diff options
Diffstat (limited to 'source4/librpc')
| -rw-r--r-- | source4/librpc/rpc/dcerpc.c | 75 | ||||
| -rw-r--r-- | source4/librpc/rpc/dcerpc_util.c | 60 |
2 files changed, 83 insertions, 52 deletions
diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c index c006693bab..e7b181c50b 100644 --- a/source4/librpc/rpc/dcerpc.c +++ b/source4/librpc/rpc/dcerpc.c @@ -223,11 +223,9 @@ static NTSTATUS ncacn_pull_request_auth(struct dcerpc_connection *c, TALLOC_CTX DATA_BLOB *raw_packet, struct ncacn_packet *pkt) { - struct ndr_pull *ndr; NTSTATUS status; struct dcerpc_auth auth; - DATA_BLOB auth_blob; - enum ndr_err_code ndr_err; + uint32_t auth_length; if (!c->security_state.auth_info || !c->security_state.generic_state) { @@ -254,33 +252,12 @@ static NTSTATUS ncacn_pull_request_auth(struct dcerpc_connection *c, TALLOC_CTX return NT_STATUS_INVALID_LEVEL; } - auth_blob.length = 8 + pkt->auth_length; - - /* check for a valid length */ - if (pkt->u.response.stub_and_verifier.length < auth_blob.length) { - return NT_STATUS_INFO_LENGTH_MISMATCH; - } - - auth_blob.data = - pkt->u.response.stub_and_verifier.data + - pkt->u.response.stub_and_verifier.length - auth_blob.length; - pkt->u.response.stub_and_verifier.length -= auth_blob.length; + status = dcerpc_pull_auth_trailer(pkt, mem_ctx, + &pkt->u.response.stub_and_verifier, + &auth, &auth_length, false); + NT_STATUS_NOT_OK_RETURN(status); - /* pull the auth structure */ - ndr = ndr_pull_init_flags(c, &auth_blob, mem_ctx); - if (!ndr) { - return NT_STATUS_NO_MEMORY; - } - - if (!(pkt->drep[0] & DCERPC_DREP_LE)) { - ndr->flags |= LIBNDR_FLAG_BIGENDIAN; - } - - ndr_err = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, &auth); - if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { - return ndr_map_error2ntstatus(ndr_err); - } - status = NT_STATUS_OK; + pkt->u.response.stub_and_verifier.length -= auth_length; /* check signature or unseal the packet */ switch (c->security_state.auth_info->auth_level) { @@ -317,7 +294,7 @@ static NTSTATUS ncacn_pull_request_auth(struct dcerpc_connection *c, TALLOC_CTX break; } - /* remove the indicated amount of paddiing */ + /* remove the indicated amount of padding */ if (pkt->u.response.stub_and_verifier.length < auth.auth_pad_length) { return NT_STATUS_INFO_LENGTH_MISMATCH; } @@ -600,7 +577,6 @@ static void dcerpc_recv_data(struct dcerpc_connection *conn, DATA_BLOB *blob, NT dcerpc_request_recv_data(conn, blob, &pkt); } - /* Receive a bind reply from the transport */ @@ -643,17 +619,14 @@ static void dcerpc_bind_recv_handler(struct rpc_request *req, } /* the bind_ack might contain a reply set of credentials */ - if (conn->security_state.auth_info && - pkt->u.bind_ack.auth_info.length) { - enum ndr_err_code ndr_err; - ndr_err = ndr_pull_struct_blob( - &pkt->u.bind_ack.auth_info, conn, - NULL, - conn->security_state.auth_info, - (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth); - if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { - c->status = ndr_map_error2ntstatus(ndr_err); - if (!composite_is_ok(c)) return; + if (conn->security_state.auth_info && pkt->u.bind_ack.auth_info.length) { + NTSTATUS status; + uint32_t auth_length; + status = dcerpc_pull_auth_trailer(pkt, conn, &pkt->u.bind_ack.auth_info, + conn->security_state.auth_info, &auth_length, true); + if (!NT_STATUS_IS_OK(status)) { + composite_error(c, status); + return; } } @@ -791,7 +764,6 @@ NTSTATUS dcerpc_auth3(struct dcerpc_pipe *p, pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST; pkt.call_id = next_call_id(p->conn); pkt.auth_length = 0; - pkt.u.auth3._pad = 0; pkt.u.auth3.auth_info = data_blob(NULL, 0); if (p->binding->flags & DCERPC_CONCURRENT_MULTIPLEX) { @@ -1610,15 +1582,14 @@ static void dcerpc_alter_recv_handler(struct rpc_request *req, /* the alter_resp might contain a reply set of credentials */ if (recv_pipe->conn->security_state.auth_info && pkt->u.alter_resp.auth_info.length) { - enum ndr_err_code ndr_err; - ndr_err = ndr_pull_struct_blob( - &pkt->u.alter_resp.auth_info, recv_pipe, - NULL, - recv_pipe->conn->security_state.auth_info, - (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth); - if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { - c->status = ndr_map_error2ntstatus(ndr_err); - if (!composite_is_ok(c)) return; + struct dcerpc_connection *conn = recv_pipe->conn; + NTSTATUS status; + uint32_t auth_length; + status = dcerpc_pull_auth_trailer(pkt, conn, &pkt->u.alter_resp.auth_info, + conn->security_state.auth_info, &auth_length, true); + if (!NT_STATUS_IS_OK(status)) { + composite_error(c, status); + return; } } diff --git a/source4/librpc/rpc/dcerpc_util.c b/source4/librpc/rpc/dcerpc_util.c index 86c91535e7..1985cb9e18 100644 --- a/source4/librpc/rpc/dcerpc_util.c +++ b/source4/librpc/rpc/dcerpc_util.c @@ -83,6 +83,10 @@ NTSTATUS ncacn_push_auth(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, } if (auth_info) { + ndr_err = ndr_push_zero(ndr, auth_info->auth_pad_length); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + return ndr_map_error2ntstatus(ndr_err); + } ndr_err = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, auth_info); if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { return ndr_map_error2ntstatus(ndr_err); @@ -750,3 +754,59 @@ _PUBLIC_ NTSTATUS dcerpc_secondary_context(struct dcerpc_pipe *p, return NT_STATUS_OK; } + + +/* + pull an dcerpc_auth structure, taking account of any auth padding in + the blob at the end of the structure + */ +NTSTATUS dcerpc_pull_auth_trailer(struct ncacn_packet *pkt, + TALLOC_CTX *mem_ctx, + DATA_BLOB *pkt_auth_blob, + struct dcerpc_auth *auth, + uint32_t *auth_length, + bool check_pad) +{ + struct ndr_pull *ndr; + enum ndr_err_code ndr_err; + uint32_t pad; + + pad = pkt_auth_blob->length - (DCERPC_AUTH_TRAILER_LENGTH + pkt->auth_length); + *auth_length = pkt_auth_blob->length - pad; + + ndr = ndr_pull_init_blob(pkt_auth_blob, mem_ctx, NULL); + if (!ndr) { + return NT_STATUS_NO_MEMORY; + } + + if (!(pkt->drep[0] & DCERPC_DREP_LE)) { + ndr->flags |= LIBNDR_FLAG_BIGENDIAN; + } + + ndr_err = ndr_pull_advance(ndr, pad); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + talloc_free(ndr); + return ndr_map_error2ntstatus(ndr_err); + } + + ndr_err = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, auth); + if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) { + talloc_free(ndr); + return ndr_map_error2ntstatus(ndr_err); + } + + if (check_pad && pad != auth->auth_pad_length) { + DEBUG(1,(__location__ ": WARNING: pad length mismatch. Calculated %u got %u\n", + (unsigned)pad, (unsigned)auth->auth_pad_length)); + } + + DEBUG(6,(__location__ ": auth_pad_length %u\n", + (unsigned)auth->auth_pad_length)); + + talloc_steal(mem_ctx, auth->credentials.data); + talloc_free(ndr); + + return NT_STATUS_OK; +} + + |