auth/spnego: always announce GENSEC_FEATURE_SIGN_PKT_HEADER support.

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

1 files changed, 14 insertions, 0 deletions

diff --git a/auth/gensec/spnego.c b/auth/gensec/spnego.c
index 645c8b2e087..ed7f3d71d68 100644
--- a/auth/gensec/spnego.c
+++ b/auth/gensec/spnego.c
@@ -1632,6 +1632,20 @@ static bool gensec_spnego_have_feature(struct gensec_security *gensec_security,
 				       uint32_t feature) 
 {
 	struct spnego_state *spnego_state = (struct spnego_state *)gensec_security->private_data;
+
+	if (feature & GENSEC_FEATURE_SIGN_PKT_HEADER) {
+		/*
+		 * All mechs with sub (child) mechs need to provide DCERPC
+		 * header signing! This is required because the negotiation
+		 * of header signing is done before the authentication
+		 * is completed.
+		 *
+		 * Currently all our backends support DCERPC with:
+		 * GENSEC_FEATURE_SIGN_PKT_HEADER.
+		 */
+		return true;
+	}
+
 	if (!spnego_state->sub_sec_security) {
 		return false;
 	}