Changeset 165 for branches/samba-3.0/source/libsmb/cliconnect.c

Timestamp:

Mar 11, 2009, 9:14:55 AM (16 years ago)

Author:

Paul Smedley

Message:

Add 'missing' 3.0.34 diffs

File:

• branches/samba-3.0/source/libsmb/cliconnect.c (modified) (4 diffs)

branches/samba-3.0/source/libsmb/cliconnect.c

@@ -539 +539 @@
 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
 
-static BOOL cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob, DATA_BLOB session_key_krb5)
+static BOOL cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob)
 {
         int32 remaining = blob.length;
@@ -563 +563 @@
                         remaining -= max_blob_size;
                 } else {
-                        DATA_BLOB null_blob = data_blob(NULL, 0);
-
                         send_blob.length = remaining; 
                         remaining = 0;
-
-                        /* This is the last packet in the sequence - turn signing on. */
-                        cli_simple_set_signing(cli, session_key_krb5, null_blob); 
                 }
 
@@ -617 +612 @@
         DATA_BLOB negTokenTarg;
         DATA_BLOB session_key_krb5;
+        DATA_BLOB null_blob = data_blob(NULL, 0);
+        NTSTATUS nt_status;
+        BOOL res;
         int rc;
+
+        cli_temp_set_signing(cli);
 
         DEBUG(2,("Doing kerberos session setup\n"));
@@ -634 +634 @@
 #endif
 
-        if (!cli_session_setup_blob(cli, negTokenTarg, session_key_krb5)) {
-                data_blob_free(&negTokenTarg);
-                data_blob_free(&session_key_krb5);
-                return ADS_ERROR_NT(cli_nt_error(cli));
+        if (!cli_session_setup_blob(cli, negTokenTarg)) {
+                nt_status = cli_nt_error(cli);
+                goto nt_error;
+        }
+
+        if (cli_is_error(cli)) {
+                nt_status = cli_nt_error(cli);
+                if (NT_STATUS_IS_OK(nt_status)) {
+                        nt_status = NT_STATUS_UNSUCCESSFUL;
+                }
+                goto nt_error;
         }
 
         cli_set_session_key(cli, session_key_krb5);
+
+        res = cli_simple_set_signing(cli, session_key_krb5, null_blob);
+        if (res) {
+                /* 'resign' the last message, so we get the right sequence numbers
+                   for checking the first reply from the server */
+                cli_calculate_sign_mac(cli);
+
+                if (!cli_check_sign_mac(cli)) {
+                        nt_status = NT_STATUS_ACCESS_DENIED;
+                        goto nt_error;
+                }
+        }
 
         data_blob_free(&negTokenTarg);
         data_blob_free(&session_key_krb5);
 
-        if (cli_is_error(cli)) {
-                if (NT_STATUS_IS_OK(cli_nt_error(cli))) {
-                        return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
-                }
-        } 
-        return ADS_ERROR_NT(cli_nt_error(cli));
+        return ADS_ERROR_NT(NT_STATUS_OK);
+
+nt_error:
+        data_blob_free(&negTokenTarg);
+        data_blob_free(&session_key_krb5);
+        cli->vuid = 0;
+        return ADS_ERROR_NT(nt_status);
 }
 #endif  /* HAVE_KRB5 */