r1462: GENSEC Kerberos and SPENGO work:

 - Spelling - it's SPNEGO, not SPENGO
 - SMB signing - Krb5 logins are now correctly signed
 - SPNEGO - Changes to always tell GENSEC about incoming packets, empty or not.

Andrew Bartlett
(This used to be commit cea578d6f39a2ea4a24e7a0064c95193ab6f6df7)

1 files changed, 17 insertions, 13 deletions

diff --git a/source4/libcli/raw/clisession.c b/source4/libcli/raw/clisession.c
index d420aa7cd6..5aaceb103a 100644
--- a/source4/libcli/raw/clisession.c
+++ b/source4/libcli/raw/clisession.c
@@ -260,7 +260,7 @@ static void use_nt1_session_keys(struct cli_session *session,
 	E_md4hash(password, nt_hash);
 	SMBsesskeygen_ntv1(nt_hash, session_key.data);
 
-	cli_transport_simple_set_signing(transport, session_key, *nt_response);
+	cli_transport_simple_set_signing(transport, session_key, *nt_response, 0);
 
 	cli_session_set_user_session_key(session, &session_key);
 	data_blob_free(&session_key);
@@ -381,6 +381,8 @@ static NTSTATUS smb_raw_session_setup_generic_spnego(struct cli_session *session
 {
 	NTSTATUS status;
 	union smb_sesssetup s2;
+	DATA_BLOB session_key = data_blob(NULL, 0);
+	DATA_BLOB null_data_blob = data_blob(NULL, 0);
 
 	s2.generic.level = RAW_SESSSETUP_SPNEGO;
 	s2.spnego.in.bufsize = ~0;
@@ -433,39 +435,41 @@ static NTSTATUS smb_raw_session_setup_generic_spnego(struct cli_session *session
 			       session->transport->negotiate.secblob,
 			       &s2.spnego.in.secblob);
 
-	if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-		goto done;
-	}
-
 	while(1) {
+		if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(status)) {
+			break;
+		}
+
+		status = gensec_session_key(session->gensec, &session_key);
+		if (NT_STATUS_IS_OK(status)) {
+			cli_transport_simple_set_signing(session->transport, session_key, null_data_blob, 0);
+		}
+
 		session->vuid = s2.spnego.out.vuid;
 		status = smb_raw_session_setup(session, mem_ctx, &s2);
 		session->vuid = UID_FIELD_INVALID;
 		if (!NT_STATUS_IS_OK(status) &&
 		    !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-			goto done;
+			break;
 		}
 
 		status = gensec_update(session->gensec, mem_ctx,
 				       s2.spnego.out.secblob,
 				       &s2.spnego.in.secblob);
 
-		if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-			goto done;
+		if (NT_STATUS_IS_OK(status)) {
+			break;
 		}
 	}
 
 done:
 	if (NT_STATUS_IS_OK(status)) {
-		DATA_BLOB null_data_blob = data_blob(NULL, 0);
-		DATA_BLOB session_key = data_blob(NULL, 0);
-		
 		status = gensec_session_key(session->gensec, &session_key);
 		if (!NT_STATUS_IS_OK(status)) {
 			return status;
 		}
-
-		cli_transport_simple_set_signing(session->transport, session_key, null_data_blob);
+		
+		cli_transport_simple_set_signing(session->transport, session_key, null_data_blob, 2 /* two legs on last packet */);
 
 		cli_session_set_user_session_key(session, &session_key);