Changeset 596 for trunk/server/source3/libsmb/clikrb5.c

Timestamp:

Jul 2, 2011, 3:35:33 PM (14 years ago)

Author:

Herwig Bauernfeind

Message:

Samba 3.5: Update trunk to 3.5.8

File:

• trunk/server/source3/libsmb/clikrb5.c (modified) (4 diffs)

trunk/server/source3/libsmb/clikrb5.c

@@ -697 +697 @@
         SIVAL(gss_cksum, 0, GSSAPI_BNDLENGTH);
 
-        /* Precalculated MD5sum of NULL channel bindings (20 bytes) */
-        /* Channel bindings are: (all ints encoded as little endian)
-
-                [4 bytes] initiator_addrtype (255 for null bindings)
-                [4 bytes] initiator_address length
-                        [n bytes] .. initiator_address data - not present
-                                     in null bindings.
-                [4 bytes] acceptor_addrtype (255 for null bindings)
-                [4 bytes] acceptor_address length
-                        [n bytes] .. acceptor_address data - not present
-                                     in null bindings.
-                [4 bytes] application_data length
-                        [n bytes] .. application_ data - not present
-                                     in null bindings.
-                MD5 of this is ""\x14\x8f\x0c\xf7\xb1u\xdey*J\x9a%\xdfV\xc5\x18"
-        */
-
-        memcpy(&gss_cksum[4],
-                "\x14\x8f\x0c\xf7\xb1u\xdey*J\x9a%\xdfV\xc5\x18",
-                GSSAPI_BNDLENGTH);
+        /*
+         * GSS_C_NO_CHANNEL_BINDINGS means 16 zero bytes.
+         * This matches the behavior of heimdal and mit.
+         *
+         * And it is needed to work against some closed source
+         * SMB servers.
+         *
+         * See bug #7883
+         */
+        memset(&gss_cksum[4], 0x00, GSSAPI_BNDLENGTH);
 
         SIVAL(gss_cksum, 20, gss_flags);
@@ -833 +823 @@
         }
 
-#if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY)
+#if defined(TKT_FLG_OK_AS_DELEGATE ) && defined(HAVE_KRB5_FWD_TGT_CREDS) && defined(HAVE_KRB5_AUTH_CON_SETUSERUSERKEY) && defined(KRB5_AUTH_CONTEXT_USE_SUBKEY) && defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE)
         if( credsp->ticket_flags & TKT_FLG_OK_AS_DELEGATE ) {
                 /* Fetch a forwarded TGT from the KDC so that we can hand off a 2nd ticket
@@ -895 +885 @@
                 }
         }
-#endif
 
         /* Frees and reallocates in_data into a GSS checksum blob. */
@@ -903 +892 @@
         }
 
-#if defined(HAVE_KRB5_AUTH_CON_SET_REQ_CKSUMTYPE)
         /* We always want GSS-checksum types. */
         retval = krb5_auth_con_set_req_cksumtype(context, *auth_context, GSSAPI_CHECKSUM );