summaryrefslogtreecommitdiff
path: root/source3/rpc_client/cli_pipe.c
diff options
context:
space:
mode:
authorJeremy Allison <jra@samba.org>2003-04-16 15:54:00 +0000
committerJeremy Allison <jra@samba.org>2003-04-16 15:54:00 +0000
commit8f25fd3d7240a309182b32ac705634b4ff5cff2b (patch)
treebd57174391bc95b80c6b1093729507d8820e2883 /source3/rpc_client/cli_pipe.c
parent84e2fbf17cf91486c22b39ed8b11f7ba148d6fab (diff)
downloadsamba-8f25fd3d7240a309182b32ac705634b4ff5cff2b.tar.gz
samba-8f25fd3d7240a309182b32ac705634b4ff5cff2b.tar.bz2
samba-8f25fd3d7240a309182b32ac705634b4ff5cff2b.zip
Fixes to make SCHANNEL work against a W2K DC. Still need to fix
multi-PDU encode/decode with SCHANNEL. Also need to test against WNT DC. Jeremy. (This used to be commit ec82e8e9f4a6bf807a91ac265af39a516c7ab631)
Diffstat (limited to 'source3/rpc_client/cli_pipe.c')
-rw-r--r--source3/rpc_client/cli_pipe.c37
1 files changed, 24 insertions, 13 deletions
diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c
index 93c6b98bc3..a0be3d9774 100644
--- a/source3/rpc_client/cli_pipe.c
+++ b/source3/rpc_client/cli_pipe.c
@@ -193,8 +193,8 @@ static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata, int len, int
BOOL auth_seal = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SEAL) != 0);
BOOL auth_schannel = (cli->saved_netlogon_pipe_fnum != 0);
- DEBUG(5,("rpc_auth_pipe: len: %d auth_len: %d verify %s seal %s\n",
- len, auth_len, BOOLSTR(auth_verify), BOOLSTR(auth_seal)));
+ DEBUG(5,("rpc_auth_pipe: len: %d auth_len: %d verify %s seal %s schannel %s\n",
+ len, auth_len, BOOLSTR(auth_verify), BOOLSTR(auth_seal), BOOLSTR(auth_schannel)));
/*
* Unseal any sealed data in the PDU, not including the
@@ -302,16 +302,16 @@ static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata, int len, int
prs_struct auth_verf;
if (auth_len != RPC_AUTH_NETSEC_CHK_LEN) {
- DEBUG(0,("rpc_auth_pipe: wrong auth len %d\n", auth_len));
+ DEBUG(0,("rpc_auth_pipe: wrong schannel auth len %d\n", auth_len));
return False;
}
if (dp - prs_data_p(rdata) > prs_data_size(rdata)) {
- DEBUG(0,("rpc_auth_pipe: auth data > data size !\n"));
+ DEBUG(0,("rpc_auth_pipe: schannel auth data > data size !\n"));
return False;
}
- DEBUG(10,("rpc_auth_pipe: verify netsec\n"));
+ DEBUG(10,("rpc_auth_pipe: schannel verify netsec\n"));
dump_data(100, dp, auth_len);
memcpy(data, dp, sizeof(data));
@@ -324,17 +324,18 @@ static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata, int len, int
prs_give_memory(&auth_verf, data, RPC_AUTH_NETSEC_CHK_LEN, False);
- if (!smb_io_rpc_auth_netsec_chk("auth_sign", &chk, &auth_verf, 0)) {
- DEBUG(0, ("rpc_auth_pipe: unmarshalling "
+ if (!smb_io_rpc_auth_netsec_chk("schannel_auth_sign", &chk, &auth_verf, 0)) {
+ DEBUG(0, ("rpc_auth_pipe: schannel unmarshalling "
"RPC_AUTH_NETSECK_CHK failed\n"));
return False;
}
+ cli->auth_info.seq_num++;
+
if (!netsec_decode(&cli->auth_info, &chk, reply_data, data_len)) {
DEBUG(0, ("rpc_auth_pipe: Could not decode schannel\n"));
return False;
}
- cli->auth_info.seq_num++;
}
return True;
}
@@ -360,7 +361,7 @@ static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata, int len, int
+------------+-----------------+-------------+---------------+-------------+
Where the presence of the AUTH_HDR and AUTH are dependent on the
- signing & sealing being neogitated.
+ signing & sealing being negotiated.
****************************************************************************/
@@ -649,7 +650,7 @@ static BOOL create_rpc_bind_req(prs_struct *rpc_out, BOOL do_auth, BOOL do_netse
init_rpc_hdr_auth(&hdr_auth, NETSEC_AUTH_TYPE, NETSEC_AUTH_LEVEL,
0x00, 1);
- init_rpc_auth_netsec_neg(&netsec_neg, my_name, domain);
+ init_rpc_auth_netsec_neg(&netsec_neg, domain, my_name);
/*
* Use the 4k buffer to store the auth info.
@@ -1018,8 +1019,15 @@ BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num,
uchar sign[8];
prs_struct netsec_blob;
- memset(sign, 0, sizeof(sign));
- sign[4] = 0x80;
+ if ((cli->auth_info.seq_num & 1) != 0) {
+ DEBUG(0,("SCHANNEL ERROR: seq_num must be even in client (seq_num=%d)\n",
+ cli->auth_info.seq_num));
+ }
+
+ DEBUG(10,("SCHANNEL seq_num=%d\n", cli->auth_info.seq_num));
+
+ RSIVAL(sign, 0, cli->auth_info.seq_num);
+ SIVAL(sign, 4, 0x80);
if (!prs_init(&netsec_blob, send_size+auth_padding,
cli->mem_ctx, MARSHALL)) {
@@ -1047,12 +1055,15 @@ BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num,
init_rpc_auth_netsec_chk(&verf, netsec_sig, nullbytes,
sign, nullbytes);
- netsec_encode(&(cli->auth_info), &verf,
+ netsec_encode(&cli->auth_info, &verf,
prs_data_p(&netsec_blob),
prs_data_size(&netsec_blob));
prs_append_prs_data(&outgoing_packet, &netsec_blob);
prs_mem_free(&netsec_blob);
+
+ cli->auth_info.seq_num++;
+
} else {
if(!prs_append_some_prs_data(&outgoing_packet, data,
data_sent, send_size)) {