s4:rpc_server: generate the correct error when we got an invalid auth_pad_length...

[samba.git] / source4 / rpc_server / dcesrv_auth.c

diff --git a/source4/rpc_server/dcesrv_auth.c b/source4/rpc_server/dcesrv_auth.c
index 802876b2da7062a17bc43c363fdfd063b68e6b0c..74a62dfa9b756ee9aed7d08d734ff0847a0657f7 100644 (file)
--- a/source4/rpc_server/dcesrv_auth.c
+++ b/source4/rpc_server/dcesrv_auth.c
@@ -56,6 +56,12 @@ bool dcesrv_auth_bind(struct dcesrv_call_state *call)
                                          &call->in_auth_info,
                                          NULL, true);
        if (!NT_STATUS_IS_OK(status)) {
+               /*
+                * This will cause a
+                * DCERPC_BIND_NAK_REASON_PROTOCOL_VERSION_NOT_SUPPORTED
+                * in the caller
+                */
+               call->fault_code = DCERPC_NCA_S_PROTO_ERROR;
                return false;
        }
 
@@ -257,6 +263,11 @@ bool dcesrv_auth_auth3(struct dcesrv_call_state *call)
        status = dcerpc_pull_auth_trailer(pkt, call, &pkt->u.auth3.auth_info,
                                          &call->in_auth_info, NULL, true);
        if (!NT_STATUS_IS_OK(status)) {
+               /*
+                * Windows returns DCERPC_NCA_S_FAULT_REMOTE_NO_MEMORY
+                * instead of DCERPC_NCA_S_PROTO_ERROR.
+                */
+               call->fault_code = DCERPC_NCA_S_FAULT_REMOTE_NO_MEMORY;
                return false;
        }
 
@@ -332,6 +343,7 @@ bool dcesrv_auth_alter(struct dcesrv_call_state *call)
        }
 
        if (dce_conn->auth_state.auth_finished) {
+               call->fault_code = DCERPC_FAULT_ACCESS_DENIED;
                return false;
        }
 
@@ -343,6 +355,12 @@ bool dcesrv_auth_alter(struct dcesrv_call_state *call)
        status = dcerpc_pull_auth_trailer(pkt, call, &pkt->u.alter.auth_info,
                                          &call->in_auth_info, NULL, true);
        if (!NT_STATUS_IS_OK(status)) {
+               call->fault_code = DCERPC_NCA_S_PROTO_ERROR;
+               return false;
+       }
+
+       if (call->in_auth_info.auth_type == DCERPC_AUTH_TYPE_NONE) {
+               call->fault_code = DCERPC_FAULT_ACCESS_DENIED;
                return false;
        }