git.samba.org
/
samba.git
/ commitdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
| commitdiff |
tree
raw
|
patch
|
inline
| side by side (parent:
e65164f
)
Found by Guenther - fix up our fallback paths from krb5 to NTLMSSP when using SMB2.
author
Jeremy Allison
<jra@samba.org>
Thu, 3 Jun 2010 18:18:11 +0000
(11:18 -0700)
committer
Jeremy Allison
<jra@samba.org>
Thu, 3 Jun 2010 18:18:11 +0000
(11:18 -0700)
Jeremy.
source3/smbd/smb2_sesssetup.c
patch
|
blob
|
history
diff --git
a/source3/smbd/smb2_sesssetup.c
b/source3/smbd/smb2_sesssetup.c
index 88454c122270d4ea82acb87e20b8ed53ee8d405f..757618ea2d2aed03696c0dbfd562a40a5b9e36be 100644
(file)
--- a/
source3/smbd/smb2_sesssetup.c
+++ b/
source3/smbd/smb2_sesssetup.c
@@
-553,15
+553,25
@@
static NTSTATUS smbd_smb2_spnego_negotiate(struct smbd_smb2_session *session,
}
#endif
}
#endif
- /* Fall back to NTLMSSP. */
- status = auth_ntlmssp_start(&session->auth_ntlmssp_state);
- if (!NT_STATUS_IS_OK(status)) {
- goto out;
- }
+ if (kerb_mech) {
+ /* The mechtoken is a krb5 ticket, but
+ * we need to fall back to NTLM. */
- status = auth_ntlmssp_update(session->auth_ntlmssp_state,
- secblob_in,
- &chal_out);
+ DEBUG(3,("smb2: Got krb5 ticket in SPNEGO "
+ "but set to downgrade to NTLMSSP\n"));
+
+ status = NT_STATUS_MORE_PROCESSING_REQUIRED;
+ } else {
+ /* Fall back to NTLMSSP. */
+ status = auth_ntlmssp_start(&session->auth_ntlmssp_state);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto out;
+ }
+
+ status = auth_ntlmssp_update(session->auth_ntlmssp_state,
+ secblob_in,
+ &chal_out);
+ }
if (!NT_STATUS_IS_OK(status) &&
!NT_STATUS_EQUAL(status,
if (!NT_STATUS_IS_OK(status) &&
!NT_STATUS_EQUAL(status,
@@
-744,6
+754,17
@@
static NTSTATUS smbd_smb2_spnego_auth(struct smbd_smb2_session *session,
SAFE_FREE(kerb_mech);
return NT_STATUS_LOGON_FAILURE;
}
SAFE_FREE(kerb_mech);
return NT_STATUS_LOGON_FAILURE;
}
+
+ data_blob_free(&secblob_in);
+ }
+
+ if (session->auth_ntlmssp_state == NULL) {
+ status = auth_ntlmssp_start(&session->auth_ntlmssp_state);
+ if (!NT_STATUS_IS_OK(status)) {
+ data_blob_free(&auth);
+ TALLOC_FREE(session);
+ return status;
+ }
}
status = auth_ntlmssp_update(session->auth_ntlmssp_state,
}
status = auth_ntlmssp_update(session->auth_ntlmssp_state,