Revert "Revert "s3:rpc_client: implement DCERPC_BIND_TIME_PROTECT_ALL_PDUS""

This reverts commit 679fd3c8e2f26cf961e01ca56a39a373b6cf9b30.

diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c
index d1d48af3d42f92b30a8ef724f2d92ce9bf0647a0..2b2ad4a3b96a712774bf29a9f51e305f9e42db24 100644 (file)
--- a/source3/rpc_client/cli_pipe.c
+++ b/source3/rpc_client/cli_pipe.c
@@ -378,6 +378,7 @@ static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
                                                DATA_BLOB *reply_pdu)
 {
        const struct dcerpc_response *r = NULL;
+       const struct dcerpc_fault *f = NULL;
        DATA_BLOB tmp_stub = { .data = NULL };
        NTSTATUS ret;
 
@@ -539,9 +540,11 @@ static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
 
        case DCERPC_PKT_FAULT:
 
+               f = &pkt->u.fault;
+
                ret = dcerpc_verify_ncacn_packet_header(pkt,
                                                DCERPC_PKT_FAULT,
-                                               0, /* max_auth_info */
+                                               f->error_and_verifier.length,
                                                DCERPC_PFC_FLAG_FIRST |
                                                DCERPC_PFC_FLAG_LAST,
                                                DCERPC_PFC_FLAG_DID_NOT_EXECUTE);
@@ -555,6 +558,25 @@ static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
                        return ret;
                }
 
+               if (cli->bind_time_features & DCERPC_BIND_TIME_PROTECT_ALL_PDUS) {
+                       tmp_stub.data = f->error_and_verifier.data;
+                       tmp_stub.length = f->error_and_verifier.length;
+
+                       /* Here's where we deal with incoming sign/seal. */
+                       ret = dcerpc_check_auth(cli->auth, pkt,
+                                               &tmp_stub,
+                                               DCERPC_FAULT_LENGTH,
+                                               pdu);
+                       if (!NT_STATUS_IS_OK(ret)) {
+                               DEBUG(1, (__location__ ": Connection to %s got "
+                                         "an unprotected FAULT: %s\n",
+                                         rpccli_pipe_txt(talloc_tos(), cli),
+                                         nt_errstr(ret)));
+                               NDR_PRINT_DEBUG(ncacn_packet, pkt);
+                               return ret;
+                       }
+               }
+
                DEBUG(1, (__location__ ": RPC fault code %s received "
                          "from %s!\n",
                          dcerpc_errstr(talloc_tos(),
@@ -1141,7 +1163,8 @@ static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
        struct ndr_syntax_id bind_time_features = dcerpc_construct_bind_time_features(
                        DCERPC_BIND_TIME_SECURITY_CONTEXT_MULTIPLEXING |
                        DCERPC_BIND_TIME_KEEP_CONNECTION_ON_ORPHAN |
-                       DCERPC_BIND_TIME_SUPPORT_PREAUTH);
+                       DCERPC_BIND_TIME_SUPPORT_PREAUTH |
+                       DCERPC_BIND_TIME_PROTECT_ALL_PDUS);
        struct dcerpc_ctx_list ctx_list[2] = {
                [0] = {
                        .context_id = 0,