Author: abartlet
Date: 2006-05-07 19:36:06 +0000 (Sun, 07 May 2006)
New Revision: 15503

WebSVN: 
http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=15503

Log:
I may shortly have to revert all of this, but be clearer about how we
handle the NTLMSSP and wrong password fallbacks.

Andrew Bartlett

Modified:
   branches/SAMBA_4_0/source/librpc/rpc/dcerpc_util.c


Changeset:
Modified: branches/SAMBA_4_0/source/librpc/rpc/dcerpc_util.c
===================================================================
--- branches/SAMBA_4_0/source/librpc/rpc/dcerpc_util.c  2006-05-07 19:26:48 UTC 
(rev 15502)
+++ branches/SAMBA_4_0/source/librpc/rpc/dcerpc_util.c  2006-05-07 19:36:06 UTC 
(rev 15503)
@@ -976,7 +976,7 @@
        struct dcerpc_binding *binding;
        const struct dcerpc_interface_table *table;
        struct cli_credentials *credentials;
-       uint8_t next_auth_type;
+       uint8_t auth_type;
        BOOL try_ntlm_fallback;
 };
 
@@ -1011,10 +1011,12 @@
        struct pipe_auth_state *s = talloc_get_type(c->private_data, struct 
pipe_auth_state);
 
        status = dcerpc_bind_auth_recv(ctx);
-       if (s->try_ntlm_fallback && NT_STATUS_EQUAL(status, 
NT_STATUS_INVALID_PARAMETER)) {
+       if (s->auth_type == DCERPC_AUTH_TYPE_SPNEGO
+           && s->try_ntlm_fallback
+           && NT_STATUS_EQUAL(status, NT_STATUS_INVALID_PARAMETER)) {
                struct composite_context *sec_conn_req;
                s->try_ntlm_fallback = False;
-               s->next_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
+               s->auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
                /* send a request for secondary rpc connection */
                sec_conn_req = dcerpc_secondary_connection_send(s->pipe,
                                                                s->binding);
@@ -1023,10 +1025,9 @@
                composite_continue(c, sec_conn_req, continue_new_auth_bind, c);
                
                return;
-       } else if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
+       } else if (s->auth_type == DCERPC_AUTH_TYPE_SPNEGO && 
NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
                struct composite_context *sec_conn_req;
                if (cli_credentials_wrong_password(s->credentials)) {
-                       s->next_auth_type = DCERPC_AUTH_TYPE_SPNEGO;
                        /* send a request for secondary rpc connection */
                        sec_conn_req = dcerpc_secondary_connection_send(s->pipe,
                                                                        
s->binding);
@@ -1070,7 +1071,7 @@
 
        /* initiate a authenticated bind */
        auth_req = dcerpc_bind_auth_send(c, s->pipe, s->table,
-                                        s->credentials, s->next_auth_type,
+                                        s->credentials, s->auth_type,
                                         dcerpc_auth_level(s->pipe->conn),
                                         s->table->authservices->names[0]);
        if (composite_nomem(auth_req, c)) return;
@@ -1157,8 +1158,6 @@
                 * connection is not signed or sealed.  For that case
                 * we rely on the already authenticated CIFS connection
                 */
-               
-               uint8_t auth_type;
 
                if ((conn->flags & (DCERPC_SIGN|DCERPC_SEAL)) == 0) {
                        /*
@@ -1172,23 +1171,23 @@
                }
 
                if (s->binding->flags & DCERPC_AUTH_SPNEGO) {
-                       auth_type = DCERPC_AUTH_TYPE_SPNEGO;
+                       s->auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 
                } else if (s->binding->flags & DCERPC_AUTH_KRB5) {
-                       auth_type = DCERPC_AUTH_TYPE_KRB5;
+                       s->auth_type = DCERPC_AUTH_TYPE_KRB5;
 
                } else if (s->binding->flags & DCERPC_SCHANNEL) {
-                       auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
+                       s->auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
 
                } else if (s->binding->flags & DCERPC_AUTH_NTLM) {
-                       auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
+                       s->auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
                } else {
-                       auth_type = DCERPC_AUTH_TYPE_SPNEGO;
+                       s->auth_type = DCERPC_AUTH_TYPE_SPNEGO;
                        s->try_ntlm_fallback = True;
                }
 
                auth_req = dcerpc_bind_auth_send(c, s->pipe, s->table,
-                                                s->credentials, 
DCERPC_AUTH_TYPE_SPNEGO,
+                                                s->credentials, s->auth_type,
                                                 dcerpc_auth_level(conn),
                                                 
s->table->authservices->names[0]);
                if (composite_nomem(auth_req, c)) return c;

Reply via email to