libcli/auth: rewrite schannel sign/seal code to be more generic

This prepares support for HMAC-SHA256/AES.

metze

1 files changed, 56 insertions, 33 deletions

diff --git a/source4/auth/gensec/schannel.c b/source4/auth/gensec/schannel.c
index 3efaf9bccae..0233f5e57c3 100644
--- a/source4/auth/gensec/schannel.c
+++ b/source4/auth/gensec/schannel.c
@@ -282,48 +282,71 @@ static bool schannel_have_feature(struct gensec_security *gensec_security,
 	return false;
 }
 
-static NTSTATUS schannel_seal_packet_wrap(struct gensec_security *gensec_security,
-					  TALLOC_CTX *mem_ctx,
-					  uint8_t *data, size_t length,
-					  const uint8_t *whole_pdu, size_t pdu_length,
-					  DATA_BLOB *sig)
+/*
+  unseal a packet
+*/
+static NTSTATUS schannel_unseal_packet(struct gensec_security *gensec_security,
+				       TALLOC_CTX *mem_ctx,
+				       uint8_t *data, size_t length,
+				       const uint8_t *whole_pdu, size_t pdu_length,
+				       const DATA_BLOB *sig)
 {
-	struct schannel_state *state = talloc_get_type(gensec_security->private_data, struct schannel_state);
+	struct schannel_state *state =
+		talloc_get_type(gensec_security->private_data,
+				struct schannel_state);
 
-	return schannel_seal_packet(state, mem_ctx, data, length, sig);
+	return netsec_incoming_packet(state, mem_ctx, true,
+				      data, length, sig);
 }
 
-static NTSTATUS schannel_sign_packet_wrap(struct gensec_security *gensec_security,
-					  TALLOC_CTX *mem_ctx,
-					  const uint8_t *data, size_t length,
-					  const uint8_t *whole_pdu, size_t pdu_length,
-					  DATA_BLOB *sig)
+/*
+  check the signature on a packet
+*/
+static NTSTATUS schannel_check_packet(struct gensec_security *gensec_security,
+				      TALLOC_CTX *mem_ctx,
+				      const uint8_t *data, size_t length,
+				      const uint8_t *whole_pdu, size_t pdu_length,
+				      const DATA_BLOB *sig)
 {
-	struct schannel_state *state = talloc_get_type(gensec_security->private_data, struct schannel_state);
+	struct schannel_state *state =
+		talloc_get_type(gensec_security->private_data,
+				struct schannel_state);
 
-	return schannel_sign_packet(state, mem_ctx, data, length, sig);
+	return netsec_incoming_packet(state, mem_ctx, false,
+				      data, length, sig);
 }
-
-static NTSTATUS schannel_check_packet_wrap(struct gensec_security *gensec_security,
-					   TALLOC_CTX *mem_ctx,
-					   const uint8_t *data, size_t length,
-					   const uint8_t *whole_pdu, size_t pdu_length,
-					   const DATA_BLOB *sig)
+/*
+  seal a packet
+*/
+static NTSTATUS schannel_seal_packet(struct gensec_security *gensec_security,
+				     TALLOC_CTX *mem_ctx,
+				     uint8_t *data, size_t length,
+				     const uint8_t *whole_pdu, size_t pdu_length,
+				     DATA_BLOB *sig)
 {
-	struct schannel_state *state = talloc_get_type(gensec_security->private_data, struct schannel_state);
+	struct schannel_state *state =
+		talloc_get_type(gensec_security->private_data,
+				struct schannel_state);
 
-	return schannel_check_packet(state, mem_ctx, data, length, sig);
+	return netsec_outgoing_packet(state, mem_ctx, true,
+				      data, length, sig);
 }
 
-static NTSTATUS schannel_unseal_packet_wrap(struct gensec_security *gensec_security,
-					    TALLOC_CTX *mem_ctx,
-					    uint8_t *data, size_t length,
-					    const uint8_t *whole_pdu, size_t pdu_length,
-					    const DATA_BLOB *sig)
+/*
+  sign a packet
+*/
+static NTSTATUS schannel_sign_packet(struct gensec_security *gensec_security,
+				     TALLOC_CTX *mem_ctx,
+				     const uint8_t *data, size_t length,
+				     const uint8_t *whole_pdu, size_t pdu_length,
+				     DATA_BLOB *sig)
 {
-	struct schannel_state *state = talloc_get_type(gensec_security->private_data, struct schannel_state);
+	struct schannel_state *state =
+		talloc_get_type(gensec_security->private_data,
+				struct schannel_state);
 
-	return schannel_unseal_packet(state, mem_ctx, data, length, sig);
+	return netsec_outgoing_packet(state, mem_ctx, false,
+				      data, length, sig);
 }
 
 static const struct gensec_security_ops gensec_schannel_security_ops = {
@@ -332,10 +355,10 @@ static const struct gensec_security_ops gensec_schannel_security_ops = {
 	.client_start   = schannel_client_start,
 	.server_start   = schannel_server_start,
 	.update 	= schannel_update,
-	.seal_packet 	= schannel_seal_packet_wrap,
-	.sign_packet   	= schannel_sign_packet_wrap,
-	.check_packet	= schannel_check_packet_wrap,
-	.unseal_packet 	= schannel_unseal_packet_wrap,
+	.seal_packet 	= schannel_seal_packet,
+	.sign_packet   	= schannel_sign_packet,
+	.check_packet	= schannel_check_packet,
+	.unseal_packet 	= schannel_unseal_packet,
 	.session_key	= schannel_session_key,
 	.session_info	= schannel_session_info,
 	.sig_size	= schannel_sig_size,