From 7bf0308a319df4359fb8f22954da16873b975dc2 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Fri, 20 Dec 2013 08:52:52 +0100 Subject: s4:auth/gensec: let GENSEC_FEATURE_SESSION_KEY result in GSS_C_INTEG_FLAG This is important to allow the 'new_spnego' with mech_list protection to work for a SMB session setup. This is not strictly needed as we always announce GENSEC_FEATURE_SESSION_KEY in gensec_gssapi_have_feature(), but it's better to send GSS_C_INTEG_FLAG over the wire. This may prevent a ticket from a Samba client to an SMB server (particularly a DC) being misused to connect to the LDAP server on that DC, as the LDAP server will require GSSAPI signing of the connection. Signed-off-by: Stefan Metzmacher Reviewed-by: Andrew Bartlett --- source4/auth/gensec/gensec_gssapi.c | 3 +++ 1 file changed, 3 insertions(+) (limited to 'source4') diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c index dd03a960c99..8bc5452f3b9 100644 --- a/source4/auth/gensec/gensec_gssapi.c +++ b/source4/auth/gensec/gensec_gssapi.c @@ -177,6 +177,9 @@ static NTSTATUS gensec_gssapi_start(struct gensec_security *gensec_security) gensec_gssapi_state->gss_want_flags |= GSS_C_SEQUENCE_FLAG; } + if (gensec_security->want_features & GENSEC_FEATURE_SESSION_KEY) { + gensec_gssapi_state->gss_want_flags |= GSS_C_INTEG_FLAG; + } if (gensec_security->want_features & GENSEC_FEATURE_SIGN) { gensec_gssapi_state->gss_want_flags |= GSS_C_INTEG_FLAG; } -- cgit v1.2.1