Changeset 919 for vendor/current/source4/librpc

Timestamp:

Jun 9, 2016, 2:17:22 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: apply latest security patches to vendor

Location:

vendor/current/source4/librpc/rpc

Files:

• dcerpc.c (modified) (3 diffs)
• dcerpc_util.c (modified) (1 diff)

vendor/current/source4/librpc/rpc/dcerpc.c

@@ -700 +700 @@
         default:
                 return NT_STATUS_INVALID_LEVEL;
+        }
+
+        if (pkt->auth_length == 0) {
+                return NT_STATUS_INVALID_NETWORK_RESPONSE;
+        }
+
+        if (c->security_state.generic_state == NULL) {
+                return NT_STATUS_INTERNAL_ERROR;
         }
 
@@ -1075 +1083 @@
 
         /* the bind_ack might contain a reply set of credentials */
-        if (conn->security_state.auth_info && pkt->u.bind_ack.auth_info.length) {
+        if (conn->security_state.auth_info && pkt->auth_length) {
                 NTSTATUS status;
                 uint32_t auth_length;
@@ -1848 +1856 @@
 
         /* the alter_resp might contain a reply set of credentials */
-        if (recv_pipe->conn->security_state.auth_info &&
-            pkt->u.alter_resp.auth_info.length) {
+        if (recv_pipe->conn->security_state.auth_info && pkt->auth_length) {
                 struct dcecli_connection *conn = recv_pipe->conn;
                 NTSTATUS status;

vendor/current/source4/librpc/rpc/dcerpc_util.c

@@ -594 +594 @@
         /* Perform an authenticated DCE-RPC bind
          */
-        if (!(conn->flags & (DCERPC_SIGN|DCERPC_SEAL))) {
+        if (!(conn->flags & (DCERPC_CONNECT|DCERPC_SEAL))) {
                 /*
                   we are doing an authenticated connection,
-                  but not using sign or seal. We must force
-                  the CONNECT dcerpc auth type as a NONE auth
-                  type doesn't allow authentication
-                  information to be passed.
+                  which needs to use [connect], [sign] or [seal].
+                  If nothing is specified, we default to [sign] now.
+                  This give roughly the same protection as
+                  ncacn_np with smb signing.
                 */
-                conn->flags |= DCERPC_CONNECT;
+                conn->flags |= DCERPC_SIGN;
         }