sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-08-04 08:22:08 +03:00
Code Activity

s3-dcerpc: Use spnego own sign/seal functions

Browse Source 
Signed-off-by: Günther Deschner <gd@samba.org>
This commit is contained in:
Simo Sorce
2010-09-11 09:46:08 -04:00
committed by Günther Deschner
parent 678993470f
commit 926a3f4fcd
1 changed files with 48 additions and 65 deletions
Download Patch File Download Diff File Expand all files Collapse all files

113
source3/librpc/rpc/dcerpc_helpers.c
View File

@ -652,50 +652,60 @@ static NTSTATUS add_spnego_auth_footer(struct spnego_context *spnego_ctx,
enum dcerpc_AuthLevel auth_level, enum dcerpc_AuthLevel auth_level,
DATA_BLOB *rpc_out) DATA_BLOB *rpc_out)
{ {
enum spnego_mech auth_type; DATA_BLOB auth_blob;
struct gse_context *gse_ctx; DATA_BLOB rpc_data;
struct auth_ntlmssp_state *ntlmssp_ctx;
void *auth_ctx;
NTSTATUS status; NTSTATUS status;
if (!spnego_ctx) { if (!spnego_ctx) {
return NT_STATUS_INVALID_PARAMETER; return NT_STATUS_INVALID_PARAMETER;
} }
status = spnego_get_negotiated_mech(spnego_ctx, rpc_data = data_blob_const(rpc_out->data
&auth_type, &auth_ctx); + DCERPC_RESPONSE_LENGTH,
if (!NT_STATUS_IS_OK(status)) { rpc_out->length
return status; - DCERPC_RESPONSE_LENGTH
} - DCERPC_AUTH_TRAILER_LENGTH);
switch (auth_type) { switch (auth_level) {
case SPNEGO_KRB5: case DCERPC_AUTH_LEVEL_PRIVACY:
gse_ctx = talloc_get_type(auth_ctx, struct gse_context); /* Data portion is encrypted. */
if (!gse_ctx) { status = spnego_seal(rpc_out->data, spnego_ctx,
status = NT_STATUS_INTERNAL_ERROR; &rpc_data, rpc_out, &auth_blob);
break;
}
status = add_gssapi_auth_footer(gse_ctx,
auth_level, rpc_out);
break; break;
case SPNEGO_NTLMSSP: if (!NT_STATUS_IS_OK(status)) {
ntlmssp_ctx = talloc_get_type(auth_ctx, return status;
struct auth_ntlmssp_state); }
if (!ntlmssp_ctx) { break;
status = NT_STATUS_INTERNAL_ERROR;
break; case DCERPC_AUTH_LEVEL_INTEGRITY:
/* Data is signed. */
status = spnego_sign(rpc_out->data, spnego_ctx,
&rpc_data, rpc_out, &auth_blob);
break;
if (!NT_STATUS_IS_OK(status)) {
return status;
} }
status = add_ntlmssp_auth_footer(ntlmssp_ctx,
auth_level, rpc_out);
break; break;
default: default:
status = NT_STATUS_INTERNAL_ERROR; /* Can't happen. */
break; smb_panic("bad auth level");
/* Notreached. */
return NT_STATUS_INVALID_PARAMETER;
} }
return status; /* Finally attach the blob. */
if (!data_blob_append(NULL, rpc_out,
auth_blob.data, auth_blob.length)) {
DEBUG(0, ("Failed to add %u bytes auth blob.\n",
(unsigned int)auth_blob.length));
return NT_STATUS_NO_MEMORY;
}
data_blob_free(&auth_blob);
return NT_STATUS_OK;
} }
static NTSTATUS get_spnego_auth_footer(TALLOC_CTX *mem_ctx, static NTSTATUS get_spnego_auth_footer(TALLOC_CTX *mem_ctx,
@ -704,44 +714,17 @@ static NTSTATUS get_spnego_auth_footer(TALLOC_CTX *mem_ctx,
DATA_BLOB *data, DATA_BLOB *full_pkt, DATA_BLOB *data, DATA_BLOB *full_pkt,
DATA_BLOB *auth_token) DATA_BLOB *auth_token)
{ {
enum spnego_mech auth_type; switch (auth_level) {
struct auth_ntlmssp_state *ntlmssp_ctx; case DCERPC_AUTH_LEVEL_PRIVACY:
struct gse_context *gse_ctx; /* Data portion is encrypted. */
void *auth_ctx; return spnego_unseal(mem_ctx, sp_ctx,
NTSTATUS status; data, full_pkt, auth_token);
status = spnego_get_negotiated_mech(sp_ctx, &auth_type, &auth_ctx); case DCERPC_AUTH_LEVEL_INTEGRITY:
if (!NT_STATUS_IS_OK(status)) { /* Data is signed. */
return status; return spnego_sigcheck(mem_ctx, sp_ctx,
} data, full_pkt, auth_token);
switch (auth_type) {
case SPNEGO_KRB5:
gse_ctx = talloc_get_type(auth_ctx,
struct gse_context);
if (!gse_ctx) {
return NT_STATUS_INVALID_PARAMETER;
}
DEBUG(10, ("KRB5 auth\n"));
return get_gssapi_auth_footer(mem_ctx, gse_ctx,
auth_level,
data, full_pkt,
auth_token);
case SPNEGO_NTLMSSP:
ntlmssp_ctx = talloc_get_type(auth_ctx,
struct auth_ntlmssp_state);
if (!ntlmssp_ctx) {
return NT_STATUS_INVALID_PARAMETER;
}
DEBUG(10, ("NTLMSSP auth\n"));
return get_ntlmssp_auth_footer(ntlmssp_ctx,
auth_level,
data, full_pkt,
auth_token);
default: default:
return NT_STATUS_INVALID_PARAMETER; return NT_STATUS_INVALID_PARAMETER;
} }