CVE-2015-5370: s4:librpc/rpc: simplify checks if gensec is used in dcerpc_ship_next_r...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=11344

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Günther Deschner <gd@samba.org>

diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c
index 0a37509bd28abb192a336d8b7260de2c814b0162..9a1b87b6b4296a937294932ee98411fd463f4c81 100644 (file)
--- a/source4/librpc/rpc/dcerpc.c
+++ b/source4/librpc/rpc/dcerpc.c
@@ -1774,25 +1774,9 @@ static void dcerpc_ship_next_request(struct dcecli_connection *c)
                need_async = true;
        }
 
-       if (c->security_state.auth_info &&
-           c->security_state.generic_state)
-       {
-               struct gensec_security *gensec = c->security_state.generic_state;
-
-               switch (c->security_state.auth_info->auth_level) {
-               case DCERPC_AUTH_LEVEL_PRIVACY:
-               case DCERPC_AUTH_LEVEL_INTEGRITY:
-                       can_async = gensec_have_feature(gensec,
+       if (c->security_state.auth_level >= DCERPC_AUTH_LEVEL_INTEGRITY) {
+               can_async = gensec_have_feature(c->security_state.generic_state,
                                                GENSEC_FEATURE_ASYNC_REPLIES);
-                       break;
-               case DCERPC_AUTH_LEVEL_CONNECT:
-               case DCERPC_AUTH_LEVEL_NONE:
-                       can_async = true;
-                       break;
-               default:
-                       can_async = false;
-                       break;
-               }
        }
 
        if (need_async && !can_async) {
@@ -1812,8 +1796,7 @@ static void dcerpc_ship_next_request(struct dcecli_connection *c)
           request header size */
        chunk_size = p->conn->srv_max_recv_frag;
        chunk_size -= DCERPC_REQUEST_LENGTH;
-       if (c->security_state.auth_info &&
-           c->security_state.generic_state) {
+       if (c->security_state.auth_level >= DCERPC_AUTH_LEVEL_INTEGRITY) {
                size_t max_payload = chunk_size;
 
                max_payload -= DCERPC_AUTH_TRAILER_LENGTH;