libcli/auth/msrpc_parse.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3    simple kerberos5/SPNEGO routines
   4    Copyright (C) Andrew Tridgell 2001
   5    Copyright (C) Jim McDonough <jmcd@us.ibm.com> 2002
   6    Copyright (C) Andrew Bartlett 2002-2003
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "libcli/auth/msrpc_parse.h"
  24
  25 /*
  26   this is a tiny msrpc packet generator. I am only using this to
  27   avoid tying this code to a particular varient of our rpc code. This
  28   generator is not general enough for all our rpc needs, its just
  29   enough for the spnego/ntlmssp code
  30
  31   format specifiers are:
  32
  33   U = unicode string (input is unix string)
  34   a = address (input is char *unix_string)
  35       (1 byte type, 1 byte length, unicode/ASCII string, all inline)
  36   A = ASCII string (input is unix string)
  37   B = data blob (pointer + length)
  38   b = data blob in header (pointer + length)
  39   D
  40   d = word (4 bytes)
  41   C = constant ascii string
  42  */
  43 bool msrpc_gen(TALLOC_CTX *mem_ctx,
  44                DATA_BLOB *blob,
  45                const char *format, ...)
  46 {
  47         int i, j;
  48         bool ret;
  49         va_list ap;
  50         char *s;
  51         uint8_t *b;
  52         int head_size=0, data_size=0;
  53         int head_ofs, data_ofs;
  54         int *intargs;
  55         size_t n;
  56
  57         DATA_BLOB *pointers;
  58
  59         pointers = talloc_array(mem_ctx, DATA_BLOB, strlen(format));
  60         intargs = talloc_array(pointers, int, strlen(format));
  61
  62         /* first scan the format to work out the header and body size */
  63         va_start(ap, format);
  64         for (i=0; format[i]; i++) {
  65                 switch (format[i]) {
  66                 case 'U':
  67                         s = va_arg(ap, char *);
  68                         head_size += 8;
  69                         ret = push_ucs2_talloc(
  70                                 pointers,
  71                                 (smb_ucs2_t **)(void *)&pointers[i].data,
  72                                 s, &n);
  73                         if (!ret) {
  74                                 va_end(ap);
  75                                 return false;
  76                         }
  77                         pointers[i].length = n;
  78                         pointers[i].length -= 2;
  79                         data_size += pointers[i].length;
  80                         break;
  81                 case 'A':
  82                         s = va_arg(ap, char *);
  83                         head_size += 8;
  84                         ret = push_ascii_talloc(
  85                                 pointers, (char **)(void *)&pointers[i].data,
  86                                 s, &n);
  87                         if (!ret) {
  88                                 va_end(ap);
  89                                 return false;
  90                         }
  91                         pointers[i].length = n;
  92                         pointers[i].length -= 1;
  93                         data_size += pointers[i].length;
  94                         break;
  95                 case 'a':
  96                         j = va_arg(ap, int);
  97                         intargs[i] = j;
  98                         s = va_arg(ap, char *);
  99                         ret = push_ucs2_talloc(
 100                                 pointers,
 101                                 (smb_ucs2_t **)(void *)&pointers[i].data,
 102                                 s, &n);
 103                         if (!ret) {
 104                                 va_end(ap);
 105                                 return false;
 106                         }
 107                         pointers[i].length = n;
 108                         pointers[i].length -= 2;
 109                         data_size += pointers[i].length + 4;
 110                         break;
 111                 case 'B':
 112                         b = va_arg(ap, uint8_t *);
 113                         head_size += 8;
 114                         pointers[i].data = b;
 115                         pointers[i].length = va_arg(ap, int);
 116                         data_size += pointers[i].length;
 117                         break;
 118                 case 'b':
 119                         b = va_arg(ap, uint8_t *);
 120                         pointers[i].data = b;
 121                         pointers[i].length = va_arg(ap, int);
 122                         head_size += pointers[i].length;
 123                         break;
 124                 case 'd':
 125                         j = va_arg(ap, int);
 126                         intargs[i] = j;
 127                         head_size += 4;
 128                         break;
 129                 case 'C':
 130                         s = va_arg(ap, char *);
 131                         pointers[i].data = (uint8_t *)s;
 132                         pointers[i].length = strlen(s)+1;
 133                         head_size += pointers[i].length;
 134                         break;
 135                 }
 136         }
 137         va_end(ap);
 138
 139         /* allocate the space, then scan the format again to fill in the values */
 140         *blob = data_blob_talloc(mem_ctx, NULL, head_size + data_size);
 141
 142         head_ofs = 0;
 143         data_ofs = head_size;
 144
 145         va_start(ap, format);
 146         for (i=0; format[i]; i++) {
 147                 switch (format[i]) {
 148                 case 'U':
 149                 case 'A':
 150                 case 'B':
 151                         n = pointers[i].length;
 152                         SSVAL(blob->data, head_ofs, n); head_ofs += 2;
 153                         SSVAL(blob->data, head_ofs, n); head_ofs += 2;
 154                         SIVAL(blob->data, head_ofs, data_ofs); head_ofs += 4;
 155                         if (pointers[i].data && n) /* don't follow null pointers... */
 156                                 memcpy(blob->data+data_ofs, pointers[i].data, n);
 157                         data_ofs += n;
 158                         break;
 159                 case 'a':
 160                         j = intargs[i];
 161                         SSVAL(blob->data, data_ofs, j); data_ofs += 2;
 162
 163                         n = pointers[i].length;
 164                         SSVAL(blob->data, data_ofs, n); data_ofs += 2;
 165                         if (n >= 0) {
 166                                 memcpy(blob->data+data_ofs, pointers[i].data, n);
 167                         }
 168                         data_ofs += n;
 169                         break;
 170                 case 'd':
 171                         j = intargs[i];
 172                         SIVAL(blob->data, head_ofs, j);
 173                         head_ofs += 4;
 174                         break;
 175                 case 'b':
 176                         n = pointers[i].length;
 177                         if (pointers[i].data && n) {
 178                                 /* don't follow null pointers... */
 179                                 memcpy(blob->data + head_ofs, pointers[i].data, n);
 180                         }
 181                         head_ofs += n;
 182                         break;
 183                 case 'C':
 184                         n = pointers[i].length;
 185                         memcpy(blob->data + head_ofs, pointers[i].data, n);
 186                         head_ofs += n;
 187                         break;
 188                 }
 189         }
 190         va_end(ap);
 191
 192         talloc_free(pointers);
 193
 194         return true;
 195 }
 196
 197
 198 /* a helpful macro to avoid running over the end of our blob */
 199 #define NEED_DATA(amount) \
 200 if ((head_ofs + amount) > blob->length) { \
 201         va_end(ap); \
 202         return false; \
 203 }
 204
 205 /**
 206   this is a tiny msrpc packet parser. This the the partner of msrpc_gen
 207
 208   format specifiers are:
 209
 210   U = unicode string (output is unix string)
 211   A = ascii string
 212   B = data blob
 213   b = data blob in header
 214   d = word (4 bytes)
 215   C = constant ascii string
 216  */
 217
 218 bool msrpc_parse(TALLOC_CTX *mem_ctx,
 219                  const DATA_BLOB *blob,
 220                  const char *format, ...)
 221 {
 222         int i;
 223         va_list ap;
 224         char **ps, *s;
 225         DATA_BLOB *b;
 226         size_t head_ofs = 0;
 227         uint16_t len1, len2;
 228         uint32_t ptr;
 229         uint32_t *v;
 230         size_t p_len = 1024;
 231         char *p = talloc_array(mem_ctx, char, p_len);
 232         bool ret = true;
 233
 234         va_start(ap, format);
 235         for (i=0; format[i]; i++) {
 236                 switch (format[i]) {
 237                 case 'U':
 238                         NEED_DATA(8);
 239                         len1 = SVAL(blob->data, head_ofs); head_ofs += 2;
 240                         len2 = SVAL(blob->data, head_ofs); head_ofs += 2;
 241                         ptr =  IVAL(blob->data, head_ofs); head_ofs += 4;
 242
 243                         ps = va_arg(ap, char **);
 244                         if (len1 == 0 && len2 == 0) {
 245                                 *ps = (char *)discard_const("");
 246                         } else {
 247                                 /* make sure its in the right format - be strict */
 248                                 if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
 249                                         ret = false;
 250                                         goto cleanup;
 251                                 }
 252                                 if (len1 & 1) {
 253                                         /* if odd length and unicode */
 254                                         ret = false;
 255                                         goto cleanup;
 256                                 }
 257                                 if (blob->data + ptr < (uint8_t *)(uintptr_t)ptr ||
 258                                                 blob->data + ptr < blob->data) {
 259                                         ret = false;
 260                                         goto cleanup;
 261                                 }
 262
 263                                 if (0 < len1) {
 264                                         size_t pull_len;
 265                                         if (!convert_string_talloc(mem_ctx, CH_UTF16, CH_UNIX,
 266                                                                    blob->data + ptr, len1,
 267                                                                    ps, &pull_len, false)) {
 268                                                 ret = false;
 269                                                 goto cleanup;
 270                                         }
 271                                 } else {
 272                                         (*ps) = (char *)discard_const("");
 273                                 }
 274                         }
 275                         break;
 276                 case 'A':
 277                         NEED_DATA(8);
 278                         len1 = SVAL(blob->data, head_ofs); head_ofs += 2;
 279                         len2 = SVAL(blob->data, head_ofs); head_ofs += 2;
 280                         ptr =  IVAL(blob->data, head_ofs); head_ofs += 4;
 281
 282                         ps = (char **)va_arg(ap, char **);
 283                         /* make sure its in the right format - be strict */
 284                         if (len1 == 0 && len2 == 0) {
 285                                 *ps = (char *)discard_const("");
 286                         } else {
 287                                 if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
 288                                         ret = false;
 289                                         goto cleanup;
 290                                 }
 291
 292                                 if (blob->data + ptr < (uint8_t *)(uintptr_t)ptr ||
 293                                                 blob->data + ptr < blob->data) {
 294                                         ret = false;
 295                                         goto cleanup;
 296                                 }
 297
 298                                 if (0 < len1) {
 299                                         size_t pull_len;
 300
 301                                         if (!convert_string_talloc(mem_ctx, CH_DOS, CH_UNIX,
 302                                                                    blob->data + ptr, len1,
 303                                                                    ps, &pull_len, false)) {
 304                                                 ret = false;
 305                                                 goto cleanup;
 306                                         }
 307                                 } else {
 308                                         (*ps) = (char *)discard_const("");
 309                                 }
 310                         }
 311                         break;
 312                 case 'B':
 313                         NEED_DATA(8);
 314                         len1 = SVAL(blob->data, head_ofs); head_ofs += 2;
 315                         len2 = SVAL(blob->data, head_ofs); head_ofs += 2;
 316                         ptr =  IVAL(blob->data, head_ofs); head_ofs += 4;
 317
 318                         b = (DATA_BLOB *)va_arg(ap, void *);
 319                         if (len1 == 0 && len2 == 0) {
 320                                 *b = data_blob_talloc(mem_ctx, NULL, 0);
 321                         } else {
 322                                 /* make sure its in the right format - be strict */
 323                                 if ((len1 != len2) || (ptr + len1 < ptr) || (ptr + len1 < len1) || (ptr + len1 > blob->length)) {
 324                                         ret = false;
 325                                         goto cleanup;
 326                                 }
 327
 328                                 if (blob->data + ptr < (uint8_t *)(uintptr_t)ptr ||
 329                                                 blob->data + ptr < blob->data) {
 330                                         ret = false;
 331                                         goto cleanup;
 332                                 }
 333
 334                                 *b = data_blob_talloc(mem_ctx, blob->data + ptr, len1);
 335                         }
 336                         break;
 337                 case 'b':
 338                         b = (DATA_BLOB *)va_arg(ap, void *);
 339                         len1 = va_arg(ap, unsigned int);
 340                         /* make sure its in the right format - be strict */
 341                         NEED_DATA(len1);
 342                         if (blob->data + head_ofs < (uint8_t *)head_ofs ||
 343                                         blob->data + head_ofs < blob->data) {
 344                                 ret = false;
 345                                 goto cleanup;
 346                         }
 347
 348                         *b = data_blob_talloc(mem_ctx, blob->data + head_ofs, len1);
 349                         head_ofs += len1;
 350                         break;
 351                 case 'd':
 352                         v = va_arg(ap, uint32_t *);
 353                         NEED_DATA(4);
 354                         *v = IVAL(blob->data, head_ofs); head_ofs += 4;
 355                         break;
 356                 case 'C':
 357                         s = va_arg(ap, char *);
 358
 359                         if (blob->data + head_ofs < (uint8_t *)head_ofs ||
 360                                         blob->data + head_ofs < blob->data ||
 361                             (head_ofs + (strlen(s) + 1)) > blob->length) {
 362                                 ret = false;
 363                                 goto cleanup;
 364                         }
 365
 366                         if (memcmp(blob->data + head_ofs, s, strlen(s)+1) != 0) {
 367                                 ret = false;
 368                                 goto cleanup;
 369                         }
 370                         head_ofs += (strlen(s) + 1);
 371
 372                         break;
 373                 }
 374         }
 375
 376 cleanup:
 377         va_end(ap);
 378         talloc_free(p);
 379         return ret;
 380 }