sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-03-27 22:50:26 +03:00
Code

repl: Give an error if we get a secret when not expecting one

Browse Source 
We should never get a secret from a server when we specify DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING

This asserts that this is the case.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Garming Sam <garming@catalyst.net.nz>
This commit is contained in:
Andrew Bartlett 2015-08-19 13:26:41 +12:00
parent 6d301ad1c9
commit 4b25650577
7 changed files with 38 additions and 4 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

1
libcli/drsuapi/drsuapi.h
View File

@ -29,6 +29,7 @@ WERROR drsuapi_decrypt_attribute_value(TALLOC_CTX *mem_ctx,
WERROR drsuapi_decrypt_attribute(TALLOC_CTX *mem_ctx,
const DATA_BLOB *gensec_skey,
uint32_t rid,
uint32_t dsdb_repl_flags,
struct drsuapi_DsReplicaAttribute *attr);

6
libcli/drsuapi/repl_decrypt.c
View File

@ -28,6 +28,7 @@
#include "../lib/crypto/crypto.h"
#include "../libcli/drsuapi/drsuapi.h"
#include "libcli/auth/libcli_auth.h"
#include "dsdb/samdb/samdb.h"
WERROR drsuapi_decrypt_attribute_value(TALLOC_CTX *mem_ctx,
const DATA_BLOB *gensec_skey,
@ -134,6 +135,7 @@ WERROR drsuapi_decrypt_attribute_value(TALLOC_CTX *mem_ctx,
WERROR drsuapi_decrypt_attribute(TALLOC_CTX *mem_ctx,
const DATA_BLOB *gensec_skey,
uint32_t rid,
uint32_t dsdb_repl_flags,
struct drsuapi_DsReplicaAttribute *attr)
{
WERROR status;
@ -164,6 +166,10 @@ WERROR drsuapi_decrypt_attribute(TALLOC_CTX *mem_ctx,
return WERR_OK;
}
if (dsdb_repl_flags & DSDB_REPL_FLAG_EXPECT_NO_SECRETS) {
return WERR_TOO_MANY_SECRETS;
}
if (attr->value_ctr.num_values > 1) {
return WERR_DS_DRA_INVALID_PARAMETER;
}

1
source3/libnet/libnet_dssync.c
View File

@ -113,6 +113,7 @@ static void libnet_dssync_decrypt_attributes(TALLOC_CTX *mem_ctx,
drsuapi_decrypt_attribute(mem_ctx,
session_key,
rid,
0,
attr);
}
}

3
source4/dsdb/repl/drepl_out_helpers.c
View File

@ -740,6 +740,9 @@ static void dreplsrv_op_pull_source_apply_changes_trigger(struct tevent_req *req
if (state->op->options & DRSUAPI_DRS_FULL_SYNC_IN_PROGRESS) {
dsdb_repl_flags |= DSDB_REPL_FLAG_PRIORITISE_INCOMING;
}
if (state->op->options & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
dsdb_repl_flags |= DSDB_REPL_FLAG_EXPECT_NO_SECRETS;
}
status = dsdb_replicated_objects_convert(service->samdb,
working_schema ? working_schema : schema,

23
source4/dsdb/repl/replicated_objects.c
View File

@ -347,7 +347,7 @@ WERROR dsdb_convert_object_ex(struct ldb_context *ldb,
struct dsdb_extended_replicated_object *out)
{
NTSTATUS nt_status;
WERROR status;
WERROR status = WERR_OK;
uint32_t i;
struct ldb_message *msg;
struct replPropertyMetaDataBlob *md;
@ -444,8 +444,25 @@ WERROR dsdb_convert_object_ex(struct ldb_context *ldb,
}
for (j=0; j<a->value_ctr.num_values; j++) {
status = drsuapi_decrypt_attribute(a->value_ctr.values[j].blob, gensec_skey, rid, a);
W_ERROR_NOT_OK_RETURN(status);
status = drsuapi_decrypt_attribute(a->value_ctr.values[j].blob,
gensec_skey, rid,
dsdb_repl_flags, a);
if (!W_ERROR_IS_OK(status)) {
break;
}
}
if (W_ERROR_EQUAL(status, WERR_TOO_MANY_SECRETS)) {
WERROR get_name_status = dsdb_attribute_drsuapi_to_ldb(ldb, schema, pfm_remote,
a, msg->elements, e);
if (W_ERROR_IS_OK(get_name_status)) {
DEBUG(0, ("Unxpectedly got secret value %s on %s from DRS server\n",
e->name, ldb_dn_get_linearized(msg->dn)));
} else {
DEBUG(0, ("Unxpectedly got secret value on %s from DRS server",
ldb_dn_get_linearized(msg->dn)));
}
} else if (!W_ERROR_IS_OK(status)) {
return status;
}
status = dsdb_attribute_drsuapi_to_ldb(ldb, schema, pfm_remote,

1
source4/dsdb/samdb/samdb.h
View File

@ -62,6 +62,7 @@ struct dsdb_control_current_partition {
#define DSDB_REPL_FLAG_PRIORITISE_INCOMING 1
#define DSDB_REPL_FLAG_PARTIAL_REPLICA 2
#define DSDB_REPL_FLAG_ADD_NCNAME 4
#define DSDB_REPL_FLAG_EXPECT_NO_SECRETS 8
#define DSDB_CONTROL_REPLICATED_UPDATE_OID "1.3.6.1.4.1.7165.4.3.3"

7
source4/libnet/libnet_vampire.c
View File

@ -553,6 +553,7 @@ NTSTATUS libnet_vampire_cb_store_chunk(void *private_data,
const struct drsuapi_DsReplicaCursor2CtrEx *uptodateness_vector;
struct dsdb_extended_replicated_objects *objs;
uint32_t req_replica_flags;
uint32_t dsdb_repl_flags = 0;
struct repsFromTo1 *s_dsa;
char *tmp_dns_name;
uint32_t i;
@ -679,6 +680,10 @@ NTSTATUS libnet_vampire_cb_store_chunk(void *private_data,
return NT_STATUS_INTERNAL_ERROR;
}
if (req_replica_flags & DRSUAPI_DRS_SPECIAL_SECRET_PROCESSING) {
dsdb_repl_flags |= DSDB_REPL_FLAG_EXPECT_NO_SECRETS;
}
status = dsdb_replicated_objects_convert(s->ldb,
schema,
c->partition->nc.dn,
@ -690,7 +695,7 @@ NTSTATUS libnet_vampire_cb_store_chunk(void *private_data,
s_dsa,
uptodateness_vector,
c->gensec_skey,
0,
dsdb_repl_flags,
s, &objs);
if (!W_ERROR_IS_OK(status)) {
DEBUG(0,("Failed to convert objects: %s\n", win_errstr(status)));