source: branches/samba-3.2.x/source/libsmb/ntlmssp_parse.c

Last change on this file was 133, checked in by Paul Smedley, 17 years ago

Update trunk to 3.2.0pre3
File size: 9.0 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 simple kerberos5/SPNEGO routines
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
6 Copyright (C) Andrew Bartlett 2002-2003
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20*/
21
22#include "includes.h"
23
24/*
25 this is a tiny msrpc packet generator. I am only using this to
26 avoid tying this code to a particular varient of our rpc code. This
27 generator is not general enough for all our rpc needs, its just
28 enough for the spnego/ntlmssp code
29
30 format specifiers are:
31
32 U = unicode string (input is unix string)
33 a = address (input is char *unix_string)
34 (1 byte type, 1 byte length, unicode/ASCII string, all inline)
35 A = ASCII string (input is unix string)
36 B = data blob (pointer + length)
37 b = data blob in header (pointer + length)
38 D
39 d = word (4 bytes)
40 C = constant ascii string
41 */
42bool msrpc_gen(DATA_BLOB *blob,
43 const char *format, ...)
44{
45 int i, n;
46 va_list ap;
47 char *s;
48 uint8 *b;
49 int head_size=0, data_size=0;
50 int head_ofs, data_ofs;
51
52 /* first scan the format to work out the header and body size */
53 va_start(ap, format);
54 for (i=0; format[i]; i++) {
55 switch (format[i]) {
56 case 'U':
57 s = va_arg(ap, char *);
58 head_size += 8;
59 data_size += str_charnum(s) * 2;
60 break;
61 case 'A':
62 s = va_arg(ap, char *);
63 head_size += 8;
64 data_size += str_ascii_charnum(s);
65 break;
66 case 'a':
67 n = va_arg(ap, int);
68 s = va_arg(ap, char *);
69 data_size += (str_charnum(s) * 2) + 4;
70 break;
71 case 'B':
72 b = va_arg(ap, uint8 *);
73 head_size += 8;
74 data_size += va_arg(ap, int);
75 break;
76 case 'b':
77 b = va_arg(ap, uint8 *);
78 head_size += va_arg(ap, int);
79 break;
80 case 'd':
81 n = va_arg(ap, int);
82 head_size += 4;
83 break;
84 case 'C':
85 s = va_arg(ap, char *);
86 head_size += str_charnum(s) + 1;
87 break;
88 }
89 }
90 va_end(ap);
91
92 /* allocate the space, then scan the format
93 * again to fill in the values */
94
95 *blob = data_blob(NULL, head_size + data_size);
96
97 head_ofs = 0;
98 data_ofs = head_size;
99
100 va_start(ap, format);
101 for (i=0; format[i]; i++) {
102 switch (format[i]) {
103 case 'U':
104 s = va_arg(ap, char *);
105 n = str_charnum(s);
106 SSVAL(blob->data, head_ofs, n*2); head_ofs += 2;
107 SSVAL(blob->data, head_ofs, n*2); head_ofs += 2;
108 SIVAL(blob->data, head_ofs, data_ofs); head_ofs += 4;
109 push_string(NULL, blob->data+data_ofs,
110 s, n*2, STR_UNICODE|STR_NOALIGN);
111 data_ofs += n*2;
112 break;
113 case 'A':
114 s = va_arg(ap, char *);
115 n = str_ascii_charnum(s);
116 SSVAL(blob->data, head_ofs, n); head_ofs += 2;
117 SSVAL(blob->data, head_ofs, n); head_ofs += 2;
118 SIVAL(blob->data, head_ofs, data_ofs); head_ofs += 4;
119 push_string(NULL, blob->data+data_ofs,
120 s, n, STR_ASCII|STR_NOALIGN);
121 data_ofs += n;
122 break;
123 case 'a':
124 n = va_arg(ap, int);
125 SSVAL(blob->data, data_ofs, n); data_ofs += 2;
126 s = va_arg(ap, char *);
127 n = str_charnum(s);
128 SSVAL(blob->data, data_ofs, n*2); data_ofs += 2;
129 if (0 < n) {
130 push_string(NULL, blob->data+data_ofs, s, n*2,
131 STR_UNICODE|STR_NOALIGN);
132 }
133 data_ofs += n*2;
134 break;
135
136 case 'B':
137 b = va_arg(ap, uint8 *);
138 n = va_arg(ap, int);
139 SSVAL(blob->data, head_ofs, n); head_ofs += 2;
140 SSVAL(blob->data, head_ofs, n); head_ofs += 2;
141 SIVAL(blob->data, head_ofs, data_ofs); head_ofs += 4;
142 if (n && b) /* don't follow null pointers... */
143 memcpy(blob->data+data_ofs, b, n);
144 data_ofs += n;
145 break;
146 case 'd':
147 n = va_arg(ap, int);
148 SIVAL(blob->data, head_ofs, n); head_ofs += 4;
149 break;
150 case 'b':
151 b = va_arg(ap, uint8 *);
152 n = va_arg(ap, int);
153 memcpy(blob->data + head_ofs, b, n);
154 head_ofs += n;
155 break;
156 case 'C':
157 s = va_arg(ap, char *);
158 n = str_charnum(s) + 1;
159 head_ofs += push_string(NULL, blob->data+head_ofs, s, n,
160 STR_ASCII|STR_TERMINATE);
161 break;
162 }
163 }
164 va_end(ap);
165
166 return true;
167}
168
169
170/* a helpful macro to avoid running over the end of our blob */
171#define NEED_DATA(amount) \
172if ((head_ofs + amount) > blob->length) { \
173 va_end(ap); \
174 return False; \
175}
176
177/*
178 this is a tiny msrpc packet parser. This the the partner of msrpc_gen
179
180 format specifiers are:
181
182 U = unicode string (output is unix string)
183 A = ascii string
184 B = data blob
185 b = data blob in header
186 d = word (4 bytes)
187 C = constant ascii string
188 */
189
190bool msrpc_parse(const DATA_BLOB *blob,
191 const char *format, ...)
192{
193 int i;
194 va_list ap;
195 char **ps, *s;
196 DATA_BLOB *b;
197 size_t head_ofs = 0;
198 uint16 len1, len2;
199 uint32 ptr;
200 uint32 *v;
201
202 va_start(ap, format);
203 for (i=0; format[i]; i++) {
204 switch (format[i]) {
205 case 'U':
206 NEED_DATA(8);
207 len1 = SVAL(blob->data, head_ofs); head_ofs += 2;
208 len2 = SVAL(blob->data, head_ofs); head_ofs += 2;
209 ptr = IVAL(blob->data, head_ofs); head_ofs += 4;
210
211 ps = va_arg(ap, char **);
212 if (len1 == 0 && len2 == 0) {
213 *ps = smb_xstrdup("");
214 } else {
215 /* make sure its in the right format
216 * be strict */
217 if ((len1 != len2) || (ptr + len1 < ptr) ||
218 (ptr + len1 < len1) ||
219 (ptr + len1 > blob->length)) {
220 va_end(ap);
221 return false;
222 }
223 if (len1 & 1) {
224 /* if odd length and unicode */
225 va_end(ap);
226 return false;
227 }
228 if (blob->data + ptr <
229 (uint8 *)(unsigned long)ptr ||
230 blob->data + ptr < blob->data) {
231 va_end(ap);
232 return false;
233 }
234
235 if (0 < len1) {
236 char *p = NULL;
237 pull_string_talloc(talloc_tos(),
238 NULL,
239 0,
240 &p,
241 blob->data + ptr,
242 len1,
243 STR_UNICODE|STR_NOALIGN);
244 if (p) {
245 (*ps) = smb_xstrdup(p);
246 TALLOC_FREE(p);
247 } else {
248 (*ps) = smb_xstrdup("");
249 }
250 } else {
251 (*ps) = smb_xstrdup("");
252 }
253 }
254 break;
255 case 'A':
256 NEED_DATA(8);
257 len1 = SVAL(blob->data, head_ofs); head_ofs += 2;
258 len2 = SVAL(blob->data, head_ofs); head_ofs += 2;
259 ptr = IVAL(blob->data, head_ofs); head_ofs += 4;
260
261 ps = va_arg(ap, char **);
262 /* make sure its in the right format - be strict */
263 if (len1 == 0 && len2 == 0) {
264 *ps = smb_xstrdup("");
265 } else {
266 if ((len1 != len2) || (ptr + len1 < ptr) ||
267 (ptr + len1 < len1) ||
268 (ptr + len1 > blob->length)) {
269 va_end(ap);
270 return false;
271 }
272
273 if (blob->data + ptr <
274 (uint8 *)(unsigned long)ptr ||
275 blob->data + ptr < blob->data) {
276 va_end(ap);
277 return false;
278 }
279
280 if (0 < len1) {
281 char *p = NULL;
282 pull_string_talloc(talloc_tos(),
283 NULL,
284 0,
285 &p,
286 blob->data + ptr,
287 len1,
288 STR_ASCII|STR_NOALIGN);
289 if (p) {
290 (*ps) = smb_xstrdup(p);
291 TALLOC_FREE(p);
292 } else {
293 (*ps) = smb_xstrdup("");
294 }
295 } else {
296 (*ps) = smb_xstrdup("");
297 }
298 }
299 break;
300 case 'B':
301 NEED_DATA(8);
302 len1 = SVAL(blob->data, head_ofs); head_ofs += 2;
303 len2 = SVAL(blob->data, head_ofs); head_ofs += 2;
304 ptr = IVAL(blob->data, head_ofs); head_ofs += 4;
305
306 b = (DATA_BLOB *)va_arg(ap, void *);
307 if (len1 == 0 && len2 == 0) {
308 *b = data_blob_null;
309 } else {
310 /* make sure its in the right format
311 * be strict */
312 if ((len1 != len2) || (ptr + len1 < ptr) ||
313 (ptr + len1 < len1) ||
314 (ptr + len1 > blob->length)) {
315 va_end(ap);
316 return false;
317 }
318
319 if (blob->data + ptr <
320 (uint8 *)(unsigned long)ptr ||
321 blob->data + ptr < blob->data) {
322 va_end(ap);
323 return false;
324 }
325
326 *b = data_blob(blob->data + ptr, len1);
327 }
328 break;
329 case 'b':
330 b = (DATA_BLOB *)va_arg(ap, void *);
331 len1 = va_arg(ap, unsigned);
332 /* make sure its in the right format - be strict */
333 NEED_DATA(len1);
334 if (blob->data + head_ofs < (uint8 *)head_ofs ||
335 blob->data + head_ofs < blob->data) {
336 va_end(ap);
337 return false;
338 }
339
340 *b = data_blob(blob->data + head_ofs, len1);
341 head_ofs += len1;
342 break;
343 case 'd':
344 v = va_arg(ap, uint32 *);
345 NEED_DATA(4);
346 *v = IVAL(blob->data, head_ofs); head_ofs += 4;
347 break;
348 case 'C':
349 s = va_arg(ap, char *);
350
351 if (blob->data + head_ofs < (uint8 *)head_ofs ||
352 blob->data + head_ofs < blob->data) {
353 va_end(ap);
354 return false;
355 }
356
357 {
358 char *p = NULL;
359 size_t ret = pull_string_talloc(talloc_tos(),
360 NULL,
361 0,
362 &p,
363 blob->data+head_ofs,
364 blob->length - head_ofs,
365 STR_ASCII|STR_TERMINATE);
366 if (ret == (size_t)-1 || p == NULL) {
367 va_end(ap);
368 return false;
369 }
370 head_ofs += ret;
371 if (strcmp(s, p) != 0) {
372 TALLOC_FREE(p);
373 va_end(ap);
374 return false;
375 }
376 TALLOC_FREE(p);
377 }
378 break;
379 }
380 }
381 va_end(ap);
382
383 return True;
384}
Note: See TracBrowser for help on using the repository browser.