r18068: This splits the handling of multiple SASL packets between the GENSEC

backend (if it chooses to implement it), or the GENSEC socket code.

This is to allow us to handle DIGEST-MD5 across to cyrus-sasl.

Andrew Bartlett
(This used to be commit 0a098006b431f4aa48632a27ca08e9adca8d9609)

1 files changed, 58 insertions, 0 deletions

diff --git a/source4/auth/gensec/spnego.c b/source4/auth/gensec/spnego.c
index a57e8cc846..fa15176e77 100644
--- a/source4/auth/gensec/spnego.c
+++ b/source4/auth/gensec/spnego.c
@@ -26,6 +26,8 @@
 #include "auth/auth.h"
 #include "auth/gensec/spnego_proto.h"
 #include "librpc/gen_ndr/ndr_dcerpc.h"
+#include "lib/socket/socket.h"
+#include "auth/gensec/socket.h"
 
 enum spnego_state_position {
 	SPNEGO_SERVER_START,
@@ -199,6 +201,59 @@ static NTSTATUS gensec_spnego_unwrap(struct gensec_security *gensec_security,
 			     mem_ctx, in, out);
 }
 
+static NTSTATUS gensec_spnego_wrap_packets(struct gensec_security *gensec_security, 
+					   TALLOC_CTX *mem_ctx, 
+					   const DATA_BLOB *in, 
+					   DATA_BLOB *out,
+					   size_t *len_processed) 
+{
+	struct spnego_state *spnego_state = gensec_security->private_data;
+
+	if (spnego_state->state_position != SPNEGO_DONE 
+	    && spnego_state->state_position != SPNEGO_FALLBACK) {
+		DEBUG(1, ("gensec_spnego_wrap: wrong state for wrap\n"));
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+	
+	return gensec_wrap_packets(spnego_state->sub_sec_security, 
+				   mem_ctx, in, out,
+				   len_processed);
+}
+
+static NTSTATUS gensec_spnego_packet_full_request(struct gensec_security *gensec_security, 
+					     	DATA_BLOB blob, size_t *size)
+{
+	struct spnego_state *spnego_state = gensec_security->private_data;
+
+	if (spnego_state->state_position != SPNEGO_DONE 
+	    && spnego_state->state_position != SPNEGO_FALLBACK) {
+		DEBUG(1, ("gensec_spnego_unwrap: wrong state for unwrap\n"));
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+	
+	return gensec_packet_full_request(spnego_state->sub_sec_security, 
+					  blob, size);
+}
+
+static NTSTATUS gensec_spnego_unwrap_packets(struct gensec_security *gensec_security, 
+					     TALLOC_CTX *mem_ctx, 
+					     const DATA_BLOB *in, 
+					     DATA_BLOB *out,
+					     size_t *len_processed) 
+{
+	struct spnego_state *spnego_state = gensec_security->private_data;
+
+	if (spnego_state->state_position != SPNEGO_DONE 
+	    && spnego_state->state_position != SPNEGO_FALLBACK) {
+		DEBUG(1, ("gensec_spnego_unwrap: wrong state for unwrap\n"));
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+	
+	return gensec_unwrap_packets(spnego_state->sub_sec_security, 
+				     mem_ctx, in, out,
+				     len_processed);
+}
+
 static size_t gensec_spnego_sig_size(struct gensec_security *gensec_security, size_t data_size) 
 {
 	struct spnego_state *spnego_state = gensec_security->private_data;
@@ -976,8 +1031,11 @@ static const struct gensec_security_ops gensec_spnego_security_ops = {
 	.max_input_size	  = gensec_spnego_max_input_size,
 	.check_packet	  = gensec_spnego_check_packet,
 	.unseal_packet	  = gensec_spnego_unseal_packet,
+	.packet_full_request = gensec_spnego_packet_full_request,
 	.wrap             = gensec_spnego_wrap,
 	.unwrap           = gensec_spnego_unwrap,
+	.wrap_packets     = gensec_spnego_wrap_packets,
+	.unwrap_packets   = gensec_spnego_unwrap_packets,
 	.session_key	  = gensec_spnego_session_key,
 	.session_info     = gensec_spnego_session_info,
 	.have_feature     = gensec_spnego_have_feature,