source: trunk-3.0/source/libsmb/ntlmssp_parse.c@ 103

Last change on this file since 103 was 102, checked in by Paul Smedley, 18 years ago

Update to 3.0.27
File size: 8.5 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 simple kerberos5/SPNEGO routines
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
6 Copyright (C) Andrew Bartlett 2002-2003
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
21*/
22
23#include "includes.h"
24
25/*
26 this is a tiny msrpc packet generator. I am only using this to
27 avoid tying this code to a particular varient of our rpc code. This
28 generator is not general enough for all our rpc needs, its just
29 enough for the spnego/ntlmssp code
30
31 format specifiers are:
32
33 U = unicode string (input is unix string)
34 a = address (input is char *unix_string)
35 (1 byte type, 1 byte length, unicode/ASCII string, all inline)
36 A = ASCII string (input is unix string)
37 B = data blob (pointer + length)
38 b = data blob in header (pointer + length)
39 D
40 d = word (4 bytes)
41 C = constant ascii string
42 */
43BOOL msrpc_gen(DATA_BLOB *blob,
44 const char *format, ...)
45{
46 int i, n;
47 va_list ap;
48 char *s;
49 uint8 *b;
50 int head_size=0, data_size=0;
51 int head_ofs, data_ofs;
52
53 /* first scan the format to work out the header and body size */
54 va_start(ap, format);
55 for (i=0; format[i]; i++) {
56 switch (format[i]) {
57 case 'U':
58 s = va_arg(ap, char *);
59 head_size += 8;
60 data_size += str_charnum(s) * 2;
61 break;
62 case 'A':
63 s = va_arg(ap, char *);
64 head_size += 8;
65 data_size += str_ascii_charnum(s);
66 break;
67 case 'a':
68 n = va_arg(ap, int);
69 s = va_arg(ap, char *);
70 data_size += (str_charnum(s) * 2) + 4;
71 break;
72 case 'B':
73 b = va_arg(ap, uint8 *);
74 head_size += 8;
75 data_size += va_arg(ap, int);
76 break;
77 case 'b':
78 b = va_arg(ap, uint8 *);
79 head_size += va_arg(ap, int);
80 break;
81 case 'd':
82 n = va_arg(ap, int);
83 head_size += 4;
84 break;
85 case 'C':
86 s = va_arg(ap, char *);
87 head_size += str_charnum(s) + 1;
88 break;
89 }
90 }
91 va_end(ap);
92
93 /* allocate the space, then scan the format again to fill in the values */
94 *blob = data_blob(NULL, head_size + data_size);
95
96 head_ofs = 0;
97 data_ofs = head_size;
98
99 va_start(ap, format);
100 for (i=0; format[i]; i++) {
101 switch (format[i]) {
102 case 'U':
103 s = va_arg(ap, char *);
104 n = str_charnum(s);
105 SSVAL(blob->data, head_ofs, n*2); head_ofs += 2;
106 SSVAL(blob->data, head_ofs, n*2); head_ofs += 2;
107 SIVAL(blob->data, head_ofs, data_ofs); head_ofs += 4;
108 push_string(NULL, blob->data+data_ofs, s, n*2, STR_UNICODE|STR_NOALIGN);
109 data_ofs += n*2;
110 break;
111 case 'A':
112 s = va_arg(ap, char *);
113 n = str_ascii_charnum(s);
114 SSVAL(blob->data, head_ofs, n); head_ofs += 2;
115 SSVAL(blob->data, head_ofs, n); head_ofs += 2;
116 SIVAL(blob->data, head_ofs, data_ofs); head_ofs += 4;
117 push_string(NULL, blob->data+data_ofs, s, n, STR_ASCII|STR_NOALIGN);
118 data_ofs += n;
119 break;
120 case 'a':
121 n = va_arg(ap, int);
122 SSVAL(blob->data, data_ofs, n); data_ofs += 2;
123 s = va_arg(ap, char *);
124 n = str_charnum(s);
125 SSVAL(blob->data, data_ofs, n*2); data_ofs += 2;
126 if (0 < n) {
127 push_string(NULL, blob->data+data_ofs, s, n*2,
128 STR_UNICODE|STR_NOALIGN);
129 }
130 data_ofs += n*2;
131 break;
132
133 case 'B':
134 b = va_arg(ap, uint8 *);
135 n = va_arg(ap, int);
136 SSVAL(blob->data, head_ofs, n); head_ofs += 2;
137 SSVAL(blob->data, head_ofs, n); head_ofs += 2;
138 SIVAL(blob->data, head_ofs, data_ofs); head_ofs += 4;
139 if (n && b) /* don't follow null pointers... */
140 memcpy(blob->data+data_ofs, b, n);
141 data_ofs += n;
142 break;
143 case 'd':
144 n = va_arg(ap, int);
145 SIVAL(blob->data, head_ofs, n); head_ofs += 4;
146 break;
147 case 'b':
148 b = va_arg(ap, uint8 *);
149 n = va_arg(ap, int);
150 memcpy(blob->data + head_ofs, b, n);
151 head_ofs += n;
152 break;
153 case 'C':
154 s = va_arg(ap, char *);
155 n = str_charnum(s) + 1;
156 head_ofs += push_string(NULL, blob->data+head_ofs, s, n,
157 STR_ASCII|STR_TERMINATE);
158 break;
159 }
160 }
161 va_end(ap);
162
163 return True;
164}
165
166
167/* a helpful macro to avoid running over the end of our blob */
168#define NEED_DATA(amount) \
169if ((head_ofs + amount) > blob->length) { \
170 return False; \
171}
172
173/*
174 this is a tiny msrpc packet parser. This the the partner of msrpc_gen
175
176 format specifiers are:
177
178 U = unicode string (output is unix string)
179 A = ascii string
180 B = data blob
181 b = data blob in header
182 d = word (4 bytes)
183 C = constant ascii string
184 */
185
186BOOL msrpc_parse(const DATA_BLOB *blob,
187 const char *format, ...)
188{
189 int i;
190 va_list ap;
191 char **ps, *s;
192 DATA_BLOB *b;
193 size_t head_ofs = 0;
194 uint16 len1, len2;
195 uint32 ptr;
196 uint32 *v;
197 pstring p;
198
199 va_start(ap, format);
200 for (i=0; format[i]; i++) {
201 switch (format[i]) {
202 case 'U':
203 NEED_DATA(8);
204 len1 = SVAL(blob->data, head_ofs); head_ofs += 2;
205 len2 = SVAL(blob->data, head_ofs); head_ofs += 2;
206 ptr = IVAL(blob->data, head_ofs); head_ofs += 4;
207
208 ps = va_arg(ap, char **);
209 if (len1 == 0 && len2 == 0) {
210 *ps = smb_xstrdup("");
211 } else {
212 /* make sure its in the right format - be strict */
213 if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
214 return False;
215 }
216 if (len1 & 1) {
217 /* if odd length and unicode */
218 return False;
219 }
220 if (blob->data + ptr < (uint8 *)(unsigned long)ptr || blob->data + ptr < blob->data)
221 return False;
222
223 if (0 < len1) {
224 pull_string(NULL, p, blob->data + ptr, sizeof(p),
225 len1,
226 STR_UNICODE|STR_NOALIGN);
227 (*ps) = smb_xstrdup(p);
228 } else {
229 (*ps) = smb_xstrdup("");
230 }
231 }
232 break;
233 case 'A':
234 NEED_DATA(8);
235 len1 = SVAL(blob->data, head_ofs); head_ofs += 2;
236 len2 = SVAL(blob->data, head_ofs); head_ofs += 2;
237 ptr = IVAL(blob->data, head_ofs); head_ofs += 4;
238
239 ps = va_arg(ap, char **);
240 /* make sure its in the right format - be strict */
241 if (len1 == 0 && len2 == 0) {
242 *ps = smb_xstrdup("");
243 } else {
244 if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
245 return False;
246 }
247
248 if (blob->data + ptr < (uint8 *)(unsigned long)ptr || blob->data + ptr < blob->data)
249 return False;
250
251 if (0 < len1) {
252 pull_string(NULL, p, blob->data + ptr, sizeof(p),
253 len1,
254 STR_ASCII|STR_NOALIGN);
255 (*ps) = smb_xstrdup(p);
256 } else {
257 (*ps) = smb_xstrdup("");
258 }
259 }
260 break;
261 case 'B':
262 NEED_DATA(8);
263 len1 = SVAL(blob->data, head_ofs); head_ofs += 2;
264 len2 = SVAL(blob->data, head_ofs); head_ofs += 2;
265 ptr = IVAL(blob->data, head_ofs); head_ofs += 4;
266
267 b = (DATA_BLOB *)va_arg(ap, void *);
268 if (len1 == 0 && len2 == 0) {
269 *b = data_blob(NULL, 0);
270 } else {
271 /* make sure its in the right format - be strict */
272 if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
273 return False;
274 }
275
276 if (blob->data + ptr < (uint8 *)(unsigned long)ptr || blob->data + ptr < blob->data)
277 return False;
278
279 *b = data_blob(blob->data + ptr, len1);
280 }
281 break;
282 case 'b':
283 b = (DATA_BLOB *)va_arg(ap, void *);
284 len1 = va_arg(ap, unsigned);
285 /* make sure its in the right format - be strict */
286 NEED_DATA(len1);
287 if (blob->data + head_ofs < (uint8 *)head_ofs || blob->data + head_ofs < blob->data)
288 return False;
289
290 *b = data_blob(blob->data + head_ofs, len1);
291 head_ofs += len1;
292 break;
293 case 'd':
294 v = va_arg(ap, uint32 *);
295 NEED_DATA(4);
296 *v = IVAL(blob->data, head_ofs); head_ofs += 4;
297 break;
298 case 'C':
299 s = va_arg(ap, char *);
300
301 if (blob->data + head_ofs < (uint8 *)head_ofs || blob->data + head_ofs < blob->data)
302 return False;
303
304 head_ofs += pull_string(NULL, p, blob->data+head_ofs, sizeof(p),
305 blob->length - head_ofs,
306 STR_ASCII|STR_TERMINATE);
307 if (strcmp(s, p) != 0) {
308 return False;
309 }
310 break;
311 }
312 }
313 va_end(ap);
314
315 return True;
316}
Note: See TracBrowser for help on using the repository browser.