gensec: Refuse to seal if we did not negotiate to sign
authorAndrew Bartlett <abartlet@samba.org>
Sat, 15 Oct 2011 03:56:01 +0000 (14:56 +1100)
committerAndrew Bartlett <abartlet@samba.org>
Tue, 18 Oct 2011 02:13:33 +0000 (13:13 +1100)
Signed-off-by: Stefan Metzmacher <metze@samba.org>
auth/gensec/gensec.c

index c0ebc68..b7f89f1 100644 (file)
@@ -76,6 +76,9 @@ _PUBLIC_ NTSTATUS gensec_seal_packet(struct gensec_security *gensec_security,
        if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SEAL)) {
                return NT_STATUS_INVALID_PARAMETER;
        }
+       if (!gensec_have_feature(gensec_security, GENSEC_FEATURE_SIGN)) {
+               return NT_STATUS_INVALID_PARAMETER;
+       }
 
        return gensec_security->ops->seal_packet(gensec_security, mem_ctx, data, length, whole_pdu, pdu_length, sig);
 }