Add some new authentication error codes for specific errors.

This might make it a bit cleaner to handle new authentication types;
clients will still have to check for PCAP_ERR_AUTH with particular error
strings to detect "that authentication type isn't supported by the
server", but at least they can check first for
PCAP_ERR_AUTH_TYPE_NOTSUP.

Also add PCAP_ERR_AUTH_FAILED for authentication failures and
PCAP_ERR_TLS_REQUIRED for "the server requires TLS".  PCAP_ERR_AUTH is
used for all other errors, including internal errors.

While we're at it, fix one case where the wrong error code was returned
for "set sampling" request errors.

diff --git a/rpcap-protocol.h b/rpcap-protocol.h
index 0c8bf24db0e120057f7cb84146ce9e3d0d56eb85..07f02cc7c68564ca13541b1f43ebc5eee5573bfc 100644 (file)
--- a/rpcap-protocol.h
+++ b/rpcap-protocol.h
@@ -385,23 +385,26 @@ struct rpcap_sampling
  * These values are used in messages sent over the network, and MUST
  * not be changed.
  */
-#define PCAP_ERR_NETW          1       /* Network error */
-#define PCAP_ERR_INITTIMEOUT   2       /* The RPCAP initial timeout has expired */
-#define PCAP_ERR_AUTH          3       /* Generic authentication error */
-#define PCAP_ERR_FINDALLIF     4       /* Generic findalldevs error */
-#define PCAP_ERR_NOREMOTEIF    5       /* The findalldevs was ok, but the remote end had no interfaces to list */
-#define PCAP_ERR_OPEN          6       /* Generic pcap_open error */
-#define PCAP_ERR_UPDATEFILTER  7       /* Generic updatefilter error */
-#define PCAP_ERR_GETSTATS      8       /* Generic pcap_stats error */
-#define PCAP_ERR_READEX                9       /* Generic pcap_next_ex error */
-#define PCAP_ERR_HOSTNOAUTH    10      /* The host is not authorized to connect to this server */
-#define PCAP_ERR_REMOTEACCEPT  11      /* Generic pcap_remoteaccept error */
-#define PCAP_ERR_STARTCAPTURE  12      /* Generic pcap_startcapture error */
-#define PCAP_ERR_ENDCAPTURE    13      /* Generic pcap_endcapture error */
-#define PCAP_ERR_RUNTIMETIMEOUT        14      /* The RPCAP run-time timeout has expired */
-#define PCAP_ERR_SETSAMPLING   15      /* Error during the settings of sampling parameters */
-#define PCAP_ERR_WRONGMSG      16      /* The other end endpoint sent a message which has not been recognized */
-#define PCAP_ERR_WRONGVER      17      /* The other end endpoint has a version number that is not compatible with our */
+#define PCAP_ERR_NETW                  1       /* Network error */
+#define PCAP_ERR_INITTIMEOUT           2       /* The RPCAP initial timeout has expired */
+#define PCAP_ERR_AUTH                  3       /* Generic authentication error */
+#define PCAP_ERR_FINDALLIF             4       /* Generic findalldevs error */
+#define PCAP_ERR_NOREMOTEIF            5       /* The findalldevs was ok, but the remote end had no interfaces to list */
+#define PCAP_ERR_OPEN                  6       /* Generic pcap_open error */
+#define PCAP_ERR_UPDATEFILTER          7       /* Generic updatefilter error */
+#define PCAP_ERR_GETSTATS              8       /* Generic pcap_stats error */
+#define PCAP_ERR_READEX                        9       /* Generic pcap_next_ex error */
+#define PCAP_ERR_HOSTNOAUTH            10      /* The host is not authorized to connect to this server */
+#define PCAP_ERR_REMOTEACCEPT          11      /* Generic pcap_remoteaccept error */
+#define PCAP_ERR_STARTCAPTURE          12      /* Generic pcap_startcapture error */
+#define PCAP_ERR_ENDCAPTURE            13      /* Generic pcap_endcapture error */
+#define PCAP_ERR_RUNTIMETIMEOUT                14      /* The RPCAP run-time timeout has expired */
+#define PCAP_ERR_SETSAMPLING           15      /* Error during the settings of sampling parameters */
+#define PCAP_ERR_WRONGMSG              16      /* The other end endpoint sent a message which has not been recognized */
+#define PCAP_ERR_WRONGVER              17      /* The other end endpoint has a version number that is not compatible with our */
+#define PCAP_ERR_AUTH_FAILED           18      /* The user couldn't be authenticated */
+#define PCAP_ERR_TLS_REQUIRED          19      /* The server requires TLS to connect */
+#define PCAP_ERR_AUTH_TYPE_NOTSUP      20      /* The authentication type isn't supported */
 
 /*
  * \brief Buffer used by socket functions to send-receive packets.

diff --git a/rpcapd/daemon.c b/rpcapd/daemon.c
index b7059b83dd12f1a4b38ccb50169b6b143982b0b7..ab1a6a009e71de39a14510ba1513ea96167dd076 100644 (file)
--- a/rpcapd/daemon.c
+++ b/rpcapd/daemon.c
@@ -312,8 +312,8 @@ daemon_serviceloop(SOCKET sockctrl, int isactive, char *passiveClients,
                        // that we require TLS.
                        //
                        if (rpcap_senderror(sockctrl, NULL, header.ver,
-                           PCAP_ERR_AUTH, "TLS is required by this server",
-                           errbuf) == -1)
+                           PCAP_ERR_TLS_REQUIRED,
+                           "TLS is required by this server", errbuf) == -1)
                        {
                                // That failed; log a message and give up.
                                rpcapd_log(LOGPRIO_ERROR, "Send to client failed: %s", errbuf);
@@ -1222,8 +1222,16 @@ daemon_msg_auth_req(struct daemon_slpars *pars, uint32 plen)
                        if (!pars->nullAuthAllowed)
                        {
                                // Send the client an error reply.
-                               pcap_snprintf(errmsgbuf, PCAP_ERRBUF_SIZE, "Authentication failed; NULL authentication not permitted.");
-                               goto error;
+                               pcap_snprintf(errmsgbuf, PCAP_ERRBUF_SIZE,
+                                   "Authentication failed; NULL authentication not permitted.");
+                               if (rpcap_senderror(pars->sockctrl, pars->ssl,
+                                   0, PCAP_ERR_AUTH_FAILED, errmsgbuf, errbuf) == -1)
+                               {
+                                       // That failed; log a message and give up.
+                                       rpcapd_log(LOGPRIO_ERROR, "Send to client failed: %s", errbuf);
+                                       return -1;
+                               }
+                               goto error_noreply;
                        }
                        break;
                }
@@ -1287,7 +1295,7 @@ daemon_msg_auth_req(struct daemon_slpars *pars, uint32 plen)
                                free(username);
                                free(passwd);
                                if (rpcap_senderror(pars->sockctrl, pars->ssl,
-                                   0, PCAP_ERR_AUTH, errmsgbuf, errbuf) == -1)
+                                   0, PCAP_ERR_AUTH_FAILED, errmsgbuf, errbuf) == -1)
                                {
                                        // That failed; log a message and give up.
                                        rpcapd_log(LOGPRIO_ERROR, "Send to client failed: %s", errbuf);
@@ -1314,8 +1322,16 @@ daemon_msg_auth_req(struct daemon_slpars *pars, uint32 plen)
                        }
 
                default:
-                       pcap_snprintf(errmsgbuf, PCAP_ERRBUF_SIZE, "Authentication type not recognized.");
-                       goto error;
+                       pcap_snprintf(errmsgbuf, PCAP_ERRBUF_SIZE,
+                           "Authentication type not recognized.");
+                       if (rpcap_senderror(pars->sockctrl, pars->ssl,
+                           0, PCAP_ERR_AUTH_TYPE_NOTSUP, errmsgbuf, errbuf) == -1)
+                       {
+                               // That failed; log a message and give up.
+                               rpcapd_log(LOGPRIO_ERROR, "Send to client failed: %s", errbuf);
+                               return -1;
+                       }
+                       goto error_noreply;
        }
 
        // The authentication succeeded; let the client know.
@@ -2326,7 +2342,7 @@ daemon_msg_setsampling_req(uint8 ver, struct daemon_slpars *pars, uint32 plen,
        return 0;
 
 error:
-       if (rpcap_senderror(pars->sockctrl, pars->ssl, ver, PCAP_ERR_AUTH,
+       if (rpcap_senderror(pars->sockctrl, pars->ssl, ver, PCAP_ERR_SETSAMPLING,
            errmsgbuf, errbuf) == -1)
        {
                // That failed; log a message and give up.