auth/gensec: enforce that all DCERPC contexts support SIGN_PKT_HEADER
authorStefan Metzmacher <metze@samba.org>
Wed, 31 Oct 2018 14:55:57 +0000 (15:55 +0100)
committerJeremy Allison <jra@samba.org>
Sun, 23 Dec 2018 20:33:51 +0000 (21:33 +0100)
That's currently always the case and will simplifies the callers.

WORKS now???
TDB_NO_FSYNC=1 buildnice make -j test FAIL_IMMEDIATELY=1 SOCKET_WRAPPER_KEEP_PCAP=1 TESTS='samba4.rpc.lsa.secrets.*ncacn_np.*Kerberos.*Samba3.*fl2000dc'
and
TDB_NO_FSYNC=1 buildnice make -j test FAIL_IMMEDIATELY=1 SOCKET_WRAPPER_KEEP_PCAP=1 TESTS='samba3.rpc.lsa.*ncacn_ip_tcp.*nt4_dc'

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Sun Dec 23 21:33:51 CET 2018 on sn-devel-144

auth/gensec/gensec.c

index e021d0c..91d8cce 100644 (file)
@@ -293,6 +293,8 @@ _PUBLIC_ size_t gensec_max_update_size(struct gensec_security *gensec_security)
 
 static NTSTATUS gensec_verify_features(struct gensec_security *gensec_security)
 {
+       bool ok;
+
        /*
         * gensec_want_feature(GENSEC_FEATURE_SIGN)
         * and
@@ -319,6 +321,20 @@ static NTSTATUS gensec_verify_features(struct gensec_security *gensec_security)
                }
        }
 
+       if (gensec_security->dcerpc_auth_level < DCERPC_AUTH_LEVEL_PACKET) {
+               return NT_STATUS_OK;
+       }
+
+       ok = gensec_have_feature(gensec_security,
+                                GENSEC_FEATURE_SIGN_PKT_HEADER);
+       if (!ok) {
+               DBG_ERR("backend [%s] does not support header signing! "
+                       "auth_level[0x%x]\n",
+                       gensec_security->ops->name,
+                       gensec_security->dcerpc_auth_level);
+               return NT_STATUS_INTERNAL_ERROR;
+       }
+
        return NT_STATUS_OK;
 }