librpc/ndr/ndr.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    libndr interface
   5
   6    Copyright (C) Andrew Tridgell 2003
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 /*
  23   this provides the core routines for NDR parsing functions
  24
  25   see http://www.opengroup.org/onlinepubs/9629399/chap14.htm for details
  26   of NDR encoding rules
  27 */
  28
  29 #include "includes.h"
  30 #include "librpc/ndr/libndr.h"
  31 #include "../lib/util/dlinklist.h"
  32 #if _SAMBA_BUILD_ == 4
  33 #include "param/param.h"
  34 #endif
  35
  36 #define NDR_BASE_MARSHALL_SIZE 1024
  37
  38 /* this guid indicates NDR encoding in a protocol tower */
  39 const struct ndr_syntax_id ndr_transfer_syntax = {
  40   { 0x8a885d04, 0x1ceb, 0x11c9, {0x9f, 0xe8}, {0x08,0x00,0x2b,0x10,0x48,0x60} },
  41   2
  42 };
  43
  44 const struct ndr_syntax_id ndr64_transfer_syntax = {
  45   { 0x71710533, 0xbeba, 0x4937, {0x83, 0x19}, {0xb5,0xdb,0xef,0x9c,0xcc,0x36} },
  46   1
  47 };
  48
  49 /*
  50   work out the number of bytes needed to align on a n byte boundary
  51 */
  52 _PUBLIC_ size_t ndr_align_size(uint32_t offset, size_t n)
  53 {
  54         if ((offset & (n-1)) == 0) return 0;
  55         return n - (offset & (n-1));
  56 }
  57
  58 /*
  59   initialise a ndr parse structure from a data blob
  60 */
  61 _PUBLIC_ struct ndr_pull *ndr_pull_init_blob(const DATA_BLOB *blob, TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience)
  62 {
  63         struct ndr_pull *ndr;
  64
  65         ndr = talloc_zero(mem_ctx, struct ndr_pull);
  66         if (!ndr) return NULL;
  67         ndr->current_mem_ctx = mem_ctx;
  68
  69         ndr->data = blob->data;
  70         ndr->data_size = blob->length;
  71         ndr->iconv_convenience = talloc_reference(ndr, iconv_convenience);
  72
  73         return ndr;
  74 }
  75
  76 /*
  77   advance by 'size' bytes
  78 */
  79 _PUBLIC_ enum ndr_err_code ndr_pull_advance(struct ndr_pull *ndr, uint32_t size)
  80 {
  81         ndr->offset += size;
  82         if (ndr->offset > ndr->data_size) {
  83                 return ndr_pull_error(ndr, NDR_ERR_BUFSIZE,
  84                                       "ndr_pull_advance by %u failed",
  85                                       size);
  86         }
  87         return NDR_ERR_SUCCESS;
  88 }
  89
  90 /*
  91   set the parse offset to 'ofs'
  92 */
  93 static enum ndr_err_code ndr_pull_set_offset(struct ndr_pull *ndr, uint32_t ofs)
  94 {
  95         ndr->offset = ofs;
  96         if (ndr->offset > ndr->data_size) {
  97                 return ndr_pull_error(ndr, NDR_ERR_BUFSIZE,
  98                                       "ndr_pull_set_offset %u failed",
  99                                       ofs);
 100         }
 101         return NDR_ERR_SUCCESS;
 102 }
 103
 104 /* create a ndr_push structure, ready for some marshalling */
 105 _PUBLIC_ struct ndr_push *ndr_push_init_ctx(TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience)
 106 {
 107         struct ndr_push *ndr;
 108
 109         ndr = talloc_zero(mem_ctx, struct ndr_push);
 110         if (!ndr) {
 111                 return NULL;
 112         }
 113
 114         ndr->flags = 0;
 115         ndr->alloc_size = NDR_BASE_MARSHALL_SIZE;
 116         ndr->data = talloc_array(ndr, uint8_t, ndr->alloc_size);
 117         if (!ndr->data) {
 118                 return NULL;
 119         }
 120         ndr->iconv_convenience = talloc_reference(ndr, iconv_convenience);
 121
 122         return ndr;
 123 }
 124
 125 /* return a DATA_BLOB structure for the current ndr_push marshalled data */
 126 _PUBLIC_ DATA_BLOB ndr_push_blob(struct ndr_push *ndr)
 127 {
 128         DATA_BLOB blob;
 129         blob = data_blob_const(ndr->data, ndr->offset);
 130         if (ndr->alloc_size > ndr->offset) {
 131                 ndr->data[ndr->offset] = 0;
 132         }
 133         return blob;
 134 }
 135
 136
 137 /*
 138   expand the available space in the buffer to ndr->offset + extra_size
 139 */
 140 _PUBLIC_ enum ndr_err_code ndr_push_expand(struct ndr_push *ndr, uint32_t extra_size)
 141 {
 142         uint32_t size = extra_size + ndr->offset;
 143
 144         if (size < ndr->offset) {
 145                 /* extra_size overflowed the offset */
 146                 return ndr_push_error(ndr, NDR_ERR_BUFSIZE, "Overflow in push_expand to %u",
 147                                       size);
 148         }
 149
 150         if (ndr->alloc_size > size) {
 151                 return NDR_ERR_SUCCESS;
 152         }
 153
 154         ndr->alloc_size += NDR_BASE_MARSHALL_SIZE;
 155         if (size+1 > ndr->alloc_size) {
 156                 ndr->alloc_size = size+1;
 157         }
 158         ndr->data = talloc_realloc(ndr, ndr->data, uint8_t, ndr->alloc_size);
 159         if (!ndr->data) {
 160                 return ndr_push_error(ndr, NDR_ERR_ALLOC, "Failed to push_expand to %u",
 161                                       ndr->alloc_size);
 162         }
 163
 164         return NDR_ERR_SUCCESS;
 165 }
 166
 167 _PUBLIC_ void ndr_print_debug_helper(struct ndr_print *ndr, const char *format, ...)
 168 {
 169         va_list ap;
 170         char *s = NULL;
 171         int i, ret;
 172
 173         va_start(ap, format);
 174         ret = vasprintf(&s, format, ap);
 175         va_end(ap);
 176
 177         if (ret == -1) {
 178                 return;
 179         }
 180
 181         for (i=0;i<ndr->depth;i++) {
 182                 DEBUGADD(1,("    "));
 183         }
 184
 185         DEBUGADD(1,("%s\n", s));
 186         free(s);
 187 }
 188
 189 _PUBLIC_ void ndr_print_string_helper(struct ndr_print *ndr, const char *format, ...)
 190 {
 191         va_list ap;
 192         int i;
 193
 194         for (i=0;i<ndr->depth;i++) {
 195                 ndr->private_data = talloc_asprintf_append_buffer(
 196                                         (char *)ndr->private_data, "    ");
 197         }
 198
 199         va_start(ap, format);
 200         ndr->private_data = talloc_vasprintf_append_buffer((char *)ndr->private_data,
 201                                                     format, ap);
 202         va_end(ap);
 203         ndr->private_data = talloc_asprintf_append_buffer((char *)ndr->private_data,
 204                                                    "\n");
 205 }
 206
 207 /*
 208   a useful helper function for printing idl structures via DEBUG()
 209 */
 210 _PUBLIC_ void ndr_print_debug(ndr_print_fn_t fn, const char *name, void *ptr)
 211 {
 212         struct ndr_print *ndr;
 213
 214         DEBUG(1,(" "));
 215
 216         ndr = talloc_zero(NULL, struct ndr_print);
 217         if (!ndr) return;
 218         ndr->print = ndr_print_debug_helper;
 219         ndr->depth = 1;
 220         ndr->flags = 0;
 221         fn(ndr, name, ptr);
 222         talloc_free(ndr);
 223 }
 224
 225 /*
 226   a useful helper function for printing idl unions via DEBUG()
 227 */
 228 _PUBLIC_ void ndr_print_union_debug(ndr_print_fn_t fn, const char *name, uint32_t level, void *ptr)
 229 {
 230         struct ndr_print *ndr;
 231
 232         DEBUG(1,(" "));
 233
 234         ndr = talloc_zero(NULL, struct ndr_print);
 235         if (!ndr) return;
 236         ndr->print = ndr_print_debug_helper;
 237         ndr->depth = 1;
 238         ndr->flags = 0;
 239         ndr_print_set_switch_value(ndr, ptr, level);
 240         fn(ndr, name, ptr);
 241         talloc_free(ndr);
 242 }
 243
 244 /*
 245   a useful helper function for printing idl function calls via DEBUG()
 246 */
 247 _PUBLIC_ void ndr_print_function_debug(ndr_print_function_t fn, const char *name, int flags, void *ptr)
 248 {
 249         struct ndr_print *ndr;
 250
 251         DEBUG(1,(" "));
 252
 253         ndr = talloc_zero(NULL, struct ndr_print);
 254         if (!ndr) return;
 255         ndr->print = ndr_print_debug_helper;
 256         ndr->depth = 1;
 257         ndr->flags = 0;
 258
 259         /* this is a s4 hack until we build up the courage to pass
 260          * this all the way down
 261          */
 262 #if _SAMBA_BUILD_ == 4
 263         ndr->iconv_convenience = smb_iconv_convenience_reinit(talloc_autofree_context(),
 264                                                               "ASCII", "UTF-8", true, NULL);
 265 #endif
 266
 267         fn(ndr, name, flags, ptr);
 268         talloc_free(ndr);
 269 }
 270
 271 /*
 272   a useful helper function for printing idl structures to a string
 273 */
 274 _PUBLIC_ char *ndr_print_struct_string(TALLOC_CTX *mem_ctx, ndr_print_fn_t fn, const char *name, void *ptr)
 275 {
 276         struct ndr_print *ndr;
 277         char *ret = NULL;
 278
 279         ndr = talloc_zero(mem_ctx, struct ndr_print);
 280         if (!ndr) return NULL;
 281         ndr->private_data = talloc_strdup(ndr, "");
 282         if (!ndr->private_data) {
 283                 goto failed;
 284         }
 285         ndr->print = ndr_print_string_helper;
 286         ndr->depth = 1;
 287         ndr->flags = 0;
 288
 289         /* this is a s4 hack until we build up the courage to pass
 290          * this all the way down
 291          */
 292 #if _SAMBA_BUILD_ == 4
 293         ndr->iconv_convenience = smb_iconv_convenience_reinit(talloc_autofree_context(),
 294                                                               "ASCII", "UTF-8", true, NULL);
 295 #endif
 296
 297         fn(ndr, name, ptr);
 298         ret = talloc_steal(mem_ctx, (char *)ndr->private_data);
 299 failed:
 300         talloc_free(ndr);
 301         return ret;
 302 }
 303
 304 /*
 305   a useful helper function for printing idl unions to a string
 306 */
 307 _PUBLIC_ char *ndr_print_union_string(TALLOC_CTX *mem_ctx, ndr_print_fn_t fn, const char *name, uint32_t level, void *ptr)
 308 {
 309         struct ndr_print *ndr;
 310         char *ret = NULL;
 311
 312         ndr = talloc_zero(mem_ctx, struct ndr_print);
 313         if (!ndr) return NULL;
 314         ndr->private_data = talloc_strdup(ndr, "");
 315         if (!ndr->private_data) {
 316                 goto failed;
 317         }
 318         ndr->print = ndr_print_string_helper;
 319         ndr->depth = 1;
 320         ndr->flags = 0;
 321         ndr_print_set_switch_value(ndr, ptr, level);
 322         fn(ndr, name, ptr);
 323         ret = talloc_steal(mem_ctx, (char *)ndr->private_data);
 324 failed:
 325         talloc_free(ndr);
 326         return ret;
 327 }
 328
 329 /*
 330   a useful helper function for printing idl function calls to a string
 331 */
 332 _PUBLIC_ char *ndr_print_function_string(TALLOC_CTX *mem_ctx,
 333                                 ndr_print_function_t fn, const char *name,
 334                                 int flags, void *ptr)
 335 {
 336         struct ndr_print *ndr;
 337         char *ret = NULL;
 338
 339         ndr = talloc_zero(mem_ctx, struct ndr_print);
 340         if (!ndr) return NULL;
 341         ndr->private_data = talloc_strdup(ndr, "");
 342         if (!ndr->private_data) {
 343                 goto failed;
 344         }
 345         ndr->print = ndr_print_string_helper;
 346         ndr->depth = 1;
 347         ndr->flags = 0;
 348         fn(ndr, name, flags, ptr);
 349         ret = talloc_steal(mem_ctx, (char *)ndr->private_data);
 350 failed:
 351         talloc_free(ndr);
 352         return ret;
 353 }
 354
 355 _PUBLIC_ void ndr_set_flags(uint32_t *pflags, uint32_t new_flags)
 356 {
 357         /* the big/little endian flags are inter-dependent */
 358         if (new_flags & LIBNDR_FLAG_LITTLE_ENDIAN) {
 359                 (*pflags) &= ~LIBNDR_FLAG_BIGENDIAN;
 360                 (*pflags) &= ~LIBNDR_FLAG_NDR64;
 361         }
 362         if (new_flags & LIBNDR_FLAG_BIGENDIAN) {
 363                 (*pflags) &= ~LIBNDR_FLAG_LITTLE_ENDIAN;
 364                 (*pflags) &= ~LIBNDR_FLAG_NDR64;
 365         }
 366         if (new_flags & LIBNDR_FLAG_REMAINING) {
 367                 (*pflags) &= ~LIBNDR_ALIGN_FLAGS;
 368         }
 369         if (new_flags & LIBNDR_ALIGN_FLAGS) {
 370                 (*pflags) &= ~LIBNDR_FLAG_REMAINING;
 371         }
 372         if (new_flags & LIBNDR_FLAG_NO_RELATIVE_REVERSE) {
 373                 (*pflags) &= ~LIBNDR_FLAG_RELATIVE_REVERSE;
 374         }
 375         (*pflags) |= new_flags;
 376 }
 377
 378 /*
 379   return and possibly log an NDR error
 380 */
 381 _PUBLIC_ enum ndr_err_code ndr_pull_error(struct ndr_pull *ndr,
 382                                  enum ndr_err_code ndr_err,
 383                                  const char *format, ...)
 384 {
 385         char *s=NULL;
 386         va_list ap;
 387         int ret;
 388
 389         va_start(ap, format);
 390         ret = vasprintf(&s, format, ap);
 391         va_end(ap);
 392
 393         if (ret == -1) {
 394                 return NDR_ERR_ALLOC;
 395         }
 396
 397         DEBUG(1,("ndr_pull_error(%u): %s\n", ndr_err, s));
 398
 399         free(s);
 400
 401         return ndr_err;
 402 }
 403
 404 /*
 405   return and possibly log an NDR error
 406 */
 407 _PUBLIC_ enum ndr_err_code ndr_push_error(struct ndr_push *ndr,
 408                                  enum ndr_err_code ndr_err,
 409                                  const char *format, ...)
 410 {
 411         char *s=NULL;
 412         va_list ap;
 413         int ret;
 414
 415         va_start(ap, format);
 416         ret = vasprintf(&s, format, ap);
 417         va_end(ap);
 418
 419         if (ret == -1) {
 420                 return NDR_ERR_ALLOC;
 421         }
 422
 423         DEBUG(1,("ndr_push_error(%u): %s\n", ndr_err, s));
 424
 425         free(s);
 426
 427         return ndr_err;
 428 }
 429
 430 /*
 431   handle subcontext buffers, which in midl land are user-marshalled, but
 432   we use magic in pidl to make them easier to cope with
 433 */
 434 _PUBLIC_ enum ndr_err_code ndr_pull_subcontext_start(struct ndr_pull *ndr,
 435                                    struct ndr_pull **_subndr,
 436                                    size_t header_size,
 437                                    ssize_t size_is)
 438 {
 439         struct ndr_pull *subndr;
 440         uint32_t r_content_size;
 441         bool force_le = false;
 442         bool force_be = false;
 443
 444         switch (header_size) {
 445         case 0: {
 446                 uint32_t content_size = ndr->data_size - ndr->offset;
 447                 if (size_is >= 0) {
 448                         content_size = size_is;
 449                 }
 450                 r_content_size = content_size;
 451                 break;
 452         }
 453
 454         case 2: {
 455                 uint16_t content_size;
 456                 NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &content_size));
 457                 if (size_is >= 0 && size_is != content_size) {
 458                         return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT, "Bad subcontext (PULL) size_is(%d) mismatch content_size %d",
 459                                                 (int)size_is, (int)content_size);
 460                 }
 461                 r_content_size = content_size;
 462                 break;
 463         }
 464
 465         case 4: {
 466                 uint32_t content_size;
 467                 NDR_CHECK(ndr_pull_uint3264(ndr, NDR_SCALARS, &content_size));
 468                 if (size_is >= 0 && size_is != content_size) {
 469                         return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT, "Bad subcontext (PULL) size_is(%d) mismatch content_size %d",
 470                                                 (int)size_is, (int)content_size);
 471                 }
 472                 r_content_size = content_size;
 473                 break;
 474         }
 475         case 0xFFFFFC01: {
 476                 /*
 477                  * Common Type Header for the Serialization Stream
 478                  * See [MS-RPCE] 2.2.6 Type Serialization Version 1
 479                  */
 480                 uint8_t version;
 481                 uint8_t drep;
 482                 uint16_t hdrlen;
 483                 uint32_t filler;
 484                 uint32_t content_size;
 485                 uint32_t reserved;
 486
 487                 /* version */
 488                 NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &version));
 489
 490                 if (version != 1) {
 491                         return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT,
 492                                               "Bad subcontext (PULL) Common Type Header version %d != 1",
 493                                               (int)version);
 494                 }
 495
 496                 /*
 497                  * 0x10 little endian
 498                  * 0x00 big endian
 499                  */
 500                 NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &drep));
 501                 if (drep == 0x10) {
 502                         force_le = true;
 503                 } else if (drep == 0x00) {
 504                         force_be = true;
 505                 } else {
 506                         return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT,
 507                                               "Bad subcontext (PULL) Common Type Header invalid drep 0x%02X",
 508                                               (unsigned int)drep);
 509                 }
 510
 511                 /* length of the "Private Header for Constructed Type" */
 512                 NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &hdrlen));
 513                 if (hdrlen != 8) {
 514                         return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT,
 515                                               "Bad subcontext (PULL) Common Type Header length %d != 8",
 516                                               (int)hdrlen);
 517                 }
 518
 519                 /* filler should be ignored */
 520                 NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &filler));
 521
 522                 /*
 523                  * Private Header for Constructed Type
 524                  */
 525                 /* length - will be updated latter */
 526                 NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &content_size));
 527                 if (size_is >= 0 && size_is != content_size) {
 528                         return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT, "Bad subcontext (PULL) size_is(%d) mismatch content_size %d",
 529                                               (int)size_is, (int)content_size);
 530                 }
 531                 /* the content size must be a multiple of 8 */
 532                 if ((content_size % 8) != 0) {
 533                         return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT,
 534                                               "Bad subcontext (PULL) size_is(%d) not padded to 8 content_size %d",
 535                                               (int)size_is, (int)content_size);
 536                 }
 537                 r_content_size = content_size;
 538
 539                 /* reserved */
 540                 NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &reserved));
 541                 break;
 542         }
 543         default:
 544                 return ndr_pull_error(ndr, NDR_ERR_SUBCONTEXT, "Bad subcontext (PULL) header_size %d",
 545                                       (int)header_size);
 546         }
 547
 548         NDR_PULL_NEED_BYTES(ndr, r_content_size);
 549
 550         subndr = talloc_zero(ndr, struct ndr_pull);
 551         NDR_ERR_HAVE_NO_MEMORY(subndr);
 552         subndr->flags           = ndr->flags & ~LIBNDR_FLAG_NDR64;
 553         subndr->current_mem_ctx = ndr->current_mem_ctx;
 554
 555         subndr->data = ndr->data + ndr->offset;
 556         subndr->offset = 0;
 557         subndr->data_size = r_content_size;
 558         subndr->iconv_convenience = talloc_reference(subndr, ndr->iconv_convenience);
 559
 560         if (force_le) {
 561                 ndr_set_flags(&ndr->flags, LIBNDR_FLAG_LITTLE_ENDIAN);
 562         } else if (force_be) {
 563                 ndr_set_flags(&ndr->flags, LIBNDR_FLAG_BIGENDIAN);
 564         }
 565
 566         *_subndr = subndr;
 567         return NDR_ERR_SUCCESS;
 568 }
 569
 570 _PUBLIC_ enum ndr_err_code ndr_pull_subcontext_end(struct ndr_pull *ndr,
 571                                  struct ndr_pull *subndr,
 572                                  size_t header_size,
 573                                  ssize_t size_is)
 574 {
 575         uint32_t advance;
 576         if (size_is >= 0) {
 577                 advance = size_is;
 578         } else if (header_size > 0) {
 579                 advance = subndr->data_size;
 580         } else {
 581                 advance = subndr->offset;
 582         }
 583         NDR_CHECK(ndr_pull_advance(ndr, advance));
 584         return NDR_ERR_SUCCESS;
 585 }
 586
 587 _PUBLIC_ enum ndr_err_code ndr_push_subcontext_start(struct ndr_push *ndr,
 588                                    struct ndr_push **_subndr,
 589                                    size_t header_size,
 590                                    ssize_t size_is)
 591 {
 592         struct ndr_push *subndr;
 593
 594         subndr = ndr_push_init_ctx(ndr, ndr->iconv_convenience);
 595         NDR_ERR_HAVE_NO_MEMORY(subndr);
 596         subndr->flags   = ndr->flags & ~LIBNDR_FLAG_NDR64;
 597
 598         if (size_is > 0) {
 599                 NDR_CHECK(ndr_push_zero(subndr, size_is));
 600                 subndr->offset = 0;
 601                 subndr->relative_end_offset = size_is;
 602         }
 603
 604         *_subndr = subndr;
 605         return NDR_ERR_SUCCESS;
 606 }
 607
 608 /*
 609   push a subcontext header
 610 */
 611 _PUBLIC_ enum ndr_err_code ndr_push_subcontext_end(struct ndr_push *ndr,
 612                                  struct ndr_push *subndr,
 613                                  size_t header_size,
 614                                  ssize_t size_is)
 615 {
 616         ssize_t padding_len;
 617
 618         if (size_is >= 0) {
 619                 padding_len = size_is - subndr->offset;
 620                 if (padding_len < 0) {
 621                         return ndr_push_error(ndr, NDR_ERR_SUBCONTEXT, "Bad subcontext (PUSH) content_size %d is larger than size_is(%d)",
 622                                               (int)subndr->offset, (int)size_is);
 623                 }
 624                 subndr->offset = size_is;
 625         }
 626
 627         switch (header_size) {
 628         case 0:
 629                 break;
 630
 631         case 2:
 632                 NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, subndr->offset));
 633                 break;
 634
 635         case 4:
 636                 NDR_CHECK(ndr_push_uint3264(ndr, NDR_SCALARS, subndr->offset));
 637                 break;
 638
 639         case 0xFFFFFC01:
 640                 /*
 641                  * Common Type Header for the Serialization Stream
 642                  * See [MS-RPCE] 2.2.6 Type Serialization Version 1
 643                  */
 644                 padding_len = NDR_ROUND(subndr->offset, 8) - subndr->offset;
 645                 if (padding_len > 0) {
 646                         NDR_CHECK(ndr_push_zero(subndr, padding_len));
 647                 }
 648
 649                 /* version */
 650                 NDR_CHECK(ndr_push_uint8(ndr, NDR_SCALARS, 1));
 651
 652                 /*
 653                  * 0x10 little endian
 654                  * 0x00 big endian
 655                  */
 656                 NDR_CHECK(ndr_push_uint8(ndr, NDR_SCALARS, NDR_BE(ndr)?0x00:0x10));
 657
 658                 /* length of the "Private Header for Constructed Type" */
 659                 NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, 8));
 660
 661                 /* filler */
 662                 NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, 0xCCCCCCCC));
 663
 664                 /*
 665                  * Private Header for Constructed Type
 666                  */
 667                 /* length - will be updated latter */
 668                 NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, subndr->offset));
 669
 670                 /* reserved */
 671                 NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, 0));
 672                 break;
 673
 674         default:
 675                 return ndr_push_error(ndr, NDR_ERR_SUBCONTEXT, "Bad subcontext header size %d",
 676                                       (int)header_size);
 677         }
 678
 679         NDR_CHECK(ndr_push_bytes(ndr, subndr->data, subndr->offset));
 680         return NDR_ERR_SUCCESS;
 681 }
 682
 683 /*
 684   store a token in the ndr context, for later retrieval
 685 */
 686 _PUBLIC_ enum ndr_err_code ndr_token_store(TALLOC_CTX *mem_ctx,
 687                          struct ndr_token_list **list,
 688                          const void *key,
 689                          uint32_t value)
 690 {
 691         struct ndr_token_list *tok;
 692         tok = talloc(mem_ctx, struct ndr_token_list);
 693         NDR_ERR_HAVE_NO_MEMORY(tok);
 694         tok->key = key;
 695         tok->value = value;
 696         DLIST_ADD((*list), tok);
 697         return NDR_ERR_SUCCESS;
 698 }
 699
 700 /*
 701   retrieve a token from a ndr context, using cmp_fn to match the tokens
 702 */
 703 _PUBLIC_ enum ndr_err_code ndr_token_retrieve_cmp_fn(struct ndr_token_list **list, const void *key, uint32_t *v,
 704                                    comparison_fn_t _cmp_fn, bool _remove_tok)
 705 {
 706         struct ndr_token_list *tok;
 707         for (tok=*list;tok;tok=tok->next) {
 708                 if (_cmp_fn && _cmp_fn(tok->key,key)==0) goto found;
 709                 else if (!_cmp_fn && tok->key == key) goto found;
 710         }
 711         return NDR_ERR_TOKEN;
 712 found:
 713         *v = tok->value;
 714         if (_remove_tok) {
 715                 DLIST_REMOVE((*list), tok);
 716                 talloc_free(tok);
 717         }
 718         return NDR_ERR_SUCCESS;
 719 }
 720
 721 /*
 722   retrieve a token from a ndr context
 723 */
 724 _PUBLIC_ enum ndr_err_code ndr_token_retrieve(struct ndr_token_list **list, const void *key, uint32_t *v)
 725 {
 726         return ndr_token_retrieve_cmp_fn(list, key, v, NULL, true);
 727 }
 728
 729 /*
 730   peek at but don't removed a token from a ndr context
 731 */
 732 _PUBLIC_ uint32_t ndr_token_peek(struct ndr_token_list **list, const void *key)
 733 {
 734         enum ndr_err_code status;
 735         uint32_t v;
 736
 737         status = ndr_token_retrieve_cmp_fn(list, key, &v, NULL, false);
 738         if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
 739                 return 0;
 740         }
 741
 742         return v;
 743 }
 744
 745 /*
 746   pull an array size field and add it to the array_size_list token list
 747 */
 748 _PUBLIC_ enum ndr_err_code ndr_pull_array_size(struct ndr_pull *ndr, const void *p)
 749 {
 750         uint32_t size;
 751         NDR_CHECK(ndr_pull_uint3264(ndr, NDR_SCALARS, &size));
 752         return ndr_token_store(ndr, &ndr->array_size_list, p, size);
 753 }
 754
 755 /*
 756   get the stored array size field
 757 */
 758 _PUBLIC_ uint32_t ndr_get_array_size(struct ndr_pull *ndr, const void *p)
 759 {
 760         return ndr_token_peek(&ndr->array_size_list, p);
 761 }
 762
 763 /*
 764   check the stored array size field
 765 */
 766 _PUBLIC_ enum ndr_err_code ndr_check_array_size(struct ndr_pull *ndr, void *p, uint32_t size)
 767 {
 768         uint32_t stored;
 769         stored = ndr_token_peek(&ndr->array_size_list, p);
 770         if (stored != size) {
 771                 return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE,
 772                                       "Bad array size - got %u expected %u\n",
 773                                       stored, size);
 774         }
 775         return NDR_ERR_SUCCESS;
 776 }
 777
 778 /*
 779   pull an array length field and add it to the array_length_list token list
 780 */
 781 _PUBLIC_ enum ndr_err_code ndr_pull_array_length(struct ndr_pull *ndr, const void *p)
 782 {
 783         uint32_t length, offset;
 784         NDR_CHECK(ndr_pull_uint3264(ndr, NDR_SCALARS, &offset));
 785         if (offset != 0) {
 786                 return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE,
 787                                       "non-zero array offset %u\n", offset);
 788         }
 789         NDR_CHECK(ndr_pull_uint3264(ndr, NDR_SCALARS, &length));
 790         return ndr_token_store(ndr, &ndr->array_length_list, p, length);
 791 }
 792
 793 /*
 794   get the stored array length field
 795 */
 796 _PUBLIC_ uint32_t ndr_get_array_length(struct ndr_pull *ndr, const void *p)
 797 {
 798         return ndr_token_peek(&ndr->array_length_list, p);
 799 }
 800
 801 /*
 802   check the stored array length field
 803 */
 804 _PUBLIC_ enum ndr_err_code ndr_check_array_length(struct ndr_pull *ndr, void *p, uint32_t length)
 805 {
 806         uint32_t stored;
 807         stored = ndr_token_peek(&ndr->array_length_list, p);
 808         if (stored != length) {
 809                 return ndr_pull_error(ndr, NDR_ERR_ARRAY_SIZE,
 810                                       "Bad array length - got %u expected %u\n",
 811                                       stored, length);
 812         }
 813         return NDR_ERR_SUCCESS;
 814 }
 815
 816 /*
 817   store a switch value
 818  */
 819 _PUBLIC_ enum ndr_err_code ndr_push_set_switch_value(struct ndr_push *ndr, const void *p, uint32_t val)
 820 {
 821         return ndr_token_store(ndr, &ndr->switch_list, p, val);
 822 }
 823
 824 _PUBLIC_ enum ndr_err_code ndr_pull_set_switch_value(struct ndr_pull *ndr, const void *p, uint32_t val)
 825 {
 826         return ndr_token_store(ndr, &ndr->switch_list, p, val);
 827 }
 828
 829 _PUBLIC_ enum ndr_err_code ndr_print_set_switch_value(struct ndr_print *ndr, const void *p, uint32_t val)
 830 {
 831         return ndr_token_store(ndr, &ndr->switch_list, p, val);
 832 }
 833
 834 /*
 835   retrieve a switch value
 836  */
 837 _PUBLIC_ uint32_t ndr_push_get_switch_value(struct ndr_push *ndr, const void *p)
 838 {
 839         return ndr_token_peek(&ndr->switch_list, p);
 840 }
 841
 842 _PUBLIC_ uint32_t ndr_pull_get_switch_value(struct ndr_pull *ndr, const void *p)
 843 {
 844         return ndr_token_peek(&ndr->switch_list, p);
 845 }
 846
 847 _PUBLIC_ uint32_t ndr_print_get_switch_value(struct ndr_print *ndr, const void *p)
 848 {
 849         return ndr_token_peek(&ndr->switch_list, p);
 850 }
 851
 852 /*
 853   pull a struct from a blob using NDR
 854 */
 855 _PUBLIC_ enum ndr_err_code ndr_pull_struct_blob(const DATA_BLOB *blob, TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, void *p,
 856                               ndr_pull_flags_fn_t fn)
 857 {
 858         struct ndr_pull *ndr;
 859         ndr = ndr_pull_init_blob(blob, mem_ctx, iconv_convenience);
 860         NDR_ERR_HAVE_NO_MEMORY(ndr);
 861         NDR_CHECK_FREE(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
 862         talloc_free(ndr);
 863         return NDR_ERR_SUCCESS;
 864 }
 865
 866 /*
 867   pull a struct from a blob using NDR - failing if all bytes are not consumed
 868 */
 869 _PUBLIC_ enum ndr_err_code ndr_pull_struct_blob_all(const DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
 870                                                     struct smb_iconv_convenience *iconv_convenience,
 871                                                     void *p, ndr_pull_flags_fn_t fn)
 872 {
 873         struct ndr_pull *ndr;
 874         uint32_t highest_ofs;
 875         ndr = ndr_pull_init_blob(blob, mem_ctx, iconv_convenience);
 876         NDR_ERR_HAVE_NO_MEMORY(ndr);
 877         NDR_CHECK_FREE(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
 878         if (ndr->offset > ndr->relative_highest_offset) {
 879                 highest_ofs = ndr->offset;
 880         } else {
 881                 highest_ofs = ndr->relative_highest_offset;
 882         }
 883         if (highest_ofs < ndr->data_size) {
 884                 enum ndr_err_code ret;
 885                 ret = ndr_pull_error(ndr, NDR_ERR_UNREAD_BYTES,
 886                                      "not all bytes consumed ofs[%u] size[%u]",
 887                                      highest_ofs, ndr->data_size);
 888                 talloc_free(ndr);
 889                 return ret;
 890         }
 891         talloc_free(ndr);
 892         return NDR_ERR_SUCCESS;
 893 }
 894
 895 /*
 896   pull a union from a blob using NDR, given the union discriminator
 897 */
 898 _PUBLIC_ enum ndr_err_code ndr_pull_union_blob(const DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
 899                                                struct smb_iconv_convenience *iconv_convenience, void *p,
 900                              uint32_t level, ndr_pull_flags_fn_t fn)
 901 {
 902         struct ndr_pull *ndr;
 903         ndr = ndr_pull_init_blob(blob, mem_ctx, iconv_convenience);
 904         NDR_ERR_HAVE_NO_MEMORY(ndr);
 905         NDR_CHECK_FREE(ndr_pull_set_switch_value(ndr, p, level));
 906         NDR_CHECK_FREE(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
 907         talloc_free(ndr);
 908         return NDR_ERR_SUCCESS;
 909 }
 910
 911 /*
 912   pull a union from a blob using NDR, given the union discriminator,
 913   failing if all bytes are not consumed
 914 */
 915 _PUBLIC_ enum ndr_err_code ndr_pull_union_blob_all(const DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
 916                                                    struct smb_iconv_convenience *iconv_convenience, void *p,
 917                              uint32_t level, ndr_pull_flags_fn_t fn)
 918 {
 919         struct ndr_pull *ndr;
 920         uint32_t highest_ofs;
 921         ndr = ndr_pull_init_blob(blob, mem_ctx, iconv_convenience);
 922         NDR_ERR_HAVE_NO_MEMORY(ndr);
 923         NDR_CHECK_FREE(ndr_pull_set_switch_value(ndr, p, level));
 924         NDR_CHECK_FREE(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
 925         if (ndr->offset > ndr->relative_highest_offset) {
 926                 highest_ofs = ndr->offset;
 927         } else {
 928                 highest_ofs = ndr->relative_highest_offset;
 929         }
 930         if (highest_ofs < ndr->data_size) {
 931                 enum ndr_err_code ret;
 932                 ret = ndr_pull_error(ndr, NDR_ERR_UNREAD_BYTES,
 933                                      "not all bytes consumed ofs[%u] size[%u]",
 934                                      highest_ofs, ndr->data_size);
 935                 talloc_free(ndr);
 936                 return ret;
 937         }
 938         talloc_free(ndr);
 939         return NDR_ERR_SUCCESS;
 940 }
 941
 942 /*
 943   push a struct to a blob using NDR
 944 */
 945 _PUBLIC_ enum ndr_err_code ndr_push_struct_blob(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, const void *p, ndr_push_flags_fn_t fn)
 946 {
 947         struct ndr_push *ndr;
 948         ndr = ndr_push_init_ctx(mem_ctx, iconv_convenience);
 949         NDR_ERR_HAVE_NO_MEMORY(ndr);
 950
 951         NDR_CHECK(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
 952
 953         *blob = ndr_push_blob(ndr);
 954         talloc_steal(mem_ctx, blob->data);
 955         talloc_free(ndr);
 956
 957         return NDR_ERR_SUCCESS;
 958 }
 959
 960 /*
 961   push a union to a blob using NDR
 962 */
 963 _PUBLIC_ enum ndr_err_code ndr_push_union_blob(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, void *p,
 964                              uint32_t level, ndr_push_flags_fn_t fn)
 965 {
 966         struct ndr_push *ndr;
 967         ndr = ndr_push_init_ctx(mem_ctx, iconv_convenience);
 968         NDR_ERR_HAVE_NO_MEMORY(ndr);
 969
 970         NDR_CHECK(ndr_push_set_switch_value(ndr, p, level));
 971         NDR_CHECK(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
 972
 973         *blob = ndr_push_blob(ndr);
 974         talloc_steal(mem_ctx, blob->data);
 975         talloc_free(ndr);
 976
 977         return NDR_ERR_SUCCESS;
 978 }
 979
 980 /*
 981   generic ndr_size_*() handler for structures
 982 */
 983 _PUBLIC_ size_t ndr_size_struct(const void *p, int flags, ndr_push_flags_fn_t push, struct smb_iconv_convenience *iconv_convenience)
 984 {
 985         struct ndr_push *ndr;
 986         enum ndr_err_code status;
 987         size_t ret;
 988
 989         /* avoid recursion */
 990         if (flags & LIBNDR_FLAG_NO_NDR_SIZE) return 0;
 991
 992         ndr = ndr_push_init_ctx(NULL, iconv_convenience);
 993         if (!ndr) return 0;
 994         ndr->flags |= flags | LIBNDR_FLAG_NO_NDR_SIZE;
 995         status = push(ndr, NDR_SCALARS|NDR_BUFFERS, discard_const(p));
 996         if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
 997                 talloc_free(ndr);
 998                 return 0;
 999         }
1000         ret = ndr->offset;
1001         talloc_free(ndr);
1002         return ret;
1003 }
1004
1005 /*
1006   generic ndr_size_*() handler for unions
1007 */
1008 _PUBLIC_ size_t ndr_size_union(const void *p, int flags, uint32_t level, ndr_push_flags_fn_t push, struct smb_iconv_convenience *iconv_convenience)
1009 {
1010         struct ndr_push *ndr;
1011         enum ndr_err_code status;
1012         size_t ret;
1013
1014         /* avoid recursion */
1015         if (flags & LIBNDR_FLAG_NO_NDR_SIZE) return 0;
1016
1017         ndr = ndr_push_init_ctx(NULL, iconv_convenience);
1018         if (!ndr) return 0;
1019         ndr->flags |= flags | LIBNDR_FLAG_NO_NDR_SIZE;
1020
1021         status = ndr_push_set_switch_value(ndr, p, level);
1022         if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
1023                 talloc_free(ndr);
1024                 return 0;
1025         }
1026         status = push(ndr, NDR_SCALARS|NDR_BUFFERS, p);
1027         if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
1028                 talloc_free(ndr);
1029                 return 0;
1030         }
1031         ret = ndr->offset;
1032         talloc_free(ndr);
1033         return ret;
1034 }
1035
1036 /*
1037   get the current base for relative pointers for the push
1038 */
1039 _PUBLIC_ uint32_t ndr_push_get_relative_base_offset(struct ndr_push *ndr)
1040 {
1041         return ndr->relative_base_offset;
1042 }
1043
1044 /*
1045   restore the old base for relative pointers for the push
1046 */
1047 _PUBLIC_ void ndr_push_restore_relative_base_offset(struct ndr_push *ndr, uint32_t offset)
1048 {
1049         ndr->relative_base_offset = offset;
1050 }
1051
1052 /*
1053   setup the current base for relative pointers for the push
1054   called in the NDR_SCALAR stage
1055 */
1056 _PUBLIC_ enum ndr_err_code ndr_push_setup_relative_base_offset1(struct ndr_push *ndr, const void *p, uint32_t offset)
1057 {
1058         ndr->relative_base_offset = offset;
1059         return ndr_token_store(ndr, &ndr->relative_base_list, p, offset);
1060 }
1061
1062 /*
1063   setup the current base for relative pointers for the push
1064   called in the NDR_BUFFERS stage
1065 */
1066 _PUBLIC_ enum ndr_err_code ndr_push_setup_relative_base_offset2(struct ndr_push *ndr, const void *p)
1067 {
1068         return ndr_token_retrieve(&ndr->relative_base_list, p, &ndr->relative_base_offset);
1069 }
1070
1071 /*
1072   push a relative object - stage1
1073   this is called during SCALARS processing
1074 */
1075 _PUBLIC_ enum ndr_err_code ndr_push_relative_ptr1(struct ndr_push *ndr, const void *p)
1076 {
1077         if (p == NULL) {
1078                 NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, 0));
1079                 return NDR_ERR_SUCCESS;
1080         }
1081         NDR_CHECK(ndr_push_align(ndr, 4));
1082         NDR_CHECK(ndr_token_store(ndr, &ndr->relative_list, p, ndr->offset));
1083         return ndr_push_uint32(ndr, NDR_SCALARS, 0xFFFFFFFF);
1084 }
1085
1086 /*
1087   push a short relative object - stage1
1088   this is called during SCALARS processing
1089 */
1090 _PUBLIC_ enum ndr_err_code ndr_push_short_relative_ptr1(struct ndr_push *ndr, const void *p)
1091 {
1092         if (p == NULL) {
1093                 NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, 0));
1094                 return NDR_ERR_SUCCESS;
1095         }
1096         NDR_CHECK(ndr_push_align(ndr, 2));
1097         NDR_CHECK(ndr_token_store(ndr, &ndr->relative_list, p, ndr->offset));
1098         return ndr_push_uint16(ndr, NDR_SCALARS, 0xFFFF);
1099 }
1100 /*
1101   push a relative object - stage2
1102   this is called during buffers processing
1103 */
1104 static enum ndr_err_code ndr_push_relative_ptr2(struct ndr_push *ndr, const void *p)
1105 {
1106         uint32_t save_offset;
1107         uint32_t ptr_offset = 0xFFFFFFFF;
1108         if (p == NULL) {
1109                 return NDR_ERR_SUCCESS;
1110         }
1111         save_offset = ndr->offset;
1112         NDR_CHECK(ndr_token_retrieve(&ndr->relative_list, p, &ptr_offset));
1113         if (ptr_offset > ndr->offset) {
1114                 return ndr_push_error(ndr, NDR_ERR_BUFSIZE,
1115                                       "ndr_push_relative_ptr2 ptr_offset(%u) > ndr->offset(%u)",
1116                                       ptr_offset, ndr->offset);
1117         }
1118         ndr->offset = ptr_offset;
1119         if (save_offset < ndr->relative_base_offset) {
1120                 return ndr_push_error(ndr, NDR_ERR_BUFSIZE,
1121                                       "ndr_push_relative_ptr2 save_offset(%u) < ndr->relative_base_offset(%u)",
1122                                       save_offset, ndr->relative_base_offset);
1123         }
1124         NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, save_offset - ndr->relative_base_offset));
1125         ndr->offset = save_offset;
1126         return NDR_ERR_SUCCESS;
1127 }
1128 /*
1129   push a short relative object - stage2
1130   this is called during buffers processing
1131 */
1132 _PUBLIC_ enum ndr_err_code ndr_push_short_relative_ptr2(struct ndr_push *ndr, const void *p)
1133 {
1134         uint32_t save_offset;
1135         uint32_t ptr_offset = 0xFFFF;
1136         if (p == NULL) {
1137                 return NDR_ERR_SUCCESS;
1138         }
1139         save_offset = ndr->offset;
1140         NDR_CHECK(ndr_token_retrieve(&ndr->relative_list, p, &ptr_offset));
1141         if (ptr_offset > ndr->offset) {
1142                 return ndr_push_error(ndr, NDR_ERR_BUFSIZE,
1143                                       "ndr_push_short_relative_ptr2 ptr_offset(%u) > ndr->offset(%u)",
1144                                       ptr_offset, ndr->offset);
1145         }
1146         ndr->offset = ptr_offset;
1147         if (save_offset < ndr->relative_base_offset) {
1148                 return ndr_push_error(ndr, NDR_ERR_BUFSIZE,
1149                                       "ndr_push_relative_ptr2 save_offset(%u) < ndr->relative_base_offset(%u)",
1150                                       save_offset, ndr->relative_base_offset);
1151         }
1152         NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, save_offset - ndr->relative_base_offset));
1153         ndr->offset = save_offset;
1154         return NDR_ERR_SUCCESS;
1155 }
1156
1157 /*
1158   push a relative object - stage2 start
1159   this is called during buffers processing
1160 */
1161 _PUBLIC_ enum ndr_err_code ndr_push_relative_ptr2_start(struct ndr_push *ndr, const void *p)
1162 {
1163         if (p == NULL) {
1164                 return NDR_ERR_SUCCESS;
1165         }
1166         if (!(ndr->flags & LIBNDR_FLAG_RELATIVE_REVERSE)) {
1167                 return ndr_push_relative_ptr2(ndr, p);
1168         }
1169         if (ndr->relative_end_offset == -1) {
1170                 return ndr_push_error(ndr, NDR_ERR_RELATIVE,
1171                               "ndr_push_relative_ptr2_start RELATIVE_REVERSE flag set and relative_end_offset %d",
1172                               ndr->relative_end_offset);
1173         }
1174         NDR_CHECK(ndr_token_store(ndr, &ndr->relative_begin_list, p, ndr->offset));
1175         return NDR_ERR_SUCCESS;
1176 }
1177
1178 /*
1179   push a relative object - stage2 end
1180   this is called during buffers processing
1181 */
1182 _PUBLIC_ enum ndr_err_code ndr_push_relative_ptr2_end(struct ndr_push *ndr, const void *p)
1183 {
1184         uint32_t begin_offset = 0xFFFFFFFF;
1185         ssize_t len;
1186         uint32_t correct_offset = 0;
1187         uint32_t align = 1;
1188         uint32_t pad = 0;
1189
1190         if (p == NULL) {
1191                 return NDR_ERR_SUCCESS;
1192         }
1193
1194         if (!(ndr->flags & LIBNDR_FLAG_RELATIVE_REVERSE)) {
1195                 return NDR_ERR_SUCCESS;
1196         }
1197
1198         if (ndr->flags & LIBNDR_FLAG_NO_NDR_SIZE) {
1199                 /* better say more than calculation a too small buffer */
1200                 NDR_PUSH_ALIGN(ndr, 8);
1201                 return NDR_ERR_SUCCESS;
1202         }
1203
1204         if (ndr->relative_end_offset < ndr->offset) {
1205                 return ndr_push_error(ndr, NDR_ERR_RELATIVE,
1206                                       "ndr_push_relative_ptr2_end:"
1207                                       "relative_end_offset %u < offset %u",
1208                                       ndr->relative_end_offset, ndr->offset);
1209         }
1210
1211         NDR_CHECK(ndr_token_retrieve(&ndr->relative_begin_list, p, &begin_offset));
1212
1213         /* we have marshalled a buffer, see how long it was */
1214         len = ndr->offset - begin_offset;
1215
1216         if (len < 0) {
1217                 return ndr_push_error(ndr, NDR_ERR_RELATIVE,
1218                                       "ndr_push_relative_ptr2_end:"
1219                                       "offset %u - begin_offset %u < 0",
1220                                       ndr->offset, begin_offset);
1221         }
1222
1223         if (ndr->relative_end_offset < len) {
1224                 return ndr_push_error(ndr, NDR_ERR_RELATIVE,
1225                                       "ndr_push_relative_ptr2_end:"
1226                                       "relative_end_offset %u < len %lld",
1227                                       ndr->offset, (long long)len);
1228         }
1229
1230         /* the reversed offset is at the end of the main buffer */
1231         correct_offset = ndr->relative_end_offset - len;
1232
1233         /* TODO: remove this hack and let the idl use FLAG_ALIGN2 explicit */
1234         align = 2;
1235
1236         if (ndr->flags & LIBNDR_FLAG_ALIGN2) {
1237                 align = 2;
1238         } else if (ndr->flags & LIBNDR_FLAG_ALIGN4) {
1239                 align = 4;
1240         } else if (ndr->flags & LIBNDR_FLAG_ALIGN8) {
1241                 align = 8;
1242         }
1243
1244         pad = ndr_align_size(correct_offset, align);
1245         if (pad) {
1246                 correct_offset += pad;
1247                 correct_offset -= align;
1248         }
1249
1250         if (correct_offset < begin_offset) {
1251                 return ndr_push_error(ndr, NDR_ERR_RELATIVE,
1252                                       "ndr_push_relative_ptr2_end: "
1253                                       "correct_offset %u < begin_offset %u",
1254                                       correct_offset, begin_offset);
1255         }
1256
1257         if (len > 0) {
1258                 uint32_t clear_size = correct_offset - begin_offset;
1259
1260                 clear_size = MIN(clear_size, len);
1261
1262                 /* now move the marshalled buffer to the end of the main buffer */
1263                 memmove(ndr->data + correct_offset, ndr->data + begin_offset, len);
1264
1265                 if (clear_size) {
1266                         /* and wipe out old buffer within the main buffer */
1267                         memset(ndr->data + begin_offset, '\0', clear_size);
1268                 }
1269         }
1270
1271         /* and set the end offset for the next buffer */
1272         ndr->relative_end_offset = correct_offset;
1273
1274         /* finally write the offset to the main buffer */
1275         ndr->offset = correct_offset;
1276         NDR_CHECK(ndr_push_relative_ptr2(ndr, p));
1277
1278         /* restore to where we were in the main buffer */
1279         ndr->offset = begin_offset;
1280
1281         return NDR_ERR_SUCCESS;
1282 }
1283
1284 /*
1285   get the current base for relative pointers for the pull
1286 */
1287 _PUBLIC_ uint32_t ndr_pull_get_relative_base_offset(struct ndr_pull *ndr)
1288 {
1289         return ndr->relative_base_offset;
1290 }
1291
1292 /*
1293   restore the old base for relative pointers for the pull
1294 */
1295 _PUBLIC_ void ndr_pull_restore_relative_base_offset(struct ndr_pull *ndr, uint32_t offset)
1296 {
1297         ndr->relative_base_offset = offset;
1298 }
1299
1300 /*
1301   setup the current base for relative pointers for the pull
1302   called in the NDR_SCALAR stage
1303 */
1304 _PUBLIC_ enum ndr_err_code ndr_pull_setup_relative_base_offset1(struct ndr_pull *ndr, const void *p, uint32_t offset)
1305 {
1306         ndr->relative_base_offset = offset;
1307         return ndr_token_store(ndr, &ndr->relative_base_list, p, offset);
1308 }
1309
1310 /*
1311   setup the current base for relative pointers for the pull
1312   called in the NDR_BUFFERS stage
1313 */
1314 _PUBLIC_ enum ndr_err_code ndr_pull_setup_relative_base_offset2(struct ndr_pull *ndr, const void *p)
1315 {
1316         return ndr_token_retrieve(&ndr->relative_base_list, p, &ndr->relative_base_offset);
1317 }
1318
1319 /*
1320   pull a relative object - stage1
1321   called during SCALARS processing
1322 */
1323 _PUBLIC_ enum ndr_err_code ndr_pull_relative_ptr1(struct ndr_pull *ndr, const void *p, uint32_t rel_offset)
1324 {
1325         rel_offset += ndr->relative_base_offset;
1326         if (rel_offset > ndr->data_size) {
1327                 return ndr_pull_error(ndr, NDR_ERR_BUFSIZE,
1328                                       "ndr_pull_relative_ptr1 rel_offset(%u) > ndr->data_size(%u)",
1329                                       rel_offset, ndr->data_size);
1330         }
1331         return ndr_token_store(ndr, &ndr->relative_list, p, rel_offset);
1332 }
1333
1334 /*
1335   pull a relative object - stage2
1336   called during BUFFERS processing
1337 */
1338 _PUBLIC_ enum ndr_err_code ndr_pull_relative_ptr2(struct ndr_pull *ndr, const void *p)
1339 {
1340         uint32_t rel_offset;
1341         NDR_CHECK(ndr_token_retrieve(&ndr->relative_list, p, &rel_offset));
1342         return ndr_pull_set_offset(ndr, rel_offset);
1343 }
1344
1345 const static struct {
1346         enum ndr_err_code err;
1347         const char *string;
1348 } ndr_err_code_strings[] = {
1349         { NDR_ERR_SUCCESS, "Success" },
1350         { NDR_ERR_ARRAY_SIZE, "Bad Array Size" },
1351         { NDR_ERR_BAD_SWITCH, "Bad Switch" },
1352         { NDR_ERR_OFFSET, "Offset Error" },
1353         { NDR_ERR_RELATIVE, "Relative Pointer Error" },
1354         { NDR_ERR_CHARCNV, "Character Conversion Error" },
1355         { NDR_ERR_LENGTH, "Length Error" },
1356         { NDR_ERR_SUBCONTEXT, "Subcontext Error" },
1357         { NDR_ERR_COMPRESSION, "Compression Error" },
1358         { NDR_ERR_STRING, "String Error" },
1359         { NDR_ERR_VALIDATE, "Validate Error" },
1360         { NDR_ERR_BUFSIZE, "Buffer Size Error" },
1361         { NDR_ERR_ALLOC, "Allocation Error" },
1362         { NDR_ERR_RANGE, "Range Error" },
1363         { NDR_ERR_TOKEN, "Token Error" },
1364         { NDR_ERR_IPV4ADDRESS, "IPv4 Address Error" },
1365         { NDR_ERR_INVALID_POINTER, "Invalid Pointer" },
1366         { NDR_ERR_UNREAD_BYTES, "Unread Bytes" },
1367         { NDR_ERR_NDR64, "NDR64 assertion error" },
1368         { 0, NULL }
1369 };
1370
1371 _PUBLIC_ const char *ndr_map_error2string(enum ndr_err_code ndr_err)
1372 {
1373         int i;
1374         for (i = 0; ndr_err_code_strings[i].string != NULL; i++) {
1375                 if (ndr_err_code_strings[i].err == ndr_err)
1376                         return ndr_err_code_strings[i].string;
1377         }
1378         return "Unknown error";
1379 }