| 1 |
From a57290580b7fcffea9b76991f2dd49ad480d3b64 Mon Sep 17 00:00:00 2001 |
| 2 |
From: Stefan Metzmacher <metze@samba.org> |
| 3 |
Date: Wed, 15 Mar 2017 17:04:30 +0000 |
| 4 |
Subject: [PATCH 1/2] libcli/smb: Fix alignment problems of |
| 5 |
smb_bytes_pull_str() |
| 6 |
|
| 7 |
This function needs to get the whole smb buffer in order to get |
| 8 |
the alignment for unicode correct. |
| 9 |
|
| 10 |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12824 |
| 11 |
|
| 12 |
Signed-off-by: Stefan Metzmacher <metze@samba.org> |
| 13 |
Reviewed-by: Jeremy Allison <jra@samba.org> |
| 14 |
Reviewed-by: Andreas Schneider <asn@samba.org> |
| 15 |
(cherry picked from commit e60e77a8afd095bfdb3d678aa48570ca159d9b24) |
| 16 |
--- |
| 17 |
libcli/smb/smb1cli_session.c | 28 +++++++++++++------------- |
| 18 |
libcli/smb/smb_util.h | 3 ++- |
| 19 |
libcli/smb/util.c | 47 +++++++++++++++++++++++++++++--------------- |
| 20 |
3 files changed, 47 insertions(+), 31 deletions(-) |
| 21 |
|
| 22 |
diff --git a/libcli/smb/smb1cli_session.c b/libcli/smb/smb1cli_session.c |
| 23 |
index 9d92aa6aed4..11614df0ae4 100644 |
| 24 |
--- a/libcli/smb/smb1cli_session.c |
| 25 |
+++ b/libcli/smb/smb1cli_session.c |
| 26 |
@@ -210,16 +210,16 @@ static void smb1cli_session_setup_lm21_done(struct tevent_req *subreq) |
| 27 |
p = bytes; |
| 28 |
|
| 29 |
status = smb_bytes_pull_str(state, &state->out_native_os, |
| 30 |
- use_unicode, p, |
| 31 |
- bytes+num_bytes-p, &ret); |
| 32 |
+ use_unicode, bytes, num_bytes, |
| 33 |
+ p, &ret); |
| 34 |
if (tevent_req_nterror(req, status)) { |
| 35 |
return; |
| 36 |
} |
| 37 |
p += ret; |
| 38 |
|
| 39 |
status = smb_bytes_pull_str(state, &state->out_native_lm, |
| 40 |
- use_unicode, p, |
| 41 |
- bytes+num_bytes-p, &ret); |
| 42 |
+ use_unicode, bytes, num_bytes, |
| 43 |
+ p, &ret); |
| 44 |
if (tevent_req_nterror(req, status)) { |
| 45 |
return; |
| 46 |
} |
| 47 |
@@ -493,24 +493,24 @@ static void smb1cli_session_setup_nt1_done(struct tevent_req *subreq) |
| 48 |
p = bytes; |
| 49 |
|
| 50 |
status = smb_bytes_pull_str(state, &state->out_native_os, |
| 51 |
- use_unicode, p, |
| 52 |
- bytes+num_bytes-p, &ret); |
| 53 |
+ use_unicode, bytes, num_bytes, |
| 54 |
+ p, &ret); |
| 55 |
if (tevent_req_nterror(req, status)) { |
| 56 |
return; |
| 57 |
} |
| 58 |
p += ret; |
| 59 |
|
| 60 |
status = smb_bytes_pull_str(state, &state->out_native_lm, |
| 61 |
- use_unicode, p, |
| 62 |
- bytes+num_bytes-p, &ret); |
| 63 |
+ use_unicode, bytes, num_bytes, |
| 64 |
+ p, &ret); |
| 65 |
if (tevent_req_nterror(req, status)) { |
| 66 |
return; |
| 67 |
} |
| 68 |
p += ret; |
| 69 |
|
| 70 |
status = smb_bytes_pull_str(state, &state->out_primary_domain, |
| 71 |
- use_unicode, p, |
| 72 |
- bytes+num_bytes-p, &ret); |
| 73 |
+ use_unicode, bytes, num_bytes, |
| 74 |
+ p, &ret); |
| 75 |
if (tevent_req_nterror(req, status)) { |
| 76 |
return; |
| 77 |
} |
| 78 |
@@ -754,16 +754,16 @@ static void smb1cli_session_setup_ext_done(struct tevent_req *subreq) |
| 79 |
p += out_security_blob_length; |
| 80 |
|
| 81 |
status = smb_bytes_pull_str(state, &state->out_native_os, |
| 82 |
- use_unicode, p, |
| 83 |
- bytes+num_bytes-p, &ret); |
| 84 |
+ use_unicode, bytes, num_bytes, |
| 85 |
+ p, &ret); |
| 86 |
if (tevent_req_nterror(req, status)) { |
| 87 |
return; |
| 88 |
} |
| 89 |
p += ret; |
| 90 |
|
| 91 |
status = smb_bytes_pull_str(state, &state->out_native_lm, |
| 92 |
- use_unicode, p, |
| 93 |
- bytes+num_bytes-p, &ret); |
| 94 |
+ use_unicode, bytes, num_bytes, |
| 95 |
+ p, &ret); |
| 96 |
if (tevent_req_nterror(req, status)) { |
| 97 |
return; |
| 98 |
} |
| 99 |
diff --git a/libcli/smb/smb_util.h b/libcli/smb/smb_util.h |
| 100 |
index 7e6f0a4ebc4..2884786339d 100644 |
| 101 |
--- a/libcli/smb/smb_util.h |
| 102 |
+++ b/libcli/smb/smb_util.h |
| 103 |
@@ -38,4 +38,5 @@ uint8_t *trans2_bytes_push_bytes(uint8_t *buf, |
| 104 |
const uint8_t *bytes, size_t num_bytes); |
| 105 |
NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2, |
| 106 |
const uint8_t *buf, size_t buf_len, |
| 107 |
- size_t *pbuf_consumed); |
| 108 |
+ const uint8_t *position, |
| 109 |
+ size_t *_consumed); |
| 110 |
diff --git a/libcli/smb/util.c b/libcli/smb/util.c |
| 111 |
index ef8c9fafa35..7ef909c6077 100644 |
| 112 |
--- a/libcli/smb/util.c |
| 113 |
+++ b/libcli/smb/util.c |
| 114 |
@@ -319,29 +319,43 @@ uint8_t *trans2_bytes_push_bytes(uint8_t *buf, |
| 115 |
static NTSTATUS internal_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, |
| 116 |
bool ucs2, bool align_odd, |
| 117 |
const uint8_t *buf, size_t buf_len, |
| 118 |
- size_t *pbuf_consumed) |
| 119 |
+ const uint8_t *position, |
| 120 |
+ size_t *p_consumed) |
| 121 |
{ |
| 122 |
size_t pad = 0; |
| 123 |
+ size_t offset; |
| 124 |
char *str = NULL; |
| 125 |
size_t str_len = 0; |
| 126 |
bool ok; |
| 127 |
|
| 128 |
*_str = NULL; |
| 129 |
- if (pbuf_consumed != NULL) { |
| 130 |
- *pbuf_consumed = 0; |
| 131 |
+ if (p_consumed != NULL) { |
| 132 |
+ *p_consumed = 0; |
| 133 |
+ } |
| 134 |
+ |
| 135 |
+ if (position < buf) { |
| 136 |
+ return NT_STATUS_INTERNAL_ERROR; |
| 137 |
+ } |
| 138 |
+ |
| 139 |
+ offset = PTR_DIFF(position, buf); |
| 140 |
+ if (offset > buf_len) { |
| 141 |
+ return NT_STATUS_BUFFER_TOO_SMALL; |
| 142 |
} |
| 143 |
|
| 144 |
if (ucs2 && |
| 145 |
- ((align_odd && (buf_len % 2 == 0)) || |
| 146 |
- (!align_odd && (buf_len % 2 == 1)))) { |
| 147 |
- if (buf_len < 1) { |
| 148 |
- return NT_STATUS_BUFFER_TOO_SMALL; |
| 149 |
- } |
| 150 |
- pad = 1; |
| 151 |
- buf_len -= pad; |
| 152 |
- buf += pad; |
| 153 |
+ ((align_odd && (offset % 2 == 0)) || |
| 154 |
+ (!align_odd && (offset % 2 == 1)))) { |
| 155 |
+ pad += 1; |
| 156 |
+ offset += 1; |
| 157 |
+ } |
| 158 |
+ |
| 159 |
+ if (offset > buf_len) { |
| 160 |
+ return NT_STATUS_BUFFER_TOO_SMALL; |
| 161 |
} |
| 162 |
|
| 163 |
+ buf_len -= offset; |
| 164 |
+ buf += offset; |
| 165 |
+ |
| 166 |
if (ucs2) { |
| 167 |
buf_len = utf16_len_n(buf, buf_len); |
| 168 |
} else { |
| 169 |
@@ -361,17 +375,18 @@ static NTSTATUS internal_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, |
| 170 |
return map_nt_error_from_unix_common(errno); |
| 171 |
} |
| 172 |
|
| 173 |
- if (pbuf_consumed != NULL) { |
| 174 |
- *pbuf_consumed = buf_len + pad; |
| 175 |
+ if (p_consumed != NULL) { |
| 176 |
+ *p_consumed = buf_len + pad; |
| 177 |
} |
| 178 |
*_str = str; |
| 179 |
- return NT_STATUS_OK;; |
| 180 |
+ return NT_STATUS_OK; |
| 181 |
} |
| 182 |
|
| 183 |
NTSTATUS smb_bytes_pull_str(TALLOC_CTX *mem_ctx, char **_str, bool ucs2, |
| 184 |
const uint8_t *buf, size_t buf_len, |
| 185 |
- size_t *_buf_consumed) |
| 186 |
+ const uint8_t *position, |
| 187 |
+ size_t *_consumed) |
| 188 |
{ |
| 189 |
return internal_bytes_pull_str(mem_ctx, _str, ucs2, true, |
| 190 |
- buf, buf_len, _buf_consumed); |
| 191 |
+ buf, buf_len, position, _consumed); |
| 192 |
} |
| 193 |
-- |
| 194 |
2.13.1 |
| 195 |
|
| 196 |
|
| 197 |
From 460941fe916d787057437412eef64c0ffdd1f65d Mon Sep 17 00:00:00 2001 |
| 198 |
From: Stefan Metzmacher <metze@samba.org> |
| 199 |
Date: Wed, 15 Mar 2017 17:04:44 +0000 |
| 200 |
Subject: [PATCH 2/2] s3:libsmb: add cli_state_update_after_sesssetup() helper |
| 201 |
function |
| 202 |
|
| 203 |
This function updates cli->server_{os,type,domain} to valid values |
| 204 |
after a session setup. |
| 205 |
|
| 206 |
BUG: https://bugzilla.samba.org/show_bug.cgi?id=12779 |
| 207 |
|
| 208 |
Signed-off-by: Stefan Metzmacher <metze@samba.org> |
| 209 |
Reviewed-by: Andreas Schneider <asn@samba.org> |
| 210 |
(cherry picked from commit e0069bd2a4820eca17c59d91bd1853f2f053a7a3) |
| 211 |
--- |
| 212 |
source3/libsmb/cliconnect.c | 74 +++++++++++++++++++++++++++++++-------------- |
| 213 |
1 file changed, 52 insertions(+), 22 deletions(-) |
| 214 |
|
| 215 |
diff --git a/source3/libsmb/cliconnect.c b/source3/libsmb/cliconnect.c |
| 216 |
index a2362ceb863..ef03da17eec 100644 |
| 217 |
--- a/source3/libsmb/cliconnect.c |
| 218 |
+++ b/source3/libsmb/cliconnect.c |
| 219 |
@@ -372,6 +372,38 @@ NTSTATUS cli_session_creds_prepare_krb5(struct cli_state *cli, |
| 220 |
return NT_STATUS_OK; |
| 221 |
} |
| 222 |
|
| 223 |
+static NTSTATUS cli_state_update_after_sesssetup(struct cli_state *cli, |
| 224 |
+ const char *native_os, |
| 225 |
+ const char *native_lm, |
| 226 |
+ const char *primary_domain) |
| 227 |
+{ |
| 228 |
+#define _VALID_STR(p) ((p) != NULL && (p)[0] != '\0') |
| 229 |
+ |
| 230 |
+ if (!_VALID_STR(cli->server_os) && _VALID_STR(native_os)) { |
| 231 |
+ cli->server_os = talloc_strdup(cli, native_os); |
| 232 |
+ if (cli->server_os == NULL) { |
| 233 |
+ return NT_STATUS_NO_MEMORY; |
| 234 |
+ } |
| 235 |
+ } |
| 236 |
+ |
| 237 |
+ if (!_VALID_STR(cli->server_type) && _VALID_STR(native_lm)) { |
| 238 |
+ cli->server_type = talloc_strdup(cli, native_lm); |
| 239 |
+ if (cli->server_type == NULL) { |
| 240 |
+ return NT_STATUS_NO_MEMORY; |
| 241 |
+ } |
| 242 |
+ } |
| 243 |
+ |
| 244 |
+ if (!_VALID_STR(cli->server_domain) && _VALID_STR(primary_domain)) { |
| 245 |
+ cli->server_domain = talloc_strdup(cli, primary_domain); |
| 246 |
+ if (cli->server_domain == NULL) { |
| 247 |
+ return NT_STATUS_NO_MEMORY; |
| 248 |
+ } |
| 249 |
+ } |
| 250 |
+ |
| 251 |
+#undef _VALID_STRING |
| 252 |
+ return NT_STATUS_OK; |
| 253 |
+} |
| 254 |
+ |
| 255 |
/******************************************************** |
| 256 |
Utility function to ensure we always return at least |
| 257 |
a valid char * pointer to an empty string for the |
| 258 |
@@ -762,7 +794,6 @@ static void cli_sesssetup_blob_done(struct tevent_req *subreq) |
| 259 |
subreq, struct tevent_req); |
| 260 |
struct cli_sesssetup_blob_state *state = tevent_req_data( |
| 261 |
req, struct cli_sesssetup_blob_state); |
| 262 |
- struct cli_state *cli = state->cli; |
| 263 |
NTSTATUS status; |
| 264 |
|
| 265 |
if (smbXcli_conn_protocol(state->cli->conn) >= PROTOCOL_SMB2_02) { |
| 266 |
@@ -784,15 +815,16 @@ static void cli_sesssetup_blob_done(struct tevent_req *subreq) |
| 267 |
return; |
| 268 |
} |
| 269 |
|
| 270 |
- if (cli->server_os == NULL) { |
| 271 |
- cli->server_os = talloc_move(cli, &state->out_native_os); |
| 272 |
- } |
| 273 |
- if (cli->server_type == NULL) { |
| 274 |
- cli->server_type = talloc_move(cli, &state->out_native_lm); |
| 275 |
- } |
| 276 |
- |
| 277 |
state->status = status; |
| 278 |
|
| 279 |
+ status = cli_state_update_after_sesssetup(state->cli, |
| 280 |
+ state->out_native_os, |
| 281 |
+ state->out_native_lm, |
| 282 |
+ NULL); |
| 283 |
+ if (tevent_req_nterror(req, status)) { |
| 284 |
+ return; |
| 285 |
+ } |
| 286 |
+ |
| 287 |
if (state->blob.length != 0) { |
| 288 |
/* |
| 289 |
* More to send |
| 290 |
@@ -1667,14 +1699,12 @@ static void cli_session_setup_creds_done_nt1(struct tevent_req *subreq) |
| 291 |
return; |
| 292 |
} |
| 293 |
|
| 294 |
- if (cli->server_os == NULL) { |
| 295 |
- cli->server_os = talloc_move(cli, &state->out_native_os); |
| 296 |
- } |
| 297 |
- if (cli->server_type == NULL) { |
| 298 |
- cli->server_type = talloc_move(cli, &state->out_native_lm); |
| 299 |
- } |
| 300 |
- if (cli->server_domain == NULL) { |
| 301 |
- cli->server_domain = talloc_move(cli, &state->out_primary_domain); |
| 302 |
+ status = cli_state_update_after_sesssetup(state->cli, |
| 303 |
+ state->out_native_os, |
| 304 |
+ state->out_native_lm, |
| 305 |
+ state->out_primary_domain); |
| 306 |
+ if (tevent_req_nterror(req, status)) { |
| 307 |
+ return; |
| 308 |
} |
| 309 |
|
| 310 |
ok = smb1cli_conn_activate_signing(cli->conn, |
| 311 |
@@ -1707,7 +1737,6 @@ static void cli_session_setup_creds_done_lm21(struct tevent_req *subreq) |
| 312 |
subreq, struct tevent_req); |
| 313 |
struct cli_session_setup_creds_state *state = tevent_req_data( |
| 314 |
req, struct cli_session_setup_creds_state); |
| 315 |
- struct cli_state *cli = state->cli; |
| 316 |
NTSTATUS status; |
| 317 |
|
| 318 |
status = smb1cli_session_setup_lm21_recv(subreq, state, |
| 319 |
@@ -1720,11 +1749,12 @@ static void cli_session_setup_creds_done_lm21(struct tevent_req *subreq) |
| 320 |
return; |
| 321 |
} |
| 322 |
|
| 323 |
- if (cli->server_os == NULL) { |
| 324 |
- cli->server_os = talloc_move(cli, &state->out_native_os); |
| 325 |
- } |
| 326 |
- if (cli->server_type == NULL) { |
| 327 |
- cli->server_type = talloc_move(cli, &state->out_native_lm); |
| 328 |
+ status = cli_state_update_after_sesssetup(state->cli, |
| 329 |
+ state->out_native_os, |
| 330 |
+ state->out_native_lm, |
| 331 |
+ NULL); |
| 332 |
+ if (tevent_req_nterror(req, status)) { |
| 333 |
+ return; |
| 334 |
} |
| 335 |
|
| 336 |
tevent_req_done(req); |
| 337 |
-- |
| 338 |
2.13.1 |
| 339 |
|
Parent Directory
| 
Revision Log
| 
Revision Graph
