auth/ntlmssp: make sure we return INVALID_PARAMETER for NTLMv2_RESPONSE parsing errors

BUG: https://bugzilla.samba.org/show_bug.cgi?id=14932

Signed-off-by: Stefan Metzmacher <metze@samba.org>
Reviewed-by: Jeremy Allison <jra@samba.org>
Autobuild-User(master): Jeremy Allison <jra@samba.org>
Autobuild-Date(master): Tue Jan  4 20:57:41 UTC 2022 on sn-devel-184

diff --git a/auth/ntlmssp/ntlmssp_server.c b/auth/ntlmssp/ntlmssp_server.c
index 939aa0ef4aa5d6ad1623ff9f1a5e0aae62ea82cd..ce78af1d32d08cf0d009f943c3ed9f8e214c6db6 100644 (file)
--- a/auth/ntlmssp/ntlmssp_server.c
+++ b/auth/ntlmssp/ntlmssp_server.c
@@ -532,6 +532,14 @@ static NTSTATUS ntlmssp_server_preauth(struct gensec_security *gensec_security,
                                        (ndr_pull_flags_fn_t)ndr_pull_NTLMv2_RESPONSE);
                if (!NDR_ERR_CODE_IS_SUCCESS(err)) {
                        nt_status = ndr_map_error2ntstatus(err);
+                       if (NT_STATUS_EQUAL(nt_status, NT_STATUS_BUFFER_TOO_SMALL)) {
+                               /*
+                                * Note that invalid blobs should result in
+                                * INVALID_PARAMETER, as demonstrated by
+                                * smb2.session.ntlmssp_bug14932
+                                */
+                               nt_status = NT_STATUS_INVALID_PARAMETER;
+                       }
                        DEBUG(1,("%s: failed to parse NTLMv2_RESPONSE of length %zu for "
                                 "user=[%s] domain=[%s] workstation=[%s] - %s %s\n",
                                 __func__, ntlmssp_state->nt_resp.length,

diff --git a/selftest/knownfail.d/smb2.session.tmp b/selftest/knownfail.d/smb2.session.tmp
deleted file mode 100644 (file)
index ef6a0d5..0000000
--- a/selftest/knownfail.d/smb2.session.tmp
+++ /dev/null
@@ -1,5 +0,0 @@
-^samba3.smb2.session.plain.ntlmssp_bug14932\(nt4_dc\)
-^samba3.smb2.session.enc.ntlmssp_bug14932\(nt4_dc\)
-^samba3.smb2.session.ntlm.ntlmssp_bug14932\(ad_dc\)
-^samba3.smb2.session.krb5.ntlmssp_bug14932\(ad_dc\)
-^samba3.smb2.session.krb5.ntlmssp_bug14932\(ad_member_idmap_rid\)