From cd52919c0c1615a832d03b03eb82cfe448ba152c Mon Sep 17 00:00:00 2001 From: Erik Geiser Date: Thu, 23 Apr 2026 09:57:36 +0200 Subject: [PATCH] Small fixes --- .golangci.yml | 1 - credentials.go | 4 ++-- dcerpcauth/dcerpcauth.go | 8 ++++++-- ldapauth/gssapi.go | 2 +- ldapauth/ldap.go | 14 ++++++++------ options.go | 2 +- pkinit/asrep.go | 8 ++++---- pkinit/diffie_hellman.go | 4 ++-- 8 files changed, 24 insertions(+), 19 deletions(-) diff --git a/.golangci.yml b/.golangci.yml index c6bf1be..3039460 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -28,7 +28,6 @@ linters: - goheader - gosec - gomodguard - - goprintffuncname - gosmopolitan - govet - grouper diff --git a/credentials.go b/credentials.go index 0482fc5..4f27c41 100644 --- a/credentials.go +++ b/credentials.go @@ -43,7 +43,7 @@ type Credential struct { // PasswordIsEmptyString is true when an empty Password field should not be // interpreted as a missing password but as a password that happens to be // empty. - PasswordIsEmtpyString bool + PasswordIsEmptyString bool // CCacheIsFromEnv indicates whether the CCache was set explicitly or // implicitly through an environment variable. CCacheIsFromEnv bool @@ -83,7 +83,7 @@ func CredentialFromPFXBytes( rsaKey, ok := key.(*rsa.PrivateKey) if !ok { - return nil, fmt.Errorf("PFX key is not an RSA private key but %T", rsaKey) + return nil, fmt.Errorf("PFX key is not an RSA private key but %T", key) } cred.ClientCert = cert diff --git a/dcerpcauth/dcerpcauth.go b/dcerpcauth/dcerpcauth.go index b5212fe..795de61 100644 --- a/dcerpcauth/dcerpcauth.go +++ b/dcerpcauth/dcerpcauth.go @@ -163,10 +163,14 @@ func DCERPCCredentials(ctx context.Context, creds *adauth.Credential, options *O options.debug("Authenticating with NT hash") return credential.NewFromNTHash(creds.LogonNameWithUpperCaseDomain(), creds.NTHash), nil - case creds.PasswordIsEmtpyString: + case creds.PasswordIsEmptyString: options.debug("Authenticating with empty password") - return credential.NewFromPassword(strings.ToUpper(creds.Domain)+`\`+creds.Username, ""), nil + return credential.NewFromPassword( + strings.ToUpper(creds.Domain)+`\`+creds.Username, + "", + credential.AllowEmptyPassword(), + ), nil case creds.ClientCert != nil: options.debug("Authenticating with client certificate (PKINIT)") diff --git a/ldapauth/gssapi.go b/ldapauth/gssapi.go index 2874748..684f4d3 100644 --- a/ldapauth/gssapi.go +++ b/ldapauth/gssapi.go @@ -254,7 +254,7 @@ func (client *gssapiClient) InitSecContextWithOptions( } if token.IsKRBError() { - return nil, !false, token.KRBError + return nil, true, token.KRBError } return make([]byte, 0), !completed, nil diff --git a/ldapauth/ldap.go b/ldapauth/ldap.go index d7d6eaa..f0082a3 100644 --- a/ldapauth/ldap.go +++ b/ldapauth/ldap.go @@ -162,6 +162,8 @@ func connect(ctx context.Context, target *adauth.Target, opts *Options) (conn *l err = tlsConn.HandshakeContext(ctx) if err != nil { + _ = tcpConn.Close() + return nil, err } @@ -217,9 +219,9 @@ func bind( switch { case opts.SimpleBind: switch { - case creds.Password == "" && !creds.PasswordIsEmtpyString: + case creds.Password == "" && !creds.PasswordIsEmptyString: return fmt.Errorf("specify a password for simple bind or -p '' for an unauthenticated simple bind") - case creds.Password == "" && creds.PasswordIsEmtpyString: + case creds.Password == "" && creds.PasswordIsEmptyString: opts.Debug("using unauthenticated simple bind") default: opts.Debug("authenticating with simple bind") @@ -228,7 +230,7 @@ func bind( _, err = conn.SimpleBind(&ldap.SimpleBindRequest{ Username: creds.UPN(), Password: creds.Password, - AllowEmptyPassword: creds.PasswordIsEmtpyString, + AllowEmptyPassword: creds.PasswordIsEmptyString, }) if err != nil { return fmt.Errorf("simple bind: %w", err) @@ -236,7 +238,7 @@ func bind( case !target.UseKerberos && creds.ClientCert == nil: opts.Debug("authenticating using NTLM bind") - if !creds.PasswordIsEmtpyString && (creds.Password == "" && creds.NTHash == "") { + if !creds.PasswordIsEmptyString && (creds.Password == "" && creds.NTHash == "") { return fmt.Errorf("no credentials available for NTLM") } @@ -245,7 +247,7 @@ func bind( Username: creds.Username, Password: creds.Password, Hash: creds.NTHash, - AllowEmptyPassword: creds.PasswordIsEmtpyString, + AllowEmptyPassword: creds.PasswordIsEmptyString, } tlsState, ok := conn.TLSConnectionState() @@ -347,7 +349,7 @@ func kerberosClient( } switch { - case creds.Password != "" || creds.PasswordIsEmtpyString: + case creds.Password != "" || creds.PasswordIsEmptyString: opts.Debug("authenticating using GSSAPI bind (password)") authClient = &gssapiClient{ diff --git a/options.go b/options.go index 76475a7..1a2164f 100644 --- a/options.go +++ b/options.go @@ -279,7 +279,7 @@ func (opts *Options) preliminaryCredential() (*Credential, error) { AESKey: aesKey, CCache: ccache, dc: opts.DomainController, - PasswordIsEmtpyString: opts.Password == "" && (opts.flagset != nil && opts.flagset.Changed("password")), + PasswordIsEmptyString: opts.Password == "" && (opts.flagset != nil && opts.flagset.Changed("password")), CCacheIsFromEnv: opts.CCache != "" && (opts.flagset != nil && !opts.flagset.Changed("ccache")), Resolver: opts.Resolver, } diff --git a/pkinit/asrep.go b/pkinit/asrep.go index dcd5fed..ac4f3af 100644 --- a/pkinit/asrep.go +++ b/pkinit/asrep.go @@ -85,15 +85,15 @@ func ExtractNegotiatedKey( return ekey, fmt.Errorf("unmarshal key info: %w", err) } - if len(keyInfo.SubjectPublicKey.Bytes) < 7 { - return ekey, fmt.Errorf("public key is too short") - } - pubkeyData, err := asn1.Marshal(keyInfo.SubjectPublicKey) if err != nil { return ekey, fmt.Errorf("marshal public key: %w", err) } + if len(pubkeyData) < 7 { + return ekey, fmt.Errorf("public key is too short") + } + pubKey := big.NewInt(0) pubKey.SetBytes(pubkeyData[7:]) diff --git a/pkinit/diffie_hellman.go b/pkinit/diffie_hellman.go index b55afee..01dc130 100644 --- a/pkinit/diffie_hellman.go +++ b/pkinit/diffie_hellman.go @@ -7,9 +7,9 @@ import ( ) var ( - // DiffieHellmanPrime is the Diffie Hellman prime (P) that is acccepted by PKINIT. + // DiffieHellmanPrime is the Diffie Hellman prime (P) that is accepted by PKINIT. DiffieHellmanPrime = big.NewInt(0) - // DiffieHellmanPrime is the Diffie Hellman base (G) that is acccepted by PKINIT. + // DiffieHellmanBase is the Diffie Hellman base (G) that is accepted by PKINIT. DiffieHellmanBase = big.NewInt(2) )