From f6e6167655ebe8b9aaa3c6336d62f26eb732a502 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Sat, 20 Jun 2015 16:19:31 +0200 Subject: [PATCH] auth/gensec: make sure gensec_start_mech_by_authtype() resets SIGN/SEAL before starting We want to set GENSEC_FEATURE_SIGN and GENSEC_FEATURE_SEAL based on the given auth_level and should not have GENSEC_FEATURE_SEAL if DCERPC_AUTH_LEVEL_INTEGRITY is desired. BUG: https://bugzilla.samba.org/show_bug.cgi?id=11061 Signed-off-by: Stefan Metzmacher Reviewed-by: Jeremy Allison Reviewed-by: Andreas Schneider Reviewed-by: Andrew Bartlett (cherry picked from commit 756508c8c37b0370301a096e35abc171fe08d31c) --- auth/gensec/gensec_start.c | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/auth/gensec/gensec_start.c b/auth/gensec/gensec_start.c index 9910f1a1917..b1bc1b93223 100644 --- a/auth/gensec/gensec_start.c +++ b/auth/gensec/gensec_start.c @@ -716,6 +716,12 @@ _PUBLIC_ NTSTATUS gensec_start_mech_by_authtype(struct gensec_security *gensec_s return NT_STATUS_INVALID_PARAMETER; } gensec_security->dcerpc_auth_level = auth_level; + /* + * We need to reset sign/seal in order to reset it. + * We may got some default features inherited by the credentials + */ + gensec_security->want_features &= ~GENSEC_FEATURE_SIGN; + gensec_security->want_features &= ~GENSEC_FEATURE_SEAL; gensec_want_feature(gensec_security, GENSEC_FEATURE_DCE_STYLE); gensec_want_feature(gensec_security, GENSEC_FEATURE_ASYNC_REPLIES); if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) { -- 2.11.4.GIT