svn commit: samba r22092 - in branches/SAMBA_3_0/source: libads libsmb rpc_client

[metze at samba.org]

Author: metze
Date: 2007-04-05 12:30:23 +0000 (Thu, 05 Apr 2007)
New Revision: 22092

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=22092

Log:
- make spnego_parse_auth_response() more generic and
  not specific for NTLMSSP
- it's possible that the server sends a mechOID and authdata
  if negResult != SPNEGO_NEG_RESULT_INCOMPLETE, but we still
  force the mechOID to be present if negResult == SPNEGO_NEG_RESULT_INCOMPLETE

metze
Modified:
   branches/SAMBA_3_0/source/libads/sasl.c
   branches/SAMBA_3_0/source/libsmb/cliconnect.c
   branches/SAMBA_3_0/source/libsmb/clispnego.c
   branches/SAMBA_3_0/source/rpc_client/cli_pipe.c


Changeset:
Modified: branches/SAMBA_3_0/source/libads/sasl.c
===================================================================
--- branches/SAMBA_3_0/source/libads/sasl.c	2007-04-05 11:13:25 UTC (rev 22091)
+++ branches/SAMBA_3_0/source/libads/sasl.c	2007-04-05 12:30:23 UTC (rev 22092)
@@ -114,7 +114,7 @@
 			}
 			data_blob_free(&tmp_blob);
 		} else if (rc == LDAP_SASL_BIND_IN_PROGRESS) {
-			if (!spnego_parse_auth_response(blob, nt_status, 
+			if (!spnego_parse_auth_response(blob, nt_status, OID_NTLMSSP, 
 							&blob_in)) {
 
 				ntlmssp_end(&ntlmssp_state);

Modified: branches/SAMBA_3_0/source/libsmb/cliconnect.c
===================================================================
--- branches/SAMBA_3_0/source/libsmb/cliconnect.c	2007-04-05 11:13:25 UTC (rev 22091)
+++ branches/SAMBA_3_0/source/libsmb/cliconnect.c	2007-04-05 12:30:23 UTC (rev 22092)
@@ -722,7 +722,7 @@
 			}
 			data_blob_free(&tmp_blob);
 		} else {
-			if (!spnego_parse_auth_response(blob, nt_status, 
+			if (!spnego_parse_auth_response(blob, nt_status, OID_NTLMSSP, 
 							&blob_in)) {
 				DEBUG(3,("Failed to parse auth response\n"));
 				if (NT_STATUS_IS_OK(nt_status) 

Modified: branches/SAMBA_3_0/source/libsmb/clispnego.c
===================================================================
--- branches/SAMBA_3_0/source/libsmb/clispnego.c	2007-04-05 11:13:25 UTC (rev 22091)
+++ branches/SAMBA_3_0/source/libsmb/clispnego.c	2007-04-05 12:30:23 UTC (rev 22092)
@@ -518,9 +518,10 @@
 }
 
 /*
- parse a SPNEGO NTLMSSP auth packet. This contains the encrypted passwords
+ parse a SPNEGO auth packet. This contains the encrypted passwords
 */
-BOOL spnego_parse_auth_response(DATA_BLOB blob, NTSTATUS nt_status, 
+BOOL spnego_parse_auth_response(DATA_BLOB blob, NTSTATUS nt_status,
+				const char *mechOID,
 				DATA_BLOB *auth)
 {
 	ASN1_DATA data;
@@ -541,14 +542,20 @@
 	asn1_check_enumerated(&data, negResult);
 	asn1_end_tag(&data);
 
-	if (negResult == SPNEGO_NEG_RESULT_INCOMPLETE) {
+	*auth = data_blob(NULL,0);
+
+	if (asn1_tag_remaining(&data)) {
 		asn1_start_tag(&data,ASN1_CONTEXT(1));
-		asn1_check_OID(&data, OID_NTLMSSP);
+		asn1_check_OID(&data, mechOID);
 		asn1_end_tag(&data);
-		
-		asn1_start_tag(&data,ASN1_CONTEXT(2));
-		asn1_read_OctetString(&data, auth);
-		asn1_end_tag(&data);
+
+		if (asn1_tag_remaining(&data)) {
+			asn1_start_tag(&data,ASN1_CONTEXT(2));
+			asn1_read_OctetString(&data, auth);
+			asn1_end_tag(&data);
+		}
+	} else if (negResult == SPNEGO_NEG_RESULT_INCOMPLETE) {
+		data.has_error = 1;
 	}
 
 	asn1_end_tag(&data);

Modified: branches/SAMBA_3_0/source/rpc_client/cli_pipe.c
===================================================================
--- branches/SAMBA_3_0/source/rpc_client/cli_pipe.c	2007-04-05 11:13:25 UTC (rev 22091)
+++ branches/SAMBA_3_0/source/rpc_client/cli_pipe.c	2007-04-05 12:30:23 UTC (rev 22092)
@@ -2002,7 +2002,7 @@
 	prs_copy_data_out((char *)server_spnego_response.data, rbuf, phdr->auth_len);
 
 	/* Check we got a valid auth response. */
-	if (!spnego_parse_auth_response(server_spnego_response, NT_STATUS_OK, &tmp_blob)) {
+	if (!spnego_parse_auth_response(server_spnego_response, NT_STATUS_OK, OID_NTLMSSP, &tmp_blob)) {
 		data_blob_free(&server_spnego_response);
 		data_blob_free(&tmp_blob);
 		return NT_STATUS_INVALID_PARAMETER;