From: Stefan Metzmacher <metze@samba.org>
Date: Thu, 8 Nov 2018 15:36:52 +0000 (+0100)
Subject: s4:rpc_server: add some protection checks to dcesrv_auth_prepare_gensec()
X-Git-Tag: talloc-2.1.15~83
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=76976eab01cd64ccf3ea2a2247a77997db3094ed;p=thirdparty%2Fsamba.git

s4:rpc_server: add some protection checks to dcesrv_auth_prepare_gensec()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=7113
BUG: https://bugzilla.samba.org/show_bug.cgi?id=11892

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
---

diff --git a/source4/rpc_server/dcesrv_auth.c b/source4/rpc_server/dcesrv_auth.c
index c58314b13f9..60bebe39cbd 100644
--- a/source4/rpc_server/dcesrv_auth.c
+++ b/source4/rpc_server/dcesrv_auth.c
@@ -40,6 +40,18 @@ static bool dcesrv_auth_prepare_gensec(struct dcesrv_call_state *call)
 	bool want_header_signing = false;
 	NTSTATUS status;
 
+	if (auth->auth_invalid) {
+		return false;
+	}
+
+	if (auth->auth_finished) {
+		return false;
+	}
+
+	if (auth->gensec_security != NULL) {
+		return false;
+	}
+
 	switch (call->in_auth_info.auth_level) {
 	case DCERPC_AUTH_LEVEL_CONNECT:
 	case DCERPC_AUTH_LEVEL_CALL: