1 files changed, 91 insertions, 14 deletions

diff --git a/source4/librpc/rpc/dcerpc_auth.c b/source4/librpc/rpc/dcerpc_auth.c
index 228a99d5c5..1c73bde6e4 100644
--- a/source4/librpc/rpc/dcerpc_auth.c
+++ b/source4/librpc/rpc/dcerpc_auth.c
@@ -5,7 +5,7 @@
 
    Copyright (C) Andrew Tridgell 2003
    Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004
-
+   Copyright (C) Stefan Metzmacher 2004
    
    This program is free software; you can redistribute it and/or modify
    it under the terms of the GNU General Public License as published by
@@ -86,27 +86,33 @@ NTSTATUS dcerpc_bind_auth(struct dcerpc_pipe *p, uint8_t auth_type, uint8_t auth
 		goto done;
 	}
 
-	status = gensec_update(p->conn->security_state.generic_state, tmp_ctx,
-			       p->conn->security_state.auth_info->credentials,
-			       &credentials);
-	if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
-		goto done;
-	}
+	while (1) {
+		status = gensec_update(p->conn->security_state.generic_state, tmp_ctx,
+				       p->conn->security_state.auth_info->credentials,
+				       &credentials);
+		if (!NT_STATUS_IS_OK(status) && !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+			break;
+		}
 
-	do {
-		p->conn->security_state.auth_info->credentials = credentials;
+		if (!credentials.length) {
+			break;
+		}
 
+		p->conn->security_state.auth_info->credentials = credentials;
+		
 		if (auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
 			status = dcerpc_alter_context(p, tmp_ctx, &p->syntax, &p->transfer_syntax);
-			if (NT_STATUS_IS_OK(status)) {
-				status = gensec_update(p->conn->security_state.generic_state, tmp_ctx,
-						       p->conn->security_state.auth_info->credentials,
-						       &credentials);
+			if (!NT_STATUS_IS_OK(status)) {
+				break;
 			}
 		} else {
 			status = dcerpc_auth3(p->conn, tmp_ctx);
+			credentials = data_blob(NULL, 0);
+			if (!NT_STATUS_IS_OK(status)) {
+				break;
+			}
 		}
-	} while (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED));
+	};
 
 done:
 	talloc_free(tmp_ctx);
@@ -122,3 +128,74 @@ done:
 	return status;
 }
 
+/*
+  setup GENSEC on a DCE-RPC pipe
+*/
+NTSTATUS dcerpc_bind_auth_password(struct dcerpc_pipe *p,
+				   const char *uuid, uint_t version,
+				   const char *domain,
+				   const char *username,
+				   const char *password,
+				   uint8_t auth_type)
+{
+	NTSTATUS status;
+
+	if (!(p->conn->flags & (DCERPC_SIGN | DCERPC_SEAL))) {
+		p->conn->flags |= DCERPC_CONNECT;
+	}
+
+	status = gensec_client_start(p, &p->conn->security_state.generic_state);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(1, ("Failed to start GENSEC client mode: %s\n", nt_errstr(status)));
+		return status;
+	}
+
+	status = gensec_set_domain(p->conn->security_state.generic_state, domain);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(1, ("Failed to start set GENSEC client domain to %s: %s\n", 
+			  domain, nt_errstr(status)));
+		return status;
+	}
+
+	status = gensec_set_username(p->conn->security_state.generic_state, username);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(1, ("Failed to start set GENSEC client username to %s: %s\n", 
+			  username, nt_errstr(status)));
+		return status;
+	}
+
+	status = gensec_set_password(p->conn->security_state.generic_state, password);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(1, ("Failed to start set GENSEC client password: %s\n", 
+			  nt_errstr(status)));
+		return status;
+	}
+
+	status = gensec_set_target_hostname(p->conn->security_state.generic_state, 
+					    p->conn->transport.peer_name(p->conn));
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(1, ("Failed to start set GENSEC target hostname: %s\n", 
+			  nt_errstr(status)));
+		return status;
+	}
+
+	status = gensec_start_mech_by_authtype(p->conn->security_state.generic_state, 
+					       auth_type,
+					       dcerpc_auth_level(p->conn));
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(1, ("Failed to start set GENSEC client mechanism %s: %s\n",
+			  gensec_get_name_by_authtype(auth_type), nt_errstr(status)));
+		return status;
+	}
+	
+	status = dcerpc_bind_auth(p, auth_type,
+				  dcerpc_auth_level(p->conn),
+				  uuid, version);
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(2, ("Failed to bind to pipe with %s: %s\n", 
+			  gensec_get_name_by_authtype(auth_type), nt_errstr(status)));
+		return status;
+	}
+
+	return status;
+}