From 7a6a1aae6fa74ab0f55c1160aedd2d79c9a44a90 Mon Sep 17 00:00:00 2001 From: Stefan Metzmacher Date: Wed, 11 Nov 2020 17:59:45 +0100 Subject: [PATCH] dcerpc_util: let dcerpc_pull_auth_trailer() expose the reject reason If dcerpc_pull_auth_trailer() returns NT_STATUS_RPC_PROTOCOL_ERROR it will return the BIND reject code in auth->auth_context_id. BUG: https://bugzilla.samba.org/show_bug.cgi?id=14356 Signed-off-by: Stefan Metzmacher Reviewed-by: Andreas Schneider --- librpc/rpc/dcerpc_util.c | 5 ++++- librpc/rpc/dcesrv_auth.c | 9 +++++++-- selftest/knownfail.d/dcerpc-auth-pad | 2 -- 3 files changed, 11 insertions(+), 5 deletions(-) diff --git a/librpc/rpc/dcerpc_util.c b/librpc/rpc/dcerpc_util.c index 61fdd8a1099..3a89983ca10 100644 --- a/librpc/rpc/dcerpc_util.c +++ b/librpc/rpc/dcerpc_util.c @@ -279,7 +279,7 @@ NTSTATUS dcerpc_pull_auth_trailer(const struct ncacn_packet *pkt, auth_length = DCERPC_AUTH_TRAILER_LENGTH + pkt->auth_length; if (pkt_trailer->length < auth_length) { - return NT_STATUS_RPC_PROTOCOL_ERROR; + return NT_STATUS_INTERNAL_ERROR; } data_and_pad = pkt_trailer->length - auth_length; @@ -287,6 +287,7 @@ NTSTATUS dcerpc_pull_auth_trailer(const struct ncacn_packet *pkt, if ((auth_offset % 4) != 0) { DBG_WARNING("auth_offset[%u] not 4 byte aligned\n", (unsigned)auth_offset); + auth->auth_context_id = DCERPC_BIND_NAK_REASON_NOT_SPECIFIED; return NT_STATUS_RPC_PROTOCOL_ERROR; } @@ -350,6 +351,7 @@ NTSTATUS dcerpc_pull_auth_trailer(const struct ncacn_packet *pkt, auth->auth_pad_length)); talloc_free(ndr); ZERO_STRUCTP(auth); + auth->auth_context_id = DCERPC_BIND_NAK_REASON_PROTOCOL_VERSION_NOT_SUPPORTED; return NT_STATUS_RPC_PROTOCOL_ERROR; } @@ -379,6 +381,7 @@ NTSTATUS dcerpc_pull_auth_trailer(const struct ncacn_packet *pkt, auth->auth_pad_length); talloc_free(ndr); ZERO_STRUCTP(auth); + auth->auth_context_id = DCERPC_BIND_NAK_REASON_NOT_SPECIFIED; return NT_STATUS_RPC_PROTOCOL_ERROR; } diff --git a/librpc/rpc/dcesrv_auth.c b/librpc/rpc/dcesrv_auth.c index 1fc6255892d..5c3190a82eb 100644 --- a/librpc/rpc/dcesrv_auth.c +++ b/librpc/rpc/dcesrv_auth.c @@ -320,8 +320,13 @@ bool dcesrv_auth_bind(struct dcesrv_call_state *call) */ auth->auth_type = DCERPC_AUTH_TYPE_NONE; auth->auth_level = DCERPC_AUTH_LEVEL_NONE; - auth->auth_context_id = - DCERPC_BIND_NAK_REASON_PROTOCOL_VERSION_NOT_SUPPORTED; + if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTOCOL_ERROR)) { + auth->auth_context_id = + call->in_auth_info.auth_context_id; + } else { + auth->auth_context_id = + DCERPC_BIND_NAK_REASON_NOT_SPECIFIED; + } return false; } diff --git a/selftest/knownfail.d/dcerpc-auth-pad b/selftest/knownfail.d/dcerpc-auth-pad index 9ea88114ce7..ae54bd75cc9 100644 --- a/selftest/knownfail.d/dcerpc-auth-pad +++ b/selftest/knownfail.d/dcerpc-auth-pad @@ -6,8 +6,6 @@ ^samba.tests.dcerpc.raw_protocol.samba.tests.dcerpc.raw_protocol.TestDCERPC_BIND.test_auth_mid_pad_ntlm_auth3 ^samba.tests.dcerpc.raw_protocol.samba.tests.dcerpc.raw_protocol.TestDCERPC_BIND.test_auth_mid_pad_spnego_alter ^samba.tests.dcerpc.raw_protocol.samba.tests.dcerpc.raw_protocol.TestDCERPC_BIND.test_auth_mid_pad_spnego_auth3 -^samba.tests.dcerpc.raw_protocol.samba.tests.dcerpc.raw_protocol.TestDCERPC_BIND.test_auth_pad_bind_align2_ntlm -^samba.tests.dcerpc.raw_protocol.samba.tests.dcerpc.raw_protocol.TestDCERPC_BIND.test_auth_pad_bind_align2_spnego ^samba.tests.dcerpc.raw_protocol.samba.tests.dcerpc.raw_protocol.TestDCERPC_BIND.test_auth_pad_auth3_align2_ntlm ^samba.tests.dcerpc.raw_protocol.samba.tests.dcerpc.raw_protocol.TestDCERPC_BIND.test_auth_pad_auth3_align2_spnego ^samba.tests.dcerpc.raw_protocol.samba.tests.dcerpc.raw_protocol.TestDCERPC_BIND.test_auth_pad_ntlm_2889_alter