|
 |
801d0a |
From 54db478fccac0ac3b0cc63f5eacfeae23bc26d4a Mon Sep 17 00:00:00 2001
|
|
|
801d0a |
From: Alexander Bokovoy <ab@samba.org>
|
|
|
801d0a |
Date: Tue, 7 Jan 2020 19:25:53 +0200
|
|
|
801d0a |
Subject: [PATCH 1/2] s3-rpcserver: fix security level check for
|
|
|
801d0a |
DsRGetForestTrustInformation
|
|
|
801d0a |
|
|
|
801d0a |
Harmonize _netr_DsRGetForestTrustInformation with source4/ logic which
|
|
|
801d0a |
didn't change since DCE RPC channel refactoring.
|
|
|
801d0a |
|
|
|
801d0a |
With the current code we return RPC faul as can be seen in the logs:
|
|
|
801d0a |
|
|
|
801d0a |
2019/12/11 17:12:55.463081, 1, pid=20939, effective(1284200000, 1284200000), real(1284200000, 0), class=rpc_parse] ../librpc/ndr/ndr.c:471(ndr_print_function_debug)
|
|
|
801d0a |
netr_DsRGetForestTrustInformation: struct netr_DsRGetForestTrustInformation
|
|
|
801d0a |
in: struct netr_DsRGetForestTrustInformation
|
|
|
801d0a |
server_name : *
|
|
|
801d0a |
server_name : '\\some-dc.example.com'
|
|
|
801d0a |
trusted_domain_name : NULL
|
|
|
801d0a |
flags : 0x00000000 (0)
|
|
|
801d0a |
[2019/12/11 17:12:55.463122, 4, pid=20939, effective(1284200000, 1284200000), real(1284200000, 0), class=rpc_srv] ../source3/rpc_server/srv_pipe.c:1561(api_rpcTNP)
|
|
|
801d0a |
api_rpcTNP: fault(5) return.
|
|
|
801d0a |
|
|
|
801d0a |
This is due to this check in processing a request:
|
|
|
801d0a |
if (!(p->pipe_bound && (p->auth.auth_type != DCERPC_AUTH_TYPE_NONE)
|
|
|
801d0a |
&& (p->auth.auth_level != DCERPC_AUTH_LEVEL_NONE))) {
|
|
|
801d0a |
p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
|
|
|
801d0a |
return WERR_ACCESS_DENIED;
|
|
|
801d0a |
}
|
|
|
801d0a |
|
|
|
801d0a |
and since we get AuthZ response,
|
|
|
801d0a |
|
|
|
801d0a |
Successful AuthZ: [netlogon,ncacn_np] user [EXAMPLE]\[admin] [S-1-5-21-1234567-890123456-500] at [Wed, 11 Dec 2019 17:12:55.461164 UTC]
|
|
|
801d0a |
Remote host [ipv4:Y.Y.Y.Y:59017] local host [ipv4:X.X.X.X:445]
|
|
|
801d0a |
[2019/12/11 17:12:55.461584, 4, pid=20939, effective(0, 0), real(0, 0)] ../lib/audit_logging/audit_logging.c:141(audit_log_json)
|
|
|
801d0a |
JSON Authorization: {"timestamp": "2019-12-11T17:12:55.461491+0000",
|
|
|
801d0a |
"type": "Authorization", "Authorization": {"version": {"major": 1, "minor": 1},
|
|
|
801d0a |
"localAddress": "ipv4:X.X.X.X:445", "remoteAddress": "ipv4:Y.Y.Y.Y:59017",
|
|
|
801d0a |
"serviceDescription": "netlogon", "authType": "ncacn_np",
|
|
|
801d0a |
"domain": "EXAMPLE", "account": "admin", "sid": "S-1-5-21-1234567-890123456-500",
|
|
|
801d0a |
"sessionId": "c5a2386f-f2cc-4241-9a9e-d104cf5859d5", "logonServer": "SOME-DC",
|
|
|
801d0a |
"transportProtection": "SMB", "accountFlags": "0x00000010"}}
|
|
|
801d0a |
|
|
|
801d0a |
this means we are actually getting anonymous DCE/RPC access to netlogon
|
|
|
801d0a |
on top of authenticated SMB connection. In such case we have exactly
|
|
|
801d0a |
auth_type set to DCERPC_AUTH_TYPE_NONE and auth_level set to
|
|
|
801d0a |
DCERPC_AUTH_LEVEL_NONE in the pipe->auth. Thus, returning an error.
|
|
|
801d0a |
|
|
|
801d0a |
Update the code to follow the same security level check as in s4 variant
|
|
|
801d0a |
of the call.
|
|
|
801d0a |
|
|
|
801d0a |
Signed-off-by: Alexander Bokovoy <ab@samba.org>
|
|
|
801d0a |
---
|
|
|
801d0a |
source3/rpc_server/netlogon/srv_netlog_nt.c | 6 +++---
|
|
|
801d0a |
1 file changed, 3 insertions(+), 3 deletions(-)
|
|
|
801d0a |
|
|
|
801d0a |
diff --git a/source3/rpc_server/netlogon/srv_netlog_nt.c b/source3/rpc_server/netlogon/srv_netlog_nt.c
|
|
|
801d0a |
index cbbf9feedc7..52b17c10e61 100644
|
|
|
801d0a |
--- a/source3/rpc_server/netlogon/srv_netlog_nt.c
|
|
|
801d0a |
+++ b/source3/rpc_server/netlogon/srv_netlog_nt.c
|
|
|
801d0a |
@@ -2451,10 +2451,10 @@ WERROR _netr_DsRGetForestTrustInformation(struct pipes_struct *p,
|
|
|
801d0a |
{
|
|
|
801d0a |
NTSTATUS status;
|
|
|
801d0a |
struct lsa_ForestTrustInformation *info, **info_ptr;
|
|
|
801d0a |
+ enum security_user_level security_level;
|
|
|
801d0a |
|
|
|
801d0a |
- if (!(p->pipe_bound && (p->auth.auth_type != DCERPC_AUTH_TYPE_NONE)
|
|
|
801d0a |
- && (p->auth.auth_level != DCERPC_AUTH_LEVEL_NONE))) {
|
|
|
801d0a |
- p->fault_state = DCERPC_FAULT_ACCESS_DENIED;
|
|
|
801d0a |
+ security_level = security_session_user_level(p->session_info, NULL);
|
|
|
801d0a |
+ if (security_level < SECURITY_USER) {
|
|
|
801d0a |
return WERR_ACCESS_DENIED;
|
|
|
801d0a |
}
|
|
|
801d0a |
|
|
|
801d0a |
--
|
|
|
801d0a |
2.24.1
|
|
|
801d0a |
|