librpc/ndr/ndr_cab.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    routines for marshalling/unmarshalling cab structures
   5
   6    Copyright (C) Guenther Deschner 2016
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #include "includes.h"
  23 #include "librpc/gen_ndr/ndr_cab.h"
  24 #include "librpc/ndr/ndr_compression.h"
  25
  26 #define OFFSET_OF_FOLDER_COFFCABSTART(folder) (36 /* cfheader size */ + (size_t)(folder)*8)
  27
  28 _PUBLIC_ void ndr_print_cf_time(struct ndr_print *ndr, const char *name, const struct cf_time *r)
  29 {
  30         uint8_t hour = 0, minute = 0, seconds = 0;
  31         char *s;
  32         if (r == NULL) { ndr_print_null(ndr); return; }
  33         hour = r->time >> 11;
  34         minute = (r->time >> 5) & 0x3f;
  35         seconds = (r->time << 1) & 0x3e;
  36         s = talloc_asprintf(ndr, "%02d:%02d:%02d", hour, minute, seconds);
  37         if (s == NULL) { return; }
  38         ndr_print_string(ndr, "time", s);
  39         talloc_free(s);
  40 }
  41
  42 _PUBLIC_ void ndr_print_cf_date(struct ndr_print *ndr, const char *name, const struct cf_date *r)
  43 {
  44         uint16_t year = 0;
  45         uint8_t month = 0, day = 0;
  46         char *s;
  47         if (r == NULL) { ndr_print_null(ndr); return; }
  48         year = (r->date >> 9);
  49         year += 1980;
  50         month = (r->date >> 5 & 0xf);
  51         day = (r->date & 0x1f);
  52         s = talloc_asprintf(ndr, "%02d/%02d/%04d", day, month, year);
  53         if (s == NULL) { return; }
  54         ndr_print_string(ndr, "date", s);
  55         talloc_free(s);
  56 }
  57
  58 uint32_t ndr_count_cfdata(const struct cab_file *r)
  59 {
  60         uint32_t count = 0, i;
  61
  62         for (i = 0; i < r->cfheader.cFolders; i++) {
  63                 if (count + r->cffolders[i].cCFData < count) {
  64                         /* Integer wrap. */
  65                         return 0;
  66                 }
  67                 count += r->cffolders[i].cCFData;
  68         }
  69
  70         return count;
  71 }
  72
  73 static uint32_t ndr_cab_compute_checksum(uint8_t *data, uint32_t length, uint32_t seed)
  74 {
  75         int num_ulong;
  76         uint32_t checksum;
  77         uint8_t *pb;
  78         uint32_t ul;
  79
  80         num_ulong = length / 4;
  81         checksum = seed;
  82         pb = data;
  83
  84         while (num_ulong-- > 0) {
  85                 ul = (uint32_t)(*pb++);
  86                 ul |= (((uint32_t)(*pb++)) <<  8);
  87                 ul |= (((uint32_t)(*pb++)) << 16);
  88                 ul |= (((uint32_t)(*pb++)) << 24);
  89
  90                 checksum ^= ul;
  91         }
  92
  93         ul = 0;
  94
  95         switch (length % 4) {
  96         case 3:
  97                 ul |= (((uint32_t)(*pb++)) << 16);
  98                 FALL_THROUGH;
  99         case 2:
 100                 ul |= (((uint32_t)(*pb++)) <<  8);
 101                 FALL_THROUGH;
 102         case 1:
 103                 ul |= (uint32_t)(*pb++);
 104                 FALL_THROUGH;
 105         default:
 106                 break;
 107         }
 108
 109         checksum ^= ul;
 110
 111         return checksum;
 112 }
 113
 114 /* Push all CFDATA of a folder.
 115  *
 116  * This works on a folder level because compression type is set per
 117  * folder, and a compression state can be shared between CFDATA of the
 118  * same folder.
 119  *
 120  * This is not a regular NDR func as we pass the compression type and
 121  * the number of CFDATA as extra arguments
 122  */
 123 static enum ndr_err_code ndr_push_folder_cfdata(struct ndr_push *ndr,
 124                                                 const struct CFDATA *r,
 125                                                 enum cf_compress_type cab_ctype,
 126                                                 size_t num_cfdata)
 127 {
 128         size_t i;
 129         enum ndr_compression_alg ndr_ctype = 0;
 130
 131         ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX|LIBNDR_FLAG_LITTLE_ENDIAN|LIBNDR_FLAG_NOALIGN);
 132
 133         if (cab_ctype == CF_COMPRESS_MSZIP) {
 134                 ndr_ctype = NDR_COMPRESSION_MSZIP_CAB;
 135                 NDR_CHECK(ndr_push_compression_state_init(ndr, ndr_ctype, &ndr->cstate));
 136         }
 137
 138         for (i = 0; i < num_cfdata; i++, r++) {
 139                 uint32_t compressed_length = 0;
 140                 uint32_t csum, csumPartial;
 141                 size_t compressed_offset, csum_offset, data_offset;
 142
 143                 if (!r->ab.data) {
 144                         return ndr_push_error(ndr, NDR_ERR_LENGTH,
 145                                               "NULL uncompressed data blob");
 146                 }
 147                 if (r->ab.length != r->cbUncomp) {
 148                         return ndr_push_error(ndr, NDR_ERR_LENGTH,
 149                                               "Uncompressed data blob size != uncompressed data size field");
 150                 }
 151
 152                 /*
 153                  * checksum is a function of the size fields
 154                  * and the potentially compressed data bytes,
 155                  * which haven't been compressed yet so
 156                  * remember offset, write zeroes, fill out
 157                  * later
 158                  */
 159                 csum_offset = ndr->offset;
 160                 NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, 0));
 161
 162                 /*
 163                  * similarly, we don't know the compressed
 164                  * size yet, remember offset, write zeros,
 165                  * fill out later
 166                  */
 167                 compressed_offset = ndr->offset;
 168                 NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, 0));
 169                 NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, r->cbUncomp));
 170
 171                 data_offset = ndr->offset;
 172
 173                 switch (cab_ctype) {
 174                 case CF_COMPRESS_NONE:
 175                         /* just copy the data */
 176                         NDR_PUSH_NEED_BYTES(ndr, r->ab.length);
 177                         NDR_CHECK(ndr_push_bytes(ndr, r->ab.data, r->ab.length));
 178                         compressed_length = r->ab.length;
 179                         break;
 180                 case CF_COMPRESS_LZX:
 181                         /*
 182                          * we have not yet worked out the details of LZX
 183                          * compression
 184                          */
 185                         return NDR_ERR_COMPRESSION;
 186
 187                 case CF_COMPRESS_MSZIP: {
 188                         struct ndr_push *push_sub, *push_compress;
 189
 190                         /* compress via subcontext */
 191                         NDR_CHECK(ndr_push_subcontext_start(ndr, &push_sub, 0, -1));
 192                         push_sub->cstate = ndr->cstate;
 193                         NDR_CHECK(ndr_push_compression_start(push_sub, &push_compress, ndr_ctype));
 194                         ndr_set_flags(&push_compress->flags, LIBNDR_FLAG_REMAINING);
 195                         NDR_CHECK(ndr_push_DATA_BLOB(push_compress, NDR_SCALARS, r->ab));
 196                         NDR_CHECK(ndr_push_compression_end(push_sub, push_compress, ndr_ctype));
 197                         NDR_CHECK(ndr_push_subcontext_end(ndr, push_sub, 0, -1));
 198                         compressed_length = push_sub->offset;
 199
 200                         break;
 201                         }
 202                 default:
 203                         return NDR_ERR_BAD_SWITCH;
 204                 }
 205
 206                 /* we can now write the compressed size and the checksum */
 207                 SSVAL(ndr->data, compressed_offset, compressed_length);
 208
 209                 /*
 210                  * Create checksum over compressed data.
 211                  *
 212                  * The 8 bytes are the header size.
 213                  *
 214                  * We have already have written the checksum and set it to zero,
 215                  * earlier. So we know that after the checksum end the value
 216                  * for the compressed length comes the blob data.
 217                  *
 218                  * NDR already did all the checks for integer wraps.
 219                  */
 220                 csumPartial = ndr_cab_compute_checksum(&ndr->data[data_offset],
 221                                                        compressed_length, 0);
 222
 223                 /*
 224                  * Checksum over header (compressed and uncompressed length).
 225                  *
 226                  * The first 4 bytes are the checksum size.
 227                  * The second 4 bytes are the size of the compressed and
 228                  * uncompressed length fields.
 229                  *
 230                  * NDR already did all the checks for integer wraps.
 231                  */
 232                 csum = ndr_cab_compute_checksum(&ndr->data[compressed_offset],
 233                                                 data_offset - compressed_offset,
 234                                                 csumPartial);
 235
 236                 SIVAL(ndr->data, csum_offset, csum);
 237         }
 238
 239         TALLOC_FREE(ndr->cstate);
 240
 241         return NDR_ERR_SUCCESS;
 242 }
 243
 244 _PUBLIC_ enum ndr_err_code ndr_push_cab_file(struct ndr_push *ndr, int ndr_flags, const struct cab_file *r)
 245 {
 246         uint32_t cntr_cffolders_0;
 247         uint32_t cntr_cffiles_0;
 248         size_t processed_cfdata = 0;
 249         {
 250                 uint32_t _flags_save_STRUCT = ndr->flags;
 251                 ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX|LIBNDR_FLAG_LITTLE_ENDIAN|LIBNDR_FLAG_NOALIGN);
 252                 NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
 253
 254                 if (ndr_flags & NDR_SCALARS) {
 255                         uint32_t i;
 256                         NDR_CHECK(ndr_push_align(ndr, 4));
 257                         NDR_CHECK(ndr_push_CFHEADER(ndr, NDR_SCALARS, &r->cfheader));
 258                         for (cntr_cffolders_0 = 0; cntr_cffolders_0 < (r->cfheader.cFolders); cntr_cffolders_0++) {
 259                                 NDR_CHECK(ndr_push_CFFOLDER(ndr, NDR_SCALARS, &r->cffolders[cntr_cffolders_0]));
 260                         }
 261                         for (cntr_cffiles_0 = 0; cntr_cffiles_0 < (r->cfheader.cFiles); cntr_cffiles_0++) {
 262                                 NDR_CHECK(ndr_push_CFFILE(ndr, NDR_SCALARS, &r->cffiles[cntr_cffiles_0]));
 263                         }
 264 #if 0
 265                         NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_count_cfdata(r)));
 266 #endif
 267
 268                         /* write in the folder header the offset of its first data block */
 269                         for (i = 0; i < r->cfheader.cFolders; i++) {
 270                                 size_t off = OFFSET_OF_FOLDER_COFFCABSTART(i);
 271                                 /* check that the offset we want to
 272                                  * write to is always inside our
 273                                  * current push buffer
 274                                  */
 275                                 if (off >= ndr->offset) {
 276                                         return ndr_push_error(ndr, NDR_ERR_OFFSET,
 277                                                               "trying to write past current push buffer size");
 278                                 }
 279                                 SIVAL(ndr->data, off, ndr->offset);
 280                                 NDR_CHECK(ndr_push_folder_cfdata(ndr, r->cfdata + processed_cfdata, r->cffolders[i].typeCompress, r->cffolders[i].cCFData));
 281                                 processed_cfdata += r->cffolders[i].cCFData;
 282                         }
 283                         NDR_CHECK(ndr_push_trailer_align(ndr, 4));
 284                 }
 285                 if (ndr_flags & NDR_BUFFERS) {
 286                 }
 287                 ndr->flags = _flags_save_STRUCT;
 288         }
 289
 290
 291         /* write total file size in header */
 292         SIVAL(ndr->data, 8, ndr->offset);
 293
 294         return NDR_ERR_SUCCESS;
 295 }
 296
 297
 298 /* Pull all CFDATA of a folder.
 299  *
 300  * This works on a folder level because compression type is set per
 301  * folder, and a compression state can be shared between CFDATA of the
 302  * same folder.
 303  *
 304  * This is not a regular NDR func as we pass the compression type and
 305  * the number of CFDATA as extra arguments
 306  */
 307 static enum ndr_err_code ndr_pull_folder_cfdata(struct ndr_pull *ndr,
 308                                                 struct CFDATA *r,
 309                                                 enum cf_compress_type cab_ctype,
 310                                                 size_t num_cfdata)
 311 {
 312         size_t i;
 313         enum ndr_compression_alg ndr_ctype = 0;
 314
 315         if (cab_ctype == CF_COMPRESS_MSZIP) {
 316                 ndr_ctype = NDR_COMPRESSION_MSZIP_CAB;
 317                 NDR_CHECK(ndr_pull_compression_state_init(ndr, NDR_COMPRESSION_MSZIP_CAB, &ndr->cstate));
 318         }
 319
 320         for (i = 0; i < num_cfdata; i++, r++) {
 321                 NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->csum));
 322                 NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->cbData));
 323                 NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->cbUncomp));
 324
 325                 switch (cab_ctype) {
 326                 case CF_COMPRESS_NONE:
 327                         /* just copy the data */
 328                         NDR_PULL_NEED_BYTES(ndr, r->cbUncomp);
 329                         r->ab = data_blob_talloc(ndr->current_mem_ctx,
 330                                                  ndr->data+ndr->offset,
 331                                                  r->cbUncomp);
 332                         if (r->ab.data == NULL) {
 333                                 return ndr_pull_error(ndr, NDR_ERR_ALLOC,
 334                                                       "failed to allocate buffer for uncompressed CFDATA block");
 335                         }
 336                         ndr->offset += r->cbUncomp;
 337                         break;
 338
 339                 case CF_COMPRESS_LZX:
 340                         /* just copy the data (LZX decompression not implemented yet) */
 341                         NDR_PULL_NEED_BYTES(ndr, r->cbData);
 342                         r->ab = data_blob_talloc(ndr->current_mem_ctx,
 343                                                  ndr->data+ndr->offset,
 344                                                  r->cbData);
 345                         if (r->ab.data == NULL) {
 346                                 return ndr_pull_error(ndr, NDR_ERR_ALLOC,
 347                                                       "failed to allocate buffer for LZX-compressed CFDATA block");
 348                         }
 349                         ndr->offset += r->cbData;
 350                         break;
 351
 352                 case CF_COMPRESS_MSZIP: {
 353                         struct ndr_pull *pull_sub, *pull_compress;
 354                         NDR_PULL_NEED_BYTES(ndr, r->cbData);
 355                         /* decompress via subcontext */
 356                         NDR_CHECK(ndr_pull_subcontext_start(ndr, &pull_sub, 0, r->cbData));
 357                         pull_sub->cstate = ndr->cstate;
 358                         NDR_CHECK(ndr_pull_compression_start(pull_sub, &pull_compress,
 359                                                              ndr_ctype, r->cbUncomp, r->cbData));
 360                         ndr_set_flags(&pull_compress->flags, LIBNDR_FLAG_REMAINING);
 361                         NDR_CHECK(ndr_pull_DATA_BLOB(pull_compress, NDR_SCALARS, &r->ab));
 362                         NDR_CHECK(ndr_pull_compression_end(pull_sub, pull_compress, ndr_ctype, r->cbUncomp));
 363                         NDR_CHECK(ndr_pull_subcontext_end(ndr, pull_sub, 0, r->cbData));
 364
 365                         break;
 366                 }
 367                 default:
 368                         return NDR_ERR_BAD_SWITCH;
 369                 }
 370         }
 371
 372         ndr_pull_compression_state_free(ndr->cstate);
 373         ndr->cstate = NULL;
 374
 375         return NDR_ERR_SUCCESS;
 376 }
 377
 378 _PUBLIC_ enum ndr_err_code ndr_pull_cab_file(struct ndr_pull *ndr, int ndr_flags, struct cab_file *r)
 379 {
 380         uint32_t size_cffolders_0 = 0;
 381         uint32_t cntr_cffolders_0;
 382         TALLOC_CTX *_mem_save_cffolders_0 = NULL;
 383         uint32_t size_cffiles_0 = 0;
 384         uint32_t cntr_cffiles_0;
 385         TALLOC_CTX *_mem_save_cffiles_0 = NULL;
 386         uint32_t size_cfdata_0 = 0;
 387         size_t processed_cfdata = 0;
 388         TALLOC_CTX *_mem_save_cfdata_0 = NULL;
 389         {
 390                 uint32_t _flags_save_STRUCT = ndr->flags;
 391                 ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX|LIBNDR_FLAG_LITTLE_ENDIAN|LIBNDR_FLAG_NOALIGN);
 392                 NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
 393                 if (ndr_flags & NDR_SCALARS) {
 394                         NDR_CHECK(ndr_pull_align(ndr, 4));
 395                         NDR_CHECK(ndr_pull_CFHEADER(ndr, NDR_SCALARS, &r->cfheader));
 396                         size_cffolders_0 = r->cfheader.cFolders;
 397                         NDR_PULL_ALLOC_N(ndr, r->cffolders, size_cffolders_0);
 398                         _mem_save_cffolders_0 = NDR_PULL_GET_MEM_CTX(ndr);
 399                         NDR_PULL_SET_MEM_CTX(ndr, r->cffolders, 0);
 400                         for (cntr_cffolders_0 = 0; cntr_cffolders_0 < (size_cffolders_0); cntr_cffolders_0++) {
 401                                 NDR_CHECK(ndr_pull_CFFOLDER(ndr, NDR_SCALARS, &r->cffolders[cntr_cffolders_0]));
 402                         }
 403                         NDR_PULL_SET_MEM_CTX(ndr, _mem_save_cffolders_0, 0);
 404                         size_cffiles_0 = r->cfheader.cFiles;
 405                         NDR_PULL_ALLOC_N(ndr, r->cffiles, size_cffiles_0);
 406                         _mem_save_cffiles_0 = NDR_PULL_GET_MEM_CTX(ndr);
 407                         NDR_PULL_SET_MEM_CTX(ndr, r->cffiles, 0);
 408                         for (cntr_cffiles_0 = 0; cntr_cffiles_0 < (size_cffiles_0); cntr_cffiles_0++) {
 409                                 NDR_CHECK(ndr_pull_CFFILE(ndr, NDR_SCALARS, &r->cffiles[cntr_cffiles_0]));
 410                         }
 411                         NDR_PULL_SET_MEM_CTX(ndr, _mem_save_cffiles_0, 0);
 412 #if 0
 413                         NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->cfdata_count));
 414 #else
 415                         r->cfdata_count = ndr_count_cfdata(r);
 416 #endif
 417                         size_cfdata_0 = r->cfdata_count;
 418                         NDR_PULL_ALLOC_N(ndr, r->cfdata, size_cfdata_0);
 419                         _mem_save_cfdata_0 = NDR_PULL_GET_MEM_CTX(ndr);
 420                         NDR_PULL_SET_MEM_CTX(ndr, r->cfdata, 0);
 421                         for (cntr_cffolders_0 = 0; cntr_cffolders_0 < (size_cffolders_0); cntr_cffolders_0++) {
 422                                 NDR_CHECK(ndr_pull_folder_cfdata(ndr,
 423                                                                  r->cfdata + processed_cfdata,
 424                                                                  r->cffolders[cntr_cffolders_0].typeCompress,
 425                                                                  r->cffolders[cntr_cffolders_0].cCFData));
 426                                 processed_cfdata += r->cffolders[cntr_cffolders_0].cCFData;
 427                         }
 428                         NDR_PULL_SET_MEM_CTX(ndr, _mem_save_cfdata_0, 0);
 429                         NDR_CHECK(ndr_pull_trailer_align(ndr, 4));
 430                 }
 431                 if (ndr_flags & NDR_BUFFERS) {
 432                 }
 433                 ndr->flags = _flags_save_STRUCT;
 434         }
 435         return NDR_ERR_SUCCESS;
 436 }