sin/samba-mirror
1
0
Fork 0
mirror of https://github.com/samba-team/samba.git synced 2025-01-03 01:18:10 +03:00
Code

s4:librpc/rpc: don't allow any unexpected upgrades of negotiate_flags

Browse Source 
Only remove the unsupported flags from local_negotiate_flags for
the next try...

BUG: https://bugzilla.samba.org/show_bug.cgi?id=15425

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
This commit is contained in:
Stefan Metzmacher 2024-10-02 16:44:26 +02:00 committed by Douglas Bagnall
parent 24de5d1cbd
commit 69b0cbd13d
1 changed files with 11 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
source4/librpc/rpc/dcerpc_schannel.c
View File

@ -245,6 +245,14 @@ static void continue_srv_auth2(struct tevent_req *subreq)
uint32_t rf = s->remote_negotiate_flags; uint32_t rf = s->remote_negotiate_flags;
const char *rn = NULL; const char *rn = NULL;
if ((lf & rf) == lf) {
/*
* without a change in flags
* there's no need to retry...
*/
s->dcerpc_schannel_auto = false;
}
if (!s->dcerpc_schannel_auto) { if (!s->dcerpc_schannel_auto) {
composite_error(c, s->a.out.result); composite_error(c, s->a.out.result);
return; return;
@ -279,7 +287,7 @@ static void continue_srv_auth2(struct tevent_req *subreq)
"and retry! local[0x%08X] remote[0x%08X]\n", "and retry! local[0x%08X] remote[0x%08X]\n",
ln, rn, lf, rf)); ln, rn, lf, rf));
s->local_negotiate_flags = s->remote_negotiate_flags; s->local_negotiate_flags &= s->remote_negotiate_flags;
generate_random_buffer(s->credentials1.data, generate_random_buffer(s->credentials1.data,
sizeof(s->credentials1.data)); sizeof(s->credentials1.data));
@ -294,14 +302,14 @@ static void continue_srv_auth2(struct tevent_req *subreq)
return; return;
} }
s->creds->negotiate_flags = s->remote_negotiate_flags;
/* verify credentials */ /* verify credentials */
if (!netlogon_creds_client_check(s->creds, s->a.out.return_credentials)) { if (!netlogon_creds_client_check(s->creds, s->a.out.return_credentials)) {
composite_error(c, NT_STATUS_UNSUCCESSFUL); composite_error(c, NT_STATUS_UNSUCCESSFUL);
return; return;
} }
s->creds->negotiate_flags &= s->remote_negotiate_flags;
composite_done(c); composite_done(c);
} }