STEP01: librpc/rpc/dcerpc_connection.c fix auth padding

diff --git a/librpc/rpc/dcerpc_connection.c b/librpc/rpc/dcerpc_connection.c
index 1b59c6b89401e47f67a0b040d1cea8f828cf67de..7b40e0bdca44c7041b6f572ab7fe8e026d6f6f68 100644 (file)
--- a/librpc/rpc/dcerpc_connection.c
+++ b/librpc/rpc/dcerpc_connection.c
@@ -461,7 +461,7 @@ static NTSTATUS dcerpc_guess_pdu_sizes(struct dcerpc_security *sec,
 
        *data_to_send = MIN(max_len, data_left);
 
-       mod_len = (header_len + *data_to_send) % pad_alignment;
+       mod_len = (*data_to_send) % pad_alignment;
        if (mod_len) {
                *pad_len = pad_alignment - mod_len;
        } else {
@@ -575,7 +575,7 @@ static NTSTATUS dcerpc_ncacn_packet_blob(TALLOC_CTX *mem_ctx,
        return NT_STATUS_OK;
 }
 
-#define DCERPC_PAYLOAD_PADDING_SIZE 16 //TODO???
+#define DCERPC_PAYLOAD_PADDING_SIZE 16
 
 static NTSTATUS dcerpc_auth_blob(TALLOC_CTX *mem_ctx,
                                 enum dcerpc_AuthType auth_type,
@@ -610,6 +610,7 @@ static NTSTATUS dcerpc_auth_blob(TALLOC_CTX *mem_ctx,
 
 static NTSTATUS dcerpc_response_auth_blob(struct dcerpc_security *sec,
                                          size_t pad_len,
+                                         size_t auth_len,
                                          DATA_BLOB *rpc_out)
 {
        char pad[DCERPC_PAYLOAD_PADDING_SIZE] = { 0, };
@@ -699,7 +700,11 @@ static NTSTATUS dcerpc_response_auth_blob(struct dcerpc_security *sec,
                /* Can't happen. */
                smb_panic("bad auth level");
                /* Notreached. */
-               return NT_STATUS_INVALID_PARAMETER;
+               return NT_STATUS_INVALID_PARAMETER_MIX;
+       }
+
+       if (auth_blob.length != auth_len) {
+               return NT_STATUS_INVALID_PARAMETER_MIX;
        }
 
        /* Finally attach the blob. */
@@ -2204,7 +2209,7 @@ static void dcerpc_do_request_out_frag_next(struct tevent_req *req,
        status = dcerpc_guess_pdu_sizes(state->call->sec,
                                    hdr_len, total_left,
                                    state->conn->features.max_xmit_frag,
-                                   16,//TODO
+                                   DCERPC_PAYLOAD_PADDING_SIZE,
                                    &total_thistime,
                                    &frag_len, &auth_len, &pad_len);
        if (!NT_STATUS_IS_OK(status)) {
@@ -2294,6 +2299,7 @@ static void dcerpc_do_request_out_frag_next(struct tevent_req *req,
        case DCERPC_AUTH_LEVEL_PRIVACY:
                status = dcerpc_response_auth_blob(state->call->sec,
                                                pad_len,
+                                               auth_len,
                                                &frag->blob);
                if (!NT_STATUS_IS_OK(status)) {
                        tevent_req_nterror(req, status);