librpc/tools: correctly validate relative pointers in ndrdump
[metze/samba/wip.git] / librpc / tools / ndrdump.c
index 69b304dc9c078f081d6629065f2a1e677574273e..2827e8d7fd0dbdffa391cbb74d9dc2fc7c174586 100644 (file)
 #include "system/locale.h"
 #include "librpc/ndr/libndr.h"
 #include "librpc/ndr/ndr_table.h"
-#if (_SAMBA_BUILD_ >= 4)
+#include "librpc/gen_ndr/ndr_dcerpc.h"
 #include "lib/cmdline/popt_common.h"
 #include "param/param.h"
-#endif
 
 static const struct ndr_interface_call *find_function(
        const struct ndr_interface_table *p,
@@ -119,6 +118,7 @@ static const struct ndr_interface_table *load_iface_from_plugin(const char *plug
        if (!p) {
                printf("%s: Unable to find DCE/RPC interface table for '%s': %s\n", plugin, pipe_name, dlerror());
                talloc_free(symbol);
+               dlclose(handle);
                return NULL;
        }
 
@@ -129,11 +129,65 @@ static const struct ndr_interface_table *load_iface_from_plugin(const char *plug
 
 static void ndrdump_data(uint8_t *d, uint32_t l, bool force)
 {
-       if (force) {
-               dump_data(0, d, l);
-       } else {
-               dump_data_skip_zeros(0, d, l);
+       dump_data_file(d, l, !force, stdout);
+}
+
+static NTSTATUS ndrdump_pull_and_print_pipes(const char *function,
+                               struct ndr_pull *ndr_pull,
+                               struct ndr_print *ndr_print,
+                               const struct ndr_interface_call_pipes *pipes)
+{
+       NTSTATUS status;
+       enum ndr_err_code ndr_err;
+       uint32_t i;
+
+       for (i=0; i < pipes->num_pipes; i++) {
+               uint64_t idx = 0;
+               while (true) {
+                       void *saved_mem_ctx;
+                       uint32_t *count;
+                       void *c;
+                       char *n;
+
+                       c = talloc_zero_size(ndr_pull, pipes->pipes[i].chunk_struct_size);
+                       talloc_set_name(c, "struct %s", pipes->pipes[i].name);
+                       /*
+                        * Note: the first struct member is always
+                        * 'uint32_t count;'
+                        */
+                       count = (uint32_t *)c;
+
+                       n = talloc_asprintf(c, "%s: %s[%llu]",
+                                       function, pipes->pipes[i].name,
+                                       (unsigned long long)idx);
+
+                       saved_mem_ctx = ndr_pull->current_mem_ctx;
+                       ndr_pull->current_mem_ctx = c;
+                       ndr_err = pipes->pipes[i].ndr_pull(ndr_pull, NDR_SCALARS, c);
+                       ndr_pull->current_mem_ctx = saved_mem_ctx;
+                       status = ndr_map_error2ntstatus(ndr_err);
+
+                       printf("pull returned %s\n", nt_errstr(status));
+                       if (!NT_STATUS_IS_OK(status)) {
+                               talloc_free(c);
+                               return status;
+                       }
+                       pipes->pipes[i].ndr_print(ndr_print, n, c);
+                       talloc_free(c);
+                       if (*count == 0) {
+                               break;
+                       }
+                       idx++;
+               }
        }
+
+       return NT_STATUS_OK;
+}
+
+static void ndr_print_dummy(struct ndr_print *ndr, const char *format, ...)
+{
+       /* This is here so that you can turn ndr printing off for the purposes
+          of benchmarking ndr parsing. */
 }
 
  int main(int argc, const char *argv[])
@@ -157,29 +211,35 @@ static void ndrdump_data(uint8_t *d, uint32_t l, bool force)
        const char *plugin = NULL;
        bool validate = false;
        bool dumpdata = false;
+       bool assume_ndr64 = false;
+       bool quiet = false;
        int opt;
-       enum {OPT_CONTEXT_FILE=1000, OPT_VALIDATE, OPT_DUMP_DATA, OPT_LOAD_DSO};
+       enum {OPT_CONTEXT_FILE=1000, OPT_VALIDATE, OPT_DUMP_DATA, OPT_LOAD_DSO, OPT_NDR64, OPT_QUIET};
        struct poptOption long_options[] = {
                POPT_AUTOHELP
                {"context-file", 'c', POPT_ARG_STRING, NULL, OPT_CONTEXT_FILE, "In-filename to parse first", "CTX-FILE" },
                {"validate", 0, POPT_ARG_NONE, NULL, OPT_VALIDATE, "try to validate the data", NULL },  
                {"dump-data", 0, POPT_ARG_NONE, NULL, OPT_DUMP_DATA, "dump the hex data", NULL },       
                {"load-dso", 'l', POPT_ARG_STRING, NULL, OPT_LOAD_DSO, "load from shared object file", NULL },
+               {"ndr64", 0, POPT_ARG_NONE, NULL, OPT_NDR64, "Assume NDR64 data", NULL },
+               {"quiet", 0, POPT_ARG_NONE, NULL, OPT_QUIET, "Don't actually dump anything", NULL },
                POPT_COMMON_SAMBA
                POPT_COMMON_VERSION
                { NULL }
        };
+       const struct ndr_interface_call_pipes *in_pipes = NULL;
+       const struct ndr_interface_call_pipes *out_pipes = NULL;
+       uint32_t highest_ofs;
+       struct dcerpc_sec_verification_trailer *sec_vt = NULL;
 
        ndr_table_init();
 
        /* Initialise samba stuff */
-       load_case_tables();
+       smb_init_locale();
 
        setlinebuf(stdout);
 
-       dbf = x_stderr;
-
-       setup_logging(argv[0], true);
+       setup_logging("ndrdump", DEBUG_STDOUT);
 
        pc = poptGetContext("ndrdump", argc, argv, long_options, 0);
        
@@ -200,6 +260,12 @@ static void ndrdump_data(uint8_t *d, uint32_t l, bool force)
                case OPT_LOAD_DSO:
                        plugin = poptGetOptArg(pc);
                        break;
+               case OPT_NDR64:
+                       assume_ndr64 = true;
+                       break;
+               case OPT_QUIET:
+                       quiet = true;
+                       break;
                }
        }
 
@@ -243,19 +309,21 @@ static void ndrdump_data(uint8_t *d, uint32_t l, bool force)
                exit(1);
        }
 
+       f = find_function(p, function);
+
        if (strcmp(inout, "in") == 0 ||
            strcmp(inout, "request") == 0) {
                flags = NDR_IN;
+               in_pipes = &f->in_pipes;
        } else if (strcmp(inout, "out") == 0 ||
                   strcmp(inout, "response") == 0) {
                flags = NDR_OUT;
+               out_pipes = &f->out_pipes;
        } else {
                printf("Bad inout value '%s'\n", inout);
                exit(1);
        }
 
-       f = find_function(p, function);
-
        mem_ctx = talloc_init("ndrdump");
 
        st = talloc_zero_size(mem_ctx, f->struct_size);
@@ -285,13 +353,26 @@ static void ndrdump_data(uint8_t *d, uint32_t l, bool force)
                blob.data = data;
                blob.length = size;
 
-               ndr_pull = ndr_pull_init_blob(&blob, mem_ctx, lp_iconv_convenience(cmdline_lp_ctx));
+               ndr_pull = ndr_pull_init_blob(&blob, mem_ctx);
+               if (ndr_pull == NULL) {
+                       perror("ndr_pull_init_blob");
+                       exit(1);
+               }
                ndr_pull->flags |= LIBNDR_FLAG_REF_ALLOC;
+               if (assume_ndr64) {
+                       ndr_pull->flags |= LIBNDR_FLAG_NDR64;
+               }
 
                ndr_err = f->ndr_pull(ndr_pull, NDR_IN, st);
 
-               if (ndr_pull->offset != ndr_pull->data_size) {
-                       printf("WARNING! %d unread bytes while parsing context file\n", ndr_pull->data_size - ndr_pull->offset);
+               if (ndr_pull->offset > ndr_pull->relative_highest_offset) {
+                       highest_ofs = ndr_pull->offset;
+               } else {
+                       highest_ofs = ndr_pull->relative_highest_offset;
+               }
+
+               if (highest_ofs != ndr_pull->data_size) {
+                       printf("WARNING! %d unread bytes while parsing context file\n", ndr_pull->data_size - highest_ofs);
                }
 
                if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
@@ -318,29 +399,74 @@ static void ndrdump_data(uint8_t *d, uint32_t l, bool force)
        blob.data = data;
        blob.length = size;
 
-       ndr_pull = ndr_pull_init_blob(&blob, mem_ctx, lp_iconv_convenience(cmdline_lp_ctx));
+       ndr_pull = ndr_pull_init_blob(&blob, mem_ctx);
+       if (ndr_pull == NULL) {
+               perror("ndr_pull_init_blob");
+               exit(1);
+       }
        ndr_pull->flags |= LIBNDR_FLAG_REF_ALLOC;
+       if (assume_ndr64) {
+               ndr_pull->flags |= LIBNDR_FLAG_NDR64;
+       }
+
+       ndr_print = talloc_zero(mem_ctx, struct ndr_print);
+       if (quiet) {
+               ndr_print->print = ndr_print_dummy;
+       } else {
+               ndr_print->print = ndr_print_printf_helper;
+       }
+       ndr_print->depth = 1;
+
+       ndr_err = ndr_pop_dcerpc_sec_verification_trailer(ndr_pull, mem_ctx, &sec_vt);
+       status = ndr_map_error2ntstatus(ndr_err);
+       if (!NT_STATUS_IS_OK(status)) {
+               printf("ndr_pop_dcerpc_sec_verification_trailer returned %s\n",
+                      nt_errstr(status));
+       }
+
+       if (sec_vt != NULL && sec_vt->count.count > 0) {
+               printf("SEC_VT: consumed %d bytes\n",
+                      (int)(blob.length - ndr_pull->data_size));
+               if (dumpdata) {
+                       ndrdump_data(blob.data + ndr_pull->data_size,
+                                    blob.length - ndr_pull->data_size,
+                                    dumpdata);
+               }
+               ndr_print_dcerpc_sec_verification_trailer(ndr_print, "SEC_VT", sec_vt);
+       }
+       TALLOC_FREE(sec_vt);
+
+       if (out_pipes) {
+               status = ndrdump_pull_and_print_pipes(function, ndr_pull, ndr_print, out_pipes);
+               if (!NT_STATUS_IS_OK(status)) {
+                       printf("dump FAILED\n");
+                       exit(1);
+               }
+       }
 
        ndr_err = f->ndr_pull(ndr_pull, flags, st);
        status = ndr_map_error2ntstatus(ndr_err);
 
        printf("pull returned %s\n", nt_errstr(status));
 
-       if (ndr_pull->offset != ndr_pull->data_size) {
-               printf("WARNING! %d unread bytes\n", ndr_pull->data_size - ndr_pull->offset);
-               ndrdump_data(ndr_pull->data+ndr_pull->offset,
-                            ndr_pull->data_size - ndr_pull->offset,
+       if (ndr_pull->offset > ndr_pull->relative_highest_offset) {
+               highest_ofs = ndr_pull->offset;
+       } else {
+               highest_ofs = ndr_pull->relative_highest_offset;
+       }
+
+       if (highest_ofs != ndr_pull->data_size) {
+               printf("WARNING! %d unread bytes\n", ndr_pull->data_size - highest_ofs);
+               ndrdump_data(ndr_pull->data+highest_ofs,
+                            ndr_pull->data_size - highest_ofs,
                             dumpdata);
        }
 
        if (dumpdata) {
-               printf("%d bytes consumed\n", ndr_pull->offset);
+               printf("%d bytes consumed\n", highest_ofs);
                ndrdump_data(blob.data, blob.length, dumpdata);
        }
 
-       ndr_print = talloc_zero(mem_ctx, struct ndr_print);
-       ndr_print->print = ndr_print_debug_helper;
-       ndr_print->depth = 1;
        f->ndr_print(ndr_print, function, flags, st);
 
        if (!NT_STATUS_IS_OK(status)) {
@@ -348,16 +474,25 @@ static void ndrdump_data(uint8_t *d, uint32_t l, bool force)
                exit(1);
        }
 
+       if (in_pipes) {
+               status = ndrdump_pull_and_print_pipes(function, ndr_pull, ndr_print, in_pipes);
+               if (!NT_STATUS_IS_OK(status)) {
+                       printf("dump FAILED\n");
+                       exit(1);
+               }
+       }
+
        if (validate) {
                DATA_BLOB v_blob;
                struct ndr_push *ndr_v_push;
                struct ndr_pull *ndr_v_pull;
                struct ndr_print *ndr_v_print;
+               uint32_t highest_v_ofs;
                uint32_t i;
                uint8_t byte_a, byte_b;
                bool differ;
 
-               ndr_v_push = ndr_push_init_ctx(mem_ctx, lp_iconv_convenience(cmdline_lp_ctx));
+               ndr_v_push = ndr_push_init_ctx(mem_ctx);
                
                ndr_err = f->ndr_push(ndr_v_push, flags, st);
                status = ndr_map_error2ntstatus(ndr_err);
@@ -374,7 +509,11 @@ static void ndrdump_data(uint8_t *d, uint32_t l, bool force)
                        ndrdump_data(v_blob.data, v_blob.length, dumpdata);
                }
 
-               ndr_v_pull = ndr_pull_init_blob(&v_blob, mem_ctx, lp_iconv_convenience(cmdline_lp_ctx));
+               ndr_v_pull = ndr_pull_init_blob(&v_blob, mem_ctx);
+               if (ndr_v_pull == NULL) {
+                       perror("ndr_pull_init_blob");
+                       exit(1);
+               }
                ndr_v_pull->flags |= LIBNDR_FLAG_REF_ALLOC;
 
                ndr_err = f->ndr_pull(ndr_v_pull, flags, v_st);
@@ -385,11 +524,17 @@ static void ndrdump_data(uint8_t *d, uint32_t l, bool force)
                        exit(1);
                }
 
+               if (ndr_v_pull->offset > ndr_v_pull->relative_highest_offset) {
+                       highest_v_ofs = ndr_v_pull->offset;
+               } else {
+                       highest_v_ofs = ndr_v_pull->relative_highest_offset;
+               }
 
-               if (ndr_v_pull->offset != ndr_v_pull->data_size) {
-                       printf("WARNING! %d unread bytes in validation\n", ndr_v_pull->data_size - ndr_v_pull->offset);
-                       ndrdump_data(ndr_v_pull->data+ndr_v_pull->offset,
-                                    ndr_v_pull->data_size - ndr_v_pull->offset,
+               if (highest_v_ofs != ndr_v_pull->data_size) {
+                       printf("WARNING! %d unread bytes in validation\n",
+                              ndr_v_pull->data_size - highest_v_ofs);
+                       ndrdump_data(ndr_v_pull->data + highest_v_ofs,
+                                    ndr_v_pull->data_size - highest_v_ofs,
                                     dumpdata);
                }
 
@@ -403,9 +548,9 @@ static void ndrdump_data(uint8_t *d, uint32_t l, bool force)
                               (unsigned long long)blob.length, (unsigned long long)v_blob.length);
                }
 
-               if (ndr_pull->offset != ndr_v_pull->offset) {
+               if (highest_ofs != highest_v_ofs) {
                        printf("WARNING! orig pulled bytes:%llu validated pulled bytes:%llu\n", 
-                              (unsigned long long)ndr_pull->offset, (unsigned long long)ndr_v_pull->offset);
+                              (unsigned long long)highest_ofs, (unsigned long long)highest_v_ofs);
                }
 
                differ = false;