libcli:auth: Return WERROR for encode_wkssvc_join_password_buffer()

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14031

Signed-off-by: Andreas Schneider <asn@samba.org>
Reviewed-by: Andrew Bartlett <abartlet@samba.org>

diff --git a/libcli/auth/proto.h b/libcli/auth/proto.h
index 67caaca8c41e65fba489ede04431653b1be0adba..65ee06215dc440311d69b1b9960fb82bf106b658 100644 (file)
--- a/libcli/auth/proto.h
+++ b/libcli/auth/proto.h
@@ -207,10 +207,10 @@ bool set_pw_in_buffer(uint8_t buffer[516], const DATA_BLOB *password);
 bool extract_pw_from_buffer(TALLOC_CTX *mem_ctx, 
                            uint8_t in_buffer[516], DATA_BLOB *new_pass);
 struct wkssvc_PasswordBuffer;
-void encode_wkssvc_join_password_buffer(TALLOC_CTX *mem_ctx,
-                                       const char *pwd,
-                                       DATA_BLOB *session_key,
-                                       struct wkssvc_PasswordBuffer **pwd_buf);
+WERROR encode_wkssvc_join_password_buffer(TALLOC_CTX *mem_ctx,
+                                         const char *pwd,
+                                         DATA_BLOB *session_key,
+                                         struct wkssvc_PasswordBuffer **pwd_buf);
 WERROR decode_wkssvc_join_password_buffer(TALLOC_CTX *mem_ctx,
                                          struct wkssvc_PasswordBuffer *pwd_buf,
                                          DATA_BLOB *session_key,

diff --git a/libcli/auth/smbencrypt.c b/libcli/auth/smbencrypt.c
index 793012553b28ff44bd60798c0e05935b2ee074bf..745f47999cdb09694f4e0404644a0af915b64d7a 100644 (file)
--- a/libcli/auth/smbencrypt.c
+++ b/libcli/auth/smbencrypt.c
@@ -965,10 +965,10 @@ bool extract_pw_from_buffer(TALLOC_CTX *mem_ctx,
  * buffer), calling MD5Update() first with session_key and then with confounder
  * (vice versa in samr) - Guenther */
 
-void encode_wkssvc_join_password_buffer(TALLOC_CTX *mem_ctx,
-                                       const char *pwd,
-                                       DATA_BLOB *session_key,
-                                       struct wkssvc_PasswordBuffer **pwd_buf)
+WERROR encode_wkssvc_join_password_buffer(TALLOC_CTX *mem_ctx,
+                                         const char *pwd,
+                                         DATA_BLOB *session_key,
+                                         struct wkssvc_PasswordBuffer **pwd_buf)
 {
        uint8_t buffer[516];
        gnutls_hash_hd_t hash_hnd = NULL;
@@ -976,11 +976,12 @@ void encode_wkssvc_join_password_buffer(TALLOC_CTX *mem_ctx,
        DATA_BLOB confounded_session_key;
        int confounder_len = 8;
        uint8_t confounder[8];
+       WERROR werr;
        int rc;
 
        my_pwd_buf = talloc_zero(mem_ctx, struct wkssvc_PasswordBuffer);
        if (!my_pwd_buf) {
-               return;
+               return WERR_NOT_ENOUGH_MEMORY;
        }
 
        confounded_session_key = data_blob_talloc(mem_ctx, NULL, 16);
@@ -991,17 +992,23 @@ void encode_wkssvc_join_password_buffer(TALLOC_CTX *mem_ctx,
 
        rc = gnutls_hash_init(&hash_hnd, GNUTLS_DIG_MD5);
        if (rc < 0) {
+               werr = gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);
+
                goto out;
        }
 
        rc = gnutls_hash(hash_hnd, session_key->data, session_key->length);
        if (rc < 0) {
                gnutls_hash_deinit(hash_hnd, NULL);
+               werr = gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);
+
                goto out;
        }
        rc = gnutls_hash(hash_hnd, confounder, confounder_len);
        if (rc < 0) {
                gnutls_hash_deinit(hash_hnd, NULL);
+               werr = gnutls_error_to_werror(rc, WERR_INTERNAL_ERROR);
+
                goto out;
        }
        gnutls_hash_deinit(hash_hnd, confounded_session_key.data);
@@ -1017,8 +1024,9 @@ void encode_wkssvc_join_password_buffer(TALLOC_CTX *mem_ctx,
 
        *pwd_buf = my_pwd_buf;
 
+       werr = WERR_OK;
 out:
-       return;
+       return werr;
 }
 
 WERROR decode_wkssvc_join_password_buffer(TALLOC_CTX *mem_ctx,

diff --git a/source3/lib/netapi/joindomain.c b/source3/lib/netapi/joindomain.c
index ff2154ba803ec20e3085d9780c738a9e04b748b6..387c517c1be21c99212c0f91c71adb079764b3d2 100644 (file)
--- a/source3/lib/netapi/joindomain.c
+++ b/source3/lib/netapi/joindomain.c
@@ -137,10 +137,13 @@ WERROR NetJoinDomain_r(struct libnetapi_ctx *ctx,
                        goto done;
                }
 
-               encode_wkssvc_join_password_buffer(ctx,
-                                                  r->in.password,
-                                                  &session_key,
-                                                  &encrypted_password);
+               werr = encode_wkssvc_join_password_buffer(ctx,
+                                                         r->in.password,
+                                                         &session_key,
+                                                         &encrypted_password);
+               if (!W_ERROR_IS_OK(werr)) {
+                       goto done;
+               }
        }
 
        old_timeout = rpccli_set_timeout(pipe_cli, 600000);
@@ -279,10 +282,13 @@ WERROR NetUnjoinDomain_r(struct libnetapi_ctx *ctx,
                        goto done;
                }
 
-               encode_wkssvc_join_password_buffer(ctx,
-                                                  r->in.password,
-                                                  &session_key,
-                                                  &encrypted_password);
+               werr = encode_wkssvc_join_password_buffer(ctx,
+                                                         r->in.password,
+                                                         &session_key,
+                                                         &encrypted_password);
+               if (!W_ERROR_IS_OK(werr)) {
+                       goto done;
+               }
        }
 
        old_timeout = rpccli_set_timeout(pipe_cli, 60000);
@@ -481,10 +487,13 @@ WERROR NetGetJoinableOUs_r(struct libnetapi_ctx *ctx,
                        goto done;
                }
 
-               encode_wkssvc_join_password_buffer(ctx,
-                                                  r->in.password,
-                                                  &session_key,
-                                                  &encrypted_password);
+               werr = encode_wkssvc_join_password_buffer(ctx,
+                                                         r->in.password,
+                                                         &session_key,
+                                                         &encrypted_password);
+               if (!W_ERROR_IS_OK(werr)) {
+                       goto done;
+               }
        }
 
        status = dcerpc_wkssvc_NetrGetJoinableOus2(b, talloc_tos(),
@@ -534,10 +543,13 @@ WERROR NetRenameMachineInDomain_r(struct libnetapi_ctx *ctx,
                        goto done;
                }
 
-               encode_wkssvc_join_password_buffer(ctx,
-                                                  r->in.password,
-                                                  &session_key,
-                                                  &encrypted_password);
+               werr = encode_wkssvc_join_password_buffer(ctx,
+                                                         r->in.password,
+                                                         &session_key,
+                                                         &encrypted_password);
+               if (!W_ERROR_IS_OK(werr)) {
+                       goto done;
+               }
        }
 
        status = dcerpc_wkssvc_NetrRenameMachineInDomain2(b, talloc_tos(),

diff --git a/source4/torture/rpc/wkssvc.c b/source4/torture/rpc/wkssvc.c
index c98ac92b39b338729a76daa183011747092c24ee..4bc1f9cd0c7f2883d36121894d334525667b4c72 100644 (file)
--- a/source4/torture/rpc/wkssvc.c
+++ b/source4/torture/rpc/wkssvc.c
@@ -1199,6 +1199,7 @@ static bool test_NetrJoinDomain2(struct torture_context *tctx,
        enum wkssvc_NetJoinStatus join_status;
        const char *join_name = NULL;
        WERROR expected_err;
+       WERROR werr;
        DATA_BLOB session_key;
        struct dcerpc_binding_handle *b = p->binding_handle;
 
@@ -1240,8 +1241,13 @@ static bool test_NetrJoinDomain2(struct torture_context *tctx,
                return false;
        }
 
-       encode_wkssvc_join_password_buffer(tctx, domain_admin_password,
-                                          &session_key, &pwd_buf);
+       werr = encode_wkssvc_join_password_buffer(tctx,
+                                                 domain_admin_password,
+                                                 &session_key,
+                                                 &pwd_buf);
+       if (!W_ERROR_IS_OK(werr)) {
+               return false;
+       }
 
        r.in.server_name = dcerpc_server_name(p);
        r.in.domain_name = domain_name;
@@ -1284,6 +1290,7 @@ static bool test_NetrUnjoinDomain2(struct torture_context *tctx,
        enum wkssvc_NetJoinStatus join_status;
        const char *join_name = NULL;
        WERROR expected_err;
+       WERROR werr;
        DATA_BLOB session_key;
        struct dcerpc_binding_handle *b = p->binding_handle;
 
@@ -1322,8 +1329,13 @@ static bool test_NetrUnjoinDomain2(struct torture_context *tctx,
                return false;
        }
 
-       encode_wkssvc_join_password_buffer(tctx, domain_admin_password,
-                                          &session_key, &pwd_buf);
+       werr = encode_wkssvc_join_password_buffer(tctx,
+                                                 domain_admin_password,
+                                                 &session_key,
+                                                 &pwd_buf);
+       if (!W_ERROR_IS_OK(werr)) {
+               return false;
+       }
 
        r.in.server_name = dcerpc_server_name(p);
        r.in.account = domain_admin_account;