Changeset 745 for trunk/server/source4/auth/gensec/spnego.c

Timestamp:

Nov 27, 2012, 4:43:17 PM (13 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: updated trunk to 3.6.0

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source4/auth/gensec/spnego.c (modified) (8 diffs)

trunk/server/source4/auth/gensec/spnego.c

@@ -29 +29 @@
 #include "auth/gensec/gensec.h"
 #include "auth/gensec/gensec_proto.h"
+#include "param/param.h"
 
 enum spnego_state_position {
@@ -420 +421 @@
 
         if (spnego_state->state_position == SPNEGO_SERVER_START) {
-                for (i=0; all_sec && all_sec[i].op; i++) {
-                        /* optomisitic token */
-                        if (strcmp(all_sec[i].oid, mechType[0]) == 0) {
+                uint32_t j;
+                for (j=0; mechType && mechType[j]; j++) {
+                        for (i=0; all_sec && all_sec[i].op; i++) {
                                 nt_status = gensec_subcontext_start(spnego_state,
                                                                     gensec_security,
@@ -437 +438 @@
                                         break;
                                 }
-                                
+
+                                if (j > 0) {
+                                        /* no optimistic token */
+                                        spnego_state->neg_oid = all_sec[i].oid;
+                                        *unwrapped_out = data_blob_null;
+                                        nt_status = NT_STATUS_MORE_PROCESSING_REQUIRED;
+                                        break;
+                                }
+
                                 nt_status = gensec_update(spnego_state->sub_sec_security,
                                                           out_mem_ctx, 
@@ -456 +465 @@
                                 break;
                         }
-                }
-        }
-        
-        /* Having tried any optomisitc token from the client (if we
+                        if (spnego_state->sub_sec_security) {
+                                break;
+                        }
+                }
+
+                if (!spnego_state->sub_sec_security) {
+                        DEBUG(1, ("SPNEGO: Could not find a suitable mechtype in NEG_TOKEN_INIT\n"));
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
+        }
+        
+        /* Having tried any optimistic token from the client (if we
          * were the server), if we didn't get anywhere, walk our list
          * in our preference order */
@@ -495 +512 @@
                         if (spnego_state->state_position != SPNEGO_SERVER_START) {
                                 if (NT_STATUS_EQUAL(nt_status, NT_STATUS_INVALID_PARAMETER) || 
+                                    NT_STATUS_EQUAL(nt_status, NT_STATUS_NO_LOGON_SERVERS) ||
+                                    NT_STATUS_EQUAL(nt_status, NT_STATUS_TIME_DIFFERENCE_AT_DC) ||
                                     NT_STATUS_EQUAL(nt_status, NT_STATUS_CANT_ACCESS_DOMAIN_INFO)) {
                                         /* Pretend we never started it (lets the first run find some incompatible demand) */
@@ -566 +585 @@
         DATA_BLOB unwrapped_out = data_blob(NULL, 0);
         const struct gensec_security_ops_wrapper *all_sec;
-        const char *principal = NULL;
 
         mechTypes = gensec_security_oids(gensec_security, 
@@ -633 +651 @@
                 
                 if (spnego_state->state_position == SPNEGO_SERVER_START) {
-                        /* server credentials */
-                        struct cli_credentials *creds = gensec_get_credentials(gensec_security);
-                        if (creds) {
-                                principal = cli_credentials_get_principal(creds, out_mem_ctx);
-                        }
-                }
-                if (principal) {
                         spnego_out.negTokenInit.mechListMIC
-                                = data_blob_string_const(principal);
+                                = data_blob_string_const(ADS_IGNORE_PRINCIPAL);
                 } else {
                         spnego_out.negTokenInit.mechListMIC = null_data_blob;
@@ -825 +836 @@
                 }
 
-                if (spnego.negTokenInit.targetPrincipal) {
+                if (spnego.negTokenInit.targetPrincipal
+                    && strcmp(spnego.negTokenInit.targetPrincipal, ADS_IGNORE_PRINCIPAL) != 0) {
                         DEBUG(5, ("Server claims it's principal name is %s\n", spnego.negTokenInit.targetPrincipal));
-                        gensec_set_target_principal(gensec_security, spnego.negTokenInit.targetPrincipal);
+                        if (lpcfg_client_use_spnego_principal(gensec_security->settings->lp_ctx)) {
+                                gensec_set_target_principal(gensec_security, spnego.negTokenInit.targetPrincipal);
+                        }
                 }