diff options
| author | Jeremy Allison <jra@samba.org> | 2006-04-18 18:00:57 +0000 |
|---|---|---|
| committer | Gerald (Jerry) Carter <jerry@samba.org> | 2007-10-10 11:16:25 -0500 |
| commit | 93ca3eee55297eb7fdd38fca38103ce129987e2a (patch) | |
| tree | 5f846596d778a74cb4ff695ba0c842ec9860a51f /source/rpc_client | |
| parent | 22b687589785051eca16a868e3475f066b647ea7 (diff) | |
| download | samba-93ca3eee55297eb7fdd38fca38103ce129987e2a.tar.gz samba-93ca3eee55297eb7fdd38fca38103ce129987e2a.tar.xz samba-93ca3eee55297eb7fdd38fca38103ce129987e2a.zip | |
r15129: Separate out mechanism and policy for NTLMSSP auth/sign/seal.
With this change (and setting lanman auth = no in smb.conf)
we have *identical* NTLMSSP flags to W2K3 in SPNEGO auth.
Jeremy
Diffstat (limited to 'source/rpc_client')
| -rw-r--r-- | source/rpc_client/cli_pipe.c | 18 |
1 files changed, 18 insertions, 0 deletions
diff --git a/source/rpc_client/cli_pipe.c b/source/rpc_client/cli_pipe.c index 37b1b2a671b..11eb21df446 100644 --- a/source/rpc_client/cli_pipe.c +++ b/source/rpc_client/cli_pipe.c @@ -2141,6 +2141,24 @@ static NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli, return NT_STATUS_INVALID_INFO_CLASS; } + /* For NTLMSSP ensure the server gave us the auth_level we wanted. */ + if (auth_type == PIPE_AUTH_TYPE_NTLMSSP || auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP) { + if (auth_level == PIPE_AUTH_LEVEL_INTEGRITY) { + if (!(cli->auth.a_u.ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) { + DEBUG(0,("cli_finish_bind_auth: requested NTLMSSSP signing and server refused.\n")); + prs_mem_free(&rbuf); + return NT_STATUS_INVALID_PARAMETER; + } + } + if (auth_level == PIPE_AUTH_LEVEL_INTEGRITY) { + if (!(cli->auth.a_u.ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) { + DEBUG(0,("cli_finish_bind_auth: requested NTLMSSSP sealing and server refused.\n")); + prs_mem_free(&rbuf); + return NT_STATUS_INVALID_PARAMETER; + } + } + } + /* Pipe is bound - set up auth_type and auth_level data. */ cli->auth.auth_type = auth_type; |