summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--source3/librpc/rpc/dcerpc_helpers.c111
1 files changed, 47 insertions, 64 deletions
diff --git a/source3/librpc/rpc/dcerpc_helpers.c b/source3/librpc/rpc/dcerpc_helpers.c
index 7af2bbc854..a94f6c88fa 100644
--- a/source3/librpc/rpc/dcerpc_helpers.c
+++ b/source3/librpc/rpc/dcerpc_helpers.c
@@ -652,50 +652,60 @@ static NTSTATUS add_spnego_auth_footer(struct spnego_context *spnego_ctx,
enum dcerpc_AuthLevel auth_level,
DATA_BLOB *rpc_out)
{
- enum spnego_mech auth_type;
- struct gse_context *gse_ctx;
- struct auth_ntlmssp_state *ntlmssp_ctx;
- void *auth_ctx;
+ DATA_BLOB auth_blob;
+ DATA_BLOB rpc_data;
NTSTATUS status;
if (!spnego_ctx) {
return NT_STATUS_INVALID_PARAMETER;
}
- status = spnego_get_negotiated_mech(spnego_ctx,
- &auth_type, &auth_ctx);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
+ rpc_data = data_blob_const(rpc_out->data
+ + DCERPC_RESPONSE_LENGTH,
+ rpc_out->length
+ - DCERPC_RESPONSE_LENGTH
+ - DCERPC_AUTH_TRAILER_LENGTH);
- switch (auth_type) {
- case SPNEGO_KRB5:
- gse_ctx = talloc_get_type(auth_ctx, struct gse_context);
- if (!gse_ctx) {
- status = NT_STATUS_INTERNAL_ERROR;
- break;
+ switch (auth_level) {
+ case DCERPC_AUTH_LEVEL_PRIVACY:
+ /* Data portion is encrypted. */
+ status = spnego_seal(rpc_out->data, spnego_ctx,
+ &rpc_data, rpc_out, &auth_blob);
+ break;
+
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
}
- status = add_gssapi_auth_footer(gse_ctx,
- auth_level, rpc_out);
break;
- case SPNEGO_NTLMSSP:
- ntlmssp_ctx = talloc_get_type(auth_ctx,
- struct auth_ntlmssp_state);
- if (!ntlmssp_ctx) {
- status = NT_STATUS_INTERNAL_ERROR;
- break;
+ case DCERPC_AUTH_LEVEL_INTEGRITY:
+ /* Data is signed. */
+ status = spnego_sign(rpc_out->data, spnego_ctx,
+ &rpc_data, rpc_out, &auth_blob);
+ break;
+
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
}
- status = add_ntlmssp_auth_footer(ntlmssp_ctx,
- auth_level, rpc_out);
break;
default:
- status = NT_STATUS_INTERNAL_ERROR;
- break;
+ /* Can't happen. */
+ smb_panic("bad auth level");
+ /* Notreached. */
+ return NT_STATUS_INVALID_PARAMETER;
}
- return status;
+ /* Finally attach the blob. */
+ if (!data_blob_append(NULL, rpc_out,
+ auth_blob.data, auth_blob.length)) {
+ DEBUG(0, ("Failed to add %u bytes auth blob.\n",
+ (unsigned int)auth_blob.length));
+ return NT_STATUS_NO_MEMORY;
+ }
+ data_blob_free(&auth_blob);
+
+ return NT_STATUS_OK;
}
static NTSTATUS get_spnego_auth_footer(TALLOC_CTX *mem_ctx,
@@ -704,44 +714,17 @@ static NTSTATUS get_spnego_auth_footer(TALLOC_CTX *mem_ctx,
DATA_BLOB *data, DATA_BLOB *full_pkt,
DATA_BLOB *auth_token)
{
- enum spnego_mech auth_type;
- struct auth_ntlmssp_state *ntlmssp_ctx;
- struct gse_context *gse_ctx;
- void *auth_ctx;
- NTSTATUS status;
-
- status = spnego_get_negotiated_mech(sp_ctx, &auth_type, &auth_ctx);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
-
- switch (auth_type) {
- case SPNEGO_KRB5:
- gse_ctx = talloc_get_type(auth_ctx,
- struct gse_context);
- if (!gse_ctx) {
- return NT_STATUS_INVALID_PARAMETER;
- }
-
- DEBUG(10, ("KRB5 auth\n"));
-
- return get_gssapi_auth_footer(mem_ctx, gse_ctx,
- auth_level,
- data, full_pkt,
- auth_token);
- case SPNEGO_NTLMSSP:
- ntlmssp_ctx = talloc_get_type(auth_ctx,
- struct auth_ntlmssp_state);
- if (!ntlmssp_ctx) {
- return NT_STATUS_INVALID_PARAMETER;
- }
+ switch (auth_level) {
+ case DCERPC_AUTH_LEVEL_PRIVACY:
+ /* Data portion is encrypted. */
+ return spnego_unseal(mem_ctx, sp_ctx,
+ data, full_pkt, auth_token);
- DEBUG(10, ("NTLMSSP auth\n"));
+ case DCERPC_AUTH_LEVEL_INTEGRITY:
+ /* Data is signed. */
+ return spnego_sigcheck(mem_ctx, sp_ctx,
+ data, full_pkt, auth_token);
- return get_ntlmssp_auth_footer(ntlmssp_ctx,
- auth_level,
- data, full_pkt,
- auth_token);
default:
return NT_STATUS_INVALID_PARAMETER;
}