idra/gss-ntlmssp.git
10 years agoAdd support for NTLMv1 Signing and Sealing v1crypto
Simo Sorce [Tue, 22 Oct 2013 15:50:13 +0000 (11:50 -0400)]
Add support for NTLMv1 Signing and Sealing

Including tests to verify conformance to MS-NLMP

10 years agoAdd CRC32 function using Zlib's crc32
Simo Sorce [Sat, 19 Oct 2013 18:59:03 +0000 (14:59 -0400)]
Add CRC32 function using Zlib's crc32

10 years agoRelease 0.2.0 v0.2.0
Simo Sorce [Fri, 18 Oct 2013 21:55:02 +0000 (17:55 -0400)]
Release 0.2.0

10 years agoTest connectionless contexts connectionless
Simo Sorce [Thu, 17 Oct 2013 15:37:47 +0000 (11:37 -0400)]
Test connectionless contexts

10 years agoSupport connectionless signing and sealing.
Simo Sorce [Thu, 17 Oct 2013 04:57:55 +0000 (00:57 -0400)]
Support connectionless signing and sealing.

In connectionless mode (GSS_C_DATAGRAM_FLAG on) sealing keys
ust be rotated for each message.

10 years agoAdd way to set sequence numbres.
Simo Sorce [Thu, 17 Oct 2013 01:51:16 +0000 (21:51 -0400)]
Add way to set sequence numbres.

In NTLMSSP connectionless mode applications are supposed to provide the
sequence number, however GSSAPI's get_mic and verify_mic functions do
not allow to pass an explicit sequence number.

Allow to override the context sequence numbers using a custom oid and
implemnting gss_set_sec_context_option()

Allows the operation only if the context is in connectionless mode.

10 years agoAdd support for connectionless mode
Simo Sorce [Wed, 16 Oct 2013 15:04:30 +0000 (11:04 -0400)]
Add support for connectionless mode

This needs a new GSSAPI flag, for now grab a number and define
GSS_C_DATAGRAM_FLAG ourselves.

10 years agoAdd public devel header file
Simo Sorce [Wed, 16 Oct 2013 21:59:35 +0000 (17:59 -0400)]
Add public devel header file

This contains definitions for various OIDs and flags needed to
implemented non-standard features like NTLMSSP Connectionless mode.

10 years agoAdd special case for enterprise names
Simo Sorce [Fri, 18 Oct 2013 18:45:50 +0000 (14:45 -0400)]
Add special case for enterprise names

When enterprise names are used they need to be passed with the embedded
'@' signed escaped with a '\', when that is done the whole name is used
as the user name and the name is not split on the @ or \ characters.

These forms are now supported:

foo
    USERNAME: foo
    DOMAIN: <null>

BAR\foo
    USERNAME: foo
    DOMAIN: BAR

foo@BAR
    USERNAME: foo
    DOMAIN: BAR

foo\@bar.example.com
    USERNAME: foo\@bar.example.com
    DOMAIN: <null>

10 years agoTreat NO OID as GSS_C_NT_USER_NAME on import
Simo Sorce [Fri, 18 Oct 2013 18:54:25 +0000 (14:54 -0400)]
Treat NO OID as GSS_C_NT_USER_NAME on import

10 years agoFix potential segfault condition in RC4_FREE
Simo Sorce [Thu, 17 Oct 2013 04:53:17 +0000 (00:53 -0400)]
Fix potential segfault condition in RC4_FREE

10 years agoFix generation of signing keys and add tests
Simo Sorce [Thu, 17 Oct 2013 15:26:49 +0000 (11:26 -0400)]
Fix generation of signing keys and add tests

10 years agoFix symbols export regex to include gssspi_ too.
Simo Sorce [Fri, 18 Oct 2013 13:00:02 +0000 (09:00 -0400)]
Fix symbols export regex to include gssspi_ too.

Thanks to David Woodhouse for finding out.

10 years agoTest acquire_cred_with_password
Simo Sorce [Thu, 17 Oct 2013 06:07:33 +0000 (02:07 -0400)]
Test acquire_cred_with_password

10 years agoAdd support for gss_acquire_cred_with_password()
Simo Sorce [Wed, 16 Oct 2013 17:10:38 +0000 (13:10 -0400)]
Add support for gss_acquire_cred_with_password()

10 years agoFix handling of NULL domain
Simo Sorce [Wed, 16 Oct 2013 17:36:23 +0000 (13:36 -0400)]
Fix handling of NULL domain

Fix segafult in NTOWFv2. When domain is NULL it is just omitted from the
NTOWFv2 computation.

Fix segfault in accept_sec_context, just make dom_name be an empty string.

Fix also memory leaks.

10 years agoFix acquiring creds via cred_store
Simo Sorce [Wed, 16 Oct 2013 17:05:52 +0000 (13:05 -0400)]
Fix acquiring creds via cred_store

Make sure to set the cred type and copy in the name.

10 years agoStreamline spec file.
Simo Sorce [Mon, 14 Oct 2013 21:19:52 +0000 (17:19 -0400)]
Streamline spec file.

Fixes as requested by Fedora review

10 years agoBump up version number afeter 0.1.0 release
Simo Sorce [Thu, 17 Oct 2013 05:25:20 +0000 (01:25 -0400)]
Bump up version number afeter 0.1.0 release

10 years agoCorrect upstream page in spec
Simo Sorce [Mon, 14 Oct 2013 13:53:51 +0000 (09:53 -0400)]
Correct upstream page in spec

10 years agoMake version 0.1.0 v0.1.0
Simo Sorce [Sun, 13 Oct 2013 16:41:13 +0000 (12:41 -0400)]
Make version 0.1.0

10 years agoFix typos in README.txt
Simo Sorce [Sun, 13 Oct 2013 16:38:59 +0000 (12:38 -0400)]
Fix typos in README.txt

10 years agoAdd more tests.
Simo Sorce [Thu, 22 Aug 2013 02:48:22 +0000 (22:48 -0400)]
Add more tests.

Cover gss_inquire_context and gss_display_name implementations.

10 years agoAdd gss_display_name implementation
Simo Sorce [Thu, 22 Aug 2013 02:35:17 +0000 (22:35 -0400)]
Add gss_display_name implementation

10 years agoAdd implementation of gss_inquire_context
Simo Sorce [Thu, 22 Aug 2013 02:05:45 +0000 (22:05 -0400)]
Add implementation of gss_inquire_context

Also add source and target names to the context.

10 years agoTest Integrity and Confidentiality
Simo Sorce [Mon, 19 Aug 2013 01:01:35 +0000 (21:01 -0400)]
Test Integrity and Confidentiality

10 years agoAdd integrity and confidentiality functions
Simo Sorce [Sun, 18 Aug 2013 05:04:30 +0000 (01:04 -0400)]
Add integrity and confidentiality functions

10 years agoAdd testsing of gssntlm mechglue functions
Simo Sorce [Sat, 27 Jul 2013 22:11:54 +0000 (18:11 -0400)]
Add testsing of gssntlm mechglue functions

10 years agoBasic implementation of accept_sec_context
Simo Sorce [Sat, 27 Jul 2013 17:57:56 +0000 (13:57 -0400)]
Basic implementation of accept_sec_context

For now works only for satndalone server with access to a password file.

10 years agoAdd support for server credentials
Simo Sorce [Sat, 27 Jul 2013 22:37:51 +0000 (18:37 -0400)]
Add support for server credentials

10 years agoAdd helper to copy names and gss_duplicate_name
Simo Sorce [Sat, 27 Jul 2013 20:46:42 +0000 (16:46 -0400)]
Add helper to copy names and gss_duplicate_name

10 years agoInternal release name
Simo Sorce [Sat, 27 Jul 2013 19:37:05 +0000 (15:37 -0400)]
Internal release name

10 years agoHelper function to check lm compatibility level
Simo Sorce [Sat, 27 Jul 2013 17:51:52 +0000 (13:51 -0400)]
Helper function to check lm compatibility level

Also stop associating it with th creds struct.

10 years agoFix message type check
Simo Sorce [Sun, 21 Jul 2013 16:59:44 +0000 (12:59 -0400)]
Fix message type check

10 years agoAdd gss_context_time() implementation
Simo Sorce [Sun, 21 Jul 2013 05:55:22 +0000 (01:55 -0400)]
Add gss_context_time() implementation

10 years agoHelper function to check security context validity
Simo Sorce [Sun, 21 Jul 2013 06:01:59 +0000 (02:01 -0400)]
Helper function to check security context validity

10 years agoAdd expiration time checks
Simo Sorce [Sun, 21 Jul 2013 05:43:54 +0000 (01:43 -0400)]
Add expiration time checks

Check Maxlife for challenge response messages.
Also add a Maximum lifetime for the context itself based on the
same challene/response maximum life.

According to MS-NLMP MaxLifetime is 36h on modern Windows OSs, use
the same for now.

10 years agoAdd Credential Store support
Simo Sorce [Sun, 21 Jul 2013 04:57:25 +0000 (00:57 -0400)]
Add Credential Store support

This allows a program to feed crdentials directly to GSSAPI from a
configuration file, or other means.

10 years agoFix some comments
Simo Sorce [Sat, 20 Jul 2013 17:01:04 +0000 (13:01 -0400)]
Fix some comments

10 years agoFix target_info length calculation
Simo Sorce [Sun, 28 Jul 2013 17:15:47 +0000 (13:15 -0400)]
Fix target_info length calculation

The size of the AV filed itself was missing for each field resulting in a
shorter than needed buffer size.

10 years agoAlways request NTLMSSP_REQUEST_TARGET
Simo Sorce [Fri, 19 Jul 2013 16:03:22 +0000 (12:03 -0400)]
Always request NTLMSSP_REQUEST_TARGET

Otherwise Windows 2003 may not return a target_info field for NTLMv2 or a
server name for NTLMv1 in the challenge message.

Thanks to David Woodhouse for providing help to debug this issue.

10 years agoAdd README.txt with section on Testing
Simo Sorce [Fri, 19 Jul 2013 02:36:58 +0000 (22:36 -0400)]
Add README.txt with section on Testing

10 years agoAdd NTLMv1 support to context initialization
Simo Sorce [Thu, 18 Jul 2013 20:23:36 +0000 (16:23 -0400)]
Add NTLMv1 support to context initialization

10 years agoAdd NTLM Crypto support functions for NTLMv1
Simo Sorce [Wed, 17 Jul 2013 07:20:16 +0000 (03:20 -0400)]
Add NTLM Crypto support functions for NTLMv1

10 years agoAdd basic NTLMv2 crypto tests
Simo Sorce [Tue, 16 Jul 2013 12:34:47 +0000 (08:34 -0400)]
Add basic NTLMv2 crypto tests

10 years agoImplement basic naming functions
Simo Sorce [Sun, 14 Jul 2013 18:38:59 +0000 (14:38 -0400)]
Implement basic naming functions

10 years agoImplement credential handling
Simo Sorce [Tue, 9 Jul 2013 03:27:39 +0000 (23:27 -0400)]
Implement credential handling

10 years agoInitial GSS Mechanism code.
Simo Sorce [Sun, 23 Jun 2013 16:02:47 +0000 (12:02 -0400)]
Initial GSS Mechanism code.

Implements init sec context and basic mechanism initialization.

10 years agoNTLM Crypto functions
Simo Sorce [Thu, 4 Jul 2013 20:37:12 +0000 (16:37 -0400)]
NTLM Crypto functions

Adds crypto function helpers needed by NTLM authentication

10 years agoInitial NTLM message parsing library
Simo Sorce [Sun, 23 Jun 2013 16:20:44 +0000 (12:20 -0400)]
Initial NTLM message parsing library

Implements functions to encode/decode NTLMSSP packets

10 years agoInitial .gitignore file
Simo Sorce [Wed, 26 Jun 2013 02:36:35 +0000 (22:36 -0400)]
Initial .gitignore file

10 years agoScheleton to start bulding the GSS-NTLMSSP project.
Simo Sorce [Sat, 22 Jun 2013 20:16:00 +0000 (16:16 -0400)]
Scheleton to start bulding the GSS-NTLMSSP project.