s3-auth: Pass service_description into gensec via auth_generic_prepare()

This allows the GENSEC service description to be set from the various callers
that go via this function.

The RPC service description is the name of the interface from the IDL.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Pair-Programmed-by: Gary Lockyer <gary@catalyst.net.nz>
Signed-off-by: Gary Lockyer <gary@catalyst.net.nz>

diff --git a/source3/auth/auth_generic.c b/source3/auth/auth_generic.c
index b7b9527f976494fb95345a94d8142a0380294806..70eb5145932633c540db26fe9b39bba2ce331b28 100644 (file)
--- a/source3/auth/auth_generic.c
+++ b/source3/auth/auth_generic.c
@@ -233,6 +233,7 @@ NTSTATUS make_auth4_context(TALLOC_CTX *mem_ctx, struct auth4_context **auth4_co
 
 NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
                              const struct tsocket_address *remote_address,
+                             const char *service_description,
                              struct gensec_security **gensec_security_out)
 {
        struct gensec_security *gensec_security;
@@ -377,6 +378,14 @@ NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx,
                return nt_status;
        }
 
+       nt_status = gensec_set_target_service_description(gensec_security,
+                                                         service_description);
+
+       if (!NT_STATUS_IS_OK(nt_status)) {
+               TALLOC_FREE(tmp_ctx);
+               return nt_status;
+       }
+
        *gensec_security_out = talloc_steal(mem_ctx, gensec_security);
        TALLOC_FREE(tmp_ctx);
        return NT_STATUS_OK;

diff --git a/source3/auth/proto.h b/source3/auth/proto.h
index c5f6ade1ea472a74d421ea9cccfc53e3d14eb486..7df30048d828df8d7a1c53d2a0dc96f1edf5c30f 100644 (file)
--- a/source3/auth/proto.h
+++ b/source3/auth/proto.h
@@ -106,6 +106,7 @@ NTSTATUS auth_domain_init(void);
 
 NTSTATUS make_auth4_context(TALLOC_CTX *mem_ctx, struct auth4_context **auth4_context_out);
 NTSTATUS auth_generic_prepare(TALLOC_CTX *mem_ctx, const struct tsocket_address *remote_address,
+                             const char *service_description,
                              struct gensec_security **gensec_security_out);
 
 NTSTATUS auth_check_password_session_info(struct auth4_context *auth_context,

diff --git a/source3/rpc_server/dcesrv_auth_generic.c b/source3/rpc_server/dcesrv_auth_generic.c
index a338108a41f910458f198d51e81753e4570aa566..7bdfdeeed94023474f184763472c818c4171bac4 100644 (file)
--- a/source3/rpc_server/dcesrv_auth_generic.c
+++ b/source3/rpc_server/dcesrv_auth_generic.c
@@ -29,12 +29,15 @@ static NTSTATUS auth_generic_server_authtype_start_as_root(TALLOC_CTX *mem_ctx,
                                                           DATA_BLOB *token_in,
                                                           DATA_BLOB *token_out,
                                                           const struct tsocket_address *remote_address,
+                                                          const char *service_description,
                                                           struct gensec_security **ctx)
 {
        struct gensec_security *gensec_security = NULL;
        NTSTATUS status;
 
-       status = auth_generic_prepare(talloc_tos(), remote_address, &gensec_security);
+       status = auth_generic_prepare(talloc_tos(), remote_address,
+                                     service_description,
+                                     &gensec_security);
        if (!NT_STATUS_IS_OK(status)) {
                DEBUG(0, (__location__ ": auth_generic_prepare failed: %s\n",
                          nt_errstr(status)));
@@ -67,6 +70,7 @@ NTSTATUS auth_generic_server_authtype_start(TALLOC_CTX *mem_ctx,
                                            DATA_BLOB *token_in,
                                            DATA_BLOB *token_out,
                                            const struct tsocket_address *remote_address,
+                                           const char *service_description,
                                            struct gensec_security **ctx)
 {
        NTSTATUS status;
@@ -78,6 +82,7 @@ NTSTATUS auth_generic_server_authtype_start(TALLOC_CTX *mem_ctx,
                                                            token_in,
                                                            token_out,
                                                            remote_address,
+                                                           service_description,
                                                            ctx);
        unbecome_root();
        return status;

diff --git a/source3/rpc_server/dcesrv_auth_generic.h b/source3/rpc_server/dcesrv_auth_generic.h
index f288c94621fc8e5b20be8da2f3b2b576b9178780..36e1a83e07729fc91b533ab43737badc4ca543dc 100644 (file)
--- a/source3/rpc_server/dcesrv_auth_generic.h
+++ b/source3/rpc_server/dcesrv_auth_generic.h
@@ -27,6 +27,7 @@ NTSTATUS auth_generic_server_authtype_start(TALLOC_CTX *mem_ctx,
                                            DATA_BLOB *token_in,
                                            DATA_BLOB *token_out,
                                            const struct tsocket_address *remote_address,
+                                           const char *service_description,
                                            struct gensec_security **ctx);
 
 NTSTATUS auth_generic_server_step(struct gensec_security *ctx,

diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c
index 407d8d70583db86aea8ac398d49690f1b43169ef..4a63dd734aaf733500db806c31d5f229e85620e4 100644 (file)
--- a/source3/rpc_server/srv_pipe.c
+++ b/source3/rpc_server/srv_pipe.c
@@ -517,6 +517,7 @@ bool is_known_pipename(const char *pipename, struct ndr_syntax_id *syntax)
 static bool pipe_auth_generic_bind(struct pipes_struct *p,
                                   struct ncacn_packet *pkt,
                                   struct dcerpc_auth *auth_info,
+                                  const char *service_description,
                                   DATA_BLOB *response)
 {
        TALLOC_CTX *mem_ctx = pkt;
@@ -529,6 +530,7 @@ static bool pipe_auth_generic_bind(struct pipes_struct *p,
                                                    &auth_info->credentials,
                                                    response,
                                                    p->remote_address,
+                                                   service_description,
                                                    &gensec_security);
        if (!NT_STATUS_IS_OK(status) &&
            !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED))
@@ -813,7 +815,9 @@ static bool api_pipe_bind_req(struct pipes_struct *p,
                }
 
                if (!pipe_auth_generic_bind(p, pkt,
-                                           &auth_info, &auth_resp)) {
+                                           &auth_info,
+                                           table->name,
+                                           &auth_resp)) {
                        goto err_exit;
                }
        } else {

diff --git a/source3/smbd/negprot.c b/source3/smbd/negprot.c
index 838ff45aad1f0fcdb36dfdee630545c94def5175..b53210112017006b5fa95cfdf820e23ba0632c90 100644 (file)
--- a/source3/smbd/negprot.c
+++ b/source3/smbd/negprot.c
@@ -171,7 +171,15 @@ DATA_BLOB negprot_spnego(TALLOC_CTX *ctx, struct smbXsrv_connection *xconn)
        /* See if we can get an SPNEGO blob */
        status = auth_generic_prepare(talloc_tos(),
                                      xconn->remote_address,
+                                     "SMB",
                                      &gensec_security);
+
+       /*
+        * There is no need to set a remote address or similar as we
+        * are just interested in the SPNEGO blob, we never keep this
+        * context.
+        */
+
        if (NT_STATUS_IS_OK(status)) {
                status = gensec_start_mech_by_oid(gensec_security, GENSEC_OID_SPNEGO);
                if (NT_STATUS_IS_OK(status)) {

diff --git a/source3/smbd/seal.c b/source3/smbd/seal.c
index d2c8951b8793b1caa900a851c42ace78e37c6cad..f406c43b0af340c5ed2dc42df1a62a56ecf5eeb6 100644 (file)
--- a/source3/smbd/seal.c
+++ b/source3/smbd/seal.c
@@ -77,6 +77,7 @@ static NTSTATUS make_auth_gensec(const struct tsocket_address *remote_address,
        NTSTATUS status;
 
        status = auth_generic_prepare(es, remote_address,
+                                     "SMB encryption",
                                      &es->gensec_security);
        if (!NT_STATUS_IS_OK(status)) {
                return nt_status_squash(status);

diff --git a/source3/smbd/sesssetup.c b/source3/smbd/sesssetup.c
index 8ec60937155dd3538baa2c7f6e4e80de173e52da..5196e4f618271c26e8846bcdae0499501ba6aece 100644 (file)
--- a/source3/smbd/sesssetup.c
+++ b/source3/smbd/sesssetup.c
@@ -247,6 +247,7 @@ static void reply_sesssetup_and_X_spnego(struct smb_request *req)
 
        if (auth->gensec == NULL) {
                status = auth_generic_prepare(session, xconn->remote_address,
+                                             "SMB",
                                              &auth->gensec);
                if (!NT_STATUS_IS_OK(status)) {
                        TALLOC_FREE(session);

diff --git a/source3/smbd/smb2_sesssetup.c b/source3/smbd/smb2_sesssetup.c
index 6a0caac13084ecdf2531380c3e1a312af2df36cd..7e3102b0c2bc6b8ab7ab5ed78c9225b1593fe425 100644 (file)
--- a/source3/smbd/smb2_sesssetup.c
+++ b/source3/smbd/smb2_sesssetup.c
@@ -855,6 +855,7 @@ auth:
        if (state->auth->gensec == NULL) {
                status = auth_generic_prepare(state->auth,
                                              state->smb2req->xconn->remote_address,
+                                             "SMB2",
                                              &state->auth->gensec);
                if (tevent_req_nterror(req, status)) {
                        return tevent_req_post(req, ev);