Skip to content

msrpce: commit only an accepted presentation context - #5139

Open
KernelClint wants to merge 3 commits into
secdev:masterfrom
KernelClint:msrpce-accepted-context-only
Open

msrpce: commit only an accepted presentation context#5139
KernelClint wants to merge 3 commits into
secdev:masterfrom
KernelClint:msrpce-accepted-context-only

Conversation

@KernelClint

Copy link
Copy Markdown
Contributor

A DCE/RPC bind proposes one or more presentation contexts, each naming an interface (the abstract
syntax) and an encoding (the transfer syntax). The server accepts or rejects each one independently
and says so in its response.

Scapy selects the session's interface from the bind contexts at
scapy/layers/dcerpc.py:2847-2864
without regard to the transfer syntax, while
scapy/layers/msrpce/rpcserver.py:326-372
decides acceptance separately. A bind proposing an unsupported transfer syntax is answered with a
provider rejection, and the interface it named is nonetheless left selected on the session — so a
following request reaches that interface's registered handler.

The change tracks which context was actually accepted and commits only that one, restoring the
previous interface when none was:

+        previous_interface = self.session.rpc_bind_interface
+        previous_interface_is_com = self.session.rpc_bind_is_com
...
+                if accepted_context is None:
+                    self.session.rpc_bind_interface = previous_interface
+                    self.session.rpc_bind_is_com = previous_interface_is_com

A bind that proposes a supported transfer syntax behaves exactly as before; the regression keeps the
ordinary NDR 2.0 path as its control.

The added regression sends a bind with an unsupported transfer syntax, asserts the rejection, then
sends a request and asserts the handler is not reached. Without the source change it fails.

Performance was measured on one computer, before and after the fix: a normal bind and call took
116.1 µs before and 116.4 µs after. Repeat runs moved by about 2%, so that difference is smaller
than the test can distinguish.

@codecov

codecov Bot commented Sep 1, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 80.64%. Comparing base (b3bbcc8) to head (1dd221a).

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #5139   +/-   ##
=======================================
  Coverage   80.63%   80.64%           
=======================================
  Files         390      390           
  Lines       96936    96948   +12     
=======================================
+ Hits        78168    78185   +17     
+ Misses      18768    18763    -5     
Files with missing lines Coverage Δ
scapy/layers/msrpce/rpcserver.py 87.00% <100.00%> (+1.36%) ⬆️

... and 5 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

The test relied on the name already being present in the campaign namespace.
That holds locally but not in CI, where the class reaches the decorator without
its interface registration and DCERPC_Server.answer() rejects it.

AI-Assisted: yes (GPT-5.6-Cyber)
register_dcerpc_interface() returns early when the interface is already
registered, before it binds opnum and intf onto the request classes. A second
import of the module therefore leaves its module-level names unbound, which is
what CI hit and a local run did not. Reading the classes back out of the
registry gives the objects that were bound.

AI-Assisted: yes (GPT-5.6-Cyber)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant