Changeset 232 for branches/samba-3.2.x/source/libsmb/cliconnect.c

Timestamp:

May 27, 2009, 9:09:42 AM (16 years ago)

Author:

Herwig Bauernfeind

Message:

Update 3.2 branch to 3.2.8

File:

• branches/samba-3.2.x/source/libsmb/cliconnect.c (modified) (4 diffs)

branches/samba-3.2.x/source/libsmb/cliconnect.c

@@ -537 +537 @@
 #define BASE_SESSSETUP_BLOB_PACKET_SIZE (35 + 24 + 22)
 
-static bool cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob, DATA_BLOB session_key_krb5)
+static bool cli_session_setup_blob(struct cli_state *cli, DATA_BLOB blob)
 {
         int32 remaining = blob.length;
@@ -561 +561 @@
                         remaining -= max_blob_size;
                 } else {
-                        DATA_BLOB null_blob = data_blob_null;
-
                         send_blob.length = remaining; 
                         remaining = 0;
-
-                        /* This is the last packet in the sequence - turn signing on. */
-                        cli_simple_set_signing(cli, session_key_krb5, null_blob); 
                 }
 
@@ -615 +610 @@
         DATA_BLOB negTokenTarg;
         DATA_BLOB session_key_krb5;
+        NTSTATUS nt_status;
         int rc;
+
+        cli_temp_set_signing(cli);
 
         DEBUG(2,("Doing kerberos session setup\n"));
@@ -632 +630 @@
 #endif
 
-        if (!cli_session_setup_blob(cli, negTokenTarg, session_key_krb5)) {
-                data_blob_free(&negTokenTarg);
-                data_blob_free(&session_key_krb5);
-                return ADS_ERROR_NT(cli_nt_error(cli));
+        if (!cli_session_setup_blob(cli, negTokenTarg)) {
+                nt_status = cli_nt_error(cli);
+                goto nt_error;
+        }
+
+        if (cli_is_error(cli)) {
+                nt_status = cli_nt_error(cli);
+                if (NT_STATUS_IS_OK(nt_status)) {
+                        nt_status = NT_STATUS_UNSUCCESSFUL;
+                }
+                goto nt_error;
         }
 
         cli_set_session_key(cli, session_key_krb5);
+
+        if (cli_simple_set_signing(
+                    cli, session_key_krb5, data_blob_null)) {
+
+                /* 'resign' the last message, so we get the right sequence numbers
+                   for checking the first reply from the server */
+                cli_calculate_sign_mac(cli, cli->outbuf);
+
+                if (!cli_check_sign_mac(cli, cli->inbuf)) {
+                        nt_status = NT_STATUS_ACCESS_DENIED;
+                        goto nt_error;
+                }
+        }
 
         data_blob_free(&negTokenTarg);
         data_blob_free(&session_key_krb5);
 
-        if (cli_is_error(cli)) {
-                if (NT_STATUS_IS_OK(cli_nt_error(cli))) {
-                        return ADS_ERROR_NT(NT_STATUS_UNSUCCESSFUL);
-                }
-        } 
-        return ADS_ERROR_NT(cli_nt_error(cli));
+        return ADS_ERROR_NT(NT_STATUS_OK);
+
+nt_error:
+        data_blob_free(&negTokenTarg);
+        data_blob_free(&session_key_krb5);
+        cli->vuid = 0;
+        return ADS_ERROR_NT(nt_status);
 }
 #endif  /* HAVE_KRB5 */