From 45faf6c35a033ec46a546dfb9d5d6aeb2fb2b83c Mon Sep 17 00:00:00 2001
From: Stefan Metzmacher <metze@samba.org>
Date: Tue, 29 Oct 2024 09:54:42 +0100
Subject: [PATCH] libcli/auth: split out netlogon_creds_client_verify() that
takes auth_{type,level}
This will make it easier to implement netr_ServerAuthenticateKerberos()
later...
BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
---
libcli/auth/credentials.c | 24 ++++++++++++++++++++++--
libcli/auth/proto.h | 4 ++++
2 files changed, 26 insertions(+), 2 deletions(-)
diff --git a/libcli/auth/credentials.c b/libcli/auth/credentials.c
index acaf721183b..fbcca1139d7 100644
--- a/libcli/auth/credentials.c
+++ b/libcli/auth/credentials.c
@@ -663,14 +663,34 @@ netlogon_creds_client_authenticator(struct netlogon_creds_CredentialState *creds
/*
check that a credentials reply from a server is correct
*/
-bool netlogon_creds_client_check(struct netlogon_creds_CredentialState *creds,
- const struct netr_Credential *received_credentials)
+NTSTATUS netlogon_creds_client_verify(struct netlogon_creds_CredentialState *creds,
+ const struct netr_Credential *received_credentials,
+ enum dcerpc_AuthType auth_type,
+ enum dcerpc_AuthLevel auth_level)
{
if (!received_credentials ||
!mem_equal_const_time(received_credentials->data, creds->server.data, 8)) {
DEBUG(2,("credentials check failed\n"));
+ return NT_STATUS_ACCESS_DENIED;
+ }
+ return NT_STATUS_OK;
+}
+
+bool netlogon_creds_client_check(struct netlogon_creds_CredentialState *creds,
+ const struct netr_Credential *received_credentials)
+{
+ enum dcerpc_AuthType auth_type = DCERPC_AUTH_TYPE_NONE;
+ enum dcerpc_AuthLevel auth_level = DCERPC_AUTH_LEVEL_NONE;
+ NTSTATUS status;
+
+ status = netlogon_creds_client_verify(creds,
+ received_credentials,
+ auth_type,
+ auth_level);
+ if (!NT_STATUS_IS_OK(status)) {
return false;
}
+
return true;
}
diff --git a/libcli/auth/proto.h b/libcli/auth/proto.h
index b4410f2f72e..d396baeebe0 100644
--- a/libcli/auth/proto.h
+++ b/libcli/auth/proto.h
@@ -54,6 +54,10 @@ struct netlogon_creds_CredentialState *netlogon_creds_client_init(TALLOC_CTX *me
NTSTATUS
netlogon_creds_client_authenticator(struct netlogon_creds_CredentialState *creds,
struct netr_Authenticator *next);
+NTSTATUS netlogon_creds_client_verify(struct netlogon_creds_CredentialState *creds,
+ const struct netr_Credential *received_credentials,
+ enum dcerpc_AuthType auth_type,
+ enum dcerpc_AuthLevel auth_level);
bool netlogon_creds_client_check(struct netlogon_creds_CredentialState *creds,
const struct netr_Credential *received_credentials);
struct netlogon_creds_CredentialState *netlogon_creds_copy(