hmmm... have to add client-side support in domain_client_validate() to

_use_ user session key.
(This used to be commit be6a6b13939798a9c7242b38864f0ce842391a74)

diff --git a/source3/include/proto.h b/source3/include/proto.h
index 9206c5e578a2e4fbb3a206226e68f6d728a021aa..a5348d4e880c4c7c871bae4779284e61387806d3 100644 (file)
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -4033,8 +4033,9 @@ BOOL server_validate(char *user, char *domain,
                     char *ntpass, int ntpasslen);
 BOOL domain_client_validate( char *user, char *domain, char *server_list,
                                char *acct_name, uint16 acct_type,
-                             char *smb_apasswd, int smb_apasslen, 
-                             char *smb_ntpasswd, int smb_ntpasslen);
+                               char *smb_apasswd, int smb_apasslen, 
+                               char *smb_ntpasswd, int smb_ntpasslen,
+                               uchar user_sess_key[16]);
 
 /*The following definitions come from  smbd/pipes.c  */
 

diff --git a/source3/rpc_client/cli_login.c b/source3/rpc_client/cli_login.c
index bd34b0d39790d15a547167176f20d12a47aa3c8c..45345cf4ac69bfcaca80ea367d8db1aa26364781 100644 (file)
--- a/source3/rpc_client/cli_login.c
+++ b/source3/rpc_client/cli_login.c
@@ -165,19 +165,39 @@ BOOL cli_nt_login_network(struct cli_state *cli, uint16 fnum, char *domain, char
                           char nt_chal_resp[24],
                           NET_ID_INFO_CTR *ctr, NET_USER_INFO_3 *user_info3)
 {
-  DEBUG(5,("cli_nt_login_network: %d\n", __LINE__));
+       uchar key[16];
+       BOOL ret;
+       DEBUG(5,("cli_nt_login_network: %d\n", __LINE__));
 
-  /* indicate a "network" login */
-  ctr->switch_value = NET_LOGON_TYPE;
+       /* indicate a "network" login */
+       ctr->switch_value = NET_LOGON_TYPE;
 
-  /* Create the structure needed for SAM logon. */
-  make_id_info2(&ctr->auth.id2, domain, 0, 
-                luid_low, 0,
-                username, cli->clnt_name_slash,
-                (uchar *)lm_chal, (uchar *)lm_chal_resp, (uchar *)nt_chal_resp);
+       /* Create the structure needed for SAM logon. */
+       make_id_info2(&ctr->auth.id2, domain, 0, 
+               luid_low, 0,
+               username, cli->clnt_name_slash,
+               (uchar *)lm_chal, (uchar *)lm_chal_resp, (uchar *)nt_chal_resp);
 
-  /* Send client sam-logon request - update credentials on success. */
-  return cli_net_sam_logon(cli, fnum, ctr, user_info3);
+       /* Send client sam-logon request - update credentials on success. */
+       ret = cli_net_sam_logon(cli, fnum, ctr, user_info3);
+
+#ifdef DEBUG_PASSWORD
+       DEBUG(100,("cli sess key:"));
+       dump_data(100, cli->sess_key, 8);
+       DEBUG(100,("enc user sess key:"));
+       dump_data(100, user_info3->user_sess_key, 16);
+#endif
+
+       memset(key, 0, 16);
+       memcpy(key, (char*)cli->sess_key, 8);
+
+       SamOEMhash(user_info3->user_sess_key, key, False);
+
+#ifdef DEBUG_PASSWORD
+       DEBUG(100,("dec user sess key:"));
+       dump_data(100, user_info3->user_sess_key, 16);
+#endif
+       return ret;
 }
 
 /****************************************************************************

diff --git a/source3/smbd/password.c b/source3/smbd/password.c
index 690e2e5f5ce5f8b90881011d261526039b283f50..3d7a35fac8ae19bab97b6a7e0fa693da8d93015a 100644 (file)
--- a/source3/smbd/password.c
+++ b/source3/smbd/password.c
@@ -1097,8 +1097,9 @@ use this machine as the password server.\n"));
 
 BOOL domain_client_validate( char *user, char *domain, char *server_list,
                                char *acct_name, uint16 acct_type,
-                             char *smb_apasswd, int smb_apasslen, 
-                             char *smb_ntpasswd, int smb_ntpasslen)
+                               char *smb_apasswd, int smb_apasslen, 
+                               char *smb_ntpasswd, int smb_ntpasslen,
+                               uchar user_sess_key[16])
 {
        uint16 nt_pipe_fnum;
        unsigned char local_challenge[8];

diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c
index 79b24a986c96ac36cb2fcc2362f6c2c045e8a3ce..da72c9f3b58a907fd37d35482e945c51cc117d39 100644 (file)
--- a/source3/smbd/reply.c
+++ b/source3/smbd/reply.c
@@ -499,8 +499,9 @@ static BOOL check_server_security(char *orig_user, char *domain,
 ****************************************************************************/
 
 static BOOL check_domain_security(char *orig_user, char *domain, 
-                                  char *smb_apasswd, int smb_apasslen,
-                                  char *smb_ntpasswd, int smb_ntpasslen)
+                               char *smb_apasswd, int smb_apasslen,
+                               char *smb_ntpasswd, int smb_ntpasslen,
+                               uchar user_sess_key[16])
 {
        fstring acct_name;
        uint16 acct_type = 0;
@@ -557,7 +558,8 @@ static BOOL check_domain_security(char *orig_user, char *domain,
        return domain_client_validate(orig_user, domain, server_list,
                                acct_name, acct_type,
                                smb_apasswd, smb_apasslen,
-                               smb_ntpasswd, smb_ntpasslen);
+                               smb_ntpasswd, smb_ntpasslen,
+                               user_sess_key);
 }
 
 /****************************************************************************
@@ -768,7 +770,7 @@ user %s attempted down-level SMB connection\n", user));
                              smb_ntpasswd, smb_ntpasslen) &&
       !check_domain_security(orig_user, domain,
                              smb_apasswd, smb_apasslen,
-                             smb_ntpasswd, smb_ntpasslen) &&
+                             smb_ntpasswd, smb_ntpasslen, user_sess_key) &&
       !check_hosts_equiv(user)
      )
   {