From b6efe6b119b0c11314a324e8a2cf96fb74a9c983 Mon Sep 17 00:00:00 2001

From: Sam Morris <sam@robots.org.uk>

Date: Tue, 6 Apr 2021 18:42:19 +0100

Subject: [PATCH 1/6] responder/common/responder_packet: handle large service

 tickets

Resolves: https://github.com/SSSD/sssd/issues/5568

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>

---

 src/responder/common/responder_packet.c | 11 +++++++++++

 src/responder/common/responder_packet.h |  1 +

 2 files changed, 12 insertions(+)

diff --git a/src/responder/common/responder_packet.c b/src/responder/common/responder_packet.c

index f56d92276..d091332b0 100644

--- a/src/responder/common/responder_packet.c

+++ b/src/responder/common/responder_packet.c

@@ -229,6 +229,17 @@ int sss_packet_recv(struct sss_packet *packet, int fd)

             if (ret != EOK) {

                 return ret;

             }

+	/* Kerberos tickets can get pretty big; since Windows Server 2012, the

+	 * limit is 48 KiB!

+	 */

+	} else if ((sss_packet_get_cmd(packet) == SSS_GSSAPI_SEC_CTX)

+                && packet->memsize < SSS_GSSAPI_PACKET_MAX_RECV_SIZE

+                && new_len < SSS_GSSAPI_PACKET_MAX_RECV_SIZE) {

+            sss_packet_set_len(packet, 0);

+            ret = sss_packet_grow(packet, new_len);

+            if (ret != EOK) {

+                return ret;

+            }

         } else {

             return EINVAL;

         }

diff --git a/src/responder/common/responder_packet.h b/src/responder/common/responder_packet.h

index 509a22a9a..70bf1e8d3 100644

--- a/src/responder/common/responder_packet.h

+++ b/src/responder/common/responder_packet.h

@@ -26,6 +26,7 @@

 #define SSS_PACKET_MAX_RECV_SIZE 1024

 #define SSS_CERT_PACKET_MAX_RECV_SIZE ( 10 * SSS_PACKET_MAX_RECV_SIZE )

+#define SSS_GSSAPI_PACKET_MAX_RECV_SIZE ( SSS_PACKET_MAX_RECV_SIZE + 48 * 1024 )

 struct sss_packet;

-- 

2.26.3

From c6a76283580c25ff78b36b8b23efdabbdb3a2cc1 Mon Sep 17 00:00:00 2001

From: Sam Morris <sam@robots.org.uk>

Date: Wed, 7 Apr 2021 14:21:34 +0100

Subject: [PATCH 2/6] responder/common/responder_packet: reduce duplication of

 code that handles larger-than-normal packets

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>

---

 src/responder/common/responder_packet.c | 40 +++++++++++++------------

 1 file changed, 21 insertions(+), 19 deletions(-)

diff --git a/src/responder/common/responder_packet.c b/src/responder/common/responder_packet.c

index d091332b0..523c9ddd4 100644

--- a/src/responder/common/responder_packet.c

+++ b/src/responder/common/responder_packet.c

@@ -216,25 +216,27 @@ int sss_packet_recv(struct sss_packet *packet, int fd)

     new_len = sss_packet_get_len(packet);

     if (new_len > packet->memsize) {

-        /* Allow certificate based requests to use larger buffer but not

-         * larger than SSS_CERT_PACKET_MAX_RECV_SIZE. Due to the way

-         * sss_packet_grow() works the packet len must be set to '0' first and

-         * then grow to the expected size. */

-        if ((sss_packet_get_cmd(packet) == SSS_NSS_GETNAMEBYCERT

-                    || sss_packet_get_cmd(packet) == SSS_NSS_GETLISTBYCERT)

-                && packet->memsize < SSS_CERT_PACKET_MAX_RECV_SIZE

-                && new_len < SSS_CERT_PACKET_MAX_RECV_SIZE) {

-            sss_packet_set_len(packet, 0);

-            ret = sss_packet_grow(packet, new_len);

-            if (ret != EOK) {

-                return ret;

-            }

-	/* Kerberos tickets can get pretty big; since Windows Server 2012, the

-	 * limit is 48 KiB!

-	 */

-	} else if ((sss_packet_get_cmd(packet) == SSS_GSSAPI_SEC_CTX)

-                && packet->memsize < SSS_GSSAPI_PACKET_MAX_RECV_SIZE

-                && new_len < SSS_GSSAPI_PACKET_MAX_RECV_SIZE) {

+        enum sss_cli_command cmd = sss_packet_get_cmd(packet);

+        size_t max_recv_size;

+

+        /* Allow certain packet types to use a larger buffer. */

+        switch (cmd) {

+        case SSS_NSS_GETNAMEBYCERT:

+        case SSS_NSS_GETLISTBYCERT:

+            max_recv_size = SSS_CERT_PACKET_MAX_RECV_SIZE;

+            break;

+

+        case SSS_GSSAPI_SEC_CTX:

+            max_recv_size = SSS_GSSAPI_PACKET_MAX_RECV_SIZE;

+            break;

+

+        default:

+            max_recv_size = 0;

+        }

+

+        /* Due to the way sss_packet_grow() works, the packet len must be set

+         * to 0 first, and then grown to the expected size. */

+        if (max_recv_size && packet->memsize < max_recv_size && new_len < max_recv_size) {

             sss_packet_set_len(packet, 0);

             ret = sss_packet_grow(packet, new_len);

             if (ret != EOK) {

-- 

2.26.3

From 63f318f73c933dc2cb08cad2f911a52d2281c45b Mon Sep 17 00:00:00 2001

From: Sam Morris <sam@robots.org.uk>

Date: Wed, 7 Apr 2021 14:22:25 +0100

Subject: [PATCH 3/6] responder/common/responder_packet: add debug logging to

 assist with errors caused by overlarge packets

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>

---

 src/responder/common/responder_packet.c | 3 +++

 1 file changed, 3 insertions(+)

diff --git a/src/responder/common/responder_packet.c b/src/responder/common/responder_packet.c

index 523c9ddd4..01a4e640e 100644

--- a/src/responder/common/responder_packet.c

+++ b/src/responder/common/responder_packet.c

@@ -243,6 +243,9 @@ int sss_packet_recv(struct sss_packet *packet, int fd)

                 return ret;

             }

         } else {

+            DEBUG(SSSDBG_OP_FAILURE,

+                "Refusing to read overlarge packet from fd %d (length %zu bytes, cmd %#04x)",

+                    fd, new_len, cmd);

             return EINVAL;

         }

     }

-- 

2.26.3

From 37d331774385b2b871ba76fcdef6ceafd776efce Mon Sep 17 00:00:00 2001

From: Sam Morris <sam@robots.org.uk>

Date: Wed, 7 Apr 2021 14:23:03 +0100

Subject: [PATCH 4/6] responder/common/responder_packet: further increase

 packet size for SSS_GSSAPI_SEC_CTX

Tokens can be 48 KiB in Windows Server 2012. Limiting to 128 KiB

provides extra overhead should that increase in the future.

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>

---

 src/responder/common/responder_packet.h | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/responder/common/responder_packet.h b/src/responder/common/responder_packet.h

index 70bf1e8d3..fd991969b 100644

--- a/src/responder/common/responder_packet.h

+++ b/src/responder/common/responder_packet.h

@@ -26,7 +26,7 @@

 #define SSS_PACKET_MAX_RECV_SIZE 1024

 #define SSS_CERT_PACKET_MAX_RECV_SIZE ( 10 * SSS_PACKET_MAX_RECV_SIZE )

-#define SSS_GSSAPI_PACKET_MAX_RECV_SIZE ( SSS_PACKET_MAX_RECV_SIZE + 48 * 1024 )

+#define SSS_GSSAPI_PACKET_MAX_RECV_SIZE ( 128 * 1024 )

 struct sss_packet;

-- 

2.26.3

From 5c9fa75bd0ffa02e31cbbf19ee68134ed384229a Mon Sep 17 00:00:00 2001

From: Sam Morris <sam@robots.org.uk>

Date: Wed, 7 Apr 2021 19:59:45 +0100

Subject: [PATCH 5/6] responder/common/responder_packet: remove some

 unnecessary checks before growing packet

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>

---

 src/responder/common/responder_packet.c | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/responder/common/responder_packet.c b/src/responder/common/responder_packet.c

index 01a4e640e..c4b38f71b 100644

--- a/src/responder/common/responder_packet.c

+++ b/src/responder/common/responder_packet.c

@@ -236,7 +236,7 @@ int sss_packet_recv(struct sss_packet *packet, int fd)

         /* Due to the way sss_packet_grow() works, the packet len must be set

          * to 0 first, and then grown to the expected size. */

-        if (max_recv_size && packet->memsize < max_recv_size && new_len < max_recv_size) {

+        if (new_len < max_recv_size) {

             sss_packet_set_len(packet, 0);

             ret = sss_packet_grow(packet, new_len);

             if (ret != EOK) {

-- 

2.26.3

From b87619f9a917d6ed9ecdb5360c4bf242dce8e372 Mon Sep 17 00:00:00 2001

From: Sam Morris <sam@robots.org.uk>

Date: Thu, 8 Apr 2021 19:09:33 +0100

Subject: [PATCH 6/6] responder/common/responder_packet: allow packets of max

 size

Reviewed-by: Alexey Tikhonov <atikhono@redhat.com>

---

 src/responder/common/responder_packet.c | 2 +-

 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/responder/common/responder_packet.c b/src/responder/common/responder_packet.c

index c4b38f71b..f2223c665 100644

--- a/src/responder/common/responder_packet.c

+++ b/src/responder/common/responder_packet.c

@@ -236,7 +236,7 @@ int sss_packet_recv(struct sss_packet *packet, int fd)

         /* Due to the way sss_packet_grow() works, the packet len must be set

          * to 0 first, and then grown to the expected size. */

-        if (new_len < max_recv_size) {

+        if (new_len <= max_recv_size) {

             sss_packet_set_len(packet, 0);

             ret = sss_packet_grow(packet, new_len);

             if (ret != EOK) {

-- 

2.26.3