svn commit: samba r2307 - in branches/SAMBA_4_0/source/libcli: auth raw

[abartlet at samba.org]

Author: abartlet
Date: 2004-09-13 04:28:10 +0000 (Mon, 13 Sep 2004)
New Revision: 2307

WebSVN: http://websvn.samba.org/websvn/changeset.php?rep=samba&path=/branches/SAMBA_4_0/source/libcli&rev=2307&nolog=1

Log:
Fix the use of 'raw' NTLMSSP to hosts that support extended security,
but do not support SPNEGO (such as XP, when not joined to a domain).

This is triggered by the presense or lack of a security blob in the
negprot reply.

Andrew Bartlett

Modified:
   branches/SAMBA_4_0/source/libcli/auth/gensec.c
   branches/SAMBA_4_0/source/libcli/auth/spnego.c
   branches/SAMBA_4_0/source/libcli/raw/clisession.c


Changeset:
Modified: branches/SAMBA_4_0/source/libcli/auth/gensec.c
===================================================================
--- branches/SAMBA_4_0/source/libcli/auth/gensec.c	2004-09-13 03:55:28 UTC (rev 2306)
+++ branches/SAMBA_4_0/source/libcli/auth/gensec.c	2004-09-13 04:28:10 UTC (rev 2307)
@@ -262,6 +262,17 @@
 }
 	
 
+const char *gensec_get_name_by_oid(const char *oid) 
+{
+	const struct gensec_security_ops *ops;
+	ops = gensec_security_by_oid(oid);
+	if (ops) {
+		return ops->name;
+	}
+	return NULL;
+}
+	
+
 /** 
  * Start a GENSEC sub-mechanism by OID, used in SPNEGO
  *

Modified: branches/SAMBA_4_0/source/libcli/auth/spnego.c
===================================================================
--- branches/SAMBA_4_0/source/libcli/auth/spnego.c	2004-09-13 03:55:28 UTC (rev 2306)
+++ branches/SAMBA_4_0/source/libcli/auth/spnego.c	2004-09-13 04:28:10 UTC (rev 2307)
@@ -290,7 +290,8 @@
 						  null_data_blob, 
 						  unwrapped_out);
 		}
-		if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(nt_status)) {
+		if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED) 
+		    && (!NT_STATUS_IS_OK(nt_status))) {
 			DEBUG(1, ("SPNEGO(%s) NEG_TOKEN_INIT failed: %s\n", 
 				  spnego_state->sub_sec_security->ops->name, nt_errstr(nt_status)));
 				gensec_end(&spnego_state->sub_sec_security);
@@ -412,7 +413,7 @@
 
 
 static NTSTATUS gensec_spnego_update(struct gensec_security *gensec_security, TALLOC_CTX *out_mem_ctx, 
-			       const DATA_BLOB in, DATA_BLOB *out) 
+				     const DATA_BLOB in, DATA_BLOB *out) 
 {
 	struct spnego_state *spnego_state = gensec_security->private_data;
 	DATA_BLOB null_data_blob = data_blob(NULL, 0);

Modified: branches/SAMBA_4_0/source/libcli/raw/clisession.c
===================================================================
--- branches/SAMBA_4_0/source/libcli/raw/clisession.c	2004-09-13 03:55:28 UTC (rev 2306)
+++ branches/SAMBA_4_0/source/libcli/raw/clisession.c	2004-09-13 04:28:10 UTC (rev 2307)
@@ -379,6 +379,7 @@
 	union smb_sesssetup s2;
 	DATA_BLOB session_key = data_blob(NULL, 0);
 	DATA_BLOB null_data_blob = data_blob(NULL, 0);
+	const char *chosen_oid;
 
 	s2.generic.level = RAW_SESSSETUP_SPNEGO;
 	s2.spnego.in.bufsize = ~0;
@@ -429,21 +430,25 @@
 		goto done;
 	}
 
-	status = gensec_start_mech_by_oid(session->gensec, OID_SPNEGO);
+	if (session->transport->negotiate.secblob.length) {
+		chosen_oid = OID_SPNEGO;
+	} else {
+		/* without a sec blob, means raw NTLMSSP */
+		chosen_oid = OID_NTLMSSP;
+	}
+
+	status = gensec_start_mech_by_oid(session->gensec, chosen_oid);
 	if (!NT_STATUS_IS_OK(status)) {
-		DEBUG(1, ("Failed to start set GENSEC client SPNEGO mechanism: %s\n",
-			  nt_errstr(status)));
+		DEBUG(1, ("Failed to start set GENSEC client SPNEGO mechanism %s: %s\n",
+			  gensec_get_name_by_oid(chosen_oid), nt_errstr(status)));
 		goto done;
 	}
-
+	
 	status = gensec_update(session->gensec, mem_ctx,
-			       session->transport->negotiate.secblob,
-			       &s2.spnego.in.secblob);
+				       session->transport->negotiate.secblob,
+				       &s2.spnego.in.secblob);
 
 	while(1) {
-		if (NT_STATUS_IS_OK(status) && s2.spnego.in.secblob.length == 0) {
-			break;
-		}
 		if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(status)) {
 			break;
 		}
@@ -455,6 +460,10 @@
 			smbcli_transport_simple_set_signing(session->transport, session_key, null_data_blob);
 		}
 		
+		if (NT_STATUS_IS_OK(status) && s2.spnego.in.secblob.length == 0) {
+			break;
+		}
+
 		session->vuid = s2.spnego.out.vuid;
 		status = smb_raw_session_setup(session, mem_ctx, &s2);
 		session->vuid = UID_FIELD_INVALID;
@@ -483,7 +492,7 @@
 		parms->generic.out.lanman = s2.spnego.out.lanman;
 		parms->generic.out.domain = s2.spnego.out.domain;
 	} else {
-		DEBUG(1, ("Failed to login with SPNEGO: %s\n", nt_errstr(status)));
+		DEBUG(1, ("Failed to login with %s: %s\n", gensec_get_name_by_oid(chosen_oid), nt_errstr(status)));
 		return status;
 	}