diff options
| author | Stefan Metzmacher <metze@samba.org> | 2014-01-03 15:30:46 +0100 |
|---|---|---|
| committer | Stefan Metzmacher <metze@samba.org> | 2014-01-07 00:27:11 +0100 |
| commit | 54b5b3067f5b7a0eb6dd9f1326c903f9fe4a5592 (patch) | |
| tree | f1f6237920014940dedb03a6bfd40e0199f44a8a /source4/auth/gensec | |
| parent | 14f6c41754960d73f46aca1bade2266b7e934d03 (diff) | |
| download | samba-54b5b3067f5b7a0eb6dd9f1326c903f9fe4a5592.tar.gz samba-54b5b3067f5b7a0eb6dd9f1326c903f9fe4a5592.tar.xz samba-54b5b3067f5b7a0eb6dd9f1326c903f9fe4a5592.zip | |
s4:gensec_gssapi: make sure gensec_gssapi_[un]seal_packet() rejects header signing
If header signing is requested we should error out instead of
silently ignoring it, our peer would hopefully reject it,
but we should also do that.
TODO: we should implement header signing using gss_wrap_iov().
Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>
Diffstat (limited to 'source4/auth/gensec')
| -rw-r--r-- | source4/auth/gensec/gensec_gssapi.c | 12 |
1 files changed, 12 insertions, 0 deletions
diff --git a/source4/auth/gensec/gensec_gssapi.c b/source4/auth/gensec/gensec_gssapi.c index 3f61cb584da..8aad3dcb06a 100644 --- a/source4/auth/gensec/gensec_gssapi.c +++ b/source4/auth/gensec/gensec_gssapi.c @@ -1029,6 +1029,12 @@ static NTSTATUS gensec_gssapi_seal_packet(struct gensec_security *gensec_securit int conf_state; ssize_t sig_length; + if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) { + DEBUG(1, ("gensec_gssapi_seal_packet: " + "GENSEC_FEATURE_SIGN_PKT_HEADER not supported\n")); + return NT_STATUS_ACCESS_DENIED; + } + input_token.length = length; input_token.value = data; @@ -1083,6 +1089,12 @@ static NTSTATUS gensec_gssapi_unseal_packet(struct gensec_security *gensec_secur dump_data_pw("gensec_gssapi_unseal_packet: sig\n", sig->data, sig->length); + if (gensec_security->want_features & GENSEC_FEATURE_SIGN_PKT_HEADER) { + DEBUG(1, ("gensec_gssapi_unseal_packet: " + "GENSEC_FEATURE_SIGN_PKT_HEADER not supported\n")); + return NT_STATUS_ACCESS_DENIED; + } + in = data_blob_talloc(gensec_security, NULL, sig->length + length); memcpy(in.data, sig->data, sig->length); |