Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 :
4 : routines for marshalling/unmarshalling cab structures
5 :
6 : Copyright (C) Guenther Deschner 2016
7 :
8 : This program is free software; you can redistribute it and/or modify
9 : it under the terms of the GNU General Public License as published by
10 : the Free Software Foundation; either version 3 of the License, or
11 : (at your option) any later version.
12 :
13 : This program is distributed in the hope that it will be useful,
14 : but WITHOUT ANY WARRANTY; without even the implied warranty of
15 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 : GNU General Public License for more details.
17 :
18 : You should have received a copy of the GNU General Public License
19 : along with this program. If not, see <http://www.gnu.org/licenses/>.
20 : */
21 :
22 : #include "includes.h"
23 : #include "librpc/gen_ndr/ndr_cab.h"
24 : #include "librpc/ndr/ndr_compression.h"
25 :
26 : #define OFFSET_OF_FOLDER_COFFCABSTART(folder) (36 /* cfheader size */ + (size_t)(folder)*8)
27 :
28 0 : _PUBLIC_ void ndr_print_cf_time(struct ndr_print *ndr, const char *name, const struct cf_time *r)
29 : {
30 0 : uint8_t hour = 0, minute = 0, seconds = 0;
31 : char *s;
32 0 : if (r == NULL) { ndr_print_null(ndr); return; }
33 0 : hour = r->time >> 11;
34 0 : minute = (r->time >> 5) & 0x3f;
35 0 : seconds = (r->time << 1) & 0x3e;
36 0 : s = talloc_asprintf(ndr, "%02d:%02d:%02d", hour, minute, seconds);
37 0 : if (s == NULL) { return; }
38 0 : ndr_print_string(ndr, "time", s);
39 0 : talloc_free(s);
40 : }
41 :
42 0 : _PUBLIC_ void ndr_print_cf_date(struct ndr_print *ndr, const char *name, const struct cf_date *r)
43 : {
44 0 : uint16_t year = 0;
45 0 : uint8_t month = 0, day = 0;
46 : char *s;
47 0 : if (r == NULL) { ndr_print_null(ndr); return; }
48 0 : year = (r->date >> 9);
49 0 : year += 1980;
50 0 : month = (r->date >> 5 & 0xf);
51 0 : day = (r->date & 0x1f);
52 0 : s = talloc_asprintf(ndr, "%02d/%02d/%04d", day, month, year);
53 0 : if (s == NULL) { return; }
54 0 : ndr_print_string(ndr, "date", s);
55 0 : talloc_free(s);
56 : }
57 :
58 0 : uint32_t ndr_count_cfdata(const struct cab_file *r)
59 : {
60 0 : uint32_t count = 0, i;
61 :
62 0 : for (i = 0; i < r->cfheader.cFolders; i++) {
63 0 : if (count + r->cffolders[i].cCFData < count) {
64 : /* Integer wrap. */
65 0 : return 0;
66 : }
67 0 : count += r->cffolders[i].cCFData;
68 : }
69 :
70 0 : return count;
71 : }
72 :
73 0 : static uint32_t ndr_cab_compute_checksum(uint8_t *data, uint32_t length, uint32_t seed)
74 : {
75 : int num_ulong;
76 : uint32_t checksum;
77 : uint8_t *pb;
78 : uint32_t ul;
79 :
80 0 : num_ulong = length / 4;
81 0 : checksum = seed;
82 0 : pb = data;
83 :
84 0 : while (num_ulong-- > 0) {
85 0 : ul = (uint32_t)(*pb++);
86 0 : ul |= (((uint32_t)(*pb++)) << 8);
87 0 : ul |= (((uint32_t)(*pb++)) << 16);
88 0 : ul |= (((uint32_t)(*pb++)) << 24);
89 :
90 0 : checksum ^= ul;
91 : }
92 :
93 0 : ul = 0;
94 :
95 0 : switch (length % 4) {
96 0 : case 3:
97 0 : ul |= (((uint32_t)(*pb++)) << 16);
98 : FALL_THROUGH;
99 0 : case 2:
100 0 : ul |= (((uint32_t)(*pb++)) << 8);
101 : FALL_THROUGH;
102 0 : case 1:
103 0 : ul |= (uint32_t)(*pb++);
104 : FALL_THROUGH;
105 0 : default:
106 0 : break;
107 : }
108 :
109 0 : checksum ^= ul;
110 :
111 0 : return checksum;
112 : }
113 :
114 : /* Push all CFDATA of a folder.
115 : *
116 : * This works on a folder level because compression type is set per
117 : * folder, and a compression state can be shared between CFDATA of the
118 : * same folder.
119 : *
120 : * This is not a regular NDR func as we pass the compression type and
121 : * the number of CFDATA as extra arguments
122 : */
123 0 : static enum ndr_err_code ndr_push_folder_cfdata(struct ndr_push *ndr,
124 : const struct CFDATA *r,
125 : enum cf_compress_type cab_ctype,
126 : size_t num_cfdata)
127 : {
128 : size_t i;
129 0 : enum ndr_compression_alg ndr_ctype = 0;
130 :
131 0 : ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX|LIBNDR_FLAG_LITTLE_ENDIAN|LIBNDR_FLAG_NOALIGN);
132 :
133 0 : if (cab_ctype == CF_COMPRESS_MSZIP) {
134 0 : ndr_ctype = NDR_COMPRESSION_MSZIP_CAB;
135 0 : NDR_CHECK(ndr_push_compression_state_init(ndr, ndr_ctype, &ndr->cstate));
136 : }
137 :
138 0 : for (i = 0; i < num_cfdata; i++, r++) {
139 0 : uint32_t compressed_length = 0;
140 : uint32_t csum, csumPartial;
141 : size_t compressed_offset, csum_offset, data_offset;
142 :
143 0 : if (!r->ab.data) {
144 0 : return ndr_push_error(ndr, NDR_ERR_LENGTH,
145 : "NULL uncompressed data blob");
146 : }
147 0 : if (r->ab.length != r->cbUncomp) {
148 0 : return ndr_push_error(ndr, NDR_ERR_LENGTH,
149 : "Uncompressed data blob size != uncompressed data size field");
150 : }
151 :
152 : /*
153 : * checksum is a function of the size fields
154 : * and the potentially compressed data bytes,
155 : * which haven't been compressed yet so
156 : * remember offset, write zeroes, fill out
157 : * later
158 : */
159 0 : csum_offset = ndr->offset;
160 0 : NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, 0));
161 :
162 : /*
163 : * similarly, we don't know the compressed
164 : * size yet, remember offset, write zeros,
165 : * fill out later
166 : */
167 0 : compressed_offset = ndr->offset;
168 0 : NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, 0));
169 0 : NDR_CHECK(ndr_push_uint16(ndr, NDR_SCALARS, r->cbUncomp));
170 :
171 0 : data_offset = ndr->offset;
172 :
173 0 : switch (cab_ctype) {
174 0 : case CF_COMPRESS_NONE:
175 : /* just copy the data */
176 0 : NDR_PUSH_NEED_BYTES(ndr, r->ab.length);
177 0 : NDR_CHECK(ndr_push_bytes(ndr, r->ab.data, r->ab.length));
178 0 : compressed_length = r->ab.length;
179 0 : break;
180 0 : case CF_COMPRESS_LZX:
181 : /*
182 : * we have not yet worked out the details of LZX
183 : * compression
184 : */
185 0 : return NDR_ERR_COMPRESSION;
186 :
187 0 : case CF_COMPRESS_MSZIP: {
188 : struct ndr_push *push_sub, *push_compress;
189 :
190 : /* compress via subcontext */
191 0 : NDR_CHECK(ndr_push_subcontext_start(ndr, &push_sub, 0, -1));
192 0 : push_sub->cstate = ndr->cstate;
193 0 : NDR_CHECK(ndr_push_compression_start(push_sub, &push_compress, ndr_ctype, -1));
194 0 : ndr_set_flags(&push_compress->flags, LIBNDR_FLAG_REMAINING);
195 0 : NDR_CHECK(ndr_push_DATA_BLOB(push_compress, NDR_SCALARS, r->ab));
196 0 : NDR_CHECK(ndr_push_compression_end(push_sub, push_compress, ndr_ctype, -1));
197 0 : NDR_CHECK(ndr_push_subcontext_end(ndr, push_sub, 0, -1));
198 0 : compressed_length = push_sub->offset;
199 :
200 0 : break;
201 : }
202 0 : default:
203 0 : return NDR_ERR_BAD_SWITCH;
204 : }
205 :
206 : /* we can now write the compressed size and the checksum */
207 0 : SSVAL(ndr->data, compressed_offset, compressed_length);
208 :
209 : /*
210 : * Create checksum over compressed data.
211 : *
212 : * The 8 bytes are the header size.
213 : *
214 : * We have already have written the checksum and set it to zero,
215 : * earlier. So we know that after the checksum end the value
216 : * for the compressed length comes the blob data.
217 : *
218 : * NDR already did all the checks for integer wraps.
219 : */
220 0 : csumPartial = ndr_cab_compute_checksum(&ndr->data[data_offset],
221 : compressed_length, 0);
222 :
223 : /*
224 : * Checksum over header (compressed and uncompressed length).
225 : *
226 : * The first 4 bytes are the checksum size.
227 : * The second 4 bytes are the size of the compressed and
228 : * uncompressed length fields.
229 : *
230 : * NDR already did all the checks for integer wraps.
231 : */
232 0 : csum = ndr_cab_compute_checksum(&ndr->data[compressed_offset],
233 : data_offset - compressed_offset,
234 : csumPartial);
235 :
236 0 : SIVAL(ndr->data, csum_offset, csum);
237 : }
238 :
239 0 : ndr_push_compression_state_free(ndr->cstate);
240 0 : ndr->cstate = NULL;
241 :
242 0 : return NDR_ERR_SUCCESS;
243 : }
244 :
245 0 : _PUBLIC_ enum ndr_err_code ndr_push_cab_file(struct ndr_push *ndr, int ndr_flags, const struct cab_file *r)
246 : {
247 : uint32_t cntr_cffolders_0;
248 : uint32_t cntr_cffiles_0;
249 0 : size_t processed_cfdata = 0;
250 : {
251 0 : uint32_t _flags_save_STRUCT = ndr->flags;
252 0 : ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX|LIBNDR_FLAG_LITTLE_ENDIAN|LIBNDR_FLAG_NOALIGN);
253 0 : NDR_PUSH_CHECK_FLAGS(ndr, ndr_flags);
254 :
255 0 : if (ndr_flags & NDR_SCALARS) {
256 : uint32_t i;
257 0 : NDR_CHECK(ndr_push_align(ndr, 4));
258 0 : NDR_CHECK(ndr_push_CFHEADER(ndr, NDR_SCALARS, &r->cfheader));
259 0 : for (cntr_cffolders_0 = 0; cntr_cffolders_0 < (r->cfheader.cFolders); cntr_cffolders_0++) {
260 0 : NDR_CHECK(ndr_push_CFFOLDER(ndr, NDR_SCALARS, &r->cffolders[cntr_cffolders_0]));
261 : }
262 0 : for (cntr_cffiles_0 = 0; cntr_cffiles_0 < (r->cfheader.cFiles); cntr_cffiles_0++) {
263 0 : NDR_CHECK(ndr_push_CFFILE(ndr, NDR_SCALARS, &r->cffiles[cntr_cffiles_0]));
264 : }
265 : #if 0
266 : NDR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ndr_count_cfdata(r)));
267 : #endif
268 :
269 : /* write in the folder header the offset of its first data block */
270 0 : for (i = 0; i < r->cfheader.cFolders; i++) {
271 0 : size_t off = OFFSET_OF_FOLDER_COFFCABSTART(i);
272 : /* check that the offset we want to
273 : * write to is always inside our
274 : * current push buffer
275 : */
276 0 : if (off >= ndr->offset) {
277 0 : return ndr_push_error(ndr, NDR_ERR_OFFSET,
278 : "trying to write past current push buffer size");
279 : }
280 0 : SIVAL(ndr->data, off, ndr->offset);
281 0 : NDR_CHECK(ndr_push_folder_cfdata(ndr, r->cfdata + processed_cfdata, r->cffolders[i].typeCompress, r->cffolders[i].cCFData));
282 0 : processed_cfdata += r->cffolders[i].cCFData;
283 : }
284 0 : NDR_CHECK(ndr_push_trailer_align(ndr, 4));
285 : }
286 0 : if (ndr_flags & NDR_BUFFERS) {
287 : }
288 0 : ndr->flags = _flags_save_STRUCT;
289 : }
290 :
291 :
292 : /* write total file size in header */
293 0 : SIVAL(ndr->data, 8, ndr->offset);
294 :
295 0 : return NDR_ERR_SUCCESS;
296 : }
297 :
298 :
299 : /* Pull all CFDATA of a folder.
300 : *
301 : * This works on a folder level because compression type is set per
302 : * folder, and a compression state can be shared between CFDATA of the
303 : * same folder.
304 : *
305 : * This is not a regular NDR func as we pass the compression type and
306 : * the number of CFDATA as extra arguments
307 : */
308 0 : static enum ndr_err_code ndr_pull_folder_cfdata(struct ndr_pull *ndr,
309 : struct CFDATA *r,
310 : enum cf_compress_type cab_ctype,
311 : size_t num_cfdata)
312 : {
313 : size_t i;
314 0 : enum ndr_compression_alg ndr_ctype = 0;
315 :
316 0 : if (cab_ctype == CF_COMPRESS_MSZIP) {
317 0 : ndr_ctype = NDR_COMPRESSION_MSZIP_CAB;
318 0 : NDR_CHECK(ndr_pull_compression_state_init(ndr, NDR_COMPRESSION_MSZIP_CAB, &ndr->cstate));
319 : }
320 :
321 0 : for (i = 0; i < num_cfdata; i++, r++) {
322 0 : NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->csum));
323 0 : NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->cbData));
324 0 : NDR_CHECK(ndr_pull_uint16(ndr, NDR_SCALARS, &r->cbUncomp));
325 :
326 0 : switch (cab_ctype) {
327 0 : case CF_COMPRESS_NONE:
328 : /* just copy the data */
329 0 : NDR_PULL_NEED_BYTES(ndr, r->cbUncomp);
330 0 : r->ab = data_blob_talloc(ndr->current_mem_ctx,
331 : ndr->data+ndr->offset,
332 : r->cbUncomp);
333 0 : if (r->ab.data == NULL) {
334 0 : return ndr_pull_error(ndr, NDR_ERR_ALLOC,
335 : "failed to allocate buffer for uncompressed CFDATA block");
336 : }
337 0 : ndr->offset += r->cbUncomp;
338 0 : break;
339 :
340 0 : case CF_COMPRESS_LZX:
341 : /* just copy the data (LZX decompression not implemented yet) */
342 0 : NDR_PULL_NEED_BYTES(ndr, r->cbData);
343 0 : r->ab = data_blob_talloc(ndr->current_mem_ctx,
344 : ndr->data+ndr->offset,
345 : r->cbData);
346 0 : if (r->ab.data == NULL) {
347 0 : return ndr_pull_error(ndr, NDR_ERR_ALLOC,
348 : "failed to allocate buffer for LZX-compressed CFDATA block");
349 : }
350 0 : ndr->offset += r->cbData;
351 0 : break;
352 :
353 0 : case CF_COMPRESS_MSZIP: {
354 : struct ndr_pull *pull_sub, *pull_compress;
355 0 : NDR_PULL_NEED_BYTES(ndr, r->cbData);
356 : /* decompress via subcontext */
357 0 : NDR_CHECK(ndr_pull_subcontext_start(ndr, &pull_sub, 0, r->cbData));
358 0 : pull_sub->cstate = ndr->cstate;
359 0 : NDR_CHECK(ndr_pull_compression_start(pull_sub, &pull_compress,
360 : ndr_ctype, r->cbUncomp, r->cbData));
361 0 : ndr_set_flags(&pull_compress->flags, LIBNDR_FLAG_REMAINING);
362 0 : NDR_CHECK(ndr_pull_DATA_BLOB(pull_compress, NDR_SCALARS, &r->ab));
363 0 : NDR_CHECK(ndr_pull_compression_end(pull_sub, pull_compress, ndr_ctype, r->cbUncomp));
364 0 : NDR_CHECK(ndr_pull_subcontext_end(ndr, pull_sub, 0, r->cbData));
365 :
366 0 : break;
367 : }
368 0 : default:
369 0 : return NDR_ERR_BAD_SWITCH;
370 : }
371 : }
372 :
373 0 : ndr_pull_compression_state_free(ndr->cstate);
374 0 : ndr->cstate = NULL;
375 :
376 0 : return NDR_ERR_SUCCESS;
377 : }
378 :
379 0 : _PUBLIC_ enum ndr_err_code ndr_pull_cab_file(struct ndr_pull *ndr, int ndr_flags, struct cab_file *r)
380 : {
381 0 : uint32_t size_cffolders_0 = 0;
382 : uint32_t cntr_cffolders_0;
383 0 : TALLOC_CTX *_mem_save_cffolders_0 = NULL;
384 0 : uint32_t size_cffiles_0 = 0;
385 : uint32_t cntr_cffiles_0;
386 0 : TALLOC_CTX *_mem_save_cffiles_0 = NULL;
387 0 : uint32_t size_cfdata_0 = 0;
388 0 : size_t processed_cfdata = 0;
389 0 : TALLOC_CTX *_mem_save_cfdata_0 = NULL;
390 : {
391 0 : uint32_t _flags_save_STRUCT = ndr->flags;
392 0 : ndr_set_flags(&ndr->flags, LIBNDR_PRINT_ARRAY_HEX|LIBNDR_FLAG_LITTLE_ENDIAN|LIBNDR_FLAG_NOALIGN);
393 0 : NDR_PULL_CHECK_FLAGS(ndr, ndr_flags);
394 0 : if (ndr_flags & NDR_SCALARS) {
395 0 : NDR_CHECK(ndr_pull_align(ndr, 4));
396 0 : NDR_CHECK(ndr_pull_CFHEADER(ndr, NDR_SCALARS, &r->cfheader));
397 0 : size_cffolders_0 = r->cfheader.cFolders;
398 0 : NDR_PULL_ALLOC_N(ndr, r->cffolders, size_cffolders_0);
399 0 : _mem_save_cffolders_0 = NDR_PULL_GET_MEM_CTX(ndr);
400 0 : NDR_PULL_SET_MEM_CTX(ndr, r->cffolders, 0);
401 0 : for (cntr_cffolders_0 = 0; cntr_cffolders_0 < (size_cffolders_0); cntr_cffolders_0++) {
402 0 : NDR_CHECK(ndr_pull_CFFOLDER(ndr, NDR_SCALARS, &r->cffolders[cntr_cffolders_0]));
403 : }
404 0 : NDR_PULL_SET_MEM_CTX(ndr, _mem_save_cffolders_0, 0);
405 0 : size_cffiles_0 = r->cfheader.cFiles;
406 0 : NDR_PULL_ALLOC_N(ndr, r->cffiles, size_cffiles_0);
407 0 : _mem_save_cffiles_0 = NDR_PULL_GET_MEM_CTX(ndr);
408 0 : NDR_PULL_SET_MEM_CTX(ndr, r->cffiles, 0);
409 0 : for (cntr_cffiles_0 = 0; cntr_cffiles_0 < (size_cffiles_0); cntr_cffiles_0++) {
410 0 : NDR_CHECK(ndr_pull_CFFILE(ndr, NDR_SCALARS, &r->cffiles[cntr_cffiles_0]));
411 : }
412 0 : NDR_PULL_SET_MEM_CTX(ndr, _mem_save_cffiles_0, 0);
413 : #if 0
414 : NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &r->cfdata_count));
415 : #else
416 0 : r->cfdata_count = ndr_count_cfdata(r);
417 : #endif
418 0 : size_cfdata_0 = r->cfdata_count;
419 0 : NDR_PULL_ALLOC_N(ndr, r->cfdata, size_cfdata_0);
420 0 : _mem_save_cfdata_0 = NDR_PULL_GET_MEM_CTX(ndr);
421 0 : NDR_PULL_SET_MEM_CTX(ndr, r->cfdata, 0);
422 0 : for (cntr_cffolders_0 = 0; cntr_cffolders_0 < (size_cffolders_0); cntr_cffolders_0++) {
423 0 : NDR_CHECK(ndr_pull_folder_cfdata(ndr,
424 : r->cfdata + processed_cfdata,
425 : r->cffolders[cntr_cffolders_0].typeCompress,
426 : r->cffolders[cntr_cffolders_0].cCFData));
427 0 : processed_cfdata += r->cffolders[cntr_cffolders_0].cCFData;
428 : }
429 0 : NDR_PULL_SET_MEM_CTX(ndr, _mem_save_cfdata_0, 0);
430 0 : NDR_CHECK(ndr_pull_trailer_align(ndr, 4));
431 : }
432 0 : if (ndr_flags & NDR_BUFFERS) {
433 : }
434 0 : ndr->flags = _flags_save_STRUCT;
435 : }
436 0 : return NDR_ERR_SUCCESS;
437 : }
|
