Add a check of received RPC fragment size

The RPC specification says that there is a maximum size of a PDU that
can be sent between client and server without further negotiation.
This change adds a check of the size of a received PDU and a Reject
response when the check fails.

Author: amn-rtl

src/device/pf_cmrpc.c

@@ -61,6 +61,16 @@
 #error "PNET_MAX_SESSION_BUFFER_SIZE must be less than or equal to 65535"
 #endif
 
+/* Unless negotiated between server and client, a CL-PDU (header (80 bytes) +
+ * body) should not be larger than MustRecvFragSize (1464 bytes). This means
+ * that a CL-PDU body should not be larger than 1384 bytes.
+ * (See DCE 1.1: RPC, p. 578)
+ */
+#define PF_CMRPC_MUST_RECV_FRAG_SIZE (1464)
+#define PF_CMRPC_PDU_HEADER_SIZE     (80)
+#define PF_CMRPC_MAX_PDU_BODY_SIZE                                             \
+   (PF_CMRPC_MUST_RECV_FRAG_SIZE - PF_CMRPC_PDU_HEADER_SIZE)
+
 static const pf_uuid_t implicit_ar = {0, 0, 0, {0, 0, 0, 0, 0, 0, 0, 0}};
 
 static const pf_uuid_t uuid_epmap_interface = {
@@ -4326,7 +4336,16 @@ static int pf_cmrpc_dce_packet (
       p_sess->get_info = get_info;
       memset (&p_sess->rpc_result, 0, sizeof (p_sess->rpc_result));
 
-      if (rpc_req.flags.fragment == false)
+      if (rpc_req.length_of_body > PF_CMRPC_MAX_PDU_BODY_SIZE)
+      {
+         LOG_ERROR (
+            PF_RPC_LOG,
+            "CMRPC(%d): RPC fragment too large (%hu bytes)."
+            " Check the conformance of the controller (PLC).\n",
+            __LINE__,
+            rpc_req.length_of_body);
+      }
+      else if (rpc_req.flags.fragment == false)
       {
          /* Incoming message is a request or response contained entirely in one
           * frame */
@@ -4438,7 +4457,45 @@ static int pf_cmrpc_dce_packet (
       /* Decide what to do with incoming message */
       /* Enter here _even_if_ an error is already detected because we may need
        * to generate an error response. */
-      if (
+      if (rpc_req.length_of_body > PF_CMRPC_MAX_PDU_BODY_SIZE)
+      {
+         /* The specifications do not clearly state what the response should
+          * be in this case. The current best guess is to send a Reject PDU.
+          */
+
+         /* Prepare the response */
+         rpc_res = rpc_req;
+         rpc_res.packet_type = PF_RPC_PT_REJECT;
+         rpc_res.flags.last_fragment = false;
+         rpc_res.flags.fragment = false;
+         rpc_res.flags.no_fack = true;
+         rpc_res.flags.maybe = false;
+         rpc_res.flags.idempotent = true;
+         rpc_res.flags.broadcast = false;
+         rpc_res.flags2.cancel_pending = false;
+         rpc_res.length_of_body = sizeof (uint32_t);
+         rpc_res.fragment_nmb = 0;
+         rpc_res.is_big_endian = p_sess->is_big_endian;
+
+         pf_put_dce_rpc_header (
+            &rpc_res,
+            *p_res_len,
+            p_res,
+            &res_pos,
+            &length_of_body_pos);
+
+         pf_put_uint32 (
+            rpc_res.is_big_endian,
+            PF_RPC_NCA_PROTO_ERROR,
+            *p_res_len,
+            p_res,
+            &res_pos);
+
+         pf_cmrpc_send_once_from_buffer (net, p_sess, p_res, res_pos, "REJECT");
+
+         p_sess->kill_session = is_new_session;
+      }
+      else if (
          (rpc_req.flags.fragment == false) ||
          (rpc_req.flags.last_fragment == true))
       {

src/pf_types.h

@@ -468,6 +468,26 @@ typedef struct pf_rpc_lookup_req
    uint16_t udpPort;
 } pf_rpc_lookup_req_t;
 
+typedef enum
+{
+   PF_RPC_NCA_RPC_VERSION_MISMATCH = 0x1C000008,
+   PF_RPC_NCA_UNSPEC_REJECT = 0x1C000009,
+   PF_RPC_NCA_S_BAD_ACTID = 0x1C00000A,
+   PF_RPC_NCA_WHO_ARE_YOU_FAILED = 0x1C00000B,
+   PF_RPC_NCA_MANAGER_NOT_ENTERED = 0x1C00000C,
+   PF_RPC_NCA_UNSUPPORTED_AUTHN_LEVEL = 0x1C00001D,
+   PF_RPC_NCA_INVALID_CHECKSUM = 0x1C00001F,
+   PF_RPC_NCA_INVALID_CRC = 0x1C000020,
+   PF_RPC_NCA_OP_RNG_ERROR = 0x1C010002,
+   PF_RPC_NCA_UNK_IF = 0x1C010003,
+   PF_RPC_NCA_WRONG_BOOT_TIME = 0x1C010006,
+   PF_RPC_NCA_S_YOU_CRASHED = 0x1C010009,
+   PF_RPC_NCA_PROTO_ERROR = 0x1C01000B,
+   PF_RPC_NCA_OUT_ARGS_TOO_BIG = 0x1C010013,
+   PF_RPC_NCA_SERVER_TOO_BUSY = 0x1C010014,
+   PF_RPC_NCA_UNSUPPORTED_TYPE = 0x1C010017
+} pf_rpc_nca_reject_status_t;
+
 /************************** Block header *************************************/
 
 typedef enum pf_block_type_values