source: vendor/current/libcli/auth/msrpc_parse.c

Last change on this file was 989, checked in by Silvan Scherrer, 9 years ago

Samba Server: update vendor to version 4.4.7
File size: 10.0 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 simple kerberos5/SPNEGO routines
4 Copyright (C) Andrew Tridgell 2001
5 Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
6 Copyright (C) Andrew Bartlett 2002-2003
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20*/
21
22#include "includes.h"
23#include "libcli/auth/msrpc_parse.h"
24
25/*
26 this is a tiny msrpc packet generator. I am only using this to
27 avoid tying this code to a particular varient of our rpc code. This
28 generator is not general enough for all our rpc needs, its just
29 enough for the spnego/ntlmssp code
30
31 format specifiers are:
32
33 U = unicode string (input is unix string)
34 a = address (input is char *unix_string)
35 (1 byte type, 1 byte length, unicode/ASCII string, all inline)
36 A = ASCII string (input is unix string)
37 B = data blob (pointer + length)
38 b = data blob in header (pointer + length)
39 D
40 d = word (4 bytes)
41 C = constant ascii string
42 */
43NTSTATUS msrpc_gen(TALLOC_CTX *mem_ctx,
44 DATA_BLOB *blob,
45 const char *format, ...)
46{
47 int i, j;
48 bool ret;
49 va_list ap;
50 char *s;
51 uint8_t *b;
52 int head_size=0, data_size=0;
53 int head_ofs, data_ofs;
54 int *intargs;
55 size_t n;
56
57 DATA_BLOB *pointers;
58
59 pointers = talloc_array(mem_ctx, DATA_BLOB, strlen(format));
60 if (!pointers) {
61 return NT_STATUS_NO_MEMORY;
62 }
63 intargs = talloc_array(pointers, int, strlen(format));
64 if (!intargs) {
65 return NT_STATUS_NO_MEMORY;
66 }
67
68 /* first scan the format to work out the header and body size */
69 va_start(ap, format);
70 for (i=0; format[i]; i++) {
71 switch (format[i]) {
72 case 'U':
73 s = va_arg(ap, char *);
74 head_size += 8;
75 ret = push_ucs2_talloc(
76 pointers,
77 (smb_ucs2_t **)(void *)&pointers[i].data,
78 s, &n);
79 if (!ret) {
80 va_end(ap);
81 return map_nt_error_from_unix_common(errno);
82 }
83 pointers[i].length = n;
84 pointers[i].length -= 2;
85 data_size += pointers[i].length;
86 break;
87 case 'A':
88 s = va_arg(ap, char *);
89 head_size += 8;
90 ret = push_ascii_talloc(
91 pointers, (char **)(void *)&pointers[i].data,
92 s, &n);
93 if (!ret) {
94 va_end(ap);
95 return map_nt_error_from_unix_common(errno);
96 }
97 pointers[i].length = n;
98 pointers[i].length -= 1;
99 data_size += pointers[i].length;
100 break;
101 case 'a':
102 j = va_arg(ap, int);
103 intargs[i] = j;
104 s = va_arg(ap, char *);
105 ret = push_ucs2_talloc(
106 pointers,
107 (smb_ucs2_t **)(void *)&pointers[i].data,
108 s, &n);
109 if (!ret) {
110 va_end(ap);
111 return map_nt_error_from_unix_common(errno);
112 }
113 pointers[i].length = n;
114 pointers[i].length -= 2;
115 data_size += pointers[i].length + 4;
116 break;
117 case 'B':
118 b = va_arg(ap, uint8_t *);
119 head_size += 8;
120 pointers[i].data = b;
121 pointers[i].length = va_arg(ap, int);
122 data_size += pointers[i].length;
123 break;
124 case 'b':
125 b = va_arg(ap, uint8_t *);
126 pointers[i].data = b;
127 pointers[i].length = va_arg(ap, int);
128 head_size += pointers[i].length;
129 break;
130 case 'd':
131 j = va_arg(ap, int);
132 intargs[i] = j;
133 head_size += 4;
134 break;
135 case 'C':
136 s = va_arg(ap, char *);
137 pointers[i].data = (uint8_t *)s;
138 pointers[i].length = strlen(s)+1;
139 head_size += pointers[i].length;
140 break;
141 default:
142 va_end(ap);
143 return NT_STATUS_INVALID_PARAMETER;
144 }
145 }
146 va_end(ap);
147
148 if (head_size + data_size == 0) {
149 return NT_STATUS_INVALID_PARAMETER;
150 }
151
152 /* allocate the space, then scan the format again to fill in the values */
153 *blob = data_blob_talloc(mem_ctx, NULL, head_size + data_size);
154 if (!blob->data) {
155 return NT_STATUS_NO_MEMORY;
156 }
157 head_ofs = 0;
158 data_ofs = head_size;
159
160 va_start(ap, format);
161 for (i=0; format[i]; i++) {
162 switch (format[i]) {
163 case 'U':
164 case 'A':
165 case 'B':
166 n = pointers[i].length;
167 SSVAL(blob->data, head_ofs, n); head_ofs += 2;
168 SSVAL(blob->data, head_ofs, n); head_ofs += 2;
169 SIVAL(blob->data, head_ofs, data_ofs); head_ofs += 4;
170 if (pointers[i].data && n) /* don't follow null pointers... */
171 memcpy(blob->data+data_ofs, pointers[i].data, n);
172 data_ofs += n;
173 break;
174 case 'a':
175 j = intargs[i];
176 SSVAL(blob->data, data_ofs, j); data_ofs += 2;
177
178 n = pointers[i].length;
179 SSVAL(blob->data, data_ofs, n); data_ofs += 2;
180 memcpy(blob->data+data_ofs, pointers[i].data, n);
181 data_ofs += n;
182 break;
183 case 'd':
184 j = intargs[i];
185 SIVAL(blob->data, head_ofs, j);
186 head_ofs += 4;
187 break;
188 case 'b':
189 n = pointers[i].length;
190 if (pointers[i].data && n) {
191 /* don't follow null pointers... */
192 memcpy(blob->data + head_ofs, pointers[i].data, n);
193 }
194 head_ofs += n;
195 break;
196 case 'C':
197 n = pointers[i].length;
198 memcpy(blob->data + head_ofs, pointers[i].data, n);
199 head_ofs += n;
200 break;
201 default:
202 va_end(ap);
203 return NT_STATUS_INVALID_PARAMETER;
204 }
205 }
206 va_end(ap);
207
208 talloc_free(pointers);
209
210 return NT_STATUS_OK;
211}
212
213
214/* a helpful macro to avoid running over the end of our blob */
215#define NEED_DATA(amount) \
216if ((head_ofs + amount) > blob->length) { \
217 va_end(ap); \
218 return false; \
219}
220
221/**
222 this is a tiny msrpc packet parser. This the the partner of msrpc_gen
223
224 format specifiers are:
225
226 U = unicode string (output is unix string)
227 A = ascii string
228 B = data blob
229 b = data blob in header
230 d = word (4 bytes)
231 C = constant ascii string
232 */
233
234bool msrpc_parse(TALLOC_CTX *mem_ctx,
235 const DATA_BLOB *blob,
236 const char *format, ...)
237{
238 int i;
239 va_list ap;
240 char **ps, *s;
241 DATA_BLOB *b;
242 size_t head_ofs = 0;
243 uint16_t len1, len2;
244 uint32_t ptr;
245 uint32_t *v;
246 size_t p_len = 1024;
247 char *p = talloc_array(mem_ctx, char, p_len);
248 bool ret = true;
249
250 if (!p) {
251 return false;
252 }
253
254 va_start(ap, format);
255 for (i=0; format[i]; i++) {
256 switch (format[i]) {
257 case 'U':
258 NEED_DATA(8);
259 len1 = SVAL(blob->data, head_ofs); head_ofs += 2;
260 len2 = SVAL(blob->data, head_ofs); head_ofs += 2;
261 ptr = IVAL(blob->data, head_ofs); head_ofs += 4;
262
263 ps = va_arg(ap, char **);
264 if (len1 == 0 && len2 == 0) {
265 *ps = talloc_strdup(mem_ctx, "");
266 if (*ps == NULL) {
267 ret = false;
268 goto cleanup;
269 }
270 } else {
271 /* make sure its in the right format - be strict */
272 if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
273 ret = false;
274 goto cleanup;
275 }
276 if (len1 & 1) {
277 /* if odd length and unicode */
278 ret = false;
279 goto cleanup;
280 }
281 if (blob->data + ptr < (uint8_t *)(uintptr_t)ptr ||
282 blob->data + ptr < blob->data) {
283 ret = false;
284 goto cleanup;
285 }
286
287 if (0 < len1) {
288 size_t pull_len;
289 if (!convert_string_talloc(mem_ctx, CH_UTF16, CH_UNIX,
290 blob->data + ptr, len1,
291 ps, &pull_len)) {
292 ret = false;
293 goto cleanup;
294 }
295 } else {
296 *ps = talloc_strdup(mem_ctx, "");
297 if (*ps == NULL) {
298 ret = false;
299 goto cleanup;
300 }
301 }
302 }
303 break;
304 case 'A':
305 NEED_DATA(8);
306 len1 = SVAL(blob->data, head_ofs); head_ofs += 2;
307 len2 = SVAL(blob->data, head_ofs); head_ofs += 2;
308 ptr = IVAL(blob->data, head_ofs); head_ofs += 4;
309
310 ps = (char **)va_arg(ap, char **);
311 /* make sure its in the right format - be strict */
312 if (len1 == 0 && len2 == 0) {
313 *ps = talloc_strdup(mem_ctx, "");
314 if (*ps == NULL) {
315 ret = false;
316 goto cleanup;
317 }
318 } else {
319 if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
320 ret = false;
321 goto cleanup;
322 }
323
324 if (blob->data + ptr < (uint8_t *)(uintptr_t)ptr ||
325 blob->data + ptr < blob->data) {
326 ret = false;
327 goto cleanup;
328 }
329
330 if (0 < len1) {
331 size_t pull_len;
332
333 if (!convert_string_talloc(mem_ctx, CH_DOS, CH_UNIX,
334 blob->data + ptr, len1,
335 ps, &pull_len)) {
336 ret = false;
337 goto cleanup;
338 }
339 } else {
340 *ps = talloc_strdup(mem_ctx, "");
341 if (*ps == NULL) {
342 ret = false;
343 goto cleanup;
344 }
345 }
346 }
347 break;
348 case 'B':
349 NEED_DATA(8);
350 len1 = SVAL(blob->data, head_ofs); head_ofs += 2;
351 len2 = SVAL(blob->data, head_ofs); head_ofs += 2;
352 ptr = IVAL(blob->data, head_ofs); head_ofs += 4;
353
354 b = (DATA_BLOB *)va_arg(ap, void *);
355 if (len1 == 0 && len2 == 0) {
356 *b = data_blob_talloc(mem_ctx, NULL, 0);
357 } else {
358 /* make sure its in the right format - be strict */
359 if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
360 ret = false;
361 goto cleanup;
362 }
363
364 if (blob->data + ptr < (uint8_t *)(uintptr_t)ptr ||
365 blob->data + ptr < blob->data) {
366 ret = false;
367 goto cleanup;
368 }
369
370 *b = data_blob_talloc(mem_ctx, blob->data + ptr, len1);
371 }
372 break;
373 case 'b':
374 b = (DATA_BLOB *)va_arg(ap, void *);
375 len1 = va_arg(ap, unsigned int);
376 /* make sure its in the right format - be strict */
377 NEED_DATA(len1);
378 if (blob->data + head_ofs < (uint8_t *)head_ofs ||
379 blob->data + head_ofs < blob->data) {
380 ret = false;
381 goto cleanup;
382 }
383
384 *b = data_blob_talloc(mem_ctx, blob->data + head_ofs, len1);
385 head_ofs += len1;
386 break;
387 case 'd':
388 v = va_arg(ap, uint32_t *);
389 NEED_DATA(4);
390 *v = IVAL(blob->data, head_ofs); head_ofs += 4;
391 break;
392 case 'C':
393 s = va_arg(ap, char *);
394
395 if (blob->data + head_ofs < (uint8_t *)head_ofs ||
396 blob->data + head_ofs < blob->data ||
397 (head_ofs + (strlen(s) + 1)) > blob->length) {
398 ret = false;
399 goto cleanup;
400 }
401
402 if (memcmp(blob->data + head_ofs, s, strlen(s)+1) != 0) {
403 ret = false;
404 goto cleanup;
405 }
406 head_ofs += (strlen(s) + 1);
407
408 break;
409 }
410 }
411
412cleanup:
413 va_end(ap);
414 talloc_free(p);
415 return ret;
416}
Note: See TracBrowser for help on using the repository browser.