s3-dcerpc: Stop using hand marshalling in create_next_pdu_schannel()

Signed-off-by: Günther Deschner <gd@samba.org>

1 files changed, 81 insertions, 87 deletions

diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c
index 97dc3cbe3b..40415cc465 100644
--- a/source3/rpc_server/srv_pipe.c
+++ b/source3/rpc_server/srv_pipe.c
@@ -297,15 +297,16 @@ static bool create_next_pdu_ntlmssp(pipes_struct *p)
 
 static bool create_next_pdu_schannel(pipes_struct *p)
 {
-	DATA_BLOB hdr;
+	DATA_BLOB blob;
 	uint8_t hdr_flags;
-	RPC_HDR_RESP hdr_resp;
 	uint32 ss_padding_len = 0;
 	uint32 data_len;
 	uint32 data_space_available;
 	uint32 data_len_left;
 	uint32 data_pos;
 	NTSTATUS status;
+	union dcerpc_payload u;
+	DATA_BLOB auth_blob = data_blob_null;
 
 	/*
 	 * If we're in the fault state, keep returning fault PDU's until
@@ -317,7 +318,7 @@ static bool create_next_pdu_schannel(pipes_struct *p)
 		return True;
 	}
 
-	memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
+	ZERO_STRUCT(u.response);
 
 	/* Set up rpc header flags. */
 	if (p->out_data.data_sent_length == 0) {
@@ -371,7 +372,7 @@ static bool create_next_pdu_schannel(pipes_struct *p)
 	 * send.
 	 */
 
-	hdr_resp.alloc_hint = data_len_left;
+	u.response.alloc_hint = data_len_left;
 
 	/*
 	 * Work out if this PDU will be the last.
@@ -387,50 +388,43 @@ static bool create_next_pdu_schannel(pipes_struct *p)
 	 */
 	prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 
-	status = dcerpc_push_ncacn_packet_header(
+	/* Set the data into the PDU. */
+	u.response.stub_and_verifier =
+		data_blob_const(prs_data_p(&p->out_data.rdata) +
+				p->out_data.data_sent_length, data_len);
+
+	status = dcerpc_push_ncacn_packet(
 				prs_get_mem_context(&p->out_data.frag),
 				DCERPC_PKT_RESPONSE,
 				hdr_flags,
-				RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
-				  data_len + ss_padding_len +
-				  RPC_HDR_AUTH_LEN +
-				  RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 				RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 				p->call_id,
-				&hdr);
+				&u,
+				&blob);
 	if (!NT_STATUS_IS_OK(status)) {
 		DEBUG(0, ("Failed to marshall RPC Header.\n"));
 		prs_mem_free(&p->out_data.frag);
 		return False;
 	}
 
-	/* Store the header in the data stream. */
-	if (!prs_copy_data_in(&p->out_data.frag,
-				(char *)hdr.data, hdr.length)) {
-		DEBUG(0, ("Out of memory.\n"));
-		prs_mem_free(&p->out_data.frag);
-		return False;
-	}
+	/* Store the data offset. */
+	data_pos = blob.length - data_len;
 
-	if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
-		DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
-		prs_mem_free(&p->out_data.frag);
-		return False;
-	}
-
-	/* Store the current offset. */
-	data_pos = prs_offset(&p->out_data.frag);
-
-	/* Copy the data into the PDU. */
+	/* Set the proper length on the pdu */
+	dcerpc_set_frag_length(&blob, blob.length +
+				      ss_padding_len +
+				      RPC_HDR_AUTH_LEN +
+				      RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN);
 
-	if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
-				     p->out_data.data_sent_length, data_len)) {
-		DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
+	/* Store the packet in the data stream. */
+	if (!prs_copy_data_in(&p->out_data.frag,
+				(char *)blob.data, blob.length)) {
+		DEBUG(0, ("Out of memory.\n"));
 		prs_mem_free(&p->out_data.frag);
 		return False;
 	}
 
-	/* Copy the sign/seal padding data. */
+	/* Append the sign/seal padding data. */
 	if (ss_padding_len) {
 		char pad[SERVER_NDR_PADDING_SIZE];
 		memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
@@ -442,70 +436,70 @@ static bool create_next_pdu_schannel(pipes_struct *p)
 		}
 	}
 
-	{
-		/*
-		 * Schannel processing.
-		 */
-		RPC_HDR_AUTH auth_info;
-		DATA_BLOB blob;
-		uint8_t *data;
-
-		/* Check it's the type of reply we were expecting to decode */
-
-		init_rpc_hdr_auth(&auth_info,
+	/* auth_blob is intentionally null, it will be appended later */
+	status = dcerpc_push_dcerpc_auth(
+				prs_get_mem_context(&p->out_data.frag),
 				DCERPC_AUTH_TYPE_SCHANNEL,
-				p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
-					DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
-				ss_padding_len, 1);
+				p->auth.auth_level,
+				ss_padding_len,
+				1, /* context id. */
+				&auth_blob,
+				&blob);
 
-		if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
-					&p->out_data.frag, 0)) {
-			DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
-			prs_mem_free(&p->out_data.frag);
-			return False;
-		}
+	/* Store auth header in the data stream. */
+	if (!prs_copy_data_in(&p->out_data.frag,
+				(char *)blob.data, blob.length)) {
+		DEBUG(0, ("Out of memory.\n"));
+		prs_mem_free(&p->out_data.frag);
+		return False;
+	}
 
-		data = (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos;
+	/*
+	 * Schannel processing.
+	 */
 
-		switch (p->auth.auth_level) {
-		case DCERPC_AUTH_LEVEL_PRIVACY:
-			status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
-							talloc_tos(),
-							true,
-							data,
-							data_len + ss_padding_len,
-							&blob);
-			break;
-		case DCERPC_AUTH_LEVEL_INTEGRITY:
-			status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
-							talloc_tos(),
-							false,
-							data,
-							data_len + ss_padding_len,
-							&blob);
-			break;
-		default:
-			status = NT_STATUS_INTERNAL_ERROR;
-			break;
-		}
+	blob = data_blob_const(prs_data_p(&p->out_data.frag) + data_pos,
+				data_len + ss_padding_len);
 
-		if (!NT_STATUS_IS_OK(status)) {
-			DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
-				nt_errstr(status)));
-			prs_mem_free(&p->out_data.frag);
-			return false;
-		}
+	switch (p->auth.auth_level) {
+	case DCERPC_AUTH_LEVEL_PRIVACY:
+		status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
+						talloc_tos(),
+						true,
+						blob.data,
+						blob.length,
+						&auth_blob);
+		break;
+	case DCERPC_AUTH_LEVEL_INTEGRITY:
+		status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
+						talloc_tos(),
+						false,
+						blob.data,
+						blob.length,
+						&auth_blob);
+		break;
+	default:
+		status = NT_STATUS_INTERNAL_ERROR;
+		break;
+	}
 
-		/* Finally marshall the blob. */
+	if (!NT_STATUS_IS_OK(status)) {
+		DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
+			nt_errstr(status)));
+		prs_mem_free(&p->out_data.frag);
+		return false;
+	}
 
-		if (DEBUGLEVEL >= 10) {
-			dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
-		}
+	/* Finally marshall the blob. */
 
-		if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
-			prs_mem_free(&p->out_data.frag);
-			return false;
-		}
+	if (DEBUGLEVEL >= 10) {
+		dump_NL_AUTH_SIGNATURE(talloc_tos(), &auth_blob);
+	}
+
+	if (!prs_copy_data_in(&p->out_data.frag,
+				(char *)auth_blob.data, auth_blob.length)) {
+		prs_mem_free(&p->out_data.frag);
+		return false;
 	}
 
 	/*