sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-12 09:18:10 +03:00
Code

r15484: Make accept_security_context() more compatible with how Samba3 (and

Browse Source 
similarly built clients) behave.

This is better than just ignoring the checksum, if it isn't the GSSAPI
checksum.  (Samba4 clients in Samba3 mode use more than just the MD5
checksum, and will use a signed AES checksum if available.  Actual
samba3 may well do the same in future, against a suitable KDC).

Also a change for easier debugging of checksum issues.

Andrew Bartlett
(This used to be commit 120374f5f9)
This commit is contained in:
Andrew Bartlett 2006-05-07 09:28:49 +00:00 committed by Gerald (Jerry) Carter
parent 07767825b7
commit 1ec7132b30
3 changed files with 46 additions and 16 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

8
source4/heimdal/lib/gssapi/8003.c
View File

@ -185,13 +185,9 @@ gssapi_krb5_verify_8003_checksum(
return GSS_S_BAD_BINDINGS;
}
/* This is the case where Samba3 has built GSSAPI out of
* krb5 the 'dodgy' way. We have to accept the non-GSSAPI
* checksum because windows does */
if(cksum->cksumtype != CKSUMTYPE_GSSAPI) {
*flags = 0;
return GSS_S_COMPLETE;
*minor_status = 0;
return GSS_S_BAD_BINDINGS;
}
/* XXX should handle checksums > 24 bytes */

51
source4/heimdal/lib/gssapi/accept_sec_context.c
View File

@ -371,15 +371,48 @@ gsskrb5_acceptor_start
return ret;
}
ret = gssapi_krb5_verify_8003_checksum(minor_status,
input_chan_bindings,
authenticator->cksum,
&flags,
&(*context_handle)->fwd_data);
krb5_free_authenticator(gssapi_krb5_context, &authenticator);
if (ret) {
return ret;
}
if (authenticator->cksum->cksumtype == CKSUMTYPE_GSSAPI) {
ret = gssapi_krb5_verify_8003_checksum(minor_status,
input_chan_bindings,
authenticator->cksum,
&flags,
&(*context_handle)->fwd_data);
krb5_free_authenticator(gssapi_krb5_context, &authenticator);
if (ret) {
return ret;
}
} else {
krb5_crypto crypto;
kret = krb5_crypto_init(gssapi_krb5_context,
(*context_handle)->auth_context->keyblock,
0, &crypto);
if(kret) {
krb5_free_authenticator(gssapi_krb5_context, &authenticator);
ret = GSS_S_FAILURE;
*minor_status = kret;
gssapi_krb5_set_error_string ();
return ret;
}
/* Windows accepts Samba3's use of a kerberos,
rather than GSSAPI checksum here */
kret = krb5_verify_checksum(gssapi_krb5_context,
crypto, KRB5_KU_AP_REQ_AUTH_CKSUM, NULL, 0,
authenticator->cksum);
krb5_free_authenticator(gssapi_krb5_context, &authenticator);
if(kret) {
ret = GSS_S_FAILURE;
*minor_status = kret;
gssapi_krb5_set_error_string ();
return ret;
}
flags = GSS_C_MUTUAL_FLAG | GSS_C_REPLAY_FLAG | GSS_C_SEQUENCE_FLAG;
}
}
if(flags & GSS_C_MUTUAL_FLAG) {

3
source4/heimdal/lib/krb5/crypto.c
View File

@ -2042,7 +2042,8 @@ verify_checksum(krb5_context context,
}
keyed_checksum = (ct->flags & F_KEYED) != 0;
if(keyed_checksum && crypto == NULL) {
krb5_clear_error_string (context);
krb5_set_error_string (context, "checksum type %s is keyed, and requires a crypto context",
ct->name);
return KRB5_PROG_SUMTYPE_NOSUPP; /* XXX */
}
if(keyed_checksum)