diff options
| -rw-r--r-- | source3/include/local.h | 3 | ||||
| -rw-r--r-- | source3/rpc_client/cli_pipe.c | 62 | ||||
| -rw-r--r-- | source3/rpc_parse/parse_rpc.c | 5 | ||||
| -rw-r--r-- | source3/rpc_server/srv_pipe.c | 431 |
4 files changed, 363 insertions, 138 deletions
diff --git a/source3/include/local.h b/source3/include/local.h index a88b17be13..a3baf64f9a 100644 --- a/source3/include/local.h +++ b/source3/include/local.h @@ -274,4 +274,7 @@ /* Maximum size of RPC data we will accept for one call. */ #define MAX_RPC_DATA_SIZE (15*1024*1024) +#define CLIENT_NDR_PADDING_SIZE 8 +#define SERVER_NDR_PADDING_SIZE 8 + #endif diff --git a/source3/rpc_client/cli_pipe.c b/source3/rpc_client/cli_pipe.c index 48e2f9eb51..2f7db99f20 100644 --- a/source3/rpc_client/cli_pipe.c +++ b/source3/rpc_client/cli_pipe.c @@ -650,8 +650,9 @@ static NTSTATUS cli_pipe_verify_ntlmssp(struct rpc_pipe_client *cli, RPC_HDR *pr } /* Ensure there's enough data for an authenticated response. */ - if ((auth_len > RPC_MAX_SIGN_SIZE) || - (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) { + if (auth_len > RPC_MAX_PDU_FRAG_LEN || + prhdr->frag_len < RPC_HEADER_LEN + RPC_HDR_RESP_LEN + + RPC_HDR_AUTH_LEN + auth_len) { DEBUG(0,("cli_pipe_verify_ntlmssp: auth_len %u is too large.\n", (unsigned int)auth_len )); return NT_STATUS_BUFFER_TOO_SMALL; @@ -671,17 +672,31 @@ static NTSTATUS cli_pipe_verify_ntlmssp(struct rpc_pipe_client *cli, RPC_HDR *pr full_packet_data_len = prhdr->frag_len - auth_len; /* Pull the auth header and the following data into a blob. */ - if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) { + /* NB. The offset of the auth_header is relative to the *end* + * of the packet, not the start. */ + if(!prs_set_offset(current_pdu, prhdr->frag_len - RPC_HDR_AUTH_LEN - auth_len)) { DEBUG(0,("cli_pipe_verify_ntlmssp: cannot move offset to %u.\n", (unsigned int)RPC_HEADER_LEN + (unsigned int)RPC_HDR_RESP_LEN + (unsigned int)data_len )); return NT_STATUS_BUFFER_TOO_SMALL; - } + } if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) { DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unmarshall RPC_HDR_AUTH.\n")); return NT_STATUS_BUFFER_TOO_SMALL; } + /* Ensure auth_pad_len fits into the packet. */ + if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len + + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len) { + DEBUG(0,("cli_pipe_verify_ntlmssp: auth_info.auth_pad_len " + "too large (%u), auth_len (%u), frag_len = (%u).\n", + (unsigned int)auth_info.auth_pad_len, + (unsigned int)auth_len, + (unsigned int)prhdr->frag_len )); + return NT_STATUS_BUFFER_TOO_SMALL; + } + + auth_blob.data = (unsigned char *)prs_data_p(current_pdu) + prs_offset(current_pdu); auth_blob.length = auth_len; @@ -775,7 +790,7 @@ static NTSTATUS cli_pipe_verify_schannel(struct rpc_pipe_client *cli, RPC_HDR *p } /* Ensure there's enough data for an authenticated response. */ - if ((auth_len > RPC_MAX_SIGN_SIZE) || + if ((auth_len > RPC_MAX_PDU_FRAG_LEN) || (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) { DEBUG(0,("cli_pipe_verify_schannel: auth_len %u is too large.\n", (unsigned int)auth_len )); @@ -784,9 +799,15 @@ static NTSTATUS cli_pipe_verify_schannel(struct rpc_pipe_client *cli, RPC_HDR *p data_len = prhdr->frag_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len; - if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) { - DEBUG(0,("cli_pipe_verify_schannel: cannot move offset to %u.\n", - (unsigned int)RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len )); + /* Pull the auth header and the following data into a blob. */ + /* NB. The offset of the auth_header is relative to the *end* + * of the packet, not the start. */ + if(!prs_set_offset(current_pdu, + prhdr->frag_len - RPC_HDR_AUTH_LEN - auth_len)) { + DEBUG(0,("cli_pipe_verify_schannel: cannot move " + "offset to %u.\n", + (unsigned int)(prhdr->frag_len - + RPC_HDR_AUTH_LEN - auth_len) )); return NT_STATUS_BUFFER_TOO_SMALL; } @@ -795,6 +816,17 @@ static NTSTATUS cli_pipe_verify_schannel(struct rpc_pipe_client *cli, RPC_HDR *p return NT_STATUS_BUFFER_TOO_SMALL; } + /* Ensure auth_pad_len fits into the packet. */ + if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len + + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len) { + DEBUG(0,("cli_pipe_verify_schannel: auth_info.auth_pad_len " + "too large (%u), auth_len (%u), frag_len = (%u).\n", + (unsigned int)auth_info.auth_pad_len, + (unsigned int)auth_len, + (unsigned int)prhdr->frag_len )); + return NT_STATUS_BUFFER_TOO_SMALL; + } + if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) { DEBUG(0,("cli_pipe_verify_schannel: Invalid auth info %d on schannel\n", auth_info.auth_type)); @@ -1790,8 +1822,8 @@ static NTSTATUS create_bind_or_alt_ctx_internal(enum dcerpc_pkt_type pkt_type, /* Do we need to pad ? */ if (auth_len) { uint16 data_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&hdr_rb); - if (data_len % 8) { - ss_padding_len = 8 - (data_len % 8); + if (data_len % CLIENT_NDR_PADDING_SIZE) { + ss_padding_len = CLIENT_NDR_PADDING_SIZE - (data_len % CLIENT_NDR_PADDING_SIZE); phdr_auth->auth_pad_len = ss_padding_len; } frag_len += RPC_HDR_AUTH_LEN + auth_len + ss_padding_len; @@ -1818,8 +1850,8 @@ static NTSTATUS create_bind_or_alt_ctx_internal(enum dcerpc_pkt_type pkt_type, if(auth_len != 0) { if (ss_padding_len) { - char pad[8]; - memset(pad, '\0', 8); + char pad[CLIENT_NDR_PADDING_SIZE]; + memset(pad, '\0', CLIENT_NDR_PADDING_SIZE); if (!prs_copy_data_in(rpc_out, pad, ss_padding_len)) { DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall padding.\n")); return NT_STATUS_NO_MEMORY; @@ -2120,8 +2152,8 @@ static uint32 calculate_data_len_tosend(struct rpc_pipe_client *cli, data_len = MIN(data_space, data_left); *p_ss_padding = 0; - if (data_len % 8) { - *p_ss_padding = 8 - (data_len % 8); + if (data_len % CLIENT_NDR_PADDING_SIZE) { + *p_ss_padding = CLIENT_NDR_PADDING_SIZE - (data_len % CLIENT_NDR_PADDING_SIZE); } *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + /* Normal headers. */ data_len + *p_ss_padding + /* data plus padding. */ @@ -2517,7 +2549,7 @@ static NTSTATUS create_rpc_bind_auth3(struct rpc_pipe_client *cli, /* I'm puzzled about this - seems to violate the DCE RPC auth rules, - about padding - shouldn't this pad to length 8 ? JRA. + about padding - shouldn't this pad to length CLIENT_NDR_PADDING_SIZE ? JRA. */ /* 4 bytes padding. */ diff --git a/source3/rpc_parse/parse_rpc.c b/source3/rpc_parse/parse_rpc.c index f720de35a1..441a00b1ea 100644 --- a/source3/rpc_parse/parse_rpc.c +++ b/source3/rpc_parse/parse_rpc.c @@ -480,6 +480,8 @@ void init_rpc_hdr_auth(RPC_HDR_AUTH *rai, /******************************************************************* Reads or writes an RPC_HDR_AUTH structure. + NB This writes UNALIGNED. Ensure you're correctly aligned before + calling. ********************************************************************/ bool smb_io_rpc_hdr_auth(const char *desc, RPC_HDR_AUTH *rai, prs_struct *ps, int depth) @@ -490,9 +492,6 @@ bool smb_io_rpc_hdr_auth(const char *desc, RPC_HDR_AUTH *rai, prs_struct *ps, in prs_debug(ps, depth, desc, "smb_io_rpc_hdr_auth"); depth++; - if(!prs_align(ps)) - return False; - if(!prs_uint8 ("auth_type ", ps, depth, &rai->auth_type)) return False; if(!prs_uint8 ("auth_level ", ps, depth, &rai->auth_level)) diff --git a/source3/rpc_server/srv_pipe.c b/source3/rpc_server/srv_pipe.c index f92a100d0a..6b08f1f9b3 100644 --- a/source3/rpc_server/srv_pipe.c +++ b/source3/rpc_server/srv_pipe.c @@ -131,11 +131,12 @@ static bool create_next_pdu_ntlmssp(pipes_struct *p) if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) { p->hdr.flags |= DCERPC_PFC_FLAG_LAST; - if (data_len_left % 8) { - ss_padding_len = 8 - (data_len_left % 8); - DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n", - ss_padding_len )); - } + } + + if (data_len_left % SERVER_NDR_PADDING_SIZE) { + ss_padding_len = SERVER_NDR_PADDING_SIZE - (data_len_left % SERVER_NDR_PADDING_SIZE); + DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n", + ss_padding_len )); } /* @@ -179,9 +180,9 @@ static bool create_next_pdu_ntlmssp(pipes_struct *p) /* Copy the sign/seal padding data. */ if (ss_padding_len) { - char pad[8]; + char pad[SERVER_NDR_PADDING_SIZE]; - memset(pad, '\0', 8); + memset(pad, '\0', SERVER_NDR_PADDING_SIZE); if (!prs_copy_data_in(&p->out_data.frag, pad, ss_padding_len)) { DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n", @@ -205,8 +206,9 @@ static bool create_next_pdu_ntlmssp(pipes_struct *p) } init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */); - if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &p->out_data.frag, - 0)) { + + if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, + &p->out_data.frag, 0)) { DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n")); prs_mem_free(&p->out_data.frag); return False; @@ -350,11 +352,11 @@ static bool create_next_pdu_schannel(pipes_struct *p) if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) { p->hdr.flags |= DCERPC_PFC_FLAG_LAST; - if (data_len_left % 8) { - ss_padding_len = 8 - (data_len_left % 8); - DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n", - ss_padding_len )); - } + } + if (data_len_left % SERVER_NDR_PADDING_SIZE) { + ss_padding_len = SERVER_NDR_PADDING_SIZE - (data_len_left % SERVER_NDR_PADDING_SIZE); + DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n", + ss_padding_len )); } p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len + @@ -395,8 +397,8 @@ static bool create_next_pdu_schannel(pipes_struct *p) /* Copy the sign/seal padding data. */ if (ss_padding_len) { - char pad[8]; - memset(pad, '\0', 8); + char pad[SERVER_NDR_PADDING_SIZE]; + memset(pad, '\0', SERVER_NDR_PADDING_SIZE); if (!prs_copy_data_in(&p->out_data.frag, pad, ss_padding_len)) { DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len)); @@ -421,7 +423,7 @@ static bool create_next_pdu_schannel(pipes_struct *p) DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY, ss_padding_len, 1); - if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, + if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &p->out_data.frag, 0)) { DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n")); prs_mem_free(&p->out_data.frag); @@ -746,12 +748,13 @@ bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p) RPC_HDR_AUTH auth_info; uint32 pad = 0; DATA_BLOB blob; + uint32_t auth_len = p->hdr.auth_len; ZERO_STRUCT(blob); DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__)); - if (p->hdr.auth_len == 0) { + if (auth_len == 0) { DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n")); goto err; } @@ -762,15 +765,45 @@ bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p) goto err; } + /* Ensure there's enough data for an authenticated request. */ + if (RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + auth_len > + p->hdr.frag_len) { + DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len " + "%u is too large.\n", + (unsigned int)auth_len )); + goto err; + } + /* * Decode the authentication verifier response. */ - if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) { - DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n")); + /* Pull the auth header and the following data into a blob. */ + /* NB. The offset of the auth_header is relative to the *end* + * of the packet, not the start. Also, the length of the + * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN, + * as the RPC header isn't included in rpc_in_p. */ + if(!prs_set_offset(rpc_in_p, + p->hdr.frag_len - RPC_HEADER_LEN - + RPC_HDR_AUTH_LEN - auth_len)) { + DEBUG(0,("api_pipe_bind_auth3: cannot move " + "offset to %u.\n", + (unsigned int)(p->hdr.frag_len - + RPC_HDR_AUTH_LEN - auth_len) )); + goto err; + } + + if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in_p, 0)) { + DEBUG(0,("api_pipe_bind_auth3: failed to " + "unmarshall RPC_HDR_AUTH.\n")); goto err; } + /* We must NEVER look at auth_info->auth_pad_len here, + * as old Samba client code gets it wrong and sends it + * as zero. JRA. + */ + if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) { DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n", (unsigned int)auth_info.auth_type )); @@ -1154,6 +1187,7 @@ static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p *******************************************************************/ static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p, + uint32_t ss_padding_len, RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth) { DATA_BLOB blob; @@ -1245,8 +1279,11 @@ static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_ OID_NTLMSSP); } + /* auth_pad_len will be handled by the caller */ + /* Copy the blob into the pout_auth parse struct */ - init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1); + init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO, + pauth_info->auth_level, ss_padding_len, 1); if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) { DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n")); goto err; @@ -1286,7 +1323,8 @@ static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_ *******************************************************************/ static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p, - RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth) + uint32_t ss_padding_len, + RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth) { RPC_HDR_AUTH auth_info; DATA_BLOB spnego_blob; @@ -1343,8 +1381,11 @@ static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p /* Generate the spnego "accept completed" blob - no incoming data. */ response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP); + /* FIXME - add auth_pad_len here ! */ + /* Copy the blob into the pout_auth parse struct */ - init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1); + init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO, + pauth_info->auth_level, ss_padding_len, 1); if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) { DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n")); goto err; @@ -1380,6 +1421,7 @@ static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p *******************************************************************/ static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p, + uint32_t ss_padding_len, RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth) { RPC_HDR_AUTH auth_info; @@ -1466,7 +1508,8 @@ static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p, return false; } - init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SCHANNEL, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1); + init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SCHANNEL, + pauth_info->auth_level, ss_padding_len, 1); if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) { DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n")); return False; @@ -1512,6 +1555,7 @@ static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p, *******************************************************************/ static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p, + uint32_t ss_padding_len, RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth) { RPC_HDR_AUTH auth_info; @@ -1555,7 +1599,8 @@ static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p, data_blob_free(&blob); /* Copy the blob into the pout_auth parse struct */ - init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_NTLMSSP, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1); + init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_NTLMSSP, + pauth_info->auth_level, ss_padding_len, 1); if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) { DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n")); goto err; @@ -1604,6 +1649,7 @@ bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p) int i = 0; int auth_len = 0; unsigned int auth_type = DCERPC_AUTH_TYPE_NONE; + uint32_t ss_padding_len = 0; /* No rebinds on a bound pipe - use alter context. */ if (p->pipe_bound) { @@ -1717,6 +1763,45 @@ bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p) DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__)); + assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0; + + /* + * Create the bind response struct. + */ + + /* If the requested abstract synt uuid doesn't match our client pipe, + reject the bind_ack & set the transfer interface synt to all 0's, + ver 0 (observed when NT5 attempts to bind to abstract interfaces + unknown to NT4) + Needed when adding entries to a DACL from NT5 - SK */ + + if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0], + hdr_rb.rpc_context[0].context_id )) { + init_rpc_hdr_ba(&hdr_ba, + RPC_MAX_PDU_FRAG_LEN, + RPC_MAX_PDU_FRAG_LEN, + assoc_gid, + ack_pipe_name, + 0x1, 0x0, 0x0, + &hdr_rb.rpc_context[0].transfer[0]); + } else { + /* Rejection reason: abstract syntax not supported */ + init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN, + RPC_MAX_PDU_FRAG_LEN, assoc_gid, + ack_pipe_name, 0x1, 0x2, 0x1, + &null_ndr_syntax_id); + p->pipe_bound = False; + } + + /* + * and marshall it. + */ + + if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) { + DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n")); + goto err_exit; + } + /* * Check if this is an authenticated bind request. */ @@ -1726,6 +1811,40 @@ bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p) * Decode the authentication verifier. */ + /* Work out any padding needed before the auth footer. */ + if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) { + ss_padding_len = SERVER_NDR_PADDING_SIZE - + ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE); + DEBUG(10,("api_pipe_bind_req: auth pad_len = %u\n", + (unsigned int)ss_padding_len )); + } + + /* Quick length check. Won't catch a bad auth footer, + * prevents overrun. */ + + if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) { + DEBUG(0,("api_pipe_bind_req: auth_len (%u) " + "too long for fragment %u.\n", + (unsigned int)p->hdr.auth_len, + (unsigned int)p->hdr.frag_len )); + goto err_exit; + } + + /* Pull the auth header and the following data into a blob. */ + /* NB. The offset of the auth_header is relative to the *end* + * of the packet, not the start. Also, the length of the + * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN, + * as the RPC header isn't included in rpc_in_p. */ + if(!prs_set_offset(rpc_in_p, + p->hdr.frag_len - RPC_HEADER_LEN - + RPC_HDR_AUTH_LEN - p->hdr.auth_len)) { + DEBUG(0,("api_pipe_bind_req: cannot move " + "offset to %u.\n", + (unsigned int)(p->hdr.frag_len - + RPC_HDR_AUTH_LEN - p->hdr.auth_len) )); + goto err_exit; + } + if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) { DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n")); goto err_exit; @@ -1750,24 +1869,25 @@ bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p) ZERO_STRUCT(auth_info); } - assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0; - switch(auth_type) { case DCERPC_AUTH_TYPE_NTLMSSP: - if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) { + if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, + ss_padding_len, &auth_info, &out_auth)) { goto err_exit; } assoc_gid = 0x7a77; break; case DCERPC_AUTH_TYPE_SCHANNEL: - if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) { + if (!pipe_schannel_auth_bind(p, rpc_in_p, + ss_padding_len, &auth_info, &out_auth)) { goto err_exit; } break; case DCERPC_AUTH_TYPE_SPNEGO: - if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) { + if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, + ss_padding_len, &auth_info, &out_auth)) { goto err_exit; } break; @@ -1781,50 +1901,13 @@ bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p) p->pipe_bound = True; /* The session key was initialized from the SMB * session in make_internal_rpc_pipe_p */ + ss_padding_len = 0; break; default: DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type )); goto err_exit; } - - /* - * Create the bind response struct. - */ - - /* If the requested abstract synt uuid doesn't match our client pipe, - reject the bind_ack & set the transfer interface synt to all 0's, - ver 0 (observed when NT5 attempts to bind to abstract interfaces - unknown to NT4) - Needed when adding entries to a DACL from NT5 - SK */ - - if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0], - hdr_rb.rpc_context[0].context_id )) { - init_rpc_hdr_ba(&hdr_ba, - RPC_MAX_PDU_FRAG_LEN, - RPC_MAX_PDU_FRAG_LEN, - assoc_gid, - ack_pipe_name, - 0x1, 0x0, 0x0, - &hdr_rb.rpc_context[0].transfer[0]); - } else { - /* Rejection reason: abstract syntax not supported */ - init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN, - RPC_MAX_PDU_FRAG_LEN, assoc_gid, - ack_pipe_name, 0x1, 0x2, 0x1, - &null_ndr_syntax_id); - p->pipe_bound = False; - } - - /* - * and marshall it. - */ - - if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) { - DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n")); - goto err_exit; - } - /* * Create the header, now we know the length. */ @@ -1835,7 +1918,8 @@ bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p) init_rpc_hdr(&p->hdr, DCERPC_PKT_BIND_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST, p->hdr.call_id, - RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth), + RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + + ss_padding_len + prs_offset(&out_auth), auth_len); /* @@ -1856,9 +1940,23 @@ bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p) goto err_exit; } - if (auth_len && !prs_append_prs_data( &p->out_data.frag, &out_auth)) { - DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n")); - goto err_exit; + if (auth_len) { + if (ss_padding_len) { + char pad[SERVER_NDR_PADDING_SIZE]; + memset(pad, '\0', SERVER_NDR_PADDING_SIZE); + if (!prs_copy_data_in(&p->out_data.frag, pad, + ss_padding_len)) { + DEBUG(0,("api_pipe_bind_req: failed to add %u " + "bytes of pad data.\n", + (unsigned int)ss_padding_len)); + goto err_exit; + } + } + + if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) { + DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n")); + goto err_exit; + } } /* @@ -1896,6 +1994,7 @@ bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p) prs_struct out_hdr_ba; prs_struct out_auth; int auth_len = 0; + uint32_t ss_padding_len = 0; prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL); @@ -1941,39 +2040,6 @@ bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p) DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__)); - /* - * Check if this is an authenticated alter context request. - */ - - if (p->hdr.auth_len != 0) { - /* - * Decode the authentication verifier. - */ - - if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) { - DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n")); - goto err_exit; - } - - /* - * Currently only the SPNEGO auth type uses the alter ctx - * response in place of the NTLMSSP auth3 type. - */ - - if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) { - /* We can only finish if the pipe is unbound. */ - if (!p->pipe_bound) { - if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) { - goto err_exit; - } - } else { - goto err_exit; - } - } - } else { - ZERO_STRUCT(auth_info); - } - assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0; /* @@ -2013,6 +2079,74 @@ bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p) goto err_exit; } + + /* + * Check if this is an authenticated alter context request. + */ + + if (p->hdr.auth_len != 0) { + /* + * Decode the authentication verifier. + */ + + /* Work out any padding needed before the auth footer. */ + if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) { + ss_padding_len = SERVER_NDR_PADDING_SIZE - + ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE); + DEBUG(10,("api_pipe_alter_context: auth pad_len = %u\n", + (unsigned int)ss_padding_len )); + } + + /* Quick length check. Won't catch a bad auth footer, + * prevents overrun. */ + + if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) { + DEBUG(0,("api_pipe_alter_context: auth_len (%u) " + "too long for fragment %u.\n", + (unsigned int)p->hdr.auth_len, + (unsigned int)p->hdr.frag_len )); + goto err_exit; + } + + /* Pull the auth header and the following data into a blob. */ + /* NB. The offset of the auth_header is relative to the *end* + * of the packet, not the start. Also, the length of the + * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN, + * as the RPC header isn't included in rpc_in_p. */ + if(!prs_set_offset(rpc_in_p, + p->hdr.frag_len - RPC_HEADER_LEN - + RPC_HDR_AUTH_LEN - p->hdr.auth_len)) { + DEBUG(0,("api_alter_context: cannot move " + "offset to %u.\n", + (unsigned int)(p->hdr.frag_len - + RPC_HDR_AUTH_LEN - p->hdr.auth_len) )); + goto err_exit; + } + + if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) { + DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n")); + goto err_exit; + } + + /* + * Currently only the SPNEGO auth type uses the alter ctx + * response in place of the NTLMSSP auth3 type. + */ + + if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) { + /* We can only finish if the pipe is unbound. */ + if (!p->pipe_bound) { + if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, + ss_padding_len, &auth_info, &out_auth)) { + goto err_exit; + } + } else { + goto err_exit; + } + } + } else { + ZERO_STRUCT(auth_info); + } /* * Create the header, now we know the length. */ @@ -2044,9 +2178,23 @@ bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p) goto err_exit; } - if (auth_len && !prs_append_prs_data(&p->out_data.frag, &out_auth)) { - DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n")); - goto err_exit; + if (auth_len) { + if (ss_padding_len) { + char pad[SERVER_NDR_PADDING_SIZE]; + memset(pad, '\0', SERVER_NDR_PADDING_SIZE); + if (!prs_copy_data_in(&p->out_data.frag, pad, + ss_padding_len)) { + DEBUG(0,("api_pipe_alter_context: failed to add %u " + "bytes of pad data.\n", + (unsigned int)ss_padding_len)); + goto err_exit; + } + } + + if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) { + DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n")); + goto err_exit; + } } /* @@ -2098,8 +2246,8 @@ bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in, } /* Ensure there's enough data for an authenticated request. */ - if ((auth_len > RPC_MAX_SIGN_SIZE) || - (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) { + if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + + auth_len > p->hdr.frag_len) { DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n", (unsigned int)auth_len )); *pstatus = NT_STATUS_INVALID_PARAMETER; @@ -2108,9 +2256,10 @@ bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in, /* * We need the full packet data + length (minus auth stuff) as well as the packet data + length - * after the RPC header. + * after the RPC header. * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal * functions as NTLMv2 checks the rpc headers also. + * Both of these values include any auth_pad_len bytes. */ data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN); @@ -2120,15 +2269,36 @@ bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in, full_packet_data_len = p->hdr.frag_len - auth_len; /* Pull the auth header and the following data into a blob. */ - if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) { - DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n", - (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len )); + /* NB. The offset of the auth_header is relative to the *end* + * of the packet, not the start. Also, the length of the + * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN, + * as the RPC header isn't included in rpc_in_p. */ + if(!prs_set_offset(rpc_in, + p->hdr.frag_len - RPC_HEADER_LEN - + RPC_HDR_AUTH_LEN - auth_len)) { + DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move " + "offset to %u.\n", + (unsigned int)(p->hdr.frag_len - + RPC_HDR_AUTH_LEN - auth_len) )); *pstatus = NT_STATUS_INVALID_PARAMETER; return False; } if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) { - DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n")); + DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to " + "unmarshall RPC_HDR_AUTH.\n")); + *pstatus = NT_STATUS_INVALID_PARAMETER; + return False; + } + + /* Ensure auth_pad_len fits into the packet. */ + if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len + + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) { + DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_info.auth_pad_len " + "too large (%u), auth_len (%u), frag_len = (%u).\n", + (unsigned int)auth_info.auth_pad_len, + (unsigned int)auth_len, + (unsigned int)p->hdr.frag_len )); *pstatus = NT_STATUS_INVALID_PARAMETER; return False; } @@ -2213,7 +2383,7 @@ bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss /* * The following is that length of the data we must verify or unseal. * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN - * preceeding the auth_data. + * preceeding the auth_data, but does include the auth_pad_len bytes. */ if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) { @@ -2228,14 +2398,35 @@ bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss DEBUG(5,("data %d auth %d\n", data_len, auth_len)); - if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) { - DEBUG(0,("cannot move offset to %u.\n", - (unsigned int)RPC_HDR_REQ_LEN + data_len )); + /* Pull the auth header and the following data into a blob. */ + /* NB. The offset of the auth_header is relative to the *end* + * of the packet, not the start. Also, the length of the + * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN, + * as the RPC header isn't included in rpc_in_p. */ + if(!prs_set_offset(rpc_in, + p->hdr.frag_len - RPC_HEADER_LEN - + RPC_HDR_AUTH_LEN - auth_len)) { + DEBUG(0,("api_pipe_schannel_process: cannot move " + "offset to %u.\n", + (unsigned int)(p->hdr.frag_len - + RPC_HDR_AUTH_LEN - auth_len) )); return False; } if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) { - DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n")); + DEBUG(0,("api_pipe_schannel_process: failed to " + "unmarshall RPC_HDR_AUTH.\n")); + return False; + } + + /* Ensure auth_pad_len fits into the packet. */ + if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len + + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) { + DEBUG(0,("api_pipe_schannel_process: auth_info.auth_pad_len " + "too large (%u), auth_len (%u), frag_len = (%u).\n", + (unsigned int)auth_info.auth_pad_len, + (unsigned int)auth_len, + (unsigned int)p->hdr.frag_len )); return False; } |