diff options
Diffstat (limited to 'source3/rpc_parse')
| -rw-r--r-- | source3/rpc_parse/parse_sec.c | 697 | ||||
| -rw-r--r-- | source3/rpc_parse/parse_spoolss.c | 159 |
2 files changed, 490 insertions, 366 deletions
diff --git a/source3/rpc_parse/parse_sec.c b/source3/rpc_parse/parse_sec.c index 5d4b56d745..57fd04e05d 100644 --- a/source3/rpc_parse/parse_sec.c +++ b/source3/rpc_parse/parse_sec.c @@ -2,10 +2,10 @@ * Unix SMB/Netbios implementation. * Version 1.9. * RPC Pipe client / server routines - * Copyright (C) Andrew Tridgell 1992-1998, - * Copyright (C) Jeremy R. Allison 1995-1998 - * Copyright (C) Luke Kenneth Casson Leighton 1996-1998, - * Copyright (C) Paul Ashton 1997-1998. + * Copyright (C) Andrew Tridgell 1992-1999, + * Copyright (C) Jeremy R. Allison 1995-1999 + * Copyright (C) Luke Kenneth Casson Leighton 1996-1999, + * Copyright (C) Paul Ashton 1997-1999. * * This program is free software; you can redistribute it and/or modify * it under the terms of the GNU General Public License as published by @@ -24,18 +24,20 @@ #include "includes.h" +#include "rpc_parse.h" extern int DEBUGLEVEL; -#define SD_HEADER_SIZE 0x14 /******************************************************************* Sets up a SEC_ACCESS structure. ********************************************************************/ -void init_sec_access(SEC_ACCESS *t, uint32 mask) +BOOL make_sec_access(SEC_ACCESS * t, uint32 mask) { + ZERO_STRUCTP(t); t->mask = mask; + return True; } /******************************************************************* @@ -50,11 +52,9 @@ BOOL sec_io_access(char *desc, SEC_ACCESS *t, prs_struct *ps, int depth) prs_debug(ps, depth, desc, "sec_io_access"); depth++; - if(!prs_align(ps)) - return False; - - if(!prs_uint32("mask", ps, depth, &(t->mask))) - return False; + prs_align(ps); + + prs_uint32("mask", ps, depth, &(t->mask)); return True; } @@ -64,555 +64,540 @@ BOOL sec_io_access(char *desc, SEC_ACCESS *t, prs_struct *ps, int depth) Sets up a SEC_ACE structure. ********************************************************************/ -void init_sec_ace(SEC_ACE *t, DOM_SID *sid, uint8 type, SEC_ACCESS mask, uint8 flag) +static size_t sec_ace_get_size(const SEC_ACE *ace) +{ + if (ace == NULL) + return 0; + return sid_size(&ace->sid) + 8; +} + +BOOL make_sec_ace(SEC_ACE * t, const DOM_SID *sid, uint8 type, + SEC_ACCESS mask, uint8 flag) { + ZERO_STRUCTP(t); + t->type = type; t->flags = flag; - t->size = sid_size(sid) + 8; t->info = mask; - - ZERO_STRUCTP(&t->sid); sid_copy(&t->sid, sid); + + t->size = sec_ace_get_size(t); + + return True; } /******************************************************************* Reads or writes a SEC_ACE structure. ********************************************************************/ -BOOL sec_io_ace(char *desc, SEC_ACE *psa, prs_struct *ps, int depth) +static BOOL sec_io_ace(char *desc, SEC_ACE * t, prs_struct *ps, int depth) { uint32 old_offset; uint32 offset_ace_size; - - if (psa == NULL) + if (t == NULL) return False; prs_debug(ps, depth, desc, "sec_io_ace"); depth++; - if(!prs_align(ps)) - return False; - - old_offset = prs_offset(ps); - - if(!prs_uint8("type ", ps, depth, &psa->type)) - return False; - - if(!prs_uint8("flags", ps, depth, &psa->flags)) - return False; - - if(!prs_uint16_pre("size ", ps, depth, &psa->size, &offset_ace_size)) - return False; + prs_align(ps); - if(!sec_io_access("info ", &psa->info, ps, depth)) - return False; + old_offset = prs_offset(ps); - if(!prs_align(ps)) - return False; + prs_uint8("type ", ps, depth, &(t->type)); + prs_uint8("flags", ps, depth, &(t->flags)); + prs_uint16_pre("size ", ps, depth, &(t->size), &offset_ace_size); - if(!smb_io_dom_sid("sid ", &psa->sid , ps, depth)) - return False; + sec_io_access("info ", &t->info, ps, depth); + prs_align(ps); + smb_io_dom_sid("sid ", &t->sid, ps, depth); + prs_align(ps); - if(!prs_uint16_post("size ", ps, depth, &psa->size, offset_ace_size, old_offset)) - return False; + prs_uint16_post("size ", ps, depth, &t->size, offset_ace_size, + old_offset); return True; } /******************************************************************* - Create a SEC_ACL structure. + Create a SEC_ACL structure. ********************************************************************/ - -SEC_ACL *make_sec_acl(uint16 revision, int num_aces, SEC_ACE *ace_list) +BOOL make_sec_acl(SEC_ACL * t, uint16 revision, int num_aces, SEC_ACE * ace) { - SEC_ACL *dst; int i; - if((dst = (SEC_ACL *)malloc(sizeof(SEC_ACL))) == NULL) - return NULL; + ZERO_STRUCTP(t); - ZERO_STRUCTP(dst); + t->revision = revision; + t->num_aces = num_aces; + t->size = 8; + t->ace = ace; - dst->revision = revision; - dst->num_aces = num_aces; - dst->size = 8; - - if((dst->ace = (SEC_ACE *)malloc( sizeof(SEC_ACE) * num_aces )) == NULL) { - free_sec_acl(&dst); - return NULL; + for (i = 0; i < num_aces; i++) + { + t->size += sec_ace_get_size(&ace[i]); } - for (i = 0; i < num_aces; i++) { - dst->ace[i] = ace_list[i]; /* Structure copy. */ - dst->size += ace_list[i].size; - } - - return dst; + return True; } /******************************************************************* - Duplicate a SEC_ACL structure. + Duplicate a SEC_ACL structure. ********************************************************************/ - SEC_ACL *dup_sec_acl( SEC_ACL *src) { if(src == NULL) return NULL; - return make_sec_acl( src->revision, src->num_aces, src->ace); + return NULL; } /******************************************************************* - Delete a SEC_ACL structure. +frees a structure. ********************************************************************/ - -void free_sec_acl(SEC_ACL **ppsa) +void free_sec_acl(SEC_ACL * t) { - SEC_ACL *psa; - - if(ppsa == NULL || *ppsa == NULL) + if (t == NULL) return; - - psa = *ppsa; - if (psa->ace != NULL) - free(psa->ace); - - free(psa); - *ppsa = NULL; + if (t->ace != NULL) + { + free(t->ace); + t->ace = NULL; + } + t->num_aces = 0; } /******************************************************************* - Reads or writes a SEC_ACL structure. + Reads or writes a structure. First of the xx_io_xx functions that allocates its data structures for you as it reads them. ********************************************************************/ -BOOL sec_io_acl(char *desc, SEC_ACL **ppsa, prs_struct *ps, int depth) +static BOOL sec_io_acl(char *desc, SEC_ACL * t, prs_struct *ps, int depth) { - int i; + uint32 i; uint32 old_offset; uint32 offset_acl_size; - SEC_ACL *psa; - if (ppsa == NULL) + if (t == NULL) return False; - psa = *ppsa; - - if(UNMARSHALLING(ps) && psa == NULL) { - /* - * This is a read and we must allocate the stuct to read into. - */ - if((psa = (SEC_ACL *)malloc(sizeof(SEC_ACL))) == NULL) - return False; - ZERO_STRUCTP(psa); - *ppsa = psa; - } - prs_debug(ps, depth, desc, "sec_io_acl"); depth++; - if(!prs_align(ps)) - return False; - + prs_align(ps); + old_offset = prs_offset(ps); - if(!prs_uint16("revision", ps, depth, &psa->revision)) - return False; + prs_uint16("revision", ps, depth, &(t->revision)); + prs_uint16_pre("size ", ps, depth, &(t->size), &offset_acl_size); + prs_uint32("num_aces ", ps, depth, &(t->num_aces)); - if(!prs_uint16_pre("size ", ps, depth, &psa->size, &offset_acl_size)) - return False; + if (ps->io && t->num_aces != 0) + { + /* reading */ + t->ace = (SEC_ACE *) malloc(sizeof(t->ace[0]) * t->num_aces); + ZERO_STRUCTP(t->ace); + } - if(!prs_uint32("num_aces ", ps, depth, &psa->num_aces)) + if (t->ace == NULL && t->num_aces != 0) + { + DEBUG(0, ("INVALID ACL\n")); + prs_set_offset(ps, 0xfffffffe); return False; - - if (UNMARSHALLING(ps) && psa->num_aces != 0) { - /* reading */ - if((psa->ace = malloc(sizeof(psa->ace[0]) * psa->num_aces)) == NULL) - return False; - ZERO_STRUCTP(psa->ace); } - for (i = 0; i < psa->num_aces; i++) { + for (i = 0; i < MIN(t->num_aces, MAX_SEC_ACES); i++) + { fstring tmp; - slprintf(tmp, sizeof(tmp)-1, "ace_list[%02d]: ", i); - if(!sec_io_ace(tmp, &psa->ace[i], ps, depth)) + slprintf(tmp, sizeof(tmp) - 1, "ace[%02d]: ", i); + if(!sec_io_ace(tmp, &t->ace[i], ps, depth)) return False; } - if(!prs_align(ps)) - return False; + prs_align(ps); - if(!prs_uint16_post("size ", ps, depth, &psa->size, offset_acl_size, old_offset)) - return False; + prs_uint16_post("size ", ps, depth, &t->size, offset_acl_size, + old_offset); return True; } + /******************************************************************* Creates a SEC_DESC structure ********************************************************************/ - -SEC_DESC *make_sec_desc(uint16 revision, uint16 type, - DOM_SID *owner_sid, DOM_SID *grp_sid, - SEC_ACL *sacl, SEC_ACL *dacl, size_t *sec_desc_size) +int make_sec_desc(SEC_DESC * t, uint16 revision, uint16 type, + DOM_SID *owner_sid, DOM_SID *grp_sid, + SEC_ACL * sacl, SEC_ACL * dacl) { - SEC_DESC *dst; uint32 offset; - *sec_desc_size = 0; - - if(( dst = (SEC_DESC *)malloc(sizeof(SEC_DESC))) == NULL) - return NULL; + ZERO_STRUCTP(t); - ZERO_STRUCTP(dst); - - dst->revision = revision; - dst->type = type; - - dst->off_owner_sid = 0; - dst->off_grp_sid = 0; - dst->off_sacl = 0; - dst->off_dacl = 0; - - if(owner_sid && ((dst->owner_sid = sid_dup(owner_sid)) == NULL)) - goto error_exit; + t->revision = revision; + t->type = type; - if(grp_sid && ((dst->grp_sid = sid_dup(grp_sid)) == NULL)) - goto error_exit; + t->off_owner_sid = 0; + t->off_grp_sid = 0; + t->off_sacl = 0; + t->off_dacl = 0; - if(sacl && ((dst->sacl = dup_sec_acl(sacl)) == NULL)) - goto error_exit; + t->dacl = dacl; + t->sacl = sacl; + t->owner_sid = owner_sid; + t->grp_sid = grp_sid; - if(dacl && ((dst->dacl = dup_sec_acl(dacl)) == NULL)) - goto error_exit; - offset = 0x0; - /* - * Work out the linearization sizes. - */ - - if (dst->owner_sid != NULL) { - + if (dacl != NULL) + { if (offset == 0) - offset = SD_HEADER_SIZE; - - dst->off_owner_sid = offset; - offset += ((sid_size(dst->owner_sid) + 3) & ~3); + { + offset = 0x14; + } + t->off_dacl = offset; + offset += dacl->size; + offset = ((offset + 3) & ~3); } - if (dst->grp_sid != NULL) { - + if (sacl != NULL) + { if (offset == 0) - offset = SD_HEADER_SIZE; - - dst->off_grp_sid = offset; - offset += ((sid_size(dst->grp_sid) + 3) & ~3); + { + offset = 0x14; + } + t->off_sacl = offset; + offset += sacl->size; + offset = ((offset + 3) & ~3); } - if (dst->sacl != NULL) { - + if (owner_sid != NULL) + { if (offset == 0) - offset = SD_HEADER_SIZE; - - dst->off_sacl = offset; - offset += ((sacl->size + 3) & ~3); + { + offset = 0x14; + } + t->off_owner_sid = offset; + offset += sid_size(owner_sid); + offset = ((offset + 3) & ~3); } - if (dst->dacl != NULL) { - + if (grp_sid != NULL) + { if (offset == 0) - offset = SD_HEADER_SIZE; - - dst->off_dacl = offset; - offset += ((dacl->size + 3) & ~3); + { + offset = 0x14; + } + t->off_grp_sid = offset; + offset += sid_size(grp_sid); } - *sec_desc_size = (size_t)((offset == 0) ? SD_HEADER_SIZE : offset); - return dst; - -error_exit: - - *sec_desc_size = 0; - free_sec_desc(&dst); - return NULL; + return (offset == 0) ? 0x14 : offset; } -/******************************************************************* - Duplicate a SEC_DESC structure. -********************************************************************/ - -SEC_DESC *dup_sec_desc( SEC_DESC *src) -{ - size_t dummy; - - if(src == NULL) - return NULL; - - return make_sec_desc( src->revision, src->type, - src->owner_sid, src->grp_sid, src->sacl, - src->dacl, &dummy); -} /******************************************************************* - Deletes a SEC_DESC structure +frees a structure ********************************************************************/ - -void free_sec_desc(SEC_DESC **ppsd) +void free_sec_desc(SEC_DESC * t) { - SEC_DESC *psd; - - if(ppsd == NULL || *ppsd == NULL) - return; + if (t->dacl != NULL) + { + free_sec_acl(t->dacl); + } - psd = *ppsd; + if (t->sacl != NULL) + { + free_sec_acl(t->dacl); - free_sec_acl(&psd->dacl); - free_sec_acl(&psd->dacl); - free(psd->owner_sid); - free(psd->grp_sid); - free(psd); - *ppsd = NULL; -} + } -/******************************************************************* - Creates a SEC_DESC structure with typical defaults. -********************************************************************/ + if (t->owner_sid != NULL) + { + free(t->owner_sid); + t->owner_sid = NULL; + } -SEC_DESC *make_standard_sec_desc(DOM_SID *owner_sid, DOM_SID *grp_sid, - SEC_ACL *dacl, size_t *sec_desc_size) -{ - return make_sec_desc(1, SEC_DESC_SELF_RELATIVE|SEC_DESC_DACL_PRESENT, - owner_sid, grp_sid, NULL, dacl, sec_desc_size); + if (t->grp_sid != NULL) + { + free(t->grp_sid); + t->grp_sid = NULL; + } } /******************************************************************* - Reads or writes a SEC_DESC structure. - If reading and the *ppsd = NULL, allocates the structure. +reads or writes a structure. ********************************************************************/ - -BOOL sec_io_desc(char *desc, SEC_DESC **ppsd, prs_struct *ps, int depth) +BOOL sec_io_desc(char *desc, SEC_DESC * t, prs_struct *ps, int depth) { +#if 0 + uint32 off_owner_sid; + uint32 off_grp_sid; + uint32 off_sacl; + uint32 off_dacl; +#endif uint32 old_offset; - uint32 max_offset = 0; /* after we're done, move offset to end */ - SEC_DESC *psd; + uint32 max_offset = 0; /* after we're done, move offset to end */ - if (ppsd == NULL) + if (t == NULL) return False; - psd = *ppsd; - - if(UNMARSHALLING(ps) && psd == NULL) { - if((psd = (SEC_DESC *)malloc(sizeof(SEC_DESC))) == NULL) - return False; - ZERO_STRUCTP(psd); - *ppsd = psd; - } - prs_debug(ps, depth, desc, "sec_io_desc"); depth++; - if(!prs_align(ps)) - return False; - + prs_align(ps); + /* start of security descriptor stored for back-calc offset purposes */ old_offset = prs_offset(ps); - - if(!prs_uint16("revision ", ps, depth, &psd->revision)) - return False; - - if(!prs_uint16("type ", ps, depth, &psd->type)) - return False; - - if(!prs_uint32("off_owner_sid", ps, depth, &psd->off_owner_sid)) - return False; - - if(!prs_uint32("off_grp_sid ", ps, depth, &psd->off_grp_sid)) - return False; - - if(!prs_uint32("off_sacl ", ps, depth, &psd->off_sacl)) - return False; - - if(!prs_uint32("off_dacl ", ps, depth, &psd->off_dacl)) - return False; - + max_offset = old_offset; + + prs_uint16("revision ", ps, depth, &(t->revision)); + prs_uint16("type ", ps, depth, &(t->type)); + + prs_uint32("off_owner_sid", ps, depth, &(t->off_owner_sid)); + prs_uint32("off_grp_sid ", ps, depth, &(t->off_grp_sid)); + prs_uint32("off_sacl ", ps, depth, &(t->off_sacl)); + prs_uint32("off_dacl ", ps, depth, &(t->off_dacl)); +#if 0 + prs_uint32_pre("off_owner_sid", ps, depth, &(t->off_owner_sid), + &off_owner_sid); + prs_uint32_pre("off_grp_sid ", ps, depth, &(t->off_grp_sid), + &off_grp_sid); + prs_uint32_pre("off_sacl ", ps, depth, &(t->off_sacl), &off_sacl); + prs_uint32_pre("off_dacl ", ps, depth, &(t->off_dacl), &off_dacl); +#endif max_offset = MAX(max_offset, prs_offset(ps)); - if (psd->off_owner_sid != 0) { - - if (UNMARSHALLING(ps)) { - if(!prs_set_offset(ps, old_offset + psd->off_owner_sid)) - return False; + if (IS_BITS_SET_ALL(t->type, SEC_DESC_DACL_PRESENT)) + { +#if 0 + prs_uint32_post("off_dacl ", ps, depth, &(t->off_dacl), + off_dacl, prs_offset(ps) - old_offset); +#endif + if(!prs_set_offset(ps, old_offset + t->off_dacl)) + return False; + if (ps->io) + { /* reading */ - if((psd->owner_sid = malloc(sizeof(*psd->owner_sid))) == NULL) - return False; - ZERO_STRUCTP(psd->owner_sid); + t->dacl = (SEC_ACL *) malloc(sizeof(*t->dacl)); + ZERO_STRUCTP(t->dacl); } - if(!smb_io_dom_sid("owner_sid ", psd->owner_sid , ps, depth)) + if (t->dacl == NULL) + { + DEBUG(0, ("INVALID DACL\n")); + prs_set_offset(ps, 0xfffffffe); return False; - if(!prs_align(ps)) + } + + if(!sec_io_acl("dacl", t->dacl, ps, depth)) return False; + prs_align(ps); } +#if 0 + else + { + prs_uint32_post("off_dacl ", ps, depth, &(t->off_dacl), + off_dacl, 0); + } +#endif max_offset = MAX(max_offset, prs_offset(ps)); - if (psd->off_grp_sid != 0) { - - if (UNMARSHALLING(ps)) { + if (IS_BITS_SET_ALL(t->type, SEC_DESC_SACL_PRESENT)) + { +#if 0 + prs_uint32_post("off_sacl ", ps, depth, &(t->off_sacl), + off_sacl, prs_offset(ps) - old_offset); +#endif + if(!prs_set_offset(ps, old_offset + t->off_sacl)) + return False; + if (ps->io) + { /* reading */ - if(!prs_set_offset(ps, old_offset + psd->off_grp_sid)) - return False; - if((psd->grp_sid = malloc(sizeof(*psd->grp_sid))) == NULL) - return False; - ZERO_STRUCTP(psd->grp_sid); + t->sacl = (SEC_ACL *) malloc(sizeof(*t->sacl)); + ZERO_STRUCTP(t->sacl); } - if(!smb_io_dom_sid("grp_sid", psd->grp_sid, ps, depth)) + if (t->sacl == NULL) + { + DEBUG(0, ("INVALID SACL\n")); + prs_set_offset(ps, 0xfffffffe); return False; - if(!prs_align(ps)) + } + + if(!sec_io_acl("sacl", t->sacl, ps, depth)) return False; + prs_align(ps); + } +#if 0 + else + { + prs_uint32_post("off_sacl ", ps, depth, &(t->off_sacl), + off_sacl, 0); } +#endif max_offset = MAX(max_offset, prs_offset(ps)); - if (IS_BITS_SET_ALL(psd->type, SEC_DESC_SACL_PRESENT) && psd->off_sacl) { - if(!prs_set_offset(ps, old_offset + psd->off_sacl)) - return False; - if(!sec_io_acl("sacl", &psd->sacl, ps, depth)) - return False; - if(!prs_align(ps)) +#if 0 + prs_uint32_post("off_owner_sid", ps, depth, &(t->off_owner_sid), + off_owner_sid, prs_offset(ps) - old_offset); +#endif + if (t->off_owner_sid != 0) + { + if (ps->io) + { + if(!prs_set_offset(ps, old_offset + t->off_owner_sid)) + return False; + } + if (ps->io) + { + /* reading */ + t->owner_sid = + (DOM_SID *)malloc(sizeof(*t->owner_sid)); + ZERO_STRUCTP(t->owner_sid); + } + + if (t->owner_sid == NULL) + { + DEBUG(0, ("INVALID OWNER SID\n")); + prs_set_offset(ps, 0xfffffffe); return False; + } + + smb_io_dom_sid("owner_sid ", t->owner_sid, ps, depth); + prs_align(ps); } max_offset = MAX(max_offset, prs_offset(ps)); - if (IS_BITS_SET_ALL(psd->type, SEC_DESC_DACL_PRESENT) && psd->off_dacl != 0) { - if(!prs_set_offset(ps, old_offset + psd->off_dacl)) - return False; - if(!sec_io_acl("dacl", &psd->dacl, ps, depth)) - return False; - if(!prs_align(ps)) +#if 0 + prs_uint32_post("off_grp_sid ", ps, depth, &(t->off_grp_sid), + off_grp_sid, prs_offset(ps) - old_offset); +#endif + if (t->off_grp_sid != 0) + { + if (ps->io) + { + if(!prs_set_offset(ps, old_offset + t->off_grp_sid)) + return False; + } + if (ps->io) + { + /* reading */ + t->grp_sid = (DOM_SID *)malloc(sizeof(*t->grp_sid)); + ZERO_STRUCTP(t->grp_sid); + } + + if (t->grp_sid == NULL) + { + DEBUG(0, ("INVALID GROUP SID\n")); + prs_set_offset(ps, 0xfffffffe); return False; + } + + smb_io_dom_sid("grp_sid", t->grp_sid, ps, depth); + prs_align(ps); } max_offset = MAX(max_offset, prs_offset(ps)); if(!prs_set_offset(ps, max_offset)) return False; + return True; } /******************************************************************* - Creates a SEC_DESC_BUF structure. +creates a SEC_DESC_BUF structure. ********************************************************************/ - -SEC_DESC_BUF *make_sec_desc_buf(int len, SEC_DESC *sec_desc) +BOOL make_sec_desc_buf(SEC_DESC_BUF * buf, int len, SEC_DESC * data) { - SEC_DESC_BUF *dst; - - if((dst = (SEC_DESC_BUF *)malloc(sizeof(SEC_DESC_BUF))) == NULL) - return NULL; - - ZERO_STRUCTP(dst); + ZERO_STRUCTP(buf); /* max buffer size (allocated size) */ - dst->max_len = len; - dst->len = len; - - if(sec_desc && ((dst->sec = dup_sec_desc(sec_desc)) == NULL)) { - free_sec_desc_buf(&dst); - return NULL; - } - - return dst; -} - -/******************************************************************* - Duplicates a SEC_DESC_BUF structure. -********************************************************************/ - -SEC_DESC_BUF *dup_sec_desc_buf(SEC_DESC_BUF *src) -{ - if(src == NULL) - return NULL; + buf->max_len = len; + buf->undoc = 0; + buf->len = data != NULL ? len : 0; + buf->sec = data; - return make_sec_desc_buf( src->len, src->sec); + return True; } /******************************************************************* - Deletes a SEC_DESC_BUF structure. +frees a SEC_DESC_BUF structure. ********************************************************************/ - -void free_sec_desc_buf(SEC_DESC_BUF **ppsdb) +void free_sec_desc_buf(SEC_DESC_BUF * buf) { - SEC_DESC_BUF *psdb; - - if(ppsdb == NULL || *ppsdb == NULL) + if (buf == NULL) return; - - psdb = *ppsdb; - free_sec_desc(&psdb->sec); - free(psdb); - *ppsdb = NULL; + if (buf->sec != NULL) + { + free_sec_desc(buf->sec); + free(buf->sec); + buf->sec = NULL; + } } /******************************************************************* - Reads or writes a SEC_DESC_BUF structure. +reads or writes a SEC_DESC_BUF structure. ********************************************************************/ - -BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF **ppsdb, prs_struct *ps, int depth) +BOOL sec_io_desc_buf(char *desc, SEC_DESC_BUF * sec, prs_struct *ps, + int depth) { uint32 off_len; uint32 off_max_len; uint32 old_offset; uint32 size; - SEC_DESC_BUF *psdb; - if (ppsdb == NULL) + if (sec == NULL) return False; - psdb = *ppsdb; - - if (UNMARSHALLING(ps) && psdb == NULL) { - if((psdb = (SEC_DESC_BUF *)malloc(sizeof(SEC_DESC_BUF))) == NULL) - return False; - ZERO_STRUCTP(psdb); - *ppsdb = psdb; - } - prs_debug(ps, depth, desc, "sec_io_desc_buf"); depth++; - if(!prs_align(ps)) - return False; - - if(!prs_uint32_pre("max_len", ps, depth, &psdb->max_len, &off_max_len)) - return False; - - if(!prs_uint32 ("undoc ", ps, depth, &psdb->undoc)) - return False; + prs_align(ps); - if(!prs_uint32_pre("len ", ps, depth, &psdb->len, &off_len)) - return False; + prs_uint32_pre("max_len", ps, depth, &(sec->max_len), &off_max_len); + prs_uint32("undoc ", ps, depth, &(sec->undoc)); + prs_uint32_pre("len ", ps, depth, &(sec->len), &off_len); old_offset = prs_offset(ps); - /* reading, length is non-zero; writing, descriptor is non-NULL */ - if ((psdb->len != 0 || MARSHALLING(ps)) && psdb->sec != NULL) { - if(!sec_io_desc("sec ", &psdb->sec, ps, depth)) + if (sec->len != 0 && ps->io) + { + /* reading */ + sec->sec = (SEC_DESC *) malloc(sizeof(*sec->sec)); + ZERO_STRUCTP(sec->sec); + + if (sec->sec == NULL) + { + DEBUG(0, ("INVALID SEC_DESC\n")); + prs_set_offset(ps, 0xfffffffe); return False; + } } - size = prs_offset(ps) - old_offset; - if(!prs_uint32_post("max_len", ps, depth, &psdb->max_len, off_max_len, size == 0 ? psdb->max_len : size)) - return False; + /* reading, length is non-zero; writing, descriptor is non-NULL */ + if ((sec->len != 0 || (!ps->io)) && sec->sec != NULL) + { + sec_io_desc("sec ", sec->sec, ps, depth); + } + + prs_align(ps); + + size = prs_offset(ps) - old_offset - 8; + prs_uint32_post("max_len", ps, depth, &(sec->max_len), off_max_len, + size == 0 ? sec->max_len : size + 8); + prs_uint32_post("len ", ps, depth, &(sec->len), off_len, + size == 0 ? 0 : size + 8); - if(!prs_uint32_post("len ", ps, depth, &psdb->len, off_len, size)) + if(!prs_set_offset(ps, old_offset + size + 8)) return False; return True; diff --git a/source3/rpc_parse/parse_spoolss.c b/source3/rpc_parse/parse_spoolss.c index 4a9c0d2645..c33cf58762 100644 --- a/source3/rpc_parse/parse_spoolss.c +++ b/source3/rpc_parse/parse_spoolss.c @@ -1296,6 +1296,14 @@ static uint32 size_of_relative_string(UNISTR *string) } /******************************************************************* + * return the length of a uint32 + sec desc + ********************************************************************/ +static uint32 size_of_sec_desc(SEC_DESC *sec) +{ + return 4+1024; +} + +/******************************************************************* * return the length of a uint32 (obvious, but the code is clean) ********************************************************************/ static uint32 size_of_device_mode(DEVICEMODE *devmode) @@ -1486,6 +1494,63 @@ static BOOL new_smb_io_relarraystr(char *desc, NEW_BUFFER *buffer, int depth, ui /******************************************************************* Parse a DEVMODE structure and its relative pointer. ********************************************************************/ +static BOOL new_smb_io_relsecdesc(char *desc, NEW_BUFFER *buffer, int depth, + SEC_DESC **secdesc) +{ + prs_struct *ps=&(buffer->prs); + + prs_debug(ps, depth, desc, "new_smb_io_relsecdesc"); + depth++; + + if (MARSHALLING(ps)) + { + uint32 struct_offset = prs_offset(ps); + uint32 relative_offset; + + if (*secdesc != NULL) + { + buffer->string_at_end -= 256; /* HACK! */ + + prs_set_offset(ps, buffer->string_at_end); + + /* write the secdesc */ + if (!sec_io_desc(desc, *secdesc, ps, depth)) + return False; + + prs_set_offset(ps, struct_offset); + } + + relative_offset=buffer->string_at_end - buffer->struct_start; + /* write its offset */ + if (!prs_uint32("offset", ps, depth, &relative_offset)) + return False; + } + else + { + uint32 old_offset; + + /* read the offset */ + if (!prs_uint32("offset", ps, depth, &(buffer->string_at_end))) + return False; + + old_offset = prs_offset(ps); + prs_set_offset(ps, buffer->string_at_end + buffer->struct_start); + + /* read the sd */ + *secdesc = g_new(SEC_DESC, 1); + if (*secdesc == NULL) + return False; + if (!sec_io_desc(desc, *secdesc, ps, depth)) + return False; + + prs_set_offset(ps, old_offset); + } + return True; +} + +/******************************************************************* + Parse a DEVMODE structure and its relative pointer. +********************************************************************/ static BOOL new_smb_io_reldevmode(char *desc, NEW_BUFFER *buffer, int depth, DEVICEMODE **devmode) { prs_struct *ps=&(buffer->prs); @@ -1663,9 +1728,6 @@ BOOL new_smb_io_printer_info_1(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_1 *i ********************************************************************/ BOOL new_smb_io_printer_info_2(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_2 *info, int depth) { - /* hack for the SEC DESC */ - uint32 pipo=0; - prs_struct *ps=&(buffer->prs); prs_debug(ps, depth, desc, "new_smb_io_printer_info_2"); @@ -1701,8 +1763,9 @@ BOOL new_smb_io_printer_info_2(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_2 *i if (!new_smb_io_relstr("parameters", buffer, depth, &info->parameters)) return False; - if (!prs_uint32("security descriptor", ps, depth, &pipo)) + if (!new_smb_io_relsecdesc("secdesc", buffer, depth, &info->secdesc)) return False; + if (!prs_uint32("attributes", ps, depth, &info->attributes)) return False; if (!prs_uint32("priority", ps, depth, &info->priority)) @@ -1724,6 +1787,26 @@ BOOL new_smb_io_printer_info_2(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_2 *i } /******************************************************************* + Parse a PRINTER_INFO_3 structure. +********************************************************************/ +BOOL new_smb_io_printer_info_3(char *desc, NEW_BUFFER *buffer, PRINTER_INFO_3 *info, int depth) +{ + prs_struct *ps=&(buffer->prs); + + prs_debug(ps, depth, desc, "new_smb_io_printer_info_3"); + depth++; + + buffer->struct_start=prs_offset(ps); + + if (!prs_uint32("flags", ps, depth, &info->flags)) + return False; + if (!sec_io_desc("sec_desc", &info->sec, ps, depth)) + return False; + + return True; +} + +/******************************************************************* Parse a DRIVER_INFO_1 structure. ********************************************************************/ BOOL new_smb_io_printer_driver_info_1(char *desc, NEW_BUFFER *buffer, DRIVER_INFO_1 *info, int depth) @@ -2281,7 +2364,7 @@ uint32 spoolss_size_printer_info_2(PRINTER_INFO_2 *info) { int size=0; - size+=4; /* the security descriptor */ + size += size_of_sec_desc( info->secdesc ); size+=size_of_device_mode( info->devmode ); @@ -2312,6 +2395,18 @@ uint32 spoolss_size_printer_info_2(PRINTER_INFO_2 *info) /******************************************************************* return the size required by a struct in the stream ********************************************************************/ +uint32 spoolss_size_printer_info_3(PRINTER_INFO_3 *info) +{ + /* well, we don't actually *know* the damn size of the + * security descriptor. spoolss is a stupidly designed + * api. + */ + return size_of_sec_desc( &info->sec ); +} + +/******************************************************************* +return the size required by a struct in the stream +********************************************************************/ uint32 spoolss_size_printer_driver_info_1(DRIVER_INFO_1 *info) { int size=0; @@ -2829,9 +2924,7 @@ BOOL spoolss_io_q_setprinter(char *desc, SPOOL_Q_SETPRINTER *q_u, prs_struct *ps if (!spoolss_io_devmode_cont(desc, &q_u->devmode_ctr, ps, depth)) return False; - if(!prs_uint32("security.size_of_buffer", ps, depth, &q_u->security.size_of_buffer)) - return False; - if(!prs_uint32("security.data", ps, depth, &q_u->security.data)) + if (!sec_io_desc_buf(desc, &q_u->secdesc_ctr, ps, depth)) return False; if(!prs_uint32("command", ps, depth, &q_u->command)) @@ -3290,6 +3383,23 @@ BOOL spool_io_printer_info_level_1(char *desc, SPOOL_PRINTER_INFO_LEVEL_1 *il, p } /******************************************************************* + Parse a SPOOL_PRINTER_INFO_LEVEL_3 structure. +********************************************************************/ +BOOL spool_io_printer_info_level_3(char *desc, SPOOL_PRINTER_INFO_LEVEL_3 *il, prs_struct *ps, int depth) +{ + prs_debug(ps, depth, desc, "spool_io_printer_info_level_3"); + depth++; + + if(!prs_align(ps)) + return False; + + if(!prs_uint32("secdesc_ptr", ps, depth, &il->secdesc_ptr)) + return False; + + return True; +} + +/******************************************************************* Parse a SPOOL_PRINTER_INFO_LEVEL_2 structure. ********************************************************************/ BOOL spool_io_printer_info_level_2(char *desc, SPOOL_PRINTER_INFO_LEVEL_2 *il, prs_struct *ps, int depth) @@ -3406,23 +3516,36 @@ BOOL spool_io_printer_info_level(char *desc, SPOOL_PRINTER_INFO_LEVEL *il, prs_s * and by setprinter when updating printer's info */ case 1: + { if (UNMARSHALLING(ps)) { - il->info_1=(SPOOL_PRINTER_INFO_LEVEL_1 *)malloc(sizeof(SPOOL_PRINTER_INFO_LEVEL_1)); + il->info_1=g_new(SPOOL_PRINTER_INFO_LEVEL_1, 1); if(il->info_1 == NULL) return False; } if (!spool_io_printer_info_level_1("", il->info_1, ps, depth)) return False; break; + } case 2: if (UNMARSHALLING(ps)) { - il->info_2=(SPOOL_PRINTER_INFO_LEVEL_2 *)malloc(sizeof(SPOOL_PRINTER_INFO_LEVEL_2)); + il->info_2=g_new(SPOOL_PRINTER_INFO_LEVEL_2, 1); if(il->info_2 == NULL) return False; } if (!spool_io_printer_info_level_2("", il->info_2, ps, depth)) return False; break; + case 3: + { + if (UNMARSHALLING(ps)) { + il->info_3=g_new(SPOOL_PRINTER_INFO_LEVEL_3, 1); + if(il->info_3 == NULL) + return False; + } + if (!spool_io_printer_info_level_3("", il->info_3, ps, depth)) + return False; + break; + } } return True; @@ -4607,11 +4730,27 @@ void free_devmode(DEVICEMODE *devmode) } } +void free_printer_info_3(PRINTER_INFO_3 *printer) +{ + if (printer!=NULL) + { + free_sec_desc(&printer->sec); + free(printer); + } +} + void free_printer_info_2(PRINTER_INFO_2 *printer) { if (printer!=NULL) { free_devmode(printer->devmode); + printer->devmode = NULL; + if (printer->secdesc != NULL) + { + free_sec_desc(printer->secdesc); + free(printer->secdesc); + printer->secdesc = NULL; + } free(printer); } } |