s4:librpc/rpc: make use of netlogon_creds_client_verify()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
(cherry picked from commit 132629ee3a9b73d0888d1110e4d0a45ded778e5a)

diff --git a/source4/librpc/rpc/dcerpc_schannel.c b/source4/librpc/rpc/dcerpc_schannel.c
index ca0495c4d472a201af7d14f772f91ff1b047ad7b..8622791fe302a1b68b9442e23862c2c229badce4 100644 (file)
--- a/source4/librpc/rpc/dcerpc_schannel.c
+++ b/source4/librpc/rpc/dcerpc_schannel.c
@@ -222,10 +222,17 @@ static void continue_srv_auth2(struct tevent_req *subreq)
 {
        struct composite_context *c;
        struct schannel_key_state *s;
+       enum dcerpc_AuthType auth_type;
+       enum dcerpc_AuthLevel auth_level;
+       NTSTATUS status;
 
        c = tevent_req_callback_data(subreq, struct composite_context);
        s = talloc_get_type(c->private_data, struct schannel_key_state);
 
+       dcerpc_binding_handle_auth_info(s->pipe2->binding_handle,
+                                       &auth_type,
+                                       &auth_level);
+
        /* receive rpc request result - auth2 credentials */ 
        c->status = dcerpc_netr_ServerAuthenticate2_r_recv(subreq, s);
        TALLOC_FREE(subreq);
@@ -328,8 +335,12 @@ static void continue_srv_auth2(struct tevent_req *subreq)
        }
 
        /* verify credentials */
-       if (!netlogon_creds_client_check(s->creds, s->a.out.return_credentials)) {
-               composite_error(c, NT_STATUS_UNSUCCESSFUL);
+       status = netlogon_creds_client_verify(s->creds,
+                                             s->a.out.return_credentials,
+                                             auth_type,
+                                             auth_level);
+       if (!NT_STATUS_IS_OK(status)) {
+               composite_error(c, status);
                return;
        }
 
@@ -602,11 +613,17 @@ static void continue_get_negotiated_capabilities(struct tevent_req *subreq)
 {
        struct composite_context *c;
        struct auth_schannel_state *s;
+       enum dcerpc_AuthType auth_type;
+       enum dcerpc_AuthLevel auth_level;
        NTSTATUS status;
 
        c = tevent_req_callback_data(subreq, struct composite_context);
        s = talloc_get_type(c->private_data, struct auth_schannel_state);
 
+       dcerpc_binding_handle_auth_info(s->pipe->binding_handle,
+                                       &auth_type,
+                                       &auth_level);
+
        /* receive rpc request result */
        c->status = dcerpc_netr_LogonGetCapabilities_r_recv(subreq, s);
        TALLOC_FREE(subreq);
@@ -642,9 +659,12 @@ static void continue_get_negotiated_capabilities(struct tevent_req *subreq)
        }
 
        /* verify credentials */
-       if (!netlogon_creds_client_check(&s->save_creds_state,
-                                        &s->c.out.return_authenticator->cred)) {
-               composite_error(c, NT_STATUS_UNSUCCESSFUL);
+       status = netlogon_creds_client_verify(&s->save_creds_state,
+                                             &s->c.out.return_authenticator->cred,
+                                             auth_type,
+                                             auth_level);
+       if (!NT_STATUS_IS_OK(status)) {
+               composite_error(c, status);
                return;
        }
 
@@ -705,10 +725,17 @@ static void continue_get_client_capabilities(struct tevent_req *subreq)
 {
        struct composite_context *c;
        struct auth_schannel_state *s;
+       enum dcerpc_AuthType auth_type;
+       enum dcerpc_AuthLevel auth_level;
+       NTSTATUS status;
 
        c = tevent_req_callback_data(subreq, struct composite_context);
        s = talloc_get_type(c->private_data, struct auth_schannel_state);
 
+       dcerpc_binding_handle_auth_info(s->pipe->binding_handle,
+                                       &auth_type,
+                                       &auth_level);
+
        /* receive rpc request result */
        c->status = dcerpc_netr_LogonGetCapabilities_r_recv(subreq, s);
        TALLOC_FREE(subreq);
@@ -743,9 +770,12 @@ static void continue_get_client_capabilities(struct tevent_req *subreq)
        }
 
        /* verify credentials */
-       if (!netlogon_creds_client_check(&s->save_creds_state,
-                                        &s->c.out.return_authenticator->cred)) {
-               composite_error(c, NT_STATUS_UNSUCCESSFUL);
+       status = netlogon_creds_client_verify(&s->save_creds_state,
+                                             &s->c.out.return_authenticator->cred,
+                                             auth_type,
+                                             auth_level);
+       if (!NT_STATUS_IS_OK(status)) {
+               composite_error(c, status);
                return;
        }