librpc/ndr/ndr_dcerpc.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Manually parsed structures found in the DCERPC protocol
   5
   6    Copyright (C) Stefan Metzmacher 2014
   7    Copyright (C) Gregor Beck 2014
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "librpc/gen_ndr/ndr_dcerpc.h"
  25 #include "librpc/gen_ndr/ndr_misc.h"
  26
  27 /*
  28  * This function was generated by pidl and
  29  * has been extended by the (_available == 0) check.
  30  *
  31  * That's why we ignore the 80 char per line limit.
  32  */
  33 enum ndr_err_code ndr_pull_dcerpc_bind_nak(struct ndr_pull *ndr, int ndr_flags, struct dcerpc_bind_nak *r)
  34 {
  35         uint32_t size_versions_0 = 0;
  36         uint32_t cntr_versions_0;
  37         TALLOC_CTX *_mem_save_versions_0 = NULL;
  38         NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
  39         if (ndr_flags & NDR_SCALARS) {
  40                 uint32_t _available;
  41                 NDR_CHECK(ndr_pull_align(ndr, 4));
  42                 NDR_CHECK(ndr_pull_dcerpc_bind_nak_reason(ndr, NDR_SCALARS, &r->reject_reason));
  43                 _available = ndr->data_size - ndr->offset;
  44                 if (_available == 0) {
  45                         /*
  46                          * This works around a bug in older
  47                          * Samba (<= 4.1) releases.
  48                          *
  49                          * See bug #11327.
  50                          */
  51                         r->num_versions = 0;
  52                 } else {
  53                         NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &r->num_versions));
  54                 }
  55                 size_versions_0 = r->num_versions;
  56                 NDR_PULL_ALLOC_N(ndr, r->versions, size_versions_0);
  57                 _mem_save_versions_0 = NDR_PULL_GET_MEM_CTX(ndr);
  58                 NDR_PULL_SET_MEM_CTX(ndr, r->versions, 0);
  59                 for (cntr_versions_0 = 0; cntr_versions_0 < (size_versions_0); cntr_versions_0++) {
  60                         NDR_CHECK(ndr_pull_dcerpc_bind_nak_version(ndr, NDR_SCALARS, &r->versions[cntr_versions_0]));
  61                 }
  62                 NDR_PULL_SET_MEM_CTX(ndr, _mem_save_versions_0, 0);
  63                 {
  64                         uint32_t _flags_save_DATA_BLOB = ndr->flags;
  65                         ndr_set_flags(&ndr->flags, LIBNDR_FLAG_REMAINING);
  66                         NDR_CHECK(ndr_pull_DATA_BLOB(ndr, NDR_SCALARS, &r->_pad));
  67                         ndr->flags = _flags_save_DATA_BLOB;
  68                 }
  69                 NDR_CHECK(ndr_pull_trailer_align(ndr, 4));
  70         }
  71         if (ndr_flags & NDR_BUFFERS) {
  72         }
  73         return NDR_ERR_SUCCESS;
  74 }
  75
  76 const uint8_t DCERPC_SEC_VT_MAGIC[] = {0x8a,0xe3,0x13,0x71,0x02,0xf4,0x36,0x71};
  77
  78 _PUBLIC_ enum ndr_err_code ndr_push_dcerpc_sec_vt_count(struct ndr_push *ndr, int ndr_flags, const struct dcerpc_sec_vt_count *r)
  79 {
  80         NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
  81         /* nothing */
  82         return NDR_ERR_SUCCESS;
  83 }
  84
  85 _PUBLIC_ enum ndr_err_code ndr_pull_dcerpc_sec_vt_count(struct ndr_pull *ndr, int ndr_flags, struct dcerpc_sec_vt_count *r)
  86 {
  87         uint32_t _saved_ofs = ndr->offset;
  88
  89         NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
  90
  91         if (!(ndr_flags & NDR_SCALARS)) {
  92                 return NDR_ERR_SUCCESS;
  93         }
  94
  95         r->count = 0;
  96
  97         while (true) {
  98                 uint16_t command;
  99                 uint16_t length;
 100
 101                 NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &command));
 102                 NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &length));
 103                 NDR_CHECK(ndr_pull_advance(ndr, length));
 104
 105                 r->count += 1;
 106
 107                 if (command & DCERPC_SEC_VT_COMMAND_END) {
 108                         break;
 109                 }
 110         }
 111
 112         ndr->offset = _saved_ofs;
 113         return NDR_ERR_SUCCESS;
 114 }
 115
 116 _PUBLIC_ enum ndr_err_code ndr_pop_dcerpc_sec_verification_trailer(
 117         struct ndr_pull *ndr, TALLOC_CTX *mem_ctx,
 118         struct dcerpc_sec_verification_trailer **_r)
 119 {
 120         enum ndr_err_code ndr_err;
 121         uint32_t ofs;
 122         uint32_t min_ofs = 0;
 123         struct dcerpc_sec_verification_trailer *r;
 124         DATA_BLOB sub_blob = data_blob_null;
 125         struct ndr_pull *sub_ndr = NULL;
 126         uint32_t remaining;
 127
 128         *_r = NULL;
 129
 130         r = talloc_zero(mem_ctx, struct dcerpc_sec_verification_trailer);
 131         if (r == NULL) {
 132                 return NDR_ERR_ALLOC;
 133         }
 134
 135         if (ndr->data_size < sizeof(DCERPC_SEC_VT_MAGIC)) {
 136                 /*
 137                  * we return with r->count = 0
 138                  */
 139                 *_r = r;
 140                 return NDR_ERR_SUCCESS;
 141         }
 142
 143         ofs = ndr->data_size - sizeof(DCERPC_SEC_VT_MAGIC);
 144         /* the magic is 4 byte aligned */
 145         ofs &= ~3;
 146
 147         if (ofs > DCERPC_SEC_VT_MAX_SIZE) {
 148                 /*
 149                  * We just scan the last 1024 bytes.
 150                  */
 151                 min_ofs = ofs - DCERPC_SEC_VT_MAX_SIZE;
 152         } else {
 153                 min_ofs = 0;
 154         }
 155
 156         while (true) {
 157                 int ret;
 158
 159                 ret = memcmp(&ndr->data[ofs],
 160                              DCERPC_SEC_VT_MAGIC,
 161                              sizeof(DCERPC_SEC_VT_MAGIC));
 162                 if (ret == 0) {
 163                         sub_blob = data_blob_const(&ndr->data[ofs],
 164                                                    ndr->data_size - ofs);
 165                         break;
 166                 }
 167
 168                 if (ofs <= min_ofs) {
 169                         break;
 170                 }
 171
 172                 ofs -= 4;
 173         }
 174
 175         if (sub_blob.length == 0) {
 176                 /*
 177                  * we return with r->count = 0
 178                  */
 179                 *_r = r;
 180                 return NDR_ERR_SUCCESS;
 181         }
 182
 183         sub_ndr = ndr_pull_init_blob(&sub_blob, r);
 184         if (sub_ndr == NULL) {
 185                 TALLOC_FREE(r);
 186                 return NDR_ERR_ALLOC;
 187         }
 188
 189         ndr_err = ndr_pull_dcerpc_sec_verification_trailer(sub_ndr,
 190                                                            NDR_SCALARS | NDR_BUFFERS,
 191                                                            r);
 192         if (ndr_err == NDR_ERR_ALLOC) {
 193                 TALLOC_FREE(r);
 194                 return NDR_ERR_ALLOC;
 195         }
 196
 197         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 198                 goto ignore_error;
 199         }
 200
 201         remaining = sub_ndr->data_size - sub_ndr->offset;
 202         if (remaining > 16) {
 203                 /*
 204                  * we expect not more than 16 byte of additional
 205                  * padding after the verification trailer.
 206                  */
 207                 goto ignore_error;
 208         }
 209
 210         /*
 211          * We assume that we got a real verification trailer.
 212          *
 213          * We remove it from the available stub data.
 214          */
 215         ndr->data_size = ofs;
 216
 217         TALLOC_FREE(sub_ndr);
 218
 219         *_r = r;
 220         return NDR_ERR_SUCCESS;
 221
 222 ignore_error:
 223         TALLOC_FREE(sub_ndr);
 224         /*
 225          * just ignore the error, it's likely
 226          * that the magic we found belongs to
 227          * the stub data.
 228          *
 229          * we return with r->count = 0
 230          */
 231         ZERO_STRUCTP(r);
 232         *_r = r;
 233         return NDR_ERR_SUCCESS;
 234 }