Changeset 920 for trunk/server

trunk/server

Property svn:mergeinfo changed
/vendor/current merged: 919

trunk/server/docs-xml/smbdotconf/ldap/clientldapsaslwrapping.xml

-              r414
+              r920
         <para>
+        The default value is <emphasis>plain</emphasis> which is not irritable
+        to KRB5 clock skew errors. That implies synchronizing the time
+        with the KDC in the case of using <emphasis>sign</emphasis> or
+        <emphasis>seal</emphasis>.
+        The default value is <emphasis>sign</emphasis>. That implies synchronizing the time
+        with the KDC in the case of using <emphasis>Kerberos</emphasis>.
         </para>
 </description>
 <value type="default">plain</value>
+<value type="default">sign</value>
 </samba:parameter>

trunk/server/docs-xml/smbdotconf/protocol/clientusespnego.xml

-              r414
+              r920
 .0) to agree upon an authentication
     mechanism.  This enables Kerberos authentication in particular.</para>
+    <para>When <smbconfoption name="client NTLMv2 auth"/> is also set to
+    <constant>yes</constant> extended security (SPNEGO) is required
+    in order to use NTLMv2 only within NTLMSSP. This behavior was
+    introduced with the patches for CVE-2016-2111.</para>
 </description>

trunk/server/docs-xml/smbdotconf/security/clientntlmv2auth.xml

-              r918
+              r920
     'best practice' security polices) only allow NTLMv2 responses, and
     not the weaker LM or NTLM.</para>
+    <para>When <smbconfoption name="client use spnego"/> is also set to
+    <constant>yes</constant> extended security (SPNEGO) is required
+    in order to use NTLMv2 only within NTLMSSP. This behavior was
+    introduced with the patches for CVE-2016-2111.</para>
 </description>
 <value type="default">yes</value>

trunk/server/docs-xml/smbdotconf/security/clientsigning.xml

-              r414
+              r920
     When set to mandatory, SMB signing is required and if set
         to disabled, SMB signing is not offered either.
+    <para>IPC$ connections for DCERPC e.g. in winbindd, are handled by the
+    <smbconfoption name="client ipc signing"/> option.</para>
 </para>
 </description>

trunk/server/lib/util/wscript_build

-              r918
+              r920
                   private_library=True,
                   local_include=False
+                  )
+                 )
+bld.SAMBA_LIBRARY('bitmap',
+                  source='bitmap.c',
+                  deps='talloc samba-util',
+                  local_include=False,
+                  private_library=True)

trunk/server/libcli/auth/ntlmssp.h

r918	r920
84	84	DATA_BLOB session_key;
85	85
	86	uint32_t required_flags;
86	87	uint32_t neg_flags; /* the current state of negotiation with the NTLMSSP partner */
87	88

trunk/server/libcli/auth/proto.h

-              r918
+              r920
                       DATA_BLOB *lm_response, DATA_BLOB *nt_response,
                       DATA_BLOB *lm_session_key, DATA_BLOB *user_session_key) ;
+NTSTATUS NTLMv2_RESPONSE_verify_netlogon_creds(const char *account_name,
+                        const char *account_domain,
+                        const DATA_BLOB response,
+                        const struct netlogon_creds_CredentialState *creds,
+                        const char *workgroup);
 /***********************************************************

trunk/server/libcli/auth/smbencrypt.c

-              r918
+              r920
 #include "../lib/crypto/crypto.h"
 #include "../libcli/auth/libcli_auth.h"
 #include "../librpc/gen_ndr/ntlmssp.h"
+#include "../librpc/gen_ndr/ndr_ntlmssp.h"
 void SMBencrypt_hash(const uint8_t lm_hash[16], const uint8_t *c8, uint8_t p24[24])
 …
         /* Deliberately ignore return here.. */
+        (void)msrpc_gen(mem_ctx, &names_blob,
+                  "aaa",
+                  MsvAvNbDomainName, domain,
+                  MsvAvNbComputerName, hostname,
+                  MsvAvEOL, "");
+        if (hostname != NULL) {
+                (void)msrpc_gen(mem_ctx, &names_blob,
+                          "aaa",
+                          MsvAvNbDomainName, domain,
+                          MsvAvNbComputerName, hostname,
+                          MsvAvEOL, "");
+        } else {
+                (void)msrpc_gen(mem_ctx, &names_blob,
+                          "aa",
+                          MsvAvNbDomainName, domain,
+                          MsvAvEOL, "");
+        }
         return names_blob;
+}
 …
+}
+NTSTATUS NTLMv2_RESPONSE_verify_netlogon_creds(const char *account_name,
+                        const char *account_domain,
+                        const DATA_BLOB response,
+                        const struct netlogon_creds_CredentialState *creds,
+                        const char *workgroup)
+{
+        TALLOC_CTX *frame = NULL;
+        /* RespType + HiRespType */
+        static const char *magic = "\x01\x01";
+        int cmp;
+        struct NTLMv2_RESPONSE v2_resp;
+        enum ndr_err_code err;
+        const struct AV_PAIR *av_nb_cn = NULL;
+        const struct AV_PAIR *av_nb_dn = NULL;
+        if (response.length < 48) {
+                /*
+                 * NTLMv2_RESPONSE has at least 48 bytes.
+                 */
+                return NT_STATUS_OK;
+        }
+        cmp = memcmp(response.data + 16, magic, 2);
+        if (cmp != 0) {
+                /*
+                 * It doesn't look like a valid NTLMv2_RESPONSE
+                 */
+                return NT_STATUS_OK;
+        }
+        frame = talloc_stackframe();
+        err = ndr_pull_struct_blob(&response, frame, &v2_resp,
+                (ndr_pull_flags_fn_t)ndr_pull_NTLMv2_RESPONSE);
+        if (!NDR_ERR_CODE_IS_SUCCESS(err)) {
+                NTSTATUS status;
+                status = ndr_map_error2ntstatus(err);
+                DEBUG(2,("Failed to parse NTLMv2_RESPONSE "
+                         "length %u - %s - %s\n",
+                         (unsigned)response.length,
+                         ndr_map_error2string(err),
+                         nt_errstr(status)));
+                dump_data(2, response.data, response.length);
+                TALLOC_FREE(frame);
+                return status;
+        }
+        if (DEBUGLVL(10)) {
+                NDR_PRINT_DEBUG(NTLMv2_RESPONSE, &v2_resp);
+        }
+        /*
+         * Make sure the netbios computer name in the
+         * NTLMv2_RESPONSE matches the computer name
+         * in the secure channel credentials for workstation
+         * trusts.
+         *
+         * And the netbios domain name matches our
+         * workgroup.
+         *
+         * This prevents workstations from requesting
+         * the session key of NTLMSSP sessions of clients
+         * to other hosts.
+         */
+        if (creds->secure_channel_type == SEC_CHAN_WKSTA) {
+                av_nb_cn = ndr_ntlmssp_find_av(&v2_resp.Challenge.AvPairs,
+                                               MsvAvNbComputerName);
+                av_nb_dn = ndr_ntlmssp_find_av(&v2_resp.Challenge.AvPairs,
+                                               MsvAvNbDomainName);
+        }
+        if (av_nb_cn != NULL) {
+                const char *v = NULL;
+                char *a = NULL;
+                size_t len;
+                v = av_nb_cn->Value.AvNbComputerName;
+                a = talloc_strdup(frame, creds->account_name);
+                if (a == NULL) {
+                        TALLOC_FREE(frame);
+                        return NT_STATUS_NO_MEMORY;
+                }
+                len = strlen(a);
+                if (len > 0 && a[len - 1] == '$') {
+                        a[len - 1] = '\0';
+                }
+#ifdef SAMBA4_INTERNAL_HEIMDAL /* smbtorture4 for make test */
+                cmp = strcasecmp_m(a, v);
+#else /* smbd */
+                cmp = StrCaseCmp(a, v);
+#endif
+                if (cmp != 0) {
+                        DEBUG(2,("%s: NTLMv2_RESPONSE with "
+                                 "NbComputerName[%s] rejected "
+                                 "for user[%s\\%s] "
+                                 "against SEC_CHAN_WKSTA[%s/%s] "
+                                 "in workgroup[%s]\n",
+                                 __func__, v,
+                                 account_domain,
+                                 account_name,
+                                 creds->computer_name,
+                                 creds->account_name,
+                                 workgroup));
+                        TALLOC_FREE(frame);
+                        return NT_STATUS_LOGON_FAILURE;
+                }
+        }
+        if (av_nb_dn != NULL) {
+                const char *v = NULL;
+                v = av_nb_dn->Value.AvNbDomainName;
+#ifdef SAMBA4_INTERNAL_HEIMDAL /* smbtorture4 for make test */
+                cmp = strcasecmp_m(workgroup, v);
+#else /* smbd */
+                cmp = StrCaseCmp(workgroup, v);
+#endif
+                if (cmp != 0) {
+                        DEBUG(2,("%s: NTLMv2_RESPONSE with "
+                                 "NbDomainName[%s] rejected "
+                                 "for user[%s\\%s] "
+                                 "against SEC_CHAN_WKSTA[%s/%s] "
+                                 "in workgroup[%s]\n",
+                                 __func__, v,
+                                 account_domain,
+                                 account_name,
+                                 creds->computer_name,
+                                 creds->account_name,
+                                 workgroup));
+                        TALLOC_FREE(frame);
+                        return NT_STATUS_LOGON_FAILURE;
+                }
+        }
+        TALLOC_FREE(frame);
+        return NT_STATUS_OK;
+}
 /***********************************************************
  encode a password buffer with a unicode password.  The buffer

trunk/server/libcli/auth/wscript_build

r918	r920
20	20	bld.SAMBA_SUBSYSTEM('LIBCLI_AUTH',
21	21	source='credentials.c session.c smbencrypt.c smbdes.c',
22		public_deps='MSRPC_PARSE',
	22	public_deps='MSRPC_PARSE NDR_NTLMSSP',
23	23	public_headers='credentials.h:domain_credentials.h'
24	24	)

trunk/server/librpc/idl/dcerpc.idl

-              r862
+              r920
 */
 import "misc.idl";
+cpp_quote("extern const uint8_t DCERPC_SEC_VT_MAGIC[8];")
 interface dcerpc
 …
         /* pfc_flags values */
+        const uint8 DCERPC_PFC_FLAG_FIRST               = 0x01; /* First fragment */
+        const uint8 DCERPC_PFC_FLAG_LAST                = 0x02; /* Last fragment */
+        const uint8 DCERPC_PFC_FLAG_PENDING_CANCEL      = 0x04; /* Cancel was pending at sender */
+        const uint8 DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN = DCERPC_PFC_FLAG_PENDING_CANCEL; /* depends on the pdu type */
+        const uint8 DCERPC_PFC_FLAG_CONC_MPX            = 0x10; /* supports concurrent multiplexing of a single connection. */
+        const uint8 DCERPC_PFC_FLAG_DID_NOT_EXECUTE     = 0x20; /* on a fault it means the server hasn't done anything */
+        const uint8 DCERPC_PFC_FLAG_MAYBE               = 0x40; /* `maybe' call semantics requested */
+        const uint8 DCERPC_PFC_FLAG_OBJECT_UUID         = 0x80; /* on valid guid is in the optional object field */
+        typedef [bitmap8bit] bitmap {
+                DCERPC_PFC_FLAG_FIRST           = 0x01, /* First fragment */
+                DCERPC_PFC_FLAG_LAST            = 0x02, /* Last fragment */
+                DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING = 0x04, /* depends on the pdu type */
+                DCERPC_PFC_FLAG_CONC_MPX        = 0x10, /* supports concurrent multiplexing of a single connection. */
+                DCERPC_PFC_FLAG_DID_NOT_EXECUTE = 0x20, /* on a fault it means the server hasn't done anything */
+                DCERPC_PFC_FLAG_MAYBE           = 0x40, /* `maybe' call semantics requested */
+                DCERPC_PFC_FLAG_OBJECT_UUID     = 0x80 /* on valid guid is in the optional object field */
+        } dcerpc_pfc_flags;
+        /* Cancel was pending at sender */
+        const int DCERPC_PFC_FLAG_PENDING_CANCEL =
+                DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING;
+        const ist DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN =
+                DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING;
         /* these offsets are needed by the signing code */
 …
         const uint8 DCERPC_DREP_OFFSET     =  4;
         const uint8 DCERPC_FRAG_LEN_OFFSET =  8;
+        const uint32 DCERPC_FRAG_MAX_SIZE  = 5840;
         const uint8 DCERPC_AUTH_LEN_OFFSET = 10;
         const uint8 DCERPC_CALL_ID_OFFSET  = 12;
+        const uint8 DCERPC_NCACN_PAYLOAD_OFFSET = 16;
+        const uint32 DCERPC_NCACN_PAYLOAD_MAX_SIZE = 0x400000; /* 4 MByte */
         /* little-endian flag */
 …
                 uint8 rpc_vers_minor;   /* Minor version */
                 dcerpc_pkt_type ptype;  /* Packet type */
                 uint8 pfc_flags;        /* Fragmentation flags */
+                dcerpc_pfc_flags pfc_flags; /* Fragmentation flags */
                 uint8 drep[4];          /* NDR data representation */
                 uint16 frag_length;     /* Total length of fragment */
 …
                 [switch_is(ptype)] dcerpc_payload u;
         } ncadg_packet;
+        typedef [bitmap16bit] bitmap {
+                DCERPC_SEC_VT_COMMAND_ENUM  = 0x3FFF,
+                DCERPC_SEC_VT_COMMAND_END   = 0x4000,
+                DCERPC_SEC_VT_MUST_PROCESS  = 0x8000
+        } dcerpc_sec_vt_command;
+        typedef [enum16bit] enum {
+                DCERPC_SEC_VT_COMMAND_BITMASK1  = 0x0001,
+                DCERPC_SEC_VT_COMMAND_PCONTEXT  = 0x0002,
+                DCERPC_SEC_VT_COMMAND_HEADER2   = 0x0003
+        } dcerpc_sec_vt_command_enum;
+        typedef [bitmap32bit] bitmap {
+                DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING = 0x00000001
+        } dcerpc_sec_vt_bitmask1;
+        typedef struct {
+                ndr_syntax_id abstract_syntax;
+                ndr_syntax_id transfer_syntax;
+        } dcerpc_sec_vt_pcontext;
+        typedef struct {
+                dcerpc_pkt_type ptype;  /* Packet type */
+                [value(0)] uint8 reserved1;
+                [value(0)] uint16 reserved2;
+                uint8 drep[4];          /* NDR data representation */
+                uint32 call_id;         /* Call identifier */
+                uint16 context_id;
+                uint16 opnum;
+        } dcerpc_sec_vt_header2;
+        typedef [switch_type(dcerpc_sec_vt_command_enum),nodiscriminant] union {
+        [case(DCERPC_SEC_VT_COMMAND_BITMASK1)] dcerpc_sec_vt_bitmask1 bitmask1;
+        [case(DCERPC_SEC_VT_COMMAND_PCONTEXT)] dcerpc_sec_vt_pcontext pcontext;
+        [case(DCERPC_SEC_VT_COMMAND_HEADER2)] dcerpc_sec_vt_header2 header2;
+        [default,flag(NDR_REMAINING)] DATA_BLOB _unknown;
+        } dcerpc_sec_vt_union;
+        typedef struct {
+                dcerpc_sec_vt_command command;
+                [switch_is(command & DCERPC_SEC_VT_COMMAND_ENUM)]
+                        [subcontext(2),flag(NDR_SUBCONTEXT_NO_UNREAD_BYTES)]
+                        dcerpc_sec_vt_union u;
+        } dcerpc_sec_vt;
+        typedef [public,nopush,nopull] struct {
+                uint16 count;
+        } dcerpc_sec_vt_count;
+        /*
+         * We assume that the whole verification trailer fits into
+         * the last 1024 bytes after the stub data.
+         *
+         * There're currently only 3 commands defined and each should
+         * only be used once.
+         */
+        const uint16 DCERPC_SEC_VT_MAX_SIZE = 1024;
+        typedef [public,flag(NDR_PAHEX)] struct {
+                [flag(NDR_ALIGN4)] DATA_BLOB _pad;
+                [value(DCERPC_SEC_VT_MAGIC)] uint8 magic[8];
+                dcerpc_sec_vt_count count;
+                dcerpc_sec_vt commands[count.count];
+        } dcerpc_sec_verification_trailer;
+}

trunk/server/librpc/idl/idl_types.h

r918	r920
48	48	#define NDR_RELATIVE_REVERSE LIBNDR_FLAG_RELATIVE_REVERSE
49	49	#define NDR_NO_RELATIVE_REVERSE LIBNDR_FLAG_NO_RELATIVE_REVERSE
	50
	51	#define NDR_SUBCONTEXT_NO_UNREAD_BYTES LIBNDR_FLAG_SUBCONTEXT_NO_UNREAD_BYTES

trunk/server/librpc/ndr/libndr.h

-              r918
+              r920
 #define LIBNDR_STRING_FLAGS             (0x7FFC)
+/*
+ * don't debug NDR_ERR_BUFSIZE failures,
+ * as the available buffer might be incomplete.
+ *
+ * return NDR_ERR_INCOMPLETE_BUFFER instead.
+ */
+#define LIBNDR_FLAG_INCOMPLETE_BUFFER (1<<16)
+/*
+ * This lets ndr_pull_subcontext_end() return
+ * NDR_ERR_UNREAD_BYTES.
+ */
+#define LIBNDR_FLAG_SUBCONTEXT_NO_UNREAD_BYTES (1<<17)
 /* set if relative pointers should *not* be marshalled in reverse order */
 #define LIBNDR_FLAG_NO_RELATIVE_REVERSE (1<<18)
 …
 /* useful macro for debugging */
 #define NDR_PRINT_DEBUG(type, p) ndr_print_debug((ndr_print_fn_t)ndr_print_ ##type, #p, p)
+#define NDR_PRINT_DEBUGC(dbgc_class, type, p) ndr_print_debugc(dbgc_class, (ndr_print_fn_t)ndr_print_ ##type, #p, p)
 #define NDR_PRINT_UNION_DEBUG(type, level, p) ndr_print_union_debug((ndr_print_fn_t)ndr_print_ ##type, #p, level, p)
 #define NDR_PRINT_FUNCTION_DEBUG(type, flags, p) ndr_print_function_debug((ndr_print_function_t)ndr_print_ ##type, #type, flags, p)
 …
         NDR_ERR_INVALID_POINTER,
         NDR_ERR_UNREAD_BYTES,
+        NDR_ERR_NDR64
+        NDR_ERR_NDR64,
+        NDR_ERR_FLAGS,
+        NDR_ERR_INCOMPLETE_BUFFER
 };
 …
 /*
   flags passed to control parse flow
+  These are deliberately in a different range to the NDR_IN/NDR_OUT
+  flags to catch mixups
 */
 #define NDR_SCALARS 1
 #define NDR_BUFFERS 2
+#define NDR_SCALARS    0x100
+#define NDR_BUFFERS    0x200
 /*
+  flags passed to ndr_print_*()
+  flags passed to ndr_print_*() and ndr pull/push for functions
+  These are deliberately in a different range to the NDR_SCALARS/NDR_BUFFERS
+  flags to catch mixups
 */
+#define NDR_IN 1
+#define NDR_OUT 2
+#define NDR_BOTH 3
+#define NDR_SET_VALUES 4
+#define NDR_IN         0x10
+#define NDR_OUT        0x20
+#define NDR_BOTH       0x30
+#define NDR_SET_VALUES 0x40
+#define NDR_PULL_CHECK_FLAGS(ndr, ndr_flags) do { \
+        if ((ndr_flags) & ~(NDR_SCALARS|NDR_BUFFERS)) { \
+                return ndr_pull_error(ndr, NDR_ERR_FLAGS, "Invalid pull struct ndr_flags 0x%x", ndr_flags); \
+        } \
+} while (0)
+#define NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags) do { \
+        if ((ndr_flags) & ~(NDR_SCALARS|NDR_BUFFERS)) \
+                return ndr_push_error(ndr, NDR_ERR_FLAGS, "Invalid push struct ndr_flags 0x%x", ndr_flags); \
+} while (0)
+#define NDR_PULL_CHECK_FN_FLAGS(ndr, flags) do { \
+        if ((flags) & ~(NDR_BOTH|NDR_SET_VALUES)) { \
+                return ndr_pull_error(ndr, NDR_ERR_FLAGS, "Invalid fn pull flags 0x%x", flags); \
+        } \
+} while (0)
+#define NDR_PUSH_CHECK_FN_FLAGS(ndr, flags) do { \
+        if ((flags) & ~(NDR_BOTH|NDR_SET_VALUES)) \
+                return ndr_push_error(ndr, NDR_ERR_FLAGS, "Invalid fn push flags 0x%x", flags); \
+} while (0)
 #define NDR_PULL_NEED_BYTES(ndr, n) do { \
         if (unlikely((n) > ndr->data_size || ndr->offset + (n) > ndr->data_size)) { \
+                if (ndr->flags & LIBNDR_FLAG_INCOMPLETE_BUFFER) { \
+                        uint32_t _available = ndr->data_size - ndr->offset; \
+                        uint32_t _missing = n - _available; \
+                        ndr->relative_highest_offset = _missing; \
+                } \
                 return ndr_pull_error(ndr, NDR_ERR_BUFSIZE, "Pull bytes %u (%s)", (unsigned)n, __location__); \
         } \
 …
         } \
         if (unlikely(ndr->offset > ndr->data_size)) {                   \
+                if (ndr->flags & LIBNDR_FLAG_INCOMPLETE_BUFFER) { \
+                        uint32_t _missing = ndr->offset - ndr->data_size; \
+                        ndr->relative_highest_offset = _missing; \
+                } \
                 return ndr_pull_error(ndr, NDR_ERR_BUFSIZE, "Pull align %u", (unsigned)n); \
         } \
 …
 void ndr_print_GUID(struct ndr_print *ndr, const char *name, const struct GUID *guid);
 bool ndr_syntax_id_equal(const struct ndr_syntax_id *i1, const struct ndr_syntax_id *i2);
+char *ndr_syntax_id_to_string(TALLOC_CTX *mem_ctx, const struct ndr_syntax_id *id);
+bool ndr_syntax_id_from_string(const char *s, struct ndr_syntax_id *id);
 enum ndr_err_code ndr_push_struct_blob(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, const void *p, ndr_push_flags_fn_t fn);
 enum ndr_err_code ndr_push_union_blob(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, void *p, uint32_t level, ndr_push_flags_fn_t fn);
 …
 size_t ndr_align_size(uint32_t offset, size_t n);
 struct ndr_pull *ndr_pull_init_blob(const DATA_BLOB *blob, TALLOC_CTX *mem_ctx);
+enum ndr_err_code ndr_pull_append(struct ndr_pull *ndr, DATA_BLOB *blob);
+enum ndr_err_code ndr_pull_pop(struct ndr_pull *ndr);
 enum ndr_err_code ndr_pull_advance(struct ndr_pull *ndr, uint32_t size);
 struct ndr_push *ndr_push_init_ctx(TALLOC_CTX *mem_ctx);
 …
 enum ndr_err_code ndr_push_expand(struct ndr_push *ndr, uint32_t extra_size);
 void ndr_print_debug_helper(struct ndr_print *ndr, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
+void ndr_print_debugc_helper(struct ndr_print *ndr, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
 void ndr_print_printf_helper(struct ndr_print *ndr, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
 void ndr_print_string_helper(struct ndr_print *ndr, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
 void ndr_print_debug(ndr_print_fn_t fn, const char *name, void *ptr);
+void ndr_print_debugc(int dbgc_class, ndr_print_fn_t fn, const char *name, void *ptr);
 void ndr_print_union_debug(ndr_print_fn_t fn, const char *name, uint32_t level, void *ptr);
 void ndr_print_function_debug(ndr_print_function_t fn, const char *name, int flags, void *ptr);

trunk/server/librpc/ndr/ndr.c

-              r918
+              r920
+}
+_PUBLIC_ enum ndr_err_code ndr_pull_append(struct ndr_pull *ndr, DATA_BLOB *blob)
+{
+        enum ndr_err_code ndr_err;
+        DATA_BLOB b;
+        uint32_t append = 0;
+        bool ok;
+        if (blob->length == 0) {
+                return NDR_ERR_SUCCESS;
+        }
+        ndr_err = ndr_token_retrieve(&ndr->array_size_list, ndr, &append);
+        if (ndr_err == NDR_ERR_TOKEN) {
+                append = 0;
+                ndr_err = NDR_ERR_SUCCESS;
+        }
+        NDR_CHECK(ndr_err);
+        if (ndr->data_size == 0) {
+                ndr->data = NULL;
+                append = UINT32_MAX;
+        }
+        if (append == UINT32_MAX) {
+                /*
+                 * append == UINT32_MAX means that
+                 * ndr->data is either NULL or a valid
+                 * talloc child of ndr, which means
+                 * we can use data_blob_append() without
+                 * data_blob_talloc() of the existing callers data
+                 */
+                b = data_blob_const(ndr->data, ndr->data_size);
+        } else {
+                b = data_blob_talloc(ndr, ndr->data, ndr->data_size);
+                if (b.data == NULL) {
+                        return ndr_pull_error(ndr, NDR_ERR_ALLOC, "%s", __location__);
+                }
+        }
+        ok = data_blob_append(ndr, &b, blob->data, blob->length);
+        if (!ok) {
+                return ndr_pull_error(ndr, NDR_ERR_ALLOC, "%s", __location__);
+        }
+        ndr->data = b.data;
+        ndr->data_size = b.length;
+        return ndr_token_store(ndr, &ndr->array_size_list, ndr, UINT32_MAX);
+}
+_PUBLIC_ enum ndr_err_code ndr_pull_pop(struct ndr_pull *ndr)
+{
+        uint32_t skip = 0;
+        uint32_t append = 0;
+        if (ndr->relative_base_offset != 0) {
+                return ndr_pull_error(ndr, NDR_ERR_RELATIVE,
+                                      "%s", __location__);
+        }
+        if (ndr->relative_highest_offset != 0) {
+                return ndr_pull_error(ndr, NDR_ERR_RELATIVE,
+                                      "%s", __location__);
+        }
+        if (ndr->relative_list != NULL) {
+                return ndr_pull_error(ndr, NDR_ERR_RELATIVE,
+                                      "%s", __location__);
+        }
+        if (ndr->relative_base_list != NULL) {
+                return ndr_pull_error(ndr, NDR_ERR_RELATIVE,
+                                      "%s", __location__);
+        }
+        /*
+         * we need to keep up to 7 bytes
+         * in order to get the aligment right.
+         */
+        skip = ndr->offset & 0xFFFFFFF8;
+        if (skip == 0) {
+                return NDR_ERR_SUCCESS;
+        }
+        ndr->offset -= skip;
+        ndr->data_size -= skip;
+        append = ndr_token_peek(&ndr->array_size_list, ndr);
+        if (append != UINT32_MAX) {
+                /*
+                 * here we assume, that ndr->data is not a
+                 * talloc child of ndr.
+                 */
+                ndr->data += skip;
+                return NDR_ERR_SUCCESS;
+        }
+        memmove(ndr->data, ndr->data + skip, ndr->data_size);
+        ndr->data = talloc_realloc(ndr, ndr->data, uint8_t, ndr->data_size);
+        if (ndr->data_size != 0 && ndr->data == NULL) {
+                return ndr_pull_error(ndr, NDR_ERR_ALLOC, "%s", __location__);
+        }
+        return NDR_ERR_SUCCESS;
+}
 /*
   advance by 'size' bytes
 …
         return NDR_ERR_SUCCESS;
+}
+_PUBLIC_ void ndr_print_debugc_helper(struct ndr_print *ndr, const char *format, ...)
+{
+        va_list ap;
+        char *s = NULL;
+        uint32_t i;
+        int ret;
+        int dbgc_class;
+        va_start(ap, format);
+        ret = vasprintf(&s, format, ap);
+        va_end(ap);
+        if (ret == -1) {
+                return;
+        }
+        dbgc_class = *(int *)ndr->private_data;
+        if (ndr->no_newline) {
+                DEBUGADDC(dbgc_class, 1,("%s", s));
+                free(s);
+                return;
+        }
+        for (i=0;i<ndr->depth;i++) {
+                DEBUGADDC(dbgc_class, 1,("    "));
+        }
+        DEBUGADDC(dbgc_class, 1,("%s\n", s));
+        free(s);
+}
 …
                                                                   "\n");
+        }
+}
+/*
+  a useful helper function for printing idl structures via DEBUGC()
+*/
+_PUBLIC_ void ndr_print_debugc(int dbgc_class, ndr_print_fn_t fn, const char *name, void *ptr)
+{
+        struct ndr_print *ndr;
+        DEBUGC(dbgc_class, 1,(" "));
+        ndr = talloc_zero(NULL, struct ndr_print);
+        if (!ndr) return;
+        ndr->private_data = &dbgc_class;
+        ndr->print = ndr_print_debugc_helper;
+        ndr->depth = 1;
+        ndr->flags = 0;
+        fn(ndr, name, ptr);
+        talloc_free(ndr);
+}
 …
         va_list ap;
         int ret;
+        if (ndr->flags & LIBNDR_FLAG_INCOMPLETE_BUFFER) {
+                switch (ndr_err) {
+                case NDR_ERR_BUFSIZE:
+                        return NDR_ERR_INCOMPLETE_BUFFER;
+                default:
+                        break;
+                }
+        }
         va_start(ap, format);
 …
                 break;
+        }
+        case 0xFFFFFFFF:
+                /*
+                 * a shallow copy like subcontext
+                 * useful for DCERPC pipe chunks.
+                 */
+                subndr = talloc_zero(ndr, struct ndr_pull);
+                NDR_ERR_HAVE_NO_MEMORY(subndr);
+                subndr->flags           = ndr->flags;
+                subndr->current_mem_ctx = ndr->current_mem_ctx;
+                subndr->data            = ndr->data;
+                subndr->offset          = ndr->offset;
+                subndr->data_size       = ndr->data_size;
+                *_subndr = subndr;
+                return NDR_ERR_SUCCESS;
         default:
                 return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT, "Bad subcontext (PULL) header_size %d",
 …
+{
         uint32_t advance;
+        if (size_is >= 0) {
+        uint32_t highest_ofs;
+        if (header_size == 0xFFFFFFFF) {
+                advance = subndr->offset - ndr->offset;
+        } else if (size_is >= 0) {
                 advance = size_is;
         } else if (header_size > 0) {
 …
                 advance = subndr->offset;
+        }
+        if (subndr->offset > ndr->relative_highest_offset) {
+                highest_ofs = subndr->offset;
+        } else {
+                highest_ofs = subndr->relative_highest_offset;
+        }
+        if (!(subndr->flags & LIBNDR_FLAG_SUBCONTEXT_NO_UNREAD_BYTES)) {
+                /*
+                 * avoid an error unless SUBCONTEXT_NO_UNREAD_BYTES is specified
+                 */
+                highest_ofs = advance;
+        }
+        if (highest_ofs < advance) {
+                return ndr_pull_error(subndr, NDR_ERR_UNREAD_BYTES,
+                                      "not all bytes consumed ofs[%u] advance[%u]",
+                                      highest_ofs, advance);
+        }
         NDR_CHECK(ndr_pull_advance(ndr, advance));
         return NDR_ERR_SUCCESS;
 …
         { NDR_ERR_UNREAD_BYTES, "Unread Bytes" },
         { NDR_ERR_NDR64, "NDR64 assertion error" },
+        { NDR_ERR_INCOMPLETE_BUFFER, "Incomplete Buffer" },
         { 0, NULL }
 };

trunk/server/librpc/ndr/ndr_basic.c

-              r918
+              r920
 _PUBLIC_ enum ndr_err_code ndr_pull_int8(struct ndr_pull *ndr, int ndr_flags, int8_t *v)
+{
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_NEED_BYTES(ndr, 1);
         *v = (int8_t)CVAL(ndr->data, ndr->offset);
 …
 _PUBLIC_ enum ndr_err_code ndr_pull_uint8(struct ndr_pull *ndr, int ndr_flags, uint8_t *v)
+{
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_NEED_BYTES(ndr, 1);
         *v = CVAL(ndr->data, ndr->offset);
 …
 _PUBLIC_ enum ndr_err_code ndr_pull_int16(struct ndr_pull *ndr, int ndr_flags, int16_t *v)
+{
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, 2);
         NDR_PULL_NEED_BYTES(ndr, 2);
 …
 _PUBLIC_ enum ndr_err_code ndr_pull_uint16(struct ndr_pull *ndr, int ndr_flags, uint16_t *v)
+{
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, 2);
         NDR_PULL_NEED_BYTES(ndr, 2);
 …
 _PUBLIC_ enum ndr_err_code ndr_pull_uint1632(struct ndr_pull *ndr, int ndr_flags, uint16_t *v)
+{
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         if (unlikely(ndr->flags & LIBNDR_FLAG_NDR64)) {
                 uint32_t v32 = 0;
 …
 _PUBLIC_ enum ndr_err_code ndr_pull_int32(struct ndr_pull *ndr, int ndr_flags, int32_t *v)
+{
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, 4);
         NDR_PULL_NEED_BYTES(ndr, 4);
 …
 _PUBLIC_ enum ndr_err_code ndr_pull_uint32(struct ndr_pull *ndr, int ndr_flags, uint32_t *v)
+{
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, 4);
         NDR_PULL_NEED_BYTES(ndr, 4);
 …
         uint64_t v64;
         enum ndr_err_code err;
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         if (likely(!(ndr->flags & LIBNDR_FLAG_NDR64))) {
                 return ndr_pull_uint32(ndr, ndr_flags, v);
 …
 _PUBLIC_ enum ndr_err_code ndr_pull_double(struct ndr_pull *ndr, int ndr_flags, double *v)
+{
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, 8);
         NDR_PULL_NEED_BYTES(ndr, 8);
 …
 _PUBLIC_ enum ndr_err_code ndr_pull_udlong(struct ndr_pull *ndr, int ndr_flags, uint64_t *v)
+{
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, 4);
         NDR_PULL_NEED_BYTES(ndr, 8);
 …
 _PUBLIC_ enum ndr_err_code ndr_pull_udlongr(struct ndr_pull *ndr, int ndr_flags, uint64_t *v)
+{
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, 4);
         NDR_PULL_NEED_BYTES(ndr, 8);
 …
+{
         uintptr_t h;
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, sizeof(h));
         NDR_PULL_NEED_BYTES(ndr, sizeof(h));
 …
+{
         uint32_t v;
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &v));
         *status = NT_STATUS(v);
 …
+{
         uint32_t v;
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &v));
         *status = W_ERROR(v);
 …
 _PUBLIC_ enum ndr_err_code ndr_pull_array_uint8(struct ndr_pull *ndr, int ndr_flags, uint8_t *data, uint32_t n)
+{
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         if (!(ndr_flags & NDR_SCALARS)) {
                 return NDR_ERR_SUCCESS;
 …
 _PUBLIC_ enum ndr_err_code ndr_push_int8(struct ndr_push *ndr, int ndr_flags, int8_t v)
+{
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_NEED_BYTES(ndr, 1);
         SCVAL(ndr->data, ndr->offset, (uint8_t)v);
 …
 _PUBLIC_ enum ndr_err_code ndr_push_uint8(struct ndr_push *ndr, int ndr_flags, uint8_t v)
+{
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_NEED_BYTES(ndr, 1);
         SCVAL(ndr->data, ndr->offset, v);
 …
 _PUBLIC_ enum ndr_err_code ndr_push_int16(struct ndr_push *ndr, int ndr_flags, int16_t v)
+{
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, 2);
         NDR_PUSH_NEED_BYTES(ndr, 2);
 …
 _PUBLIC_ enum ndr_err_code ndr_push_uint16(struct ndr_push *ndr, int ndr_flags, uint16_t v)
+{
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, 2);
         NDR_PUSH_NEED_BYTES(ndr, 2);
 …
 _PUBLIC_ enum ndr_err_code ndr_push_int32(struct ndr_push *ndr, int ndr_flags, int32_t v)
+{
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, 4);
         NDR_PUSH_NEED_BYTES(ndr, 4);
 …
 _PUBLIC_ enum ndr_err_code ndr_push_uint32(struct ndr_push *ndr, int ndr_flags, uint32_t v)
+{
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, 4);
         NDR_PUSH_NEED_BYTES(ndr, 4);
 …
 _PUBLIC_ enum ndr_err_code ndr_push_udlong(struct ndr_push *ndr, int ndr_flags, uint64_t v)
+{
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, 4);
         NDR_PUSH_NEED_BYTES(ndr, 8);
 …
 _PUBLIC_ enum ndr_err_code ndr_push_udlongr(struct ndr_push *ndr, int ndr_flags, uint64_t v)
+{
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, 4);
         NDR_PUSH_NEED_BYTES(ndr, 8);
 …
 _PUBLIC_ enum ndr_err_code ndr_push_double(struct ndr_push *ndr, int ndr_flags, double v)
+{
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, 8);
         NDR_PUSH_NEED_BYTES(ndr, 8);
 …
+{
         uintptr_t h = (intptr_t)v;
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, sizeof(h));
         NDR_PUSH_NEED_BYTES(ndr, sizeof(h));
 …
 _PUBLIC_ enum ndr_err_code ndr_push_array_uint8(struct ndr_push *ndr, int ndr_flags, const uint8_t *data, uint32_t n)
+{
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         if (!(ndr_flags & NDR_SCALARS)) {
                 return NDR_ERR_SUCCESS;
 …
 _PUBLIC_ enum ndr_err_code ndr_push_NTTIME(struct ndr_push *ndr, int ndr_flags, NTTIME t)
+{
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_CHECK(ndr_push_udlong(ndr, ndr_flags, t));
         return NDR_ERR_SUCCESS;
 …
 _PUBLIC_ enum ndr_err_code ndr_pull_NTTIME(struct ndr_pull *ndr, int ndr_flags, NTTIME *t)
+{
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_CHECK(ndr_pull_udlong(ndr, ndr_flags, t));
         return NDR_ERR_SUCCESS;
 …
 _PUBLIC_ enum ndr_err_code ndr_push_NTTIME_1sec(struct ndr_push *ndr, int ndr_flags, NTTIME t)
+{
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         t /= 10000000;
         NDR_CHECK(ndr_push_hyper(ndr, ndr_flags, t));
 …
 _PUBLIC_ enum ndr_err_code ndr_pull_NTTIME_1sec(struct ndr_pull *ndr, int ndr_flags, NTTIME *t)
+{
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_CHECK(ndr_pull_hyper(ndr, ndr_flags, t));
         (*t) *= 10000000;
 …
 _PUBLIC_ enum ndr_err_code ndr_pull_NTTIME_hyper(struct ndr_pull *ndr, int ndr_flags, NTTIME *t)
+{
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_CHECK(ndr_pull_hyper(ndr, ndr_flags, t));
         return NDR_ERR_SUCCESS;
 …
 _PUBLIC_ enum ndr_err_code ndr_push_NTTIME_hyper(struct ndr_push *ndr, int ndr_flags, NTTIME t)
+{
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_CHECK(ndr_push_hyper(ndr, ndr_flags, t));
         return NDR_ERR_SUCCESS;
 …
 _PUBLIC_ enum ndr_err_code ndr_push_uid_t(struct ndr_push *ndr, int ndr_flags, uid_t u)
+{
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         return ndr_push_hyper(ndr, NDR_SCALARS, (uint64_t)u);
+}
 …
 _PUBLIC_ enum ndr_err_code ndr_push_gid_t(struct ndr_push *ndr, int ndr_flags, gid_t g)
+{
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         return ndr_push_hyper(ndr, NDR_SCALARS, (uint64_t)g);
+}

trunk/server/librpc/ndr/ndr_misc.c

-              r414
+              r920
                 && (i1->if_version == i2->if_version);
+}
+_PUBLIC_ char *ndr_syntax_id_to_string(TALLOC_CTX *mem_ctx, const struct ndr_syntax_id *id)
+{
+        return talloc_asprintf(mem_ctx,
+                               "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x/0x%08x",
+                               id->uuid.time_low, id->uuid.time_mid,
+                               id->uuid.time_hi_and_version,
+                               id->uuid.clock_seq[0],
+                               id->uuid.clock_seq[1],
+                               id->uuid.node[0], id->uuid.node[1],
+                               id->uuid.node[2], id->uuid.node[3],
+                               id->uuid.node[4], id->uuid.node[5],
+                               (unsigned)id->if_version);
+}
+_PUBLIC_ bool ndr_syntax_id_from_string(const char *s, struct ndr_syntax_id *id)
+{
+        int ret;
+        size_t i;
+        uint32_t time_low;
+        uint32_t time_mid, time_hi_and_version;
+        uint32_t clock_seq[2];
+        uint32_t node[6];
+        uint32_t if_version;
+        ret = sscanf(s,
+                     "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x/0x%08x",
+                     &time_low, &time_mid, &time_hi_and_version,
+                     &clock_seq[0], &clock_seq[1],
+                     &node[0], &node[1], &node[2], &node[3], &node[4], &node[5],
+                     &if_version);
+        if (ret != 12) {
+                return false;
+        }
+        id->uuid.time_low = time_low;
+        id->uuid.time_mid = time_mid;
+        id->uuid.time_hi_and_version = time_hi_and_version;
+        id->uuid.clock_seq[0] = clock_seq[0];
+        id->uuid.clock_seq[1] = clock_seq[1];
+        for (i=0; i<6; i++) {
+                id->uuid.node[i] = node[i];
+        }
+        id->if_version = if_version;
+        return true;
+}

trunk/server/librpc/ndr/ndr_ntlmssp.c

-              r918
+              r920
+}
+_PUBLIC_ struct AV_PAIR *ndr_ntlmssp_find_av(const struct AV_PAIR_LIST *av_list,
+                                             enum ntlmssp_AvId AvId)
+{
+        struct AV_PAIR *res = NULL;
+        uint32_t i = 0;
+        for (i = 0; i < av_list->count; i++) {
+                if (av_list->pair[i].AvId != AvId) {
+                        continue;
+                }
+                res = discard_const_p(struct AV_PAIR, &av_list->pair[i]);
+                break;
+        }
+        return res;
+}

trunk/server/librpc/ndr/ndr_ntlmssp.h

r918	r920
32	32	_PUBLIC_ void ndr_print_ntlmssp_Version(struct ndr_print ndr, const char name, const union ntlmssp_Version *r);
33	33
	34	_PUBLIC_ struct AV_PAIR ndr_ntlmssp_find_av(const struct AV_PAIR_LIST av_list,
	35	enum ntlmssp_AvId AvId);

trunk/server/librpc/rpc/dcerpc_util.c

-              r862
+              r920
 #include "librpc/gen_ndr/ndr_dcerpc.h"
 #include "rpc_common.h"
+#include "lib/util/bitmap.h"
 /* we need to be able to get/set the fragment length without doing a full
 …
 * @return               - A NTSTATUS error code.
 */
 NTSTATUS dcerpc_pull_auth_trailer(struct ncacn_packet *pkt,
+NTSTATUS dcerpc_pull_auth_trailer(const struct ncacn_packet *pkt,
                                   TALLOC_CTX *mem_ctx,
                                   DATA_BLOB *pkt_trailer,
+                                  const DATA_BLOB *pkt_trailer,
                                   struct dcerpc_auth *auth,
                                   uint32_t *auth_length,
+                                  uint32_t *_auth_length,
                                   bool auth_data_only)
+{
         struct ndr_pull *ndr;
         enum ndr_err_code ndr_err;
+        uint32_t data_and_pad;
+        data_and_pad = pkt_trailer->length
+                        - (DCERPC_AUTH_TRAILER_LENGTH + pkt->auth_length);
+        /* paranoia check for pad size. This would be caught anyway by
+           the ndr_pull_advance() a few lines down, but it scared
+           Jeremy enough for him to call me, so we might as well check
+           it now, just to prevent someone posting a bogus YouTube
+           video in the future.
+        */
+        if (data_and_pad > pkt_trailer->length) {
+                return NT_STATUS_INFO_LENGTH_MISMATCH;
+        }
+        *auth_length = pkt_trailer->length - data_and_pad;
+        uint16_t data_and_pad;
+        uint16_t auth_length;
+        uint32_t tmp_length;
+        ZERO_STRUCTP(auth);
+        if (_auth_length != NULL) {
+                *_auth_length = 0;
+        }
+        /* Paranoia checks for auth_length. The caller should check this... */
+        if (pkt->auth_length == 0) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        /* Paranoia checks for auth_length. The caller should check this... */
+        if (pkt->auth_length > pkt->frag_length) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        tmp_length = DCERPC_NCACN_PAYLOAD_OFFSET;
+        tmp_length += DCERPC_AUTH_TRAILER_LENGTH;
+        tmp_length += pkt->auth_length;
+        if (tmp_length > pkt->frag_length) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        if (pkt_trailer->length > UINT16_MAX) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        auth_length = DCERPC_AUTH_TRAILER_LENGTH + pkt->auth_length;
+        if (pkt_trailer->length < auth_length) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        data_and_pad = pkt_trailer->length - auth_length;
         ndr = ndr_pull_init_blob(pkt_trailer, mem_ctx);
 …
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 talloc_free(ndr);
+                ZERO_STRUCTP(auth);
                 return ndr_map_error2ntstatus(ndr_err);
+        }
         if (auth_data_only && data_and_pad != auth->auth_pad_length) {
                 DEBUG(1, (__location__ ": WARNING: pad length mismatch. "
+        if (data_and_pad < auth->auth_pad_length) {
+                DEBUG(1, (__location__ ": ERROR: pad length mismatch. "
                           "Calculated %u  got %u\n",
                           (unsigned)data_and_pad,
                           (unsigned)auth->auth_pad_length));
+                talloc_free(ndr);
+                ZERO_STRUCTP(auth);
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        if (auth_data_only && data_and_pad != auth->auth_pad_length) {
+                DEBUG(1, (__location__ ": ERROR: pad length mismatch. "
+                          "Calculated %u  got %u\n",
+                          (unsigned)data_and_pad,
+                          (unsigned)auth->auth_pad_length));
+                talloc_free(ndr);
+                ZERO_STRUCTP(auth);
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
 …
         talloc_steal(mem_ctx, auth->credentials.data);
         talloc_free(ndr);
+        if (_auth_length != NULL) {
+                *_auth_length = auth_length;
+        }
+        return NT_STATUS_OK;
+}
+/**
+* @brief        Verify the fields in ncacn_packet header.
+*
+* @param pkt            - The ncacn_packet strcuture
+* @param ptype          - The expected PDU type
+* @param max_auth_info  - The maximum size of a possible auth trailer
+* @param required_flags - The required flags for the pdu.
+* @param optional_flags - The possible optional flags for the pdu.
+*
+* @return               - A NTSTATUS error code.
+*/
+NTSTATUS dcerpc_verify_ncacn_packet_header(const struct ncacn_packet *pkt,
+                                           enum dcerpc_pkt_type ptype,
+                                           size_t max_auth_info,
+                                           uint8_t required_flags,
+                                           uint8_t optional_flags)
+{
+        if (pkt->rpc_vers != 5) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        if (pkt->rpc_vers_minor != 0) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        if (pkt->auth_length > pkt->frag_length) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        if (pkt->ptype != ptype) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        if (max_auth_info > UINT16_MAX) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        if (pkt->auth_length > 0) {
+                size_t max_auth_length;
+                if (max_auth_info <= DCERPC_AUTH_TRAILER_LENGTH) {
+                        return NT_STATUS_RPC_PROTOCOL_ERROR;
+                }
+                max_auth_length = max_auth_info - DCERPC_AUTH_TRAILER_LENGTH;
+                if (pkt->auth_length > max_auth_length) {
+                        return NT_STATUS_RPC_PROTOCOL_ERROR;
+                }
+        }
+        if ((pkt->pfc_flags & required_flags) != required_flags) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        if (pkt->pfc_flags & ~(optional_flags|required_flags)) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        if (pkt->drep[0] & ~DCERPC_DREP_LE) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        if (pkt->drep[1] != 0) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        if (pkt->drep[2] != 0) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        if (pkt->drep[3] != 0) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
         return NT_STATUS_OK;
 …
         return NT_STATUS_OK;
+}
+struct dcerpc_sec_vt_header2 dcerpc_sec_vt_header2_from_ncacn_packet(const struct ncacn_packet *pkt)
+{
+        struct dcerpc_sec_vt_header2 ret;
+        ZERO_STRUCT(ret);
+        ret.ptype = pkt->ptype;
+        memcpy(&ret.drep, pkt->drep, sizeof(ret.drep));
+        ret.call_id = pkt->call_id;
+        switch (pkt->ptype) {
+        case DCERPC_PKT_REQUEST:
+                ret.context_id = pkt->u.request.context_id;
+                ret.opnum      = pkt->u.request.opnum;
+                break;
+        case DCERPC_PKT_RESPONSE:
+                ret.context_id = pkt->u.response.context_id;
+                break;
+        case DCERPC_PKT_FAULT:
+                ret.context_id = pkt->u.fault.context_id;
+                break;
+        default:
+                break;
+        }
+        return ret;
+}
+bool dcerpc_sec_vt_header2_equal(const struct dcerpc_sec_vt_header2 *v1,
+                                 const struct dcerpc_sec_vt_header2 *v2)
+{
+        if (v1->ptype != v2->ptype) {
+                return false;
+        }
+        if (memcmp(v1->drep, v2->drep, sizeof(v1->drep)) != 0) {
+                return false;
+        }
+        if (v1->call_id != v2->call_id) {
+                return false;
+        }
+        if (v1->context_id != v2->context_id) {
+                return false;
+        }
+        if (v1->opnum != v2->opnum) {
+                return false;
+        }
+        return true;
+}
+static bool dcerpc_sec_vt_is_valid(const struct dcerpc_sec_verification_trailer *r)
+{
+        bool ret = false;
+        TALLOC_CTX *frame = talloc_stackframe();
+        struct bitmap *commands_seen;
+        int i;
+        if (r->count.count == 0) {
+                ret = true;
+                goto done;
+        }
+        if (memcmp(r->magic, DCERPC_SEC_VT_MAGIC, sizeof(r->magic)) != 0) {
+                goto done;
+        }
+        commands_seen = bitmap_talloc(frame, DCERPC_SEC_VT_COMMAND_ENUM + 1);
+        if (commands_seen == NULL) {
+                goto done;
+        }
+        for (i=0; i < r->count.count; i++) {
+                enum dcerpc_sec_vt_command_enum cmd =
+                        r->commands[i].command & DCERPC_SEC_VT_COMMAND_ENUM;
+                if (bitmap_query(commands_seen, cmd)) {
+                        /* Each command must appear at most once. */
+                        goto done;
+                }
+                bitmap_set(commands_seen, cmd);
+                switch (cmd) {
+                case DCERPC_SEC_VT_COMMAND_BITMASK1:
+                case DCERPC_SEC_VT_COMMAND_PCONTEXT:
+                case DCERPC_SEC_VT_COMMAND_HEADER2:
+                        break;
+                default:
+                        if ((r->commands[i].u._unknown.length % 4) != 0) {
+                                goto done;
+                        }
+                        break;
+                }
+        }
+        ret = true;
+done:
+        TALLOC_FREE(frame);
+        return ret;
+}
+#define CHECK(msg, ok)                                          \
+do {                                                            \
+        if (!ok) {                                              \
+                DEBUG(10, ("SEC_VT check %s failed\n", msg));   \
+                return false;                                   \
+        }                                                       \
+} while(0)
+#define CHECK_SYNTAX(msg, s1, s2)                                       \
+do {                                                            \
+        if (!ndr_syntax_id_equal(&s1, &s2)) {                           \
+                TALLOC_CTX *frame = talloc_stackframe();                \
+                DEBUG(10, ("SEC_VT check %s failed: %s vs. %s\n", msg,  \
+                           ndr_syntax_id_to_string(frame, &s1),         \
+                           ndr_syntax_id_to_string(frame, &s1)));       \
+                TALLOC_FREE(frame);                                     \
+                return false;                                           \
+        }                                                               \
+} while(0)
+bool dcerpc_sec_verification_trailer_check(
+                const struct dcerpc_sec_verification_trailer *vt,
+                const uint32_t *bitmask1,
+                const struct dcerpc_sec_vt_pcontext *pcontext,
+                const struct dcerpc_sec_vt_header2 *header2)
+{
+        size_t i;
+        if (!dcerpc_sec_vt_is_valid(vt)) {
+                return false;
+        }
+        for (i=0; i < vt->count.count; i++) {
+                struct dcerpc_sec_vt *c = &vt->commands[i];
+                switch (c->command & DCERPC_SEC_VT_COMMAND_ENUM) {
+                case DCERPC_SEC_VT_COMMAND_BITMASK1:
+                        if (bitmask1 == NULL) {
+                                CHECK("Bitmask1 must_process_command",
+                                      !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
+                                break;
+                        }
+                        if (c->u.bitmask1 & DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING) {
+                                CHECK("Bitmask1 client_header_signing",
+                                      *bitmask1 & DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING);
+                        }
+                        break;
+                case DCERPC_SEC_VT_COMMAND_PCONTEXT:
+                        if (pcontext == NULL) {
+                                CHECK("Pcontext must_process_command",
+                                      !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
+                                break;
+                        }
+                        CHECK_SYNTAX("Pcontect abstract_syntax",
+                                     pcontext->abstract_syntax,
+                                     c->u.pcontext.abstract_syntax);
+                        CHECK_SYNTAX("Pcontext transfer_syntax",
+                                     pcontext->transfer_syntax,
+                                     c->u.pcontext.transfer_syntax);
+                        break;
+                case DCERPC_SEC_VT_COMMAND_HEADER2: {
+                        if (header2 == NULL) {
+                                CHECK("Header2 must_process_command",
+                                      !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
+                                break;
+                        }
+                        CHECK("Header2", dcerpc_sec_vt_header2_equal(header2, &c->u.header2));
+                        break;
+                }
+                default:
+                        CHECK("Unknown must_process_command",
+                              !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
+                        break;
+                }
+        }
+        return true;
+}

trunk/server/librpc/rpc/rpc_common.h

-              r862
+              r920
 * @return               - A NTSTATUS error code.
 */
 NTSTATUS dcerpc_pull_auth_trailer(struct ncacn_packet *pkt,
+NTSTATUS dcerpc_pull_auth_trailer(const struct ncacn_packet *pkt,
                                   TALLOC_CTX *mem_ctx,
                                   DATA_BLOB *pkt_trailer,
+                                  const DATA_BLOB *pkt_trailer,
                                   struct dcerpc_auth *auth,
                                   uint32_t *auth_length,
                                   bool auth_data_only);
+NTSTATUS dcerpc_verify_ncacn_packet_header(const struct ncacn_packet *pkt,
+                                           enum dcerpc_pkt_type ptype,
+                                           size_t max_auth_info,
+                                           uint8_t required_flags,
+                                           uint8_t optional_flags);
 struct tevent_req *dcerpc_read_ncacn_packet_send(TALLOC_CTX *mem_ctx,
                                                  struct tevent_context *ev,
 …
                                     void *r_ptr);
+/**
+ * Extract header information from a ncacn_packet
+ * as a dcerpc_sec_vt_header2 as used by the security verification trailer.
+ *
+ * @param[in] pkt a packet
+ *
+ * @return a dcerpc_sec_vt_header2
+ */
+struct dcerpc_sec_vt_header2 dcerpc_sec_vt_header2_from_ncacn_packet(const struct ncacn_packet *pkt);
+/**
+ * Test if two dcerpc_sec_vt_header2 structures are equal
+ * without consideration of reserved fields.
+ *
+ * @param v1 a pointer to a dcerpc_sec_vt_header2 structure
+ * @param v2 a pointer to a dcerpc_sec_vt_header2 structure
+ *
+ * @retval true if *v1 equals *v2
+ */
+bool dcerpc_sec_vt_header2_equal(const struct dcerpc_sec_vt_header2 *v1,
+                                 const struct dcerpc_sec_vt_header2 *v2);
+/**
+ * Check for consistency of the security verification trailer with the PDU header.
+ * See <a href="http://msdn.microsoft.com/en-us/library/cc243559.aspx">MS-RPCE 2.2.2.13</a>.
+ * A check with an empty trailer succeeds.
+ *
+ * @param[in] vt a pointer to the security verification trailer.
+ * @param[in] bitmask1 which flags were negotiated on the connection.
+ * @param[in] pcontext the syntaxes negotiatied for the presentation context.
+ * @param[in] header2 some fields from the PDU header.
+ *
+ * @retval true on success.
+ */
+bool dcerpc_sec_verification_trailer_check(
+                const struct dcerpc_sec_verification_trailer *vt,
+                const uint32_t *bitmask1,
+                const struct dcerpc_sec_vt_pcontext *pcontext,
+                const struct dcerpc_sec_vt_header2 *header2);
 #endif /* __DEFAULT_LIBRPC_RPCCOMMON_H__ */

trunk/server/librpc/wscript_build

-              r918
+              r920
 bld.SAMBA_SUBSYSTEM('NDR_DCERPC',
         source='gen_ndr/ndr_dcerpc.c',
+        source='gen_ndr/ndr_dcerpc.c ndr/ndr_dcerpc.c',
         public_deps='ndr',
+        deps='bitmap',
         public_headers='gen_ndr/ndr_dcerpc.h gen_ndr/dcerpc.h',
         header_path= [ ('*gen_ndr*', 'gen_ndr') ],

trunk/server/pidl/lib/Parse/Pidl/ODL.pm

r414	r920
71	71	}
72	72	my $podl = Parse::Pidl::IDL::parse_file($idl_path, $opt_incdirs);
73		if (defined(@$podl)) {
	73	if (defined($podl)) {
74	74	require Parse::Pidl::Typelist;
75	75	my $basename = basename($idl_path, ".idl");

trunk/server/pidl/lib/Parse/Pidl/Samba3/ServerNDR.pm

r918	r920
184	184
185	185	pidl "";
186		pidl "if (p->~~rng_~~fault_state) {";
	186	pidl "if (p->fault_state) {";
187	187	pidl "\ttalloc_free(r);";
188	188	pidl "\t/* Return true here, srv_pipe_hnd.c will take care */";

trunk/server/pidl/pidl

r918	r920
606	606
607	607	$pidl = Parse::Pidl::IDL::parse_file($idl_file, \@opt_incdirs);
608		defined @$pidl \|\| die "Failed to parse $idl_file";
	608	defined $pidl \|\| die "Failed to parse $idl_file";
609	609	}
610	610

trunk/server/selftest/target/Samba3.pm

-              r862
+              r920
         domain logons = yes
         lanman auth = yes
+        raw NTLMv2 auth = yes
 ";
 …
         security = server
         password server = $s3dcvars->{SERVER_IP}
+        client ntlmv2 auth = no
 ";

trunk/server/source3/Makefile-smbtorture4

r918	r920
7	7	@(cd .. && \
8	8	CFLAGS='' $(WAF) reconfigure \|\| \
9		CFLAGS='' $(WAF) configure --enable-socket-wrapper --enable-nss-wrapper --enable-uid-wrapper --nonshared-binary=$(SAMBA4_BINARIES) --enable-auto-reconfigure )
	9	CFLAGS='' $(WAF) configure --enable-socket-wrapper --enable-nss-wrapper --enable-uid-wrapper --nonshared-binary=$(SAMBA4_BINARIES) --enable-auto-reconfigure --bundled-libraries=ALL --disable-gnutls )
10	10
11	11	.PHONY: samba4-configure

trunk/server/source3/Makefile.in

-              r873
+              r920
              librpc/ndr/util.o \
              librpc/gen_ndr/ndr_server_id.o \
+             librpc/gen_ndr/ndr_dcerpc.o
+             librpc/gen_ndr/ndr_dcerpc.o \
+             ../librpc/ndr/ndr_dcerpc.o
 LIBNDR_GEN_OBJ0 = librpc/gen_ndr/ndr_samr.o \
 …
           ../libds/common/flag_mapping.o \
           lib/access.o lib/smbrun.o \
           lib/bitmap.o lib/dprintf.o $(UTIL_REG_OBJ) \
+          ../lib/util/bitmap.o lib/dprintf.o $(UTIL_REG_OBJ) \
           lib/wins_srv.o \
           lib/util_str.o lib/clobber.o lib/util_sid.o \
 …
 PROFILES_OBJ = utils/profiles.o \
                $(LIBSMB_ERR_OBJ) \
+               $(LIBNDR_NTLMSSP_OBJ) \
                $(PARAM_OBJ) \
                $(LIB_OBJ) $(LIB_DUMMY_OBJ) \
 …
            $(PASSCHANGE_OBJ) $(FNAME_UTIL_OBJ) \
            $(LIBCLI_SAMR_OBJ) \
+           rpc_client/init_lsa.o
+           $(LIBCLI_NETLOGON_OBJ) \
+           rpc_client/init_lsa.o \
+           rpc_client/init_netlogon.o
 STATUS_OBJ = utils/status.o utils/status_profile.o \
              $(LOCKING_OBJ) $(PARAM_OBJ) \
              $(PROFILE_OBJ) $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) \
              $(LIBSMB_ERR_OBJ) $(FNAME_UTIL_OBJ)
+             $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ) $(FNAME_UTIL_OBJ)
 SMBCONTROL_OBJ = utils/smbcontrol.o $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) \
         $(LIBSMB_ERR_OBJ) $(POPT_LIB_OBJ) $(PRINTBASE_OBJ)
+        $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ) $(POPT_LIB_OBJ) $(PRINTBASE_OBJ)
 SMBTREE_OBJ = utils/smbtree.o $(PARAM_OBJ) \
 …
              $(LIBMSRPC_GEN_OBJ) \
              $(LIBMSRPC_OBJ) \
+             $(LIBCLI_SRVSVC_OBJ)
+             $(LIBCLI_SRVSVC_OBJ) \
+             $(LIBCLI_NETLOGON_OBJ) \
+             rpc_client/init_netlogon.o
 TESTPARM_OBJ = utils/testparm.o \
                $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) \
                $(LIBSMB_ERR_OBJ)
+               $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ)
 SMBTA_UTIL_OBJ = utils/smbta-util.o $(PARAM_OBJ) $(POPT_LIB_OBJ) \
         $(LIB_NONSMBD_OBJ) \
         $(LIBSMB_ERR_OBJ) $(FNAME_UTIL_OBJ)
+        $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ) $(FNAME_UTIL_OBJ)
 TEST_LP_LOAD_OBJ = param/test_lp_load.o \
 …
                 $(LIBMSRPC_GEN_OBJ) $(LIBMSRPC_OBJ) \
                 $(LIBCLI_SAMR_OBJ) \
+                rpc_client/init_lsa.o
+                $(LIBCLI_NETLOGON_OBJ) \
+                rpc_client/init_lsa.o \
+                rpc_client/init_netlogon.o
 PDBEDIT_OBJ = utils/pdbedit.o $(PASSWD_UTIL_OBJ) $(PARAM_OBJ) $(PASSDB_OBJ) \
 …
                     $(PASSDB_OBJ) $(SMBLDAP_OBJ) $(GROUPDB_OBJ) \
                     $(LIBCLI_SRVSVC_OBJ) \
+                    $(LIBCLI_LSA_OBJ)
+                    $(LIBCLI_LSA_OBJ) \
+                    $(LIBCLI_NETLOGON_OBJ) \
+                    rpc_client/init_netlogon.o
 LIBSMBCLIENT_OBJ = $(LIBSMBCLIENT_OBJ1)
 …
              $(PASSDB_OBJ) $(SMBLDAP_OBJ) $(GROUPDB_OBJ) \
              $(DISPLAY_SEC_OBJ) \
+             $(LIBCLI_SRVSVC_OBJ)
+             $(LIBCLI_SRVSVC_OBJ) \
+             $(LIBCLI_NETLOGON_OBJ) \
+             rpc_client/init_netlogon.o
 LIBSMBCONF_OBJ = ../lib/smbconf/smbconf.o \
 …
                   $(PARAM_OBJ) \
                   $(LIBSMB_ERR_OBJ) \
+                  $(LIBNDR_NTLMSSP_OBJ) \
                   $(POPT_LIB_OBJ)
 …
 NMBLOOKUP_OBJ = utils/nmblookup.o $(PARAM_OBJ) $(LIBNMB_OBJ) \
                $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) $(LIBSMB_ERR_OBJ)
+               $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ)
 SMBTORTURE_OBJ1 = torture/torture.o torture/nbio.o torture/scanner.o torture/utable.o \
 …
         torture/wbc_async.o \
         ../nsswitch/wb_reqtrans.o \
+        $(LIBMSRPC_OBJ) $(LIBMSRPC_GEN_OBJ) $(LIBCLI_ECHO_OBJ)
+        $(LIBMSRPC_OBJ) $(LIBMSRPC_GEN_OBJ) $(LIBCLI_ECHO_OBJ) \
+        $(LIBCLI_NETLOGON_OBJ) rpc_client/init_netlogon.o
 MASKTEST_OBJ = torture/masktest.o $(PARAM_OBJ) $(LIBSMB_OBJ) $(KRBCLIENT_OBJ) \
 …
 MSGTEST_OBJ = torture/msgtest.o $(PARAM_OBJ) $(LIBSMB_ERR_OBJ) \
+                 $(LIBNDR_NTLMSSP_OBJ) \
                  $(LIB_NONSMBD_OBJ) \
                  $(LIBNDR_GEN_OBJ0)
 …
 VFSTEST_OBJ = torture/cmd_vfs.o torture/vfstest.o $(SMBD_OBJ_BASE) $(READLINE_OBJ)
 SMBICONV_OBJ = $(PARAM_OBJ) torture/smbiconv.o $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) $(LIBSMB_ERR_OBJ)
+SMBICONV_OBJ = $(PARAM_OBJ) torture/smbiconv.o $(LIB_NONSMBD_OBJ) $(POPT_LIB_OBJ) $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ)
 LOG2PCAP_OBJ = utils/log2pcaphex.o
 …
                 $(PASSDB_OBJ) $(GROUPDB_OBJ) $(LIBMSRPC_OBJ) $(LIBMSRPC_GEN_OBJ) \
                 $(POPT_LIB_OBJ) $(SMBLDAP_OBJ) \
+                $(LIBCLI_LSA_OBJ)
+                $(LIBCLI_LSA_OBJ) \
+                $(LIBCLI_NETLOGON_OBJ) \
+                rpc_client/init_netlogon.o
 SMBCQUOTAS_OBJ = utils/smbcquotas.o $(LIBSMB_OBJ) $(KRBCLIENT_OBJ) \
 …
                 $(LIBMSRPC_OBJ) $(LIBMSRPC_GEN_OBJ) $(POPT_LIB_OBJ) \
                 $(PASSDB_OBJ) $(SMBLDAP_OBJ) $(GROUPDB_OBJ) \
+                $(LIBCLI_LSA_OBJ)
+                $(LIBCLI_LSA_OBJ) \
+                $(LIBCLI_NETLOGON_OBJ) \
+                rpc_client/init_netlogon.o
 EVTLOGADM_OBJ0  = utils/eventlogadm.o
 EVTLOGADM_OBJ   = $(EVTLOGADM_OBJ0) $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) \
                 $(LIBSMB_ERR_OBJ) $(LIB_EVENTLOG_OBJ) \
+                $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ) $(LIB_EVENTLOG_OBJ) \
                 librpc/gen_ndr/ndr_eventlog.o \
                 librpc/gen_ndr/ndr_lsa.o
 …
 SHARESEC_OBJ0 = utils/sharesec.o
 SHARESEC_OBJ  = $(SHARESEC_OBJ0) $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) \
                 $(LIBSMB_ERR_OBJ) \
+                $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ) \
                 $(POPT_LIB_OBJ)
 TALLOCTORT_OBJ = @tallocdir@/testsuite.o @tallocdir@/testsuite_main.o \
                 $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) $(LIBSMB_ERR_OBJ)
+                $(PARAM_OBJ) $(LIB_NONSMBD_OBJ) $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ)
 REPLACETORT_OBJ = @libreplacedir@/test/testsuite.o \
 …
 WINBIND_WINS_NSS_OBJ = ../nsswitch/wins.o $(PARAM_OBJ) \
         $(LIB_NONSMBD_OBJ) $(LIBSMB_ERR_OBJ) $(LIBNMB_OBJ)
+        $(LIB_NONSMBD_OBJ) $(LIBSMB_ERR_OBJ) $(LIBNDR_NTLMSSP_OBJ) $(LIBNMB_OBJ)
 PAM_SMBPASS_OBJ_0 = pam_smbpass/pam_smb_auth.o pam_smbpass/pam_smb_passwd.o \
 …
                   $(PARAM_OBJ) \
                   $(LIB_NONSMBD_OBJ) \
+                  $(LIBSMB_ERR_OBJ)
+                  $(LIBSMB_ERR_OBJ) \
+                  $(LIBNDR_NTLMSSP_OBJ)
 DBWRAP_TORTURE_OBJ = utils/dbwrap_torture.o \
 …
                      $(LIB_NONSMBD_OBJ) \
                      $(LIBSMB_ERR_OBJ) \
+                     $(LIBNDR_NTLMSSP_OBJ) \
                      $(POPT_LIB_OBJ)

trunk/server/source3/auth/auth_util.c

-              r862
+              r920
 #include "lib/winbind_util.h"
 #include "passdb.h"
+#include "../lib/tsocket/tsocket.h"
 #undef DBGC_CLASS
 …
                                       DATA_BLOB lm_resp, DATA_BLOB nt_resp)
+{
+        bool allow_raw = lp_raw_ntlmv2_auth();
+        if (!allow_raw && nt_resp.length >= 48) {
+                /*
+                 * NTLMv2_RESPONSE has at least 48 bytes
+                 * and should only be supported via NTLMSSP.
+                 */
+                DEBUG(2,("Rejecting raw NTLMv2 authentication with "
+                         "user [%s\\%s]\n",
+                         client_domain, smb_name));
+                return NT_STATUS_INVALID_PARAMETER;
+        }
         return make_user_info_map(user_info, smb_name,
                                   client_domain,

trunk/server/source3/include/ntdomain.h

-              r918
+              r920
         int n_cmds;
         uint32 context_id;
+        struct ndr_syntax_id syntax;
+        /*
+         * shall we allow "connect" auth level for this interface ?
+         */
+        bool allow_connect;
 } PIPE_RPC_FNS;
 …
         /*
+         * Set to true when we should return fault PDU's for everything.
+         */
+        bool fault_state;
+        /*
+         * Set to true when we should return fault PDU's for a bad handle.
+         */
+        bool bad_handle_fault_state;
+        /*
+         * Set to true when the backend does not support a call.
+         */
+        bool rng_fault_state;
+         * States we can be in.
+         */
+        bool allow_alter;
+        bool allow_bind;
+        bool allow_auth3;
+        /*
+         * Set the DCERPC_FAULT to return.
+         */
+        int fault_state;
         /*

trunk/server/source3/include/proto.h

-              r862
+              r920
 bool get_audit_category_from_param(const char *param, uint32 *audit_category);
 const char *audit_policy_str(TALLOC_CTX *mem_ctx, uint32 policy);
-/* The following definitions come from lib/bitmap.c  */
-struct bitmap *bitmap_talloc(TALLOC_CTX *mem_ctx, int n);
-int bitmap_copy(struct bitmap * const dst, const struct bitmap * const src);
-bool bitmap_set(struct bitmap *bm, unsigned i);
-bool bitmap_clear(struct bitmap *bm, unsigned i);
-bool bitmap_query(struct bitmap *bm, unsigned i);
-int bitmap_find(struct bitmap *bm, unsigned ofs);
 /* The following definitions come from lib/charcnv.c  */
 …
 void ntlmssp_want_feature_list(struct ntlmssp_state *ntlmssp_state, char *feature_list);
 void ntlmssp_want_feature(struct ntlmssp_state *ntlmssp_state, uint32_t feature);
+bool ntlmssp_have_feature(struct ntlmssp_state *ntlmssp_state, uint32_t feature);
 NTSTATUS ntlmssp_update(struct ntlmssp_state *ntlmssp_state,
                         const DATA_BLOB in, DATA_BLOB *out) ;
 …
 bool lp_lanman_auth(void);
 bool lp_ntlm_auth(void);
+bool lp_raw_ntlmv2_auth(void);
 bool lp_client_plaintext_auth(void);
 bool lp_client_lanman_auth(void);
 …
 int lp_winbind_max_clients(void);
 const char **lp_winbind_nss_info(void);
+bool lp_winbind_sealed_pipes(void);
 int lp_algorithmic_rid_base(void);
 int lp_name_cache_timeout(void);
 int lp_client_signing(void);
+int lp_client_ipc_signing(void);
 int lp_server_signing(void);
 int lp_client_ldap_sasl_wrapping(void);
 …
 void widelinks_warning(int snum);
 char *lp_ncalrpc_dir(void);
+bool lp_allow_dcerpc_auth_level_connect(void);
 /* The following definitions come from param/loadparm_server_role.c  */

trunk/server/source3/include/smb.h

-              r862
+              r920
 };
 /* the following are used by loadparm for option lists */
 typedef enum {
 …
 #define FLAG_META       0x8000 /* A meta directive - not a real parameter */
 #define FLAG_CMDLINE    0x10000 /* option has been overridden */
-struct bitmap {
-        uint32 *b;
-        unsigned int n;
-};
 /* offsets into message for common items */

trunk/server/source3/lib/bitmap.c

-              r918
+              r920
 #include "includes.h"
+#include "lib/util/bitmap.h"
 /* these functions provide a simple way to allocate integers from a
 …
         struct bitmap *bm;
         bm = TALLOC_P(mem_ctx, struct bitmap);
+        bm = talloc_zero(mem_ctx, struct bitmap);
         if (!bm) return NULL;
         bm->n = n;
         bm->b = TALLOC_ZERO_ARRAY(bm, uint32, (n+31)/32);
+        bm->b = talloc_zero_array(bm, uint32_t, (n+31)/32);
         if (!bm->b) {
                 TALLOC_FREE(bm);
 …
         SMB_ASSERT(dst->b != src->b);
         memcpy(dst->b, src->b, sizeof(uint32)*((count+31)/32));
+        memcpy(dst->b, src->b, sizeof(uint32_t)*((count+31)/32));
         return count;
 …
                 DEBUG(0,("Setting invalid bitmap entry %d (of %d)\n",
                       i, bm->n));
                 return False;
+                return false;
+        }
         bm->b[i/32] |= (1<<(i%32));
         return True;
+        return true;
+}
 …
                 DEBUG(0,("clearing invalid bitmap entry %d (of %d)\n",
                       i, bm->n));
                 return False;
+                return false;
+        }
         bm->b[i/32] &= ~(1<<(i%32));
         return True;
+        return true;
+}
 …
 bool bitmap_query(struct bitmap *bm, unsigned i)
+{
         if (i >= bm->n) return False;
+        if (i >= bm->n) return false;
         if (bm->b[i/32] & (1<<(i%32))) {
                 return True;
+                return true;
+        }
         return False;
+        return false;
+}

trunk/server/source3/libads/sasl.c

-              r918
+              r920
         /* we have a reference conter on ntlmssp_state, if we are signing
            then the state will be kept by the signing engine */
+        if (ads->ldap.wrap_type >= ADS_SASLWRAP_TYPE_SEAL) {
+                bool ok;
+                ok = ntlmssp_have_feature(ntlmssp_state,
+                                          NTLMSSP_FEATURE_SEAL);
+                if (!ok) {
+                        DEBUG(0,("The ntlmssp feature sealing request, but unavailable\n"));
+                        TALLOC_FREE(ntlmssp_state);
+                        return ADS_ERROR_NT(NT_STATUS_INVALID_NETWORK_RESPONSE);
+                }
+                ok = ntlmssp_have_feature(ntlmssp_state,
+                                          NTLMSSP_FEATURE_SIGN);
+                if (!ok) {
+                        DEBUG(0,("The ntlmssp feature signing request, but unavailable\n"));
+                        TALLOC_FREE(ntlmssp_state);
+                        return ADS_ERROR_NT(NT_STATUS_INVALID_NETWORK_RESPONSE);
+                }
+        } else if (ads->ldap.wrap_type >= ADS_SASLWRAP_TYPE_SIGN) {
+                bool ok;
+                ok = ntlmssp_have_feature(ntlmssp_state,
+                                          NTLMSSP_FEATURE_SIGN);
+                if (!ok) {
+                        DEBUG(0,("The gensec feature signing request, but unavailable\n"));
+                        TALLOC_FREE(ntlmssp_state);
+                        return ADS_ERROR_NT(NT_STATUS_INVALID_NETWORK_RESPONSE);
+                }
+        }
         if (ads->ldap.wrap_type > ADS_SASLWRAP_TYPE_PLAIN) {

trunk/server/source3/librpc/rpc/dcerpc.h

-              r918
+              r920
         enum dcerpc_AuthType auth_type;
         enum dcerpc_AuthLevel auth_level;
+        bool verified_bitmask1;
         void *auth_ctx;
+        uint32_t auth_context_id;
         /* Only the client code uses these 3 for now */
 …
                                  const DATA_BLOB *credentials,
                                  DATA_BLOB *blob);
-NTSTATUS dcerpc_pull_dcerpc_auth(TALLOC_CTX *mem_ctx,
-                                 const DATA_BLOB *blob,
-                                 struct dcerpc_auth *r,
-                                 bool bigendian);
 NTSTATUS dcerpc_guess_sizes(struct pipe_auth_data *auth,
                             size_t header_len, size_t data_left,
 …
                            struct ncacn_packet *pkt,
                            DATA_BLOB *pkt_trailer,
+                           size_t header_size,
+                           DATA_BLOB *raw_pkt,
+                           size_t *pad_len);
+                           uint8_t header_size,
+                           DATA_BLOB *raw_pkt);
 /* The following definitions come from librpc/rpc/rpc_common.c  */

trunk/server/source3/librpc/rpc/dcerpc_helpers.c

-              r862
+              r920
 /**
-* @brief Decodes a dcerpc_auth blob
+*
-* @param mem_ctx        The memory context on which to allocate the packet
-*                       elements
-* @param blob           The blob of data to decode
-* @param r              An empty dcerpc_auth structure, must not be NULL
+*
-* @return a NTSTATUS error code
-*/
-NTSTATUS dcerpc_pull_dcerpc_auth(TALLOC_CTX *mem_ctx,
-                                 const DATA_BLOB *blob,
-                                 struct dcerpc_auth *r,
-                                 bool bigendian)
+{
-        enum ndr_err_code ndr_err;
-        struct ndr_pull *ndr;
-        ndr = ndr_pull_init_blob(blob, mem_ctx);
-        if (!ndr) {
-                return NT_STATUS_NO_MEMORY;
+        }
-        if (bigendian) {
-                ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
+        }
-        ndr_err = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, r);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                talloc_free(ndr);
-                return ndr_map_error2ntstatus(ndr_err);
+        }
-        talloc_free(ndr);
-        if (DEBUGLEVEL >= 10) {
-                NDR_PRINT_DEBUG(dcerpc_auth, r);
+        }
-        return NT_STATUS_OK;
+}
-/**
 * @brief Calculate how much data we can in a packet, including calculating
 *        auth token and pad lengths.
 …
                                          auth->auth_level,
                                          pad_len,
 /* context id. */,
+                                         auth->auth_context_id,
                                          &auth_blob,
                                          &auth_info);
 …
 * @param auth           The auth data for the connection
 * @param pkt            The actual ncacn_packet
+* @param pkt_trailer    The stub_and_verifier part of the packet
+* @param pkt_trailer [in][out]  The stub_and_verifier part of the packet,
+*                       the auth_trailer and padding will be removed.
 * @param header_size    The header size
 * @param raw_pkt        The whole raw packet data blob
-* @param pad_len        [out] The padding length used in the packet
+*
 * @return A NTSTATUS error code
 …
                            struct ncacn_packet *pkt,
                            DATA_BLOB *pkt_trailer,
+                           size_t header_size,
+                           DATA_BLOB *raw_pkt,
+                           size_t *pad_len)
+                           uint8_t header_size,
+                           DATA_BLOB *raw_pkt)
+{
         struct schannel_state *schannel_auth;
 …
         DATA_BLOB data;
+        /*
+         * These check should be done in the caller.
+         */
+        SMB_ASSERT(raw_pkt->length == pkt->frag_length);
+        SMB_ASSERT(header_size <= pkt->frag_length);
+        SMB_ASSERT(pkt_trailer->length < pkt->frag_length);
+        SMB_ASSERT((pkt_trailer->length + header_size) <= pkt->frag_length);
         switch (auth->auth_level) {
         case DCERPC_AUTH_LEVEL_PRIVACY:
 …
                         break;
+                }
-                *pad_len = 0;
                 return NT_STATUS_OK;
 …
                         return NT_STATUS_INVALID_PARAMETER;
+                }
-                *pad_len = 0;
                 return NT_STATUS_OK;
 …
+        }
+        /* Paranioa checks for auth_length. */
+        if (pkt->auth_length > pkt->frag_length) {
+                return NT_STATUS_INFO_LENGTH_MISMATCH;
+        }
+        if (((unsigned int)pkt->auth_length
+             + DCERPC_AUTH_TRAILER_LENGTH < (unsigned int)pkt->auth_length) ||
+            ((unsigned int)pkt->auth_length
+             + DCERPC_AUTH_TRAILER_LENGTH < DCERPC_AUTH_TRAILER_LENGTH)) {
+                /* Integer wrap attempt. */
+                return NT_STATUS_INFO_LENGTH_MISMATCH;
+        if (pkt->auth_length == 0) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
 …
+        }
+        if (auth_info.auth_type != auth->auth_type) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        if (auth_info.auth_level != auth->auth_level) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        if (auth_info.auth_context_id != auth->auth_context_id) {
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        pkt_trailer->length -= auth_length;
         data = data_blob_const(raw_pkt->data + header_size,
                                 pkt_trailer->length - auth_length);
         full_pkt = data_blob_const(raw_pkt->data,
                                 raw_pkt->length - auth_info.credentials.length);
+                               pkt_trailer->length);
+        full_pkt = data_blob_const(raw_pkt->data, raw_pkt->length);
+        full_pkt.length -= auth_info.credentials.length;
         switch (auth->auth_type) {
 …
          * are still both used in later calls */
         if (auth->auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
+                if (pkt_trailer->length != data.length) {
+                        return NT_STATUS_INVALID_PARAMETER;
+                }
                 memcpy(pkt_trailer->data, data.data, data.length);
+        }
         *pad_len = auth_info.auth_pad_length;
+        pkt_trailer->length -= auth_info.auth_pad_length;
         data_blob_free(&auth_info.credentials);
         return NT_STATUS_OK;

trunk/server/source3/libsmb/cliconnect.c

-              r862
+              r920
                 /* otherwise do a NT1 style session setup */
+                if (lp_client_ntlmv2_auth() && lp_client_use_spnego()) {
+                        /*
+                         * Don't send an NTLMv2 response without NTLMSSP
+                         * if we want to use spnego support
+                         */
+                        DEBUG(1, ("Server does not support EXTENDED_SECURITY "
+                                  " but 'client use spnego = yes"
+                                  " and 'client ntlmv2 auth = yes'\n"));
+                        return NT_STATUS_ACCESS_DENIED;
+                }
                 status = cli_session_setup_nt1(cli, user, pass, passlen,
                                                ntpass, ntpasslen, workgroup);

trunk/server/source3/libsmb/clidfs.c

-              r918
+              r920
         const char *password;
         NTSTATUS status;
+        int signing_state = get_cmdline_auth_info_signing_state(auth_info);
+        if (force_encrypt) {
+                signing_state = Required;
+        }
         /* make a copy so we don't modify the global string 'service' */
 …
         /* have to open a new connection */
         c = cli_initialise_ex(get_cmdline_auth_info_signing_state(auth_info));
+        c = cli_initialise_ex(signing_state);
         if (c == NULL) {
                 d_printf("Connection to %s failed\n", server_n);

trunk/server/source3/libsmb/libsmb_server.c

-              r918
+              r920
         NTSTATUS status;
         char *newserver, *newshare;
+        int signing_state = Undefined;
         zero_sockaddr(&ss);
 …
         zero_sockaddr(&ss);
+        if (context->internal->smb_encryption_level != SMBC_ENCRYPTLEVEL_NONE) {
+                signing_state = Required;
+        }
         /* have to open a new connection */
         if ((c = cli_initialise()) == NULL) {
+        if ((c = cli_initialise_ex(signing_state)) == NULL) {
                 errno = ENOMEM;
                 return NULL;
 …
                                    pp_workgroup, pp_username, pp_password);
         if (!ipc_srv) {
+                int signing_state = Undefined;
                 /* We didn't find a cached connection.  Get the password */
 …
                         flags |= CLI_FULL_CONNECTION_USE_CCACHE;
+                }
+                if (context->internal->smb_encryption_level != SMBC_ENCRYPTLEVEL_NONE) {
+                        signing_state = Required;
+                }
                 zero_sockaddr(&ss);
 …
                                                 *pp_password,
                                                 flags,
                                                 Undefined);
+                                                signing_state);
                 if (! NT_STATUS_IS_OK(nt_status)) {
                         DEBUG(1,("cli_full_connection failed! (%s)\n",

trunk/server/source3/libsmb/ntlmssp.c

-              r918
+              r920
+}
+bool ntlmssp_have_feature(struct ntlmssp_state *ntlmssp_state,
+                          uint32_t feature)
+{
+        if (feature & NTLMSSP_FEATURE_SIGN) {
+                if (ntlmssp_state->session_key.length == 0) {
+                        return false;
+                }
+                if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN) {
+                        return true;
+                }
+        }
+        if (feature & NTLMSSP_FEATURE_SEAL) {
+                if (ntlmssp_state->session_key.length == 0) {
+                        return false;
+                }
+                if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL) {
+                        return true;
+                }
+        }
+        if (feature & NTLMSSP_FEATURE_SESSION_KEY) {
+                if (ntlmssp_state->session_key.length > 0) {
+                        return true;
+                }
+        }
+        return false;
+}
 /**
  * Request features for the NTLMSSP negotiation
 …
          */
         if (in_list("NTLMSSP_FEATURE_SESSION_KEY", feature_list, True)) {
                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
+                ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SIGN;
+        }
         if (in_list("NTLMSSP_FEATURE_SIGN", feature_list, True)) {
                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
+                ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SIGN;
+        }
         if(in_list("NTLMSSP_FEATURE_SEAL", feature_list, True)) {
                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
+                ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SEAL;
+        }
         if (in_list("NTLMSSP_FEATURE_CCACHE", feature_list, true)) {
                 ntlmssp_state->use_ccache = true;
+        }
+        ntlmssp_state->neg_flags |= ntlmssp_state->required_flags;
+}
 …
         /* As per JRA's comment above */
         if (feature & NTLMSSP_FEATURE_SESSION_KEY) {
                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
+                ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SIGN;
+        }
         if (feature & NTLMSSP_FEATURE_SIGN) {
                 ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
+                ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SIGN;
+        }
         if (feature & NTLMSSP_FEATURE_SEAL) {
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
+                ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SIGN;
+                ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_SEAL;
+        }
         if (feature & NTLMSSP_FEATURE_CCACHE) {
                 ntlmssp_state->use_ccache = true;
+        }
+        ntlmssp_state->neg_flags |= ntlmssp_state->required_flags;
+}
 …
         if (ntlmssp_state->use_ntlmv2) {
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_NTLM2;
+                ntlmssp_state->required_flags |= NTLMSSP_NEGOTIATE_NTLM2;
+                ntlmssp_state->allow_lm_key = false;
+        }
+        if (ntlmssp_state->allow_lm_key) {
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_LM_KEY;
+        }
 …
         return NT_STATUS_MORE_PROCESSING_REQUIRED;
+}
+static NTSTATUS ntlmssp3_handle_neg_flags(struct ntlmssp_state *ntlmssp_state,
+                                          uint32_t flags)
+{
+        uint32_t missing_flags = ntlmssp_state->required_flags;
+        if (flags & NTLMSSP_NEGOTIATE_UNICODE) {
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_UNICODE;
+                ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_OEM;
+                ntlmssp_state->unicode = true;
+        } else {
+                ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_UNICODE;
+                ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_OEM;
+                ntlmssp_state->unicode = false;
+        }
+        /*
+         * NTLMSSP_NEGOTIATE_NTLM2 (NTLMSSP_NEGOTIATE_EXTENDED_SESSIONSECURITY)
+         * has priority over NTLMSSP_NEGOTIATE_LM_KEY
+         */
+        if (!(flags & NTLMSSP_NEGOTIATE_NTLM2)) {
+                ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_NTLM2;
+        }
+        if (ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_NTLM2) {
+                ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
+        }
+        if (!(flags & NTLMSSP_NEGOTIATE_LM_KEY)) {
+                ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_LM_KEY;
+        }
+        if (!(flags & NTLMSSP_NEGOTIATE_ALWAYS_SIGN)) {
+                ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_ALWAYS_SIGN;
+        }
+        if (!(flags & NTLMSSP_NEGOTIATE_128)) {
+                ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_128;
+        }
+        if (!(flags & NTLMSSP_NEGOTIATE_56)) {
+                ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_56;
+        }
+        if (!(flags & NTLMSSP_NEGOTIATE_KEY_EXCH)) {
+                ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_KEY_EXCH;
+        }
+        if (!(flags & NTLMSSP_NEGOTIATE_SIGN)) {
+                ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SIGN;
+        }
+        if (!(flags & NTLMSSP_NEGOTIATE_SEAL)) {
+                ntlmssp_state->neg_flags &= ~NTLMSSP_NEGOTIATE_SEAL;
+        }
+        if ((flags & NTLMSSP_REQUEST_TARGET)) {
+                ntlmssp_state->neg_flags |= NTLMSSP_REQUEST_TARGET;
+        }
+        missing_flags &= ~ntlmssp_state->neg_flags;
+        if (missing_flags != 0) {
+                NTSTATUS status = NT_STATUS_RPC_SEC_PKG_ERROR;
+                DEBUG(1, ("%s: Got challenge flags[0x%08x] "
+                          "- possible downgrade detected! "
+                          "missing_flags[0x%08x] - %s\n",
+                          __func__,
+                          (unsigned)flags,
+                          (unsigned)missing_flags,
+                          nt_errstr(status)));
+                debug_ntlmssp_flags(missing_flags);
+                DEBUGADD(4, ("neg_flags[0x%08x]\n",
+                             (unsigned)ntlmssp_state->neg_flags));
+                debug_ntlmssp_flags(ntlmssp_state->neg_flags);
+                return status;
+        }
+        return NT_STATUS_OK;
+}
 …
         NTSTATUS nt_status = NT_STATUS_OK;
+        if (!msrpc_parse(ntlmssp_state, &reply, "CdBd",
+                         "NTLMSSP",
+                         &ntlmssp_command,
+                         &server_domain_blob,
+                         &chal_flags)) {
+                DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
+                dump_data(2, reply.data, reply.length);
+                return NT_STATUS_INVALID_PARAMETER;
+        }
+        data_blob_free(&server_domain_blob);
+        DEBUG(3, ("Got challenge flags:\n"));
+        debug_ntlmssp_flags(chal_flags);
+        nt_status = ntlmssp3_handle_neg_flags(ntlmssp_state, chal_flags);
+        if (!NT_STATUS_IS_OK(nt_status)) {
+                return nt_status;
+        }
         if (ntlmssp_state->use_ccache) {
                 struct wbcCredentialCacheParams params;
 …
 noccache:
-        if (!msrpc_parse(ntlmssp_state, &reply, "CdBd",
-                         "NTLMSSP",
-                         &ntlmssp_command,
-                         &server_domain_blob,
-                         &chal_flags)) {
-                DEBUG(1, ("Failed to parse the NTLMSSP Challenge: (#1)\n"));
-                dump_data(2, reply.data, reply.length);
-                return NT_STATUS_INVALID_PARAMETER;
+        }
         if (DEBUGLEVEL >= 10) {
 …
+                }
+        }
-        data_blob_free(&server_domain_blob);
-        DEBUG(3, ("Got challenge flags:\n"));
-        debug_ntlmssp_flags(chal_flags);
-        ntlmssp_handle_neg_flags(ntlmssp_state, chal_flags, lp_client_lanman_auth());
         if (ntlmssp_state->unicode) {
 …
         ntlmssp_state->use_ntlmv2 = use_ntlmv2;
+        ntlmssp_state->allow_lm_key = lp_client_lanman_auth();
         ntlmssp_state->expected_state = NTLMSSP_INITIAL;
 …
                 NTLMSSP_REQUEST_TARGET;
+        if (ntlmssp_state->use_ntlmv2) {
+                ntlmssp_state->allow_lm_key = false;
+        }
         ntlmssp_state->client.netbios_name = talloc_strdup(ntlmssp_state, netbios_name);
         if (!ntlmssp_state->client.netbios_name) {

trunk/server/source3/modules/vfs_acl_common.c

r862	r920
24	24	#include "../libcli/security/security.h"
25	25	#include "../librpc/gen_ndr/ndr_security.h"
	26	#include "../lib/util/bitmap.h"
26	27
27	28	static NTSTATUS create_acl_blob(const struct security_descriptor *psd,

trunk/server/source3/modules/vfs_full_audit.c

r918	r920
65	65	#include "auth.h"
66	66	#include "ntioctl.h"
	67	#include "lib/util/bitmap.h"
67	68
68	69	static int vfs_full_audit_debug_level = DBGC_VFS;

trunk/server/source3/modules/vfs_shadow_copy2.c

-              r918
+              r920
 #include "includes.h"
 #include "smbd/smbd.h"
+#include "smbd/globals.h"
+#include "../libcli/security/security.h"
 #include "system/filesys.h"
 #include "ntioctl.h"
 …
+}
+static bool check_access_snapdir(struct vfs_handle_struct *handle,
+                                const char *path)
+{
+        struct smb_filename smb_fname;
+        int ret;
+        NTSTATUS status;
+        uint32_t access_granted = 0;
+        ZERO_STRUCT(smb_fname);
+        smb_fname.base_name = talloc_asprintf(talloc_tos(),
+                                                "%s",
+                                                path);
+        if (smb_fname.base_name == NULL) {
+                return false;
+        }
+        ret = SMB_VFS_NEXT_STAT(handle, &smb_fname);
+        if (ret != 0 || !S_ISDIR(smb_fname.st.st_ex_mode)) {
+                TALLOC_FREE(smb_fname.base_name);
+                return false;
+        }
+        status = smbd_check_open_rights(handle->conn,
+                                        &smb_fname,
+                                        SEC_DIR_LIST,
+                                        &access_granted);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0,("user does not have list permission "
+                        "on snapdir %s\n",
+                        smb_fname.base_name));
+                TALLOC_FREE(smb_fname.base_name);
+                return false;
+        }
+        TALLOC_FREE(smb_fname.base_name);
+        return true;
+}
 static int shadow_copy2_rmdir(vfs_handle_struct *handle,  const char *fname)
+{
 …
         TALLOC_CTX *tmp_ctx = talloc_new(handle->data);
         char *snapshot;
+        bool ret;
         snapdir = shadow_copy2_find_snapdir(tmp_ctx, handle);
 …
                          handle->conn->connectpath));
                 errno = EINVAL;
+                talloc_free(tmp_ctx);
+                return -1;
+        }
+        ret = check_access_snapdir(handle, snapdir);
+        if (!ret) {
+                DEBUG(0,("access denied on listing snapdir %s\n", snapdir));
+                errno = EACCES;
                 talloc_free(tmp_ctx);
                 return -1;

trunk/server/source3/param/loadparm.c

-              r918
+              r920
 #include "dbwrap.h"
 #include "smbldap.h"
+#include "../lib/util/bitmap.h"
 #ifdef HAVE_SYS_SYSCTL_H
 …
         bool bWinbindRefreshTickets;
         bool bWinbindOfflineLogon;
+        bool bWinbindSealedPipes;
         bool bWinbindNormalizeNames;
         bool bWinbindRpcOnly;
 …
         bool bLanmanAuth;
         bool bNTLMAuth;
+        bool bRawNTLMv2Auth;
         bool bUseSpnego;
         bool bClientLanManAuth;
 …
         bool bHostnameLookups;
         bool bUnixExtensions;
+        bool bAllowDcerpcAuthLevelConnect;
         bool bDisableNetbios;
         char * szDedicatedKeytabFile;
 …
         int name_cache_timeout;
         int client_signing;
+        int client_ipc_signing;
         int server_signing;
         int client_ldap_sasl_wrapping;
 …
         },
+        {
+                .label          = "raw NTLMv2 auth",
+                .type           = P_BOOL,
+                .p_class        = P_GLOBAL,
+                .ptr            = &Globals.bRawNTLMv2Auth,
+                .special        = NULL,
+                .enum_list      = NULL,
+                .flags          = FLAG_ADVANCED,
+        },
+        {
                 .label          = "client NTLMv2 auth",
                 .type           = P_BOOL,
 …
         },
+        {
+                .label          = "allow dcerpc auth level connect",
+                .type           = P_BOOL,
+                .p_class        = P_GLOBAL,
+                .ptr            = &Globals.bAllowDcerpcAuthLevelConnect,
+                .special        = NULL,
+                .enum_list      = NULL,
+                .flags          = FLAG_ADVANCED,
+        },
+        {
                 .label          = "use spnego",
                 .type           = P_BOOL,
 …
                 .p_class        = P_GLOBAL,
                 .ptr            = &Globals.client_signing,
+                .special        = NULL,
+                .enum_list      = enum_smb_signing_vals,
+                .flags          = FLAG_ADVANCED,
+        },
+        {
+                .label          = "client ipc signing",
+                .type           = P_ENUM,
+                .p_class        = P_GLOBAL,
+                .ptr            = &Globals.client_ipc_signing,
                 .special        = NULL,
                 .enum_list      = enum_smb_signing_vals,
 …
                 .p_class        = P_GLOBAL,
                 .ptr            = &Globals.bWinbindOfflineLogon,
+                .special        = NULL,
+                .enum_list      = NULL,
+                .flags          = FLAG_ADVANCED,
+        },
+        {
+                .label          = "winbind sealed pipes",
+                .type           = P_BOOL,
+                .p_class        = P_GLOBAL,
+                .ptr            = &Globals.bWinbindSealedPipes,
                 .special        = NULL,
                 .enum_list      = NULL,
 …
         Globals.bLanmanAuth = False;    /* Do NOT use the LanMan hash, even if it is supplied */
         Globals.bNTLMAuth = True;       /* Do use NTLMv1 if it is supplied by the client (otherwise NTLMv2) */
+        Globals.bRawNTLMv2Auth = false; /* Allow NTLMv2 without NTLMSSP */
         Globals.bClientNTLMv2Auth = True; /* Client should always use use NTLMv2, as we can't tell that the server supports it, but most modern servers do */
         /* Note, that we will also use NTLM2 session security (which is different), if it is available */
+        Globals.bAllowDcerpcAuthLevelConnect = false; /* we don't allow this by default */
         Globals.map_to_guest = 0;       /* By Default, "Never" */
 …
         Globals.ldap_debug_threshold = 10;
+        Globals.client_ldap_sasl_wrapping = ADS_AUTH_SASL_SIGN;
         /* This is what we tell the afs client. in reality we set the token
          * to never expire, though, when this runs out the afs client will
 …
         Globals.bWinbindRefreshTickets = False;
         Globals.bWinbindOfflineLogon = False;
+        Globals.bWinbindSealedPipes = True;
         Globals.iIdmapCacheTime = 86400 * 7; /* a week by default */
 …
         Globals.client_signing = Auto;
+        Globals.client_ipc_signing = Required;
         Globals.server_signing = False;
 …
 FN_GLOBAL_STRING(lp_check_password_script, &Globals.szCheckPasswordScript)
+FN_GLOBAL_BOOL(lp_allow_dcerpc_auth_level_connect, &Globals.bAllowDcerpcAuthLevelConnect)
 FN_GLOBAL_STRING(lp_wins_hook, &Globals.szWINSHook)
 FN_GLOBAL_CONST_STRING(lp_template_homedir, &Globals.szTemplateHomedir)
 …
 FN_GLOBAL_BOOL(lp_winbind_refresh_tickets, &Globals.bWinbindRefreshTickets)
 FN_GLOBAL_BOOL(lp_winbind_offline_logon, &Globals.bWinbindOfflineLogon)
+FN_GLOBAL_BOOL(lp_winbind_sealed_pipes, &Globals.bWinbindSealedPipes)
 FN_GLOBAL_BOOL(lp_winbind_normalize_names, &Globals.bWinbindNormalizeNames)
 FN_GLOBAL_BOOL(lp_winbind_rpc_only, &Globals.bWinbindRpcOnly)
 …
 FN_GLOBAL_BOOL(lp_lanman_auth, &Globals.bLanmanAuth)
 FN_GLOBAL_BOOL(lp_ntlm_auth, &Globals.bNTLMAuth)
+FN_GLOBAL_BOOL(lp_raw_ntlmv2_auth, &Globals.bRawNTLMv2Auth)
 FN_GLOBAL_BOOL(lp_client_plaintext_auth, &Globals.bClientPlaintextAuth)
 FN_GLOBAL_BOOL(lp_client_lanman_auth, &Globals.bClientLanManAuth)
 …
 FN_GLOBAL_INTEGER(lp_name_cache_timeout, &Globals.name_cache_timeout)
 FN_GLOBAL_INTEGER(lp_client_signing, &Globals.client_signing)
+FN_GLOBAL_INTEGER(lp_client_ipc_signing, &Globals.client_ipc_signing)
 FN_GLOBAL_INTEGER(lp_server_signing, &Globals.server_signing)
 FN_GLOBAL_INTEGER(lp_client_ldap_sasl_wrapping, &Globals.client_ldap_sasl_wrapping)
 …
+        }
 #endif
+        if (!lp_is_in_client()) {
+                switch (lp_client_ipc_signing()) {
+                case Required:
+                        lp_set_cmdline("client signing", "mandatory");
+                        break;
+                case Auto:
+                        lp_set_cmdline("client signing", "auto");
+                        break;
+                case False:
+                        lp_set_cmdline("client signing", "disabled");
+                        break;
+                }
+        }
         init_iconv();

trunk/server/source3/passdb/pdb_get_set.c

r918	r920
26	26	#include "../libcli/auth/libcli_auth.h"
27	27	#include "../libcli/security/security.h"
	28	#include "../lib/util/bitmap.h"
28	29
29	30	#undef DBGC_CLASS

trunk/server/source3/rpc_client/cli_pipe.c

-              r862
+              r920
 #include "ntlmssp_wrap.h"
 #include "librpc/gen_ndr/ndr_dcerpc.h"
+#include "librpc/gen_ndr/ndr_netlogon_c.h"
 #include "librpc/rpc/dcerpc.h"
 #include "librpc/crypto/gse.h"
 …
                                                 DATA_BLOB *pdu,
                                                 uint8_t expected_pkt_type,
+                                                uint32_t call_id,
                                                 DATA_BLOB *rdata,
                                                 DATA_BLOB *reply_pdu)
+{
+        struct dcerpc_response *r;
+        const struct dcerpc_response *r = NULL;
+        DATA_BLOB tmp_stub = data_blob_null;
         NTSTATUS ret = NT_STATUS_OK;
-        size_t pad_len = 0;
         /*
 …
         *rdata = *pdu;
+        if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
+            !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
+                /*
+                 * TODO: do we still need this hack which was introduced
+                 * in commit a42afcdcc7ab9aa9ed193ae36d3dbb10843447f0.
+                 *
+                 * I don't even know what AS/U might be...
+                 */
+                DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
+                          "fragment first/last ON.\n"));
+                pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
+        }
         /* Ensure we have the correct type. */
         switch (pkt->ptype) {
+        case DCERPC_PKT_BIND_NAK:
+                DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
+                          rpccli_pipe_txt(talloc_tos(), cli)));
+                ret = dcerpc_verify_ncacn_packet_header(pkt,
+                                                DCERPC_PKT_BIND_NAK,
+, /* max_auth_info */
+                                                DCERPC_PFC_FLAG_FIRST |
+                                                DCERPC_PFC_FLAG_LAST,
+); /* optional flags */
+                if (!NT_STATUS_IS_OK(ret)) {
+                        DEBUG(1, (__location__ ": Connection to %s got an unexpected "
+                                  "RPC packet type - %u, expected %u: %s\n",
+                                  rpccli_pipe_txt(talloc_tos(), cli),
+                                  pkt->ptype, expected_pkt_type,
+                                  nt_errstr(ret)));
+                        NDR_PRINT_DEBUG(ncacn_packet, pkt);
+                        return ret;
+                }
+                /* Use this for now... */
+                return NT_STATUS_NETWORK_ACCESS_DENIED;
+        case DCERPC_PKT_BIND_ACK:
+                ret = dcerpc_verify_ncacn_packet_header(pkt,
+                                        expected_pkt_type,
+                                        pkt->u.bind_ack.auth_info.length,
+                                        DCERPC_PFC_FLAG_FIRST |
+                                        DCERPC_PFC_FLAG_LAST,
+                                        DCERPC_PFC_FLAG_CONC_MPX |
+                                        DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN);
+                if (!NT_STATUS_IS_OK(ret)) {
+                        DEBUG(1, (__location__ ": Connection to %s got an unexpected "
+                                  "RPC packet type - %u, expected %u: %s\n",
+                                  rpccli_pipe_txt(talloc_tos(), cli),
+                                  pkt->ptype, expected_pkt_type,
+                                  nt_errstr(ret)));
+                        NDR_PRINT_DEBUG(ncacn_packet, pkt);
+                        return ret;
+                }
+                break;
         case DCERPC_PKT_ALTER_RESP:
+        case DCERPC_PKT_BIND_ACK:
+                /* Client code never receives this kind of packets */
+                ret = dcerpc_verify_ncacn_packet_header(pkt,
+                                        expected_pkt_type,
+                                        pkt->u.alter_resp.auth_info.length,
+                                        DCERPC_PFC_FLAG_FIRST |
+                                        DCERPC_PFC_FLAG_LAST,
+                                        DCERPC_PFC_FLAG_CONC_MPX |
+                                        DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN);
+                if (!NT_STATUS_IS_OK(ret)) {
+                        DEBUG(1, (__location__ ": Connection to %s got an unexpected "
+                                  "RPC packet type - %u, expected %u: %s\n",
+                                  rpccli_pipe_txt(talloc_tos(), cli),
+                                  pkt->ptype, expected_pkt_type,
+                                  nt_errstr(ret)));
+                        NDR_PRINT_DEBUG(ncacn_packet, pkt);
+                        return ret;
+                }
                 break;
         case DCERPC_PKT_RESPONSE:
                 r = &pkt->u.response;
+                ret = dcerpc_verify_ncacn_packet_header(pkt,
+                                                expected_pkt_type,
+                                                r->stub_and_verifier.length,
+, /* required_flags */
+                                                DCERPC_PFC_FLAG_FIRST |
+                                                DCERPC_PFC_FLAG_LAST);
+                if (!NT_STATUS_IS_OK(ret)) {
+                        DEBUG(1, (__location__ ": Connection to %s got an unexpected "
+                                  "RPC packet type - %u, expected %u: %s\n",
+                                  rpccli_pipe_txt(talloc_tos(), cli),
+                                  pkt->ptype, expected_pkt_type,
+                                  nt_errstr(ret)));
+                        NDR_PRINT_DEBUG(ncacn_packet, pkt);
+                        return ret;
+                }
+                tmp_stub.data = r->stub_and_verifier.data;
+                tmp_stub.length = r->stub_and_verifier.length;
                 /* Here's where we deal with incoming sign/seal. */
                 ret = dcerpc_check_auth(cli->auth, pkt,
                                         &r->stub_and_verifier,
+                                        &tmp_stub,
                                         DCERPC_RESPONSE_LENGTH,
                                         pdu, &pad_len);
+                                        pdu);
                 if (!NT_STATUS_IS_OK(ret)) {
+                        DEBUG(1, (__location__ ": Connection to %s got an unexpected "
+                                  "RPC packet type - %u, expected %u: %s\n",
+                                  rpccli_pipe_txt(talloc_tos(), cli),
+                                  pkt->ptype, expected_pkt_type,
+                                  nt_errstr(ret)));
+                        NDR_PRINT_DEBUG(ncacn_packet, pkt);
                         return ret;
+                }
-                if (pkt->frag_length < DCERPC_RESPONSE_LENGTH + pad_len) {
-                        return NT_STATUS_BUFFER_TOO_SMALL;
+                }
                 /* Point the return values at the NDR data. */
+                rdata->data = r->stub_and_verifier.data;
+                if (pkt->auth_length) {
+                        /* We've already done integer wrap tests in
+                         * dcerpc_check_auth(). */
+                        rdata->length = r->stub_and_verifier.length
+                                         - pad_len
+                                         - DCERPC_AUTH_TRAILER_LENGTH
+                                         - pkt->auth_length;
+                } else {
+                        rdata->length = r->stub_and_verifier.length;
+                }
+                DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
+                *rdata = tmp_stub;
+                DEBUG(10, ("Got pdu len %lu, data_len %lu\n",
                            (long unsigned int)pdu->length,
+                           (long unsigned int)rdata->length,
+                           (unsigned int)pad_len));
+                           (long unsigned int)rdata->length));
                 /*
 …
                 break;
-        case DCERPC_PKT_BIND_NAK:
-                DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
-                          rpccli_pipe_txt(talloc_tos(), cli)));
-                /* Use this for now... */
-                return NT_STATUS_NETWORK_ACCESS_DENIED;
         case DCERPC_PKT_FAULT:
+                ret = dcerpc_verify_ncacn_packet_header(pkt,
+                                                DCERPC_PKT_FAULT,
+, /* max_auth_info */
+                                                DCERPC_PFC_FLAG_FIRST |
+                                                DCERPC_PFC_FLAG_LAST,
+                                                DCERPC_PFC_FLAG_DID_NOT_EXECUTE);
+                if (!NT_STATUS_IS_OK(ret)) {
+                        DEBUG(1, (__location__ ": Connection to %s got an unexpected "
+                                  "RPC packet type - %u, expected %u: %s\n",
+                                  rpccli_pipe_txt(talloc_tos(), cli),
+                                  pkt->ptype, expected_pkt_type,
+                                  nt_errstr(ret)));
+                        NDR_PRINT_DEBUG(ncacn_packet, pkt);
+                        return ret;
+                }
                 DEBUG(1, (__location__ ": RPC fault code %s received "
 …
                           (unsigned int)pkt->ptype,
                           rpccli_pipe_txt(talloc_tos(), cli)));
+                return NT_STATUS_INVALID_INFO_CLASS;
+        }
+        if (pkt->ptype != expected_pkt_type) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        if (pkt->call_id != call_id) {
                 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
                           "RPC packet type - %u, not %u\n",
+                          "RPC call_id - %u, not %u\n",
                           rpccli_pipe_txt(talloc_tos(), cli),
+                          pkt->ptype, expected_pkt_type));
+                return NT_STATUS_INVALID_INFO_CLASS;
+        }
+        /* Do this just before return - we don't want to modify any rpc header
+           data before now as we may have needed to do cryptographic actions on
+           it before. */
+        if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
+            !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
+                DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
+                          "fragment first/last ON.\n"));
+                pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
+                          pkt->call_id, call_id));
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
 …
         state->pkt = talloc(state, struct ncacn_packet);
         if (!state->pkt) {
+                /*
+                 * TODO: do a real async disconnect ...
+                 *
+                 * For now do it sync...
+                 */
+                TALLOC_FREE(state->cli->transport);
                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
                 return;
 …
                                           !state->endianess);
         if (!NT_STATUS_IS_OK(status)) {
+                /*
+                 * TODO: do a real async disconnect ...
+                 *
+                 * For now do it sync...
+                 */
+                TALLOC_FREE(state->cli->transport);
                 tevent_req_nterror(req, status);
-                return;
+        }
-        if (state->incoming_frag.length != state->pkt->frag_length) {
-                DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
-                          (unsigned int)state->incoming_frag.length,
-                          (unsigned int)state->pkt->frag_length));
-                tevent_req_nterror(req,  NT_STATUS_INVALID_PARAMETER);
                 return;
+        }
 …
                                                 &state->incoming_frag,
                                                 state->expected_pkt_type,
+                                                state->call_id,
                                                 &rdata,
                                                 &state->reply_pdu);
 …
                   nt_errstr(status)));
+        if (state->pkt->ptype != DCERPC_PKT_FAULT && !NT_STATUS_IS_OK(status)) {
+                /*
+                 * TODO: do a real async disconnect ...
+                 *
+                 * For now do it sync...
+                 */
+                TALLOC_FREE(state->cli->transport);
+        } else if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTOCOL_ERROR)) {
+                /*
+                 * TODO: do a real async disconnect ...
+                 *
+                 * For now do it sync...
+                 */
+                TALLOC_FREE(state->cli->transport);
+        } else if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR)) {
+                /*
+                 * TODO: do a real async disconnect ...
+                 *
+                 * For now do it sync...
+                 */
+                TALLOC_FREE(state->cli->transport);
+        }
         if (!NT_STATUS_IS_OK(status)) {
                 tevent_req_nterror(req, status);
 …
                          state->endianess?"little":"big",
                          state->pkt->drep[0]?"little":"big"));
+                tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
+                /*
+                 * TODO: do a real async disconnect ...
+                 *
+                 * For now do it sync...
+                 */
+                TALLOC_FREE(state->cli->transport);
+                tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
+                return;
+        }
+        if (state->reply_pdu_offset + rdata.length > MAX_RPC_DATA_SIZE) {
+                /*
+                 * TODO: do a real async disconnect ...
+                 *
+                 * For now do it sync...
+                 */
+                TALLOC_FREE(state->cli->transport);
+                tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
                 return;
+        }
 …
                 if (!data_blob_realloc(NULL, &state->reply_pdu,
                                 state->reply_pdu_offset + rdata.length)) {
+                        /*
+                         * TODO: do a real async disconnect ...
+                         *
+                         * For now do it sync...
+                         */
+                        TALLOC_FREE(state->cli->transport);
                         tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
                         return;
 …
                                         state->call_id,
                                         &state->incoming_frag);
+        if (subreq == NULL) {
+                /*
+                 * TODO: do a real async disconnect ...
+                 *
+                 * For now do it sync...
+                 */
+                TALLOC_FREE(state->cli->transport);
+        }
         if (tevent_req_nomem(subreq, req)) {
                 return;
 …
                                                 auth->auth_level,
 , /* auth_pad_length */
 , /* auth_context_id */
+                                                auth->auth_context_id,
                                                 &auth_token,
                                                 &auth_info);
 …
         DATA_BLOB *req_data;
         uint32_t req_data_sent;
+        DATA_BLOB req_trailer;
+        uint32_t req_trailer_sent;
+        bool verify_bitmask1;
+        bool verify_pcontext;
         DATA_BLOB rpc_out;
         DATA_BLOB reply_pdu;
 …
 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
+static NTSTATUS prepare_verification_trailer(struct rpc_api_pipe_req_state *state);
 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
                                   bool *is_last_frag);
 …
+        }
+        status = prepare_verification_trailer(state);
+        if (!NT_STATUS_IS_OK(status)) {
+                goto post_status;
+        }
         status = prepare_next_frag(state, &is_last_frag);
         if (!NT_STATUS_IS_OK(status)) {
 …
+}
+static NTSTATUS prepare_verification_trailer(struct rpc_api_pipe_req_state *state)
+{
+        struct pipe_auth_data *a = state->cli->auth;
+        struct dcerpc_sec_verification_trailer *t;
+        struct dcerpc_sec_vt *c = NULL;
+        struct ndr_push *ndr = NULL;
+        enum ndr_err_code ndr_err;
+        size_t align = 0;
+        size_t pad = 0;
+        if (a == NULL) {
+                return NT_STATUS_OK;
+        }
+        if (a->auth_level < DCERPC_AUTH_LEVEL_INTEGRITY) {
+                return NT_STATUS_OK;
+        }
+        t = talloc_zero(state, struct dcerpc_sec_verification_trailer);
+        if (t == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        if (!a->verified_bitmask1) {
+                t->commands = talloc_realloc(t, t->commands,
+                                             struct dcerpc_sec_vt,
+                                             t->count.count + 1);
+                if (t->commands == NULL) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                c = &t->commands[t->count.count++];
+                ZERO_STRUCTP(c);
+                c->command = DCERPC_SEC_VT_COMMAND_BITMASK1;
+                state->verify_bitmask1 = true;
+        }
+        if (!state->cli->verified_pcontext) {
+                t->commands = talloc_realloc(t, t->commands,
+                                             struct dcerpc_sec_vt,
+                                             t->count.count + 1);
+                if (t->commands == NULL) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                c = &t->commands[t->count.count++];
+                ZERO_STRUCTP(c);
+                c->command = DCERPC_SEC_VT_COMMAND_PCONTEXT;
+                c->u.pcontext.abstract_syntax = state->cli->abstract_syntax;
+                c->u.pcontext.transfer_syntax = state->cli->transfer_syntax;
+                state->verify_pcontext = true;
+        }
+        if (true) { /* We do not support header signing */
+                t->commands = talloc_realloc(t, t->commands,
+                                             struct dcerpc_sec_vt,
+                                             t->count.count + 1);
+                if (t->commands == NULL) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                c = &t->commands[t->count.count++];
+                ZERO_STRUCTP(c);
+                c->command = DCERPC_SEC_VT_COMMAND_HEADER2;
+                c->u.header2.ptype = DCERPC_PKT_REQUEST;
+                c->u.header2.drep[0] = DCERPC_DREP_LE;
+                c->u.header2.drep[1] = 0;
+                c->u.header2.drep[2] = 0;
+                c->u.header2.drep[3] = 0;
+                c->u.header2.call_id = state->call_id;
+                c->u.header2.context_id = 0;
+                c->u.header2.opnum = state->op_num;
+        }
+        if (t->count.count == 0) {
+                TALLOC_FREE(t);
+                return NT_STATUS_OK;
+        }
+        c = &t->commands[t->count.count - 1];
+        c->command |= DCERPC_SEC_VT_COMMAND_END;
+        if (DEBUGLEVEL >= 10) {
+                NDR_PRINT_DEBUG(dcerpc_sec_verification_trailer, t);
+        }
+        ndr = ndr_push_init_ctx(state);
+        if (ndr == NULL) {
+                return NT_STATUS_NO_MEMORY;
+        }
+        ndr_err = ndr_push_dcerpc_sec_verification_trailer(ndr,
+                                                NDR_SCALARS | NDR_BUFFERS,
+                                                t);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                return ndr_map_error2ntstatus(ndr_err);
+        }
+        state->req_trailer = ndr_push_blob(ndr);
+        align = state->req_data->length & 0x3;
+        if (align > 0) {
+                pad = 4 - align;
+        }
+        if (pad > 0) {
+                bool ok;
+                uint8_t *p;
+                const uint8_t zeros[4] = { 0, };
+                ok = data_blob_append(ndr, &state->req_trailer, zeros, pad);
+                if (!ok) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                /* move the padding to the start */
+                p = state->req_trailer.data;
+                memmove(p + pad, p, state->req_trailer.length - pad);
+                memset(p, 0, pad);
+        }
+        return NT_STATUS_OK;
+}
 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
                                   bool *is_last_frag)
+{
-        size_t data_sent_thistime;
         size_t auth_len;
         size_t frag_len;
 …
         size_t pad_len;
         size_t data_left;
+        NTSTATUS status;
+        size_t data_thistime;
+        size_t trailer_left;
+        size_t trailer_thistime = 0;
+        size_t total_left;
+        size_t total_thistime;
+        NTSTATUS status;
+        bool ok;
         union dcerpc_payload u;
         data_left = state->req_data->length - state->req_data_sent;
+        trailer_left = state->req_trailer.length - state->req_trailer_sent;
+        total_left = data_left + trailer_left;
+        if ((total_left < data_left) || (total_left < trailer_left)) {
+                /*
+                 * overflow
+                 */
+                return NT_STATUS_INVALID_PARAMETER_MIX;
+        }
         status = dcerpc_guess_sizes(state->cli->auth,
                                     DCERPC_REQUEST_LENGTH, data_left,
+                                    DCERPC_REQUEST_LENGTH, total_left,
                                     state->cli->max_xmit_frag,
                                     CLIENT_NDR_PADDING_SIZE,
                                     &data_sent_thistime,
+                                    &total_thistime,
                                     &frag_len, &auth_len, &pad_len);
         if (!NT_STATUS_IS_OK(status)) {
 …
+        }
         if (data_sent_thistime == data_left) {
+        if (total_thistime == total_left) {
                 flags |= DCERPC_PFC_FLAG_LAST;
+        }
+        data_thistime = MIN(total_thistime, data_left);
+        if (data_thistime < total_thistime) {
+                trailer_thistime = total_thistime - data_thistime;
+        }
         data_blob_free(&state->rpc_out);
         ZERO_STRUCT(u.request);
         u.request.alloc_hint    = state->req_data->length;
+        u.request.alloc_hint    = total_left;
         u.request.context_id    = 0;
         u.request.opnum         = state->op_num;
 …
         dcerpc_set_frag_length(&state->rpc_out, frag_len);
+        /* Copy in the data. */
+        if (!data_blob_append(NULL, &state->rpc_out,
+        if (data_thistime > 0) {
+                /* Copy in the data. */
+                ok = data_blob_append(NULL, &state->rpc_out,
                                 state->req_data->data + state->req_data_sent,
+                                data_sent_thistime)) {
+                return NT_STATUS_NO_MEMORY;
+                                data_thistime);
+                if (!ok) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                state->req_data_sent += data_thistime;
+        }
+        if (trailer_thistime > 0) {
+                /* Copy in the verification trailer. */
+                ok = data_blob_append(NULL, &state->rpc_out,
+                                state->req_trailer.data + state->req_trailer_sent,
+                                trailer_thistime);
+                if (!ok) {
+                        return NT_STATUS_NO_MEMORY;
+                }
+                state->req_trailer_sent += trailer_thistime;
+        }
 …
+        }
-        state->req_data_sent += data_sent_thistime;
         *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
 …
                 return;
+        }
+        if (state->cli->auth == NULL) {
+                tevent_req_done(req);
+                return;
+        }
+        if (state->verify_bitmask1) {
+                state->cli->auth->verified_bitmask1 = true;
+        }
+        if (state->verify_pcontext) {
+                state->cli->verified_pcontext = true;
+        }
         tevent_req_done(req);
+}
 …
 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
                                 struct rpc_pipe_client *cli,
+                                uint32 rpc_call_id,
+                                enum dcerpc_AuthType auth_type,
+                                enum dcerpc_AuthLevel auth_level,
+                                struct pipe_auth_data *auth,
+                                uint32_t rpc_call_id,
                                 DATA_BLOB *pauth_blob,
                                 DATA_BLOB *rpc_out)
 …
         status = dcerpc_push_dcerpc_auth(mem_ctx,
                                          auth_type,
                                          auth_level,
+                                         auth->auth_type,
+                                         auth->auth_level,
 , /* auth_pad_length */
 , /* auth_context_id */
+                                         auth->auth_context_id,
                                          pauth_blob,
                                          &u.auth3.auth_info);
 …
 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
+                                        enum dcerpc_AuthType auth_type,
+                                        enum dcerpc_AuthLevel auth_level,
+                                        uint32 rpc_call_id,
+                                        struct pipe_auth_data *auth,
+                                        uint32_t rpc_call_id,
                                         const struct ndr_syntax_id *abstract,
                                         const struct ndr_syntax_id *transfer,
 …
         status = dcerpc_push_dcerpc_auth(mem_ctx,
                                          auth_type,
                                          auth_level,
+                                         auth->auth_type,
+                                         auth->auth_level,
 , /* auth_pad_length */
 , /* auth_context_id */
+                                         auth->auth_context_id,
                                          pauth_blob,
                                          &auth_info);
 …
         bool auth3;
         uint32_t rpc_call_id;
+        struct netr_Authenticator auth;
+        struct netr_Authenticator return_auth;
+        struct netlogon_creds_CredentialState *creds;
+        union netr_Capabilities capabilities;
+        struct netr_LogonGetCapabilities r;
 };
 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
+static void rpc_pipe_bind_step_two_trigger(struct tevent_req *req);
 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
                                    struct rpc_pipe_bind_state *state,
 …
         case DCERPC_AUTH_TYPE_NONE:
         case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
-        case DCERPC_AUTH_TYPE_SCHANNEL:
                 /* Bind complete. */
                 tevent_req_done(req);
                 return;
+        case DCERPC_AUTH_TYPE_NTLMSSP:
+        case DCERPC_AUTH_TYPE_SPNEGO:
+        case DCERPC_AUTH_TYPE_KRB5:
+                /* Paranoid lenght checks */
+                if (pkt->frag_length < DCERPC_AUTH_TRAILER_LENGTH
+                                                + pkt->auth_length) {
+                        tevent_req_nterror(req,
+                                        NT_STATUS_INFO_LENGTH_MISMATCH);
+        case DCERPC_AUTH_TYPE_SCHANNEL:
+                rpc_pipe_bind_step_two_trigger(req);
+                return;
+        default:
+                if (pkt->auth_length == 0) {
+                        tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
                         return;
+                }
                 /* get auth credentials */
                 status = dcerpc_pull_dcerpc_auth(talloc_tos(),
                                                  &pkt->u.bind_ack.auth_info,
                                                  &auth, false);
+                status = dcerpc_pull_auth_trailer(pkt, talloc_tos(),
+                                                  &pkt->u.bind_ack.auth_info,
+                                                  &auth, NULL, true);
                 if (!NT_STATUS_IS_OK(status)) {
                         DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
 …
                         return;
+                }
+                if (auth.auth_type != pauth->auth_type) {
+                        DEBUG(0, (__location__ " Auth type %u mismatch expected %u.\n",
+                                  auth.auth_type, pauth->auth_type));
+                        tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
+                        return;
+                }
+                if (auth.auth_level != pauth->auth_level) {
+                        DEBUG(0, (__location__ " Auth level %u mismatch expected %u.\n",
+                                  auth.auth_level, pauth->auth_level));
+                        tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
+                        return;
+                }
+                if (auth.auth_context_id != pauth->auth_context_id) {
+                        DEBUG(0, (__location__ " Auth context id %u mismatch expected %u.\n",
+                                  (unsigned)auth.auth_context_id,
+                                  (unsigned)pauth->auth_context_id));
+                        tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
+                        return;
+                }
                 break;
-        default:
-                goto err_out;
+        }
 …
+}
+static void rpc_pipe_bind_step_two_done(struct tevent_req *subreq);
+static void rpc_pipe_bind_step_two_trigger(struct tevent_req *req)
+{
+        struct rpc_pipe_bind_state *state =
+                tevent_req_data(req,
+                                struct rpc_pipe_bind_state);
+        struct dcerpc_binding_handle *b = state->cli->binding_handle;
+        struct schannel_state *schannel_auth =
+                talloc_get_type_abort(state->cli->auth->auth_ctx,
+                                      struct schannel_state);
+        struct tevent_req *subreq;
+        if (schannel_auth == NULL ||
+            !ndr_syntax_id_equal(&state->cli->abstract_syntax,
+                                 &ndr_table_netlogon.syntax_id)) {
+                tevent_req_done(req);
+                return;
+        }
+        ZERO_STRUCT(state->return_auth);
+        state->creds = netlogon_creds_copy(state, schannel_auth->creds);
+        if (state->creds == NULL) {
+                tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
+                return;
+        }
+        netlogon_creds_client_authenticator(state->creds, &state->auth);
+        state->r.in.server_name = state->cli->srv_name_slash;
+        state->r.in.computer_name = state->creds->computer_name;
+        state->r.in.credential = &state->auth;
+        state->r.in.query_level = 1;
+        state->r.in.return_authenticator = &state->return_auth;
+        state->r.out.capabilities = &state->capabilities;
+        state->r.out.return_authenticator = &state->return_auth;
+        subreq = dcerpc_netr_LogonGetCapabilities_r_send(talloc_tos(),
+                                                         state->ev,
+                                                         b,
+                                                         &state->r);
+        if (subreq == NULL) {
+                tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
+                return;
+        }
+        tevent_req_set_callback(subreq, rpc_pipe_bind_step_two_done, req);
+        return;
+}
+static void rpc_pipe_bind_step_two_done(struct tevent_req *subreq)
+{
+        struct tevent_req *req =
+                tevent_req_callback_data(subreq,
+                                         struct tevent_req);
+        struct rpc_pipe_bind_state *state =
+                tevent_req_data(req,
+                                struct rpc_pipe_bind_state);
+        struct schannel_state *schannel_auth =
+                talloc_get_type_abort(state->cli->auth->auth_ctx,
+                                      struct schannel_state);
+        NTSTATUS status;
+        status = dcerpc_netr_LogonGetCapabilities_r_recv(subreq, talloc_tos());
+        TALLOC_FREE(subreq);
+        if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
+                if (state->cli->dc->negotiate_flags &
+                    NETLOGON_NEG_SUPPORTS_AES) {
+                        DEBUG(5, ("AES is not supported and the error was %s\n",
+                                  nt_errstr(status)));
+                        tevent_req_nterror(req,
+                                           NT_STATUS_INVALID_NETWORK_RESPONSE);
+                        return;
+                }
+                /* This is probably NT */
+                DEBUG(5, ("We are checking against an NT - %s\n",
+                          nt_errstr(status)));
+                tevent_req_done(req);
+                return;
+        } else if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(0, ("dcerpc_netr_LogonGetCapabilities_r_recv failed with %s\n",
+                          nt_errstr(status)));
+                tevent_req_nterror(req, status);
+                return;
+        }
+        if (NT_STATUS_EQUAL(state->r.out.result, NT_STATUS_NOT_IMPLEMENTED)) {
+                if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
+                        /* This means AES isn't supported. */
+                        DEBUG(5, ("AES is not supported and the error was %s\n",
+                                  nt_errstr(state->r.out.result)));
+                        tevent_req_nterror(req,
+                                           NT_STATUS_INVALID_NETWORK_RESPONSE);
+                        return;
+                }
+                /* This is probably an old Samba version */
+                DEBUG(5, ("We are checking against an old Samba version - %s\n",
+                          nt_errstr(state->r.out.result)));
+                tevent_req_done(req);
+                return;
+        }
+        /* We need to check the credential state here, cause win2k3 and earlier
+         * returns NT_STATUS_NOT_IMPLEMENTED */
+        if (!netlogon_creds_client_check(state->creds,
+                                         &state->r.out.return_authenticator->cred)) {
+                /*
+                 * Server replied with bad credential. Fail.
+                 */
+                DEBUG(0,("rpc_pipe_bind_step_two_done: server %s "
+                         "replied with bad credential\n",
+                         state->cli->desthost));
+                tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
+                return;
+        }
+        TALLOC_FREE(schannel_auth->creds);
+        schannel_auth->creds = talloc_steal(state->cli, state->creds);
+        if (!NT_STATUS_IS_OK(state->r.out.result)) {
+                DEBUG(0, ("dcerpc_netr_LogonGetCapabilities_r_recv failed with %s\n",
+                          nt_errstr(state->r.out.result)));
+                tevent_req_nterror(req, state->r.out.result);
+                return;
+        }
+        if (state->creds->negotiate_flags !=
+            state->r.out.capabilities->server_capabilities) {
+                DEBUG(0, ("The client capabilities don't match the server "
+                          "capabilities: local[0x%08X] remote[0x%08X]\n",
+                          state->creds->negotiate_flags,
+                          state->capabilities.server_capabilities));
+                tevent_req_nterror(req,
+                                   NT_STATUS_INVALID_NETWORK_RESPONSE);
+                return;
+        }
+        /* TODO: Add downgrade dectection. */
+        tevent_req_done(req);
+        return;
+}
 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
                                    struct rpc_pipe_bind_state *state,
 …
         data_blob_free(&state->rpc_out);
+        status = create_rpc_alter_context(state,
+                                          auth->auth_type,
+                                          auth->auth_level,
+        status = create_rpc_alter_context(state, auth,
                                           state->rpc_call_id,
                                           &state->cli->abstract_syntax,
 …
         data_blob_free(&state->rpc_out);
         status = create_rpc_bind_auth3(state, state->cli,
+        status = create_rpc_bind_auth3(state, state->cli, auth,
                                         state->rpc_call_id,
-                                        auth->auth_type,
-                                        auth->auth_level,
                                         auth_token,
                                         &state->rpc_out);
 …
          * TODO: do a real async disconnect ...
+         *
          * For now the caller needs to free rpc_cli
+         * For now we do it sync...
          */
+        TALLOC_FREE(hs->rpc_cli->transport);
         hs->rpc_cli = NULL;
 …
         result->auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
         result->auth_level = DCERPC_AUTH_LEVEL_CONNECT;
+        result->auth_context_id = 1;
         result->user_name = talloc_strdup(result, "");
 …
         result->auth_type = DCERPC_AUTH_TYPE_NONE;
         result->auth_level = DCERPC_AUTH_LEVEL_NONE;
+        result->auth_context_id = 0;
         result->user_name = talloc_strdup(result, "");
 …
         result->auth_type = auth_type;
         result->auth_level = auth_level;
+        result->auth_context_id = 1;
         result->user_name = talloc_strdup(result, username);
 …
         result->auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
         result->auth_level = auth_level;
+        result->auth_context_id = 1;
         result->user_name = talloc_strdup(result, "");
 …
         auth->auth_type = DCERPC_AUTH_TYPE_KRB5;
         auth->auth_level = auth_level;
+        auth->auth_context_id = 1;
         if (!username) {
 …
         auth->auth_type = DCERPC_AUTH_TYPE_SPNEGO;
         auth->auth_level = auth_level;
+        auth->auth_context_id = 1;
         if (!username) {
 …
         auth->auth_type = DCERPC_AUTH_TYPE_SPNEGO;
         auth->auth_level = auth_level;
+        auth->auth_context_id = 1;
         if (!username) {

trunk/server/source3/rpc_client/rpc_client.h

r918	r920
40	40	struct ndr_syntax_id abstract_syntax;
41	41	struct ndr_syntax_id transfer_syntax;
	42	bool verified_pcontext;
42	43
43	44	char *desthost;

trunk/server/source3/rpc_server/dfs/srv_dfs_nt.c

r918	r920
412	412	{
413	413	/* FIXME: Implement your code here */
414		p->~~rng_fault_state = True~~;
	414	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
415	415	return WERR_NOT_SUPPORTED;
416	416	}
…	…
419	419	{
420	420	/* FIXME: Implement your code here */
421		p->~~rng_fault_state = True~~;
	421	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
422	422	return WERR_NOT_SUPPORTED;
423	423	}
…	…
426	426	{
427	427	/* FIXME: Implement your code here */
428		p->~~rng_fault_state = True~~;
	428	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
429	429	return WERR_NOT_SUPPORTED;
430	430	}
…	…
433	433	{
434	434	/* FIXME: Implement your code here */
435		p->~~rng_fault_state = True~~;
	435	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
436	436	return WERR_NOT_SUPPORTED;
437	437	}
…	…
440	440	{
441	441	/* FIXME: Implement your code here */
442		p->~~rng_fault_state = True~~;
	442	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
443	443	return WERR_NOT_SUPPORTED;
444	444	}
…	…
447	447	{
448	448	/* FIXME: Implement your code here */
449		p->~~rng_fault_state = True~~;
	449	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
450	450	return WERR_NOT_SUPPORTED;
451	451	}
…	…
454	454	{
455	455	/* FIXME: Implement your code here */
456		p->~~rng_fault_state = True~~;
	456	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
457	457	return WERR_NOT_SUPPORTED;
458	458	}
…	…
461	461	{
462	462	/* FIXME: Implement your code here */
463		p->~~rng_fault_state = True~~;
	463	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
464	464	return WERR_NOT_SUPPORTED;
465	465	}
…	…
468	468	{
469	469	/* FIXME: Implement your code here */
470		p->~~rng_fault_state = True~~;
	470	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
471	471	return WERR_NOT_SUPPORTED;
472	472	}
…	…
475	475	{
476	476	/* FIXME: Implement your code here */
477		p->~~rng_fault_state = True~~;
	477	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
478	478	return WERR_NOT_SUPPORTED;
479	479	}
…	…
482	482	{
483	483	/* FIXME: Implement your code here */
484		p->~~rng_fault_state = True~~;
	484	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
485	485	return WERR_NOT_SUPPORTED;
486	486	}
…	…
489	489	{
490	490	/* FIXME: Implement your code here */
491		p->~~rng_fault_state = True~~;
	491	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
492	492	return WERR_NOT_SUPPORTED;
493	493	}
…	…
496	496	{
497	497	/* FIXME: Implement your code here */
498		p->~~rng_fault_state = True~~;
	498	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
499	499	return WERR_NOT_SUPPORTED;
500	500	}
…	…
503	503	{
504	504	/* FIXME: Implement your code here */
505		p->~~rng_fault_state = True~~;
	505	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
506	506	return WERR_NOT_SUPPORTED;
507	507	}
…	…
510	510	{
511	511	/* FIXME: Implement your code here */
512		p->~~rng_fault_state = True~~;
	512	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
513	513	return WERR_NOT_SUPPORTED;
514	514	}
…	…
517	517	{
518	518	/* FIXME: Implement your code here */
519		p->~~rng_fault_state = True~~;
	519	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
520	520	return WERR_NOT_SUPPORTED;
521	521	}
…	…
524	524	{
525	525	/* FIXME: Implement your code here */
526		p->~~rng_fault_state = True~~;
	526	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
527	527	return WERR_NOT_SUPPORTED;
528	528	}
…	…
531	531	{
532	532	/* FIXME: Implement your code here */
533		p->~~rng_fault_state = True~~;
534		return WERR_NOT_SUPPORTED;
535		}
	533	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
	534	return WERR_NOT_SUPPORTED;
	535	}

trunk/server/source3/rpc_server/dssetup/srv_dssetup_nt.c

r918	r920
131	131	struct dssetup_DsRoleDnsNameToFlatName *r)
132	132	{
133		p->~~rng_fault_state = true~~;
	133	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
134	134	return WERR_NOT_SUPPORTED;
135	135	}
…	…
141	141	struct dssetup_DsRoleDcAsDc *r)
142	142	{
143		p->~~rng_fault_state = true~~;
	143	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
144	144	return WERR_NOT_SUPPORTED;
145	145	}
…	…
151	151	struct dssetup_DsRoleDcAsReplica *r)
152	152	{
153		p->~~rng_fault_state = true~~;
	153	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
154	154	return WERR_NOT_SUPPORTED;
155	155	}
…	…
161	161	struct dssetup_DsRoleDemoteDc *r)
162	162	{
163		p->~~rng_fault_state = true~~;
	163	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
164	164	return WERR_NOT_SUPPORTED;
165	165	}
…	…
171	171	struct dssetup_DsRoleGetDcOperationProgress *r)
172	172	{
173		p->~~rng_fault_state = true~~;
	173	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
174	174	return WERR_NOT_SUPPORTED;
175	175	}
…	…
181	181	struct dssetup_DsRoleGetDcOperationResults *r)
182	182	{
183		p->~~rng_fault_state = true~~;
	183	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
184	184	return WERR_NOT_SUPPORTED;
185	185	}
…	…
191	191	struct dssetup_DsRoleCancel *r)
192	192	{
193		p->~~rng_fault_state = true~~;
	193	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
194	194	return WERR_NOT_SUPPORTED;
195	195	}
…	…
201	201	struct dssetup_DsRoleServerSaveStateForUpgrade *r)
202	202	{
203		p->~~rng_fault_state = true~~;
	203	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
204	204	return WERR_NOT_SUPPORTED;
205	205	}
…	…
211	211	struct dssetup_DsRoleUpgradeDownlevelServer *r)
212	212	{
213		p->~~rng_fault_state = true~~;
	213	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
214	214	return WERR_NOT_SUPPORTED;
215	215	}
…	…
221	221	struct dssetup_DsRoleAbortDownlevelServerUpgrade *r)
222	222	{
223		p->~~rng_fault_state = true~~;
224		return WERR_NOT_SUPPORTED;
225		}
	223	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
	224	return WERR_NOT_SUPPORTED;
	225	}

trunk/server/source3/rpc_server/echo/srv_echo_nt.c

r918	r920
88	88	void _echo_TestCall(struct pipes_struct p, struct echo_TestCall r)
89	89	{
90		p->~~rng_fault_state = True~~;
	90	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
91	91	return;
92	92	}
…	…
94	94	NTSTATUS _echo_TestCall2(struct pipes_struct p, struct echo_TestCall2 r)
95	95	{
96		p->~~rng_fault_state = True~~;
	96	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
97	97	return NT_STATUS_OK;
98	98	}
…	…
106	106	void _echo_TestEnum(struct pipes_struct p, struct echo_TestEnum r)
107	107	{
108		p->~~rng_fault_state = True~~;
	108	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
109	109	return;
110	110	}
…	…
112	112	void _echo_TestSurrounding(struct pipes_struct p, struct echo_TestSurrounding r)
113	113	{
114		p->~~rng_fault_state = True~~;
	114	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
115	115	return;
116	116	}
…	…
118	118	uint16 _echo_TestDoublePointer(struct pipes_struct p, struct echo_TestDoublePointer r)
119	119	{
120		p->~~rng_fault_state = True~~;
	120	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
121	121	return 0;
122	122	}

trunk/server/source3/rpc_server/epmapper/srv_epmapper.c

r918	r920
298	298	if (p->transport != NCALRPC \|\|
299	299	!is_priviledged_pipe(p->session_info)) {
	300	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
300	301	return EPMAPPER_STATUS_CANT_PERFORM_OP;
301	302	}
…	…
434	435	if (p->transport != NCALRPC \|\|
435	436	!is_priviledged_pipe(p->session_info)) {
	437	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
436	438	return EPMAPPER_STATUS_CANT_PERFORM_OP;
437	439	}
…	…
1097	1099	struct epm_InqObject *r)
1098	1100	{
1099		p->~~rng_fault_state = true~~;
	1101	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1100	1102	return EPMAPPER_STATUS_CANT_PERFORM_OP;
1101	1103	}
…	…
1111	1113	struct epm_MgmtDelete *r)
1112	1114	{
1113		p->~~rng_fault_state = true~~;
	1115	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1114	1116	return EPMAPPER_STATUS_CANT_PERFORM_OP;
1115	1117	}
…	…
1122	1124	struct epm_MapAuth *r)
1123	1125	{
1124		p->~~rng_fault_state = true~~;
	1126	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1125	1127	return EPMAPPER_STATUS_CANT_PERFORM_OP;
1126	1128	}

trunk/server/source3/rpc_server/eventlog/srv_eventlog_nt.c

r918	r920
696	696	NTSTATUS _eventlog_BackupEventLogW(struct pipes_struct p, struct eventlog_BackupEventLogW r)
697	697	{
698		p->~~rng_fault_state = True~~;
	698	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
699	699	return NT_STATUS_NOT_IMPLEMENTED;
700	700	}
…	…
839	839	struct eventlog_DeregisterEventSource *r)
840	840	{
841		p->~~rng_fault_state = True~~;
	841	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
842	842	return NT_STATUS_NOT_IMPLEMENTED;
843	843	}
…	…
846	846	struct eventlog_ChangeNotify *r)
847	847	{
848		p->~~rng_fault_state = True~~;
	848	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
849	849	return NT_STATUS_NOT_IMPLEMENTED;
850	850	}
…	…
853	853	struct eventlog_RegisterEventSourceW *r)
854	854	{
855		p->~~rng_fault_state = True~~;
	855	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
856	856	return NT_STATUS_NOT_IMPLEMENTED;
857	857	}
…	…
860	860	struct eventlog_OpenBackupEventLogW *r)
861	861	{
862		p->~~rng_fault_state = True~~;
	862	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
863	863	return NT_STATUS_NOT_IMPLEMENTED;
864	864	}
…	…
867	867	struct eventlog_ClearEventLogA *r)
868	868	{
869		p->~~rng_fault_state = True~~;
	869	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
870	870	return NT_STATUS_NOT_IMPLEMENTED;
871	871	}
…	…
874	874	struct eventlog_BackupEventLogA *r)
875	875	{
876		p->~~rng_fault_state = True~~;
	876	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
877	877	return NT_STATUS_NOT_IMPLEMENTED;
878	878	}
…	…
881	881	struct eventlog_OpenEventLogA *r)
882	882	{
883		p->~~rng_fault_state = True~~;
	883	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
884	884	return NT_STATUS_NOT_IMPLEMENTED;
885	885	}
…	…
888	888	struct eventlog_RegisterEventSourceA *r)
889	889	{
890		p->~~rng_fault_state = True~~;
	890	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
891	891	return NT_STATUS_NOT_IMPLEMENTED;
892	892	}
…	…
895	895	struct eventlog_OpenBackupEventLogA *r)
896	896	{
897		p->~~rng_fault_state = True~~;
	897	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
898	898	return NT_STATUS_NOT_IMPLEMENTED;
899	899	}
…	…
902	902	struct eventlog_ReadEventLogA *r)
903	903	{
904		p->~~rng_fault_state = True~~;
	904	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
905	905	return NT_STATUS_NOT_IMPLEMENTED;
906	906	}
…	…
909	909	struct eventlog_ReportEventA *r)
910	910	{
911		p->~~rng_fault_state = True~~;
	911	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
912	912	return NT_STATUS_NOT_IMPLEMENTED;
913	913	}
…	…
916	916	struct eventlog_RegisterClusterSvc *r)
917	917	{
918		p->~~rng_fault_state = True~~;
	918	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
919	919	return NT_STATUS_NOT_IMPLEMENTED;
920	920	}
…	…
923	923	struct eventlog_DeregisterClusterSvc *r)
924	924	{
925		p->~~rng_fault_state = True~~;
	925	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
926	926	return NT_STATUS_NOT_IMPLEMENTED;
927	927	}
…	…
930	930	struct eventlog_WriteClusterEvents *r)
931	931	{
932		p->~~rng_fault_state = True~~;
	932	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
933	933	return NT_STATUS_NOT_IMPLEMENTED;
934	934	}
…	…
937	937	struct eventlog_ReportEventAndSourceW *r)
938	938	{
939		p->~~rng_fault_state = True~~;
940		return NT_STATUS_NOT_IMPLEMENTED;
941		}
	939	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
	940	return NT_STATUS_NOT_IMPLEMENTED;
	941	}

trunk/server/source3/rpc_server/lsa/srv_lsa_nt.c

r918	r920
818	818
819	819	if ((pdb_capabilities() & PDB_CAP_ADS) == 0) {
820		p->~~rng_fault_state = True~~;
	820	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
821	821	return NT_STATUS_NOT_IMPLEMENTED;
822	822	}
…	…
3211	3211	NTSTATUS _lsa_SetSecObj(struct pipes_struct p, struct lsa_SetSecObj r)
3212	3212	{
3213		p->~~rng_fault_state = True~~;
	3213	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3214	3214	return NT_STATUS_NOT_IMPLEMENTED;
3215	3215	}
…	…
3218	3218	struct lsa_ChangePassword *r)
3219	3219	{
3220		p->~~rng_fault_state = True~~;
	3220	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3221	3221	return NT_STATUS_NOT_IMPLEMENTED;
3222	3222	}
…	…
3224	3224	NTSTATUS _lsa_SetInfoPolicy(struct pipes_struct p, struct lsa_SetInfoPolicy r)
3225	3225	{
3226		p->~~rng_fault_state = True~~;
	3226	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3227	3227	return NT_STATUS_NOT_IMPLEMENTED;
3228	3228	}
…	…
3230	3230	NTSTATUS _lsa_ClearAuditLog(struct pipes_struct p, struct lsa_ClearAuditLog r)
3231	3231	{
3232		p->~~rng_fault_state = True~~;
	3232	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3233	3233	return NT_STATUS_NOT_IMPLEMENTED;
3234	3234	}
…	…
3237	3237	struct lsa_GetQuotasForAccount *r)
3238	3238	{
3239		p->~~rng_fault_state = True~~;
	3239	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3240	3240	return NT_STATUS_NOT_IMPLEMENTED;
3241	3241	}
…	…
3244	3244	struct lsa_SetQuotasForAccount *r)
3245	3245	{
3246		p->~~rng_fault_state = True~~;
	3246	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3247	3247	return NT_STATUS_NOT_IMPLEMENTED;
3248	3248	}
…	…
3251	3251	struct lsa_SetInformationTrustedDomain *r)
3252	3252	{
3253		p->~~rng_fault_state = True~~;
	3253	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3254	3254	return NT_STATUS_NOT_IMPLEMENTED;
3255	3255	}
…	…
3257	3257	NTSTATUS _lsa_QuerySecret(struct pipes_struct p, struct lsa_QuerySecret r)
3258	3258	{
3259		p->~~rng_fault_state = True~~;
	3259	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3260	3260	return NT_STATUS_NOT_IMPLEMENTED;
3261	3261	}
…	…
3264	3264	struct lsa_SetTrustedDomainInfo *r)
3265	3265	{
3266		p->~~rng_fault_state = True~~;
	3266	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3267	3267	return NT_STATUS_NOT_IMPLEMENTED;
3268	3268	}
…	…
3271	3271	struct lsa_StorePrivateData *r)
3272	3272	{
3273		p->~~rng_fault_state = True~~;
	3273	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3274	3274	return NT_STATUS_NOT_IMPLEMENTED;
3275	3275	}
…	…
3278	3278	struct lsa_RetrievePrivateData *r)
3279	3279	{
3280		p->~~rng_fault_state = True~~;
	3280	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3281	3281	return NT_STATUS_NOT_IMPLEMENTED;
3282	3282	}
…	…
3285	3285	struct lsa_SetInfoPolicy2 *r)
3286	3286	{
3287		p->~~rng_fault_state = True~~;
	3287	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3288	3288	return NT_STATUS_NOT_IMPLEMENTED;
3289	3289	}
…	…
3292	3292	struct lsa_SetTrustedDomainInfoByName *r)
3293	3293	{
3294		p->~~rng_fault_state = True~~;
	3294	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3295	3295	return NT_STATUS_NOT_IMPLEMENTED;
3296	3296	}
…	…
3311	3311
3312	3312	if (!(pdb_capabilities() & PDB_CAP_TRUSTED_DOMAINS_EX)) {
3313		p->~~rng_fault_state = True~~;
	3313	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3314	3314	return NT_STATUS_NOT_IMPLEMENTED;
3315	3315	}
…	…
3380	3380	struct lsa_QueryDomainInformationPolicy *r)
3381	3381	{
3382		p->~~rng_fault_state = True~~;
	3382	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3383	3383	return NT_STATUS_NOT_IMPLEMENTED;
3384	3384	}
…	…
3387	3387	struct lsa_SetDomainInformationPolicy *r)
3388	3388	{
3389		p->~~rng_fault_state = True~~;
	3389	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3390	3390	return NT_STATUS_NOT_IMPLEMENTED;
3391	3391	}
…	…
3393	3393	NTSTATUS _lsa_TestCall(struct pipes_struct p, struct lsa_TestCall r)
3394	3394	{
3395		p->~~rng_fault_state = True~~;
	3395	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3396	3396	return NT_STATUS_NOT_IMPLEMENTED;
3397	3397	}
…	…
3399	3399	NTSTATUS _lsa_CREDRWRITE(struct pipes_struct p, struct lsa_CREDRWRITE r)
3400	3400	{
3401		p->~~rng_fault_state = True~~;
	3401	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3402	3402	return NT_STATUS_NOT_IMPLEMENTED;
3403	3403	}
…	…
3405	3405	NTSTATUS _lsa_CREDRREAD(struct pipes_struct p, struct lsa_CREDRREAD r)
3406	3406	{
3407		p->~~rng_fault_state = True~~;
	3407	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3408	3408	return NT_STATUS_NOT_IMPLEMENTED;
3409	3409	}
…	…
3411	3411	NTSTATUS _lsa_CREDRENUMERATE(struct pipes_struct p, struct lsa_CREDRENUMERATE r)
3412	3412	{
3413		p->~~rng_fault_state = True~~;
	3413	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3414	3414	return NT_STATUS_NOT_IMPLEMENTED;
3415	3415	}
…	…
3418	3418	struct lsa_CREDRWRITEDOMAINCREDENTIALS *r)
3419	3419	{
3420		p->~~rng_fault_state = True~~;
	3420	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3421	3421	return NT_STATUS_NOT_IMPLEMENTED;
3422	3422	}
…	…
3425	3425	struct lsa_CREDRREADDOMAINCREDENTIALS *r)
3426	3426	{
3427		p->~~rng_fault_state = True~~;
	3427	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3428	3428	return NT_STATUS_NOT_IMPLEMENTED;
3429	3429	}
…	…
3431	3431	NTSTATUS _lsa_CREDRDELETE(struct pipes_struct p, struct lsa_CREDRDELETE r)
3432	3432	{
3433		p->~~rng_fault_state = True~~;
	3433	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3434	3434	return NT_STATUS_NOT_IMPLEMENTED;
3435	3435	}
…	…
3438	3438	struct lsa_CREDRGETTARGETINFO *r)
3439	3439	{
3440		p->~~rng_fault_state = True~~;
	3440	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3441	3441	return NT_STATUS_NOT_IMPLEMENTED;
3442	3442	}
…	…
3445	3445	struct lsa_CREDRPROFILELOADED *r)
3446	3446	{
3447		p->~~rng_fault_state = True~~;
	3447	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3448	3448	return NT_STATUS_NOT_IMPLEMENTED;
3449	3449	}
…	…
3452	3452	struct lsa_CREDRGETSESSIONTYPES *r)
3453	3453	{
3454		p->~~rng_fault_state = True~~;
	3454	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3455	3455	return NT_STATUS_NOT_IMPLEMENTED;
3456	3456	}
…	…
3459	3459	struct lsa_LSARREGISTERAUDITEVENT *r)
3460	3460	{
3461		p->~~rng_fault_state = True~~;
	3461	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3462	3462	return NT_STATUS_NOT_IMPLEMENTED;
3463	3463	}
…	…
3466	3466	struct lsa_LSARGENAUDITEVENT *r)
3467	3467	{
3468		p->~~rng_fault_state = True~~;
	3468	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3469	3469	return NT_STATUS_NOT_IMPLEMENTED;
3470	3470	}
…	…
3473	3473	struct lsa_LSARUNREGISTERAUDITEVENT *r)
3474	3474	{
3475		p->~~rng_fault_state = True~~;
	3475	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3476	3476	return NT_STATUS_NOT_IMPLEMENTED;
3477	3477	}
…	…
3480	3480	struct lsa_lsaRQueryForestTrustInformation *r)
3481	3481	{
3482		p->~~rng_fault_state = True~~;
	3482	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3483	3483	return NT_STATUS_NOT_IMPLEMENTED;
3484	3484	}
…	…
3993	3993	struct lsa_CREDRRENAME *r)
3994	3994	{
3995		p->~~rng_fault_state = True~~;
	3995	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
3996	3996	return NT_STATUS_NOT_IMPLEMENTED;
3997	3997	}
…	…
4000	4000	struct lsa_LSAROPENPOLICYSCE *r)
4001	4001	{
4002		p->~~rng_fault_state = True~~;
	4002	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
4003	4003	return NT_STATUS_NOT_IMPLEMENTED;
4004	4004	}
…	…
4007	4007	struct lsa_LSARADTREGISTERSECURITYEVENTSOURCE *r)
4008	4008	{
4009		p->~~rng_fault_state = True~~;
	4009	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
4010	4010	return NT_STATUS_NOT_IMPLEMENTED;
4011	4011	}
…	…
4014	4014	struct lsa_LSARADTUNREGISTERSECURITYEVENTSOURCE *r)
4015	4015	{
4016		p->~~rng_fault_state = True~~;
	4016	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
4017	4017	return NT_STATUS_NOT_IMPLEMENTED;
4018	4018	}
…	…
4021	4021	struct lsa_LSARADTREPORTSECURITYEVENT *r)
4022	4022	{
4023		p->~~rng_fault_state = True~~;
	4023	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
4024	4024	return NT_STATUS_NOT_IMPLEMENTED;
4025	4025	}

trunk/server/source3/rpc_server/netlogon/srv_netlog_nt.c

r916	r920
1509	1509	{
1510	1510	const char *wksname = nt_workstation;
	1511	const char *workgroup = lp_workgroup();
1511	1512
1512	1513	status = make_auth_context_fixed(talloc_tos(), &auth_context,
…	…
1533	1534	status = NT_STATUS_NO_MEMORY;
1534	1535	}
	1536
	1537	if (NT_STATUS_IS_OK(status)) {
	1538	status = NTLMv2_RESPONSE_verify_netlogon_creds(
	1539	user_info->client.account_name,
	1540	user_info->client.domain_name,
	1541	user_info->password.response.nt,
	1542	creds, workgroup);
	1543	}
1535	1544	break;
1536	1545	}
…	…
1637	1646	break;
1638	1647	case 6:
	1648	/* Only allow this if the pipe is protected. */
	1649	if (p->auth.auth_level < DCERPC_AUTH_LEVEL_PRIVACY) {
	1650	DEBUG(0,("netr_Validation6: client %s not using privacy for netlogon\n",
	1651	get_remote_machine_name()));
	1652	status = NT_STATUS_INVALID_PARAMETER;
	1653	break;
	1654	}
	1655
1639	1656	status = serverinfo_to_SamInfo6(server_info, pipe_session_key, 16,
1640	1657	r->out.validation->sam6);
…	…
1788	1805	struct netr_LogonUasLogon *r)
1789	1806	{
1790		p->~~rng_fault_state = true~~;
	1807	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1791	1808	return WERR_NOT_SUPPORTED;
1792	1809	}
…	…
1798	1815	struct netr_LogonUasLogoff *r)
1799	1816	{
1800		p->~~rng_fault_state = true~~;
	1817	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1801	1818	return WERR_NOT_SUPPORTED;
1802	1819	}
…	…
1808	1825	struct netr_DatabaseDeltas *r)
1809	1826	{
1810		p->~~rng_fault_state = true~~;
	1827	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1811	1828	return NT_STATUS_NOT_IMPLEMENTED;
1812	1829	}
…	…
1818	1835	struct netr_DatabaseSync *r)
1819	1836	{
1820		p->~~rng_fault_state = true~~;
	1837	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1821	1838	return NT_STATUS_NOT_IMPLEMENTED;
1822	1839	}
…	…
1828	1845	struct netr_AccountDeltas *r)
1829	1846	{
1830		p->~~rng_fault_state = true~~;
	1847	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1831	1848	return NT_STATUS_NOT_IMPLEMENTED;
1832	1849	}
…	…
1838	1855	struct netr_AccountSync *r)
1839	1856	{
1840		p->~~rng_fault_state = true~~;
	1857	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1841	1858	return NT_STATUS_NOT_IMPLEMENTED;
1842	1859	}
…	…
1979	1996	struct netr_DatabaseSync2 *r)
1980	1997	{
1981		p->~~rng_fault_state = true~~;
	1998	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1982	1999	return NT_STATUS_NOT_IMPLEMENTED;
1983	2000	}
…	…
1989	2006	struct netr_DatabaseRedo *r)
1990	2007	{
1991		p->~~rng_fault_state = true~~;
	2008	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1992	2009	return NT_STATUS_NOT_IMPLEMENTED;
1993	2010	}
…	…
1999	2016	struct netr_DsRGetDCName *r)
2000	2017	{
2001		p->~~rng_fault_state = true~~;
	2018	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2002	2019	return WERR_NOT_SUPPORTED;
2003	2020	}
…	…
2018	2035	struct netr_NETRLOGONSETSERVICEBITS *r)
2019	2036	{
2020		p->~~rng_fault_state = true~~;
	2037	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2021	2038	return WERR_NOT_SUPPORTED;
2022	2039	}
…	…
2028	2045	struct netr_LogonGetTrustRid *r)
2029	2046	{
2030		p->~~rng_fault_state = true~~;
	2047	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2031	2048	return WERR_NOT_SUPPORTED;
2032	2049	}
…	…
2038	2055	struct netr_NETRLOGONCOMPUTESERVERDIGEST *r)
2039	2056	{
2040		p->~~rng_fault_state = true~~;
	2057	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2041	2058	return WERR_NOT_SUPPORTED;
2042	2059	}
…	…
2048	2065	struct netr_NETRLOGONCOMPUTECLIENTDIGEST *r)
2049	2066	{
2050		p->~~rng_fault_state = true~~;
	2067	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2051	2068	return WERR_NOT_SUPPORTED;
2052	2069	}
…	…
2058	2075	struct netr_DsRGetDCNameEx *r)
2059	2076	{
2060		p->~~rng_fault_state = true~~;
	2077	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2061	2078	return WERR_NOT_SUPPORTED;
2062	2079	}
…	…
2068	2085	struct netr_DsRGetSiteName *r)
2069	2086	{
2070		p->~~rng_fault_state = true~~;
	2087	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2071	2088	return WERR_NOT_SUPPORTED;
2072	2089	}
…	…
2078	2095	struct netr_LogonGetDomainInfo *r)
2079	2096	{
2080		p->~~rng_fault_state = true~~;
	2097	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2081	2098	return NT_STATUS_NOT_IMPLEMENTED;
2082	2099	}
…	…
2088	2105	struct netr_ServerPasswordGet *r)
2089	2106	{
2090		p->~~rng_fault_state = true~~;
	2107	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2091	2108	return WERR_NOT_SUPPORTED;
2092	2109	}
…	…
2098	2115	struct netr_NETRLOGONSENDTOSAM *r)
2099	2116	{
2100		p->~~rng_fault_state = true~~;
	2117	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2101	2118	return WERR_NOT_SUPPORTED;
2102	2119	}
…	…
2108	2125	struct netr_DsRAddressToSitenamesW *r)
2109	2126	{
2110		p->~~rng_fault_state = true~~;
	2127	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2111	2128	return WERR_NOT_SUPPORTED;
2112	2129	}
…	…
2118	2135	struct netr_DsRGetDCNameEx2 *r)
2119	2136	{
2120		p->~~rng_fault_state = true~~;
	2137	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2121	2138	return WERR_NOT_SUPPORTED;
2122	2139	}
…	…
2128	2145	struct netr_NETRLOGONGETTIMESERVICEPARENTDOMAIN *r)
2129	2146	{
2130		p->~~rng_fault_state = true~~;
	2147	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2131	2148	return WERR_NOT_SUPPORTED;
2132	2149	}
…	…
2138	2155	struct netr_NetrEnumerateTrustedDomainsEx *r)
2139	2156	{
2140		p->~~rng_fault_state = true~~;
	2157	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2141	2158	return WERR_NOT_SUPPORTED;
2142	2159	}
…	…
2148	2165	struct netr_DsRAddressToSitenamesExW *r)
2149	2166	{
2150		p->~~rng_fault_state = true~~;
	2167	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2151	2168	return WERR_NOT_SUPPORTED;
2152	2169	}
…	…
2158	2175	struct netr_DsrGetDcSiteCoverageW *r)
2159	2176	{
2160		p->~~rng_fault_state = true~~;
	2177	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2161	2178	return WERR_NOT_SUPPORTED;
2162	2179	}
…	…
2168	2185	struct netr_DsrEnumerateDomainTrusts *r)
2169	2186	{
2170		p->~~rng_fault_state = true~~;
	2187	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2171	2188	return WERR_NOT_SUPPORTED;
2172	2189	}
…	…
2178	2195	struct netr_DsrDeregisterDNSHostRecords *r)
2179	2196	{
2180		p->~~rng_fault_state = true~~;
	2197	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2181	2198	return WERR_NOT_SUPPORTED;
2182	2199	}
…	…
2188	2205	struct netr_ServerTrustPasswordsGet *r)
2189	2206	{
2190		p->~~rng_fault_state = true~~;
	2207	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2191	2208	return NT_STATUS_NOT_IMPLEMENTED;
2192	2209	}
…	…
2198	2215	struct netr_DsRGetForestTrustInformation *r)
2199	2216	{
2200		p->~~rng_fault_state = true~~;
	2217	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2201	2218	return WERR_NOT_SUPPORTED;
2202	2219	}
…	…
2272	2289	/* TODO: check server name */
2273	2290
2274		status = schannel_check_creds_state(p->mem_ctx, lp_private_dir(),
2275		r->in.computer_name,
2276		r->in.credential,
2277		r->out.return_authenticator,
2278		&creds);
	2291	become_root();
	2292	status = netr_creds_server_step_check(p, p->mem_ctx,
	2293	r->in.computer_name,
	2294	r->in.credential,
	2295	r->out.return_authenticator,
	2296	&creds);
	2297	unbecome_root();
2279	2298	if (!NT_STATUS_IS_OK(status)) {
2280	2299	return status;
…	…
2372	2391	/* TODO: check server name */
2373	2392
2374		status = schannel_check_creds_state(p->mem_ctx, lp_private_dir(),
2375		r->in.computer_name,
2376		r->in.credential,
2377		r->out.return_authenticator,
2378		&creds);
	2393	become_root();
	2394	status = netr_creds_server_step_check(p, p->mem_ctx,
	2395	r->in.computer_name,
	2396	r->in.credential,
	2397	r->out.return_authenticator,
	2398	&creds);
	2399	unbecome_root();
2379	2400	if (!NT_STATUS_IS_OK(status)) {
2380	2401	return status;
…	…
2477	2498	struct netr_Unused47 *r)
2478	2499	{
2479		p->~~rng_fault_state = true~~;
	2500	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2480	2501	return NT_STATUS_NOT_IMPLEMENTED;
2481	2502	}
…	…
2487	2508	struct netr_DsrUpdateReadOnlyServerDnsRecords *r)
2488	2509	{
2489		p->~~rng_fault_state = true~~;
	2510	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2490	2511	return NT_STATUS_NOT_IMPLEMENTED;
2491	2512	}

trunk/server/source3/rpc_server/ntsvcs/srv_ntsvcs_nt.c

r918	r920
228	228	struct PNP_Disconnect *r)
229	229	{
230		p->~~rng_fault_state = true~~;
	230	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
231	231	return WERR_NOT_SUPPORTED;
232	232	}
…	…
238	238	struct PNP_Connect *r)
239	239	{
240		p->~~rng_fault_state = true~~;
	240	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
241	241	return WERR_NOT_SUPPORTED;
242	242	}
…	…
248	248	struct PNP_GetGlobalState *r)
249	249	{
250		p->~~rng_fault_state = true~~;
	250	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
251	251	return WERR_NOT_SUPPORTED;
252	252	}
…	…
258	258	struct PNP_InitDetection *r)
259	259	{
260		p->~~rng_fault_state = true~~;
	260	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
261	261	return WERR_NOT_SUPPORTED;
262	262	}
…	…
268	268	struct PNP_ReportLogOn *r)
269	269	{
270		p->~~rng_fault_state = true~~;
	270	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
271	271	return WERR_NOT_SUPPORTED;
272	272	}
…	…
278	278	struct PNP_GetRootDeviceInstance *r)
279	279	{
280		p->~~rng_fault_state = true~~;
	280	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
281	281	return WERR_NOT_SUPPORTED;
282	282	}
…	…
288	288	struct PNP_GetRelatedDeviceInstance *r)
289	289	{
290		p->~~rng_fault_state = true~~;
	290	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
291	291	return WERR_NOT_SUPPORTED;
292	292	}
…	…
298	298	struct PNP_EnumerateSubKeys *r)
299	299	{
300		p->~~rng_fault_state = true~~;
	300	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
301	301	return WERR_NOT_SUPPORTED;
302	302	}
…	…
308	308	struct PNP_GetDepth *r)
309	309	{
310		p->~~rng_fault_state = true~~;
	310	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
311	311	return WERR_NOT_SUPPORTED;
312	312	}
…	…
318	318	struct PNP_SetDeviceRegProp *r)
319	319	{
320		p->~~rng_fault_state = true~~;
	320	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
321	321	return WERR_NOT_SUPPORTED;
322	322	}
…	…
328	328	struct PNP_GetClassInstance *r)
329	329	{
330		p->~~rng_fault_state = true~~;
	330	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
331	331	return WERR_NOT_SUPPORTED;
332	332	}
…	…
338	338	struct PNP_CreateKey *r)
339	339	{
340		p->~~rng_fault_state = true~~;
	340	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
341	341	return WERR_NOT_SUPPORTED;
342	342	}
…	…
348	348	struct PNP_DeleteRegistryKey *r)
349	349	{
350		p->~~rng_fault_state = true~~;
	350	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
351	351	return WERR_NOT_SUPPORTED;
352	352	}
…	…
358	358	struct PNP_GetClassCount *r)
359	359	{
360		p->~~rng_fault_state = true~~;
	360	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
361	361	return WERR_NOT_SUPPORTED;
362	362	}
…	…
368	368	struct PNP_GetClassName *r)
369	369	{
370		p->~~rng_fault_state = true~~;
	370	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
371	371	return WERR_NOT_SUPPORTED;
372	372	}
…	…
378	378	struct PNP_DeleteClassKey *r)
379	379	{
380		p->~~rng_fault_state = true~~;
	380	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
381	381	return WERR_NOT_SUPPORTED;
382	382	}
…	…
388	388	struct PNP_GetInterfaceDeviceAlias *r)
389	389	{
390		p->~~rng_fault_state = true~~;
	390	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
391	391	return WERR_NOT_SUPPORTED;
392	392	}
…	…
398	398	struct PNP_GetInterfaceDeviceList *r)
399	399	{
400		p->~~rng_fault_state = true~~;
	400	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
401	401	return WERR_NOT_SUPPORTED;
402	402	}
…	…
408	408	struct PNP_GetInterfaceDeviceListSize *r)
409	409	{
410		p->~~rng_fault_state = true~~;
	410	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
411	411	return WERR_NOT_SUPPORTED;
412	412	}
…	…
418	418	struct PNP_RegisterDeviceClassAssociation *r)
419	419	{
420		p->~~rng_fault_state = true~~;
	420	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
421	421	return WERR_NOT_SUPPORTED;
422	422	}
…	…
428	428	struct PNP_UnregisterDeviceClassAssociation *r)
429	429	{
430		p->~~rng_fault_state = true~~;
	430	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
431	431	return WERR_NOT_SUPPORTED;
432	432	}
…	…
438	438	struct PNP_GetClassRegProp *r)
439	439	{
440		p->~~rng_fault_state = true~~;
	440	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
441	441	return WERR_NOT_SUPPORTED;
442	442	}
…	…
448	448	struct PNP_SetClassRegProp *r)
449	449	{
450		p->~~rng_fault_state = true~~;
	450	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
451	451	return WERR_NOT_SUPPORTED;
452	452	}
…	…
458	458	struct PNP_CreateDevInst *r)
459	459	{
460		p->~~rng_fault_state = true~~;
	460	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
461	461	return WERR_NOT_SUPPORTED;
462	462	}
…	…
468	468	struct PNP_DeviceInstanceAction *r)
469	469	{
470		p->~~rng_fault_state = true~~;
	470	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
471	471	return WERR_NOT_SUPPORTED;
472	472	}
…	…
478	478	struct PNP_GetDeviceStatus *r)
479	479	{
480		p->~~rng_fault_state = true~~;
	480	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
481	481	return WERR_NOT_SUPPORTED;
482	482	}
…	…
488	488	struct PNP_SetDeviceProblem *r)
489	489	{
490		p->~~rng_fault_state = true~~;
	490	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
491	491	return WERR_NOT_SUPPORTED;
492	492	}
…	…
498	498	struct PNP_DisableDevInst *r)
499	499	{
500		p->~~rng_fault_state = true~~;
	500	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
501	501	return WERR_NOT_SUPPORTED;
502	502	}
…	…
508	508	struct PNP_UninstallDevInst *r)
509	509	{
510		p->~~rng_fault_state = true~~;
	510	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
511	511	return WERR_NOT_SUPPORTED;
512	512	}
…	…
518	518	struct PNP_AddID *r)
519	519	{
520		p->~~rng_fault_state = true~~;
	520	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
521	521	return WERR_NOT_SUPPORTED;
522	522	}
…	…
528	528	struct PNP_RegisterDriver *r)
529	529	{
530		p->~~rng_fault_state = true~~;
	530	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
531	531	return WERR_NOT_SUPPORTED;
532	532	}
…	…
538	538	struct PNP_QueryRemove *r)
539	539	{
540		p->~~rng_fault_state = true~~;
	540	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
541	541	return WERR_NOT_SUPPORTED;
542	542	}
…	…
548	548	struct PNP_RequestDeviceEject *r)
549	549	{
550		p->~~rng_fault_state = true~~;
	550	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
551	551	return WERR_NOT_SUPPORTED;
552	552	}
…	…
558	558	struct PNP_IsDockStationPresent *r)
559	559	{
560		p->~~rng_fault_state = true~~;
	560	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
561	561	return WERR_NOT_SUPPORTED;
562	562	}
…	…
568	568	struct PNP_RequestEjectPC *r)
569	569	{
570		p->~~rng_fault_state = true~~;
	570	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
571	571	return WERR_NOT_SUPPORTED;
572	572	}
…	…
578	578	struct PNP_AddEmptyLogConf *r)
579	579	{
580		p->~~rng_fault_state = true~~;
	580	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
581	581	return WERR_NOT_SUPPORTED;
582	582	}
…	…
588	588	struct PNP_FreeLogConf *r)
589	589	{
590		p->~~rng_fault_state = true~~;
	590	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
591	591	return WERR_NOT_SUPPORTED;
592	592	}
…	…
598	598	struct PNP_GetFirstLogConf *r)
599	599	{
600		p->~~rng_fault_state = true~~;
	600	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
601	601	return WERR_NOT_SUPPORTED;
602	602	}
…	…
608	608	struct PNP_GetNextLogConf *r)
609	609	{
610		p->~~rng_fault_state = true~~;
	610	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
611	611	return WERR_NOT_SUPPORTED;
612	612	}
…	…
618	618	struct PNP_GetLogConfPriority *r)
619	619	{
620		p->~~rng_fault_state = true~~;
	620	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
621	621	return WERR_NOT_SUPPORTED;
622	622	}
…	…
628	628	struct PNP_AddResDes *r)
629	629	{
630		p->~~rng_fault_state = true~~;
	630	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
631	631	return WERR_NOT_SUPPORTED;
632	632	}
…	…
638	638	struct PNP_FreeResDes *r)
639	639	{
640		p->~~rng_fault_state = true~~;
	640	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
641	641	return WERR_NOT_SUPPORTED;
642	642	}
…	…
648	648	struct PNP_GetNextResDes *r)
649	649	{
650		p->~~rng_fault_state = true~~;
	650	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
651	651	return WERR_NOT_SUPPORTED;
652	652	}
…	…
658	658	struct PNP_GetResDesData *r)
659	659	{
660		p->~~rng_fault_state = true~~;
	660	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
661	661	return WERR_NOT_SUPPORTED;
662	662	}
…	…
668	668	struct PNP_GetResDesDataSize *r)
669	669	{
670		p->~~rng_fault_state = true~~;
	670	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
671	671	return WERR_NOT_SUPPORTED;
672	672	}
…	…
678	678	struct PNP_ModifyResDes *r)
679	679	{
680		p->~~rng_fault_state = true~~;
	680	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
681	681	return WERR_NOT_SUPPORTED;
682	682	}
…	…
688	688	struct PNP_DetectResourceLimit *r)
689	689	{
690		p->~~rng_fault_state = true~~;
	690	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
691	691	return WERR_NOT_SUPPORTED;
692	692	}
…	…
698	698	struct PNP_QueryResConfList *r)
699	699	{
700		p->~~rng_fault_state = true~~;
	700	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
701	701	return WERR_NOT_SUPPORTED;
702	702	}
…	…
708	708	struct PNP_SetHwProf *r)
709	709	{
710		p->~~rng_fault_state = true~~;
	710	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
711	711	return WERR_NOT_SUPPORTED;
712	712	}
…	…
718	718	struct PNP_QueryArbitratorFreeData *r)
719	719	{
720		p->~~rng_fault_state = true~~;
	720	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
721	721	return WERR_NOT_SUPPORTED;
722	722	}
…	…
728	728	struct PNP_QueryArbitratorFreeSize *r)
729	729	{
730		p->~~rng_fault_state = true~~;
	730	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
731	731	return WERR_NOT_SUPPORTED;
732	732	}
…	…
738	738	struct PNP_RunDetection *r)
739	739	{
740		p->~~rng_fault_state = true~~;
	740	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
741	741	return WERR_NOT_SUPPORTED;
742	742	}
…	…
748	748	struct PNP_RegisterNotification *r)
749	749	{
750		p->~~rng_fault_state = true~~;
	750	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
751	751	return WERR_NOT_SUPPORTED;
752	752	}
…	…
758	758	struct PNP_UnregisterNotification *r)
759	759	{
760		p->~~rng_fault_state = true~~;
	760	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
761	761	return WERR_NOT_SUPPORTED;
762	762	}
…	…
768	768	struct PNP_GetCustomDevProp *r)
769	769	{
770		p->~~rng_fault_state = true~~;
	770	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
771	771	return WERR_NOT_SUPPORTED;
772	772	}
…	…
778	778	struct PNP_GetVersionInternal *r)
779	779	{
780		p->~~rng_fault_state = true~~;
	780	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
781	781	return WERR_NOT_SUPPORTED;
782	782	}
…	…
788	788	struct PNP_GetBlockedDriverInfo *r)
789	789	{
790		p->~~rng_fault_state = true~~;
	790	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
791	791	return WERR_NOT_SUPPORTED;
792	792	}
…	…
798	798	struct PNP_GetServerSideDeviceInstallFlags *r)
799	799	{
800		p->~~rng_fault_state = true~~;
801		return WERR_NOT_SUPPORTED;
802		}
	800	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
	801	return WERR_NOT_SUPPORTED;
	802	}

trunk/server/source3/rpc_server/rpc_handles.c

r918	r920
243	243	dump_data(4, (uint8_t )hnd, sizeof(hnd));
244	244
245		p->~~bad_handle_fault_state = true~~;
	245	p->fault_state = DCERPC_FAULT_CONTEXT_MISMATCH;
246	246
247	247	return NULL;

trunk/server/source3/rpc_server/rpc_ncacn_np.c

-              r918
+              r920
         p->syntax = *syntax;
         p->transport = NCALRPC;
+        p->allow_bind = true;
         DEBUG(4,("Created internal pipe %s (pipes_open=%d)\n",
 …
         if (p->fault_state) {
+                p->fault_state = false;
+                NTSTATUS status;
+                status = NT_STATUS(p->fault_state);
+                p->fault_state = 0;
                 data_blob_free(&p->out_data.rdata);
                 talloc_free_children(p->mem_ctx);
+                return NT_STATUS_RPC_CALL_FAILED;
+        }
+        if (p->bad_handle_fault_state) {
+                p->bad_handle_fault_state = false;
+                data_blob_free(&p->out_data.rdata);
+                talloc_free_children(p->mem_ctx);
+                return NT_STATUS_RPC_SS_CONTEXT_MISMATCH;
+        }
+        if (p->rng_fault_state) {
+                p->rng_fault_state = false;
+                data_blob_free(&p->out_data.rdata);
+                talloc_free_children(p->mem_ctx);
+                return NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE;
+                return status;
+        }
 …
         result->auth->auth_type = DCERPC_AUTH_TYPE_NONE;
         result->auth->auth_level = DCERPC_AUTH_LEVEL_NONE;
+        result->auth->auth_context_id = 0;
         status = rpccli_anon_bind_data(result, &auth);

trunk/server/source3/rpc_server/rpc_server.c

-              r745
+              r920
         p->transport = transport;
         p->ncalrpc_as_system = ncalrpc_as_system;
+        p->allow_bind = true;
         p->mem_ctx = talloc_named(p, 0, "pipe %s %p", pipe_name, p);
 …
         if (ret == -1) {
                 DEBUG(2, ("Writev failed!\n"));
+                goto fail;
+        }
+        if (npc->p->fault_state != 0) {
+                DEBUG(2, ("Disconnect after fault\n"));
+                sys_errno = EINVAL;
                 goto fail;
+        }
 …
+        }
+        if (ncacn_conn->p->fault_state != 0) {
+                DEBUG(2, ("Disconnect after fault\n"));
+                sys_errno = EINVAL;
+                goto fail;
+        }
         /* clear out any data that may have been left around */
         ncacn_conn->count = 0;

trunk/server/source3/rpc_server/samr/srv_samr_nt.c

r862	r920
6629	6629	struct samr_PwInfo dom_pw_info;
6630	6630
	6631	if (p->auth.auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
	6632	p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
	6633	return NT_STATUS_ACCESS_DENIED;
	6634	}
	6635
6631	6636	if (r->in.level < 1 \|\| r->in.level > 3) {
6632	6637	return NT_STATUS_INVALID_INFO_CLASS;
…	…
6683	6688	struct samr_Shutdown *r)
6684	6689	{
6685		p->~~rng_fault_state = true~~;
	6690	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6686	6691	return NT_STATUS_NOT_IMPLEMENTED;
6687	6692	}
…	…
6693	6698	struct samr_SetMemberAttributesOfGroup *r)
6694	6699	{
6695		p->~~rng_fault_state = true~~;
	6700	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6696	6701	return NT_STATUS_NOT_IMPLEMENTED;
6697	6702	}
…	…
6703	6708	struct samr_TestPrivateFunctionsDomain *r)
6704	6709	{
	6710	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6705	6711	return NT_STATUS_NOT_IMPLEMENTED;
6706	6712	}
…	…
6712	6718	struct samr_TestPrivateFunctionsUser *r)
6713	6719	{
	6720	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6714	6721	return NT_STATUS_NOT_IMPLEMENTED;
6715	6722	}
…	…
6721	6728	struct samr_AddMultipleMembersToAlias *r)
6722	6729	{
6723		p->~~rng_fault_state = true~~;
	6730	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6724	6731	return NT_STATUS_NOT_IMPLEMENTED;
6725	6732	}
…	…
6731	6738	struct samr_RemoveMultipleMembersFromAlias *r)
6732	6739	{
6733		p->~~rng_fault_state = true~~;
	6740	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6734	6741	return NT_STATUS_NOT_IMPLEMENTED;
6735	6742	}
…	…
6741	6748	struct samr_SetBootKeyInformation *r)
6742	6749	{
6743		p->~~rng_fault_state = true~~;
	6750	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6744	6751	return NT_STATUS_NOT_IMPLEMENTED;
6745	6752	}
…	…
6751	6758	struct samr_GetBootKeyInformation *r)
6752	6759	{
6753		p->~~rng_fault_state = true~~;
	6760	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6754	6761	return NT_STATUS_NOT_IMPLEMENTED;
6755	6762	}
…	…
6761	6768	struct samr_SetDsrmPassword *r)
6762	6769	{
6763		p->~~rng_fault_state = true~~;
	6770	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
6764	6771	return NT_STATUS_NOT_IMPLEMENTED;
6765	6772	}

trunk/server/source3/rpc_server/spoolss/srv_spoolss_nt.c

r862	r920
2481	2481	"", /* domain */
2482	2482	"", /* password */
2483		0, ~~lp_client_signing()~~);
	2483	0, False);
2484	2484
2485	2485	if ( !NT_STATUS_IS_OK( ret ) ) {
…	…
10157	10157	struct spoolss_GetPrinterDriver *r)
10158	10158	{
10159		p->~~rng_fault_state = true~~;
	10159	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10160	10160	return WERR_NOT_SUPPORTED;
10161	10161	}
…	…
10168	10168	struct spoolss_ReadPrinter *r)
10169	10169	{
10170		p->~~rng_fault_state = true~~;
	10170	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10171	10171	return WERR_NOT_SUPPORTED;
10172	10172	}
…	…
10179	10179	struct spoolss_WaitForPrinterChange *r)
10180	10180	{
10181		p->~~rng_fault_state = true~~;
	10181	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10182	10182	return WERR_NOT_SUPPORTED;
10183	10183	}
…	…
10190	10190	struct spoolss_ConfigurePort *r)
10191	10191	{
10192		p->~~rng_fault_state = true~~;
	10192	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10193	10193	return WERR_NOT_SUPPORTED;
10194	10194	}
…	…
10201	10201	struct spoolss_DeletePort *r)
10202	10202	{
10203		p->~~rng_fault_state = true~~;
	10203	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10204	10204	return WERR_NOT_SUPPORTED;
10205	10205	}
…	…
10212	10212	struct spoolss_CreatePrinterIC *r)
10213	10213	{
10214		p->~~rng_fault_state = true~~;
	10214	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10215	10215	return WERR_NOT_SUPPORTED;
10216	10216	}
…	…
10223	10223	struct spoolss_PlayGDIScriptOnPrinterIC *r)
10224	10224	{
10225		p->~~rng_fault_state = true~~;
	10225	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10226	10226	return WERR_NOT_SUPPORTED;
10227	10227	}
…	…
10234	10234	struct spoolss_DeletePrinterIC *r)
10235	10235	{
10236		p->~~rng_fault_state = true~~;
	10236	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10237	10237	return WERR_NOT_SUPPORTED;
10238	10238	}
…	…
10245	10245	struct spoolss_AddPrinterConnection *r)
10246	10246	{
10247		p->~~rng_fault_state = true~~;
	10247	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10248	10248	return WERR_NOT_SUPPORTED;
10249	10249	}
…	…
10256	10256	struct spoolss_DeletePrinterConnection *r)
10257	10257	{
10258		p->~~rng_fault_state = true~~;
	10258	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10259	10259	return WERR_NOT_SUPPORTED;
10260	10260	}
…	…
10267	10267	struct spoolss_PrinterMessageBox *r)
10268	10268	{
10269		p->~~rng_fault_state = true~~;
	10269	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10270	10270	return WERR_NOT_SUPPORTED;
10271	10271	}
…	…
10278	10278	struct spoolss_AddMonitor *r)
10279	10279	{
10280		p->~~rng_fault_state = true~~;
	10280	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10281	10281	return WERR_NOT_SUPPORTED;
10282	10282	}
…	…
10289	10289	struct spoolss_DeleteMonitor *r)
10290	10290	{
10291		p->~~rng_fault_state = true~~;
	10291	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10292	10292	return WERR_NOT_SUPPORTED;
10293	10293	}
…	…
10300	10300	struct spoolss_DeletePrintProcessor *r)
10301	10301	{
10302		p->~~rng_fault_state = true~~;
	10302	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10303	10303	return WERR_NOT_SUPPORTED;
10304	10304	}
…	…
10311	10311	struct spoolss_AddPrintProvidor *r)
10312	10312	{
10313		p->~~rng_fault_state = true~~;
	10313	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10314	10314	return WERR_NOT_SUPPORTED;
10315	10315	}
…	…
10322	10322	struct spoolss_DeletePrintProvidor *r)
10323	10323	{
10324		p->~~rng_fault_state = true~~;
	10324	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10325	10325	return WERR_NOT_SUPPORTED;
10326	10326	}
…	…
10333	10333	struct spoolss_FindFirstPrinterChangeNotification *r)
10334	10334	{
10335		p->~~rng_fault_state = true~~;
	10335	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10336	10336	return WERR_NOT_SUPPORTED;
10337	10337	}
…	…
10344	10344	struct spoolss_FindNextPrinterChangeNotification *r)
10345	10345	{
10346		p->~~rng_fault_state = true~~;
	10346	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10347	10347	return WERR_NOT_SUPPORTED;
10348	10348	}
…	…
10355	10355	struct spoolss_RouterFindFirstPrinterChangeNotificationOld *r)
10356	10356	{
10357		p->~~rng_fault_state = true~~;
	10357	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10358	10358	return WERR_NOT_SUPPORTED;
10359	10359	}
…	…
10366	10366	struct spoolss_ReplyOpenPrinter *r)
10367	10367	{
10368		p->~~rng_fault_state = true~~;
	10368	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10369	10369	return WERR_NOT_SUPPORTED;
10370	10370	}
…	…
10377	10377	struct spoolss_RouterReplyPrinter *r)
10378	10378	{
10379		p->~~rng_fault_state = true~~;
	10379	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10380	10380	return WERR_NOT_SUPPORTED;
10381	10381	}
…	…
10388	10388	struct spoolss_ReplyClosePrinter *r)
10389	10389	{
10390		p->~~rng_fault_state = true~~;
	10390	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10391	10391	return WERR_NOT_SUPPORTED;
10392	10392	}
…	…
10399	10399	struct spoolss_AddPortEx *r)
10400	10400	{
10401		p->~~rng_fault_state = true~~;
	10401	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10402	10402	return WERR_NOT_SUPPORTED;
10403	10403	}
…	…
10410	10410	struct spoolss_RouterFindFirstPrinterChangeNotification *r)
10411	10411	{
10412		p->~~rng_fault_state = true~~;
	10412	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10413	10413	return WERR_NOT_SUPPORTED;
10414	10414	}
…	…
10421	10421	struct spoolss_SpoolerInit *r)
10422	10422	{
10423		p->~~rng_fault_state = true~~;
	10423	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10424	10424	return WERR_NOT_SUPPORTED;
10425	10425	}
…	…
10432	10432	struct spoolss_ResetPrinterEx *r)
10433	10433	{
10434		p->~~rng_fault_state = true~~;
	10434	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10435	10435	return WERR_NOT_SUPPORTED;
10436	10436	}
…	…
10443	10443	struct spoolss_RouterReplyPrinterEx *r)
10444	10444	{
10445		p->~~rng_fault_state = true~~;
	10445	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10446	10446	return WERR_NOT_SUPPORTED;
10447	10447	}
…	…
10454	10454	struct spoolss_44 *r)
10455	10455	{
10456		p->~~rng_fault_state = true~~;
	10456	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10457	10457	return WERR_NOT_SUPPORTED;
10458	10458	}
…	…
10465	10465	struct spoolss_SetPort *r)
10466	10466	{
10467		p->~~rng_fault_state = true~~;
	10467	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10468	10468	return WERR_NOT_SUPPORTED;
10469	10469	}
…	…
10476	10476	struct spoolss_4a *r)
10477	10477	{
10478		p->~~rng_fault_state = true~~;
	10478	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10479	10479	return WERR_NOT_SUPPORTED;
10480	10480	}
…	…
10487	10487	struct spoolss_4b *r)
10488	10488	{
10489		p->~~rng_fault_state = true~~;
	10489	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10490	10490	return WERR_NOT_SUPPORTED;
10491	10491	}
…	…
10498	10498	struct spoolss_4c *r)
10499	10499	{
10500		p->~~rng_fault_state = true~~;
	10500	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10501	10501	return WERR_NOT_SUPPORTED;
10502	10502	}
…	…
10509	10509	struct spoolss_53 *r)
10510	10510	{
10511		p->~~rng_fault_state = true~~;
	10511	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10512	10512	return WERR_NOT_SUPPORTED;
10513	10513	}
…	…
10520	10520	struct spoolss_AddPerMachineConnection *r)
10521	10521	{
10522		p->~~rng_fault_state = true~~;
	10522	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10523	10523	return WERR_NOT_SUPPORTED;
10524	10524	}
…	…
10531	10531	struct spoolss_DeletePerMachineConnection *r)
10532	10532	{
10533		p->~~rng_fault_state = true~~;
	10533	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10534	10534	return WERR_NOT_SUPPORTED;
10535	10535	}
…	…
10542	10542	struct spoolss_EnumPerMachineConnections *r)
10543	10543	{
10544		p->~~rng_fault_state = true~~;
	10544	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10545	10545	return WERR_NOT_SUPPORTED;
10546	10546	}
…	…
10553	10553	struct spoolss_5a *r)
10554	10554	{
10555		p->~~rng_fault_state = true~~;
	10555	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10556	10556	return WERR_NOT_SUPPORTED;
10557	10557	}
…	…
10564	10564	struct spoolss_5b *r)
10565	10565	{
10566		p->~~rng_fault_state = true~~;
	10566	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10567	10567	return WERR_NOT_SUPPORTED;
10568	10568	}
…	…
10575	10575	struct spoolss_5c *r)
10576	10576	{
10577		p->~~rng_fault_state = true~~;
	10577	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10578	10578	return WERR_NOT_SUPPORTED;
10579	10579	}
…	…
10586	10586	struct spoolss_5d *r)
10587	10587	{
10588		p->~~rng_fault_state = true~~;
	10588	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10589	10589	return WERR_NOT_SUPPORTED;
10590	10590	}
…	…
10597	10597	struct spoolss_5e *r)
10598	10598	{
10599		p->~~rng_fault_state = true~~;
	10599	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10600	10600	return WERR_NOT_SUPPORTED;
10601	10601	}
…	…
10608	10608	struct spoolss_5f *r)
10609	10609	{
10610		p->~~rng_fault_state = true~~;
	10610	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10611	10611	return WERR_NOT_SUPPORTED;
10612	10612	}
…	…
10619	10619	struct spoolss_60 *r)
10620	10620	{
10621		p->~~rng_fault_state = true~~;
	10621	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10622	10622	return WERR_NOT_SUPPORTED;
10623	10623	}
…	…
10630	10630	struct spoolss_61 *r)
10631	10631	{
10632		p->~~rng_fault_state = true~~;
	10632	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10633	10633	return WERR_NOT_SUPPORTED;
10634	10634	}
…	…
10641	10641	struct spoolss_62 *r)
10642	10642	{
10643		p->~~rng_fault_state = true~~;
	10643	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10644	10644	return WERR_NOT_SUPPORTED;
10645	10645	}
…	…
10652	10652	struct spoolss_63 *r)
10653	10653	{
10654		p->~~rng_fault_state = true~~;
	10654	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10655	10655	return WERR_NOT_SUPPORTED;
10656	10656	}
…	…
10663	10663	struct spoolss_64 *r)
10664	10664	{
10665		p->~~rng_fault_state = true~~;
	10665	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10666	10666	return WERR_NOT_SUPPORTED;
10667	10667	}
…	…
10674	10674	struct spoolss_65 *r)
10675	10675	{
10676		p->~~rng_fault_state = true~~;
	10676	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10677	10677	return WERR_NOT_SUPPORTED;
10678	10678	}
…	…
10685	10685	struct spoolss_GetCorePrinterDrivers *r)
10686	10686	{
10687		p->~~rng_fault_state = true~~;
	10687	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10688	10688	return WERR_NOT_SUPPORTED;
10689	10689	}
…	…
10696	10696	struct spoolss_67 *r)
10697	10697	{
10698		p->~~rng_fault_state = true~~;
	10698	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10699	10699	return WERR_NOT_SUPPORTED;
10700	10700	}
…	…
10707	10707	struct spoolss_GetPrinterDriverPackagePath *r)
10708	10708	{
10709		p->~~rng_fault_state = true~~;
	10709	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10710	10710	return WERR_NOT_SUPPORTED;
10711	10711	}
…	…
10718	10718	struct spoolss_69 *r)
10719	10719	{
10720		p->~~rng_fault_state = true~~;
	10720	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10721	10721	return WERR_NOT_SUPPORTED;
10722	10722	}
…	…
10729	10729	struct spoolss_6a *r)
10730	10730	{
10731		p->~~rng_fault_state = true~~;
	10731	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10732	10732	return WERR_NOT_SUPPORTED;
10733	10733	}
…	…
10740	10740	struct spoolss_6b *r)
10741	10741	{
10742		p->~~rng_fault_state = true~~;
	10742	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10743	10743	return WERR_NOT_SUPPORTED;
10744	10744	}
…	…
10751	10751	struct spoolss_6c *r)
10752	10752	{
10753		p->~~rng_fault_state = true~~;
	10753	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10754	10754	return WERR_NOT_SUPPORTED;
10755	10755	}
…	…
10762	10762	struct spoolss_6d *r)
10763	10763	{
10764		p->~~rng_fault_state = true~~;
	10764	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
10765	10765	return WERR_NOT_SUPPORTED;
10766	10766	}

trunk/server/source3/rpc_server/srv_pipe.c

-              r918
+              r920
 #include "ntdomain.h"
 #include "rpc_server/srv_pipe.h"
+#include "../librpc/gen_ndr/ndr_dcerpc.h"
+#include "../librpc/ndr/ndr_dcerpc.h"
+#include "../librpc/gen_ndr/ndr_samr.h"
+#include "../librpc/gen_ndr/ndr_lsa.h"
+#include "../librpc/gen_ndr/ndr_netlogon.h"
+#include "../librpc/gen_ndr/ndr_epmapper.h"
+#include "../librpc/gen_ndr/ndr_echo.h"
 #undef DBGC_CLASS
 …
          */
         if (p->fault_state) {
                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
+                setup_fault_pdu(p, NT_STATUS(p->fault_state));
                 return true;
+        }
 …
         p->out_data.current_pdu_sent = 0;
+        set_incoming_fault(p);
         TALLOC_FREE(p->auth.auth_ctx);
         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
         p->pipe_bound = False;
+        p->allow_bind = false;
+        p->allow_alter = false;
+        p->allow_auth3 = false;
         return True;
 …
+{
         struct pipe_rpc_fns *context_fns;
+        const char *interface_name = NULL;
+        bool ok;
         DEBUG(3,("check_bind_req for %s\n",
+                 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
+                 get_pipe_name_from_syntax(talloc_tos(), abstract)));
+        ok = ndr_syntax_id_equal(transfer, &ndr_transfer_syntax);
+        if (!ok) {
+                DEBUG(1,("check_bind_req unknown transfer syntax for "
+                         "%s context_id=%u\n",
+                         get_pipe_name_from_syntax(talloc_tos(), abstract),
+                         (unsigned)context_id));
+                return false;
+        }
+        for (context_fns = p->contexts;
+             context_fns != NULL;
+             context_fns = context_fns->next)
+        {
+                if (context_fns->context_id != context_id) {
+                        continue;
+                }
+                ok = ndr_syntax_id_equal(&context_fns->syntax,
+                                         abstract);
+                if (ok) {
+                        return true;
+                }
+                DEBUG(1,("check_bind_req: changing abstract syntax for "
+                         "%s context_id=%u into %s not supported\n",
+                         get_pipe_name_from_syntax(talloc_tos(), &context_fns->syntax),
+                         (unsigned)context_id,
+                         get_pipe_name_from_syntax(talloc_tos(), abstract)));
+                return false;
+        }
         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
+        if (rpc_srv_pipe_exists_by_id(abstract) &&
+           ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
+                DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
+                        rpc_srv_get_pipe_cli_name(abstract),
+                        rpc_srv_get_pipe_srv_name(abstract)));
+        } else {
+        if (!rpc_srv_pipe_exists_by_id(abstract)) {
                 return false;
+        }
+        DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
+                  rpc_srv_get_pipe_cli_name(abstract),
+                  rpc_srv_get_pipe_srv_name(abstract)));
         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 …
+        }
+        interface_name = get_pipe_name_from_syntax(talloc_tos(),
+                                                   abstract);
+        SMB_ASSERT(interface_name != NULL);
         context_fns->next = context_fns->prev = NULL;
         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
         context_fns->context_id = context_id;
+        context_fns->syntax = *abstract;
+        context_fns->allow_connect = lp_allow_dcerpc_auth_level_connect();
+        /*
+         * for the samr and the lsarpc interfaces we don't allow "connect"
+         * auth_level by default.
+         */
+        ok = ndr_syntax_id_equal(abstract, &ndr_table_samr.syntax_id);
+        if (ok) {
+                context_fns->allow_connect = false;
+        }
+        ok = ndr_syntax_id_equal(abstract, &ndr_table_lsarpc.syntax_id);
+        if (ok) {
+                context_fns->allow_connect = false;
+        }
+        ok = ndr_syntax_id_equal(abstract, &ndr_table_netlogon.syntax_id);
+        if (ok) {
+                context_fns->allow_connect = false;
+        }
+        /*
+         * for the epmapper and echo interfaces we allow "connect"
+         * auth_level by default.
+         */
+        ok = ndr_syntax_id_equal(abstract, &ndr_table_epmapper.syntax_id);
+        if (ok) {
+                context_fns->allow_connect = true;
+        }
+        ok = ndr_syntax_id_equal(abstract, &ndr_table_rpcecho.syntax_id);
+        if (ok) {
+                context_fns->allow_connect = true;
+        }
+        /*
+         * every interface can be modified to allow "connect" auth_level by
+         * using a parametric option like:
+         * allow dcerpc auth level connect:<interface>
+         * e.g.
+         * allow dcerpc auth level connect:samr = yes
+         */
+        context_fns->allow_connect = lp_parm_bool(-1,
+                "allow dcerpc auth level connect",
+                interface_name, context_fns->allow_connect);
         /* add to the list of open contexts */
 …
         p->auth.auth_ctx = spnego_ctx;
         p->auth.auth_type = DCERPC_AUTH_TYPE_SPNEGO;
+        p->auth.auth_context_id = auth_info->auth_context_id;
         DEBUG(10, ("SPNEGO auth started\n"));
 …
         p->auth.auth_ctx = schannel_auth;
         p->auth.auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
+        p->auth.auth_context_id = auth_info->auth_context_id;
         p->pipe_bound = True;
 …
         p->auth.auth_ctx = ntlmssp_state;
         p->auth.auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
+        p->auth.auth_context_id = auth_info->auth_context_id;
         DEBUG(10, (__location__ ": NTLMSSP auth started\n"));
 …
         void *mech_ctx;
         NTSTATUS status;
+        if (p->auth.auth_type == DCERPC_AUTH_TYPE_NONE) {
+                p->pipe_bound = true;
+                return NT_STATUS_OK;
+        }
         switch (p->auth.auth_type) {
 …
         DATA_BLOB auth_blob = data_blob_null;
+        /* No rebinds on a bound pipe - use alter context. */
+        if (p->pipe_bound) {
+                DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
+                         "pipe %s.\n",
+                         get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
+        if (!p->allow_bind) {
+                DEBUG(2,("Pipe not in allow bind state\n"));
                 return setup_bind_nak(p, pkt);
+        }
+        p->allow_bind = false;
+        status = dcerpc_verify_ncacn_packet_header(pkt,
+                        DCERPC_PKT_BIND,
+                        pkt->u.bind.auth_info.length,
+, /* required flags */
+                        DCERPC_PFC_FLAG_FIRST |
+                        DCERPC_PFC_FLAG_LAST |
+                        DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
+x08 | /* this is not defined, but should be ignored */
+                        DCERPC_PFC_FLAG_CONC_MPX |
+                        DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
+                        DCERPC_PFC_FLAG_MAYBE |
+                        DCERPC_PFC_FLAG_OBJECT_UUID);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("api_pipe_bind_req: invalid pdu: %s\n",
+                          nt_errstr(status)));
+                NDR_PRINT_DEBUG(ncacn_packet, pkt);
+                goto err_exit;
+        }
         if (pkt->u.bind.num_contexts == 0) {
+                DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
+                DEBUG(1, ("api_pipe_bind_req: no rpc contexts around\n"));
+                goto err_exit;
+        }
+        if (pkt->u.bind.ctx_list[0].num_transfer_syntaxes == 0) {
+                DEBUG(1, ("api_pipe_bind_req: no transfer syntaxes around\n"));
                 goto err_exit;
+        }
 …
          */
         if (pkt->auth_length) {
-                /* Quick length check. Won't catch a bad auth footer,
-                 * prevents overrun. */
-                if (pkt->frag_length < RPC_HEADER_LEN +
-                                        DCERPC_AUTH_TRAILER_LENGTH +
-                                        pkt->auth_length) {
-                        DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
-                                "too long for fragment %u.\n",
-                                (unsigned int)pkt->auth_length,
-                                (unsigned int)pkt->frag_length));
-                        goto err_exit;
+                }
                 /*
                  * Decode the authentication verifier.
                  */
                 status = dcerpc_pull_dcerpc_auth(pkt,
                                                  &pkt->u.bind.auth_info,
                                                  &auth_info, p->endian);
+                status = dcerpc_pull_auth_trailer(pkt, pkt,
+                                                  &pkt->u.bind.auth_info,
+                                                  &auth_info, NULL, true);
                 if (!NT_STATUS_IS_OK(status)) {
                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
 …
                 /* The session key was initialized from the SMB
                  * session in make_internal_rpc_pipe_p */
+                p->auth.auth_context_id = 0;
+        }
 …
                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
                           nt_errstr(status)));
+                goto err_exit;
+        }
         if (auth_resp.length) {
                 status = dcerpc_push_dcerpc_auth(pkt,
                                                  auth_type,
                                                  auth_info.auth_level,
 ,
 , /* auth_context_id */
+, /* pad_len */
+                                                 p->auth.auth_context_id,
                                                  &auth_resp,
                                                  &auth_blob);
 …
         TALLOC_FREE(auth_blob.data);
+        if (bind_ack_ctx.result == 0) {
+                p->allow_alter = true;
+                p->allow_auth3 = true;
+                if (p->auth.auth_type == DCERPC_AUTH_TYPE_NONE) {
+                        status = pipe_auth_verify_final(p);
+                        if (!NT_STATUS_IS_OK(status)) {
+                                DEBUG(0, ("pipe_auth_verify_final failed: %s\n",
+                                          nt_errstr(status)));
+                                goto err_exit;
+                        }
+                }
+        } else {
+                goto err_exit;
+        }
         return True;
 …
         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
+        if (!p->allow_auth3) {
+                DEBUG(1, ("Pipe not in allow auth3 state.\n"));
+                goto err;
+        }
+        status = dcerpc_verify_ncacn_packet_header(pkt,
+                        DCERPC_PKT_AUTH3,
+                        pkt->u.auth3.auth_info.length,
+, /* required flags */
+                        DCERPC_PFC_FLAG_FIRST |
+                        DCERPC_PFC_FLAG_LAST |
+                        DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
+x08 | /* this is not defined, but should be ignored */
+                        DCERPC_PFC_FLAG_CONC_MPX |
+                        DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
+                        DCERPC_PFC_FLAG_MAYBE |
+                        DCERPC_PFC_FLAG_OBJECT_UUID);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("api_pipe_bind_auth3: invalid pdu: %s\n",
+                          nt_errstr(status)));
+                NDR_PRINT_DEBUG(ncacn_packet, pkt);
+                goto err;
+        }
+        /* We can only finish if the pipe is unbound for now */
+        if (p->pipe_bound) {
+                DEBUG(0, (__location__ ": Pipe already bound, "
+                          "AUTH3 not supported!\n"));
+                goto err;
+        }
         if (pkt->auth_length == 0) {
                 DEBUG(0, ("No auth field sent for bind request!\n"));
+                DEBUG(1, ("No auth field sent for auth3 request!\n"));
                 goto err;
+        }
-        /* Ensure there's enough data for an authenticated request. */
-        if (pkt->frag_length < RPC_HEADER_LEN
-                                + DCERPC_AUTH_TRAILER_LENGTH
-                                + pkt->auth_length) {
-                        DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
-                                "%u is too large.\n",
-                        (unsigned int)pkt->auth_length));
-                goto err;
+        }
         /*
          * Decode the authentication verifier response.
          */
         status = dcerpc_pull_dcerpc_auth(pkt,
                                          &pkt->u.auth3.auth_info,
                                          &auth_info, p->endian);
+        status = dcerpc_pull_auth_trailer(pkt, pkt,
+                                          &pkt->u.auth3.auth_info,
+                                          &auth_info, NULL, true);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
 …
                           "but auth was started as type %d!\n",
                           auth_info.auth_type, p->auth.auth_type));
+                goto err;
+        }
+        if (auth_info.auth_level != p->auth.auth_level) {
+                DEBUG(1, ("Auth level mismatch! Client sent %d, "
+                          "but auth was started as level %d!\n",
+                          auth_info.auth_level, p->auth.auth_level));
+                goto err;
+        }
+        if (auth_info.auth_context_id != p->auth.auth_context_id) {
+                DEBUG(0, ("Auth context id mismatch! Client sent %u, "
+                          "but auth was started as level %u!\n",
+                          (unsigned)auth_info.auth_context_id,
+                          (unsigned)p->auth.auth_context_id));
                 goto err;
+        }
 …
 err:
+        p->pipe_bound = false;
+        p->allow_bind = false;
+        p->allow_alter = false;
+        p->allow_auth3 = false;
         TALLOC_FREE(p->auth.auth_ctx);
 …
         NTSTATUS status;
         union dcerpc_payload u;
         struct dcerpc_ack_ctx bind_ack_ctx;
+        struct dcerpc_ack_ctx alter_ack_ctx;
         DATA_BLOB auth_resp = data_blob_null;
         DATA_BLOB auth_blob = data_blob_null;
 …
         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
+        if (pkt->u.bind.assoc_group_id != 0) {
+                assoc_gid = pkt->u.bind.assoc_group_id;
+        if (!p->allow_alter) {
+                DEBUG(1, ("Pipe not in allow alter state.\n"));
+                goto err_exit;
+        }
+        status = dcerpc_verify_ncacn_packet_header(pkt,
+                        DCERPC_PKT_ALTER,
+                        pkt->u.alter.auth_info.length,
+, /* required flags */
+                        DCERPC_PFC_FLAG_FIRST |
+                        DCERPC_PFC_FLAG_LAST |
+                        DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
+x08 | /* this is not defined, but should be ignored */
+                        DCERPC_PFC_FLAG_CONC_MPX |
+                        DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
+                        DCERPC_PFC_FLAG_MAYBE |
+                        DCERPC_PFC_FLAG_OBJECT_UUID);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("api_pipe_alter_context: invalid pdu: %s\n",
+                          nt_errstr(status)));
+                NDR_PRINT_DEBUG(ncacn_packet, pkt);
+                goto err_exit;
+        }
+        if (pkt->u.alter.num_contexts == 0) {
+                DEBUG(1, ("api_pipe_alter_context: no rpc contexts around\n"));
+                goto err_exit;
+        }
+        if (pkt->u.alter.ctx_list[0].num_transfer_syntaxes == 0) {
+                DEBUG(1, ("api_pipe_alter_context: no transfer syntaxes around\n"));
+                goto err_exit;
+        }
+        if (pkt->u.alter.assoc_group_id != 0) {
+                assoc_gid = pkt->u.alter.assoc_group_id;
         } else {
                 assoc_gid = 0x53f0;
 …
         /* If the requested abstract synt uuid doesn't match our client pipe,
                 reject the bind_ack & set the transfer interface synt to all 0's,
+                reject the alter_ack & set the transfer interface synt to all 0's,
                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
                 unknown to NT4)
 …
         if (check_bind_req(p,
                         &pkt->u.bind.ctx_list[0].abstract_syntax,
                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
                         pkt->u.bind.ctx_list[0].context_id)) {
                 bind_ack_ctx.result = 0;
                 bind_ack_ctx.reason = 0;
                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
+                        &pkt->u.alter.ctx_list[0].abstract_syntax,
+                        &pkt->u.alter.ctx_list[0].transfer_syntaxes[0],
+                        pkt->u.alter.ctx_list[0].context_id)) {
+                alter_ack_ctx.result = 0;
+                alter_ack_ctx.reason = 0;
+                alter_ack_ctx.syntax = pkt->u.alter.ctx_list[0].transfer_syntaxes[0];
         } else {
-                p->pipe_bound = False;
                 /* Rejection reason: abstract syntax not supported */
                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
                 bind_ack_ctx.syntax = null_ndr_syntax_id;
+                alter_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
+                alter_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
+                alter_ack_ctx.syntax = null_ndr_syntax_id;
+        }
 …
          */
         if (pkt->auth_length) {
-                /* Quick length check. Won't catch a bad auth footer,
-                 * prevents overrun. */
-                if (pkt->frag_length < RPC_HEADER_LEN +
-                                        DCERPC_AUTH_TRAILER_LENGTH +
-                                        pkt->auth_length) {
-                        DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
-                                "too long for fragment %u.\n",
-                                (unsigned int)pkt->auth_length,
-                                (unsigned int)pkt->frag_length ));
-                        goto err_exit;
+                }
-                status = dcerpc_pull_dcerpc_auth(pkt,
-                                                 &pkt->u.bind.auth_info,
-                                                 &auth_info, p->endian);
-                if (!NT_STATUS_IS_OK(status)) {
-                        DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
-                        goto err_exit;
+                }
                 /* We can only finish if the pipe is unbound for now */
                 if (p->pipe_bound) {
 …
+                }
+                status = dcerpc_pull_auth_trailer(pkt, pkt,
+                                                  &pkt->u.alter.auth_info,
+                                                  &auth_info, NULL, true);
+                if (!NT_STATUS_IS_OK(status)) {
+                        DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
+                        goto err_exit;
+                }
                 if (auth_info.auth_type != p->auth.auth_type) {
                         DEBUG(0, ("Auth type mismatch! Client sent %d, "
 …
+                }
+                if (auth_info.auth_level != p->auth.auth_level) {
+                        DEBUG(0, ("Auth level mismatch! Client sent %d, "
+                                  "but auth was started as level %d!\n",
+                                  auth_info.auth_level, p->auth.auth_level));
+                        goto err_exit;
+                }
+                if (auth_info.auth_context_id != p->auth.auth_context_id) {
+                        DEBUG(0, ("Auth context id mismatch! Client sent %u, "
+                                  "but auth was started as level %u!\n",
+                                  (unsigned)auth_info.auth_context_id,
+                                  (unsigned)p->auth.auth_context_id));
+                        goto err_exit;
+                }
                 switch (auth_info.auth_type) {
 …
         u.alter_resp.num_results = 1;
         u.alter_resp.ctx_list = &bind_ack_ctx;
+        u.alter_resp.ctx_list = &alter_ack_ctx;
         /* NOTE: We leave the auth_info empty so we can calculate the padding
 …
                                           &p->out_data.frag);
         if (!NT_STATUS_IS_OK(status)) {
                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
+                DEBUG(0, ("Failed to marshall alter_resp packet. (%s)\n",
                           nt_errstr(status)));
+                goto err_exit;
+        }
 …
                                                  auth_info.auth_level,
                                                  pad_len,
 , /* auth_context_id */
+                                                 p->auth.auth_context_id,
                                                  &auth_resp,
                                                  &auth_blob);
 …
 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
+                       const struct api_struct *api_rpc_cmds, int n_cmds);
+                       const struct api_struct *api_rpc_cmds, int n_cmds,
+                       const struct ndr_syntax_id *syntax);
+static bool srv_pipe_check_verification_trailer(struct pipes_struct *p,
+                                                struct ncacn_packet *pkt,
+                                                struct pipe_rpc_fns *pipe_fns)
+{
+        TALLOC_CTX *frame = talloc_stackframe();
+        struct dcerpc_sec_verification_trailer *vt = NULL;
+        const uint32_t bitmask1 = 0;
+        const struct dcerpc_sec_vt_pcontext pcontext = {
+                .abstract_syntax = pipe_fns->syntax,
+                .transfer_syntax = ndr_transfer_syntax,
+        };
+        const struct dcerpc_sec_vt_header2 header2 =
+               dcerpc_sec_vt_header2_from_ncacn_packet(pkt);
+        struct ndr_pull *ndr;
+        enum ndr_err_code ndr_err;
+        bool ret = false;
+        ndr = ndr_pull_init_blob(&p->in_data.data, frame);
+        if (ndr == NULL) {
+                goto done;
+        }
+        ndr_err = ndr_pop_dcerpc_sec_verification_trailer(ndr, frame, &vt);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                goto done;
+        }
+        ret = dcerpc_sec_verification_trailer_check(vt, &bitmask1,
+                                                    &pcontext, &header2);
+done:
+        TALLOC_FREE(frame);
+        return ret;
+}
 /****************************************************************************
 …
                                 struct ncacn_packet *pkt)
+{
+        TALLOC_CTX *frame = talloc_stackframe();
         bool ret = False;
-        bool changed_user = False;
         PIPE_RPC_FNS *pipe_fns;
+        if (p->pipe_bound &&
+            ((p->auth.auth_type == DCERPC_AUTH_TYPE_NTLMSSP) ||
+             (p->auth.auth_type == DCERPC_AUTH_TYPE_KRB5) ||
+             (p->auth.auth_type == DCERPC_AUTH_TYPE_SPNEGO))) {
+                if(!become_authenticated_pipe_user(p->session_info)) {
+                        data_blob_free(&p->out_data.rdata);
+                        return False;
+                }
+                changed_user = True;
+        }
+        DEBUG(5, ("Requested \\PIPE\\%s\n",
+                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
+        const char *interface_name = NULL;
+        if (!p->pipe_bound) {
+                DEBUG(1, ("Pipe not bound!\n"));
+                data_blob_free(&p->out_data.rdata);
+                TALLOC_FREE(frame);
+                return false;
+        }
         /* get the set of RPC functions for this context */
 …
         pipe_fns = find_pipe_fns_by_context(p->contexts,
                                             pkt->u.request.context_id);
+        if ( pipe_fns ) {
+                TALLOC_CTX *frame = talloc_stackframe();
+                ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds);
+        if (pipe_fns == NULL) {
+                DEBUG(0, ("No rpc function table associated with context "
+                          "[%d]\n",
+                          pkt->u.request.context_id));
+                data_blob_free(&p->out_data.rdata);
                 TALLOC_FREE(frame);
+        }
+        else {
+                DEBUG(0, ("No rpc function table associated with context "
+                          "[%d] on pipe [%s]\n",
+                          pkt->u.request.context_id,
+                          get_pipe_name_from_syntax(talloc_tos(),
+                                                    &p->syntax)));
+        }
+        if (changed_user) {
+                unbecome_authenticated_pipe_user();
+        }
+                return false;
+        }
+        interface_name = get_pipe_name_from_syntax(talloc_tos(),
+                                                   &pipe_fns->syntax);
+        SMB_ASSERT(interface_name != NULL);
+        DEBUG(5, ("Requested \\PIPE\\%s\n",
+                  interface_name));
+        switch (p->auth.auth_level) {
+        case DCERPC_AUTH_LEVEL_NONE:
+        case DCERPC_AUTH_LEVEL_INTEGRITY:
+        case DCERPC_AUTH_LEVEL_PRIVACY:
+                break;
+        default:
+                if (!pipe_fns->allow_connect) {
+                        DEBUG(1, ("%s: restrict auth_level_connect access "
+                                  "to [%s] with auth[type=0x%x,level=0x%x] "
+                                  "on [%s] from [%s]\n",
+                                  __func__, interface_name,
+                                  p->auth.auth_type,
+                                  p->auth.auth_level,
+                                  derpc_transport_string_by_transport(p->transport),
+                                  p->client_id->name));
+                        setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_ACCESS_DENIED));
+                        TALLOC_FREE(frame);
+                        return true;
+                }
+                break;
+        }
+        if (!srv_pipe_check_verification_trailer(p, pkt, pipe_fns)) {
+                DEBUG(1, ("srv_pipe_check_verification_trailer: failed\n"));
+                set_incoming_fault(p);
+                setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_ACCESS_DENIED));
+                data_blob_free(&p->out_data.rdata);
+                TALLOC_FREE(frame);
+                return true;
+        }
+        if (!become_authenticated_pipe_user(p->session_info)) {
+                DEBUG(1, ("Failed to become pipe user!\n"));
+                data_blob_free(&p->out_data.rdata);
+                TALLOC_FREE(frame);
+                return false;
+        }
+        ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds,
+                         &pipe_fns->syntax);
+        unbecome_authenticated_pipe_user();
+        TALLOC_FREE(frame);
         return ret;
+}
 …
 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
+                       const struct api_struct *api_rpc_cmds, int n_cmds)
+                       const struct api_struct *api_rpc_cmds, int n_cmds,
+                       const struct ndr_syntax_id *syntax)
+{
         int fn_num;
 …
         /* interpret the command */
         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
+                 get_pipe_name_from_syntax(talloc_tos(), syntax),
                  pkt->u.request.opnum));
 …
                 fstring name;
                 slprintf(name, sizeof(name)-1, "in_%s",
                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
+                         get_pipe_name_from_syntax(talloc_tos(), syntax));
                 dump_pdu_region(name, pkt->u.request.opnum,
                                 &p->in_data.data, 0,
 …
         if(!api_rpc_cmds[fn_num].fn(p)) {
                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
+                         get_pipe_name_from_syntax(talloc_tos(), syntax),
                          api_rpc_cmds[fn_num].name));
                 data_blob_free(&p->out_data.rdata);
 …
+        }
+        if (p->bad_handle_fault_state) {
+                DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
+                p->bad_handle_fault_state = False;
+                setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
+                return True;
+        }
+        if (p->rng_fault_state) {
+                DEBUG(4, ("api_rpcTNP: rng fault return\n"));
+                p->rng_fault_state = False;
+                setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
+                return True;
+        if (p->fault_state) {
+                DEBUG(4,("api_rpcTNP: fault(%d) return.\n", p->fault_state));
+                setup_fault_pdu(p, NT_STATUS(p->fault_state));
+                p->fault_state = 0;
+                return true;
+        }
 …
                 fstring name;
                 slprintf(name, sizeof(name)-1, "out_%s",
                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
+                         get_pipe_name_from_syntax(talloc_tos(), syntax));
                 dump_pdu_region(name, pkt->u.request.opnum,
                                 &p->out_data.rdata, offset1,
 …
         DEBUG(5,("api_rpcTNP: called %s successfully\n",
                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
+                 get_pipe_name_from_syntax(talloc_tos(), syntax)));
         /* Check for buffer underflow in rpc parsing */
 …
         p->in_data.pdu_needed_len = 0;
         p->in_data.pdu.length = 0;
+        p->fault_state = True;
+        DEBUG(10, ("set_incoming_fault: Setting fault state on pipe %s\n",
+                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
+        p->fault_state = DCERPC_NCA_S_PROTO_ERROR;
+        p->allow_alter = false;
+        p->allow_auth3 = false;
+        p->pipe_bound = false;
+        DEBUG(10, ("Setting fault state\n"));
+}
 …
         NTSTATUS status;
         size_t hdr_size = DCERPC_REQUEST_LENGTH;
-        size_t pad_len;
         DEBUG(10, ("Checking request auth.\n"));
 …
         status = dcerpc_check_auth(auth, pkt,
                                    &pkt->u.request.stub_and_verifier,
+                                   hdr_size, raw_pkt,
+                                   &pad_len);
+                                   hdr_size, raw_pkt);
         if (!NT_STATUS_IS_OK(status)) {
                 return status;
+        }
-        /* remove padding and auth trailer,
-         * this way the caller will get just the data */
-        if (pkt->auth_length) {
-                size_t trail_len = pad_len
-                                        + DCERPC_AUTH_TRAILER_LENGTH
-                                        + pkt->auth_length;
-                if (pkt->u.request.stub_and_verifier.length < trail_len) {
-                        return NT_STATUS_INFO_LENGTH_MISMATCH;
+                }
-                pkt->u.request.stub_and_verifier.length -= trail_len;
+        }
 …
                 set_incoming_fault(p);
                 return False;
+        }
+        /*
+         * We don't ignore DCERPC_PFC_FLAG_PENDING_CANCEL.
+         * TODO: we can reject it with DCERPC_FAULT_NO_CALL_ACTIVE later.
+         */
+        status = dcerpc_verify_ncacn_packet_header(pkt,
+                        DCERPC_PKT_REQUEST,
+                        pkt->u.request.stub_and_verifier.length,
+, /* required_flags */
+                        DCERPC_PFC_FLAG_FIRST |
+                        DCERPC_PFC_FLAG_LAST |
+x08 | /* this is not defined, but should be ignored */
+                        DCERPC_PFC_FLAG_CONC_MPX |
+                        DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
+                        DCERPC_PFC_FLAG_MAYBE |
+                        DCERPC_PFC_FLAG_OBJECT_UUID);
+        if (!NT_STATUS_IS_OK(status)) {
+                DEBUG(1, ("process_request_pdu: invalid pdu: %s\n",
+                          nt_errstr(status)));
+                NDR_PRINT_DEBUG(ncacn_packet, pkt);
+                set_incoming_fault(p);
+                return false;
+        }
 …
                                                                 &p->syntax)));
                 set_incoming_fault(p);
                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
+                setup_fault_pdu(p, NT_STATUS(DCERPC_NCA_S_PROTO_ERROR));
                 TALLOC_FREE(pkt);
         } else {

trunk/server/source3/rpc_server/srvsvc/srv_srvsvc_nt.c

r918	r920
2549	2549	struct srvsvc_NetCharDevEnum *r)
2550	2550	{
2551		p->~~rng_fault_state = True~~;
	2551	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2552	2552	return WERR_NOT_SUPPORTED;
2553	2553	}
…	…
2556	2556	struct srvsvc_NetCharDevGetInfo *r)
2557	2557	{
2558		p->~~rng_fault_state = True~~;
	2558	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2559	2559	return WERR_NOT_SUPPORTED;
2560	2560	}
…	…
2563	2563	struct srvsvc_NetCharDevControl *r)
2564	2564	{
2565		p->~~rng_fault_state = True~~;
	2565	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2566	2566	return WERR_NOT_SUPPORTED;
2567	2567	}
…	…
2570	2570	struct srvsvc_NetCharDevQEnum *r)
2571	2571	{
2572		p->~~rng_fault_state = True~~;
	2572	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2573	2573	return WERR_NOT_SUPPORTED;
2574	2574	}
…	…
2577	2577	struct srvsvc_NetCharDevQGetInfo *r)
2578	2578	{
2579		p->~~rng_fault_state = True~~;
	2579	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2580	2580	return WERR_NOT_SUPPORTED;
2581	2581	}
…	…
2584	2584	struct srvsvc_NetCharDevQSetInfo *r)
2585	2585	{
2586		p->~~rng_fault_state = True~~;
	2586	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2587	2587	return WERR_NOT_SUPPORTED;
2588	2588	}
…	…
2591	2591	struct srvsvc_NetCharDevQPurge *r)
2592	2592	{
2593		p->~~rng_fault_state = True~~;
	2593	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2594	2594	return WERR_NOT_SUPPORTED;
2595	2595	}
…	…
2598	2598	struct srvsvc_NetCharDevQPurgeSelf *r)
2599	2599	{
2600		p->~~rng_fault_state = True~~;
	2600	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2601	2601	return WERR_NOT_SUPPORTED;
2602	2602	}
…	…
2605	2605	struct srvsvc_NetFileGetInfo *r)
2606	2606	{
2607		p->~~rng_fault_state = True~~;
	2607	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2608	2608	return WERR_NOT_SUPPORTED;
2609	2609	}
…	…
2612	2612	struct srvsvc_NetShareCheck *r)
2613	2613	{
2614		p->~~rng_fault_state = True~~;
	2614	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2615	2615	return WERR_NOT_SUPPORTED;
2616	2616	}
…	…
2619	2619	struct srvsvc_NetServerStatisticsGet *r)
2620	2620	{
2621		p->~~rng_fault_state = True~~;
	2621	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2622	2622	return WERR_NOT_SUPPORTED;
2623	2623	}
…	…
2626	2626	struct srvsvc_NetTransportAdd *r)
2627	2627	{
2628		p->~~rng_fault_state = True~~;
	2628	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2629	2629	return WERR_NOT_SUPPORTED;
2630	2630	}
…	…
2633	2633	struct srvsvc_NetTransportEnum *r)
2634	2634	{
2635		p->~~rng_fault_state = True~~;
	2635	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2636	2636	return WERR_NOT_SUPPORTED;
2637	2637	}
…	…
2640	2640	struct srvsvc_NetTransportDel *r)
2641	2641	{
2642		p->~~rng_fault_state = True~~;
	2642	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2643	2643	return WERR_NOT_SUPPORTED;
2644	2644	}
…	…
2647	2647	struct srvsvc_NetSetServiceBits *r)
2648	2648	{
2649		p->~~rng_fault_state = True~~;
	2649	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2650	2650	return WERR_NOT_SUPPORTED;
2651	2651	}
…	…
2654	2654	struct srvsvc_NetPathType *r)
2655	2655	{
2656		p->~~rng_fault_state = True~~;
	2656	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2657	2657	return WERR_NOT_SUPPORTED;
2658	2658	}
…	…
2661	2661	struct srvsvc_NetPathCanonicalize *r)
2662	2662	{
2663		p->~~rng_fault_state = True~~;
	2663	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2664	2664	return WERR_NOT_SUPPORTED;
2665	2665	}
…	…
2668	2668	struct srvsvc_NetPathCompare *r)
2669	2669	{
2670		p->~~rng_fault_state = True~~;
	2670	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2671	2671	return WERR_NOT_SUPPORTED;
2672	2672	}
…	…
2675	2675	struct srvsvc_NETRPRNAMECANONICALIZE *r)
2676	2676	{
2677		p->~~rng_fault_state = True~~;
	2677	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2678	2678	return WERR_NOT_SUPPORTED;
2679	2679	}
…	…
2682	2682	struct srvsvc_NetPRNameCompare *r)
2683	2683	{
2684		p->~~rng_fault_state = True~~;
	2684	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2685	2685	return WERR_NOT_SUPPORTED;
2686	2686	}
…	…
2689	2689	struct srvsvc_NetShareDelStart *r)
2690	2690	{
2691		p->~~rng_fault_state = True~~;
	2691	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2692	2692	return WERR_NOT_SUPPORTED;
2693	2693	}
…	…
2696	2696	struct srvsvc_NetShareDelCommit *r)
2697	2697	{
2698		p->~~rng_fault_state = True~~;
	2698	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2699	2699	return WERR_NOT_SUPPORTED;
2700	2700	}
…	…
2703	2703	struct srvsvc_NetServerTransportAddEx *r)
2704	2704	{
2705		p->~~rng_fault_state = True~~;
	2705	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2706	2706	return WERR_NOT_SUPPORTED;
2707	2707	}
…	…
2710	2710	struct srvsvc_NetServerSetServiceBitsEx *r)
2711	2711	{
2712		p->~~rng_fault_state = True~~;
	2712	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2713	2713	return WERR_NOT_SUPPORTED;
2714	2714	}
…	…
2717	2717	struct srvsvc_NETRDFSGETVERSION *r)
2718	2718	{
2719		p->~~rng_fault_state = True~~;
	2719	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2720	2720	return WERR_NOT_SUPPORTED;
2721	2721	}
…	…
2724	2724	struct srvsvc_NETRDFSCREATELOCALPARTITION *r)
2725	2725	{
2726		p->~~rng_fault_state = True~~;
	2726	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2727	2727	return WERR_NOT_SUPPORTED;
2728	2728	}
…	…
2731	2731	struct srvsvc_NETRDFSDELETELOCALPARTITION *r)
2732	2732	{
2733		p->~~rng_fault_state = True~~;
	2733	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2734	2734	return WERR_NOT_SUPPORTED;
2735	2735	}
…	…
2738	2738	struct srvsvc_NETRDFSSETLOCALVOLUMESTATE *r)
2739	2739	{
2740		p->~~rng_fault_state = True~~;
	2740	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2741	2741	return WERR_NOT_SUPPORTED;
2742	2742	}
…	…
2745	2745	struct srvsvc_NETRDFSSETSERVERINFO *r)
2746	2746	{
2747		p->~~rng_fault_state = True~~;
	2747	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2748	2748	return WERR_NOT_SUPPORTED;
2749	2749	}
…	…
2752	2752	struct srvsvc_NETRDFSCREATEEXITPOINT *r)
2753	2753	{
2754		p->~~rng_fault_state = True~~;
	2754	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2755	2755	return WERR_NOT_SUPPORTED;
2756	2756	}
…	…
2759	2759	struct srvsvc_NETRDFSDELETEEXITPOINT *r)
2760	2760	{
2761		p->~~rng_fault_state = True~~;
	2761	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2762	2762	return WERR_NOT_SUPPORTED;
2763	2763	}
…	…
2766	2766	struct srvsvc_NETRDFSMODIFYPREFIX *r)
2767	2767	{
2768		p->~~rng_fault_state = True~~;
	2768	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2769	2769	return WERR_NOT_SUPPORTED;
2770	2770	}
…	…
2773	2773	struct srvsvc_NETRDFSFIXLOCALVOLUME *r)
2774	2774	{
2775		p->~~rng_fault_state = True~~;
	2775	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2776	2776	return WERR_NOT_SUPPORTED;
2777	2777	}
…	…
2780	2780	struct srvsvc_NETRDFSMANAGERREPORTSITEINFO *r)
2781	2781	{
2782		p->~~rng_fault_state = True~~;
	2782	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
2783	2783	return WERR_NOT_SUPPORTED;
2784	2784	}
…	…
2787	2787	struct srvsvc_NETRSERVERTRANSPORTDELEX *r)
2788	2788	{
2789		p->~~rng_fault_state = True~~;
2790		return WERR_NOT_SUPPORTED;
2791		}
	2789	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
	2790	return WERR_NOT_SUPPORTED;
	2791	}

trunk/server/source3/rpc_server/svcctl/srv_svcctl_nt.c

r918	r920
1005	1005	struct svcctl_DeleteService *r)
1006	1006	{
1007		p->~~rng_fault_state = True~~;
	1007	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1008	1008	return WERR_NOT_SUPPORTED;
1009	1009	}
…	…
1012	1012	struct svcctl_SetServiceStatus *r)
1013	1013	{
1014		p->~~rng_fault_state = True~~;
	1014	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1015	1015	return WERR_NOT_SUPPORTED;
1016	1016	}
…	…
1019	1019	struct svcctl_NotifyBootConfigStatus *r)
1020	1020	{
1021		p->~~rng_fault_state = True~~;
	1021	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1022	1022	return WERR_NOT_SUPPORTED;
1023	1023	}
…	…
1026	1026	struct svcctl_SCSetServiceBitsW *r)
1027	1027	{
1028		p->~~rng_fault_state = True~~;
	1028	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1029	1029	return WERR_NOT_SUPPORTED;
1030	1030	}
…	…
1033	1033	struct svcctl_ChangeServiceConfigW *r)
1034	1034	{
1035		p->~~rng_fault_state = True~~;
	1035	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1036	1036	return WERR_NOT_SUPPORTED;
1037	1037	}
…	…
1040	1040	struct svcctl_CreateServiceW *r)
1041	1041	{
1042		p->~~rng_fault_state = True~~;
	1042	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1043	1043	return WERR_NOT_SUPPORTED;
1044	1044	}
…	…
1047	1047	struct svcctl_QueryServiceLockStatusW *r)
1048	1048	{
1049		p->~~rng_fault_state = True~~;
	1049	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1050	1050	return WERR_NOT_SUPPORTED;
1051	1051	}
…	…
1054	1054	struct svcctl_GetServiceKeyNameW *r)
1055	1055	{
1056		p->~~rng_fault_state = True~~;
	1056	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1057	1057	return WERR_NOT_SUPPORTED;
1058	1058	}
…	…
1061	1061	struct svcctl_SCSetServiceBitsA *r)
1062	1062	{
1063		p->~~rng_fault_state = True~~;
	1063	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1064	1064	return WERR_NOT_SUPPORTED;
1065	1065	}
…	…
1068	1068	struct svcctl_ChangeServiceConfigA *r)
1069	1069	{
1070		p->~~rng_fault_state = True~~;
	1070	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1071	1071	return WERR_NOT_SUPPORTED;
1072	1072	}
…	…
1075	1075	struct svcctl_CreateServiceA *r)
1076	1076	{
1077		p->~~rng_fault_state = True~~;
	1077	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1078	1078	return WERR_NOT_SUPPORTED;
1079	1079	}
…	…
1082	1082	struct svcctl_EnumDependentServicesA *r)
1083	1083	{
1084		p->~~rng_fault_state = True~~;
	1084	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1085	1085	return WERR_NOT_SUPPORTED;
1086	1086	}
…	…
1089	1089	struct svcctl_EnumServicesStatusA *r)
1090	1090	{
1091		p->~~rng_fault_state = True~~;
	1091	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1092	1092	return WERR_NOT_SUPPORTED;
1093	1093	}
…	…
1096	1096	struct svcctl_OpenSCManagerA *r)
1097	1097	{
1098		p->~~rng_fault_state = True~~;
	1098	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1099	1099	return WERR_NOT_SUPPORTED;
1100	1100	}
…	…
1103	1103	struct svcctl_OpenServiceA *r)
1104	1104	{
1105		p->~~rng_fault_state = True~~;
	1105	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1106	1106	return WERR_NOT_SUPPORTED;
1107	1107	}
…	…
1110	1110	struct svcctl_QueryServiceConfigA *r)
1111	1111	{
1112		p->~~rng_fault_state = True~~;
	1112	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1113	1113	return WERR_NOT_SUPPORTED;
1114	1114	}
…	…
1117	1117	struct svcctl_QueryServiceLockStatusA *r)
1118	1118	{
1119		p->~~rng_fault_state = True~~;
	1119	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1120	1120	return WERR_NOT_SUPPORTED;
1121	1121	}
…	…
1124	1124	struct svcctl_StartServiceA *r)
1125	1125	{
1126		p->~~rng_fault_state = True~~;
	1126	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1127	1127	return WERR_NOT_SUPPORTED;
1128	1128	}
…	…
1131	1131	struct svcctl_GetServiceDisplayNameA *r)
1132	1132	{
1133		p->~~rng_fault_state = True~~;
	1133	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1134	1134	return WERR_NOT_SUPPORTED;
1135	1135	}
…	…
1138	1138	struct svcctl_GetServiceKeyNameA *r)
1139	1139	{
1140		p->~~rng_fault_state = True~~;
	1140	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1141	1141	return WERR_NOT_SUPPORTED;
1142	1142	}
…	…
1145	1145	struct svcctl_GetCurrentGroupeStateW *r)
1146	1146	{
1147		p->~~rng_fault_state = True~~;
	1147	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1148	1148	return WERR_NOT_SUPPORTED;
1149	1149	}
…	…
1152	1152	struct svcctl_EnumServiceGroupW *r)
1153	1153	{
1154		p->~~rng_fault_state = True~~;
	1154	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1155	1155	return WERR_NOT_SUPPORTED;
1156	1156	}
…	…
1159	1159	struct svcctl_ChangeServiceConfig2A *r)
1160	1160	{
1161		p->~~rng_fault_state = True~~;
	1161	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1162	1162	return WERR_NOT_SUPPORTED;
1163	1163	}
…	…
1166	1166	struct svcctl_ChangeServiceConfig2W *r)
1167	1167	{
1168		p->~~rng_fault_state = True~~;
	1168	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1169	1169	return WERR_NOT_SUPPORTED;
1170	1170	}
…	…
1173	1173	struct svcctl_QueryServiceConfig2A *r)
1174	1174	{
1175		p->~~rng_fault_state = True~~;
	1175	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1176	1176	return WERR_NOT_SUPPORTED;
1177	1177	}
…	…
1180	1180	struct EnumServicesStatusExA *r)
1181	1181	{
1182		p->~~rng_fault_state = True~~;
	1182	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1183	1183	return WERR_NOT_SUPPORTED;
1184	1184	}
…	…
1187	1187	struct EnumServicesStatusExW *r)
1188	1188	{
1189		p->~~rng_fault_state = True~~;
	1189	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1190	1190	return WERR_NOT_SUPPORTED;
1191	1191	}
…	…
1194	1194	struct svcctl_SCSendTSMessage *r)
1195	1195	{
1196		p->~~rng_fault_state = True~~;
1197		return WERR_NOT_SUPPORTED;
1198		}
	1196	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
	1197	return WERR_NOT_SUPPORTED;
	1198	}

trunk/server/source3/rpc_server/winreg/srv_winreg_nt.c

-              r918
+              r920
            do anything */
         p->rng_fault_state = True;
+        p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
         return WERR_NOT_SUPPORTED;
+}
 …
            do anything */
         p->rng_fault_state = True;
+        p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
         return WERR_NOT_SUPPORTED;
+}
 …
            do anything */
         p->rng_fault_state = True;
+        p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
         return WERR_NOT_SUPPORTED;
+}
 …
            do anything */
         p->rng_fault_state = True;
+        p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
         return WERR_NOT_SUPPORTED;
+}
 …
            do anything */
         p->rng_fault_state = True;
+        p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
         return WERR_NOT_SUPPORTED;
+}

trunk/server/source3/rpc_server/wkssvc/srv_wkssvc_nt.c

r862	r920
406	406	{
407	407	/* FIXME: Add implementation code here */
408		p->~~rng_fault_state = True~~;
	408	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
409	409	return WERR_NOT_SUPPORTED;
410	410	}
…	…
609	609	{
610	610	/* FIXME: Add implementation code here */
611		p->~~rng_fault_state = True~~;
	611	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
612	612	return WERR_NOT_SUPPORTED;
613	613	}
…	…
620	620	{
621	621	/* FIXME: Add implementation code here */
622		p->~~rng_fault_state = True~~;
	622	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
623	623	return WERR_NOT_SUPPORTED;
624	624	}
…	…
631	631	{
632	632	/* FIXME: Add implementation code here */
633		p->~~rng_fault_state = True~~;
	633	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
634	634	return WERR_NOT_SUPPORTED;
635	635	}
…	…
642	642	{
643	643	/* FIXME: Add implementation code here */
644		p->~~rng_fault_state = True~~;
	644	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
645	645	return WERR_NOT_SUPPORTED;
646	646	}
…	…
653	653	{
654	654	/* FIXME: Add implementation code here */
655		p->~~rng_fault_state = True~~;
	655	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
656	656	return WERR_NOT_SUPPORTED;
657	657	}
…	…
664	664	{
665	665	/* FIXME: Add implementation code here */
666		p->~~rng_fault_state = True~~;
	666	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
667	667	return WERR_NOT_SUPPORTED;
668	668	}
…	…
675	675	{
676	676	/* FIXME: Add implementation code here */
677		p->~~rng_fault_state = True~~;
	677	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
678	678	return WERR_NOT_SUPPORTED;
679	679	}
…	…
686	686	{
687	687	/* FIXME: Add implementation code here */
688		p->~~rng_fault_state = True~~;
	688	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
689	689	return WERR_NOT_SUPPORTED;
690	690	}
…	…
697	697	{
698	698	/* FIXME: Add implementation code here */
699		p->~~rng_fault_state = True~~;
	699	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
700	700	return WERR_NOT_SUPPORTED;
701	701	}
…	…
708	708	{
709	709	/* FIXME: Add implementation code here */
710		p->~~rng_fault_state = True~~;
	710	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
711	711	return WERR_NOT_SUPPORTED;
712	712	}
…	…
719	719	{
720	720	/* FIXME: Add implementation code here */
721		p->~~rng_fault_state = True~~;
	721	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
722	722	return WERR_NOT_SUPPORTED;
723	723	}
…	…
730	730	{
731	731	/* FIXME: Add implementation code here */
732		p->~~rng_fault_state = True~~;
	732	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
733	733	return WERR_NOT_SUPPORTED;
734	734	}
…	…
741	741	{
742	742	/* FIXME: Add implementation code here */
743		p->~~rng_fault_state = True~~;
	743	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
744	744	return WERR_NOT_SUPPORTED;
745	745	}
…	…
752	752	{
753	753	/* FIXME: Add implementation code here */
754		p->~~rng_fault_state = True~~;
	754	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
755	755	return WERR_NOT_SUPPORTED;
756	756	}
…	…
763	763	{
764	764	/* FIXME: Add implementation code here */
765		p->~~rng_fault_state = True~~;
	765	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
766	766	return WERR_NOT_SUPPORTED;
767	767	}
…	…
774	774	{
775	775	/* FIXME: Add implementation code here */
776		p->~~rng_fault_state = True~~;
	776	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
777	777	return WERR_NOT_SUPPORTED;
778	778	}
…	…
785	785	{
786	786	/* FIXME: Add implementation code here */
787		p->~~rng_fault_state = True~~;
	787	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
788	788	return WERR_NOT_SUPPORTED;
789	789	}
…	…
796	796	{
797	797	/* FIXME: Add implementation code here */
798		p->~~rng_fault_state = True~~;
	798	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
799	799	return WERR_NOT_SUPPORTED;
800	800	}
…	…
807	807	{
808	808	/* FIXME: Add implementation code here */
809		p->~~rng_fault_state = True~~;
	809	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
810	810	return WERR_NOT_SUPPORTED;
811	811	}
…	…
963	963	{
964	964	/* for now just return not supported */
	965	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
965	966	return WERR_NOT_SUPPORTED;
966	967	}
…	…
973	974	{
974	975	/* FIXME: Add implementation code here */
975		p->~~rng_fault_state = True~~;
	976	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
976	977	return WERR_NOT_SUPPORTED;
977	978	}
…	…
984	985	{
985	986	/* FIXME: Add implementation code here */
986		p->~~rng_fault_state = True~~;
	987	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
987	988	return WERR_NOT_SUPPORTED;
988	989	}
…	…
995	996	{
996	997	/* FIXME: Add implementation code here */
997		p->~~rng_fault_state = True~~;
	998	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
998	999	return WERR_NOT_SUPPORTED;
999	1000	}
…	…
1006	1007	{
1007	1008	/* FIXME: Add implementation code here */
1008		p->~~rng_fault_state = True~~;
	1009	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1009	1010	return WERR_NOT_SUPPORTED;
1010	1011	}
…	…
1017	1018	{
1018	1019	/* FIXME: Add implementation code here */
1019		p->~~rng_fault_state = True~~;
	1020	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
1020	1021	return WERR_NOT_SUPPORTED;
1021	1022	}
…	…
1028	1029	{
1029	1030	/* FIXME: Add implementation code here */
1030		p->~~rng_fault_state = True~~;
1031		return WERR_NOT_SUPPORTED;
1032		}
	1031	p->fault_state = DCERPC_FAULT_OP_RNG_ERROR;
	1032	return WERR_NOT_SUPPORTED;
	1033	}

trunk/server/source3/rpcclient/rpcclient.c

-              r918
+              r920
+        }
+        if (binding->flags & DCERPC_CONNECT) {
+                pipe_default_auth_level = DCERPC_AUTH_LEVEL_CONNECT;
+                pipe_default_auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
+        }
         if (binding->flags & DCERPC_SIGN) {
                 pipe_default_auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 …
+        }
         if (binding->flags & DCERPC_AUTH_NTLM) {
-                /* If neither Integrity or Privacy are requested then
-                 * Use just Connect level */
-                if (pipe_default_auth_level == DCERPC_AUTH_LEVEL_NONE) {
-                        pipe_default_auth_level = DCERPC_AUTH_LEVEL_CONNECT;
+                }
                 if (pipe_default_auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
                         pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
 …
+        }
         if (binding->flags & DCERPC_AUTH_KRB5) {
-                /* If neither Integrity or Privacy are requested then
-                 * Use just Connect level */
-                if (pipe_default_auth_level == DCERPC_AUTH_LEVEL_NONE) {
-                        pipe_default_auth_level = DCERPC_AUTH_LEVEL_CONNECT;
+                }
                 if (pipe_default_auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
                         pipe_default_auth_spnego_type = PIPE_AUTH_TYPE_SPNEGO_KRB5;
                 } else {
                         pipe_default_auth_type = DCERPC_AUTH_TYPE_KRB5;
+                }
+        }
+        if (pipe_default_auth_type != DCERPC_AUTH_TYPE_NONE) {
+                /* If nothing is requested then default to integrity */
+                if (pipe_default_auth_level == DCERPC_AUTH_LEVEL_NONE) {
+                        pipe_default_auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
+                }
+        }

trunk/server/source3/selftest/knownfail

r918	r920
19	19	samba3.rap.sam..userdelete # Not provided by Samba 3
20	20	samba3.rap.basic..netsessiongetinfo # Not provided by Samba 3
	21	samba3.blackbox.rpcclient.over.ncacn_np.with.connect. # we don't allow auth_level_connect anymore
	22	samba3.posix_s3.rpc.lsa.lookupsids.ncacn_ip_tcp.connect.* # we don't allow auth_level_connect anymore

trunk/server/source3/selftest/skip

-              r862
+              r920
 samba3.*raw.qfsinfo
 samba3.*raw.sfileinfo.base
+# skip, don't work for badlock backports
+samba3.posix_s3.raw.eas
+samba3.posix_s3.raw.rename
+samba3.posix_s3.raw.search
+samba3.posix_s3.raw.streams

trunk/server/source3/selftest/tests.py

-              r918
+              r920
         elif t == "raw.samba3posixtimedlock":
             plansmbtorturetestsuite(t, "s3dc", '//$SERVER_IP/tmpguest -U$USERNAME%$PASSWORD --option=torture:localdir=$SELFTEST_PREFIX/dc/share')
+        elif t == "rpc.samr.passwords.validate":
+            plansmbtorturetestsuite(t, "s3dc", 'ncacn_np:$SERVER_IP[seal] -U$USERNAME%$PASSWORD', 'over ncacn_np ')
         else:
             plansmbtorturetestsuite(t, "s3dc", '//$SERVER_IP/tmp -U$USERNAME%$PASSWORD')
 …
     test = 'rpc.lsa.lookupsids'
     auth_options = ["", "ntlm", "spnego" ]
+    auth_options = ["", "ntlm", "spnego", "spnego,ntlm" ]
     signseal_options = ["", ",connect", ",sign", ",seal"]
     smb_options = ["", ",smb2"]
 …
                     options = binding_string + " -U$USERNAME%$PASSWORD"
                     plansmbtorturetestsuite(test, "s3dc", options, 'over ncacn_np with [%s%s%s%s] ' % (a, s, z, e))
+                    plantestsuite("samba3.blackbox.rpcclient over ncacn_np with [%s%s%s%s] " % (a, s, z, e), "s3dc:local", [os.path.join(samba3srcdir, "script/tests/test_rpcclient.sh"),
+                                                                 "none", options, configuration])
     for e in endianness_options:
         for a in auth_options:

trunk/server/source3/smbd/conn.c

r862	r920
24	24	#include "smbd/globals.h"
25	25	#include "rpc_server/rpc_ncacn_np.h"
	26	#include "lib/util/bitmap.h"
26	27
27	28	/* The connections bitmap is expanded in increments of BITMAP_BLOCK_SZ. The

trunk/server/source3/smbd/dir.c

r862	r920
24	24	#include "smbd/globals.h"
25	25	#include "libcli/security/security.h"
	26	#include "lib/util/bitmap.h"
26	27
27	28	/*

trunk/server/source3/smbd/files.c

r918	r920
23	23	#include "libcli/security/security.h"
24	24	#include "util_tdb.h"
	25	#include "lib/util/bitmap.h"
25	26
26	27	#define VALID_FNUM(fnum) (((fnum) >= 0) && ((fnum) < real_max_open_files))

trunk/server/source3/smbd/smb2_server.c

r862	r920
27	27	#include "../lib/util/tevent_ntstatus.h"
28	28	#include "smbprofile.h"
	29	#include "../lib/util/bitmap.h"
29	30
30	31	#define OUTVEC_ALLOC_SIZE (SMB2_HDR_BODY + 9)

trunk/server/source3/smbd/vfs.c

-              r918
+              r920
                 const char *conn_rootdir;
                 size_t rootdir_len;
+                bool matched;
                 conn_rootdir = SMB_VFS_CONNECTPATH(conn, fname);
 …
                 rootdir_len = strlen(conn_rootdir);
+                if (strncmp(conn_rootdir, resolved_name,
+                                rootdir_len) != 0) {
+                matched = (strncmp(conn_rootdir, resolved_name,
+                                rootdir_len) == 0);
+                if (!matched || (resolved_name[rootdir_len] != '/' &&
+                                 resolved_name[rootdir_len] != '\0')) {
                         DEBUG(2, ("check_reduced_name: Bad access "
                                 "attempt: %s is a symlink outside the "

trunk/server/source3/winbindd/winbindd_cm.c

-              r862
+              r920
  anonymous:
+        if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
+                status = NT_STATUS_DOWNGRADE_DETECTED;
+                DEBUG(1, ("Unwilling to make SAMR connection to domain %s "
+                          "without connection level security, "
+                          "must set 'winbind sealed pipes = false' "
+                          "to proceed: %s\n",
+                          domain->name, nt_errstr(status)));
+                goto done;
+        }
         /* Finally fall back to anonymous. */
 …
  anonymous:
+        if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
+                result = NT_STATUS_DOWNGRADE_DETECTED;
+                DEBUG(1, ("Unwilling to make LSA connection to domain %s "
+                          "without connection level security, "
+                          "must set 'winbind sealed pipes = false' "
+                          "to proceed: %s\n",
+                          domain->name, nt_errstr(result)));
+                goto done;
+        }
         result = cli_rpc_pipe_open_noauth(conn->cli,
                                           &ndr_table_lsarpc.syntax_id,
 …
  no_schannel:
         if ((lp_client_schannel() == False) ||
+                        ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
+                ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
+                if (lp_winbind_sealed_pipes() && (IS_DC || domain->primary)) {
+                        result = NT_STATUS_DOWNGRADE_DETECTED;
+                        DEBUG(1, ("Unwilling to make connection to domain %s "
+                                  "without connection level security, "
+                                  "must set 'winbind sealed pipes = false' "
+                                  "to proceed: %s\n",
+                                  domain->name, nt_errstr(result)));
+                        TALLOC_FREE(netlogon_pipe);
+                        invalidate_cm_connection(conn);
+                        return result;
+                }
                 /*
                  * NetSamLogonEx only works for schannel

trunk/server/source4/heimdal/cf/make-proto.pl

-              r918
+              r920
 # $Id$
 ##use Getopt::Std;
 require 'getopts.pl';
+use Getopt::Std;
+#require 'getopts.pl';
 my $comment = 0;
 …
 my $private_func_re = "^_";
 Getopts('x:m:o:p:dqE:R:P:') || die "foo";
+getopts('x:m:o:p:dqE:R:P:') || die "foo";
 if($opt_d) {

trunk/server/source4/lib/ldb/wscript

-              r918
+              r920
                           vnum=VERSION,
                           private_library=private_library,
+                          manpages='man/ldb.3',
+                          abi_directory = 'ABI',
+                          abi_match = abi_match)
+                          manpages='man/ldb.3')
         # generate a include/ldb_version.h

trunk/server/source4/librpc/rpc/dcerpc.c

-              r862
+              r920
         default:
                 return NT_STATUS_INVALID_LEVEL;
+        }
+        if (pkt->auth_length == 0) {
+                return NT_STATUS_INVALID_NETWORK_RESPONSE;
+        }
+        if (c->security_state.generic_state == NULL) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
 …
         /* the bind_ack might contain a reply set of credentials */
         if (conn->security_state.auth_info && pkt->u.bind_ack.auth_info.length) {
+        if (conn->security_state.auth_info && pkt->auth_length) {
                 NTSTATUS status;
                 uint32_t auth_length;
 …
         /* the alter_resp might contain a reply set of credentials */
+        if (recv_pipe->conn->security_state.auth_info &&
+            pkt->u.alter_resp.auth_info.length) {
+        if (recv_pipe->conn->security_state.auth_info && pkt->auth_length) {
                 struct dcecli_connection *conn = recv_pipe->conn;
                 NTSTATUS status;

trunk/server/source4/librpc/rpc/dcerpc_util.c

-              r918
+              r920
         /* Perform an authenticated DCE-RPC bind
          */
         if (!(conn->flags & (DCERPC_SIGN|DCERPC_SEAL))) {
+        if (!(conn->flags & (DCERPC_CONNECT|DCERPC_SEAL))) {
                 /*
                   we are doing an authenticated connection,
                   but not using sign or seal. We must force
                   the CONNECT dcerpc auth type as a NONE auth
                   type doesn't allow authentication
                   information to be passed.
+                  which needs to use [connect], [sign] or [seal].
+                  If nothing is specified, we default to [sign] now.
+                  This give roughly the same protection as
+                  ncacn_np with smb signing.
                 */
                 conn->flags |= DCERPC_CONNECT;
+                conn->flags |= DCERPC_SIGN;
+        }

trunk/server/source4/rpc_server/dcesrv_auth.c

-              r745
+              r920
         uint32_t auth_length;
         if (pkt->u.bind.auth_info.length == 0) {
+        if (pkt->auth_length == 0) {
                 dce_conn->auth_state.auth_info = NULL;
                 return true;
 …
         NTSTATUS status;
         if (!call->conn->auth_state.gensec_security) {
+        if (call->pkt.auth_length == 0) {
                 return NT_STATUS_OK;
+        }
 …
         uint32_t auth_length;
+        /* We can't work without an existing gensec state, and an new blob to feed it */
+        if (!dce_conn->auth_state.auth_info ||
+            !dce_conn->auth_state.gensec_security ||
+            pkt->u.auth3.auth_info.length == 0) {
+        if (pkt->auth_length == 0) {
+                return false;
+        }
+        if (!dce_conn->auth_state.auth_info) {
+                return false;
+        }
+        /* We can't work without an existing gensec state */
+        if (!dce_conn->auth_state.gensec_security) {
                 return false;
+        }
 …
         /* on a pure interface change there is no auth blob */
         if (pkt->u.alter.auth_info.length == 0) {
+        if (pkt->auth_length == 0) {
                 return true;
+        }
 …
         /* on a pure interface change there is no auth_info structure
            setup */
+        if (!call->conn->auth_state.auth_info ||
+            dce_conn->auth_state.auth_info->credentials.length == 0) {
+        if (call->pkt.auth_length == 0) {
                 return NT_STATUS_OK;
+        }
 …
         default:
+                return false;
+        }
+        if (pkt->auth_length == 0) {
+                DEBUG(1,("dcesrv_auth_request: unexpected auth_length of 0\n"));
                 return false;
+        }

trunk/server/source4/torture/basic/base.c

-              r918
+              r920
+{
         bool nt_status_support;
+        bool client_ntlmv2_auth;
         struct smbcli_state *cli_nt = NULL, *cli_dos = NULL;
         bool result = false;
 …
         nt_status_support = lpcfg_nt_status_support(tctx->lp_ctx);
+        client_ntlmv2_auth = lpcfg_client_ntlmv2_auth(tctx->lp_ctx);
         if (!lpcfg_set_cmdline(tctx->lp_ctx, "nt status support", "yes")) {
 …
                 goto fail;
+        }
+        if (!lpcfg_set_cmdline(tctx->lp_ctx, "client ntlmv2 auth", "yes")) {
+                torture_result(tctx, TORTURE_FAIL, "Could not set 'client ntlmv2 auth = yes'\n");
+                goto fail;
+        }
         if (!torture_open_connection(&cli_nt, tctx, 0)) {
 …
         if (!lpcfg_set_cmdline(tctx->lp_ctx, "nt status support", "no")) {
+                torture_comment(tctx, "Could not set 'nt status support = yes'\n");
+                torture_result(tctx, TORTURE_FAIL, "Could not set 'nt status support = no'\n");
+                goto fail;
+        }
+        if (!lpcfg_set_cmdline(tctx->lp_ctx, "client ntlmv2 auth", "no")) {
+                torture_result(tctx, TORTURE_FAIL, "Could not set 'client ntlmv2 auth = no'\n");
                 goto fail;
+        }
 …
         if (!lpcfg_set_cmdline(tctx->lp_ctx, "nt status support",
                             nt_status_support ? "yes":"no")) {
+                torture_comment(tctx, "Could not reset 'nt status support = yes'");
+                torture_result(tctx, TORTURE_FAIL, "Could not reset 'nt status support'");
+                goto fail;
+        }
+        if (!lpcfg_set_cmdline(tctx->lp_ctx, "client ntlmv2 auth",
+                               client_ntlmv2_auth ? "yes":"no")) {
+                torture_result(tctx, TORTURE_FAIL, "Could not reset 'client ntlmv2 auth'");
                 goto fail;
+        }

trunk/server/source4/torture/ndr/dfsblob.c

-              r918
+              r920
         struct torture_suite *suite = torture_suite_create(ctx, "dfsblob");
         torture_suite_add_ndr_pull_fn_test(suite, dfs_GetDFSReferral_in, dfs_get_ref_in, NDR_IN, NULL);
+        torture_suite_add_ndr_pull_test(suite, dfs_GetDFSReferral_in, dfs_get_ref_in, NULL);
         torture_suite_add_ndr_pull_fn_test(suite, dfs_referral_resp, dfs_get_ref_out2, NDR_BUFFERS|NDR_SCALARS, NULL);
+        torture_suite_add_ndr_pull_test(suite, dfs_referral_resp, dfs_get_ref_out2, NULL);
         torture_suite_add_ndr_pull_fn_test(suite, dfs_referral_resp, dfs_get_ref_out, NDR_BUFFERS|NDR_SCALARS,dfs_referral_out_check);
+        torture_suite_add_ndr_pull_test(suite, dfs_referral_resp, dfs_get_ref_out,dfs_referral_out_check);
         return suite;

trunk/server/source4/torture/ndr/drsblobs.c

-              r918
+              r920
 };
+/* these are taken from the trust objects of a w2k8r2 forest, with a
+ * trust relationship between the forest parent and a child domain
+ */
+static const char *trustAuthIncoming =
+"AQAAAAwAAAAcAQAASuQ+RXJdzAECAAAAAAEAAMOWL6UVfVKiJOUsGcT03H"
+"jHxr2ACsMMOV5ynM617Tp7idNC+c4egdqk4S9YEpvR2YvHmdZdymL6F7QKm8OkXazYZF2r/gZ/bI+"
+"jkWbsn4O8qyAc3OUKQRZwBbf+lxBW+vM4O3ZpUjz5BSKCcFQgM+MY91yVU8Nji3HNnvGnDquobFAZ"
+"hxjL+S1l5+QZgkfyfv5mQScGRbU1Lar1xg9G3JznUb7S6pvrBO2nwK8g+KZBfJy5UeULigDH4IWo/"
+"JmtaEGkKE2uiKIjdsEQd/uwnkouW26XzRc0ulfJnPFftGnT9KIcShPf7DLj/tstmQAAceRMFHJTY3"
+"PmxoowoK8HUyBK5D5Fcl3MAQIAAAAAAQAAw5YvpRV9UqIk5SwZxPTceMfGvYAKwww5XnKczrXtOnu"
+"J00L5zh6B2qThL1gSm9HZi8eZ1l3KYvoXtAqbw6RdrNhkXav+Bn9sj6ORZuyfg7yrIBzc5QpBFnAF"
+"t/6XEFb68zg7dmlSPPkFIoJwVCAz4xj3XJVTw2OLcc2e8acOq6hsUBmHGMv5LWXn5BmCR/J+/mZBJ"
+"wZFtTUtqvXGD0bcnOdRvtLqm+sE7afAryD4pkF8nLlR5QuKAMfghaj8ma1oQaQoTa6IoiN2wRB3+7"
+"CeSi5bbpfNFzS6V8mc8V+0adP0ohxKE9/sMuP+2y2ZAABx5EwUclNjc+bGijCgrwdTIA==";
+static const char *trustAuthOutgoing =
+"AQAAAAwAAAAcAQAASuQ+RXJdzAECAAAAAAEAAMOWL6UVfVKiJOUsGcT03H"
+"jHxr2ACsMMOV5ynM617Tp7idNC+c4egdqk4S9YEpvR2YvHmdZdymL6F7QKm8OkXazYZF2r/gZ/bI+"
+"jkWbsn4O8qyAc3OUKQRZwBbf+lxBW+vM4O3ZpUjz5BSKCcFQgM+MY91yVU8Nji3HNnvGnDquobFAZ"
+"hxjL+S1l5+QZgkfyfv5mQScGRbU1Lar1xg9G3JznUb7S6pvrBO2nwK8g+KZBfJy5UeULigDH4IWo/"
+"JmtaEGkKE2uiKIjdsEQd/uwnkouW26XzRc0ulfJnPFftGnT9KIcShPf7DLj/tstmQAAceRMFHJTY3"
+"PmxoowoK8HUyBK5D5Fcl3MAQIAAAAAAQAAw5YvpRV9UqIk5SwZxPTceMfGvYAKwww5XnKczrXtOnu"
+"J00L5zh6B2qThL1gSm9HZi8eZ1l3KYvoXtAqbw6RdrNhkXav+Bn9sj6ORZuyfg7yrIBzc5QpBFnAF"
+"t/6XEFb68zg7dmlSPPkFIoJwVCAz4xj3XJVTw2OLcc2e8acOq6hsUBmHGMv5LWXn5BmCR/J+/mZBJ"
+"wZFtTUtqvXGD0bcnOdRvtLqm+sE7afAryD4pkF8nLlR5QuKAMfghaj8ma1oQaQoTa6IoiN2wRB3+7"
+"CeSi5bbpfNFzS6V8mc8V+0adP0ohxKE9/sMuP+2y2ZAABx5EwUclNjc+bGijCgrwdTIA==";
 static bool trust_domain_passwords_check_in(struct torture_context *tctx,
                                             struct trustDomainPasswords *r)
 …
         struct torture_suite *suite = torture_suite_create(ctx, "drsblobs");
+        torture_suite_add_ndr_pull_fn_test(suite, ForestTrustInfo, forest_trust_info_data_out, NDR_IN, forest_trust_info_check_out);
+        torture_suite_add_ndr_pull_fn_test(suite, trustDomainPasswords, trust_domain_passwords_in, NDR_IN, trust_domain_passwords_check_in);
+        torture_suite_add_ndr_pull_test(suite, ForestTrustInfo, forest_trust_info_data_out, forest_trust_info_check_out);
+        torture_suite_add_ndr_pull_test(suite, trustDomainPasswords, trust_domain_passwords_in, trust_domain_passwords_check_in);
+#if 0
+        torture_suite_add_ndr_pullpush_test(suite,
+                                            trustAuthInOutBlob,
+                                            base64_decode_data_blob_talloc(suite, trustAuthIncoming),
+                                            NULL);
+        torture_suite_add_ndr_pullpush_test(suite,
+                                            trustAuthInOutBlob,
+                                            base64_decode_data_blob_talloc(suite, trustAuthOutgoing),
+                                            NULL);
+#endif
         return suite;

trunk/server/source4/torture/ndr/nbt.c

-              r918
+              r920
         struct torture_suite *suite = torture_suite_create(ctx, "nbt");
         torture_suite_add_ndr_pull_fn_test(suite, nbt_netlogon_packet, netlogon_logon_request_req_data, NDR_IN, netlogon_logon_request_req_check);
+        torture_suite_add_ndr_pull_test(suite, nbt_netlogon_packet, netlogon_logon_request_req_data, netlogon_logon_request_req_check);
         torture_suite_add_ndr_pull_fn_test(suite, nbt_netlogon_response2, netlogon_logon_request_resp_data, NDR_IN, netlogon_logon_request_resp_check);
+        torture_suite_add_ndr_pull_test(suite, nbt_netlogon_response2, netlogon_logon_request_resp_data, netlogon_logon_request_resp_check);
         return suite;

trunk/server/source4/torture/ndr/ndr.c

-              r918
+              r920
         size_t struct_size;
         ndr_pull_flags_fn_t pull_fn;
+        ndr_push_flags_fn_t push_fn;
         int ndr_flags;
+        int flags;
 };
 static bool wrap_ndr_pull_test(struct torture_context *tctx,
                                struct torture_tcase *tcase,
                                struct torture_test *test)
+static bool wrap_ndr_pullpush_test(struct torture_context *tctx,
+                                   struct torture_tcase *tcase,
+                                   struct torture_test *test)
+{
         bool (*check_fn) (struct torture_context *ctx, void *data) = test->fn;
         const struct ndr_pull_test_data *data = (const struct ndr_pull_test_data *)test->data;
-        void *ds = talloc_zero_size(tctx, data->struct_size);
         struct ndr_pull *ndr = ndr_pull_init_blob(&(data->data), tctx);
+        void *ds = talloc_zero_size(ndr, data->struct_size);
+        bool ret;
+        uint32_t highest_ofs;
+        ndr->flags |= data->flags;
         ndr->flags |= LIBNDR_FLAG_REF_ALLOC;
 …
                                    "pulling");
+        torture_assert(tctx, ndr->offset == ndr->data_size,
+        if (ndr->offset > ndr->relative_highest_offset) {
+                highest_ofs = ndr->offset;
+        } else {
+                highest_ofs = ndr->relative_highest_offset;
+        }
+        torture_assert(tctx, highest_ofs == ndr->data_size,
                                    talloc_asprintf(tctx,
+                                           "%d unread bytes", ndr->data_size - ndr->offset));
+        if (check_fn != NULL)
+                return check_fn(tctx, ds);
+        else
+                return true;
+}
+_PUBLIC_ struct torture_test *_torture_suite_add_ndr_pull_test(
+                                        struct torture_suite *suite,
+                                        const char *name, ndr_pull_flags_fn_t pull_fn,
+                                        DATA_BLOB db,
+                                        size_t struct_size,
+                                        int ndr_flags,
+                                        bool (*check_fn) (struct torture_context *ctx, void *data))
+                                           "%d unread bytes", ndr->data_size - highest_ofs));
+        if (check_fn != NULL) {
+                ret = check_fn(tctx, ds);
+        } else {
+                ret = true;
+        }
+        if (data->push_fn != NULL) {
+                DATA_BLOB outblob;
+                torture_assert_ndr_success(tctx, ndr_push_struct_blob(&outblob, ndr, ds, data->push_fn), "pushing");
+                torture_assert_data_blob_equal(tctx, outblob, data->data, "ndr push compare");
+        }
+        talloc_free(ndr);
+        return ret;
+}
+_PUBLIC_ struct torture_test *_torture_suite_add_ndr_pullpush_test(
+        struct torture_suite *suite,
+        const char *name,
+        ndr_pull_flags_fn_t pull_fn,
+        ndr_push_flags_fn_t push_fn,
+        DATA_BLOB db,
+        size_t struct_size,
+        int ndr_flags,
+        int flags,
+        bool (*check_fn) (struct torture_context *ctx, void *data))
+{
         struct torture_test *test;
 …
         test->name = talloc_strdup(test, name);
         test->description = NULL;
+        test->run = wrap_ndr_pull_test;
+        test->run = wrap_ndr_pullpush_test;
         data = talloc(test, struct ndr_pull_test_data);
         data->data = db;
         data->ndr_flags = ndr_flags;
+        data->flags = flags;
         data->struct_size = struct_size;
         data->pull_fn = pull_fn;
+        data->push_fn = push_fn;
         test->data = data;
         test->fn = check_fn;
 …
         return test;
+}
 static bool wrap_ndr_inout_pull_test(struct torture_context *tctx,
 …
         void *ds = talloc_zero_size(tctx, data->struct_size);
         struct ndr_pull *ndr;
+        uint32_t highest_ofs;
         /* handle NDR_IN context */
 …
                 "ndr pull of context failed");
+        torture_assert(tctx, ndr->offset == ndr->data_size,
+                talloc_asprintf(tctx, "%d unread bytes", ndr->data_size - ndr->offset));
+        if (ndr->offset > ndr->relative_highest_offset) {
+                highest_ofs = ndr->offset;
+        } else {
+                highest_ofs = ndr->relative_highest_offset;
+        }
+        torture_assert(tctx, highest_ofs == ndr->data_size,
+                talloc_asprintf(tctx, "%d unread bytes", ndr->data_size - highest_ofs));
         talloc_free(ndr);
 …
                 "ndr pull failed");
+        torture_assert(tctx, ndr->offset == ndr->data_size,
+                talloc_asprintf(tctx, "%d unread bytes", ndr->data_size - ndr->offset));
+        if (ndr->offset > ndr->relative_highest_offset) {
+                highest_ofs = ndr->offset;
+        } else {
+                highest_ofs = ndr->relative_highest_offset;
+        }
+        torture_assert(tctx, highest_ofs == ndr->data_size,
+                talloc_asprintf(tctx, "%d unread bytes", ndr->data_size - highest_ofs));
         talloc_free(ndr);

trunk/server/source4/torture/ndr/ndr.h

-              r918
+              r920
 #include "libcli/security/security.h"
 _PUBLIC_ struct torture_test *_torture_suite_add_ndr_pull_test(
+_PUBLIC_ struct torture_test *_torture_suite_add_ndr_pullpush_test(
                                         struct torture_suite *suite,
+                                        const char *name, ndr_pull_flags_fn_t fn,
+                                        const char *name,
+                                        ndr_pull_flags_fn_t pull_fn,
+                                        ndr_push_flags_fn_t push_fn,
                                         DATA_BLOB db,
                                         size_t struct_size,
                                         int ndr_flags,
+                                        int flags,
                                         bool (*check_fn) (struct torture_context *, void *data));
 …
 #define torture_suite_add_ndr_pull_test(suite,name,data,check_fn) \
                 _torture_suite_add_ndr_pull_test(suite, #name, \
                          (ndr_pull_flags_fn_t)ndr_pull_ ## name, data_blob_talloc(suite, data, sizeof(data)), \
                          sizeof(struct name), NDR_SCALARS|NDR_BUFFERS, (bool (*) (struct torture_context *, void *)) check_fn);
+                _torture_suite_add_ndr_pullpush_test(suite, #name, \
+                         (ndr_pull_flags_fn_t)ndr_pull_ ## name, NULL, data_blob_const(data, sizeof(data)), \
+                         sizeof(struct name), NDR_SCALARS|NDR_BUFFERS, 0, (bool (*) (struct torture_context *, void *)) check_fn);
 #define torture_suite_add_ndr_pull_fn_test(suite,name,data,flags,check_fn) \
+                _torture_suite_add_ndr_pull_test(suite, #name "_" #flags, \
+                         (ndr_pull_flags_fn_t)ndr_pull_ ## name, data_blob_talloc(suite, data, sizeof(data)), \
+                         sizeof(struct name), flags, (bool (*) (struct torture_context *, void *)) check_fn);
+                _torture_suite_add_ndr_pullpush_test(suite, #name "_" #flags, \
+                         (ndr_pull_flags_fn_t)ndr_pull_ ## name, NULL, data_blob_const(data, sizeof(data)), \
+                         sizeof(struct name), flags, 0, (bool (*) (struct torture_context *, void *)) check_fn);
+#define torture_suite_add_ndr_pull_fn_test_flags(suite,name,data,flags,flags2,check_fn) \
+                _torture_suite_add_ndr_pullpush_test(suite, #name "_" #flags "_" #flags2, \
+                         (ndr_pull_flags_fn_t)ndr_pull_ ## name, NULL, data_blob_const(data, sizeof(data)), \
+                         sizeof(struct name), flags, flags2, (bool (*) (struct torture_context *, void *)) check_fn);
+#define torture_suite_add_ndr_pullpush_test(suite,name,data_blob,check_fn) \
+                _torture_suite_add_ndr_pullpush_test(suite, #name, \
+                         (ndr_pull_flags_fn_t)ndr_pull_ ## name, \
+                         (ndr_push_flags_fn_t)ndr_push_ ## name, \
+                         data_blob, \
+                         sizeof(struct name), NDR_SCALARS|NDR_BUFFERS, 0, (bool (*) (struct torture_context *, void *)) check_fn);
 #define torture_suite_add_ndr_pull_io_test(suite,name,data_in,data_out,check_fn_out) \
                 _torture_suite_add_ndr_pull_inout_test(suite, #name "_INOUT", \
                          (ndr_pull_flags_fn_t)ndr_pull_ ## name, \
                          data_blob_talloc(suite, data_in, sizeof(data_in)), \
                          data_blob_talloc(suite, data_out, sizeof(data_out)), \
+                         data_blob_const(data_in, sizeof(data_in)), \
+                         data_blob_const(data_out, sizeof(data_out)), \
                          sizeof(struct name), \
                          (bool (*) (struct torture_context *, void *)) check_fn_out);

trunk/server/source4/torture/ndr/ntlmssp.c

-              r918
+              r920
         struct torture_suite *suite = torture_suite_create(ctx, "ntlmssp");
+        torture_suite_add_ndr_pull_fn_test(suite, NEGOTIATE_MESSAGE, ntlmssp_NEGOTIATE_MESSAGE_data, NDR_IN, ntlmssp_NEGOTIATE_MESSAGE_check);
+        /* torture_suite_add_ndr_pull_fn_test(suite, CHALLENGE_MESSAGE, ntlmssp_CHALLENGE_MESSAGE_data, NDR_IN, ntlmssp_CHALLENGE_MESSAGE_check);
+        torture_suite_add_ndr_pull_fn_test(suite, AUTHENTICATE_MESSAGE, ntlmssp_AUTHENTICATE_MESSAGE_data, NDR_IN, ntlmssp_AUTHENTICATE_MESSAGE_check); */
+        torture_suite_add_ndr_pull_test(suite, NEGOTIATE_MESSAGE, ntlmssp_NEGOTIATE_MESSAGE_data, ntlmssp_NEGOTIATE_MESSAGE_check);
+#if 0
+        torture_suite_add_ndr_pull_test(suite, CHALLENGE_MESSAGE, ntlmssp_CHALLENGE_MESSAGE_data, ntlmssp_CHALLENGE_MESSAGE_check);
+        torture_suite_add_ndr_pull_test(suite, AUTHENTICATE_MESSAGE, ntlmssp_AUTHENTICATE_MESSAGE_data, ntlmssp_AUTHENTICATE_MESSAGE_check);
+#endif
         return suite;
+}

trunk/server/source4/torture/raw/samba3misc.c

-              r918
+              r920
         TALLOC_CTX *mem_ctx;
         bool nt_status_support;
+        bool client_ntlmv2_auth;
         if (!(mem_ctx = talloc_init("torture_samba3_badpath"))) {
 …
         nt_status_support = lpcfg_nt_status_support(torture->lp_ctx);
+        if (!lpcfg_set_cmdline(torture->lp_ctx, "nt status support", "yes")) {
+                printf("Could not set 'nt status support = yes'\n");
+                goto fail;
+        }
+        client_ntlmv2_auth = lpcfg_client_ntlmv2_auth(torture->lp_ctx);
+        torture_assert_goto(torture, lpcfg_set_cmdline(torture->lp_ctx, "nt status support", "yes"), ret, fail, "Could not set 'nt status support = yes'\n");
+        torture_assert_goto(torture, lpcfg_set_cmdline(torture->lp_ctx, "client ntlmv2 auth", "yes"), ret, fail, "Could not set 'client ntlmv2 auth = yes'\n");
         if (!torture_open_connection(&cli_nt, torture, 0)) {
 …
+        }
+        if (!lpcfg_set_cmdline(torture->lp_ctx, "nt status support", "no")) {
+                printf("Could not set 'nt status support = yes'\n");
+                goto fail;
+        }
+        torture_assert_goto(torture, lpcfg_set_cmdline(torture->lp_ctx, "nt status support", "no"), ret, fail, "Could not set 'nt status support = no'\n");
+        torture_assert_goto(torture, lpcfg_set_cmdline(torture->lp_ctx, "client ntlmv2 auth", "no"), ret, fail, "Could not set 'client ntlmv2 auth = no'\n");
         if (!torture_open_connection(&cli_dos, torture, 1)) {
 …
         smbcli_deltree(cli_nt->tree, dirname);
+        torture_assert_goto(torture, lpcfg_set_cmdline(torture->lp_ctx, "nt status support",
+                                                       nt_status_support ? "yes":"no"),
+                            ret, fail, "Could not set 'nt status support' back to where it was\n");
+        torture_assert_goto(torture, lpcfg_set_cmdline(torture->lp_ctx, "client ntlmv2 auth",
+                                                       client_ntlmv2_auth ? "yes":"no"),
+                            ret, fail, "Could not set 'client ntlmv2 auth' back to where it was\n");
         status = smbcli_mkdir(cli_nt->tree, dirname);

trunk/server/source4/torture/rpc/rpc.c

r918	r920
502	502	torture_suite_add_suite(suite, torture_rpc_samr_passwords_badpwdcount(suite));
503	503	torture_suite_add_suite(suite, torture_rpc_samr_passwords_lockout(suite));
	504	torture_suite_add_suite(suite, torture_rpc_samr_passwords_validate(suite));
504	505	torture_suite_add_suite(suite, torture_rpc_samr_user_privileges(suite));
505	506	torture_suite_add_suite(suite, torture_rpc_samr_large_dc(suite));

trunk/server/source4/torture/rpc/samba3rpc.c

-              r918
+              r920
                 names_blob = NTLMv2_generate_names_blob(
                         mem_ctx,
                         cli_credentials_get_workstation(user_creds),
                         cli_credentials_get_domain(user_creds));
+                        cli_credentials_get_workstation(wks_creds),
+                        cli_credentials_get_domain(wks_creds));
                 status = cli_credentials_get_ntlm_response(
                         user_creds, mem_ctx, &flags, chal, names_blob,

trunk/server/source4/torture/rpc/samr.c

-              r862
+              r920
 static bool test_samr_ValidatePassword(struct dcerpc_pipe *p,
                                        struct torture_context *tctx)
+static bool test_samr_ValidatePassword(struct torture_context *tctx,
+                                       struct dcerpc_pipe *p)
+{
         struct samr_ValidatePassword r;
 …
         torture_comment(tctx, "Testing samr_ValidatePassword\n");
+        if (p->conn->transport.transport != NCACN_IP_TCP) {
+                torture_comment(tctx, "samr_ValidatePassword only should succeed over NCACN_IP_TCP!\n");
+        }
         ZERO_STRUCT(r);
         r.in.level = NetValidatePasswordReset;
 …
         ret &= test_samr_handle_Close(b, torture, &ctx->handle);
-        ret &= test_samr_ValidatePassword(p, torture);
         return ret;
+}
 …
+}
+struct torture_suite *torture_rpc_samr_passwords_validate(TALLOC_CTX *mem_ctx)
+{
+        struct torture_suite *suite = torture_suite_create(mem_ctx, "samr.passwords.validate");
+        struct torture_rpc_tcase *tcase;
+        tcase = torture_suite_add_rpc_iface_tcase(suite, "samr",
+                                                  &ndr_table_samr);
+        torture_rpc_tcase_add_test(tcase, "validate",
+                                   test_samr_ValidatePassword);
+        return suite;
+}

Context Navigation

Legend:

Download in other formats: