From ac505bb247d1f63d6c22d380e4db5a5f84cd2ff1 Mon Sep 17 00:00:00 2001

From: Andrew Bartlett <abartlet@samba.org>

Date: Fri, 16 Aug 2019 16:08:57 +1200

Subject: [PATCH 106/187] s4-rpc_server/backupkey: consistently check error

 codes from GnuTLS

This uses the new gnutls_error_to_werror()

This should resolve Coverity 1452111 as forwarded by Volker.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>

Reviewed-by: Andreas Schneider <asn@samba.org>

(cherry picked from commit 2d54559aad9af81cf21d223dad28b48184c59f44)

---

 .../rpc_server/backupkey/dcesrv_backupkey.c   | 146 +++++++++++-------

 source4/rpc_server/wscript_build              |   2 +-

 2 files changed, 92 insertions(+), 56 deletions(-)

diff --git a/source4/rpc_server/backupkey/dcesrv_backupkey.c b/source4/rpc_server/backupkey/dcesrv_backupkey.c

index a826ae083f4..cea6a28e4e2 100644

--- a/source4/rpc_server/backupkey/dcesrv_backupkey.c

+++ b/source4/rpc_server/backupkey/dcesrv_backupkey.c

@@ -42,6 +42,8 @@

 #include <gnutls/crypto.h>

 #include <gnutls/abstract.h>

+#include "lib/crypto/gnutls_helpers.h"

+

 #define DCESRV_INTERFACE_BACKUPKEY_BIND(context, iface) \

 	dcesrv_interface_backupkey_bind(context, iface)

 static NTSTATUS dcesrv_interface_backupkey_bind(struct dcesrv_connection_context *context,

@@ -1439,15 +1441,23 @@ static WERROR bkrp_server_wrap_decrypt_data(struct dcesrv_call_state *dce_call,

 	 * BACKUPKEY_BACKUP_GUID, it really is the whole key

 	 */

-	gnutls_hmac_init(&hmac_hnd,

-			 GNUTLS_MAC_SHA1,

-			 server_key.key,

-			 sizeof(server_key.key));

-	gnutls_hmac(hmac_hnd,

+	rc = gnutls_hmac_init(&hmac_hnd,

+			      GNUTLS_MAC_SHA1,

+			      server_key.key,

+			      sizeof(server_key.key));

+	if (rc != GNUTLS_E_SUCCESS) {

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

+	}

+

+	rc = gnutls_hmac(hmac_hnd,

 		    decrypt_request.r2,

 		    sizeof(decrypt_request.r2));

-	gnutls_hmac_output(hmac_hnd, symkey);

+	if (rc != GNUTLS_E_SUCCESS) {

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

+	}

+

+	gnutls_hmac_output(hmac_hnd, symkey);

 	dump_data_pw("symkey: \n", symkey, sizeof(symkey));

 	/* rc4 decrypt sid and secret using sym key */

@@ -1462,9 +1472,7 @@ static WERROR bkrp_server_wrap_decrypt_data(struct dcesrv_call_state *dce_call,

 				&cipher_key,

 				NULL);

 	if (rc != GNUTLS_E_SUCCESS) {

-		DBG_ERR("gnutls_cipher_init failed - %s\n",

-			gnutls_strerror(rc));

-		return WERR_INVALID_PARAMETER;

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

 	}

 	rc = gnutls_cipher_encrypt2(cipher_hnd,

 				    encrypted_blob.data,

@@ -1473,9 +1481,7 @@ static WERROR bkrp_server_wrap_decrypt_data(struct dcesrv_call_state *dce_call,

 				    encrypted_blob.length);

 	gnutls_cipher_deinit(cipher_hnd);

 	if (rc != GNUTLS_E_SUCCESS) {

-		DBG_ERR("gnutls_cipher_encrypt2 failed - %s\n",

-			gnutls_strerror(rc));

-		return WERR_INVALID_PARAMETER;

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

 	}

 	ndr_err = ndr_pull_struct_blob_all(&encrypted_blob, mem_ctx, &rc4payload,

@@ -1494,9 +1500,13 @@ static WERROR bkrp_server_wrap_decrypt_data(struct dcesrv_call_state *dce_call,

 	 * This is *not* the leading 64 bytes, as indicated in MS-BKRP 3.1.4.1.1

 	 * BACKUPKEY_BACKUP_GUID, it really is the whole key

 	 */

-	gnutls_hmac(hmac_hnd,

-		    rc4payload.r3,

-		    sizeof(rc4payload.r3));

+	rc = gnutls_hmac(hmac_hnd,

+			 rc4payload.r3,

+			 sizeof(rc4payload.r3));

+	if (rc != GNUTLS_E_SUCCESS) {

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

+	}

+

 	gnutls_hmac_deinit(hmac_hnd, mackey);

 	dump_data_pw("mackey: \n", mackey, sizeof(mackey));

@@ -1507,20 +1517,31 @@ static WERROR bkrp_server_wrap_decrypt_data(struct dcesrv_call_state *dce_call,

 		return WERR_INTERNAL_ERROR;

 	}

-	gnutls_hmac_init(&hmac_hnd,

-			 GNUTLS_MAC_SHA1,

-			 mackey,

-			 sizeof(mackey));

+	rc = gnutls_hmac_init(&hmac_hnd,

+			      GNUTLS_MAC_SHA1,

+			      mackey,

+			      sizeof(mackey));

+	if (rc != GNUTLS_E_SUCCESS) {

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

+	}

+

 	/* SID field */

-	gnutls_hmac(hmac_hnd,

-		    sid_blob.data,

-		    sid_blob.length);

+	rc = gnutls_hmac(hmac_hnd,

+			 sid_blob.data,

+			 sid_blob.length);

+	if (rc != GNUTLS_E_SUCCESS) {

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

+	}

+

 	/* Secret field */

-	gnutls_hmac(hmac_hnd,

-		    rc4payload.secret_data.data,

-		    rc4payload.secret_data.length);

-	gnutls_hmac_deinit(hmac_hnd, mac);

+	rc = gnutls_hmac(hmac_hnd,

+			 rc4payload.secret_data.data,

+			 rc4payload.secret_data.length);

+	if (rc != GNUTLS_E_SUCCESS) {

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

+	}

+	gnutls_hmac_deinit(hmac_hnd, mac);

 	dump_data_pw("mac: \n", mac, sizeof(mac));

 	dump_data_pw("rc4payload.mac: \n", rc4payload.mac, sizeof(rc4payload.mac));

@@ -1657,26 +1678,34 @@ static WERROR bkrp_server_wrap_encrypt_data(struct dcesrv_call_state *dce_call,

 	 * This is *not* the leading 64 bytes, as indicated in MS-BKRP 3.1.4.1.1

 	 * BACKUPKEY_BACKUP_GUID, it really is the whole key

 	 */

-	gnutls_hmac_init(&hmac_hnd,

-			 GNUTLS_MAC_SHA1,

-			 server_key.key,

-			 sizeof(server_key.key));

-	gnutls_hmac(hmac_hnd,

-		    server_side_wrapped.r2,

-		    sizeof(server_side_wrapped.r2));

-	gnutls_hmac_output(hmac_hnd, symkey);

+	rc = gnutls_hmac_init(&hmac_hnd,

+			      GNUTLS_MAC_SHA1,

+			      server_key.key,

+			      sizeof(server_key.key));

+	if (rc != GNUTLS_E_SUCCESS) {

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

+	}

+	rc = gnutls_hmac(hmac_hnd,

+			 server_side_wrapped.r2,

+			 sizeof(server_side_wrapped.r2));

+	if (rc != GNUTLS_E_SUCCESS) {

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

+	}

+	gnutls_hmac_output(hmac_hnd, symkey);

 	dump_data_pw("symkey: \n", symkey, sizeof(symkey));

 	/*

 	 * This is *not* the leading 64 bytes, as indicated in MS-BKRP 3.1.4.1.1

 	 * BACKUPKEY_BACKUP_GUID, it really is the whole key

 	 */

-	gnutls_hmac(hmac_hnd,

-		    rc4payload.r3,

-		    sizeof(rc4payload.r3));

+	rc = gnutls_hmac(hmac_hnd,

+			 rc4payload.r3,

+			 sizeof(rc4payload.r3));

+	if (rc != GNUTLS_E_SUCCESS) {

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

+	}

 	gnutls_hmac_deinit(hmac_hnd, mackey);

-

 	dump_data_pw("mackey: \n", mackey, sizeof(mackey));

 	ndr_err = ndr_push_struct_blob(&sid_blob, mem_ctx, caller_sid,

@@ -1688,20 +1717,31 @@ static WERROR bkrp_server_wrap_encrypt_data(struct dcesrv_call_state *dce_call,

 	rc4payload.secret_data.data = r->in.data_in;

 	rc4payload.secret_data.length = r->in.data_in_len;

-	gnutls_hmac_init(&hmac_hnd,

-			 GNUTLS_MAC_SHA1,

-			 mackey,

-			 sizeof(mackey));

+	rc = gnutls_hmac_init(&hmac_hnd,

+			      GNUTLS_MAC_SHA1,

+			      mackey,

+			      sizeof(mackey));

+	if (rc != GNUTLS_E_SUCCESS) {

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

+	}

+

 	/* SID field */

-	gnutls_hmac(hmac_hnd,

-		    sid_blob.data,

-		    sid_blob.length);

+	rc = gnutls_hmac(hmac_hnd,

+			 sid_blob.data,

+			 sid_blob.length);

+	if (rc != GNUTLS_E_SUCCESS) {

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

+	}

+

 	/* Secret field */

-	gnutls_hmac(hmac_hnd,

-		    rc4payload.secret_data.data,

-		    rc4payload.secret_data.length);

-	gnutls_hmac_deinit(hmac_hnd, rc4payload.mac);

+	rc = gnutls_hmac(hmac_hnd,

+			 rc4payload.secret_data.data,

+			 rc4payload.secret_data.length);

+	if (rc != GNUTLS_E_SUCCESS) {

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

+	}

+	gnutls_hmac_deinit(hmac_hnd, rc4payload.mac);

 	dump_data_pw("rc4payload.mac: \n", rc4payload.mac, sizeof(rc4payload.mac));

 	rc4payload.sid = *caller_sid;

@@ -1721,9 +1761,7 @@ static WERROR bkrp_server_wrap_encrypt_data(struct dcesrv_call_state *dce_call,

 				&cipher_key,

 				NULL);

 	if (rc != GNUTLS_E_SUCCESS) {

-		DBG_ERR("gnutls_cipher_init failed - %s\n",

-			gnutls_strerror(rc));

-		return WERR_INVALID_PARAMETER;

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

 	}

 	rc = gnutls_cipher_encrypt2(cipher_hnd,

 				    encrypted_blob.data,

@@ -1732,9 +1770,7 @@ static WERROR bkrp_server_wrap_encrypt_data(struct dcesrv_call_state *dce_call,

 				    encrypted_blob.length);

 	gnutls_cipher_deinit(cipher_hnd);

 	if (rc != GNUTLS_E_SUCCESS) {

-		DBG_ERR("gnutls_cipher_encrypt2 failed - %s\n",

-			gnutls_strerror(rc));

-		return WERR_INVALID_PARAMETER;

+		return gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);

 	}

 	/* create server wrap structure */

diff --git a/source4/rpc_server/wscript_build b/source4/rpc_server/wscript_build

index a5c1c1d9a2c..18ec5aef894 100644

--- a/source4/rpc_server/wscript_build

+++ b/source4/rpc_server/wscript_build

@@ -124,7 +124,7 @@ bld.SAMBA_MODULE('dcerpc_backupkey',

 		 autoproto='backupkey/proto.h',

 		 subsystem='dcerpc_server',

 		 init_function='dcerpc_server_backupkey_init',

-		 deps='samdb DCERPC_COMMON NDR_BACKUPKEY RPC_NDR_BACKUPKEY gnutls',

+		 deps='samdb DCERPC_COMMON NDR_BACKUPKEY RPC_NDR_BACKUPKEY gnutls GNUTLS_HELPERS',

 		 )

-- 

2.23.0