src/kdc/ndr.c

/* -*- mode: c; c-basic-offset: 4; indent-tabs-mode: nil -*- */
/* kdc/ndr.c - NDR encoding and decoding functions */
/*
 * Copyright (C) 2021 by Red Hat, Inc.
 * All rights reserved.
 *
 * Redistribution and use in source and binary forms, with or without
 * modification, are permitted provided that the following conditions
 * are met:
 *
 * * Redistributions of source code must retain the above copyright
 *   notice, this list of conditions and the following disclaimer.
 *
 * * Redistributions in binary form must reproduce the above copyright
 *   notice, this list of conditions and the following disclaimer in
 *   the documentation and/or other materials provided with the
 *   distribution.
 *
 * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
 * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
 * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
 * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
 * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
 * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
 * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
 * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
 * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
 * OF THE POSSIBILITY OF SUCH DAMAGE.
 */

#include "k5-int.h"
#include "k5-input.h"
#include "k5-buf.h"
#include "k5-utf8.h"
#include "kdc_util.h"

struct encoded_wchars {
    uint16_t bytes_len;
    uint16_t num_wchars;
    uint8_t *encoded;
};

/*
 * MS-DTYP 2.3.10:
 *
 * typedef struct _RPC_UNICODE_STRING {
 *     unsigned short Length;
 *     unsigned short MaximumLength;
 *     [size_is(MaximumLength/2), length_is(Length/2)] WCHAR* Buffer;
 * } RPC_UNICODE_STRING, *PRPC_UNICODE_STRING;
 *
 * Note that Buffer is not a String - there's no termination.
 *
 * We don't actually decode Length and MaximumLength here - this is a
 * conformant-varying array, which means that (per DCE-1.1-RPC 14.3.7.2) where
 * those actually appear in the serialized data is variable depending on
 * whether the string is at top level of the struct or not.  (This also
 * affects where the pointer identifier appears.)
 *
 * See MS-RPCE 4.7 for what an RPC_UNICODE_STRING looks like when not at
 * top-level.
 */
static krb5_error_code
dec_wchar_pointer(struct k5input *in, char **out)
{
    const uint8_t *bytes;
    uint32_t actual_count;

    /* Maximum count. */
    (void)k5_input_get_uint32_le(in);
    /* Offset - all zeroes, "should" not be checked. */
    (void)k5_input_get_uint32_le(in);

    actual_count = k5_input_get_uint32_le(in);
    if (actual_count > UINT32_MAX / 2)
        return ERANGE;

    bytes = k5_input_get_bytes(in, actual_count * 2);
    if (bytes == NULL || k5_utf16le_to_utf8(bytes, actual_count * 2, out) != 0)
        return EINVAL;

    /* Always align on 4. */
    if (actual_count % 2 == 1)
        (void)k5_input_get_uint16_le(in);

    return 0;
}

static krb5_error_code
enc_wchar_pointer(const char *utf8, struct encoded_wchars *encoded_out)
{
    krb5_error_code ret;
    struct k5buf b;
    size_t utf16len, num_wchars;
    uint8_t *utf16;

    ret = k5_utf8_to_utf16le(utf8, &utf16, &utf16len);
    if (ret)
        return ret;

    num_wchars = utf16len / 2;

    k5_buf_init_dynamic(&b);
    k5_buf_add_uint32_le(&b, num_wchars + 1);
    k5_buf_add_uint32_le(&b, 0);
    k5_buf_add_uint32_le(&b, num_wchars);
    k5_buf_add_len(&b, utf16, utf16len);

    free(utf16);

    if (num_wchars % 2 == 1)
        k5_buf_add_uint16_le(&b, 0);

    ret = k5_buf_status(&b);
    if (ret)
        return ret;

    encoded_out->bytes_len = b.len;
    encoded_out->num_wchars = num_wchars;
    encoded_out->encoded = b.data;
    return 0;
}

/*
 * Decode a delegation info structure, leaving room to add an additional
 * service.
 *
 * MS-PAC 2.9:
 *
 * typedef struct _S4U_DELEGATION_INFO {
 *     RPC_UNICODE_STRING S4U2proxyTarget;
 *     ULONG TransitedListSize;
 *     [size_is(TransitedListSize)] PRPC_UNICODE_STRING S4UTransitedServices;
 * } S4U_DELEGATION_INFO, *PS4U_DELEGATION_INFO;
 */
krb5_error_code
ndr_dec_delegation_info(krb5_data *data, struct pac_s4u_delegation_info **out)
{
    krb5_error_code ret;
    struct pac_s4u_delegation_info *di = NULL;
    struct k5input in;
    uint32_t i, object_buffer_length, nservices;
    uint8_t version, endianness, common_header_length;

    *out = NULL;

    di = k5alloc(sizeof(*di), &ret);
    if (di == NULL)
        return ret;

    k5_input_init(&in, data->data, data->length);

    /* Common Type Header - MS-RPCE 2.2.6.1 */
    version = k5_input_get_byte(&in);
    endianness = k5_input_get_byte(&in);
    common_header_length = k5_input_get_uint16_le(&in);
    (void)k5_input_get_uint32_le(&in); /* Filler - 0xcccccccc. */
    if (version != 1 || endianness != 0x10 || common_header_length != 8) {
        ret = EINVAL;
        goto error;
    }

    /* Private Header for Constructed Type - MS-RPCE 2.2.6.2 */
    object_buffer_length = k5_input_get_uint32_le(&in);
    if (data->length < 16 || object_buffer_length != data->length - 16) {
        ret = EINVAL;
        goto error;
    }

    (void)k5_input_get_uint32_le(&in); /* Filler - 0. */

    /* This code doesn't handle re-used pointers, which could come into play in
     * the unlikely case of a delegation loop. */

    /* Pointer.  Microsoft always starts at 00 00 02 00 */
    (void)k5_input_get_uint32_le(&in);
    /* Length of proxy target - 2 */
    (void)k5_input_get_uint16_le(&in);
    /* Length of proxy target */
    (void)k5_input_get_uint16_le(&in);
    /* Another pointer - 04 00 02 00.  Microsoft increments by 4 (le). */
    (void)k5_input_get_uint32_le(&in);

    /* Transited services length - header version. */
    (void)k5_input_get_uint32_le(&in);

    /* More pointer: 08 00 02 00 */
    (void)k5_input_get_uint32_le(&in);

    ret = dec_wchar_pointer(&in, &di->proxy_target);
    if (ret)
        goto error;
    nservices = k5_input_get_uint32_le(&in);

    /* Here, we have encoded 2 bytes of length, 2 bytes of (length + 2), and 4
     * bytes of pointer, for each element (deferred pointers). */
    if (nservices > data->length / 8) {
        ret = ERANGE;
        goto error;
    }
    (void)k5_input_get_bytes(&in, 8 * nservices);

    /* Since we're likely to add another entry, leave a blank at the end. */
    di->transited_services = k5calloc(nservices + 1, sizeof(char *), &ret);
    if (di->transited_services == NULL)
        goto error;

    for (i = 0; i < nservices; i++) {
        ret = dec_wchar_pointer(&in, &di->transited_services[i]);
        if (ret)
            goto error;
        di->transited_services_length++;
    }

    ret = in.status;
    if (ret)
        goto error;

    *out = di;
    return 0;

error:
    ndr_free_delegation_info(di);
    return ret;
}

/* Empirically, Microsoft starts pointers at 00 00 02 00, and if treated little
 * endian, they increase by 4. */
static inline void
write_ptr(struct k5buf *buf, uint32_t *pointer)
{
    if (*pointer == 0)
        *pointer = 0x00020000;
    k5_buf_add_uint32_le(buf, *pointer);
    *pointer += 4;
}

krb5_error_code
ndr_enc_delegation_info(struct pac_s4u_delegation_info *in, krb5_data *out)
{
    krb5_error_code ret;
    size_t i;
    struct k5buf b = EMPTY_K5BUF;
    struct encoded_wchars pt_encoded = { 0 }, *tss_encoded = NULL;
    uint32_t pointer = 0;

    /* Encode ahead of time since we need the lengths. */
    ret = enc_wchar_pointer(in->proxy_target, &pt_encoded);
    if (ret)
        goto cleanup;

    tss_encoded = k5calloc(in->transited_services_length, sizeof(*tss_encoded),
                           &ret);
    if (tss_encoded == NULL)
        goto cleanup;

    k5_buf_init_dynamic(&b);

    /* Common Type Header - MS-RPCE 2.2.6.1 */
    k5_buf_add_len(&b, "\x01\x10\x08\x00", 4);
    k5_buf_add_uint32_le(&b, 0xcccccccc);

    /* Private Header for Constructed Type - MS-RPCE 2.2.6.2 */
    k5_buf_add_uint32_le(&b, 0); /* Skip over where payload length goes. */
    k5_buf_add_uint32_le(&b, 0); /* Filler - all zeroes. */

    write_ptr(&b, &pointer);
    k5_buf_add_uint16_le(&b, 2 * pt_encoded.num_wchars);
    k5_buf_add_uint16_le(&b, 2 * (pt_encoded.num_wchars + 1));
    write_ptr(&b, &pointer);

    k5_buf_add_uint32_le(&b, in->transited_services_length);
    write_ptr(&b, &pointer);

    k5_buf_add_len(&b, pt_encoded.encoded, pt_encoded.bytes_len);

    k5_buf_add_uint32_le(&b, in->transited_services_length);

    /* Deferred pointers. */
    for (i = 0; i < in->transited_services_length; i++) {
        ret = enc_wchar_pointer(in->transited_services[i], &tss_encoded[i]);
        if (ret)
            goto cleanup;

        k5_buf_add_uint16_le(&b, 2 * tss_encoded[i].num_wchars);
        k5_buf_add_uint16_le(&b, 2 * (tss_encoded[i].num_wchars + 1));
        write_ptr(&b, &pointer);
    }

    for (i = 0; i < in->transited_services_length; i++)
        k5_buf_add_len(&b, tss_encoded[i].encoded, tss_encoded[i].bytes_len);

    /* Now, pad to 8 bytes.  RPC_UNICODE_STRING is aligned on 4 bytes. */
    if (b.len % 8 != 0)
        k5_buf_add_uint32_le(&b, 0);

    /* Record the payload length where we skipped over it previously. */
    if (b.data != NULL)
        store_32_le(b.len - 0x10, ((uint8_t *)b.data) + 8);

    ret = k5_buf_status(&b);
    if (ret)
        goto cleanup;

    *out = make_data(b.data, b.len);
    b.data = NULL;

cleanup:
    free(b.data);
    free(pt_encoded.encoded);
    for (i = 0; tss_encoded != NULL && i < in->transited_services_length; i++)
        free(tss_encoded[i].encoded);
    free(tss_encoded);
    return ret;
}

void
ndr_free_delegation_info(struct pac_s4u_delegation_info *di)
{
    uint32_t i;

    if (di == NULL)
        return;
    free(di->proxy_target);
    for (i = 0; i < di->transited_services_length; i++)
        free(di->transited_services[i]);
    free(di->transited_services);
    free(di);
}