sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-02-14 01:57:53 +03:00
Code

always send an OID list until we handle raw (unwrapped) NTLMSSP

Browse Source 
packets in session setup
This commit is contained in:
Andrew Tridgell -
parent 8150f0f3f7
commit 3b3f8a9350
1 changed files with 15 additions and 6 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

21
source/smbd/negprot.c
View File

@ -158,10 +158,11 @@ static int negprot_spnego(char *p)
DATA_BLOB blob;
extern pstring global_myname;
uint8 guid[16];
const char *OIDs[] = {OID_NTLMSSP,
OID_KERBEROS5,
OID_KERBEROS5_OLD,
NULL};
const char *OIDs_krb5[] = {OID_NTLMSSP,
OID_KERBEROS5,
OID_KERBEROS5_OLD,
NULL};
const char *OIDs_plain[] = {OID_NTLMSSP, NULL};
char *principal;
int len;
@ -171,17 +172,25 @@ static int negprot_spnego(char *p)
safe_strcpy((char *)guid, global_myname, 16);
strlower((char *)guid);
#if 0
/* strangely enough, NT does not sent the single OID NTLMSSP when
not a ADS member, it sends no OIDs at all */
not a ADS member, it sends no OIDs at all
we can't do this until we teach our sesssion setup parser to know
about raw NTLMSSP (clients send no ASN.1 wrapping if we do this)
*/
if (lp_security() != SEC_ADS) {
memcpy(p, guid, 16);
return 16;
}
#endif
/* win2000 uses host$@REALM, which we will probably use eventually,
but for now this works */
asprintf(&principal, "HOST/%s@%s", guid, lp_realm());
blob = spnego_gen_negTokenInit(guid, OIDs, principal);
blob = spnego_gen_negTokenInit(guid,
lp_security()==SEC_ADS ? OIDs_krb5 : OIDs_plain,
principal);
free(principal);
memcpy(p, blob.data, blob.length);