-
Notifications
You must be signed in to change notification settings - Fork 26
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Send MIC by Default #69
Comments
Now that I released 1.1 we can take a look at this. |
@simo5 Any idea how this can be fixed? I am suspecting that this is causing an issue with one of the servers we are trying to authenticate with. I would be happy to send a patch if you can help me. |
This issue is related to something I raised long back: #6 . Is the fix going to be something along those lines or something else? |
@amandeepgautam it should be easy enough, it is just a change of defaults. |
@simo5 Please pardon my ignorance, but I am not sure which defaults you refer to. In this case, as well, MIC is not always added. While the windows client seems to be adding MIC almost always. Please see the attached packet traces. attempt1_success.pcap is the attempt from the windows client. |
The code is calling gss-ntlmssp/src/gssapi_ntlmssp.h Lines 35 to 45 in 8149435
When you all
The code in libsmb2 would have to be updated to call |
Just a warning that if you use That's one of the reasons why I scrapped my experiment with using this context option in production. It is fine for testing though. |
@filipnavara we fixed that in #64 right ? |
Correct, it is fixed. Most distros still distribute version 0.7 though. |
@jborean93 thanks for explaining. @filipnavara Thanks for the heads up. We have the flexibility to update gssapi/gss-ntlmssp so we should be fine. @simo5 I did add the unconditional call to |
Currently gss-ntlmssp only adds the MIC to the authentication message if the caller has also called
gss_inquire_sec_context_by_oid(ctx, spnego_req_mechlistMIC_oid)
. This sets an internal flag that tellsgss-ntlmssp
that the caller knows enough about the library and SPNEGO to include themechListMIC
in the wrapper token. I believe that the default should have gss-ntlmssp always add the MIC regardless of this being called first. At this point in time I feel like any users ofgss-ntlmssp
will know how to reset the crypto state for themechListMIC
or even use the inquiry to determine if the MIC was set (server is new enough) rather than having to call it twice to enable the MIC as well.I know this is a complex setup so happy to look into it further if needed.
The text was updated successfully, but these errors were encountered: