s3-dcerpc: Use dcerpc_push_dcerpc_auth() for spnego auth continuations.

Signed-off-by: Günther Deschner <gd@samba.org>

1 files changed, 32 insertions, 41 deletions

diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c
index 3034b8aa68..baebec426d 100644
--- a/source3/rpc_server/srv_pipe.c
+++ b/source3/rpc_server/srv_pipe.c
@@ -1180,19 +1180,16 @@ static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p,
 *******************************************************************/
 
 static bool pipe_spnego_auth_bind_continue(pipes_struct *p,
-					   uint32_t ss_padding_len,
+					   TALLOC_CTX *mem_ctx,
 					   struct dcerpc_auth *pauth_info,
-					   prs_struct *pout_auth)
+					   DATA_BLOB *response)
 {
-	RPC_HDR_AUTH auth_info;
 	DATA_BLOB auth_blob;
 	DATA_BLOB auth_reply;
-	DATA_BLOB response;
 	struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
 
 	ZERO_STRUCT(auth_blob);
 	ZERO_STRUCT(auth_reply);
-	ZERO_STRUCT(response);
 
 	/*
 	 * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
@@ -1225,25 +1222,12 @@ static bool pipe_spnego_auth_bind_continue(pipes_struct *p,
 	data_blob_free(&auth_blob);
 
 	/* Generate the spnego "accept completed" blob - no incoming data. */
-	response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
-
-	/* FIXME - add auth_pad_len here ! */
-
-	/* Copy the blob into the pout_auth parse struct */
-	init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
-			pauth_info->auth_level, ss_padding_len, 1);
-	if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
-		DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
-		goto err;
-	}
+	*response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
 
-	if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
-		DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
-		goto err;
-	}
+	/* Make sure data is bound to the memctx, to be freed the caller */
+	talloc_steal(mem_ctx, response->data);
 
 	data_blob_free(&auth_reply);
-	data_blob_free(&response);
 
 	p->pipe_bound = True;
 
@@ -1253,7 +1237,6 @@ static bool pipe_spnego_auth_bind_continue(pipes_struct *p,
 
 	data_blob_free(&auth_blob);
 	data_blob_free(&auth_reply);
-	data_blob_free(&response);
 
 	free_pipe_ntlmssp_auth_data(&p->auth);
 	p->auth.a_u.auth_ntlmssp_state = NULL;
@@ -1763,10 +1746,11 @@ bool api_pipe_alter_context(pipes_struct *p, struct ncacn_packet *pkt)
 	uint16 assoc_gid;
 	fstring ack_pipe_name;
 	prs_struct out_hdr_ba;
-	prs_struct out_auth;
 	int auth_len = 0;
 	uint32_t ss_padding_len = 0;
 	NTSTATUS status;
+	DATA_BLOB auth_resp = data_blob_null;
+	DATA_BLOB auth_blob = data_blob_null;
 
 	prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 
@@ -1787,13 +1771,6 @@ bool api_pipe_alter_context(pipes_struct *p, struct ncacn_packet *pkt)
 		return False;
 	}
 
-	if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
-		DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
-		prs_mem_free(&p->out_data.frag);
-		prs_mem_free(&out_hdr_ba);
-		return False;
-	}
-
 	/* secondary address CAN be NULL
 	 * as the specs say it's ignored.
 	 * It MUST be NULL to have the spoolss working.
@@ -1895,11 +1872,11 @@ bool api_pipe_alter_context(pipes_struct *p, struct ncacn_packet *pkt)
 		if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
 			/* We can only finish if the pipe is unbound. */
 			if (!p->pipe_bound) {
-				if (!pipe_spnego_auth_bind_continue(p,
-						    ss_padding_len,
-						    &auth_info, &out_auth)) {
+				if (!pipe_spnego_auth_bind_continue(p, pkt,
+						&auth_info, &auth_resp)) {
 					goto err_exit;
 				}
+
 			} else {
 				goto err_exit;
 			}
@@ -1907,17 +1884,29 @@ bool api_pipe_alter_context(pipes_struct *p, struct ncacn_packet *pkt)
 	} else {
 		ZERO_STRUCT(auth_info);
 	}
+
+	if (auth_resp.length) {
+		status = dcerpc_push_dcerpc_auth(pkt,
+						 auth_info.auth_type,
+						 auth_info.auth_level,
+						 ss_padding_len,
+						 1, /* auth_context_id */
+						 &auth_resp,
+						 &auth_blob);
+		if (!NT_STATUS_IS_OK(status)) {
+			DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
+			goto err_exit;
+		}
+
+		auth_len = auth_resp.length;
+	}
 	/*
 	 * Create the header, now we know the length.
 	 */
 
-	if (prs_offset(&out_auth)) {
-		auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
-	}
-
 	init_rpc_hdr(&hdr, DCERPC_PKT_ALTER_RESP, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
 			pkt->call_id,
-			RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
+			RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + auth_blob.length,
 			auth_len);
 
 	/*
@@ -1951,7 +1940,9 @@ bool api_pipe_alter_context(pipes_struct *p, struct ncacn_packet *pkt)
 			}
 		}
 
-		if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
+		if (!prs_copy_data_in(&p->out_data.frag,
+					(char *)auth_blob.data,
+					auth_blob.length)) {
 			DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
 			goto err_exit;
 		}
@@ -1965,14 +1956,14 @@ bool api_pipe_alter_context(pipes_struct *p, struct ncacn_packet *pkt)
 	p->out_data.current_pdu_sent = 0;
 
 	prs_mem_free(&out_hdr_ba);
-	prs_mem_free(&out_auth);
+	TALLOC_FREE(auth_blob.data);
 	return True;
 
   err_exit:
 
 	prs_mem_free(&p->out_data.frag);
 	prs_mem_free(&out_hdr_ba);
-	prs_mem_free(&out_auth);
+	TALLOC_FREE(auth_blob.data);
 	return setup_bind_nak(p, pkt);
 }