mirror of
https://github.com/samba-team/samba.git
synced 2025-01-08 21:18:16 +03:00
c6d880a115
Harmonize _netr_DsRGetForestTrustInformation with source4/ logic which
didn't change since DCE RPC channel refactoring.
With the current code we return RPC faul as can be seen in the logs:
2019/12/11 17:12:55.463081, 1, pid=20939, effective(1284200000, 1284200000), real(1284200000, 0), class=rpc_parse] ../librpc/ndr/ndr.c:471(ndr_print_function_debug)
netr_DsRGetForestTrustInformation: struct netr_DsRGetForestTrustInformation
in: struct netr_DsRGetForestTrustInformation
server_name : *
server_name : '\\some-dc.example.com'
trusted_domain_name : NULL
flags : 0x00000000 (0)
[2019/12/11 17:12:55.463122, 4, pid=20939, effective(1284200000, 1284200000), real(1284200000, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1561(api_rpcTNP)
api_rpcTNP: fault(5) return.
This is due to this check in processing a request:
if (!(p->pipe_bound && (p->auth.auth_type != DCERPC_AUTH_TYPE_NONE)
&& (p->auth.auth_level != DCERPC_AUTH_LEVEL_NONE))) {
p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
return WERR_ACCESS_DENIED;
}
and since we get AuthZ response,
Successful AuthZ: [netlogon,ncacn_np] user [EXAMPLE]\[admin] [S-1-5-21-1234567-890123456-500] at [Wed, 11 Dec 2019 17:12:55.461164 UTC]
Remote host [ipv4:Y.Y.Y.Y:59017] local host [ipv4:X.X.X.X:445]
[2019/12/11 17:12:55.461584, 4, pid=20939, effective(0, 0), real(0, 0)] ../lib/audit_logging/audit_logging.c:141(audit_log_json)
JSON Authorization: {"timestamp": "2019-12-11T17:12:55.461491+0000",
"type": "Authorization", "Authorization": {"version": {"major": 1, "minor": 1},
"localAddress": "ipv4:X.X.X.X:445", "remoteAddress": "ipv4:Y.Y.Y.Y:59017",
"serviceDescription": "netlogon", "authType": "ncacn_np",
"domain": "EXAMPLE", "account": "admin", "sid": "S-1-5-21-1234567-890123456-500",
"sessionId": "c5a2386f-f2cc-4241-9a9e-d104cf5859d5", "logonServer": "SOME-DC",
"transportProtection": "SMB", "accountFlags": "0x00000010"}}
this means we are actually getting anonymous DCE/RPC access to netlogon
on top of authenticated SMB connection. In such case we have exactly
auth_type set to DCERPC_AUTH_TYPE_NONE and auth_level set to
DCERPC_AUTH_LEVEL_NONE in the pipe->auth. Thus, returning an error.
Update the code to follow the same security level check as in s4 variant
of the call.
Signed-off-by: Alexander Bokovoy <ab@samba.org>
Reviewed-by: Guenther Deschner <gd@samba.org>
Autobuild-User(master): Günther Deschner <gd@samba.org>
Autobuild-Date(master): Mon Jan 13 15:05:28 UTC 2020 on sn-devel-184
|
||
|---|---|---|
| .. | ||
| dfs | ||
| dssetup | ||
| echo | ||
| epmapper | ||
| eventlog | ||
| fss | ||
| initshutdown | ||
| lsa | ||
| mdssvc | ||
| netlogon | ||
| ntsvcs | ||
| samr | ||
| spoolss | ||
| srvsvc | ||
| svcctl | ||
| winreg | ||
| wkssvc | ||
| dcesrv_auth_generic.c | ||
| dcesrv_auth_generic.h | ||
| epmd.c | ||
| epmd.h | ||
| fssd.c | ||
| fssd.h | ||
| lsasd.c | ||
| lsasd.h | ||
| mdssd.c | ||
| mdssd.h | ||
| rpc_config.c | ||
| rpc_config.h | ||
| rpc_contexts.c | ||
| rpc_contexts.h | ||
| rpc_ep_register.c | ||
| rpc_ep_register.h | ||
| rpc_handles.c | ||
| rpc_modules.c | ||
| rpc_modules.h | ||
| rpc_ncacn_np.c | ||
| rpc_ncacn_np.h | ||
| rpc_pipes.h | ||
| rpc_server.c | ||
| rpc_server.h | ||
| rpc_service_setup.c | ||
| rpc_service_setup.h | ||
| rpc_sock_helper.c | ||
| rpc_sock_helper.h | ||
| srv_access_check.c | ||
| srv_access_check.h | ||
| srv_pipe_hnd.c | ||
| srv_pipe_hnd.h | ||
| srv_pipe_internal.h | ||
| srv_pipe_register.c | ||
| srv_pipe_register.h | ||
| srv_pipe.c | ||
| srv_pipe.h | ||
| wscript_build | ||