summaryrefslogtreecommitdiff
path: root/source3/auth
diff options
context:
space:
mode:
authorAndrew Bartlett <abartlet@samba.org>2011-07-26 10:01:39 +1000
committerAndrew Bartlett <abartlet@samba.org>2011-08-03 18:48:04 +1000
commit902df836807b700b2d27877f2fa5284930df3ff7 (patch)
tree89dca448661f2318219a3606462d579b58637d93 /source3/auth
parent643d05826cbf7ef82e1ee8f33d610a79dcb8607a (diff)
downloadsamba-902df836807b700b2d27877f2fa5284930df3ff7.tar.gz
samba-902df836807b700b2d27877f2fa5284930df3ff7.tar.bz2
samba-902df836807b700b2d27877f2fa5284930df3ff7.zip
s3-ntlmssp Split calls to gensec plugin into prepare and start
GENSEC has the concept of starting the GENSEC subsystem before starting the actual mechansim. Between these two stages is when most context methods are called, to specify credentials and features. Andrew Bartlett Signed-off-by: Andrew Tridgell <tridge@samba.org>
Diffstat (limited to 'source3/auth')
-rw-r--r--source3/auth/auth.c5
-rw-r--r--source3/auth/auth_ntlmssp.c14
-rw-r--r--source3/auth/auth_samba4.c16
3 files changed, 18 insertions, 17 deletions
diff --git a/source3/auth/auth.c b/source3/auth/auth.c
index df93e0d27a..f2cd703297 100644
--- a/source3/auth/auth.c
+++ b/source3/auth/auth.c
@@ -462,8 +462,9 @@ static NTSTATUS make_auth_context_text_list(TALLOC_CTX *mem_ctx,
/* Look for the first module to provide a start_gensec hook, and set that if provided */
for (method = (*auth_context)->auth_method_list; method; method = method->next) {
- if (method->start_gensec) {
- (*auth_context)->start_gensec = method->start_gensec;
+ if (method->prepare_gensec && method->gensec_start_mech_by_oid) {
+ (*auth_context)->prepare_gensec = method->prepare_gensec;
+ (*auth_context)->gensec_start_mech_by_oid = method->gensec_start_mech_by_oid;
break;
}
}
diff --git a/source3/auth/auth_ntlmssp.c b/source3/auth/auth_ntlmssp.c
index 64307bea48..c078416aad 100644
--- a/source3/auth/auth_ntlmssp.c
+++ b/source3/auth/auth_ntlmssp.c
@@ -212,14 +212,20 @@ NTSTATUS auth_ntlmssp_start(const struct tsocket_address *remote_address,
return nt_status;
}
- if (auth_context->start_gensec) {
- nt_status = auth_context->start_gensec(ans, GENSEC_OID_NTLMSSP, &ans->gensec_security);
+ if (auth_context->prepare_gensec) {
+ nt_status = auth_context->prepare_gensec(ans, &ans->gensec_security);
if (!NT_STATUS_IS_OK(nt_status)) {
TALLOC_FREE(ans);
return nt_status;
} else {
- *auth_ntlmssp_state = ans;
- return NT_STATUS_OK;
+ nt_status = auth_context->gensec_start_mech_by_oid(ans->gensec_security, GENSEC_OID_NTLMSSP);
+ if (!NT_STATUS_IS_OK(nt_status)) {
+ TALLOC_FREE(ans);
+ return nt_status;
+ } else {
+ *auth_ntlmssp_state = ans;
+ return NT_STATUS_OK;
+ }
}
}
diff --git a/source3/auth/auth_samba4.c b/source3/auth/auth_samba4.c
index cf185f750a..2c9a6a0f8c 100644
--- a/source3/auth/auth_samba4.c
+++ b/source3/auth/auth_samba4.c
@@ -97,8 +97,8 @@ static NTSTATUS check_samba4_security(const struct auth_context *auth_context,
/* Hook to allow GENSEC to handle blob-based authentication
* mechanisms, without directly linking the mechansim code */
-static NTSTATUS start_gensec(TALLOC_CTX *mem_ctx, const char *oid_string,
- struct gensec_security **gensec_context)
+static NTSTATUS prepare_gensec(TALLOC_CTX *mem_ctx,
+ struct gensec_security **gensec_context)
{
NTSTATUS status;
struct loadparm_context *lp_ctx;
@@ -165,15 +165,8 @@ static NTSTATUS start_gensec(TALLOC_CTX *mem_ctx, const char *oid_string,
gensec_want_feature(gensec_ctx, GENSEC_FEATURE_SESSION_KEY);
gensec_want_feature(gensec_ctx, GENSEC_FEATURE_UNIX_TOKEN);
- status = gensec_start_mech_by_oid(gensec_ctx, oid_string);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(1, ("Failed to start GENSEC %s server code: %s\n",
- gensec_get_name_by_oid(gensec_ctx, oid_string), nt_errstr(status)));
- TALLOC_FREE(frame);
- return status;
- }
-
*gensec_context = gensec_ctx;
+ TALLOC_FREE(frame);
return status;
}
@@ -192,7 +185,8 @@ static NTSTATUS auth_init_samba4(struct auth_context *auth_context,
}
result->name = "samba4";
result->auth = check_samba4_security;
- result->start_gensec = start_gensec;
+ result->prepare_gensec = prepare_gensec;
+ result->gensec_start_mech_by_oid = gensec_start_mech_by_oid;
*auth_method = result;
return NT_STATUS_OK;