svn commit: samba r9606 - in trunk/source/rpc_server: .

[jra at samba.org]

Author: jra
Date: 2005-08-25 03:04:27 +0000 (Thu, 25 Aug 2005)
New Revision: 9606

WebSVN: http://websvn.samba.org/cgi-bin/viewcvs.cgi?view=rev&root=samba&rev=9606

Log:
Remember to remove the sign/seal padding length from the data stream once we've
done the sign/seal calculations.
Jeremy.

Modified:
   trunk/source/rpc_server/srv_pipe.c
   trunk/source/rpc_server/srv_pipe_hnd.c


Changeset:
Modified: trunk/source/rpc_server/srv_pipe.c
===================================================================
--- trunk/source/rpc_server/srv_pipe.c	2005-08-25 02:55:54 UTC (rev 9605)
+++ trunk/source/rpc_server/srv_pipe.c	2005-08-25 03:04:27 UTC (rev 9606)
@@ -1829,7 +1829,8 @@
  Deal with NTLMSSP sign & seal processing on an RPC request.
 ****************************************************************************/
 
-BOOL api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in, NTSTATUS *pstatus)
+BOOL api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
+					uint32 *p_ss_padding_len, NTSTATUS *pstatus)
 {
 	RPC_HDR_AUTH auth_info;
 	uint32 auth_len = p->hdr.auth_len;
@@ -1888,6 +1889,13 @@
 		return False;
 	}
 
+	/*
+	 * Remember the padding length. We must remove it from the real data
+	 * stream once the sign/seal is done.
+	 */
+
+	*p_ss_padding_len = auth_info.auth_pad_len;
+
 	auth_blob.data = prs_data_p(rpc_in) + prs_offset(rpc_in);
 	auth_blob.length = auth_len;
 	
@@ -1937,7 +1945,7 @@
  Deal with schannel processing on an RPC request.
 ****************************************************************************/
 
-BOOL api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in)
+BOOL api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
 {
 	/*
 	 * We always negotiate the following two bits....
@@ -1988,6 +1996,13 @@
 		return False;
 	}
 
+	/*
+	 * Remember the padding length. We must remove it from the real data
+	 * stream once the sign/seal is done.
+	 */
+
+	*p_ss_padding_len = auth_info.auth_pad_len;
+
 	if (!schannel_decode(p->auth.a_u.schannel_auth,
 			   p->auth.auth_level,
 			   SENDER_IS_INITIATOR,

Modified: trunk/source/rpc_server/srv_pipe_hnd.c
===================================================================
--- trunk/source/rpc_server/srv_pipe_hnd.c	2005-08-25 02:55:54 UTC (rev 9605)
+++ trunk/source/rpc_server/srv_pipe_hnd.c	2005-08-25 03:04:27 UTC (rev 9606)
@@ -543,6 +543,7 @@
 
 static BOOL process_request_pdu(pipes_struct *p, prs_struct *rpc_in_p)
 {
+	uint32 ss_padding_len = 0;
 	size_t data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
 				(p->hdr.auth_len ? RPC_HDR_AUTH_LEN : 0) - p->hdr.auth_len;
 
@@ -573,20 +574,19 @@
 
 		case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 		case PIPE_AUTH_TYPE_NTLMSSP:
-			{
-				NTSTATUS status;
-				if(!api_pipe_ntlmssp_auth_process(p, rpc_in_p,&status)) {
-					DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
-					DEBUG(0,("process_request_pdu: error was %s.\n", nt_errstr(status) ));
-					set_incoming_fault(p);
-					return False;
-				}
+		{
+			NTSTATUS status;
+			if(!api_pipe_ntlmssp_auth_process(p, rpc_in_p, &ss_padding_len, &status)) {
+				DEBUG(0,("process_request_pdu: failed to do auth processing.\n"));
+				DEBUG(0,("process_request_pdu: error was %s.\n", nt_errstr(status) ));
+				set_incoming_fault(p);
+				return False;
 			}
-
 			break;
+		}
 
 		case PIPE_AUTH_TYPE_SCHANNEL:
-			if (!api_pipe_schannel_process(p, rpc_in_p)) {
+			if (!api_pipe_schannel_process(p, rpc_in_p, &ss_padding_len)) {
 				DEBUG(3,("process_request_pdu: failed to do schannel processing.\n"));
 				set_incoming_fault(p);
 				return False;
@@ -599,6 +599,11 @@
 			return False;
 	}
 
+	/* Now we've done the sign/seal we can remove any padding data. */
+	if (data_len > ss_padding_len) {
+		data_len -= ss_padding_len;
+	}
+
 	/*
 	 * Check the data length doesn't go over the 15Mb limit.
 	 * increased after observing a bug in the Windows NT 4.0 SP6a