s3-dcerpc: Use spnego own sign/seal functions

Signed-off-by: Günther Deschner <gd@samba.org>

1 files changed, 47 insertions, 64 deletions

diff --git a/source3/librpc/rpc/dcerpc_helpers.c b/source3/librpc/rpc/dcerpc_helpers.c
index 7af2bbc854..a94f6c88fa 100644
--- a/source3/librpc/rpc/dcerpc_helpers.c
+++ b/source3/librpc/rpc/dcerpc_helpers.c
@@ -652,50 +652,60 @@ static NTSTATUS add_spnego_auth_footer(struct spnego_context *spnego_ctx,
 					enum dcerpc_AuthLevel auth_level,
 					DATA_BLOB *rpc_out)
 {
-	enum spnego_mech auth_type;
-	struct gse_context *gse_ctx;
-	struct auth_ntlmssp_state *ntlmssp_ctx;
-	void *auth_ctx;
+	DATA_BLOB auth_blob;
+	DATA_BLOB rpc_data;
 	NTSTATUS status;
 
 	if (!spnego_ctx) {
 		return NT_STATUS_INVALID_PARAMETER;
 	}
 
-	status = spnego_get_negotiated_mech(spnego_ctx,
-					    &auth_type, &auth_ctx);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
-	}
+	rpc_data = data_blob_const(rpc_out->data
+					+ DCERPC_RESPONSE_LENGTH,
+				   rpc_out->length
+					- DCERPC_RESPONSE_LENGTH
+					- DCERPC_AUTH_TRAILER_LENGTH);
 
-	switch (auth_type) {
-	case SPNEGO_KRB5:
-		gse_ctx = talloc_get_type(auth_ctx, struct gse_context);
-		if (!gse_ctx) {
-			status = NT_STATUS_INTERNAL_ERROR;
-			break;
+	switch (auth_level) {
+	case DCERPC_AUTH_LEVEL_PRIVACY:
+		/* Data portion is encrypted. */
+		status = spnego_seal(rpc_out->data, spnego_ctx,
+				     &rpc_data, rpc_out, &auth_blob);
+		break;
+
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
 		}
-		status = add_gssapi_auth_footer(gse_ctx,
-						auth_level, rpc_out);
 		break;
 
-	case SPNEGO_NTLMSSP:
-		ntlmssp_ctx = talloc_get_type(auth_ctx,
-						struct auth_ntlmssp_state);
-		if (!ntlmssp_ctx) {
-			status = NT_STATUS_INTERNAL_ERROR;
-			break;
+	case DCERPC_AUTH_LEVEL_INTEGRITY:
+		/* Data is signed. */
+		status = spnego_sign(rpc_out->data, spnego_ctx,
+				     &rpc_data, rpc_out, &auth_blob);
+		break;
+
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
 		}
-		status = add_ntlmssp_auth_footer(ntlmssp_ctx,
-						 auth_level, rpc_out);
 		break;
 
 	default:
-		status = NT_STATUS_INTERNAL_ERROR;
-		break;
+		/* Can't happen. */
+		smb_panic("bad auth level");
+		/* Notreached. */
+		return NT_STATUS_INVALID_PARAMETER;
 	}
 
-	return status;
+	/* Finally attach the blob. */
+	if (!data_blob_append(NULL, rpc_out,
+				auth_blob.data, auth_blob.length)) {
+		DEBUG(0, ("Failed to add %u bytes auth blob.\n",
+			  (unsigned int)auth_blob.length));
+		return NT_STATUS_NO_MEMORY;
+	}
+	data_blob_free(&auth_blob);
+
+	return NT_STATUS_OK;
 }
 
 static NTSTATUS get_spnego_auth_footer(TALLOC_CTX *mem_ctx,
@@ -704,44 +714,17 @@ static NTSTATUS get_spnego_auth_footer(TALLOC_CTX *mem_ctx,
 					DATA_BLOB *data, DATA_BLOB *full_pkt,
 					DATA_BLOB *auth_token)
 {
-	enum spnego_mech auth_type;
-	struct auth_ntlmssp_state *ntlmssp_ctx;
-	struct gse_context *gse_ctx;
-	void *auth_ctx;
-	NTSTATUS status;
-
-	status = spnego_get_negotiated_mech(sp_ctx, &auth_type, &auth_ctx);
-	if (!NT_STATUS_IS_OK(status)) {
-		return status;
-	}
-
-	switch (auth_type) {
-	case SPNEGO_KRB5:
-		gse_ctx = talloc_get_type(auth_ctx,
-					  struct gse_context);
-		if (!gse_ctx) {
-			return NT_STATUS_INVALID_PARAMETER;
-		}
-
-		DEBUG(10, ("KRB5 auth\n"));
-
-		return get_gssapi_auth_footer(mem_ctx, gse_ctx,
-						auth_level,
-						data, full_pkt,
-						auth_token);
-	case SPNEGO_NTLMSSP:
-		ntlmssp_ctx = talloc_get_type(auth_ctx,
-					  struct auth_ntlmssp_state);
-		if (!ntlmssp_ctx) {
-			return NT_STATUS_INVALID_PARAMETER;
-		}
+	switch (auth_level) {
+	case DCERPC_AUTH_LEVEL_PRIVACY:
+		/* Data portion is encrypted. */
+		return spnego_unseal(mem_ctx, sp_ctx,
+				     data, full_pkt, auth_token);
 
-		DEBUG(10, ("NTLMSSP auth\n"));
+	case DCERPC_AUTH_LEVEL_INTEGRITY:
+		/* Data is signed. */
+		return spnego_sigcheck(mem_ctx, sp_ctx,
+				       data, full_pkt, auth_token);
 
-		return get_ntlmssp_auth_footer(ntlmssp_ctx,
-						auth_level,
-						data, full_pkt,
-						auth_token);
 	default:
 		return NT_STATUS_INVALID_PARAMETER;
 	}