Changeset 989 for vendor/current/source4/dns_server

Timestamp:

Nov 25, 2016, 8:04:54 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: update vendor to version 4.4.7

Location:

vendor/current/source4/dns_server

Files:

• dns_crypto.c (modified) (5 diffs)
• dns_server.c (modified) (3 diffs)

vendor/current/source4/dns_server/dns_crypto.c

@@ -147 +147 @@
         tkey = dns_find_tkey(dns->tkeys, state->tsig->name);
         if (tkey == NULL) {
+                /*
+                 * We must save the name for use in the TSIG error
+                 * response and have no choice here but to save the
+                 * keyname from the TSIG request.
+                 */
+                state->key_name = talloc_strdup(state->mem_ctx,
+                                                state->tsig->name);
+                if (state->key_name == NULL) {
+                        return WERR_NOMEM;
+                }
                 state->tsig_error = DNS_RCODE_BADKEY;
                 return DNS_ERR(NOTAUTH);
+        }
+
+        /*
+         * Remember the keyname that found an existing tkey, used
+         * later to fetch the key with dns_find_tkey() when signing
+         * and adding a TSIG record with MAC.
+         */
+        state->key_name = talloc_strdup(state->mem_ctx, tkey->name);
+        if (state->key_name == NULL) {
+                return WERR_NOMEM;
         }
 
@@ -208 +228 @@
         }
 
-        /*FIXME: Why is there too much padding? */
-        buffer_len -= 2;
-
         /* Now we also need to count down the additional record counter */
         arcount = RSVAL(buffer, 10);
@@ -218 +235 @@
                                     buffer, buffer_len, &sig);
         if (NT_STATUS_EQUAL(NT_STATUS_ACCESS_DENIED, status)) {
-                return DNS_ERR(BADKEY);
+                state->tsig_error = DNS_RCODE_BADSIG;
+                return DNS_ERR(NOTAUTH);
         }
 
@@ -227 +245 @@
 
         state->authenticated = true;
-        state->key_name = talloc_strdup(state->mem_ctx, tkey->name);
-        if (state->key_name == NULL) {
-                return WERR_NOMEM;
-        }
-
+
+        return WERR_OK;
+}
+
+static WERROR dns_tsig_compute_mac(TALLOC_CTX *mem_ctx,
+                                   struct dns_request_state *state,
+                                   struct dns_name_packet *packet,
+                                   struct dns_server_tkey *tkey,
+                                   time_t current_time,
+                                   DATA_BLOB *_psig)
+{
+        NTSTATUS status;
+        enum ndr_err_code ndr_err;
+        DATA_BLOB packet_blob, tsig_blob, sig;
+        uint8_t *buffer = NULL;
+        uint8_t *p = NULL;
+        size_t buffer_len = 0;
+        struct dns_fake_tsig_rec *check_rec = talloc_zero(mem_ctx,
+                        struct dns_fake_tsig_rec);
+        size_t mac_size = 0;
+
+        if (check_rec == NULL) {
+                return WERR_NOMEM;
+        }
+
+        /* first build and verify check packet */
+        check_rec->name = talloc_strdup(check_rec, tkey->name);
+        if (check_rec->name == NULL) {
+                return WERR_NOMEM;
+        }
+        check_rec->rr_class = DNS_QCLASS_ANY;
+        check_rec->ttl = 0;
+        check_rec->algorithm_name = talloc_strdup(check_rec, tkey->algorithm);
+        if (check_rec->algorithm_name == NULL) {
+                return WERR_NOMEM;
+        }
+        check_rec->time_prefix = 0;
+        check_rec->time = current_time;
+        check_rec->fudge = 300;
+        check_rec->error = state->tsig_error;
+        check_rec->other_size = 0;
+        check_rec->other_data = NULL;
+
+        ndr_err = ndr_push_struct_blob(&packet_blob, mem_ctx, packet,
+                (ndr_push_flags_fn_t)ndr_push_dns_name_packet);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                DEBUG(1, ("Failed to push packet: %s!\n",
+                          ndr_errstr(ndr_err)));
+                return DNS_ERR(SERVER_FAILURE);
+        }
+
+        ndr_err = ndr_push_struct_blob(&tsig_blob, mem_ctx, check_rec,
+                (ndr_push_flags_fn_t)ndr_push_dns_fake_tsig_rec);
+        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
+                DEBUG(1, ("Failed to push packet: %s!\n",
+                          ndr_errstr(ndr_err)));
+                return DNS_ERR(SERVER_FAILURE);
+        }
+
+        if (state->tsig != NULL) {
+                mac_size = state->tsig->rdata.tsig_record.mac_size;
+        }
+
+        buffer_len = mac_size;
+
+        buffer_len += packet_blob.length;
+        if (buffer_len < packet_blob.length) {
+                return WERR_INVALID_PARAM;
+        }
+        buffer_len += tsig_blob.length;
+        if (buffer_len < tsig_blob.length) {
+                return WERR_INVALID_PARAM;
+        }
+
+        buffer = talloc_zero_array(mem_ctx, uint8_t, buffer_len);
+        if (buffer == NULL) {
+                return WERR_NOMEM;
+        }
+
+        p = buffer;
+
+        /*
+         * RFC 2845 "4.2 TSIG on Answers", how to lay out the buffer
+         * that we're going to sign:
+         * 1. MAC of request (if present)
+         * 2. Outgoing packet
+         * 3. TSIG record
+         */
+        if (mac_size > 0) {
+                memcpy(p, state->tsig->rdata.tsig_record.mac, mac_size);
+                p += mac_size;
+        }
+
+        memcpy(p, packet_blob.data, packet_blob.length);
+        p += packet_blob.length;
+
+        memcpy(p, tsig_blob.data, tsig_blob.length);
+
+        status = gensec_sign_packet(tkey->gensec, mem_ctx, buffer, buffer_len,
+                                    buffer, buffer_len, &sig);
+        if (!NT_STATUS_IS_OK(status)) {
+                return ntstatus_to_werror(status);
+        }
+
+        *_psig = sig;
         return WERR_OK;
 }
@@ -242 +360 @@
 {
         WERROR werror;
-        NTSTATUS status;
-        enum ndr_err_code ndr_err;
         time_t current_time = time(NULL);
-        DATA_BLOB packet_blob, tsig_blob, sig;
-        uint8_t *buffer = NULL;
-        size_t buffer_len = 0;
-        struct dns_server_tkey * tkey = NULL;
-        struct dns_res_rec *tsig = talloc_zero(mem_ctx, struct dns_res_rec);
-
-        struct dns_fake_tsig_rec *check_rec = talloc_zero(mem_ctx,
-                        struct dns_fake_tsig_rec);
-
+        struct dns_res_rec *tsig = NULL;
+        DATA_BLOB sig = (DATA_BLOB) {
+                .data = NULL,
+                .length = 0
+        };
+
+        tsig = talloc_zero(mem_ctx, struct dns_res_rec);
         if (tsig == NULL) {
                 return WERR_NOMEM;
         }
 
-        if (check_rec == NULL) {
-                return WERR_NOMEM;
-        }
-
-        tkey = dns_find_tkey(dns->tkeys, state->key_name);
-        if (tkey == NULL) {
-                /* FIXME: read up on what to do when we can't find a key */
-                return WERR_OK;
-        }
-
-        /* first build and verify check packet */
-        check_rec->name = talloc_strdup(check_rec, tkey->name);
-        if (check_rec->name == NULL) {
-                return WERR_NOMEM;
-        }
-        check_rec->rr_class = DNS_QCLASS_ANY;
-        check_rec->ttl = 0;
-        check_rec->algorithm_name = talloc_strdup(check_rec, tkey->algorithm);
-        if (check_rec->algorithm_name == NULL) {
-                return WERR_NOMEM;
-        }
-        check_rec->time_prefix = 0;
-        check_rec->time = current_time;
-        check_rec->fudge = 300;
-        check_rec->error = state->tsig_error;
-        check_rec->other_size = 0;
-        check_rec->other_data = NULL;
-
-        ndr_err = ndr_push_struct_blob(&packet_blob, mem_ctx, packet,
-                (ndr_push_flags_fn_t)ndr_push_dns_name_packet);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                DEBUG(1, ("Failed to push packet: %s!\n",
-                          ndr_errstr(ndr_err)));
-                return DNS_ERR(SERVER_FAILURE);
-        }
-
-        ndr_err = ndr_push_struct_blob(&tsig_blob, mem_ctx, check_rec,
-                (ndr_push_flags_fn_t)ndr_push_dns_fake_tsig_rec);
-        if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                DEBUG(1, ("Failed to push packet: %s!\n",
-                          ndr_errstr(ndr_err)));
-                return DNS_ERR(SERVER_FAILURE);
-        }
-
-        buffer_len = packet_blob.length + tsig_blob.length;
-        buffer = talloc_zero_array(mem_ctx, uint8_t, buffer_len);
-        if (buffer == NULL) {
-                return WERR_NOMEM;
-        }
-
-        memcpy(buffer, packet_blob.data, packet_blob.length);
-        memcpy(buffer+packet_blob.length, tsig_blob.data, tsig_blob.length);
-
-
-        status = gensec_sign_packet(tkey->gensec, mem_ctx, buffer, buffer_len,
-                                    buffer, buffer_len, &sig);
-        if (!NT_STATUS_IS_OK(status)) {
-                return ntstatus_to_werror(status);
-        }
-
-        tsig->name = talloc_strdup(tsig, check_rec->name);
+        if (state->tsig_error == DNS_RCODE_OK) {
+                struct dns_server_tkey *tkey = dns_find_tkey(
+                        dns->tkeys, state->key_name);
+                if (tkey == NULL) {
+                        return DNS_ERR(SERVER_FAILURE);
+                }
+
+                werror = dns_tsig_compute_mac(mem_ctx, state, packet,
+                                              tkey, current_time, &sig);
+                if (!W_ERROR_IS_OK(werror)) {
+                        return werror;
+                }
+        }
+
+        tsig->name = talloc_strdup(tsig, state->key_name);
         if (tsig->name == NULL) {
                 return WERR_NOMEM;
         }
-        tsig->rr_class = check_rec->rr_class;
+        tsig->rr_class = DNS_QCLASS_ANY;
         tsig->rr_type = DNS_QTYPE_TSIG;
         tsig->ttl = 0;
         tsig->length = UINT16_MAX;
-        tsig->rdata.tsig_record.algorithm_name = talloc_strdup(tsig,
-                        check_rec->algorithm_name);
-        tsig->rdata.tsig_record.time_prefix = check_rec->time_prefix;
-        tsig->rdata.tsig_record.time = check_rec->time;
-        tsig->rdata.tsig_record.fudge = check_rec->fudge;
+        tsig->rdata.tsig_record.algorithm_name = talloc_strdup(tsig, "gss-tsig");
+        tsig->rdata.tsig_record.time_prefix = 0;
+        tsig->rdata.tsig_record.time = current_time;
+        tsig->rdata.tsig_record.fudge = 300;
         tsig->rdata.tsig_record.error = state->tsig_error;
         tsig->rdata.tsig_record.original_id = packet->id;
         tsig->rdata.tsig_record.other_size = 0;
         tsig->rdata.tsig_record.other_data = NULL;
-        tsig->rdata.tsig_record.mac_size = sig.length;
-        tsig->rdata.tsig_record.mac = talloc_memdup(tsig, sig.data, sig.length);
-
+        if (sig.length > 0) {
+                tsig->rdata.tsig_record.mac_size = sig.length;
+                tsig->rdata.tsig_record.mac = talloc_memdup(tsig, sig.data, sig.length);
+        }
 
         if (packet->arcount == 0) {

vendor/current/source4/dns_server/dns_server.c

@@ -153 +153 @@
         }
 
-        ret = dns_verify_tsig(dns, state, &state->state, &state->in_packet, in);
-        if (!W_ERROR_IS_OK(ret)) {
-                DEBUG(1, ("Failed to verify TSIG!\n"));
-                state->dns_err = werr_to_dns_err(ret);
-                tevent_req_done(req);
-                return tevent_req_post(req, ev);
-        }
-
         if (state->in_packet.operation & DNS_FLAG_REPLY) {
                 DEBUG(1, ("Won't reply to replies.\n"));
@@ -176 +168 @@
 
         state->out_packet = state->in_packet;
+
+        ret = dns_verify_tsig(dns, state, &state->state, &state->out_packet, in);
+        if (!W_ERROR_IS_OK(ret)) {
+                state->dns_err = werr_to_dns_err(ret);
+                tevent_req_done(req);
+                return tevent_req_post(req, ev);
+        }
 
         switch (state->in_packet.operation & DNS_OPCODE) {
@@ -237 +236 @@
         }
         if ((state->dns_err != DNS_RCODE_OK) &&
-            (state->dns_err != DNS_RCODE_NXDOMAIN)) {
+            (state->dns_err != DNS_RCODE_NXDOMAIN) &&
+            (state->dns_err != DNS_RCODE_NOTAUTH))
+        {
                 goto drop;
         }