r4079: implement the gensec_have_feature() correctly by asking

the backend what is actually in use

metze
(This used to be commit 6f3eb7bc03609108b9e0ea5676fca3d04140e737)

diff --git a/source4/ldap_server/ldap_server.c b/source4/ldap_server/ldap_server.c
index 9f256b0b8b3af22dacf8f443923d15e84e5b5748..ea1b8cb9b4a8936976dafd31c2c092cb08728ac7 100644 (file)
--- a/source4/ldap_server/ldap_server.c
+++ b/source4/ldap_server/ldap_server.c
@@ -195,8 +195,8 @@ static BOOL ldapsrv_read_buf(struct ldapsrv_connection *conn)
        size_t nread;
 
        if (!conn->gensec || !conn->session_info ||
-          !(gensec_have_feature(conn->gensec, GENSEC_WANT_SIGN) &&
-            gensec_have_feature(conn->gensec, GENSEC_WANT_SEAL))) {
+          !(gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN) &&
+            gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL))) {
                return read_into_buf(sock, &conn->in_buffer);
        }
 
@@ -254,7 +254,7 @@ static BOOL ldapsrv_read_buf(struct ldapsrv_connection *conn)
        tmp_blob.data = buf + (4 + creds.length);
        tmp_blob.length = (4 + sasl_length) - (4 + creds.length);
 
-       if (gensec_have_feature(conn->gensec, GENSEC_WANT_SEAL)) {
+       if (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL)) {
                status = gensec_unseal_packet(conn->gensec, mem_ctx,
                                              tmp_blob.data, tmp_blob.length,
                                              tmp_blob.data, tmp_blob.length,
@@ -320,8 +320,8 @@ static BOOL ldapsrv_write_buf(struct ldapsrv_connection *conn)
        TALLOC_CTX *mem_ctx;
 
        if (!conn->gensec || !conn->session_info ||
-          !(gensec_have_feature(conn->gensec, GENSEC_WANT_SIGN) &&
-            gensec_have_feature(conn->gensec, GENSEC_WANT_SEAL))) {
+          !(gensec_have_feature(conn->gensec, GENSEC_FEATURE_SIGN) &&
+            gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL))) {
                return write_from_buf(sock, &conn->out_buffer);
        }
 
@@ -338,7 +338,7 @@ static BOOL ldapsrv_write_buf(struct ldapsrv_connection *conn)
                goto nodata;
        }
 
-       if (gensec_have_feature(conn->gensec, GENSEC_WANT_SEAL)) {
+       if (gensec_have_feature(conn->gensec, GENSEC_FEATURE_SEAL)) {
                status = gensec_seal_packet(conn->gensec, mem_ctx,
                                            tmp_blob.data, tmp_blob.length,
                                            tmp_blob.data, tmp_blob.length,

diff --git a/source4/libcli/auth/gensec.c b/source4/libcli/auth/gensec.c
index 7243222b6d25a5a74d9c94cd58c34edc7cc17817..147d1b12df95d349881bd15a99071f46d3b6e93b 100644 (file)
--- a/source4/libcli/auth/gensec.c
+++ b/source4/libcli/auth/gensec.c
@@ -137,6 +137,7 @@ static NTSTATUS gensec_start(TALLOC_CTX *mem_ctx, struct gensec_security **gense
 
        (*gensec_security)->subcontext = False;
        (*gensec_security)->want_features = 0;
+       (*gensec_security)->have_features = 0;
        return NT_STATUS_OK;
 }
 
@@ -232,11 +233,11 @@ NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_security,
                return NT_STATUS_INVALID_PARAMETER;
        }
        if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
-               gensec_want_feature(gensec_security, GENSEC_WANT_SIGN);
+               gensec_want_feature(gensec_security, GENSEC_FEATURE_SIGN);
        }
        if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
-               gensec_want_feature(gensec_security, GENSEC_WANT_SIGN);
-               gensec_want_feature(gensec_security, GENSEC_WANT_SEAL);
+               gensec_want_feature(gensec_security, GENSEC_FEATURE_SIGN);
+               gensec_want_feature(gensec_security, GENSEC_FEATURE_SEAL);
        }
 
        return gensec_start_mech(gensec_security);
@@ -310,8 +311,8 @@ NTSTATUS gensec_unseal_packet(struct gensec_security *gensec_security,
        if (!gensec_security->ops->unseal_packet) {
                return NT_STATUS_NOT_IMPLEMENTED;
        }
-       if (!(gensec_security->want_features & GENSEC_WANT_SEAL)) {
-               if (gensec_security->want_features & GENSEC_WANT_SIGN) {
+       if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
+               if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
                        return gensec_check_packet(gensec_security, mem_ctx, 
                                                   data, length, 
                                                   whole_pdu, pdu_length, 
@@ -335,7 +336,7 @@ NTSTATUS gensec_check_packet(struct gensec_security *gensec_security,
        if (!gensec_security->ops->check_packet) {
                return NT_STATUS_NOT_IMPLEMENTED;
        }
-       if (!(gensec_security->want_features & GENSEC_WANT_SIGN)) {
+       if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
                return NT_STATUS_INVALID_PARAMETER;
        }
        
@@ -351,8 +352,8 @@ NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security,
        if (!gensec_security->ops->seal_packet) {
                return NT_STATUS_NOT_IMPLEMENTED;
        }
-       if (!(gensec_security->want_features & GENSEC_WANT_SEAL)) {
-               if (gensec_security->want_features & GENSEC_WANT_SIGN) {
+       if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
+               if (gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
                        return gensec_sign_packet(gensec_security, mem_ctx, 
                                                  data, length, 
                                                  whole_pdu, pdu_length, 
@@ -373,7 +374,7 @@ NTSTATUS gensec_sign_packet(struct gensec_security *gensec_security,
        if (!gensec_security->ops->sign_packet) {
                return NT_STATUS_NOT_IMPLEMENTED;
        }
-       if (!(gensec_security->want_features & GENSEC_WANT_SIGN)) {
+       if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
                return NT_STATUS_INVALID_PARAMETER;
        }
        
@@ -385,7 +386,7 @@ size_t gensec_sig_size(struct gensec_security *gensec_security)
        if (!gensec_security->ops->sig_size) {
                return 0;
        }
-       if (!(gensec_security->want_features & GENSEC_WANT_SIGN)) {
+       if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
                return 0;
        }
        
@@ -398,10 +399,6 @@ NTSTATUS gensec_session_key(struct gensec_security *gensec_security,
        if (!gensec_security->ops->session_key) {
                return NT_STATUS_NOT_IMPLEMENTED;
        }
-       if (!(gensec_security->want_features & GENSEC_WANT_SESSION_KEY)) {
-               return NT_STATUS_INVALID_PARAMETER;
-       }
-       
        return gensec_security->ops->session_key(gensec_security, session_key);
 }
 
@@ -474,7 +471,7 @@ void gensec_want_feature(struct gensec_security *gensec_security,
 BOOL gensec_have_feature(struct gensec_security *gensec_security,
                         uint32 feature) 
 {
-       if (gensec_security->want_features & feature) {
+       if (gensec_security->have_features & feature) {
                return True;
        }
 

diff --git a/source4/libcli/auth/gensec.h b/source4/libcli/auth/gensec.h
index f8b7e292e8442ef3ae5925634da311f5e9c6fc68..3d645bee82197c9ca5f101939b6034cd7d242a6f 100644 (file)
--- a/source4/libcli/auth/gensec.h
+++ b/source4/libcli/auth/gensec.h
@@ -41,9 +41,9 @@ struct gensec_target {
        const char *service;
 };
 
-#define GENSEC_WANT_SESSION_KEY 0x1
-#define GENSEC_WANT_SIGN 0x2
-#define GENSEC_WANT_SEAL 0x4
+#define GENSEC_FEATURE_SESSION_KEY     0x00000001
+#define GENSEC_FEATURE_SIGN            0x00000002
+#define GENSEC_FEATURE_SEAL            0x00000004
 
 /* GENSEC mode */
 enum gensec_role
@@ -99,6 +99,7 @@ struct gensec_security {
        enum gensec_role gensec_role;
        BOOL subcontext;
        uint32 want_features;
+       uint32 have_features;
 };
 
 /* this structure is used by backends to determine the size of some critical types */

diff --git a/source4/libcli/auth/gensec_ntlmssp.c b/source4/libcli/auth/gensec_ntlmssp.c
index 147e2359f428ce0d013502c2da22cfeb3705f9db..07dacfb5e06af7d7fd7cabafddcc5c197103730e 100644 (file)
--- a/source4/libcli/auth/gensec_ntlmssp.c
+++ b/source4/libcli/auth/gensec_ntlmssp.c
@@ -178,10 +178,10 @@ static NTSTATUS gensec_ntlmssp_server_start(struct gensec_security *gensec_secur
                return nt_status;
        }
 
-       if (gensec_security->want_features & GENSEC_WANT_SIGN) {
+       if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
                gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
        }
-       if (gensec_security->want_features & GENSEC_WANT_SEAL) {
+       if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
                gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
        }
 
@@ -219,7 +219,7 @@ static NTSTATUS gensec_ntlmssp_client_start(struct gensec_security *gensec_secur
                return status;
        }
 
-       if (gensec_security->want_features & GENSEC_WANT_SESSION_KEY) {
+       if (gensec_security->want_features & GENSEC_FEATURE_SESSION_KEY) {
                /*
                 * We need to set this to allow a later SetPassword
                 * via the SAMR pipe to succeed. Strange.... We could
@@ -231,10 +231,10 @@ static NTSTATUS gensec_ntlmssp_client_start(struct gensec_security *gensec_secur
                 */
                gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
        }
-       if (gensec_security->want_features & GENSEC_WANT_SIGN) {
+       if (gensec_security->want_features & GENSEC_FEATURE_SIGN) {
                gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
        }
-       if (gensec_security->want_features & GENSEC_WANT_SEAL) {
+       if (gensec_security->want_features & GENSEC_FEATURE_SEAL) {
                gensec_ntlmssp_state->ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
        }
 
@@ -343,8 +343,27 @@ static NTSTATUS gensec_ntlmssp_update(struct gensec_security *gensec_security, T
                                      const DATA_BLOB in, DATA_BLOB *out) 
 {
        struct gensec_ntlmssp_state *gensec_ntlmssp_state = gensec_security->private_data;
+       NTSTATUS status;
+
+       status = ntlmssp_update(gensec_ntlmssp_state->ntlmssp_state, out_mem_ctx, in, out);
+
+       if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED) && !NT_STATUS_IS_OK(status)) {
+               return status;
+       }
+
+       if (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
+               gensec_security->have_features |= GENSEC_FEATURE_SIGN;
+       }
+
+       if (gensec_ntlmssp_state->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
+               gensec_security->have_features |= GENSEC_FEATURE_SEAL;
+       }
 
-       return ntlmssp_update(gensec_ntlmssp_state->ntlmssp_state, out_mem_ctx, in, out);
+       if (gensec_ntlmssp_state->ntlmssp_state->session_key.data) {
+               gensec_security->have_features |= GENSEC_FEATURE_SESSION_KEY;
+       }
+
+       return status;
 }
 
 /** 

diff --git a/source4/libcli/ldap/ldap_client.c b/source4/libcli/ldap/ldap_client.c
index 88c84d880ba3300b103a9fc2aae3346150efba63..a9b20b4ea8e0e8a6743e233d82897895b70c28e5 100644 (file)
--- a/source4/libcli/ldap/ldap_client.c
+++ b/source4/libcli/ldap/ldap_client.c
@@ -382,7 +382,7 @@ int ldap_bind_sasl(struct ldap_connection *conn, const char *username, const cha
                return result;
        }
 
-       gensec_want_feature(conn->gensec, GENSEC_WANT_SIGN | GENSEC_WANT_SEAL);
+       gensec_want_feature(conn->gensec, GENSEC_FEATURE_SIGN | GENSEC_FEATURE_SEAL);
 
        status = gensec_set_domain(conn->gensec, domain);
        if (!NT_STATUS_IS_OK(status)) {

diff --git a/source4/smb_server/sesssetup.c b/source4/smb_server/sesssetup.c
index 453f296c78458c8af4b5f4e84af6b39e60946ac0..d8dde02c123d9ec693b46545032f24e00e44d469 100644 (file)
--- a/source4/smb_server/sesssetup.c
+++ b/source4/smb_server/sesssetup.c
@@ -238,7 +238,7 @@ static NTSTATUS sesssetup_spnego(struct smbsrv_request *req, union smb_sesssetup
                        return status;
                }
 
-               gensec_want_feature(gensec_ctx, GENSEC_WANT_SESSION_KEY);
+               gensec_want_feature(gensec_ctx, GENSEC_FEATURE_SESSION_KEY);
 
                status = gensec_start_mech_by_oid(gensec_ctx, GENSEC_OID_SPNEGO);
                if (!NT_STATUS_IS_OK(status)) {