auth/gensec: split out a gensec_verify_dcerpc_auth_level() function

We only need this logic once.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

diff --git a/auth/gensec/gensec.c b/auth/gensec/gensec.c
index 9fd5f2545544304ec6005011ecdd4f6e3b62bdf9..e3b13521ed2b4b2cad308f0cf9cebb706a7ec095 100644 (file)
--- a/auth/gensec/gensec.c
+++ b/auth/gensec/gensec.c
@@ -217,6 +217,50 @@ _PUBLIC_ size_t gensec_max_update_size(struct gensec_security *gensec_security)
        return gensec_security->max_update_size;
 }
 
+static NTSTATUS gensec_verify_dcerpc_auth_level(struct gensec_security *gensec_security)
+{
+       if (gensec_security->dcerpc_auth_level == 0) {
+               return NT_STATUS_OK;
+       }
+
+       /*
+        * Because callers using the
+        * gensec_start_mech_by_auth_type() never call
+        * gensec_want_feature(), it isn't sensible for them
+        * to have to call gensec_have_feature() manually, and
+        * these are not points of negotiation, but are
+        * asserted by the client
+        */
+       switch (gensec_security->dcerpc_auth_level) {
+       case DCERPC_AUTH_LEVEL_INTEGRITY:
+               if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
+                       DEBUG(0,("Did not manage to negotiate mandetory feature "
+                                "SIGN for dcerpc auth_level %u\n",
+                                gensec_security->dcerpc_auth_level));
+                       return NT_STATUS_ACCESS_DENIED;
+               }
+               break;
+       case DCERPC_AUTH_LEVEL_PRIVACY:
+               if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
+                       DEBUG(0,("Did not manage to negotiate mandetory feature "
+                                "SIGN for dcerpc auth_level %u\n",
+                                gensec_security->dcerpc_auth_level));
+                       return NT_STATUS_ACCESS_DENIED;
+               }
+               if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
+                       DEBUG(0,("Did not manage to negotiate mandetory feature "
+                                "SEAL for dcerpc auth_level %u\n",
+                                gensec_security->dcerpc_auth_level));
+                       return NT_STATUS_ACCESS_DENIED;
+               }
+               break;
+       default:
+               break;
+       }
+
+       return NT_STATUS_OK;
+}
+
 _PUBLIC_ NTSTATUS gensec_update_ev(struct gensec_security *gensec_security,
                                   TALLOC_CTX *out_mem_ctx,
                                   struct tevent_context *ev,
@@ -261,31 +305,9 @@ _PUBLIC_ NTSTATUS gensec_update_ev(struct gensec_security *gensec_security,
                 * these are not points of negotiation, but are
                 * asserted by the client
                 */
-               switch (gensec_security->dcerpc_auth_level) {
-               case DCERPC_AUTH_LEVEL_INTEGRITY:
-                       if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
-                               DEBUG(0,("Did not manage to negotiate mandetory feature "
-                                        "SIGN for dcerpc auth_level %u\n",
-                                        gensec_security->dcerpc_auth_level));
-                               return NT_STATUS_ACCESS_DENIED;
-                       }
-                       break;
-               case DCERPC_AUTH_LEVEL_PRIVACY:
-                       if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
-                               DEBUG(0,("Did not manage to negotiate mandetory feature "
-                                        "SIGN for dcerpc auth_level %u\n",
-                                        gensec_security->dcerpc_auth_level));
-                               return NT_STATUS_ACCESS_DENIED;
-                       }
-                       if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
-                               DEBUG(0,("Did not manage to negotiate mandetory feature "
-                                        "SEAL for dcerpc auth_level %u\n",
-                                        gensec_security->dcerpc_auth_level));
-                               return NT_STATUS_ACCESS_DENIED;
-                       }
-                       break;
-               default:
-                       break;
+               status = gensec_verify_dcerpc_auth_level(gensec_security);
+               if (!NT_STATUS_IS_OK(status)) {
+                       return status;
                }
 
                return NT_STATUS_OK;
@@ -458,34 +480,9 @@ static void gensec_update_subreq_done(struct tevent_req *subreq)
         * these are not points of negotiation, but are
         * asserted by the client
         */
-       switch (state->gensec_security->dcerpc_auth_level) {
-       case DCERPC_AUTH_LEVEL_INTEGRITY:
-               if (!gensec_have_feature(state->gensec_security, GENSEC_FEATURE_SIGN)) {
-                       DEBUG(0,("Did not manage to negotiate mandetory feature "
-                                "SIGN for dcerpc auth_level %u\n",
-                                state->gensec_security->dcerpc_auth_level));
-                       tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
-                       return;
-               }
-               break;
-       case DCERPC_AUTH_LEVEL_PRIVACY:
-               if (!gensec_have_feature(state->gensec_security, GENSEC_FEATURE_SIGN)) {
-                       DEBUG(0,("Did not manage to negotiate mandetory feature "
-                                "SIGN for dcerpc auth_level %u\n",
-                                state->gensec_security->dcerpc_auth_level));
-                       tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
-                       return;
-               }
-               if (!gensec_have_feature(state->gensec_security, GENSEC_FEATURE_SEAL)) {
-                       DEBUG(0,("Did not manage to negotiate mandetory feature "
-                                "SEAL for dcerpc auth_level %u\n",
-                                state->gensec_security->dcerpc_auth_level));
-                       tevent_req_nterror(req, NT_STATUS_ACCESS_DENIED);
-                       return;
-               }
-               break;
-       default:
-               break;
+       status = gensec_verify_dcerpc_auth_level(state->gensec_security);
+       if (tevent_req_nterror(req, status)) {
+               return;
        }
 
        tevent_req_done(req);