s4-rpc: be more careful about DCERPC auth padding

[ira/wip.git] / source4 / librpc / rpc / dcerpc.c

diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c
index 87d44384ce5541465162eb5a4f6ba2eb9544f550..e7b181c50bc09fa4e9ca5235104de4273be4eafb 100644 (file)
--- a/source4/librpc/rpc/dcerpc.c
+++ b/source4/librpc/rpc/dcerpc.c
@@ -223,11 +223,9 @@ static NTSTATUS ncacn_pull_request_auth(struct dcerpc_connection *c, TALLOC_CTX
                                        DATA_BLOB *raw_packet,
                                        struct ncacn_packet *pkt)
 {
-       struct ndr_pull *ndr;
        NTSTATUS status;
        struct dcerpc_auth auth;
-       DATA_BLOB auth_blob;
-       enum ndr_err_code ndr_err;
+       uint32_t auth_length;
 
        if (!c->security_state.auth_info ||
            !c->security_state.generic_state) {
@@ -254,33 +252,12 @@ static NTSTATUS ncacn_pull_request_auth(struct dcerpc_connection *c, TALLOC_CTX
                return NT_STATUS_INVALID_LEVEL;
        }
 
-       auth_blob.length = 8 + pkt->auth_length;
-
-       /* check for a valid length */
-       if (pkt->u.response.stub_and_verifier.length < auth_blob.length) {
-               return NT_STATUS_INFO_LENGTH_MISMATCH;
-       }
-
-       auth_blob.data = 
-               pkt->u.response.stub_and_verifier.data + 
-               pkt->u.response.stub_and_verifier.length - auth_blob.length;
-       pkt->u.response.stub_and_verifier.length -= auth_blob.length;
+       status = dcerpc_pull_auth_trailer(pkt, mem_ctx,
+                                         &pkt->u.response.stub_and_verifier,
+                                         &auth, &auth_length, false);
+       NT_STATUS_NOT_OK_RETURN(status);
 
-       /* pull the auth structure */
-       ndr = ndr_pull_init_flags(c, &auth_blob, mem_ctx);
-       if (!ndr) {
-               return NT_STATUS_NO_MEMORY;
-       }
-
-       if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
-               ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
-       }
-
-       ndr_err = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, &auth);
-       if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-               return ndr_map_error2ntstatus(ndr_err);
-       }
-       status = NT_STATUS_OK;
+       pkt->u.response.stub_and_verifier.length -= auth_length;
 
        /* check signature or unseal the packet */
        switch (c->security_state.auth_info->auth_level) {
@@ -317,7 +294,7 @@ static NTSTATUS ncacn_pull_request_auth(struct dcerpc_connection *c, TALLOC_CTX
                break;
        }
        
-       /* remove the indicated amount of paddiing */
+       /* remove the indicated amount of padding */
        if (pkt->u.response.stub_and_verifier.length < auth.auth_pad_length) {
                return NT_STATUS_INFO_LENGTH_MISMATCH;
        }
@@ -457,9 +434,10 @@ static NTSTATUS ncacn_push_request_sign(struct dcerpc_connection *c,
 
        if (creds2.length != sig_size) {
                DEBUG(0,("ncacn_push_request_sign: creds2.length[%u] != sig_size[%u] pad[%u] stub[%u]\n",
-                       creds2.length, (uint32_t)sig_size,
-                       c->security_state.auth_info->auth_pad_length,
-                       pkt->u.request.stub_and_verifier.length));
+                       (unsigned) creds2.length,
+                       (unsigned) sig_size,
+                       (unsigned) c->security_state.auth_info->auth_pad_length,
+                       (unsigned) pkt->u.request.stub_and_verifier.length));
                return NT_STATUS_INTERNAL_ERROR;
        }
 
@@ -599,7 +577,6 @@ static void dcerpc_recv_data(struct dcerpc_connection *conn, DATA_BLOB *blob, NT
        dcerpc_request_recv_data(conn, blob, &pkt);
 }
 
-
 /*
   Receive a bind reply from the transport
 */
@@ -642,17 +619,14 @@ static void dcerpc_bind_recv_handler(struct rpc_request *req,
        }
 
        /* the bind_ack might contain a reply set of credentials */
-       if (conn->security_state.auth_info &&
-           pkt->u.bind_ack.auth_info.length) {
-               enum ndr_err_code ndr_err;
-               ndr_err = ndr_pull_struct_blob(
-                       &pkt->u.bind_ack.auth_info, conn,
-                       NULL,
-                       conn->security_state.auth_info,
-                       (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
-               if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                       c->status = ndr_map_error2ntstatus(ndr_err);
-                       if (!composite_is_ok(c)) return;
+       if (conn->security_state.auth_info && pkt->u.bind_ack.auth_info.length) {
+               NTSTATUS status;
+               uint32_t auth_length;
+               status = dcerpc_pull_auth_trailer(pkt, conn, &pkt->u.bind_ack.auth_info,
+                                                 conn->security_state.auth_info, &auth_length, true);
+               if (!NT_STATUS_IS_OK(status)) {
+                       composite_error(c, status);
+                       return;
                }
        }
 
@@ -790,7 +764,6 @@ NTSTATUS dcerpc_auth3(struct dcerpc_pipe *p,
        pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
        pkt.call_id = next_call_id(p->conn);
        pkt.auth_length = 0;
-       pkt.u.auth3._pad = 0;
        pkt.u.auth3.auth_info = data_blob(NULL, 0);
 
        if (p->binding->flags & DCERPC_CONCURRENT_MULTIPLEX) {
@@ -830,7 +803,7 @@ static void dcerpc_request_recv_data(struct dcerpc_connection *c,
                                     DATA_BLOB *raw_packet, struct ncacn_packet *pkt)
 {
        struct rpc_request *req;
-       uint_t length;
+       unsigned int length;
        NTSTATUS status = NT_STATUS_OK;
 
        /*
@@ -1441,7 +1414,7 @@ _PUBLIC_ NTSTATUS dcerpc_ndr_request_recv(struct rpc_request *req)
        NTSTATUS status;
        DATA_BLOB response;
        struct ndr_pull *pull;
-       uint_t flags;
+       unsigned int flags;
        TALLOC_CTX *mem_ctx = req->ndr.mem_ctx;
        void *r = req->ndr.struct_ptr;
        uint32_t opnum = req->ndr.opnum;
@@ -1609,15 +1582,14 @@ static void dcerpc_alter_recv_handler(struct rpc_request *req,
        /* the alter_resp might contain a reply set of credentials */
        if (recv_pipe->conn->security_state.auth_info &&
            pkt->u.alter_resp.auth_info.length) {
-               enum ndr_err_code ndr_err;
-               ndr_err = ndr_pull_struct_blob(
-                       &pkt->u.alter_resp.auth_info, recv_pipe,
-                       NULL,
-                       recv_pipe->conn->security_state.auth_info,
-                       (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
-               if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
-                       c->status = ndr_map_error2ntstatus(ndr_err);
-                       if (!composite_is_ok(c)) return;
+               struct dcerpc_connection *conn = recv_pipe->conn;
+               NTSTATUS status;
+               uint32_t auth_length;
+               status = dcerpc_pull_auth_trailer(pkt, conn, &pkt->u.alter_resp.auth_info,
+                                                 conn->security_state.auth_info, &auth_length, true);
+               if (!NT_STATUS_IS_OK(status)) {
+                       composite_error(c, status);
+                       return;
                }
        }