selftest: test plugin_s4_dc against all ncacn_np tests

Changes to the s3 epmapper behaviour seem to have fixed the rest of these
tests.

Andrew Bartlett

diff --git a/source3/auth/auth.c b/source3/auth/auth.c
index f2cd7032972de2a8be6d46bd0be5f834aa7e775e..4e413b1de5ba228a90fac45aa3f09d576f937304 100644 (file)
--- a/source3/auth/auth.c
+++ b/source3/auth/auth.c
@@ -462,9 +462,10 @@ static NTSTATUS make_auth_context_text_list(TALLOC_CTX *mem_ctx,
 
        /* Look for the first module to provide a start_gensec hook, and set that if provided */
        for (method = (*auth_context)->auth_method_list; method; method = method->next) {
-               if (method->prepare_gensec && method->gensec_start_mech_by_oid) {
+               if (method->prepare_gensec) {
                        (*auth_context)->prepare_gensec = method->prepare_gensec;
                        (*auth_context)->gensec_start_mech_by_oid = method->gensec_start_mech_by_oid;
+                       (*auth_context)->gensec_start_mech_by_authtype = method->gensec_start_mech_by_authtype;
                        break;
                }
        }

diff --git a/source3/auth/auth_ntlmssp.c b/source3/auth/auth_ntlmssp.c
index e52cf9209d0a597a68a95a59f4ee9e7e6909d361..cccb319ccc63efd989fe1090e8435321bd0cecb2 100644 (file)
--- a/source3/auth/auth_ntlmssp.c
+++ b/source3/auth/auth_ntlmssp.c
@@ -27,6 +27,7 @@
 #include "../librpc/gen_ndr/netlogon.h"
 #include "../lib/tsocket/tsocket.h"
 #include "auth/gensec/gensec.h"
+#include "librpc/rpc/dcerpc.h"
 
 NTSTATUS auth_ntlmssp_session_info(TALLOC_CTX *mem_ctx,
                                   struct auth_ntlmssp_state *auth_ntlmssp_state,
@@ -290,6 +291,41 @@ NTSTATUS auth_generic_start(struct auth_ntlmssp_state *auth_ntlmssp_state, const
        return NT_STATUS_OK;
 }
 
+NTSTATUS auth_generic_authtype_start(struct auth_ntlmssp_state *auth_ntlmssp_state, 
+                                    uint8_t auth_type, uint8_t auth_level)
+{
+       if (auth_ntlmssp_state->auth_context->gensec_start_mech_by_authtype) {
+               return auth_ntlmssp_state->auth_context->gensec_start_mech_by_authtype(auth_ntlmssp_state->gensec_security,
+                                                                                      auth_type, auth_level);
+       }
+
+       if (auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
+               /* The caller will then free the auth_ntlmssp_state,
+                * undoing what was done in auth_ntlmssp_prepare().
+                *
+                * We can't do that logic here, as
+                * auth_ntlmssp_want_feature() may have been called in
+                * between.
+                */
+               return NT_STATUS_NOT_IMPLEMENTED;
+       }
+
+       if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
+               auth_ntlmssp_want_feature(auth_ntlmssp_state, NTLMSSP_FEATURE_SIGN);
+       } else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
+               /* Always implies both sign and seal for ntlmssp */
+               auth_ntlmssp_want_feature(auth_ntlmssp_state, NTLMSSP_FEATURE_SEAL);
+       } else if (auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
+               /* Default features */
+       } else {
+               DEBUG(2,("auth_level %d not supported in DCE/RPC authentication\n",
+                        auth_level));
+               return NT_STATUS_INVALID_PARAMETER;
+       }
+
+       return NT_STATUS_OK;
+}
+
 NTSTATUS auth_ntlmssp_start(struct auth_ntlmssp_state *auth_ntlmssp_state)
 {
        return auth_generic_start(auth_ntlmssp_state, GENSEC_OID_NTLMSSP);

diff --git a/source3/auth/auth_samba4.c b/source3/auth/auth_samba4.c
index 2c9a6a0f8c334d36d7db67bcf350e1de10ca4202..7315c1621bd3aef35d603d4da04ac21f5feb35af 100644 (file)
--- a/source3/auth/auth_samba4.c
+++ b/source3/auth/auth_samba4.c
@@ -187,6 +187,7 @@ static NTSTATUS auth_init_samba4(struct auth_context *auth_context,
        result->auth = check_samba4_security;
        result->prepare_gensec = prepare_gensec;
        result->gensec_start_mech_by_oid = gensec_start_mech_by_oid;
+       result->gensec_start_mech_by_authtype = gensec_start_mech_by_authtype;
 
         *auth_method = result;
        return NT_STATUS_OK;

diff --git a/source3/auth/proto.h b/source3/auth/proto.h
index 239e8ff45481e31a33f1a6d15c22052d470f4894..5dded1421ca4e364006aefb0ff760f865e82f059 100644 (file)
--- a/source3/auth/proto.h
+++ b/source3/auth/proto.h
@@ -76,6 +76,8 @@ NTSTATUS auth_ntlmssp_prepare(const struct tsocket_address *remote_address,
                              struct auth_ntlmssp_state **auth_ntlmssp_state);
 NTSTATUS auth_ntlmssp_start(struct auth_ntlmssp_state *auth_ntlmssp_state);
 NTSTATUS auth_generic_start(struct auth_ntlmssp_state *auth_ntlmssp_state, const char *oid);
+NTSTATUS auth_generic_authtype_start(struct auth_ntlmssp_state *auth_ntlmssp_state, 
+                                    uint8_t auth_type, uint8_t auth_level);
 
 
 /* The following definitions come from auth/auth_sam.c  */

diff --git a/source3/include/auth.h b/source3/include/auth.h
index f7422f0600f02400c8b52d704334fc2286e0fe60..6721b1f1884faff0af043c97c2184f5e384b6f38 100644 (file)
--- a/source3/include/auth.h
+++ b/source3/include/auth.h
@@ -88,6 +88,7 @@ struct auth_context {
        NTSTATUS (*prepare_gensec)(TALLOC_CTX *mem_ctx,
                                 struct gensec_security **gensec_context);
        NTSTATUS (*gensec_start_mech_by_oid)(struct gensec_security *gensec_context, const char *oid_string);
+       NTSTATUS (*gensec_start_mech_by_authtype)(struct gensec_security *gensec_context, uint8_t auth_type, uint8_t auth_level);
 };
 
 typedef struct auth_methods
@@ -113,6 +114,7 @@ typedef struct auth_methods
        NTSTATUS (*prepare_gensec)(TALLOC_CTX *mem_ctx,
                                 struct gensec_security **gensec_context);
        NTSTATUS (*gensec_start_mech_by_oid)(struct gensec_security *gensec_context, const char *oid_string);
+       NTSTATUS (*gensec_start_mech_by_authtype)(struct gensec_security *gensec_context, uint8_t auth_type, uint8_t auth_level);
        /* Used to keep tabs on things like the cli for SMB server authentication */
        void *private_data;
 

diff --git a/source3/librpc/rpc/dcerpc.h b/source3/librpc/rpc/dcerpc.h
index d7e8e0c193d1587dfc128df9963f92ab2033bcb7..be23e10130de12ac711974e4fb52783f9387480c 100644 (file)
--- a/source3/librpc/rpc/dcerpc.h
+++ b/source3/librpc/rpc/dcerpc.h
@@ -39,6 +39,8 @@ struct NL_AUTH_MESSAGE;
 struct pipe_auth_data {
        enum dcerpc_AuthType auth_type;
        enum dcerpc_AuthLevel auth_level;
+       
+       bool gensec_hook;
 
        void *auth_ctx;
 

diff --git a/source4/selftest/tests.py b/source4/selftest/tests.py
index 538ec5d4516ae0e9be2131f8b6adc9f4b1180337..0902a3ec2910a7c4ae7d7a243bc9f1cf905d707f 100755 (executable)
--- a/source4/selftest/tests.py
+++ b/source4/selftest/tests.py
@@ -135,7 +135,7 @@ for bindoptions in ["seal,padcheck"] + validate_list + ["bigendian"]:
 #Plugin S4 DC tests (confirms named pipe auth forwarding).  This can be expanded once kerberos is supported in the plugin DC
 #
 for bindoptions in ["seal,padcheck"] + validate_list + ["bigendian"]:
-    for t in [ "rpc.lsalookup", "rpc.lsa.secrets", "rpc.lsa-getuser", "rpc.handles", "rpc.asyncbind", "rpc.authcontext", "rpc.lsa"]:
+    for t in ncacn_np_tests:
         env = "plugin_s4_dc"
         transport = "ncacn_np"
         plantestsuite_loadlist("samba4.%s with %s" % (t, bindoptions), env, [valgrindify(smb4torture), "$LISTOPT", "%s:$SERVER[%s]" % (transport, bindoptions), '-U$USERNAME%$PASSWORD', '-W', '$DOMAIN', '-k', 'no', t])