s3-dcerpc: Use spnego own sign/seal functions

diff --git a/source3/librpc/rpc/dcerpc_helpers.c b/source3/librpc/rpc/dcerpc_helpers.c
index 7af2bbc854092daf349975e1393bcff4f2ec8478..a94f6c88fab0faac8ab811977946eefad8898e88 100644 (file)
--- a/source3/librpc/rpc/dcerpc_helpers.c
+++ b/source3/librpc/rpc/dcerpc_helpers.c
@@ -652,50 +652,60 @@ static NTSTATUS add_spnego_auth_footer(struct spnego_context *spnego_ctx,
                                        enum dcerpc_AuthLevel auth_level,
                                        DATA_BLOB *rpc_out)
 {
-       enum spnego_mech auth_type;
-       struct gse_context *gse_ctx;
-       struct auth_ntlmssp_state *ntlmssp_ctx;
-       void *auth_ctx;
+       DATA_BLOB auth_blob;
+       DATA_BLOB rpc_data;
        NTSTATUS status;
 
        if (!spnego_ctx) {
                return NT_STATUS_INVALID_PARAMETER;
        }
 
-       status = spnego_get_negotiated_mech(spnego_ctx,
-                                           &auth_type, &auth_ctx);
-       if (!NT_STATUS_IS_OK(status)) {
-               return status;
-       }
+       rpc_data = data_blob_const(rpc_out->data
+                                       + DCERPC_RESPONSE_LENGTH,
+                                  rpc_out->length
+                                       - DCERPC_RESPONSE_LENGTH
+                                       - DCERPC_AUTH_TRAILER_LENGTH);
 
-       switch (auth_type) {
-       case SPNEGO_KRB5:
-               gse_ctx = talloc_get_type(auth_ctx, struct gse_context);
-               if (!gse_ctx) {
-                       status = NT_STATUS_INTERNAL_ERROR;
-                       break;
+       switch (auth_level) {
+       case DCERPC_AUTH_LEVEL_PRIVACY:
+               /* Data portion is encrypted. */
+               status = spnego_seal(rpc_out->data, spnego_ctx,
+                                    &rpc_data, rpc_out, &auth_blob);
+               break;
+
+               if (!NT_STATUS_IS_OK(status)) {
+                       return status;
                }
-               status = add_gssapi_auth_footer(gse_ctx,
-                                               auth_level, rpc_out);
                break;
 
-       case SPNEGO_NTLMSSP:
-               ntlmssp_ctx = talloc_get_type(auth_ctx,
-                                               struct auth_ntlmssp_state);
-               if (!ntlmssp_ctx) {
-                       status = NT_STATUS_INTERNAL_ERROR;
-                       break;
+       case DCERPC_AUTH_LEVEL_INTEGRITY:
+               /* Data is signed. */
+               status = spnego_sign(rpc_out->data, spnego_ctx,
+                                    &rpc_data, rpc_out, &auth_blob);
+               break;
+
+               if (!NT_STATUS_IS_OK(status)) {
+                       return status;
                }
-               status = add_ntlmssp_auth_footer(ntlmssp_ctx,
-                                                auth_level, rpc_out);
                break;
 
        default:
-               status = NT_STATUS_INTERNAL_ERROR;
-               break;
+               /* Can't happen. */
+               smb_panic("bad auth level");
+               /* Notreached. */
+               return NT_STATUS_INVALID_PARAMETER;
        }
 
-       return status;
+       /* Finally attach the blob. */
+       if (!data_blob_append(NULL, rpc_out,
+                               auth_blob.data, auth_blob.length)) {
+               DEBUG(0, ("Failed to add %u bytes auth blob.\n",
+                         (unsigned int)auth_blob.length));
+               return NT_STATUS_NO_MEMORY;
+       }
+       data_blob_free(&auth_blob);
+
+       return NT_STATUS_OK;
 }
 
 static NTSTATUS get_spnego_auth_footer(TALLOC_CTX *mem_ctx,
@@ -704,44 +714,17 @@ static NTSTATUS get_spnego_auth_footer(TALLOC_CTX *mem_ctx,
                                        DATA_BLOB *data, DATA_BLOB *full_pkt,
                                        DATA_BLOB *auth_token)
 {
-       enum spnego_mech auth_type;
-       struct auth_ntlmssp_state *ntlmssp_ctx;
-       struct gse_context *gse_ctx;
-       void *auth_ctx;
-       NTSTATUS status;
-
-       status = spnego_get_negotiated_mech(sp_ctx, &auth_type, &auth_ctx);
-       if (!NT_STATUS_IS_OK(status)) {
-               return status;
-       }
-
-       switch (auth_type) {
-       case SPNEGO_KRB5:
-               gse_ctx = talloc_get_type(auth_ctx,
-                                         struct gse_context);
-               if (!gse_ctx) {
-                       return NT_STATUS_INVALID_PARAMETER;
-               }
-
-               DEBUG(10, ("KRB5 auth\n"));
-
-               return get_gssapi_auth_footer(mem_ctx, gse_ctx,
-                                               auth_level,
-                                               data, full_pkt,
-                                               auth_token);
-       case SPNEGO_NTLMSSP:
-               ntlmssp_ctx = talloc_get_type(auth_ctx,
-                                         struct auth_ntlmssp_state);
-               if (!ntlmssp_ctx) {
-                       return NT_STATUS_INVALID_PARAMETER;
-               }
+       switch (auth_level) {
+       case DCERPC_AUTH_LEVEL_PRIVACY:
+               /* Data portion is encrypted. */
+               return spnego_unseal(mem_ctx, sp_ctx,
+                                    data, full_pkt, auth_token);
 
-               DEBUG(10, ("NTLMSSP auth\n"));
+       case DCERPC_AUTH_LEVEL_INTEGRITY:
+               /* Data is signed. */
+               return spnego_sigcheck(mem_ctx, sp_ctx,
+                                      data, full_pkt, auth_token);
 
-               return get_ntlmssp_auth_footer(ntlmssp_ctx,
-                                               auth_level,
-                                               data, full_pkt,
-                                               auth_token);
        default:
                return NT_STATUS_INVALID_PARAMETER;
        }