From b4c9dc3724b5c34661b6986e81af2dc6c191dde9 Mon Sep 17 00:00:00 2001
From: Simo Sorce <idra@samba.org>
Date: Thu, 18 Feb 2010 10:19:09 -0500
Subject: s3:schannel more readable check logic

Make the initial schannel check logic more understandable.
Make it easy to define different policies depending on ther caller's security
requirements (Integrity/Privacy/Both/None)
---
 source3/rpc_server/srv_netlog_nt.c | 44 +++++++++++++++++++++++++++++++++-----
 1 file changed, 39 insertions(+), 5 deletions(-)

(limited to 'source3')

diff --git a/source3/rpc_server/srv_netlog_nt.c b/source3/rpc_server/srv_netlog_nt.c
index 71463c28ad..769936ca20 100644
--- a/source3/rpc_server/srv_netlog_nt.c
+++ b/source3/rpc_server/srv_netlog_nt.c
@@ -765,6 +765,36 @@ NTSTATUS _netr_ServerAuthenticate2(pipes_struct *p,
 	return _netr_ServerAuthenticate3(p, &a);
 }
 
+/*************************************************************************
+ * If schannel is required for this call test that it actually is available.
+ *************************************************************************/
+static NTSTATUS schannel_check_required(struct pipe_auth_data *auth_info,
+					const char *computer_name,
+					bool integrity, bool privacy)
+{
+	if (auth_info && auth_info->auth_type == PIPE_AUTH_TYPE_SCHANNEL) {
+		if (!privacy && !integrity) {
+			return NT_STATUS_OK;
+		}
+
+		if ((!privacy && integrity) &&
+		    auth_info->auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
+			return NT_STATUS_OK;
+		}
+
+		if ((privacy || integrity) &&
+		    auth_info->auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
+			return NT_STATUS_OK;
+		}
+	}
+
+	/* test didn't pass */
+	DEBUG(0, ("schannel_check_required: [%s] is not using schannel\n",
+		  computer_name));
+
+	return NT_STATUS_ACCESS_DENIED;
+}
+
 /*************************************************************************
  *************************************************************************/
 
@@ -778,9 +808,15 @@ static NTSTATUS netr_creds_server_step_check(pipes_struct *p,
 	NTSTATUS status;
 	struct tdb_context *tdb;
 	bool schannel_global_required = (lp_server_schannel() == true) ? true:false;
-	bool schannel_in_use = (p->auth.auth_type == PIPE_AUTH_TYPE_SCHANNEL) ? true:false; /* &&
-		(p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY ||
-		 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY); */
+
+	if (schannel_global_required) {
+		status = schannel_check_required(&p->auth,
+						 computer_name,
+						 false, false);
+		if (!NT_STATUS_IS_OK(status)) {
+			return status;
+		}
+	}
 
 	tdb = open_schannel_session_store(mem_ctx);
 	if (!tdb) {
@@ -789,8 +825,6 @@ static NTSTATUS netr_creds_server_step_check(pipes_struct *p,
 
 	status = schannel_creds_server_step_check_tdb(tdb, mem_ctx,
 						      computer_name,
-						      schannel_global_required,
-						      schannel_in_use,
 						      received_authenticator,
 						      return_authenticator,
 						      creds_out);
-- 
cgit