diff options
| author | Jeremy Allison <jra@samba.org> | 2008-02-14 18:07:27 -0800 |
|---|---|---|
| committer | Jeremy Allison <jra@samba.org> | 2008-02-14 18:07:27 -0800 |
| commit | 81d6133b0363be3736e60d8336a90129d67d7e4a (patch) | |
| tree | 22e2be0130359308fc06ba094c6fff26790100a9 /source3/smbd | |
| parent | 0a89940df5255a3921f81721a627610967fe2698 (diff) | |
| download | samba-81d6133b0363be3736e60d8336a90129d67d7e4a.tar.gz samba-81d6133b0363be3736e60d8336a90129d67d7e4a.tar.bz2 samba-81d6133b0363be3736e60d8336a90129d67d7e4a.zip | |
Currently we don't SPNEGO negotiate back to NTLMSSP. Note this.
Jeremy.
(This used to be commit 8cd04b948bfba3896d40c9e314a197f60ad76833)
Diffstat (limited to 'source3/smbd')
| -rw-r--r-- | source3/smbd/seal.c | 20 |
1 files changed, 16 insertions, 4 deletions
diff --git a/source3/smbd/seal.c b/source3/smbd/seal.c index ea017e08d8..d4394e5bca 100644 --- a/source3/smbd/seal.c +++ b/source3/smbd/seal.c @@ -496,12 +496,15 @@ static NTSTATUS srv_enc_spnego_negotiate(connection_struct *conn, srv_free_encryption_context(&partial_srv_trans_enc_ctx); + if (got_kerberos_mechanism) { #if defined(HAVE_GSSAPI) && defined(HAVE_KRB5) - if (got_kerberos_mechanism && lp_use_kerberos_keytab() ) { status = srv_enc_spnego_gss_negotiate(ppdata, p_data_size, secblob); - } else +#else + /* Currently we don't SPNEGO negotiate + * back to NTLMSSP as we do in sessionsetupX. We should... */ + return NT_STATUS_LOGON_FAILURE; #endif - { + } else { status = srv_enc_ntlm_negotiate(ppdata, p_data_size, secblob, true); } @@ -558,7 +561,16 @@ static NTSTATUS srv_enc_spnego_ntlm_auth(connection_struct *conn, status = auth_ntlmssp_update(ec->auth_ntlmssp_state, auth, &auth_reply); data_blob_free(&auth); - response = spnego_gen_auth_response(&auth_reply, status, OID_NTLMSSP); + /* From RFC4178. + * + * supportedMech + * + * This field SHALL only be present in the first reply from the + * target. + * So set mechOID to NULL here. + */ + + response = spnego_gen_auth_response(&auth_reply, status, NULL); data_blob_free(&auth_reply); if (NT_STATUS_IS_OK(status)) { |