Changeset 920 for trunk/server/source3/rpc_client

Timestamp:

Jun 9, 2016, 2:23:12 PM (10 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: apply latest security patches to trunk

Location:

trunk/server

Files:

• . (modified) (1 prop)
• source3/rpc_client/cli_pipe.c (modified) (40 diffs)
• source3/rpc_client/rpc_client.h (modified) (1 diff)

trunk/server/source3/rpc_client/cli_pipe.c

@@ -29 +29 @@
 #include "ntlmssp_wrap.h"
 #include "librpc/gen_ndr/ndr_dcerpc.h"
+
 #include "librpc/rpc/dcerpc.h"
 #include "librpc/crypto/gse.h"
@@ -400 +401 @@
                                                 DATA_BLOB *pdu,
                                                 uint8_t expected_pkt_type,
+
                                                 DATA_BLOB *rdata,
                                                 DATA_BLOB *reply_pdu)
 {
-        struct dcerpc_response *r;
+        const struct dcerpc_response *r = NULL;
+        DATA_BLOB tmp_stub = data_blob_null;
         NTSTATUS ret = NT_STATUS_OK;
-        size_t pad_len = 0;
 
         /*
@@ -413 +415 @@
         *rdata = *pdu;
 
+
+
+
+
+
+
+
+
+
+
+
+
+
         /* Ensure we have the correct type. */
         switch (pkt->ptype) {
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
         case DCERPC_PKT_ALTER_RESP:
-        case DCERPC_PKT_BIND_ACK:
-
-                /* Client code never receives this kind of packets */
+                ret = dcerpc_verify_ncacn_packet_header(pkt,
+                                        expected_pkt_type,
+                                        pkt->u.alter_resp.auth_info.length,
+                                        DCERPC_PFC_FLAG_FIRST |
+                                        DCERPC_PFC_FLAG_LAST,
+                                        DCERPC_PFC_FLAG_CONC_MPX |
+                                        DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN);
+                if (!NT_STATUS_IS_OK(ret)) {
+                        DEBUG(1, (__location__ ": Connection to %s got an unexpected "
+                                  "RPC packet type - %u, expected %u: %s\n",
+                                  rpccli_pipe_txt(talloc_tos(), cli),
+                                  pkt->ptype, expected_pkt_type,
+                                  nt_errstr(ret)));
+                        NDR_PRINT_DEBUG(ncacn_packet, pkt);
+                        return ret;
+                }
+
                 break;
 
-
         case DCERPC_PKT_RESPONSE:
 
                 r = &pkt->u.response;
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 
                 /* Here's where we deal with incoming sign/seal. */
                 ret = dcerpc_check_auth(cli->auth, pkt,
-                                        &r->stub_and_verifier,
+                                        &,
                                         DCERPC_RESPONSE_LENGTH,
-                                        pdu, &pad_len);
+                                        pdu);
                 if (!NT_STATUS_IS_OK(ret)) {
+
+
+
+
+
+
                         return ret;
                 }
 
-                if (pkt->frag_length < DCERPC_RESPONSE_LENGTH + pad_len) {
-                        return NT_STATUS_BUFFER_TOO_SMALL;
-                }
-
                 /* Point the return values at the NDR data. */
-                rdata->data = r->stub_and_verifier.data;
-
-                if (pkt->auth_length) {
-                        /* We've already done integer wrap tests in
-                         * dcerpc_check_auth(). */
-                        rdata->length = r->stub_and_verifier.length
-                                         - pad_len
-                                         - DCERPC_AUTH_TRAILER_LENGTH
-                                         - pkt->auth_length;
-                } else {
-                        rdata->length = r->stub_and_verifier.length;
-                }
-
-                DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
+                *rdata = tmp_stub;
+
+                DEBUG(10, ("Got pdu len %lu, data_len %lu\n",
                            (long unsigned int)pdu->length,
-                           (long unsigned int)rdata->length,
-                           (unsigned int)pad_len));
+                           (long unsigned int)rdata->length));
 
                 /*
@@ -477 +557 @@
                 break;
 
-        case DCERPC_PKT_BIND_NAK:
-                DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
-                          rpccli_pipe_txt(talloc_tos(), cli)));
-                /* Use this for now... */
-                return NT_STATUS_NETWORK_ACCESS_DENIED;
-
         case DCERPC_PKT_FAULT:
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 
                 DEBUG(1, (__location__ ": RPC fault code %s received "
@@ -498 +588 @@
                           (unsigned int)pkt->ptype,
                           rpccli_pipe_txt(talloc_tos(), cli)));
-                return NT_STATUS_INVALID_INFO_CLASS;
-        }
-
-        if (pkt->ptype != expected_pkt_type) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+
+
+        if (pkt->call_id != call_id) {
                 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
-                          "RPC packet type - %u, not %u\n",
+                          "RPC  - %u, not %u\n",
                           rpccli_pipe_txt(talloc_tos(), cli),
-                          pkt->ptype, expected_pkt_type));
-                return NT_STATUS_INVALID_INFO_CLASS;
-        }
-
-        /* Do this just before return - we don't want to modify any rpc header
-           data before now as we may have needed to do cryptographic actions on
-           it before. */
-
-        if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
-            !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
-                DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
-                          "fragment first/last ON.\n"));
-                pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
+                          pkt->call_id, call_id));
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
         }
 
@@ -874 +954 @@
         state->pkt = talloc(state, struct ncacn_packet);
         if (!state->pkt) {
+
+
+
+
+
+
                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
                 return;
@@ -883 +969 @@
                                           !state->endianess);
         if (!NT_STATUS_IS_OK(status)) {
+
+
+
+
+
+
                 tevent_req_nterror(req, status);
-                return;
-        }
-
-        if (state->incoming_frag.length != state->pkt->frag_length) {
-                DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
-                          (unsigned int)state->incoming_frag.length,
-                          (unsigned int)state->pkt->frag_length));
-                tevent_req_nterror(req,  NT_STATUS_INVALID_PARAMETER);
                 return;
         }
@@ -899 +983 @@
                                                 &state->incoming_frag,
                                                 state->expected_pkt_type,
+
                                                 &rdata,
                                                 &state->reply_pdu);
@@ -907 +992 @@
                   nt_errstr(status)));
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
         if (!NT_STATUS_IS_OK(status)) {
                 tevent_req_nterror(req, status);
@@ -931 +1038 @@
                          state->endianess?"little":"big",
                          state->pkt->drep[0]?"little":"big"));
-                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                /*
+                 * TODO: do a real async disconnect ...
+                 *
+                 * For now do it sync...
+                 */
+                TALLOC_FREE(state->cli->transport);
+                tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
+                return;
+        }
+
+        if (state->reply_pdu_offset + rdata.length > MAX_RPC_DATA_SIZE) {
+                /*
+                 * TODO: do a real async disconnect ...
+                 *
+                 * For now do it sync...
+                 */
+                TALLOC_FREE(state->cli->transport);
+                tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
                 return;
         }
@@ -939 +1063 @@
                 if (!data_blob_realloc(NULL, &state->reply_pdu,
                                 state->reply_pdu_offset + rdata.length)) {
+
+
+
+
+
+
                         tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
                         return;
@@ -968 +1098 @@
                                         state->call_id,
                                         &state->incoming_frag);
+
+
+
+
+
+
+
+
         if (tevent_req_nomem(subreq, req)) {
                 return;
@@ -1237 +1375 @@
                                                 auth->auth_level,
                                                 0, /* auth_pad_length */
-                                                1, /* auth_context_id */
+                                                
                                                 &auth_token,
                                                 &auth_info);
@@ -1270 +1408 @@
         DATA_BLOB *req_data;
         uint32_t req_data_sent;
+
+
+
+
         DATA_BLOB rpc_out;
         DATA_BLOB reply_pdu;
@@ -1276 +1418 @@
 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
+
 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
                                   bool *is_last_frag);
@@ -1311 +1454 @@
         }
 
+
+
+
+
+
         status = prepare_next_frag(state, &is_last_frag);
         if (!NT_STATUS_IS_OK(status)) {
@@ -1345 +1493 @@
 }
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
                                   bool *is_last_frag)
 {
-        size_t data_sent_thistime;
         size_t auth_len;
         size_t frag_len;
@@ -1354 +1624 @@
         size_t pad_len;
         size_t data_left;
-        NTSTATUS status;
+        size_t data_thistime;
+        size_t trailer_left;
+        size_t trailer_thistime = 0;
+        size_t total_left;
+        size_t total_thistime;
+        NTSTATUS status;
+        bool ok;
         union dcerpc_payload u;
 
         data_left = state->req_data->length - state->req_data_sent;
+
+
+
+
+
+
+
+
 
         status = dcerpc_guess_sizes(state->cli->auth,
-                                    DCERPC_REQUEST_LENGTH, data_left,
+                                    DCERPC_REQUEST_LENGTH, _left,
                                     state->cli->max_xmit_frag,
                                     CLIENT_NDR_PADDING_SIZE,
-                                    &data_sent_thistime,
+                                    &_thistime,
                                     &frag_len, &auth_len, &pad_len);
         if (!NT_STATUS_IS_OK(status)) {
@@ -1373 +1657 @@
         }
 
-        if (data_sent_thistime == data_left) {
+        if (_left) {
                 flags |= DCERPC_PFC_FLAG_LAST;
         }
 
+
+
+
+
+
         data_blob_free(&state->rpc_out);
 
         ZERO_STRUCT(u.request);
 
-        u.request.alloc_hint    = state->req_data->length;
+        u.request.alloc_hint    = ;
         u.request.context_id    = 0;
         u.request.opnum         = state->op_num;
@@ -1401 +1690 @@
         dcerpc_set_frag_length(&state->rpc_out, frag_len);
 
-        /* Copy in the data. */
-        if (!data_blob_append(NULL, &state->rpc_out,
+        if (data_thistime > 0) {
+                /* Copy in the data. */
+                ok = data_blob_append(NULL, &state->rpc_out,
                                 state->req_data->data + state->req_data_sent,
-                                data_sent_thistime)) {
-                return NT_STATUS_NO_MEMORY;
+                                data_thistime);
+                if (!ok) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                state->req_data_sent += data_thistime;
+        }
+
+        if (trailer_thistime > 0) {
+                /* Copy in the verification trailer. */
+                ok = data_blob_append(NULL, &state->rpc_out,
+                                state->req_trailer.data + state->req_trailer_sent,
+                                trailer_thistime);
+                if (!ok) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                state->req_trailer_sent += trailer_thistime;
         }
 
@@ -1425 +1729 @@
         }
 
-        state->req_data_sent += data_sent_thistime;
         *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
 
@@ -1489 +1792 @@
                 return;
         }
+
+
+
+
+
+
+
+
+
+
+
+
+
+
         tevent_req_done(req);
 }
@@ -1560 +1877 @@
 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
                                 struct rpc_pipe_client *cli,
-                                uint32 rpc_call_id,
-                                enum dcerpc_AuthType auth_type,
-                                enum dcerpc_AuthLevel auth_level,
+                                struct pipe_auth_data *auth,
+                                uint32_t rpc_call_id,
                                 DATA_BLOB *pauth_blob,
                                 DATA_BLOB *rpc_out)
@@ -1572 +1888 @@
 
         status = dcerpc_push_dcerpc_auth(mem_ctx,
-                                         auth_type,
-                                         auth_level,
+                                         auth_type,
+                                         auth_level,
                                          0, /* auth_pad_length */
-                                         1, /* auth_context_id */
+                                         
                                          pauth_blob,
                                          &u.auth3.auth_info);
@@ -1605 +1921 @@
 
 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
-                                        enum dcerpc_AuthType auth_type,
-                                        enum dcerpc_AuthLevel auth_level,
-                                        uint32 rpc_call_id,
+                                        struct pipe_auth_data *auth,
+                                        uint32_t rpc_call_id,
                                         const struct ndr_syntax_id *abstract,
                                         const struct ndr_syntax_id *transfer,
@@ -1617 +1932 @@
 
         status = dcerpc_push_dcerpc_auth(mem_ctx,
-                                         auth_type,
-                                         auth_level,
+                                         auth_type,
+                                         auth_level,
                                          0, /* auth_pad_length */
-                                         1, /* auth_context_id */
+                                         
                                          pauth_blob,
                                          &auth_info);
@@ -1648 +1963 @@
         bool auth3;
         uint32_t rpc_call_id;
+
+
+
+
+
 };
 
 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
+
 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
                                    struct rpc_pipe_bind_state *state,
@@ -1754 +2075 @@
         case DCERPC_AUTH_TYPE_NONE:
         case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
-        case DCERPC_AUTH_TYPE_SCHANNEL:
                 /* Bind complete. */
                 tevent_req_done(req);
                 return;
 
-        case DCERPC_AUTH_TYPE_NTLMSSP:
-        case DCERPC_AUTH_TYPE_SPNEGO:
-        case DCERPC_AUTH_TYPE_KRB5:
-                /* Paranoid lenght checks */
-                if (pkt->frag_length < DCERPC_AUTH_TRAILER_LENGTH
-                                                + pkt->auth_length) {
-                        tevent_req_nterror(req,
-                                        NT_STATUS_INFO_LENGTH_MISMATCH);
+        case DCERPC_AUTH_TYPE_SCHANNEL:
+                rpc_pipe_bind_step_two_trigger(req);
+                return;
+
+        default:
+                if (pkt->auth_length == 0) {
+                        tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
                         return;
                 }
                 /* get auth credentials */
-                status = dcerpc_pull_dcerpc_auth(talloc_tos(),
-                                                 &pkt->u.bind_ack.auth_info,
-                                                 &auth, false);
+                status = dcerpc_pull_talloc_tos(),
+                                                 &pkt->u.bind_ack.auth_info,
+                                                 e);
                 if (!NT_STATUS_IS_OK(status)) {
                         DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
@@ -1779 +2098 @@
                         return;
                 }
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
                 break;
-
-        default:
-                goto err_out;
         }
 
@@ -1870 +2209 @@
 }
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
                                    struct rpc_pipe_bind_state *state,
@@ -1881 +2367 @@
         data_blob_free(&state->rpc_out);
 
-        status = create_rpc_alter_context(state,
-                                          auth->auth_type,
-                                          auth->auth_level,
+        status = create_rpc_alter_context(state, auth,
                                           state->rpc_call_id,
                                           &state->cli->abstract_syntax,
@@ -1916 +2400 @@
         data_blob_free(&state->rpc_out);
 
-        status = create_rpc_bind_auth3(state, state->cli,
+        status = create_rpc_bind_auth3(state, state->cli,
                                         state->rpc_call_id,
-                                        auth->auth_type,
-                                        auth->auth_level,
                                         auth_token,
                                         &state->rpc_out);
@@ -2153 +2635 @@
          * TODO: do a real async disconnect ...
          *
-         * For now the caller needs to free rpc_cli
+         * For now 
          */
+
         hs->rpc_cli = NULL;
 
@@ -2291 +2774 @@
         result->auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
         result->auth_level = DCERPC_AUTH_LEVEL_CONNECT;
+
 
         result->user_name = talloc_strdup(result, "");
@@ -2315 +2799 @@
         result->auth_type = DCERPC_AUTH_TYPE_NONE;
         result->auth_level = DCERPC_AUTH_LEVEL_NONE;
+
 
         result->user_name = talloc_strdup(result, "");
@@ -2352 +2837 @@
         result->auth_type = auth_type;
         result->auth_level = auth_level;
+
 
         result->user_name = talloc_strdup(result, username);
@@ -2423 +2909 @@
         result->auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
         result->auth_level = auth_level;
+
 
         result->user_name = talloc_strdup(result, "");
@@ -3087 +3574 @@
         auth->auth_type = DCERPC_AUTH_TYPE_KRB5;
         auth->auth_level = auth_level;
+
 
         if (!username) {
@@ -3157 +3645 @@
         auth->auth_type = DCERPC_AUTH_TYPE_SPNEGO;
         auth->auth_level = auth_level;
+
 
         if (!username) {
@@ -3231 +3720 @@
         auth->auth_type = DCERPC_AUTH_TYPE_SPNEGO;
         auth->auth_level = auth_level;
+
 
         if (!username) {

trunk/server/source3/rpc_client/rpc_client.h

@@ -40 +40 @@
         struct ndr_syntax_id abstract_syntax;
         struct ndr_syntax_id transfer_syntax;
+
 
         char *desthost;