source: trunk/server/librpc/rpc/dcerpc_util.c@ 920

Last change on this file since 920 was 920, checked in by Silvan Scherrer, 10 years ago

Samba Server: apply latest security patches to trunk
File size: 15.9 KB
Line 
1/*
2 Unix SMB/CIFS implementation.
3 raw dcerpc operations
4
5 Copyright (C) Andrew Tridgell 2003-2005
6 Copyright (C) Jelmer Vernooij 2004-2005
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 3 of the License, or
11 (at your option) any later version.
12
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
17
18 You should have received a copy of the GNU General Public License
19 along with this program. If not, see <http://www.gnu.org/licenses/>.
20*/
21
22#include "includes.h"
23#include "system/network.h"
24#include <tevent.h>
25#include "lib/tsocket/tsocket.h"
26#include "lib/util/tevent_ntstatus.h"
27#include "librpc/rpc/dcerpc.h"
28#include "librpc/gen_ndr/ndr_dcerpc.h"
29#include "rpc_common.h"
30#include "lib/util/bitmap.h"
31
32/* we need to be able to get/set the fragment length without doing a full
33 decode */
34void dcerpc_set_frag_length(DATA_BLOB *blob, uint16_t v)
35{
36 if (CVAL(blob->data,DCERPC_DREP_OFFSET) & DCERPC_DREP_LE) {
37 SSVAL(blob->data, DCERPC_FRAG_LEN_OFFSET, v);
38 } else {
39 RSSVAL(blob->data, DCERPC_FRAG_LEN_OFFSET, v);
40 }
41}
42
43uint16_t dcerpc_get_frag_length(const DATA_BLOB *blob)
44{
45 if (CVAL(blob->data,DCERPC_DREP_OFFSET) & DCERPC_DREP_LE) {
46 return SVAL(blob->data, DCERPC_FRAG_LEN_OFFSET);
47 } else {
48 return RSVAL(blob->data, DCERPC_FRAG_LEN_OFFSET);
49 }
50}
51
52uint32_t dcerpc_get_call_id(const DATA_BLOB *blob)
53{
54 if (CVAL(blob->data,DCERPC_DREP_OFFSET) & DCERPC_DREP_LE) {
55 return IVAL(blob->data, DCERPC_CALL_ID_OFFSET);
56 } else {
57 return RIVAL(blob->data, DCERPC_CALL_ID_OFFSET);
58 }
59}
60
61void dcerpc_set_auth_length(DATA_BLOB *blob, uint16_t v)
62{
63 if (CVAL(blob->data,DCERPC_DREP_OFFSET) & DCERPC_DREP_LE) {
64 SSVAL(blob->data, DCERPC_AUTH_LEN_OFFSET, v);
65 } else {
66 RSSVAL(blob->data, DCERPC_AUTH_LEN_OFFSET, v);
67 }
68}
69
70uint8_t dcerpc_get_endian_flag(DATA_BLOB *blob)
71{
72 return blob->data[DCERPC_DREP_OFFSET];
73}
74
75
76/**
77* @brief Pull a dcerpc_auth structure, taking account of any auth
78* padding in the blob. For request/response packets we pass
79* the whole data blob, so auth_data_only must be set to false
80* as the blob contains data+pad+auth and no just pad+auth.
81*
82* @param pkt - The ncacn_packet strcuture
83* @param mem_ctx - The mem_ctx used to allocate dcerpc_auth elements
84* @param pkt_trailer - The packet trailer data, usually the trailing
85* auth_info blob, but in the request/response case
86* this is the stub_and_verifier blob.
87* @param auth - A preallocated dcerpc_auth *empty* structure
88* @param auth_length - The length of the auth trail, sum of auth header
89* lenght and pkt->auth_length
90* @param auth_data_only - Whether the pkt_trailer includes only the auth_blob
91* (+ padding) or also other data.
92*
93* @return - A NTSTATUS error code.
94*/
95NTSTATUS dcerpc_pull_auth_trailer(const struct ncacn_packet *pkt,
96 TALLOC_CTX *mem_ctx,
97 const DATA_BLOB *pkt_trailer,
98 struct dcerpc_auth *auth,
99 uint32_t *_auth_length,
100 bool auth_data_only)
101{
102 struct ndr_pull *ndr;
103 enum ndr_err_code ndr_err;
104 uint16_t data_and_pad;
105 uint16_t auth_length;
106 uint32_t tmp_length;
107
108 ZERO_STRUCTP(auth);
109 if (_auth_length != NULL) {
110 *_auth_length = 0;
111 }
112
113 /* Paranoia checks for auth_length. The caller should check this... */
114 if (pkt->auth_length == 0) {
115 return NT_STATUS_INTERNAL_ERROR;
116 }
117
118 /* Paranoia checks for auth_length. The caller should check this... */
119 if (pkt->auth_length > pkt->frag_length) {
120 return NT_STATUS_INTERNAL_ERROR;
121 }
122 tmp_length = DCERPC_NCACN_PAYLOAD_OFFSET;
123 tmp_length += DCERPC_AUTH_TRAILER_LENGTH;
124 tmp_length += pkt->auth_length;
125 if (tmp_length > pkt->frag_length) {
126 return NT_STATUS_INTERNAL_ERROR;
127 }
128 if (pkt_trailer->length > UINT16_MAX) {
129 return NT_STATUS_INTERNAL_ERROR;
130 }
131
132 auth_length = DCERPC_AUTH_TRAILER_LENGTH + pkt->auth_length;
133 if (pkt_trailer->length < auth_length) {
134 return NT_STATUS_RPC_PROTOCOL_ERROR;
135 }
136
137 data_and_pad = pkt_trailer->length - auth_length;
138
139 ndr = ndr_pull_init_blob(pkt_trailer, mem_ctx);
140 if (!ndr) {
141 return NT_STATUS_NO_MEMORY;
142 }
143
144 if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
145 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
146 }
147
148 ndr_err = ndr_pull_advance(ndr, data_and_pad);
149 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
150 talloc_free(ndr);
151 return ndr_map_error2ntstatus(ndr_err);
152 }
153
154 ndr_err = ndr_pull_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, auth);
155 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
156 talloc_free(ndr);
157 ZERO_STRUCTP(auth);
158 return ndr_map_error2ntstatus(ndr_err);
159 }
160
161 if (data_and_pad < auth->auth_pad_length) {
162 DEBUG(1, (__location__ ": ERROR: pad length mismatch. "
163 "Calculated %u got %u\n",
164 (unsigned)data_and_pad,
165 (unsigned)auth->auth_pad_length));
166 talloc_free(ndr);
167 ZERO_STRUCTP(auth);
168 return NT_STATUS_RPC_PROTOCOL_ERROR;
169 }
170
171 if (auth_data_only && data_and_pad != auth->auth_pad_length) {
172 DEBUG(1, (__location__ ": ERROR: pad length mismatch. "
173 "Calculated %u got %u\n",
174 (unsigned)data_and_pad,
175 (unsigned)auth->auth_pad_length));
176 talloc_free(ndr);
177 ZERO_STRUCTP(auth);
178 return NT_STATUS_RPC_PROTOCOL_ERROR;
179 }
180
181 DEBUG(6,(__location__ ": auth_pad_length %u\n",
182 (unsigned)auth->auth_pad_length));
183
184 talloc_steal(mem_ctx, auth->credentials.data);
185 talloc_free(ndr);
186
187 if (_auth_length != NULL) {
188 *_auth_length = auth_length;
189 }
190
191 return NT_STATUS_OK;
192}
193
194/**
195* @brief Verify the fields in ncacn_packet header.
196*
197* @param pkt - The ncacn_packet strcuture
198* @param ptype - The expected PDU type
199* @param max_auth_info - The maximum size of a possible auth trailer
200* @param required_flags - The required flags for the pdu.
201* @param optional_flags - The possible optional flags for the pdu.
202*
203* @return - A NTSTATUS error code.
204*/
205NTSTATUS dcerpc_verify_ncacn_packet_header(const struct ncacn_packet *pkt,
206 enum dcerpc_pkt_type ptype,
207 size_t max_auth_info,
208 uint8_t required_flags,
209 uint8_t optional_flags)
210{
211 if (pkt->rpc_vers != 5) {
212 return NT_STATUS_RPC_PROTOCOL_ERROR;
213 }
214
215 if (pkt->rpc_vers_minor != 0) {
216 return NT_STATUS_RPC_PROTOCOL_ERROR;
217 }
218
219 if (pkt->auth_length > pkt->frag_length) {
220 return NT_STATUS_RPC_PROTOCOL_ERROR;
221 }
222
223 if (pkt->ptype != ptype) {
224 return NT_STATUS_RPC_PROTOCOL_ERROR;
225 }
226
227 if (max_auth_info > UINT16_MAX) {
228 return NT_STATUS_INTERNAL_ERROR;
229 }
230
231 if (pkt->auth_length > 0) {
232 size_t max_auth_length;
233
234 if (max_auth_info <= DCERPC_AUTH_TRAILER_LENGTH) {
235 return NT_STATUS_RPC_PROTOCOL_ERROR;
236 }
237 max_auth_length = max_auth_info - DCERPC_AUTH_TRAILER_LENGTH;
238
239 if (pkt->auth_length > max_auth_length) {
240 return NT_STATUS_RPC_PROTOCOL_ERROR;
241 }
242 }
243
244 if ((pkt->pfc_flags & required_flags) != required_flags) {
245 return NT_STATUS_RPC_PROTOCOL_ERROR;
246 }
247 if (pkt->pfc_flags & ~(optional_flags|required_flags)) {
248 return NT_STATUS_RPC_PROTOCOL_ERROR;
249 }
250
251 if (pkt->drep[0] & ~DCERPC_DREP_LE) {
252 return NT_STATUS_RPC_PROTOCOL_ERROR;
253 }
254 if (pkt->drep[1] != 0) {
255 return NT_STATUS_RPC_PROTOCOL_ERROR;
256 }
257 if (pkt->drep[2] != 0) {
258 return NT_STATUS_RPC_PROTOCOL_ERROR;
259 }
260 if (pkt->drep[3] != 0) {
261 return NT_STATUS_RPC_PROTOCOL_ERROR;
262 }
263
264 return NT_STATUS_OK;
265}
266
267struct dcerpc_read_ncacn_packet_state {
268#if 0
269 struct {
270 } caller;
271#endif
272 DATA_BLOB buffer;
273 struct ncacn_packet *pkt;
274};
275
276static int dcerpc_read_ncacn_packet_next_vector(struct tstream_context *stream,
277 void *private_data,
278 TALLOC_CTX *mem_ctx,
279 struct iovec **_vector,
280 size_t *_count);
281static void dcerpc_read_ncacn_packet_done(struct tevent_req *subreq);
282
283struct tevent_req *dcerpc_read_ncacn_packet_send(TALLOC_CTX *mem_ctx,
284 struct tevent_context *ev,
285 struct tstream_context *stream)
286{
287 struct tevent_req *req;
288 struct dcerpc_read_ncacn_packet_state *state;
289 struct tevent_req *subreq;
290
291 req = tevent_req_create(mem_ctx, &state,
292 struct dcerpc_read_ncacn_packet_state);
293 if (req == NULL) {
294 return NULL;
295 }
296
297 state->buffer = data_blob_const(NULL, 0);
298 state->pkt = talloc(state, struct ncacn_packet);
299 if (tevent_req_nomem(state->pkt, req)) {
300 goto post;
301 }
302
303 subreq = tstream_readv_pdu_send(state, ev,
304 stream,
305 dcerpc_read_ncacn_packet_next_vector,
306 state);
307 if (tevent_req_nomem(subreq, req)) {
308 goto post;
309 }
310 tevent_req_set_callback(subreq, dcerpc_read_ncacn_packet_done, req);
311
312 return req;
313 post:
314 tevent_req_post(req, ev);
315 return req;
316}
317
318static int dcerpc_read_ncacn_packet_next_vector(struct tstream_context *stream,
319 void *private_data,
320 TALLOC_CTX *mem_ctx,
321 struct iovec **_vector,
322 size_t *_count)
323{
324 struct dcerpc_read_ncacn_packet_state *state =
325 talloc_get_type_abort(private_data,
326 struct dcerpc_read_ncacn_packet_state);
327 struct iovec *vector;
328 off_t ofs = 0;
329
330 if (state->buffer.length == 0) {
331 /* first get enough to read the fragment length */
332 ofs = 0;
333 state->buffer.length = DCERPC_FRAG_LEN_OFFSET + 2;
334 state->buffer.data = talloc_array(state, uint8_t,
335 state->buffer.length);
336 if (!state->buffer.data) {
337 return -1;
338 }
339 } else if (state->buffer.length == (DCERPC_FRAG_LEN_OFFSET + 2)) {
340 /* now read the fragment length and allocate the full buffer */
341 size_t frag_len = dcerpc_get_frag_length(&state->buffer);
342
343 ofs = state->buffer.length;
344
345 if (frag_len < ofs) {
346 /*
347 * something is wrong, let the caller deal with it
348 */
349 *_vector = NULL;
350 *_count = 0;
351 return 0;
352 }
353
354 state->buffer.data = talloc_realloc(state,
355 state->buffer.data,
356 uint8_t, frag_len);
357 if (!state->buffer.data) {
358 return -1;
359 }
360 state->buffer.length = frag_len;
361 } else {
362 /* if we reach this we have a full fragment */
363 *_vector = NULL;
364 *_count = 0;
365 return 0;
366 }
367
368 /* now create the vector that we want to be filled */
369 vector = talloc_array(mem_ctx, struct iovec, 1);
370 if (!vector) {
371 return -1;
372 }
373
374 vector[0].iov_base = (void *) (state->buffer.data + ofs);
375 vector[0].iov_len = state->buffer.length - ofs;
376
377 *_vector = vector;
378 *_count = 1;
379 return 0;
380}
381
382static void dcerpc_read_ncacn_packet_done(struct tevent_req *subreq)
383{
384 struct tevent_req *req = tevent_req_callback_data(subreq,
385 struct tevent_req);
386 struct dcerpc_read_ncacn_packet_state *state = tevent_req_data(req,
387 struct dcerpc_read_ncacn_packet_state);
388 int ret;
389 int sys_errno;
390 struct ndr_pull *ndr;
391 enum ndr_err_code ndr_err;
392 NTSTATUS status;
393
394 ret = tstream_readv_pdu_recv(subreq, &sys_errno);
395 TALLOC_FREE(subreq);
396 if (ret == -1) {
397 status = map_nt_error_from_unix(sys_errno);
398 tevent_req_nterror(req, status);
399 return;
400 }
401
402 ndr = ndr_pull_init_blob(&state->buffer, state->pkt);
403 if (tevent_req_nomem(ndr, req)) {
404 return;
405 }
406
407 if (!(CVAL(ndr->data, DCERPC_DREP_OFFSET) & DCERPC_DREP_LE)) {
408 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
409 }
410
411 if (CVAL(ndr->data, DCERPC_PFC_OFFSET) & DCERPC_PFC_FLAG_OBJECT_UUID) {
412 ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
413 }
414
415 ndr_err = ndr_pull_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, state->pkt);
416 TALLOC_FREE(ndr);
417 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
418 status = ndr_map_error2ntstatus(ndr_err);
419 tevent_req_nterror(req, status);
420 return;
421 }
422
423 if (state->pkt->frag_length != state->buffer.length) {
424 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
425 return;
426 }
427
428 tevent_req_done(req);
429}
430
431NTSTATUS dcerpc_read_ncacn_packet_recv(struct tevent_req *req,
432 TALLOC_CTX *mem_ctx,
433 struct ncacn_packet **pkt,
434 DATA_BLOB *buffer)
435{
436 struct dcerpc_read_ncacn_packet_state *state = tevent_req_data(req,
437 struct dcerpc_read_ncacn_packet_state);
438 NTSTATUS status;
439
440 if (tevent_req_is_nterror(req, &status)) {
441 tevent_req_received(req);
442 return status;
443 }
444
445 *pkt = talloc_move(mem_ctx, &state->pkt);
446 if (buffer) {
447 buffer->data = talloc_move(mem_ctx, &state->buffer.data);
448 buffer->length = state->buffer.length;
449 }
450
451 tevent_req_received(req);
452 return NT_STATUS_OK;
453}
454
455struct dcerpc_sec_vt_header2 dcerpc_sec_vt_header2_from_ncacn_packet(const struct ncacn_packet *pkt)
456{
457 struct dcerpc_sec_vt_header2 ret;
458
459 ZERO_STRUCT(ret);
460 ret.ptype = pkt->ptype;
461 memcpy(&ret.drep, pkt->drep, sizeof(ret.drep));
462 ret.call_id = pkt->call_id;
463
464 switch (pkt->ptype) {
465 case DCERPC_PKT_REQUEST:
466 ret.context_id = pkt->u.request.context_id;
467 ret.opnum = pkt->u.request.opnum;
468 break;
469
470 case DCERPC_PKT_RESPONSE:
471 ret.context_id = pkt->u.response.context_id;
472 break;
473
474 case DCERPC_PKT_FAULT:
475 ret.context_id = pkt->u.fault.context_id;
476 break;
477
478 default:
479 break;
480 }
481
482 return ret;
483}
484
485bool dcerpc_sec_vt_header2_equal(const struct dcerpc_sec_vt_header2 *v1,
486 const struct dcerpc_sec_vt_header2 *v2)
487{
488 if (v1->ptype != v2->ptype) {
489 return false;
490 }
491
492 if (memcmp(v1->drep, v2->drep, sizeof(v1->drep)) != 0) {
493 return false;
494 }
495
496 if (v1->call_id != v2->call_id) {
497 return false;
498 }
499
500 if (v1->context_id != v2->context_id) {
501 return false;
502 }
503
504 if (v1->opnum != v2->opnum) {
505 return false;
506 }
507
508 return true;
509}
510
511static bool dcerpc_sec_vt_is_valid(const struct dcerpc_sec_verification_trailer *r)
512{
513 bool ret = false;
514 TALLOC_CTX *frame = talloc_stackframe();
515 struct bitmap *commands_seen;
516 int i;
517
518 if (r->count.count == 0) {
519 ret = true;
520 goto done;
521 }
522
523 if (memcmp(r->magic, DCERPC_SEC_VT_MAGIC, sizeof(r->magic)) != 0) {
524 goto done;
525 }
526
527 commands_seen = bitmap_talloc(frame, DCERPC_SEC_VT_COMMAND_ENUM + 1);
528 if (commands_seen == NULL) {
529 goto done;
530 }
531
532 for (i=0; i < r->count.count; i++) {
533 enum dcerpc_sec_vt_command_enum cmd =
534 r->commands[i].command & DCERPC_SEC_VT_COMMAND_ENUM;
535
536 if (bitmap_query(commands_seen, cmd)) {
537 /* Each command must appear at most once. */
538 goto done;
539 }
540 bitmap_set(commands_seen, cmd);
541
542 switch (cmd) {
543 case DCERPC_SEC_VT_COMMAND_BITMASK1:
544 case DCERPC_SEC_VT_COMMAND_PCONTEXT:
545 case DCERPC_SEC_VT_COMMAND_HEADER2:
546 break;
547 default:
548 if ((r->commands[i].u._unknown.length % 4) != 0) {
549 goto done;
550 }
551 break;
552 }
553 }
554 ret = true;
555done:
556 TALLOC_FREE(frame);
557 return ret;
558}
559
560#define CHECK(msg, ok) \
561do { \
562 if (!ok) { \
563 DEBUG(10, ("SEC_VT check %s failed\n", msg)); \
564 return false; \
565 } \
566} while(0)
567
568#define CHECK_SYNTAX(msg, s1, s2) \
569do { \
570 if (!ndr_syntax_id_equal(&s1, &s2)) { \
571 TALLOC_CTX *frame = talloc_stackframe(); \
572 DEBUG(10, ("SEC_VT check %s failed: %s vs. %s\n", msg, \
573 ndr_syntax_id_to_string(frame, &s1), \
574 ndr_syntax_id_to_string(frame, &s1))); \
575 TALLOC_FREE(frame); \
576 return false; \
577 } \
578} while(0)
579
580
581bool dcerpc_sec_verification_trailer_check(
582 const struct dcerpc_sec_verification_trailer *vt,
583 const uint32_t *bitmask1,
584 const struct dcerpc_sec_vt_pcontext *pcontext,
585 const struct dcerpc_sec_vt_header2 *header2)
586{
587 size_t i;
588
589 if (!dcerpc_sec_vt_is_valid(vt)) {
590 return false;
591 }
592
593 for (i=0; i < vt->count.count; i++) {
594 struct dcerpc_sec_vt *c = &vt->commands[i];
595
596 switch (c->command & DCERPC_SEC_VT_COMMAND_ENUM) {
597 case DCERPC_SEC_VT_COMMAND_BITMASK1:
598 if (bitmask1 == NULL) {
599 CHECK("Bitmask1 must_process_command",
600 !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
601 break;
602 }
603
604 if (c->u.bitmask1 & DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING) {
605 CHECK("Bitmask1 client_header_signing",
606 *bitmask1 & DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING);
607 }
608 break;
609
610 case DCERPC_SEC_VT_COMMAND_PCONTEXT:
611 if (pcontext == NULL) {
612 CHECK("Pcontext must_process_command",
613 !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
614 break;
615 }
616
617 CHECK_SYNTAX("Pcontect abstract_syntax",
618 pcontext->abstract_syntax,
619 c->u.pcontext.abstract_syntax);
620 CHECK_SYNTAX("Pcontext transfer_syntax",
621 pcontext->transfer_syntax,
622 c->u.pcontext.transfer_syntax);
623 break;
624
625 case DCERPC_SEC_VT_COMMAND_HEADER2: {
626 if (header2 == NULL) {
627 CHECK("Header2 must_process_command",
628 !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
629 break;
630 }
631
632 CHECK("Header2", dcerpc_sec_vt_header2_equal(header2, &c->u.header2));
633 break;
634 }
635
636 default:
637 CHECK("Unknown must_process_command",
638 !(c->command & DCERPC_SEC_VT_MUST_PROCESS));
639 break;
640 }
641 }
642
643 return true;
644}
Note: See TracBrowser for help on using the repository browser.