4 files changed, 41 insertions, 1 deletions

diff --git a/source3/auth/auth.c b/source3/auth/auth.c
index f2cd703297..4e413b1de5 100644
--- a/source3/auth/auth.c
+++ b/source3/auth/auth.c
@@ -462,9 +462,10 @@ static NTSTATUS make_auth_context_text_list(TALLOC_CTX *mem_ctx,
 
 	/* Look for the first module to provide a start_gensec hook, and set that if provided */
 	for (method = (*auth_context)->auth_method_list; method; method = method->next) {
-		if (method->prepare_gensec && method->gensec_start_mech_by_oid) {
+		if (method->prepare_gensec) {
 			(*auth_context)->prepare_gensec = method->prepare_gensec;
 			(*auth_context)->gensec_start_mech_by_oid = method->gensec_start_mech_by_oid;
+			(*auth_context)->gensec_start_mech_by_authtype = method->gensec_start_mech_by_authtype;
 			break;
 		}
 	}
diff --git a/source3/auth/auth_ntlmssp.c b/source3/auth/auth_ntlmssp.c
index e52cf9209d..cccb319ccc 100644
--- a/source3/auth/auth_ntlmssp.c
+++ b/source3/auth/auth_ntlmssp.c
@@ -27,6 +27,7 @@
 #include "../librpc/gen_ndr/netlogon.h"
 #include "../lib/tsocket/tsocket.h"
 #include "auth/gensec/gensec.h"
+#include "librpc/rpc/dcerpc.h"
 
 NTSTATUS auth_ntlmssp_session_info(TALLOC_CTX *mem_ctx,
 				   struct auth_ntlmssp_state *auth_ntlmssp_state,
@@ -290,6 +291,41 @@ NTSTATUS auth_generic_start(struct auth_ntlmssp_state *auth_ntlmssp_state, const
 	return NT_STATUS_OK;
 }
 
+NTSTATUS auth_generic_authtype_start(struct auth_ntlmssp_state *auth_ntlmssp_state, 
+				     uint8_t auth_type, uint8_t auth_level)
+{
+	if (auth_ntlmssp_state->auth_context->gensec_start_mech_by_authtype) {
+		return auth_ntlmssp_state->auth_context->gensec_start_mech_by_authtype(auth_ntlmssp_state->gensec_security,
+										       auth_type, auth_level);
+	}
+
+	if (auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
+		/* The caller will then free the auth_ntlmssp_state,
+		 * undoing what was done in auth_ntlmssp_prepare().
+		 *
+		 * We can't do that logic here, as
+		 * auth_ntlmssp_want_feature() may have been called in
+		 * between.
+		 */
+		return NT_STATUS_NOT_IMPLEMENTED;
+	}
+
+	if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
+		auth_ntlmssp_want_feature(auth_ntlmssp_state, NTLMSSP_FEATURE_SIGN);
+	} else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
+		/* Always implies both sign and seal for ntlmssp */
+		auth_ntlmssp_want_feature(auth_ntlmssp_state, NTLMSSP_FEATURE_SEAL);
+	} else if (auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
+		/* Default features */
+	} else {
+		DEBUG(2,("auth_level %d not supported in DCE/RPC authentication\n",
+			 auth_level));
+		return NT_STATUS_INVALID_PARAMETER;
+	}
+
+	return NT_STATUS_OK;
+}
+
 NTSTATUS auth_ntlmssp_start(struct auth_ntlmssp_state *auth_ntlmssp_state)
 {
 	return auth_generic_start(auth_ntlmssp_state, GENSEC_OID_NTLMSSP);
diff --git a/source3/auth/auth_samba4.c b/source3/auth/auth_samba4.c
index 2c9a6a0f8c..7315c1621b 100644
--- a/source3/auth/auth_samba4.c
+++ b/source3/auth/auth_samba4.c
@@ -187,6 +187,7 @@ static NTSTATUS auth_init_samba4(struct auth_context *auth_context,
 	result->auth = check_samba4_security;
 	result->prepare_gensec = prepare_gensec;
 	result->gensec_start_mech_by_oid = gensec_start_mech_by_oid;
+	result->gensec_start_mech_by_authtype = gensec_start_mech_by_authtype;
 
         *auth_method = result;
 	return NT_STATUS_OK;
diff --git a/source3/auth/proto.h b/source3/auth/proto.h
index 239e8ff454..5dded1421c 100644
--- a/source3/auth/proto.h
+++ b/source3/auth/proto.h
@@ -76,6 +76,8 @@ NTSTATUS auth_ntlmssp_prepare(const struct tsocket_address *remote_address,
 			      struct auth_ntlmssp_state **auth_ntlmssp_state);
 NTSTATUS auth_ntlmssp_start(struct auth_ntlmssp_state *auth_ntlmssp_state);
 NTSTATUS auth_generic_start(struct auth_ntlmssp_state *auth_ntlmssp_state, const char *oid);
+NTSTATUS auth_generic_authtype_start(struct auth_ntlmssp_state *auth_ntlmssp_state, 
+				     uint8_t auth_type, uint8_t auth_level);
 
 
 /* The following definitions come from auth/auth_sam.c  */