Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Make sending only filled MsvAvFlags field for CHALLENGE message #98

Merged
merged 1 commit into from
Feb 27, 2024

Conversation

FeoOne
Copy link
Contributor

@FeoOne FeoOne commented Feb 24, 2024

I encountered a problem due to which MIC code verification on the server side in the gss-ntlmssp library consistently fails.
NTLM authentication used to implement DCE/RPC between Windows client and Linux server.

Environment
Client: Windows 10 22H2, standard MSRPC API.
Server: various Debian and RedHat based distributives, MIT Kerberos 5, gss-ntlmssp 1.2.

Experimentally, it was possible to establish that if there is no empty MsvAvFlags field (with a value of 0) in the TargetInfo list in the CHALLENGE message, the MIC hashes begins to match. The specification does not indicate that this field is required and there is an indirect indication that it may be missing in section 3.1.5.1.2:

If there is an AV_PAIR structure (section 2.2.2.1) with the AvId field set to MsvAvFlags, ... else ...

Apparently, Windows does not take this field into account when calculating MIC code that is transmitted in the AUTHENTICATE message.

@simo5
Copy link
Collaborator

simo5 commented Feb 26, 2024

Ohh this is a pretty good catch, I have been chasing this kind of issue for a while, but me and others could not figure out what was going on.

@FeoOne Could you please sign your commit so I can merge?

@FeoOne
Copy link
Contributor Author

FeoOne commented Feb 27, 2024

Yeah, this problem also gave us a lot of headaches. I hope this is a fix for the root cause, but so far tests are showing positive results.

Commit signed, thank you!

@simo5 simo5 merged commit 7134b95 into gssapi:main Feb 27, 2024
12 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants