#include "messages.h"
#include "smbprofile.h"
#include "../libcli/security/security.h"
+#include "auth/gensec/gensec.h"
/* For split krb5 SPNEGO blobs. */
struct pending_auth_data {
struct smbd_server_connection *sconn = req->sconn;
if (NT_STATUS_IS_OK(nt_status)) {
- nt_status = auth_ntlmssp_steal_session_info(talloc_tos(),
+ nt_status = auth_ntlmssp_session_info(talloc_tos(),
(*auth_ntlmssp_state), &session_info);
}
return;
}
- if (blob1.data[0] == ASN1_APPLICATION(0)) {
-
- /* its a negTokenTarg packet */
-
- reply_spnego_negotiate(req, vuid, blob1,
- &vuser->auth_ntlmssp_state);
- data_blob_free(&blob1);
- return;
- }
-
- if (blob1.data[0] == ASN1_CONTEXT(1)) {
-
- /* its a auth packet */
-
- reply_spnego_auth(req, vuid, blob1,
- &vuser->auth_ntlmssp_state);
- data_blob_free(&blob1);
- return;
- }
-
- if (blob1.length > 7 && strncmp((char *)(blob1.data), "NTLMSSP", 7) == 0) {
+ /* Handle either raw NTLMSSP or hand off the whole blob to
+ * GENSEC. The processing at this layer is essentially
+ * identical regardless. In particular, both rely only on the
+ * status code (not the contents of the packet) and do not
+ * wrap the result */
+ if (sconn->use_gensec_hook || ntlmssp_blob_matches_magic(&blob1)) {
DATA_BLOB chal;
if (!vuser->auth_ntlmssp_state) {
auth_ntlmssp_want_feature(vuser->auth_ntlmssp_state, NTLMSSP_FEATURE_SESSION_KEY);
- status = auth_ntlmssp_start(vuser->auth_ntlmssp_state);
+ if (sconn->use_gensec_hook) {
+ status = auth_generic_start(vuser->auth_ntlmssp_state, GENSEC_OID_SPNEGO);
+ } else {
+ status = auth_ntlmssp_start(vuser->auth_ntlmssp_state);
+ }
if (!NT_STATUS_IS_OK(status)) {
/* Kill the intermediate vuid */
invalidate_vuid(sconn, vuid);
reply_spnego_ntlmssp(req, vuid,
&vuser->auth_ntlmssp_state,
- &chal, status, OID_NTLMSSP, false);
+ &chal, status, NULL, false);
data_blob_free(&chal);
return;
}
+ if (blob1.data[0] == ASN1_APPLICATION(0)) {
+
+ /* its a negTokenTarg packet */
+
+ reply_spnego_negotiate(req, vuid, blob1,
+ &vuser->auth_ntlmssp_state);
+ data_blob_free(&blob1);
+ return;
+ }
+
+ if (blob1.data[0] == ASN1_CONTEXT(1)) {
+
+ /* its a auth packet */
+
+ reply_spnego_auth(req, vuid, blob1,
+ &vuser->auth_ntlmssp_state);
+ data_blob_free(&blob1);
+ return;
+ }
+
/* what sort of packet is this? */
DEBUG(1,("Unknown packet in reply_sesssetup_and_X_spnego\n"));
}
fstrcpy(sub_user, user);
} else {
- fstrcpy(sub_user, lp_guestaccount());
+ fstrcpy(sub_user, "");
}
sub_set_smb_name(sub_user);