Andreas Schneider 5277fc4d03 s3-rpc_server: Fix handling of fragmented rpc requests. ...

We need to call pipe_init_outgoing_data() as the first thing in
process_complete_pdu(). Otherwise the caller may use uninitialized
memory and tries to write a response into the socket.

The problem happens only if a real socket is used, which means
in all cases for master and only with external rpc daemons in v4-0
and v4-1.

The problem looks like this in the logs.

    [2014/03/20 14:49:35.531663, 10, pid=7309, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1627(process_complete_pdu)
      Processing packet type 0
    [2014/03/20 14:49:35.531695, 10, pid=7309, effective(0, 0), real(0, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1472(dcesrv_auth_request)
      Checking request auth.
    [2014/03/20 14:49:35.531738, 10, pid=7309, effective(0, 0), real(0, 0)] ../source3/rpc_server/rpc_server.c:521(named_pipe_packet_process)
      Sending 1 fragments in a total of 0 bytes
    [2014/03/20 14:49:35.531769, 10, pid=7309, effective(0, 0), real(0, 0)] ../source3/rpc_server/rpc_server.c:526(named_pipe_packet_process)
      Sending PDU number: 0, PDU Length: 4294967228
    [2014/03/20 14:49:35.531801,  2, pid=7309, effective(0, 0), real(0, 0)] ../source3/rpc_server/rpc_server.c:565(named_pipe_packet_done)
      Writev failed!
    [2014/03/20 14:49:35.531845,  2, pid=7309, effective(0, 0), real(0, 0)] ../source3/rpc_server/rpc_server.c:595(named_pipe_packet_done)
      Fatal error(Message too long). Terminating client(127.0.0.1) connection!

BUG: https://bugzilla.samba.org/show_bug.cgi?id=10481

Pair-Programmed-With: Stefan Metzmacher <metze@samba.org>
Signed-off-by: Andreas Schneider <asn@cryptomilk.org>
Reviewed-by: Guenther Deschner <gd@samba.org

Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Thu Mar 20 18:30:17 CET 2014 on sn-devel-104

2014-03-20 18:30:17 +01:00

..

dfs

Correctly check for errors in strlower_m() returns.

2012-08-09 12:08:18 -07:00

dssetup

Correctly check for errors in strlower_m() returns.

2012-08-09 12:08:18 -07:00

echo

s3-rpc_server: Make it possible to use more rpc exceptions.

2012-07-06 10:00:56 +02:00

epmapper

s3:srv_epmapper: make use of dcerpc_binding_get_abstract_syntax()

2014-02-13 11:54:16 +01:00

eventlog

Change get_nt_acl_no_snum() to return an NTSTATUS, not a struct security_descriptor *.

2012-11-13 22:48:19 +01:00

initshutdown

s3: include ntdomain.h before including generated srv_ headers.

2011-05-02 15:03:44 +02:00

lsa

s3-lsa: Flesh out the returned info in _lsa_EnumTrustedDomainsEx().

2012-09-28 22:44:08 +02:00

netlogon

s3-auth: Pass mem_ctx to auth_check_ntlm_password().

2014-02-19 11:29:29 +13:00

ntsvcs

s3-rpc_server: Make it possible to use more rpc exceptions.

2012-07-06 10:00:56 +02:00

samr

CVE-2013-4496:samr: Remove ChangePasswordUser

2014-03-13 10:26:03 +01:00

spoolss

s3: printing: Fix problem with server taking too long to respond to a MSG_PRINTER_DRVUPGRADE message.

2014-02-18 17:48:30 +01:00

srvsvc

param: change fstype to use a constant string

2014-02-12 13:17:14 +13:00

svcctl

s3-rpc_server: Fix useless check if we still have a valid string.

2012-12-21 13:56:00 +01:00

winreg

loadparm: rename lp[cfg]_print_ok to lp[cfg]_printable for consistency with docs

2014-02-03 13:27:15 +13:00

wkssvc

param: rename lp function and variable from 'passwordserver' to 'password_server'

2014-02-07 16:19:10 -08:00

dcesrv_auth_generic.c

s3-rpc_server: Ensure we are root when starting and usiing gensec

2013-05-16 19:02:00 +02:00

dcesrv_auth_generic.h

s3-rpc_server Remove unused function auth_generic_server_start()

2012-02-23 16:14:18 +11:00

epmd.c

s3-epmd: Cast getpid() result to unsigned int for GNU/Solaris build

2013-03-15 10:39:02 -07:00

lsasd.c

s3-rpc_server: Refactor lsasd_create_sockets().

2013-10-21 12:49:44 +02:00

rpc_config.c

s3-rpc: added "rpc_server:default" config option

2011-12-22 07:27:07 +01:00

rpc_config.h

s3-rpc_server: Replace RPC_SERVICE_MODE_DAEMON checks

2011-08-21 09:05:03 -04:00

rpc_contexts.c

s3-rpc_server: Move the context functions to own file.

2011-06-01 12:02:15 +02:00

rpc_contexts.h

s3-rpc_server: Move the context functions to own file.

2011-06-01 12:02:15 +02:00

rpc_ep_register.c

s3:rpc_server: make use of dcerpc_binding_set_abstract_syntax()

2014-02-13 11:54:16 +01:00

rpc_ep_register.h

s3-rpc_server: Use binding vector in rpc_ep_try_register().

2011-08-01 08:50:35 +02:00

rpc_handles.c

s3-rpc: use ndr_interface_name() instead of get_pipe_name_from_syntax() in DEBUG.

2013-09-20 13:07:16 +02:00

rpc_ncacn_np.c

s3-rpc_server: Remove obsolete make_internal_rpc_pipe().

2013-10-29 16:29:16 +01:00

rpc_ncacn_np.h

s3-rpc_server: Remove obsolete make_internal_rpc_pipe().

2013-10-29 16:29:16 +01:00

rpc_pipes.h

s3:rpc_server: check header of each packet fragment

2014-02-11 16:02:14 +01:00

rpc_server.c

s3:rpc_server: use make_session_info_guest() directly

2013-12-23 09:18:15 +01:00

rpc_server.h

s3/rpc_server: don't unmarshall PDUs twice

2013-12-11 22:24:31 +01:00

rpc_service_setup.c

param: Change from _lp to lp__ as the prefix for internal parameter wrappers

2012-04-16 14:32:38 +10:00

rpc_service_setup.h

s3-rpc_server: Move config helpers in one place.

2011-08-21 09:05:03 -04:00

rpc_sock_helper.c

s3:rpc_server: rpc_create_tcpip_sockets() may leak talloc_stackframe on failure

2013-11-04 12:30:26 +01:00

rpc_sock_helper.h

s3-rpc_server: Add RPC socket helper functions.

2011-08-01 08:50:35 +02:00

srv_access_check.c

s3-rpc_server: Grant the system token full access.

2013-08-06 14:42:14 +02:00

srv_access_check.h

s3:rpc_server: add _RPC_SERVER_SRV_ACCESS_CHECK_H_ guard to srv_access_check.h

2011-05-31 18:37:29 +02:00

srv_pipe_hnd.c

rpc_server: change unsupported pipe error

2014-03-05 16:31:42 +01:00

srv_pipe_hnd.h

s3/rpc_server: don't unmarshall PDUs twice

2013-12-11 22:24:31 +01:00

srv_pipe_internal.h

s3-rpc: Seperate rpc_srv_register for plain connection.

2010-06-04 12:12:43 -04:00

srv_pipe_register.c

s3-rpc_server: remove proto of nonexisting function

2011-05-02 15:03:43 +02:00

srv_pipe_register.h

s3-proto: move rpc_srv_register protos and structs to town headerfile.

2011-05-02 15:03:43 +02:00

srv_pipe.c

s3-rpc_server: Fix handling of fragmented rpc requests.

2014-03-20 18:30:17 +01:00

srv_pipe.h

s3-rpc_server: (re)move last globally included rpc_server prototypes.

2011-05-02 16:05:31 +02:00

wscript_build

s3-rpc_server: Add make_internal_rpc_pipe_socketpair().

2013-10-29 16:17:03 +01:00