Changeset 920 for trunk/server/librpc

Timestamp:

Jun 9, 2016, 2:23:12 PM (9 years ago)

Author:

Silvan Scherrer

Message:

Samba Server: apply latest security patches to trunk

Location:

trunk/server

Files:

• . (modified) (1 prop)
• librpc/ABI (copied) (copied from vendor/current/librpc/ABI )
• librpc/idl/dcerpc.idl (modified) (5 diffs)
• librpc/idl/idl_types.h (modified) (1 diff)
• librpc/ndr/libndr.h (modified) (8 diffs)
• librpc/ndr/ndr.c (modified) (8 diffs)
• librpc/ndr/ndr_basic.c (modified) (34 diffs)
• librpc/ndr/ndr_dcerpc.c (copied) (copied from vendor/current/librpc/ndr/ndr_dcerpc.c )
• librpc/ndr/ndr_dcerpc.h (copied) (copied from vendor/current/librpc/ndr/ndr_dcerpc.h )
• librpc/ndr/ndr_misc.c (modified) (1 diff)
• librpc/ndr/ndr_ntlmssp.c (modified) (1 diff)
• librpc/ndr/ndr_ntlmssp.h (modified) (1 diff)
• librpc/rpc/dcerpc_util.c (modified) (5 diffs)
• librpc/rpc/rpc_common.h (modified) (2 diffs)
• librpc/wscript_build (modified) (1 diff)

trunk/server/librpc/idl/dcerpc.idl

@@ -10 +10 @@
 */
 import "misc.idl";
+
+cpp_quote("extern const uint8_t DCERPC_SEC_VT_MAGIC[8];")
 
 interface dcerpc
@@ -454 +456 @@
 
         /* pfc_flags values */
-        const uint8 DCERPC_PFC_FLAG_FIRST               = 0x01; /* First fragment */
-        const uint8 DCERPC_PFC_FLAG_LAST                = 0x02; /* Last fragment */
-        const uint8 DCERPC_PFC_FLAG_PENDING_CANCEL      = 0x04; /* Cancel was pending at sender */
-        const uint8 DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN = DCERPC_PFC_FLAG_PENDING_CANCEL; /* depends on the pdu type */
-        const uint8 DCERPC_PFC_FLAG_CONC_MPX            = 0x10; /* supports concurrent multiplexing of a single connection. */
-        const uint8 DCERPC_PFC_FLAG_DID_NOT_EXECUTE     = 0x20; /* on a fault it means the server hasn't done anything */
-        const uint8 DCERPC_PFC_FLAG_MAYBE               = 0x40; /* `maybe' call semantics requested */
-        const uint8 DCERPC_PFC_FLAG_OBJECT_UUID         = 0x80; /* on valid guid is in the optional object field */
+        typedef [bitmap8bit] bitmap {
+                DCERPC_PFC_FLAG_FIRST           = 0x01, /* First fragment */
+                DCERPC_PFC_FLAG_LAST            = 0x02, /* Last fragment */
+                DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING = 0x04, /* depends on the pdu type */
+                DCERPC_PFC_FLAG_CONC_MPX        = 0x10, /* supports concurrent multiplexing of a single connection. */
+                DCERPC_PFC_FLAG_DID_NOT_EXECUTE = 0x20, /* on a fault it means the server hasn't done anything */
+                DCERPC_PFC_FLAG_MAYBE           = 0x40, /* `maybe' call semantics requested */
+                DCERPC_PFC_FLAG_OBJECT_UUID     = 0x80 /* on valid guid is in the optional object field */
+        } dcerpc_pfc_flags;
+
+        /* Cancel was pending at sender */
+        const int DCERPC_PFC_FLAG_PENDING_CANCEL =
+                DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING;
+        const ist DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN =
+                DCERPC_PFC_FLAG_PENDING_CANCEL_OR_HDR_SIGNING;
 
         /* these offsets are needed by the signing code */
@@ -467 +476 @@
         const uint8 DCERPC_DREP_OFFSET     =  4;
         const uint8 DCERPC_FRAG_LEN_OFFSET =  8;
+        const uint32 DCERPC_FRAG_MAX_SIZE  = 5840;
         const uint8 DCERPC_AUTH_LEN_OFFSET = 10;
         const uint8 DCERPC_CALL_ID_OFFSET  = 12;
+        const uint8 DCERPC_NCACN_PAYLOAD_OFFSET = 16;
+        const uint32 DCERPC_NCACN_PAYLOAD_MAX_SIZE = 0x400000; /* 4 MByte */
 
         /* little-endian flag */
@@ -477 +489 @@
                 uint8 rpc_vers_minor;   /* Minor version */
                 dcerpc_pkt_type ptype;  /* Packet type */
-                uint8 pfc_flags;        /* Fragmentation flags */
+                dcerpc_pfc_flags pfc_flags; /* Fragmentation flags */
                 uint8 drep[4];          /* NDR data representation */
                 uint16 frag_length;     /* Total length of fragment */
@@ -507 +519 @@
                 [switch_is(ptype)] dcerpc_payload u;
         } ncadg_packet;
+
+        typedef [bitmap16bit] bitmap {
+                DCERPC_SEC_VT_COMMAND_ENUM  = 0x3FFF,
+                DCERPC_SEC_VT_COMMAND_END   = 0x4000,
+                DCERPC_SEC_VT_MUST_PROCESS  = 0x8000
+        } dcerpc_sec_vt_command;
+
+        typedef [enum16bit] enum {
+                DCERPC_SEC_VT_COMMAND_BITMASK1  = 0x0001,
+                DCERPC_SEC_VT_COMMAND_PCONTEXT  = 0x0002,
+                DCERPC_SEC_VT_COMMAND_HEADER2   = 0x0003
+        } dcerpc_sec_vt_command_enum;
+
+        typedef [bitmap32bit] bitmap {
+                DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING = 0x00000001
+        } dcerpc_sec_vt_bitmask1;
+
+        typedef struct {
+                ndr_syntax_id abstract_syntax;
+                ndr_syntax_id transfer_syntax;
+        } dcerpc_sec_vt_pcontext;
+
+        typedef struct {
+                dcerpc_pkt_type ptype;  /* Packet type */
+                [value(0)] uint8 reserved1;
+                [value(0)] uint16 reserved2;
+                uint8 drep[4];          /* NDR data representation */
+                uint32 call_id;         /* Call identifier */
+                uint16 context_id;
+                uint16 opnum;
+        } dcerpc_sec_vt_header2;
+
+        typedef [switch_type(dcerpc_sec_vt_command_enum),nodiscriminant] union {
+        [case(DCERPC_SEC_VT_COMMAND_BITMASK1)] dcerpc_sec_vt_bitmask1 bitmask1;
+        [case(DCERPC_SEC_VT_COMMAND_PCONTEXT)] dcerpc_sec_vt_pcontext pcontext;
+        [case(DCERPC_SEC_VT_COMMAND_HEADER2)] dcerpc_sec_vt_header2 header2;
+        [default,flag(NDR_REMAINING)] DATA_BLOB _unknown;
+        } dcerpc_sec_vt_union;
+
+        typedef struct {
+                dcerpc_sec_vt_command command;
+                [switch_is(command & DCERPC_SEC_VT_COMMAND_ENUM)]
+                        [subcontext(2),flag(NDR_SUBCONTEXT_NO_UNREAD_BYTES)]
+                        dcerpc_sec_vt_union u;
+        } dcerpc_sec_vt;
+
+        typedef [public,nopush,nopull] struct {
+                uint16 count;
+        } dcerpc_sec_vt_count;
+
+        /*
+         * We assume that the whole verification trailer fits into
+         * the last 1024 bytes after the stub data.
+         *
+         * There're currently only 3 commands defined and each should
+         * only be used once.
+         */
+        const uint16 DCERPC_SEC_VT_MAX_SIZE = 1024;
+
+        typedef [public,flag(NDR_PAHEX)] struct {
+                [flag(NDR_ALIGN4)] DATA_BLOB _pad;
+                [value(DCERPC_SEC_VT_MAGIC)] uint8 magic[8];
+                dcerpc_sec_vt_count count;
+                dcerpc_sec_vt commands[count.count];
+        } dcerpc_sec_verification_trailer;
 }

trunk/server/librpc/idl/idl_types.h

@@ -48 +48 @@
 #define NDR_RELATIVE_REVERSE LIBNDR_FLAG_RELATIVE_REVERSE
 #define NDR_NO_RELATIVE_REVERSE LIBNDR_FLAG_NO_RELATIVE_REVERSE
+
+#define NDR_SUBCONTEXT_NO_UNREAD_BYTES LIBNDR_FLAG_SUBCONTEXT_NO_UNREAD_BYTES

trunk/server/librpc/ndr/libndr.h

@@ -125 +125 @@
 #define LIBNDR_STRING_FLAGS             (0x7FFC)
 
+/*
+ * don't debug NDR_ERR_BUFSIZE failures,
+ * as the available buffer might be incomplete.
+ *
+ * return NDR_ERR_INCOMPLETE_BUFFER instead.
+ */
+#define LIBNDR_FLAG_INCOMPLETE_BUFFER (1<<16)
+
+/*
+ * This lets ndr_pull_subcontext_end() return
+ * NDR_ERR_UNREAD_BYTES.
+ */
+#define LIBNDR_FLAG_SUBCONTEXT_NO_UNREAD_BYTES (1<<17)
+
 /* set if relative pointers should *not* be marshalled in reverse order */
 #define LIBNDR_FLAG_NO_RELATIVE_REVERSE (1<<18)
@@ -164 +178 @@
 /* useful macro for debugging */
 #define NDR_PRINT_DEBUG(type, p) ndr_print_debug((ndr_print_fn_t)ndr_print_ ##type, #p, p)
+#define NDR_PRINT_DEBUGC(dbgc_class, type, p) ndr_print_debugc(dbgc_class, (ndr_print_fn_t)ndr_print_ ##type, #p, p)
 #define NDR_PRINT_UNION_DEBUG(type, level, p) ndr_print_union_debug((ndr_print_fn_t)ndr_print_ ##type, #p, level, p)
 #define NDR_PRINT_FUNCTION_DEBUG(type, flags, p) ndr_print_function_debug((ndr_print_function_t)ndr_print_ ##type, #type, flags, p)
@@ -200 +215 @@
         NDR_ERR_INVALID_POINTER,
         NDR_ERR_UNREAD_BYTES,
-        NDR_ERR_NDR64
+        NDR_ERR_NDR64,
+        NDR_ERR_FLAGS,
+        NDR_ERR_INCOMPLETE_BUFFER
 };
 
@@ -218 +235 @@
 /*
   flags passed to control parse flow
+  These are deliberately in a different range to the NDR_IN/NDR_OUT
+  flags to catch mixups
 */
-#define NDR_SCALARS 1
-#define NDR_BUFFERS 2
+#define NDR_SCALARS    0x100
+#define NDR_BUFFERS    0x200
 
 /*
-  flags passed to ndr_print_*()
+  flags passed to ndr_print_*() and ndr pull/push for functions
+  These are deliberately in a different range to the NDR_SCALARS/NDR_BUFFERS
+  flags to catch mixups
 */
-#define NDR_IN 1
-#define NDR_OUT 2
-#define NDR_BOTH 3
-#define NDR_SET_VALUES 4
+#define NDR_IN         0x10
+#define NDR_OUT        0x20
+#define NDR_BOTH       0x30
+#define NDR_SET_VALUES 0x40
+
+
+#define NDR_PULL_CHECK_FLAGS(ndr, ndr_flags) do { \
+        if ((ndr_flags) & ~(NDR_SCALARS|NDR_BUFFERS)) { \
+                return ndr_pull_error(ndr, NDR_ERR_FLAGS, "Invalid pull struct ndr_flags 0x%x", ndr_flags); \
+        } \
+} while (0)
+
+#define NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags) do { \
+        if ((ndr_flags) & ~(NDR_SCALARS|NDR_BUFFERS)) \
+                return ndr_push_error(ndr, NDR_ERR_FLAGS, "Invalid push struct ndr_flags 0x%x", ndr_flags); \
+} while (0)
+
+#define NDR_PULL_CHECK_FN_FLAGS(ndr, flags) do { \
+        if ((flags) & ~(NDR_BOTH|NDR_SET_VALUES)) { \
+                return ndr_pull_error(ndr, NDR_ERR_FLAGS, "Invalid fn pull flags 0x%x", flags); \
+        } \
+} while (0)
+
+#define NDR_PUSH_CHECK_FN_FLAGS(ndr, flags) do { \
+        if ((flags) & ~(NDR_BOTH|NDR_SET_VALUES)) \
+                return ndr_push_error(ndr, NDR_ERR_FLAGS, "Invalid fn push flags 0x%x", flags); \
+} while (0)
 
 #define NDR_PULL_NEED_BYTES(ndr, n) do { \
         if (unlikely((n) > ndr->data_size || ndr->offset + (n) > ndr->data_size)) { \
+                if (ndr->flags & LIBNDR_FLAG_INCOMPLETE_BUFFER) { \
+                        uint32_t _available = ndr->data_size - ndr->offset; \
+                        uint32_t _missing = n - _available; \
+                        ndr->relative_highest_offset = _missing; \
+                } \
                 return ndr_pull_error(ndr, NDR_ERR_BUFSIZE, "Pull bytes %u (%s)", (unsigned)n, __location__); \
         } \
@@ -248 +297 @@
         } \
         if (unlikely(ndr->offset > ndr->data_size)) {                   \
+                if (ndr->flags & LIBNDR_FLAG_INCOMPLETE_BUFFER) { \
+                        uint32_t _missing = ndr->offset - ndr->data_size; \
+                        ndr->relative_highest_offset = _missing; \
+                } \
                 return ndr_pull_error(ndr, NDR_ERR_BUFSIZE, "Pull align %u", (unsigned)n); \
         } \
@@ -403 +456 @@
 void ndr_print_GUID(struct ndr_print *ndr, const char *name, const struct GUID *guid);
 bool ndr_syntax_id_equal(const struct ndr_syntax_id *i1, const struct ndr_syntax_id *i2); 
+char *ndr_syntax_id_to_string(TALLOC_CTX *mem_ctx, const struct ndr_syntax_id *id);
+bool ndr_syntax_id_from_string(const char *s, struct ndr_syntax_id *id);
 enum ndr_err_code ndr_push_struct_blob(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, const void *p, ndr_push_flags_fn_t fn);
 enum ndr_err_code ndr_push_union_blob(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, void *p, uint32_t level, ndr_push_flags_fn_t fn);
@@ -425 +480 @@
 size_t ndr_align_size(uint32_t offset, size_t n);
 struct ndr_pull *ndr_pull_init_blob(const DATA_BLOB *blob, TALLOC_CTX *mem_ctx);
+enum ndr_err_code ndr_pull_append(struct ndr_pull *ndr, DATA_BLOB *blob);
+enum ndr_err_code ndr_pull_pop(struct ndr_pull *ndr);
 enum ndr_err_code ndr_pull_advance(struct ndr_pull *ndr, uint32_t size);
 struct ndr_push *ndr_push_init_ctx(TALLOC_CTX *mem_ctx);
@@ -430 +487 @@
 enum ndr_err_code ndr_push_expand(struct ndr_push *ndr, uint32_t extra_size);
 void ndr_print_debug_helper(struct ndr_print *ndr, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
+void ndr_print_debugc_helper(struct ndr_print *ndr, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
 void ndr_print_printf_helper(struct ndr_print *ndr, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
 void ndr_print_string_helper(struct ndr_print *ndr, const char *format, ...) PRINTF_ATTRIBUTE(2,3);
 void ndr_print_debug(ndr_print_fn_t fn, const char *name, void *ptr);
+void ndr_print_debugc(int dbgc_class, ndr_print_fn_t fn, const char *name, void *ptr);
 void ndr_print_union_debug(ndr_print_fn_t fn, const char *name, uint32_t level, void *ptr);
 void ndr_print_function_debug(ndr_print_function_t fn, const char *name, int flags, void *ptr);

trunk/server/librpc/ndr/ndr.c

@@ -78 +78 @@
 }
 
+_PUBLIC_ enum ndr_err_code ndr_pull_append(struct ndr_pull *ndr, DATA_BLOB *blob)
+{
+        enum ndr_err_code ndr_err;
+        DATA_BLOB b;
+        uint32_t append = 0;
+        bool ok;
+
+        if (blob->length == 0) {
+                return NDR_ERR_SUCCESS;
+        }
+
+        ndr_err = ndr_token_retrieve(&ndr->array_size_list, ndr, &append);
+        if (ndr_err == NDR_ERR_TOKEN) {
+                append = 0;
+                ndr_err = NDR_ERR_SUCCESS;
+        }
+        NDR_CHECK(ndr_err);
+
+        if (ndr->data_size == 0) {
+                ndr->data = NULL;
+                append = UINT32_MAX;
+        }
+
+        if (append == UINT32_MAX) {
+                /*
+                 * append == UINT32_MAX means that
+                 * ndr->data is either NULL or a valid
+                 * talloc child of ndr, which means
+                 * we can use data_blob_append() without
+                 * data_blob_talloc() of the existing callers data
+                 */
+                b = data_blob_const(ndr->data, ndr->data_size);
+        } else {
+                b = data_blob_talloc(ndr, ndr->data, ndr->data_size);
+                if (b.data == NULL) {
+                        return ndr_pull_error(ndr, NDR_ERR_ALLOC, "%s", __location__);
+                }
+        }
+
+        ok = data_blob_append(ndr, &b, blob->data, blob->length);
+        if (!ok) {
+                return ndr_pull_error(ndr, NDR_ERR_ALLOC, "%s", __location__);
+        }
+
+        ndr->data = b.data;
+        ndr->data_size = b.length;
+
+        return ndr_token_store(ndr, &ndr->array_size_list, ndr, UINT32_MAX);
+}
+
+_PUBLIC_ enum ndr_err_code ndr_pull_pop(struct ndr_pull *ndr)
+{
+        uint32_t skip = 0;
+        uint32_t append = 0;
+
+        if (ndr->relative_base_offset != 0) {
+                return ndr_pull_error(ndr, NDR_ERR_RELATIVE,
+                                      "%s", __location__);
+        }
+        if (ndr->relative_highest_offset != 0) {
+                return ndr_pull_error(ndr, NDR_ERR_RELATIVE,
+                                      "%s", __location__);
+        }
+        if (ndr->relative_list != NULL) {
+                return ndr_pull_error(ndr, NDR_ERR_RELATIVE,
+                                      "%s", __location__);
+        }
+        if (ndr->relative_base_list != NULL) {
+                return ndr_pull_error(ndr, NDR_ERR_RELATIVE,
+                                      "%s", __location__);
+        }
+
+        /*
+         * we need to keep up to 7 bytes
+         * in order to get the aligment right.
+         */
+        skip = ndr->offset & 0xFFFFFFF8;
+
+        if (skip == 0) {
+                return NDR_ERR_SUCCESS;
+        }
+
+        ndr->offset -= skip;
+        ndr->data_size -= skip;
+
+        append = ndr_token_peek(&ndr->array_size_list, ndr);
+        if (append != UINT32_MAX) {
+                /*
+                 * here we assume, that ndr->data is not a
+                 * talloc child of ndr.
+                 */
+                ndr->data += skip;
+                return NDR_ERR_SUCCESS;
+        }
+
+        memmove(ndr->data, ndr->data + skip, ndr->data_size);
+
+        ndr->data = talloc_realloc(ndr, ndr->data, uint8_t, ndr->data_size);
+        if (ndr->data_size != 0 && ndr->data == NULL) {
+                return ndr_pull_error(ndr, NDR_ERR_ALLOC, "%s", __location__);
+        }
+
+        return NDR_ERR_SUCCESS;
+}
+
 /*
   advance by 'size' bytes
@@ -166 +271 @@
 
         return NDR_ERR_SUCCESS;
+}
+
+_PUBLIC_ void ndr_print_debugc_helper(struct ndr_print *ndr, const char *format, ...)
+{
+        va_list ap;
+        char *s = NULL;
+        uint32_t i;
+        int ret;
+        int dbgc_class;
+
+        va_start(ap, format);
+        ret = vasprintf(&s, format, ap);
+        va_end(ap);
+
+        if (ret == -1) {
+                return;
+        }
+
+        dbgc_class = *(int *)ndr->private_data;
+
+        if (ndr->no_newline) {
+                DEBUGADDC(dbgc_class, 1,("%s", s));
+                free(s);
+                return;
+        }
+
+        for (i=0;i<ndr->depth;i++) {
+                DEBUGADDC(dbgc_class, 1,("    "));
+        }
+
+        DEBUGADDC(dbgc_class, 1,("%s\n", s));
+        free(s);
 }
 
@@ -236 +373 @@
                                                                   "\n");
         }
+}
+
+/*
+  a useful helper function for printing idl structures via DEBUGC()
+*/
+_PUBLIC_ void ndr_print_debugc(int dbgc_class, ndr_print_fn_t fn, const char *name, void *ptr)
+{
+        struct ndr_print *ndr;
+
+        DEBUGC(dbgc_class, 1,(" "));
+
+        ndr = talloc_zero(NULL, struct ndr_print);
+        if (!ndr) return;
+        ndr->private_data = &dbgc_class;
+        ndr->print = ndr_print_debugc_helper;
+        ndr->depth = 1;
+        ndr->flags = 0;
+        fn(ndr, name, ptr);
+        talloc_free(ndr);
 }
 
@@ -403 +559 @@
         va_list ap;
         int ret;
+
+        if (ndr->flags & LIBNDR_FLAG_INCOMPLETE_BUFFER) {
+                switch (ndr_err) {
+                case NDR_ERR_BUFSIZE:
+                        return NDR_ERR_INCOMPLETE_BUFFER;
+                default:
+                        break;
+                }
+        }
 
         va_start(ap, format);
@@ -558 +723 @@
                 break;
         }
+        case 0xFFFFFFFF:
+                /*
+                 * a shallow copy like subcontext
+                 * useful for DCERPC pipe chunks.
+                 */
+                subndr = talloc_zero(ndr, struct ndr_pull);
+                NDR_ERR_HAVE_NO_MEMORY(subndr);
+
+                subndr->flags           = ndr->flags;
+                subndr->current_mem_ctx = ndr->current_mem_ctx;
+                subndr->data            = ndr->data;
+                subndr->offset          = ndr->offset;
+                subndr->data_size       = ndr->data_size;
+
+                *_subndr = subndr;
+                return NDR_ERR_SUCCESS;
+
         default:
                 return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT, "Bad subcontext (PULL) header_size %d", 
@@ -590 +772 @@
 {
         uint32_t advance;
-        if (size_is >= 0) {
+        uint32_t highest_ofs;
+
+        if (header_size == 0xFFFFFFFF) {
+                advance = subndr->offset - ndr->offset;
+        } else if (size_is >= 0) {
                 advance = size_is;
         } else if (header_size > 0) {
@@ -597 +783 @@
                 advance = subndr->offset;
         }
+
+        if (subndr->offset > ndr->relative_highest_offset) {
+                highest_ofs = subndr->offset;
+        } else {
+                highest_ofs = subndr->relative_highest_offset;
+        }
+        if (!(subndr->flags & LIBNDR_FLAG_SUBCONTEXT_NO_UNREAD_BYTES)) {
+                /*
+                 * avoid an error unless SUBCONTEXT_NO_UNREAD_BYTES is specified
+                 */
+                highest_ofs = advance;
+        }
+        if (highest_ofs < advance) {
+                return ndr_pull_error(subndr, NDR_ERR_UNREAD_BYTES,
+                                      "not all bytes consumed ofs[%u] advance[%u]",
+                                      highest_ofs, advance);
+        }
+
         NDR_CHECK(ndr_pull_advance(ndr, advance));
         return NDR_ERR_SUCCESS;
@@ -1441 +1645 @@
         { NDR_ERR_UNREAD_BYTES, "Unread Bytes" },
         { NDR_ERR_NDR64, "NDR64 assertion error" },
+        { NDR_ERR_INCOMPLETE_BUFFER, "Incomplete Buffer" },
         { 0, NULL }
 };

trunk/server/librpc/ndr/ndr_basic.c

@@ -62 +62 @@
 _PUBLIC_ enum ndr_err_code ndr_pull_int8(struct ndr_pull *ndr, int ndr_flags, int8_t *v)
 {
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_NEED_BYTES(ndr, 1);
         *v = (int8_t)CVAL(ndr->data, ndr->offset);
@@ -73 +74 @@
 _PUBLIC_ enum ndr_err_code ndr_pull_uint8(struct ndr_pull *ndr, int ndr_flags, uint8_t *v)
 {
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_NEED_BYTES(ndr, 1);
         *v = CVAL(ndr->data, ndr->offset);
@@ -84 +86 @@
 _PUBLIC_ enum ndr_err_code ndr_pull_int16(struct ndr_pull *ndr, int ndr_flags, int16_t *v)
 {
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, 2);
         NDR_PULL_NEED_BYTES(ndr, 2);
@@ -96 +99 @@
 _PUBLIC_ enum ndr_err_code ndr_pull_uint16(struct ndr_pull *ndr, int ndr_flags, uint16_t *v)
 {
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, 2);
         NDR_PULL_NEED_BYTES(ndr, 2);
@@ -108 +112 @@
 _PUBLIC_ enum ndr_err_code ndr_pull_uint1632(struct ndr_pull *ndr, int ndr_flags, uint16_t *v)
 {
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         if (unlikely(ndr->flags & LIBNDR_FLAG_NDR64)) {
                 uint32_t v32 = 0;
@@ -126 +131 @@
 _PUBLIC_ enum ndr_err_code ndr_pull_int32(struct ndr_pull *ndr, int ndr_flags, int32_t *v)
 {
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, 4);
         NDR_PULL_NEED_BYTES(ndr, 4);
@@ -138 +144 @@
 _PUBLIC_ enum ndr_err_code ndr_pull_uint32(struct ndr_pull *ndr, int ndr_flags, uint32_t *v)
 {
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, 4);
         NDR_PULL_NEED_BYTES(ndr, 4);
@@ -152 +159 @@
         uint64_t v64;
         enum ndr_err_code err;
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         if (likely(!(ndr->flags & LIBNDR_FLAG_NDR64))) {
                 return ndr_pull_uint32(ndr, ndr_flags, v);
@@ -170 +178 @@
 _PUBLIC_ enum ndr_err_code ndr_pull_double(struct ndr_pull *ndr, int ndr_flags, double *v)
 {
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, 8);
         NDR_PULL_NEED_BYTES(ndr, 8);
@@ -218 +227 @@
 _PUBLIC_ enum ndr_err_code ndr_pull_udlong(struct ndr_pull *ndr, int ndr_flags, uint64_t *v)
 {
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, 4);
         NDR_PULL_NEED_BYTES(ndr, 8);
@@ -231 +241 @@
 _PUBLIC_ enum ndr_err_code ndr_pull_udlongr(struct ndr_pull *ndr, int ndr_flags, uint64_t *v)
 {
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, 4);
         NDR_PULL_NEED_BYTES(ndr, 8);
@@ -265 +276 @@
 {
         uintptr_t h;
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PULL_ALIGN(ndr, sizeof(h));
         NDR_PULL_NEED_BYTES(ndr, sizeof(h));
@@ -279 +291 @@
 {
         uint32_t v;
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &v));
         *status = NT_STATUS(v);
@@ -303 +316 @@
 {
         uint32_t v;
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &v));
         *status = W_ERROR(v);
@@ -415 +429 @@
 _PUBLIC_ enum ndr_err_code ndr_pull_array_uint8(struct ndr_pull *ndr, int ndr_flags, uint8_t *data, uint32_t n)
 {
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         if (!(ndr_flags & NDR_SCALARS)) {
                 return NDR_ERR_SUCCESS;
@@ -426 +441 @@
 _PUBLIC_ enum ndr_err_code ndr_push_int8(struct ndr_push *ndr, int ndr_flags, int8_t v)
 {
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_NEED_BYTES(ndr, 1);
         SCVAL(ndr->data, ndr->offset, (uint8_t)v);
@@ -437 +453 @@
 _PUBLIC_ enum ndr_err_code ndr_push_uint8(struct ndr_push *ndr, int ndr_flags, uint8_t v)
 {
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_NEED_BYTES(ndr, 1);
         SCVAL(ndr->data, ndr->offset, v);
@@ -448 +465 @@
 _PUBLIC_ enum ndr_err_code ndr_push_int16(struct ndr_push *ndr, int ndr_flags, int16_t v)
 {
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, 2);
         NDR_PUSH_NEED_BYTES(ndr, 2);
@@ -460 +478 @@
 _PUBLIC_ enum ndr_err_code ndr_push_uint16(struct ndr_push *ndr, int ndr_flags, uint16_t v)
 {
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, 2);
         NDR_PUSH_NEED_BYTES(ndr, 2);
@@ -483 +502 @@
 _PUBLIC_ enum ndr_err_code ndr_push_int32(struct ndr_push *ndr, int ndr_flags, int32_t v)
 {
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, 4);
         NDR_PUSH_NEED_BYTES(ndr, 4);
@@ -495 +515 @@
 _PUBLIC_ enum ndr_err_code ndr_push_uint32(struct ndr_push *ndr, int ndr_flags, uint32_t v)
 {
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, 4);
         NDR_PUSH_NEED_BYTES(ndr, 4);
@@ -518 +539 @@
 _PUBLIC_ enum ndr_err_code ndr_push_udlong(struct ndr_push *ndr, int ndr_flags, uint64_t v)
 {
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, 4);
         NDR_PUSH_NEED_BYTES(ndr, 8);
@@ -531 +553 @@
 _PUBLIC_ enum ndr_err_code ndr_push_udlongr(struct ndr_push *ndr, int ndr_flags, uint64_t v)
 {
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, 4);
         NDR_PUSH_NEED_BYTES(ndr, 8);
@@ -564 +587 @@
 _PUBLIC_ enum ndr_err_code ndr_push_double(struct ndr_push *ndr, int ndr_flags, double v)
 {
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, 8);
         NDR_PUSH_NEED_BYTES(ndr, 8);
@@ -577 +601 @@
 {
         uintptr_t h = (intptr_t)v;
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_PUSH_ALIGN(ndr, sizeof(h));
         NDR_PUSH_NEED_BYTES(ndr, sizeof(h));
@@ -687 +712 @@
 _PUBLIC_ enum ndr_err_code ndr_push_array_uint8(struct ndr_push *ndr, int ndr_flags, const uint8_t *data, uint32_t n)
 {
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         if (!(ndr_flags & NDR_SCALARS)) {
                 return NDR_ERR_SUCCESS;
@@ -739 +765 @@
 _PUBLIC_ enum ndr_err_code ndr_push_NTTIME(struct ndr_push *ndr, int ndr_flags, NTTIME t)
 {
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_CHECK(ndr_push_udlong(ndr, ndr_flags, t));
         return NDR_ERR_SUCCESS;
@@ -748 +775 @@
 _PUBLIC_ enum ndr_err_code ndr_pull_NTTIME(struct ndr_pull *ndr, int ndr_flags, NTTIME *t)
 {
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_CHECK(ndr_pull_udlong(ndr, ndr_flags, t));
         return NDR_ERR_SUCCESS;
@@ -757 +785 @@
 _PUBLIC_ enum ndr_err_code ndr_push_NTTIME_1sec(struct ndr_push *ndr, int ndr_flags, NTTIME t)
 {
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         t /= 10000000;
         NDR_CHECK(ndr_push_hyper(ndr, ndr_flags, t));
@@ -767 +796 @@
 _PUBLIC_ enum ndr_err_code ndr_pull_NTTIME_1sec(struct ndr_pull *ndr, int ndr_flags, NTTIME *t)
 {
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_CHECK(ndr_pull_hyper(ndr, ndr_flags, t));
         (*t) *= 10000000;
@@ -777 +807 @@
 _PUBLIC_ enum ndr_err_code ndr_pull_NTTIME_hyper(struct ndr_pull *ndr, int ndr_flags, NTTIME *t)
 {
+        NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
         NDR_CHECK(ndr_pull_hyper(ndr, ndr_flags, t));
         return NDR_ERR_SUCCESS;
@@ -786 +817 @@
 _PUBLIC_ enum ndr_err_code ndr_push_NTTIME_hyper(struct ndr_push *ndr, int ndr_flags, NTTIME t)
 {
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         NDR_CHECK(ndr_push_hyper(ndr, ndr_flags, t));
         return NDR_ERR_SUCCESS;
@@ -815 +847 @@
 _PUBLIC_ enum ndr_err_code ndr_push_uid_t(struct ndr_push *ndr, int ndr_flags, uid_t u)
 {
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         return ndr_push_hyper(ndr, NDR_SCALARS, (uint64_t)u);
 }
@@ -840 +873 @@
 _PUBLIC_ enum ndr_err_code ndr_push_gid_t(struct ndr_push *ndr, int ndr_flags, gid_t g)
 {
+        NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
         return ndr_push_hyper(ndr, NDR_SCALARS, (uint64_t)g);
 }

trunk/server/librpc/ndr/ndr_misc.c

@@ -36 +36 @@
                 && (i1->if_version == i2->if_version);
 }
+
+_PUBLIC_ char *ndr_syntax_id_to_string(TALLOC_CTX *mem_ctx, const struct ndr_syntax_id *id)
+{
+        return talloc_asprintf(mem_ctx,
+                               "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x/0x%08x",
+                               id->uuid.time_low, id->uuid.time_mid,
+                               id->uuid.time_hi_and_version,
+                               id->uuid.clock_seq[0],
+                               id->uuid.clock_seq[1],
+                               id->uuid.node[0], id->uuid.node[1],
+                               id->uuid.node[2], id->uuid.node[3],
+                               id->uuid.node[4], id->uuid.node[5],
+                               (unsigned)id->if_version);
+}
+
+_PUBLIC_ bool ndr_syntax_id_from_string(const char *s, struct ndr_syntax_id *id)
+{
+        int ret;
+        size_t i;
+        uint32_t time_low;
+        uint32_t time_mid, time_hi_and_version;
+        uint32_t clock_seq[2];
+        uint32_t node[6];
+        uint32_t if_version;
+
+        ret = sscanf(s,
+                     "%08x-%04x-%04x-%02x%02x-%02x%02x%02x%02x%02x%02x/0x%08x",
+                     &time_low, &time_mid, &time_hi_and_version,
+                     &clock_seq[0], &clock_seq[1],
+                     &node[0], &node[1], &node[2], &node[3], &node[4], &node[5],
+                     &if_version);
+        if (ret != 12) {
+                return false;
+        }
+
+        id->uuid.time_low = time_low;
+        id->uuid.time_mid = time_mid;
+        id->uuid.time_hi_and_version = time_hi_and_version;
+        id->uuid.clock_seq[0] = clock_seq[0];
+        id->uuid.clock_seq[1] = clock_seq[1];
+        for (i=0; i<6; i++) {
+                id->uuid.node[i] = node[i];
+        }
+        id->if_version = if_version;
+
+        return true;
+}

trunk/server/librpc/ndr/ndr_ntlmssp.c

@@ -177 +177 @@
 }
 
+_PUBLIC_ struct AV_PAIR *ndr_ntlmssp_find_av(const struct AV_PAIR_LIST *av_list,
+                                             enum ntlmssp_AvId AvId)
+{
+        struct AV_PAIR *res = NULL;
+        uint32_t i = 0;
 
+        for (i = 0; i < av_list->count; i++) {
+                if (av_list->pair[i].AvId != AvId) {
+                        continue;
+                }
+
+                res = discard_const_p(struct AV_PAIR, &av_list->pair[i]);
+                break;
+        }
+
+        return res;
+}

trunk/server/librpc/ndr/ndr_ntlmssp.h

@@ -32 +32 @@
 _PUBLIC_ void ndr_print_ntlmssp_Version(struct ndr_print *ndr, const char *name, const union ntlmssp_Version *r);
 
+_PUBLIC_ struct AV_PAIR *ndr_ntlmssp_find_av(const struct AV_PAIR_LIST *av_list,
+                                             enum ntlmssp_AvId AvId);

trunk/server/librpc/rpc/dcerpc_util.c

@@ -28 +28 @@
 #include "librpc/gen_ndr/ndr_dcerpc.h"
 #include "rpc_common.h"
+#include "lib/util/bitmap.h"
 
 /* we need to be able to get/set the fragment length without doing a full
@@ -92 +93 @@
 * @return               - A NTSTATUS error code.
 */
-NTSTATUS dcerpc_pull_auth_trailer(struct ncacn_packet *pkt,
+NTSTATUS dcerpc_pull_auth_trailer(const struct ncacn_packet *pkt,
                                   TALLOC_CTX *mem_ctx,
-                                  DATA_BLOB *pkt_trailer,
+                                  const DATA_BLOB *pkt_trailer,
                                   struct dcerpc_auth *auth,
-                                  uint32_t *auth_length,
+                                  uint32_t *_auth_length,
                                   bool auth_data_only)
 {
         struct ndr_pull *ndr;
         enum ndr_err_code ndr_err;
-        uint32_t data_and_pad;
-
-        data_and_pad = pkt_trailer->length
-                        - (DCERPC_AUTH_TRAILER_LENGTH + pkt->auth_length);
-
-        /* paranoia check for pad size. This would be caught anyway by
-           the ndr_pull_advance() a few lines down, but it scared
-           Jeremy enough for him to call me, so we might as well check
-           it now, just to prevent someone posting a bogus YouTube
-           video in the future.
-        */
-        if (data_and_pad > pkt_trailer->length) {
-                return NT_STATUS_INFO_LENGTH_MISMATCH;
-        }
-
-        *auth_length = pkt_trailer->length - data_and_pad;
+        uint16_t data_and_pad;
+        uint16_t auth_length;
+        uint32_t tmp_length;
+
+        ZERO_STRUCTP(auth);
+        if (_auth_length != NULL) {
+                *_auth_length = 0;
+        }
+
+        /* Paranoia checks for auth_length. The caller should check this... */
+        if (pkt->auth_length == 0) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        /* Paranoia checks for auth_length. The caller should check this... */
+        if (pkt->auth_length > pkt->frag_length) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        tmp_length = DCERPC_NCACN_PAYLOAD_OFFSET;
+        tmp_length += DCERPC_AUTH_TRAILER_LENGTH;
+        tmp_length += pkt->auth_length;
+        if (tmp_length > pkt->frag_length) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+        if (pkt_trailer->length > UINT16_MAX) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        auth_length = DCERPC_AUTH_TRAILER_LENGTH + pkt->auth_length;
+        if (pkt_trailer->length < auth_length) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+
+        data_and_pad = pkt_trailer->length - auth_length;
 
         ndr = ndr_pull_init_blob(pkt_trailer, mem_ctx);
@@ -136 +155 @@
         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
                 talloc_free(ndr);
+                ZERO_STRUCTP(auth);
                 return ndr_map_error2ntstatus(ndr_err);
         }
 
-        if (auth_data_only && data_and_pad != auth->auth_pad_length) {
-                DEBUG(1, (__location__ ": WARNING: pad length mismatch. "
+        if (data_and_pad < auth->auth_pad_length) {
+                DEBUG(1, (__location__ ": ERROR: pad length mismatch. "
                           "Calculated %u  got %u\n",
                           (unsigned)data_and_pad,
                           (unsigned)auth->auth_pad_length));
+                talloc_free(ndr);
+                ZERO_STRUCTP(auth);
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+
+        if (auth_data_only && data_and_pad != auth->auth_pad_length) {
+                DEBUG(1, (__location__ ": ERROR: pad length mismatch. "
+                          "Calculated %u  got %u\n",
+                          (unsigned)data_and_pad,
+                          (unsigned)auth->auth_pad_length));
+                talloc_free(ndr);
+                ZERO_STRUCTP(auth);
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
         }
 
@@ -151 +184 @@
         talloc_steal(mem_ctx, auth->credentials.data);
         talloc_free(ndr);
+
+        if (_auth_length != NULL) {
+                *_auth_length = auth_length;
+        }
+
+        return NT_STATUS_OK;
+}
+
+/**
+* @brief        Verify the fields in ncacn_packet header.
+*
+* @param pkt            - The ncacn_packet strcuture
+* @param ptype          - The expected PDU type
+* @param max_auth_info  - The maximum size of a possible auth trailer
+* @param required_flags - The required flags for the pdu.
+* @param optional_flags - The possible optional flags for the pdu.
+*
+* @return               - A NTSTATUS error code.
+*/
+NTSTATUS dcerpc_verify_ncacn_packet_header(const struct ncacn_packet *pkt,
+                                           enum dcerpc_pkt_type ptype,
+                                           size_t max_auth_info,
+                                           uint8_t required_flags,
+                                           uint8_t optional_flags)
+{
+        if (pkt->rpc_vers != 5) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+
+        if (pkt->rpc_vers_minor != 0) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+
+        if (pkt->auth_length > pkt->frag_length) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+
+        if (pkt->ptype != ptype) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+
+        if (max_auth_info > UINT16_MAX) {
+                return NT_STATUS_INTERNAL_ERROR;
+        }
+
+        if (pkt->auth_length > 0) {
+                size_t max_auth_length;
+
+                if (max_auth_info <= DCERPC_AUTH_TRAILER_LENGTH) {
+                        return NT_STATUS_RPC_PROTOCOL_ERROR;
+                }
+                max_auth_length = max_auth_info - DCERPC_AUTH_TRAILER_LENGTH;
+
+                if (pkt->auth_length > max_auth_length) {
+                        return NT_STATUS_RPC_PROTOCOL_ERROR;
+                }
+        }
+
+        if ((pkt->pfc_flags & required_flags) != required_flags) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        if (pkt->pfc_flags & ~(optional_flags|required_flags)) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+
+        if (pkt->drep[0] & ~DCERPC_DREP_LE) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        if (pkt->drep[1] != 0) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        if (pkt->drep[2] != 0) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
+        if (pkt->drep[3] != 0) {
+                return NT_STATUS_RPC_PROTOCOL_ERROR;
+        }
 
         return NT_STATUS_OK;
@@ -342 +452 @@
         return NT_STATUS_OK;
 }
+
+struct dcerpc_sec_vt_header2 dcerpc_sec_vt_header2_from_ncacn_packet(const struct ncacn_packet *pkt)
+{
+        struct dcerpc_sec_vt_header2 ret;
+
+        ZERO_STRUCT(ret);
+        ret.ptype = pkt->ptype;
+        memcpy(&ret.drep, pkt->drep, sizeof(ret.drep));
+        ret.call_id = pkt->call_id;
+
+        switch (pkt->ptype) {
+        case DCERPC_PKT_REQUEST:
+                ret.context_id = pkt->u.request.context_id;
+                ret.opnum      = pkt->u.request.opnum;
+                break;
+
+        case DCERPC_PKT_RESPONSE:
+                ret.context_id = pkt->u.response.context_id;
+                break;
+
+        case DCERPC_PKT_FAULT:
+                ret.context_id = pkt->u.fault.context_id;
+                break;
+
+        default:
+                break;
+        }
+
+        return ret;
+}
+
+bool dcerpc_sec_vt_header2_equal(const struct dcerpc_sec_vt_header2 *v1,
+                                 const struct dcerpc_sec_vt_header2 *v2)
+{
+        if (v1->ptype != v2->ptype) {
+                return false;
+        }
+
+        if (memcmp(v1->drep, v2->drep, sizeof(v1->drep)) != 0) {
+                return false;
+        }
+
+        if (v1->call_id != v2->call_id) {
+                return false;
+        }
+
+        if (v1->context_id != v2->context_id) {
+                return false;
+        }
+
+        if (v1->opnum != v2->opnum) {
+                return false;
+        }
+
+        return true;
+}
+
+static bool dcerpc_sec_vt_is_valid(const struct dcerpc_sec_verification_trailer *r)
+{
+        bool ret = false;
+        TALLOC_CTX *frame = talloc_stackframe();
+        struct bitmap *commands_seen;
+        int i;
+
+        if (r->count.count == 0) {
+                ret = true;
+                goto done;
+        }
+
+        if (memcmp(r->magic, DCERPC_SEC_VT_MAGIC, sizeof(r->magic)) != 0) {
+                goto done;
+        }
+
+        commands_seen = bitmap_talloc(frame, DCERPC_SEC_VT_COMMAND_ENUM + 1);
+        if (commands_seen == NULL) {
+                goto done;
+        }
+
+        for (i=0; i < r->count.count; i++) {
+                enum dcerpc_sec_vt_command_enum cmd =
+                        r->commands[i].command & DCERPC_SEC_VT_COMMAND_ENUM;
+
+                if (bitmap_query(commands_seen, cmd)) {
+                        /* Each command must appear at most once. */
+                        goto done;
+                }
+                bitmap_set(commands_seen, cmd);
+
+                switch (cmd) {
+                case DCERPC_SEC_VT_COMMAND_BITMASK1:
+                case DCERPC_SEC_VT_COMMAND_PCONTEXT:
+                case DCERPC_SEC_VT_COMMAND_HEADER2:
+                        break;
+                default:
+                        if ((r->commands[i].u._unknown.length % 4) != 0) {
+                                goto done;
+                        }
+                        break;
+                }
+        }
+        ret = true;
+done:
+        TALLOC_FREE(frame);
+        return ret;
+}
+
+#define CHECK(msg, ok)                                          \
+do {                                                            \
+        if (!ok) {                                              \
+                DEBUG(10, ("SEC_VT check %s failed\n", msg));   \
+                return false;                                   \
+        }                                                       \
+} while(0)
+
+#define CHECK_SYNTAX(msg, s1, s2)                                       \
+do {                                                            \
+        if (!ndr_syntax_id_equal(&s1, &s2)) {                           \
+                TALLOC_CTX *frame = talloc_stackframe();                \
+                DEBUG(10, ("SEC_VT check %s failed: %s vs. %s\n", msg,  \
+                           ndr_syntax_id_to_string(frame, &s1),         \
+                           ndr_syntax_id_to_string(frame, &s1)));       \
+                TALLOC_FREE(frame);                                     \
+                return false;                                           \
+        }                                                               \
+} while(0)
+
+
+bool dcerpc_sec_verification_trailer_check(
+                const struct dcerpc_sec_verification_trailer *vt,
+                const uint32_t *bitmask1,
+                const struct dcerpc_sec_vt_pcontext *pcontext,
+                const struct dcerpc_sec_vt_header2 *header2)
+{
+        size_t i;
+
+        if (!dcerpc_sec_vt_is_valid(vt)) {
+                return false;
+        }
+
+        for (i=0; i < vt->count.count; i++) {
+                struct dcerpc_sec_vt *c = &vt->commands[i];
+
+                switch (c->command & DCERPC_SEC_VT_COMMAND_ENUM) {
+                case DCERPC_SEC_VT_COMMAND_BITMASK1:
+                        if (bitmask1 == NULL) {
+                                CHECK("Bitmask1 must_process_command",
+                                      !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
+                                break;
+                        }
+
+                        if (c->u.bitmask1 & DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING) {
+                                CHECK("Bitmask1 client_header_signing",
+                                      *bitmask1 & DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING);
+                        }
+                        break;
+
+                case DCERPC_SEC_VT_COMMAND_PCONTEXT:
+                        if (pcontext == NULL) {
+                                CHECK("Pcontext must_process_command",
+                                      !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
+                                break;
+                        }
+
+                        CHECK_SYNTAX("Pcontect abstract_syntax",
+                                     pcontext->abstract_syntax,
+                                     c->u.pcontext.abstract_syntax);
+                        CHECK_SYNTAX("Pcontext transfer_syntax",
+                                     pcontext->transfer_syntax,
+                                     c->u.pcontext.transfer_syntax);
+                        break;
+
+                case DCERPC_SEC_VT_COMMAND_HEADER2: {
+                        if (header2 == NULL) {
+                                CHECK("Header2 must_process_command",
+                                      !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
+                                break;
+                        }
+
+                        CHECK("Header2", dcerpc_sec_vt_header2_equal(header2, &c->u.header2));
+                        break;
+                }
+
+                default:
+                        CHECK("Unknown must_process_command",
+                              !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
+                        break;
+                }
+        }
+
+        return true;
+}

trunk/server/librpc/rpc/rpc_common.h

@@ -159 +159 @@
 * @return               - A NTSTATUS error code.
 */
-NTSTATUS dcerpc_pull_auth_trailer(struct ncacn_packet *pkt,
+NTSTATUS dcerpc_pull_auth_trailer(const struct ncacn_packet *pkt,
                                   TALLOC_CTX *mem_ctx,
-                                  DATA_BLOB *pkt_trailer,
+                                  const DATA_BLOB *pkt_trailer,
                                   struct dcerpc_auth *auth,
                                   uint32_t *auth_length,
                                   bool auth_data_only);
+NTSTATUS dcerpc_verify_ncacn_packet_header(const struct ncacn_packet *pkt,
+                                           enum dcerpc_pkt_type ptype,
+                                           size_t max_auth_info,
+                                           uint8_t required_flags,
+                                           uint8_t optional_flags);
 struct tevent_req *dcerpc_read_ncacn_packet_send(TALLOC_CTX *mem_ctx,
                                                  struct tevent_context *ev,
@@ -297 +302 @@
                                     void *r_ptr);
 
+/**
+ * Extract header information from a ncacn_packet
+ * as a dcerpc_sec_vt_header2 as used by the security verification trailer.
+ *
+ * @param[in] pkt a packet
+ *
+ * @return a dcerpc_sec_vt_header2
+ */
+struct dcerpc_sec_vt_header2 dcerpc_sec_vt_header2_from_ncacn_packet(const struct ncacn_packet *pkt);
+
+
+/**
+ * Test if two dcerpc_sec_vt_header2 structures are equal
+ * without consideration of reserved fields.
+ *
+ * @param v1 a pointer to a dcerpc_sec_vt_header2 structure
+ * @param v2 a pointer to a dcerpc_sec_vt_header2 structure
+ *
+ * @retval true if *v1 equals *v2
+ */
+bool dcerpc_sec_vt_header2_equal(const struct dcerpc_sec_vt_header2 *v1,
+                                 const struct dcerpc_sec_vt_header2 *v2);
+
+/**
+ * Check for consistency of the security verification trailer with the PDU header.
+ * See <a href="http://msdn.microsoft.com/en-us/library/cc243559.aspx">MS-RPCE 2.2.2.13</a>.
+ * A check with an empty trailer succeeds.
+ *
+ * @param[in] vt a pointer to the security verification trailer.
+ * @param[in] bitmask1 which flags were negotiated on the connection.
+ * @param[in] pcontext the syntaxes negotiatied for the presentation context.
+ * @param[in] header2 some fields from the PDU header.
+ *
+ * @retval true on success.
+ */
+bool dcerpc_sec_verification_trailer_check(
+                const struct dcerpc_sec_verification_trailer *vt,
+                const uint32_t *bitmask1,
+                const struct dcerpc_sec_vt_pcontext *pcontext,
+                const struct dcerpc_sec_vt_header2 *header2);
+
 #endif /* __DEFAULT_LIBRPC_RPCCOMMON_H__ */

trunk/server/librpc/wscript_build

@@ -275 +275 @@
 
 bld.SAMBA_SUBSYSTEM('NDR_DCERPC',
-        source='gen_ndr/ndr_dcerpc.c',
+        source='gen_ndr/ndr_dcerpc.c ndr/ndr_dcerpc.c',
         public_deps='ndr',
+        deps='bitmap',
         public_headers='gen_ndr/ndr_dcerpc.h gen_ndr/dcerpc.h',
         header_path= [ ('*gen_ndr*', 'gen_ndr') ],