?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Fix a segfault: rpccli_* expect the reply_pdu to always be initialized
[Samba.git] / source3 / rpc_client / cli_pipe.c
blobcf2c833c28a25a07def49dc99bc509c79a3bdbd2
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Largely rewritten by Jeremy Allison 2005.
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "librpc/gen_ndr/cli_epmapper.h"
22
23 #undef DBGC_CLASS
24 #define DBGC_CLASS DBGC_RPC_CLI
25
26 /*******************************************************************
27 interface/version dce/rpc pipe identification
28 ********************************************************************/
29
30 #define PIPE_SRVSVC "\\PIPE\\srvsvc"
31 #define PIPE_SAMR "\\PIPE\\samr"
32 #define PIPE_WINREG "\\PIPE\\winreg"
33 #define PIPE_WKSSVC "\\PIPE\\wkssvc"
34 #define PIPE_NETLOGON "\\PIPE\\NETLOGON"
35 #define PIPE_NTLSA "\\PIPE\\ntlsa"
36 #define PIPE_NTSVCS "\\PIPE\\ntsvcs"
37 #define PIPE_LSASS "\\PIPE\\lsass"
38 #define PIPE_LSARPC "\\PIPE\\lsarpc"
39 #define PIPE_SPOOLSS "\\PIPE\\spoolss"
40 #define PIPE_NETDFS "\\PIPE\\netdfs"
41 #define PIPE_ECHO "\\PIPE\\rpcecho"
42 #define PIPE_SHUTDOWN "\\PIPE\\initshutdown"
43 #define PIPE_EPM "\\PIPE\\epmapper"
44 #define PIPE_SVCCTL "\\PIPE\\svcctl"
45 #define PIPE_EVENTLOG "\\PIPE\\eventlog"
46 #define PIPE_EPMAPPER "\\PIPE\\epmapper"
47 #define PIPE_DRSUAPI "\\PIPE\\drsuapi"
48
49 /*
50 * IMPORTANT!! If you update this structure, make sure to
51 * update the index #defines in smb.h.
52 */
53
54 static const struct pipe_id_info {
55 /* the names appear not to matter: the syntaxes _do_ matter */
56
57 const char *client_pipe;
58 const RPC_IFACE *abstr_syntax; /* this one is the abstract syntax id */
59 } pipe_names [] =
60 {
61 { PIPE_LSARPC, &ndr_table_lsarpc.syntax_id },
62 { PIPE_LSARPC, &ndr_table_dssetup.syntax_id },
63 { PIPE_SAMR, &ndr_table_samr.syntax_id },
64 { PIPE_NETLOGON, &ndr_table_netlogon.syntax_id },
65 { PIPE_SRVSVC, &ndr_table_srvsvc.syntax_id },
66 { PIPE_WKSSVC, &ndr_table_wkssvc.syntax_id },
67 { PIPE_WINREG, &ndr_table_winreg.syntax_id },
68 { PIPE_SPOOLSS, &syntax_spoolss },
69 { PIPE_NETDFS, &ndr_table_netdfs.syntax_id },
70 { PIPE_ECHO, &ndr_table_rpcecho.syntax_id },
71 { PIPE_SHUTDOWN, &ndr_table_initshutdown.syntax_id },
72 { PIPE_SVCCTL, &ndr_table_svcctl.syntax_id },
73 { PIPE_EVENTLOG, &ndr_table_eventlog.syntax_id },
74 { PIPE_NTSVCS, &ndr_table_ntsvcs.syntax_id },
75 { PIPE_EPMAPPER, &ndr_table_epmapper.syntax_id },
76 { PIPE_DRSUAPI, &ndr_table_drsuapi.syntax_id },
77 { NULL, NULL }
78 };
79
80 /****************************************************************************
81 Return the pipe name from the interface.
82 ****************************************************************************/
83
84 const char *cli_get_pipe_name_from_iface(TALLOC_CTX *mem_ctx,
85 const struct ndr_syntax_id *interface)
86 {
87 int i;
88 for (i = 0; pipe_names[i].client_pipe; i++) {
89 if (ndr_syntax_id_equal(pipe_names[i].abstr_syntax,
90 interface)) {
91 return &pipe_names[i].client_pipe[5];
92 }
93 }
94
95 /*
96 * Here we should ask \\epmapper, but for now our code is only
97 * interested in the known pipes mentioned in pipe_names[]
98 */
99
100 return NULL;
101 }
102
103 /********************************************************************
104 Map internal value to wire value.
105 ********************************************************************/
106
107 static int map_pipe_auth_type_to_rpc_auth_type(enum pipe_auth_type auth_type)
108 {
109 switch (auth_type) {
110
111 case PIPE_AUTH_TYPE_NONE:
112 return RPC_ANONYMOUS_AUTH_TYPE;
113
114 case PIPE_AUTH_TYPE_NTLMSSP:
115 return RPC_NTLMSSP_AUTH_TYPE;
116
117 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
118 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
119 return RPC_SPNEGO_AUTH_TYPE;
120
121 case PIPE_AUTH_TYPE_SCHANNEL:
122 return RPC_SCHANNEL_AUTH_TYPE;
123
124 case PIPE_AUTH_TYPE_KRB5:
125 return RPC_KRB5_AUTH_TYPE;
126
127 default:
128 DEBUG(0,("map_pipe_auth_type_to_rpc_type: unknown pipe "
129 "auth type %u\n",
130 (unsigned int)auth_type ));
131 break;
132 }
133 return -1;
134 }
135
136 /********************************************************************
137 Pipe description for a DEBUG
138 ********************************************************************/
139 static char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx, struct rpc_pipe_client *cli)
140 {
141 char *result;
142
143 switch (cli->transport_type) {
144 case NCACN_NP:
145 result = talloc_asprintf(mem_ctx, "host %s, pipe %s, "
146 "fnum 0x%x",
147 cli->desthost,
148 cli->trans.np.pipe_name,
149 (unsigned int)(cli->trans.np.fnum));
150 break;
151 case NCACN_IP_TCP:
152 case NCACN_UNIX_STREAM:
153 result = talloc_asprintf(mem_ctx, "host %s, fd %d",
154 cli->desthost, cli->trans.sock.fd);
155 break;
156 default:
157 result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
158 break;
159 }
160 SMB_ASSERT(result != NULL);
161 return result;
162 }
163
164 /********************************************************************
165 Rpc pipe call id.
166 ********************************************************************/
167
168 static uint32 get_rpc_call_id(void)
169 {
170 static uint32 call_id = 0;
171 return ++call_id;
172 }
173
174 /*
175 * Realloc pdu to have a least "size" bytes
176 */
177
178 static bool rpc_grow_buffer(prs_struct *pdu, size_t size)
179 {
180 size_t extra_size;
181
182 if (prs_data_size(pdu) >= size) {
183 return true;
184 }
185
186 extra_size = size - prs_data_size(pdu);
187
188 if (!prs_force_grow(pdu, extra_size)) {
189 DEBUG(0, ("rpc_grow_buffer: Failed to grow parse struct by "
190 "%d bytes.\n", (int)extra_size));
191 return false;
192 }
193
194 DEBUG(5, ("rpc_grow_buffer: grew buffer by %d bytes to %u\n",
195 (int)extra_size, prs_data_size(pdu)));
196 return true;
197 }
198
199
200 /*******************************************************************
201 Use SMBreadX to get rest of one fragment's worth of rpc data.
202 Reads the whole size or give an error message
203 ********************************************************************/
204
205 struct rpc_read_state {
206 struct event_context *ev;
207 struct rpc_pipe_client *cli;
208 char *data;
209 size_t size;
210 size_t num_read;
211 };
212
213 static void rpc_read_np_done(struct async_req *subreq);
214 static void rpc_read_sock_done(struct async_req *subreq);
215
216 static struct async_req *rpc_read_send(TALLOC_CTX *mem_ctx,
217 struct event_context *ev,
218 struct rpc_pipe_client *cli,
219 char *data, size_t size)
220 {
221 struct async_req *result, *subreq;
222 struct rpc_read_state *state;
223
224 if (!async_req_setup(mem_ctx, &result, &state,
225 struct rpc_read_state)) {
226 return NULL;
227 }
228 state->ev = ev;
229 state->cli = cli;
230 state->data = data;
231 state->size = size;
232 state->num_read = 0;
233
234 DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
235
236 if (cli->transport_type == NCACN_NP) {
237 subreq = cli_read_andx_send(
238 state, ev, cli->trans.np.cli,
239 cli->trans.np.fnum, 0, size);
240 if (subreq == NULL) {
241 DEBUG(10, ("cli_read_andx_send failed\n"));
242 goto fail;
243 }
244 subreq->async.fn = rpc_read_np_done;
245 subreq->async.priv = result;
246 return result;
247 }
248
249 if ((cli->transport_type == NCACN_IP_TCP)
250 || (cli->transport_type == NCACN_UNIX_STREAM)) {
251 subreq = recvall_send(state, ev, cli->trans.sock.fd,
252 data, size, 0);
253 if (subreq == NULL) {
254 DEBUG(10, ("recvall_send failed\n"));
255 goto fail;
256 }
257 subreq->async.fn = rpc_read_sock_done;
258 subreq->async.priv = result;
259 return result;
260 }
261
262 if (async_post_status(result, ev, NT_STATUS_INVALID_PARAMETER)) {
263 return result;
264 }
265 fail:
266 TALLOC_FREE(result);
267 return NULL;
268 }
269
270 static void rpc_read_np_done(struct async_req *subreq)
271 {
272 struct async_req *req = talloc_get_type_abort(
273 subreq->async.priv, struct async_req);
274 struct rpc_read_state *state = talloc_get_type_abort(
275 req->private_data, struct rpc_read_state);
276 NTSTATUS status;
277 ssize_t received;
278 uint8_t *rcvbuf;
279
280 status = cli_read_andx_recv(subreq, &received, &rcvbuf);
281 /*
282 * We can't TALLOC_FREE(subreq) as usual here, as rcvbuf still is a
283 * child of that.
284 */
285 if (NT_STATUS_EQUAL(status, NT_STATUS_BUFFER_TOO_SMALL)) {
286 status = NT_STATUS_OK;
287 }
288 if (!NT_STATUS_IS_OK(status)) {
289 TALLOC_FREE(subreq);
290 async_req_error(req, status);
291 return;
292 }
293
294 memcpy(state->data + state->num_read, rcvbuf, received);
295 TALLOC_FREE(subreq);
296
297 state->num_read += received;
298
299 if (state->num_read == state->size) {
300 async_req_done(req);
301 return;
302 }
303
304 subreq = cli_read_andx_send(
305 state, state->ev, state->cli->trans.np.cli,
306 state->cli->trans.np.fnum, 0,
307 state->size - state->num_read);
308
309 if (async_req_nomem(subreq, req)) {
310 return;
311 }
312
313 subreq->async.fn = rpc_read_np_done;
314 subreq->async.priv = req;
315 }
316
317 static void rpc_read_sock_done(struct async_req *subreq)
318 {
319 struct async_req *req = talloc_get_type_abort(
320 subreq->async.priv, struct async_req);
321 NTSTATUS status;
322
323 status = recvall_recv(subreq);
324 TALLOC_FREE(subreq);
325 if (!NT_STATUS_IS_OK(status)) {
326 async_req_error(req, status);
327 return;
328 }
329
330 async_req_done(req);
331 }
332
333 static NTSTATUS rpc_read_recv(struct async_req *req)
334 {
335 return async_req_simple_recv(req);
336 }
337
338 struct rpc_write_state {
339 struct event_context *ev;
340 struct rpc_pipe_client *cli;
341 const char *data;
342 size_t size;
343 size_t num_written;
344 };
345
346 static void rpc_write_np_done(struct async_req *subreq);
347 static void rpc_write_sock_done(struct async_req *subreq);
348
349 static struct async_req *rpc_write_send(TALLOC_CTX *mem_ctx,
350 struct event_context *ev,
351 struct rpc_pipe_client *cli,
352 const char *data, size_t size)
353 {
354 struct async_req *result, *subreq;
355 struct rpc_write_state *state;
356
357 if (!async_req_setup(mem_ctx, &result, &state,
358 struct rpc_write_state)) {
359 return NULL;
360 }
361 state->ev = ev;
362 state->cli = cli;
363 state->data = data;
364 state->size = size;
365 state->num_written = 0;
366
367 DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
368
369 if (cli->transport_type == NCACN_NP) {
370 subreq = cli_write_andx_send(
371 state, ev, cli->trans.np.cli,
372 cli->trans.np.fnum, 8, /* 8 means message mode. */
373 (uint8_t *)data, 0, size);
374 if (subreq == NULL) {
375 DEBUG(10, ("cli_write_andx_send failed\n"));
376 goto fail;
377 }
378 subreq->async.fn = rpc_write_np_done;
379 subreq->async.priv = result;
380 return result;
381 }
382
383 if ((cli->transport_type == NCACN_IP_TCP)
384 || (cli->transport_type == NCACN_UNIX_STREAM)) {
385 subreq = sendall_send(state, ev, cli->trans.sock.fd,
386 data, size, 0);
387 if (subreq == NULL) {
388 DEBUG(10, ("sendall_send failed\n"));
389 goto fail;
390 }
391 subreq->async.fn = rpc_write_sock_done;
392 subreq->async.priv = result;
393 return result;
394 }
395
396 if (async_post_status(result, ev, NT_STATUS_INVALID_PARAMETER)) {
397 return result;
398 }
399 fail:
400 TALLOC_FREE(result);
401 return NULL;
402 }
403
404 static void rpc_write_np_done(struct async_req *subreq)
405 {
406 struct async_req *req = talloc_get_type_abort(
407 subreq->async.priv, struct async_req);
408 struct rpc_write_state *state = talloc_get_type_abort(
409 req->private_data, struct rpc_write_state);
410 NTSTATUS status;
411 size_t written;
412
413 status = cli_write_andx_recv(subreq, &written);
414 TALLOC_FREE(subreq);
415 if (!NT_STATUS_IS_OK(status)) {
416 async_req_error(req, status);
417 return;
418 }
419
420 state->num_written += written;
421
422 if (state->num_written == state->size) {
423 async_req_done(req);
424 return;
425 }
426
427 subreq = cli_write_andx_send(
428 state, state->ev, state->cli->trans.np.cli,
429 state->cli->trans.np.fnum, 8,
430 (uint8_t *)(state->data + state->num_written),
431 0, state->size - state->num_written);
432
433 if (async_req_nomem(subreq, req)) {
434 return;
435 }
436
437 subreq->async.fn = rpc_write_np_done;
438 subreq->async.priv = req;
439 }
440
441 static void rpc_write_sock_done(struct async_req *subreq)
442 {
443 struct async_req *req = talloc_get_type_abort(
444 subreq->async.priv, struct async_req);
445 NTSTATUS status;
446
447 status = sendall_recv(subreq);
448 TALLOC_FREE(subreq);
449 if (!NT_STATUS_IS_OK(status)) {
450 async_req_error(req, status);
451 return;
452 }
453
454 async_req_done(req);
455 }
456
457 static NTSTATUS rpc_write_recv(struct async_req *req)
458 {
459 return async_req_simple_recv(req);
460 }
461
462
463 static NTSTATUS parse_rpc_header(struct rpc_pipe_client *cli,
464 struct rpc_hdr_info *prhdr,
465 prs_struct *pdu)
466 {
467 /*
468 * This next call sets the endian bit correctly in current_pdu. We
469 * will propagate this to rbuf later.
470 */
471
472 if(!smb_io_rpc_hdr("rpc_hdr ", prhdr, pdu, 0)) {
473 DEBUG(0, ("get_current_pdu: Failed to unmarshall RPC_HDR.\n"));
474 return NT_STATUS_BUFFER_TOO_SMALL;
475 }
476
477 if (prhdr->frag_len > cli->max_recv_frag) {
478 DEBUG(0, ("cli_pipe_get_current_pdu: Server sent fraglen %d,"
479 " we only allow %d\n", (int)prhdr->frag_len,
480 (int)cli->max_recv_frag));
481 return NT_STATUS_BUFFER_TOO_SMALL;
482 }
483
484 return NT_STATUS_OK;
485 }
486
487 /****************************************************************************
488 Try and get a PDU's worth of data from current_pdu. If not, then read more
489 from the wire.
490 ****************************************************************************/
491
492 struct get_complete_frag_state {
493 struct event_context *ev;
494 struct rpc_pipe_client *cli;
495 struct rpc_hdr_info *prhdr;
496 prs_struct *pdu;
497 };
498
499 static void get_complete_frag_got_header(struct async_req *subreq);
500 static void get_complete_frag_got_rest(struct async_req *subreq);
501
502 static struct async_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
503 struct event_context *ev,
504 struct rpc_pipe_client *cli,
505 struct rpc_hdr_info *prhdr,
506 prs_struct *pdu)
507 {
508 struct async_req *result, *subreq;
509 struct get_complete_frag_state *state;
510 uint32_t pdu_len;
511 NTSTATUS status;
512
513 if (!async_req_setup(mem_ctx, &result, &state,
514 struct get_complete_frag_state)) {
515 return NULL;
516 }
517 state->ev = ev;
518 state->cli = cli;
519 state->prhdr = prhdr;
520 state->pdu = pdu;
521
522 pdu_len = prs_data_size(pdu);
523 if (pdu_len < RPC_HEADER_LEN) {
524 if (!rpc_grow_buffer(pdu, RPC_HEADER_LEN)) {
525 status = NT_STATUS_NO_MEMORY;
526 goto post_status;
527 }
528 subreq = rpc_read_send(state, state->ev, state->cli,
529 prs_data_p(state->pdu) + pdu_len,
530 RPC_HEADER_LEN - pdu_len);
531 if (subreq == NULL) {
532 status = NT_STATUS_NO_MEMORY;
533 goto post_status;
534 }
535 subreq->async.fn = get_complete_frag_got_header;
536 subreq->async.priv = result;
537 return result;
538 }
539
540 status = parse_rpc_header(cli, prhdr, pdu);
541 if (!NT_STATUS_IS_OK(status)) {
542 goto post_status;
543 }
544
545 /*
546 * Ensure we have frag_len bytes of data.
547 */
548 if (pdu_len < prhdr->frag_len) {
549 if (!rpc_grow_buffer(pdu, prhdr->frag_len)) {
550 status = NT_STATUS_NO_MEMORY;
551 goto post_status;
552 }
553 subreq = rpc_read_send(state, state->ev, state->cli,
554 prs_data_p(pdu) + pdu_len,
555 prhdr->frag_len - pdu_len);
556 if (subreq == NULL) {
557 status = NT_STATUS_NO_MEMORY;
558 goto post_status;
559 }
560 subreq->async.fn = get_complete_frag_got_rest;
561 subreq->async.priv = result;
562 return result;
563 }
564
565 status = NT_STATUS_OK;
566 post_status:
567 if (async_post_status(result, ev, status)) {
568 return result;
569 }
570 TALLOC_FREE(result);
571 return NULL;
572 }
573
574 static void get_complete_frag_got_header(struct async_req *subreq)
575 {
576 struct async_req *req = talloc_get_type_abort(
577 subreq->async.priv, struct async_req);
578 struct get_complete_frag_state *state = talloc_get_type_abort(
579 req->private_data, struct get_complete_frag_state);
580 NTSTATUS status;
581
582 status = rpc_read_recv(subreq);
583 TALLOC_FREE(subreq);
584 if (!NT_STATUS_IS_OK(status)) {
585 async_req_error(req, status);
586 return;
587 }
588
589 status = parse_rpc_header(state->cli, state->prhdr, state->pdu);
590 if (!NT_STATUS_IS_OK(status)) {
591 async_req_error(req, status);
592 return;
593 }
594
595 if (!rpc_grow_buffer(state->pdu, state->prhdr->frag_len)) {
596 async_req_error(req, NT_STATUS_NO_MEMORY);
597 return;
598 }
599
600 /*
601 * We're here in this piece of code because we've read exactly
602 * RPC_HEADER_LEN bytes into state->pdu.
603 */
604
605 subreq = rpc_read_send(state, state->ev, state->cli,
606 prs_data_p(state->pdu) + RPC_HEADER_LEN,
607 state->prhdr->frag_len - RPC_HEADER_LEN);
608 if (async_req_nomem(subreq, req)) {
609 return;
610 }
611 subreq->async.fn = get_complete_frag_got_rest;
612 subreq->async.priv = req;
613 }
614
615 static void get_complete_frag_got_rest(struct async_req *subreq)
616 {
617 struct async_req *req = talloc_get_type_abort(
618 subreq->async.priv, struct async_req);
619 NTSTATUS status;
620
621 status = rpc_read_recv(subreq);
622 TALLOC_FREE(subreq);
623 if (!NT_STATUS_IS_OK(status)) {
624 async_req_error(req, status);
625 return;
626 }
627 async_req_done(req);
628 }
629
630 static NTSTATUS get_complete_frag_recv(struct async_req *req)
631 {
632 return async_req_simple_recv(req);
633 }
634
635 /****************************************************************************
636 NTLMSSP specific sign/seal.
637 Virtually identical to rpc_server/srv_pipe.c:api_pipe_ntlmssp_auth_process.
638 In fact I should probably abstract these into identical pieces of code... JRA.
639 ****************************************************************************/
640
641 static NTSTATUS cli_pipe_verify_ntlmssp(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
642 prs_struct *current_pdu,
643 uint8 *p_ss_padding_len)
644 {
645 RPC_HDR_AUTH auth_info;
646 uint32 save_offset = prs_offset(current_pdu);
647 uint32 auth_len = prhdr->auth_len;
648 NTLMSSP_STATE *ntlmssp_state = cli->auth->a_u.ntlmssp_state;
649 unsigned char *data = NULL;
650 size_t data_len;
651 unsigned char *full_packet_data = NULL;
652 size_t full_packet_data_len;
653 DATA_BLOB auth_blob;
654 NTSTATUS status;
655
656 if (cli->auth->auth_level == PIPE_AUTH_LEVEL_NONE
657 || cli->auth->auth_level == PIPE_AUTH_LEVEL_CONNECT) {
658 return NT_STATUS_OK;
659 }
660
661 if (!ntlmssp_state) {
662 return NT_STATUS_INVALID_PARAMETER;
663 }
664
665 /* Ensure there's enough data for an authenticated response. */
666 if ((auth_len > RPC_MAX_SIGN_SIZE) ||
667 (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) {
668 DEBUG(0,("cli_pipe_verify_ntlmssp: auth_len %u is too large.\n",
669 (unsigned int)auth_len ));
670 return NT_STATUS_BUFFER_TOO_SMALL;
671 }
672
673 /*
674 * We need the full packet data + length (minus auth stuff) as well as the packet data + length
675 * after the RPC header.
676 * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
677 * functions as NTLMv2 checks the rpc headers also.
678 */
679
680 data = (unsigned char *)(prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN);
681 data_len = (size_t)(prhdr->frag_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len);
682
683 full_packet_data = (unsigned char *)prs_data_p(current_pdu);
684 full_packet_data_len = prhdr->frag_len - auth_len;
685
686 /* Pull the auth header and the following data into a blob. */
687 if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) {
688 DEBUG(0,("cli_pipe_verify_ntlmssp: cannot move offset to %u.\n",
689 (unsigned int)RPC_HEADER_LEN + (unsigned int)RPC_HDR_RESP_LEN + (unsigned int)data_len ));
690 return NT_STATUS_BUFFER_TOO_SMALL;
691 }
692
693 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) {
694 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unmarshall RPC_HDR_AUTH.\n"));
695 return NT_STATUS_BUFFER_TOO_SMALL;
696 }
697
698 auth_blob.data = (unsigned char *)prs_data_p(current_pdu) + prs_offset(current_pdu);
699 auth_blob.length = auth_len;
700
701 switch (cli->auth->auth_level) {
702 case PIPE_AUTH_LEVEL_PRIVACY:
703 /* Data is encrypted. */
704 status = ntlmssp_unseal_packet(ntlmssp_state,
705 data, data_len,
706 full_packet_data,
707 full_packet_data_len,
708 &auth_blob);
709 if (!NT_STATUS_IS_OK(status)) {
710 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unseal "
711 "packet from %s. Error was %s.\n",
712 rpccli_pipe_txt(debug_ctx(), cli),
713 nt_errstr(status) ));
714 return status;
715 }
716 break;
717 case PIPE_AUTH_LEVEL_INTEGRITY:
718 /* Data is signed. */
719 status = ntlmssp_check_packet(ntlmssp_state,
720 data, data_len,
721 full_packet_data,
722 full_packet_data_len,
723 &auth_blob);
724 if (!NT_STATUS_IS_OK(status)) {
725 DEBUG(0,("cli_pipe_verify_ntlmssp: check signing failed on "
726 "packet from %s. Error was %s.\n",
727 rpccli_pipe_txt(debug_ctx(), cli),
728 nt_errstr(status) ));
729 return status;
730 }
731 break;
732 default:
733 DEBUG(0, ("cli_pipe_verify_ntlmssp: unknown internal "
734 "auth level %d\n", cli->auth->auth_level));
735 return NT_STATUS_INVALID_INFO_CLASS;
736 }
737
738 /*
739 * Return the current pointer to the data offset.
740 */
741
742 if(!prs_set_offset(current_pdu, save_offset)) {
743 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
744 (unsigned int)save_offset ));
745 return NT_STATUS_BUFFER_TOO_SMALL;
746 }
747
748 /*
749 * Remember the padding length. We must remove it from the real data
750 * stream once the sign/seal is done.
751 */
752
753 *p_ss_padding_len = auth_info.auth_pad_len;
754
755 return NT_STATUS_OK;
756 }
757
758 /****************************************************************************
759 schannel specific sign/seal.
760 ****************************************************************************/
761
762 static NTSTATUS cli_pipe_verify_schannel(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
763 prs_struct *current_pdu,
764 uint8 *p_ss_padding_len)
765 {
766 RPC_HDR_AUTH auth_info;
767 RPC_AUTH_SCHANNEL_CHK schannel_chk;
768 uint32 auth_len = prhdr->auth_len;
769 uint32 save_offset = prs_offset(current_pdu);
770 struct schannel_auth_struct *schannel_auth =
771 cli->auth->a_u.schannel_auth;
772 uint32 data_len;
773
774 if (cli->auth->auth_level == PIPE_AUTH_LEVEL_NONE
775 || cli->auth->auth_level == PIPE_AUTH_LEVEL_CONNECT) {
776 return NT_STATUS_OK;
777 }
778
779 if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
780 DEBUG(0,("cli_pipe_verify_schannel: auth_len %u.\n", (unsigned int)auth_len ));
781 return NT_STATUS_INVALID_PARAMETER;
782 }
783
784 if (!schannel_auth) {
785 return NT_STATUS_INVALID_PARAMETER;
786 }
787
788 /* Ensure there's enough data for an authenticated response. */
789 if ((auth_len > RPC_MAX_SIGN_SIZE) ||
790 (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) {
791 DEBUG(0,("cli_pipe_verify_schannel: auth_len %u is too large.\n",
792 (unsigned int)auth_len ));
793 return NT_STATUS_INVALID_PARAMETER;
794 }
795
796 data_len = prhdr->frag_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len;
797
798 if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) {
799 DEBUG(0,("cli_pipe_verify_schannel: cannot move offset to %u.\n",
800 (unsigned int)RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len ));
801 return NT_STATUS_BUFFER_TOO_SMALL;
802 }
803
804 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) {
805 DEBUG(0,("cli_pipe_verify_schannel: failed to unmarshall RPC_HDR_AUTH.\n"));
806 return NT_STATUS_BUFFER_TOO_SMALL;
807 }
808
809 if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
810 DEBUG(0,("cli_pipe_verify_schannel: Invalid auth info %d on schannel\n",
811 auth_info.auth_type));
812 return NT_STATUS_BUFFER_TOO_SMALL;
813 }
814
815 if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
816 &schannel_chk, current_pdu, 0)) {
817 DEBUG(0,("cli_pipe_verify_schannel: failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
818 return NT_STATUS_BUFFER_TOO_SMALL;
819 }
820
821 if (!schannel_decode(schannel_auth,
822 cli->auth->auth_level,
823 SENDER_IS_ACCEPTOR,
824 &schannel_chk,
825 prs_data_p(current_pdu)+RPC_HEADER_LEN+RPC_HDR_RESP_LEN,
826 data_len)) {
827 DEBUG(3,("cli_pipe_verify_schannel: failed to decode PDU "
828 "Connection to %s.\n",
829 rpccli_pipe_txt(debug_ctx(), cli)));
830 return NT_STATUS_INVALID_PARAMETER;
831 }
832
833 /* The sequence number gets incremented on both send and receive. */
834 schannel_auth->seq_num++;
835
836 /*
837 * Return the current pointer to the data offset.
838 */
839
840 if(!prs_set_offset(current_pdu, save_offset)) {
841 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
842 (unsigned int)save_offset ));
843 return NT_STATUS_BUFFER_TOO_SMALL;
844 }
845
846 /*
847 * Remember the padding length. We must remove it from the real data
848 * stream once the sign/seal is done.
849 */
850
851 *p_ss_padding_len = auth_info.auth_pad_len;
852
853 return NT_STATUS_OK;
854 }
855
856 /****************************************************************************
857 Do the authentication checks on an incoming pdu. Check sign and unseal etc.
858 ****************************************************************************/
859
860 static NTSTATUS cli_pipe_validate_rpc_response(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
861 prs_struct *current_pdu,
862 uint8 *p_ss_padding_len)
863 {
864 NTSTATUS ret = NT_STATUS_OK;
865
866 /* Paranioa checks for auth_len. */
867 if (prhdr->auth_len) {
868 if (prhdr->auth_len > prhdr->frag_len) {
869 return NT_STATUS_INVALID_PARAMETER;
870 }
871
872 if (prhdr->auth_len + (unsigned int)RPC_HDR_AUTH_LEN < prhdr->auth_len ||
873 prhdr->auth_len + (unsigned int)RPC_HDR_AUTH_LEN < (unsigned int)RPC_HDR_AUTH_LEN) {
874 /* Integer wrap attempt. */
875 return NT_STATUS_INVALID_PARAMETER;
876 }
877 }
878
879 /*
880 * Now we have a complete RPC request PDU fragment, try and verify any auth data.
881 */
882
883 switch(cli->auth->auth_type) {
884 case PIPE_AUTH_TYPE_NONE:
885 if (prhdr->auth_len) {
886 DEBUG(3, ("cli_pipe_validate_rpc_response: "
887 "Connection to %s - got non-zero "
888 "auth len %u.\n",
889 rpccli_pipe_txt(debug_ctx(), cli),
890 (unsigned int)prhdr->auth_len ));
891 return NT_STATUS_INVALID_PARAMETER;
892 }
893 break;
894
895 case PIPE_AUTH_TYPE_NTLMSSP:
896 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
897 ret = cli_pipe_verify_ntlmssp(cli, prhdr, current_pdu, p_ss_padding_len);
898 if (!NT_STATUS_IS_OK(ret)) {
899 return ret;
900 }
901 break;
902
903 case PIPE_AUTH_TYPE_SCHANNEL:
904 ret = cli_pipe_verify_schannel(cli, prhdr, current_pdu, p_ss_padding_len);
905 if (!NT_STATUS_IS_OK(ret)) {
906 return ret;
907 }
908 break;
909
910 case PIPE_AUTH_TYPE_KRB5:
911 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
912 default:
913 DEBUG(3, ("cli_pipe_validate_rpc_response: Connection "
914 "to %s - unknown internal auth type %u.\n",
915 rpccli_pipe_txt(debug_ctx(), cli),
916 cli->auth->auth_type ));
917 return NT_STATUS_INVALID_INFO_CLASS;
918 }
919
920 return NT_STATUS_OK;
921 }
922
923 /****************************************************************************
924 Do basic authentication checks on an incoming pdu.
925 ****************************************************************************/
926
927 static NTSTATUS cli_pipe_validate_current_pdu(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
928 prs_struct *current_pdu,
929 uint8 expected_pkt_type,
930 char **ppdata,
931 uint32 *pdata_len,
932 prs_struct *return_data)
933 {
934
935 NTSTATUS ret = NT_STATUS_OK;
936 uint32 current_pdu_len = prs_data_size(current_pdu);
937
938 if (current_pdu_len != prhdr->frag_len) {
939 DEBUG(5,("cli_pipe_validate_current_pdu: incorrect pdu length %u, expected %u\n",
940 (unsigned int)current_pdu_len, (unsigned int)prhdr->frag_len ));
941 return NT_STATUS_INVALID_PARAMETER;
942 }
943
944 /*
945 * Point the return values at the real data including the RPC
946 * header. Just in case the caller wants it.
947 */
948 *ppdata = prs_data_p(current_pdu);
949 *pdata_len = current_pdu_len;
950
951 /* Ensure we have the correct type. */
952 switch (prhdr->pkt_type) {
953 case RPC_ALTCONTRESP:
954 case RPC_BINDACK:
955
956 /* Alter context and bind ack share the same packet definitions. */
957 break;
958
959
960 case RPC_RESPONSE:
961 {
962 RPC_HDR_RESP rhdr_resp;
963 uint8 ss_padding_len = 0;
964
965 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, current_pdu, 0)) {
966 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_RESP.\n"));
967 return NT_STATUS_BUFFER_TOO_SMALL;
968 }
969
970 /* Here's where we deal with incoming sign/seal. */
971 ret = cli_pipe_validate_rpc_response(cli, prhdr,
972 current_pdu, &ss_padding_len);
973 if (!NT_STATUS_IS_OK(ret)) {
974 return ret;
975 }
976
977 /* Point the return values at the NDR data. Remember to remove any ss padding. */
978 *ppdata = prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
979
980 if (current_pdu_len < RPC_HEADER_LEN + RPC_HDR_RESP_LEN + ss_padding_len) {
981 return NT_STATUS_BUFFER_TOO_SMALL;
982 }
983
984 *pdata_len = current_pdu_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - ss_padding_len;
985
986 /* Remember to remove the auth footer. */
987 if (prhdr->auth_len) {
988 /* We've already done integer wrap tests on auth_len in
989 cli_pipe_validate_rpc_response(). */
990 if (*pdata_len < RPC_HDR_AUTH_LEN + prhdr->auth_len) {
991 return NT_STATUS_BUFFER_TOO_SMALL;
992 }
993 *pdata_len -= (RPC_HDR_AUTH_LEN + prhdr->auth_len);
994 }
995
996 DEBUG(10,("cli_pipe_validate_current_pdu: got pdu len %u, data_len %u, ss_len %u\n",
997 current_pdu_len, *pdata_len, ss_padding_len ));
998
999 /*
1000 * If this is the first reply, and the allocation hint is reasonably, try and
1001 * set up the return_data parse_struct to the correct size.
1002 */
1003
1004 if ((prs_data_size(return_data) == 0) && rhdr_resp.alloc_hint && (rhdr_resp.alloc_hint < 15*1024*1024)) {
1005 if (!prs_set_buffer_size(return_data, rhdr_resp.alloc_hint)) {
1006 DEBUG(0,("cli_pipe_validate_current_pdu: reply alloc hint %u "
1007 "too large to allocate\n",
1008 (unsigned int)rhdr_resp.alloc_hint ));
1009 return NT_STATUS_NO_MEMORY;
1010 }
1011 }
1012
1013 break;
1014 }
1015
1016 case RPC_BINDNACK:
1017 DEBUG(1, ("cli_pipe_validate_current_pdu: Bind NACK "
1018 "received from %s!\n",
1019 rpccli_pipe_txt(debug_ctx(), cli)));
1020 /* Use this for now... */
1021 return NT_STATUS_NETWORK_ACCESS_DENIED;
1022
1023 case RPC_FAULT:
1024 {
1025 RPC_HDR_RESP rhdr_resp;
1026 RPC_HDR_FAULT fault_resp;
1027
1028 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, current_pdu, 0)) {
1029 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_RESP.\n"));
1030 return NT_STATUS_BUFFER_TOO_SMALL;
1031 }
1032
1033 if(!smb_io_rpc_hdr_fault("fault", &fault_resp, current_pdu, 0)) {
1034 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_FAULT.\n"));
1035 return NT_STATUS_BUFFER_TOO_SMALL;
1036 }
1037
1038 DEBUG(1, ("cli_pipe_validate_current_pdu: RPC fault "
1039 "code %s received from %s!\n",
1040 dcerpc_errstr(debug_ctx(), NT_STATUS_V(fault_resp.status)),
1041 rpccli_pipe_txt(debug_ctx(), cli)));
1042 if (NT_STATUS_IS_OK(fault_resp.status)) {
1043 return NT_STATUS_UNSUCCESSFUL;
1044 } else {
1045 return fault_resp.status;
1046 }
1047 }
1048
1049 default:
1050 DEBUG(0, ("cli_pipe_validate_current_pdu: unknown packet type %u received "
1051 "from %s!\n",
1052 (unsigned int)prhdr->pkt_type,
1053 rpccli_pipe_txt(debug_ctx(), cli)));
1054 return NT_STATUS_INVALID_INFO_CLASS;
1055 }
1056
1057 if (prhdr->pkt_type != expected_pkt_type) {
1058 DEBUG(3, ("cli_pipe_validate_current_pdu: Connection to %s "
1059 "got an unexpected RPC packet type - %u, not %u\n",
1060 rpccli_pipe_txt(debug_ctx(), cli),
1061 prhdr->pkt_type,
1062 expected_pkt_type));
1063 return NT_STATUS_INVALID_INFO_CLASS;
1064 }
1065
1066 /* Do this just before return - we don't want to modify any rpc header
1067 data before now as we may have needed to do cryptographic actions on
1068 it before. */
1069
1070 if ((prhdr->pkt_type == RPC_BINDACK) && !(prhdr->flags & RPC_FLG_LAST)) {
1071 DEBUG(5,("cli_pipe_validate_current_pdu: bug in server (AS/U?), "
1072 "setting fragment first/last ON.\n"));
1073 prhdr->flags |= RPC_FLG_FIRST|RPC_FLG_LAST;
1074 }
1075
1076 return NT_STATUS_OK;
1077 }
1078
1079 /****************************************************************************
1080 Ensure we eat the just processed pdu from the current_pdu prs_struct.
1081 Normally the frag_len and buffer size will match, but on the first trans
1082 reply there is a theoretical chance that buffer size > frag_len, so we must
1083 deal with that.
1084 ****************************************************************************/
1085
1086 static NTSTATUS cli_pipe_reset_current_pdu(struct rpc_pipe_client *cli, RPC_HDR *prhdr, prs_struct *current_pdu)
1087 {
1088 uint32 current_pdu_len = prs_data_size(current_pdu);
1089
1090 if (current_pdu_len < prhdr->frag_len) {
1091 return NT_STATUS_BUFFER_TOO_SMALL;
1092 }
1093
1094 /* Common case. */
1095 if (current_pdu_len == (uint32)prhdr->frag_len) {
1096 prs_mem_free(current_pdu);
1097 prs_init_empty(current_pdu, prs_get_mem_context(current_pdu), UNMARSHALL);
1098 /* Make current_pdu dynamic with no memory. */
1099 prs_give_memory(current_pdu, 0, 0, True);
1100 return NT_STATUS_OK;
1101 }
1102
1103 /*
1104 * Oh no ! More data in buffer than we processed in current pdu.
1105 * Cheat. Move the data down and shrink the buffer.
1106 */
1107
1108 memcpy(prs_data_p(current_pdu), prs_data_p(current_pdu) + prhdr->frag_len,
1109 current_pdu_len - prhdr->frag_len);
1110
1111 /* Remember to set the read offset back to zero. */
1112 prs_set_offset(current_pdu, 0);
1113
1114 /* Shrink the buffer. */
1115 if (!prs_set_buffer_size(current_pdu, current_pdu_len - prhdr->frag_len)) {
1116 return NT_STATUS_BUFFER_TOO_SMALL;
1117 }
1118
1119 return NT_STATUS_OK;
1120 }
1121
1122 /****************************************************************************
1123 Call a remote api on an arbitrary pipe. takes param, data and setup buffers.
1124 ****************************************************************************/
1125
1126 struct cli_api_pipe_state {
1127 struct event_context *ev;
1128 struct rpc_pipe_client *cli;
1129 uint32_t max_rdata_len;
1130 uint8_t *rdata;
1131 uint32_t rdata_len;
1132 };
1133
1134 static void cli_api_pipe_np_trans_done(struct async_req *subreq);
1135 static void cli_api_pipe_sock_send_done(struct async_req *subreq);
1136 static void cli_api_pipe_sock_read_done(struct async_req *subreq);
1137
1138 static struct async_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
1139 struct event_context *ev,
1140 struct rpc_pipe_client *cli,
1141 uint8_t *data, size_t data_len,
1142 uint32_t max_rdata_len)
1143 {
1144 struct async_req *result, *subreq;
1145 struct cli_api_pipe_state *state;
1146 NTSTATUS status;
1147
1148 if (!async_req_setup(mem_ctx, &result, &state,
1149 struct cli_api_pipe_state)) {
1150 return NULL;
1151 }
1152 state->ev = ev;
1153 state->cli = cli;
1154 state->max_rdata_len = max_rdata_len;
1155
1156 if (state->max_rdata_len < RPC_HEADER_LEN) {
1157 /*
1158 * For a RPC reply we always need at least RPC_HEADER_LEN
1159 * bytes. We check this here because we will receive
1160 * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
1161 */
1162 status = NT_STATUS_INVALID_PARAMETER;
1163 goto post_status;
1164 }
1165
1166 if (cli->transport_type == NCACN_NP) {
1167
1168 uint16_t setup[2];
1169 SSVAL(setup+0, 0, TRANSACT_DCERPCCMD);
1170 SSVAL(setup+1, 0, cli->trans.np.fnum);
1171
1172 subreq = cli_trans_send(
1173 state, ev, cli->trans.np.cli, SMBtrans,
1174 "\\PIPE\\", 0, 0, 0, setup, 2, 0,
1175 NULL, 0, 0, data, data_len, max_rdata_len);
1176 if (subreq == NULL) {
1177 status = NT_STATUS_NO_MEMORY;
1178 goto post_status;
1179 }
1180 subreq->async.fn = cli_api_pipe_np_trans_done;
1181 subreq->async.priv = result;
1182 return result;
1183 }
1184
1185 if ((cli->transport_type == NCACN_IP_TCP)
1186 || (cli->transport_type == NCACN_UNIX_STREAM)) {
1187 subreq = sendall_send(state, ev, cli->trans.sock.fd,
1188 data, data_len, 0);
1189 if (subreq == NULL) {
1190 status = NT_STATUS_NO_MEMORY;
1191 goto post_status;
1192 }
1193 subreq->async.fn = cli_api_pipe_sock_send_done;
1194 subreq->async.priv = result;
1195 return result;
1196 }
1197
1198 status = NT_STATUS_INVALID_PARAMETER;
1199
1200 post_status:
1201 if (async_post_status(result, ev, status)) {
1202 return result;
1203 }
1204 TALLOC_FREE(result);
1205 return NULL;
1206 }
1207
1208 static void cli_api_pipe_np_trans_done(struct async_req *subreq)
1209 {
1210 struct async_req *req = talloc_get_type_abort(
1211 subreq->async.priv, struct async_req);
1212 struct cli_api_pipe_state *state = talloc_get_type_abort(
1213 req->private_data, struct cli_api_pipe_state);
1214 NTSTATUS status;
1215
1216 status = cli_trans_recv(subreq, state, NULL, NULL, NULL, NULL,
1217 &state->rdata, &state->rdata_len);
1218 TALLOC_FREE(subreq);
1219 if (!NT_STATUS_IS_OK(status)) {
1220 async_req_error(req, status);
1221 return;
1222 }
1223 async_req_done(req);
1224 }
1225
1226 static void cli_api_pipe_sock_send_done(struct async_req *subreq)
1227 {
1228 struct async_req *req = talloc_get_type_abort(
1229 subreq->async.priv, struct async_req);
1230 struct cli_api_pipe_state *state = talloc_get_type_abort(
1231 req->private_data, struct cli_api_pipe_state);
1232 NTSTATUS status;
1233
1234 status = sendall_recv(subreq);
1235 TALLOC_FREE(subreq);
1236 if (!NT_STATUS_IS_OK(status)) {
1237 async_req_error(req, status);
1238 return;
1239 }
1240
1241 state->rdata = TALLOC_ARRAY(state, uint8_t, RPC_HEADER_LEN);
1242 if (async_req_nomem(state->rdata, req)) {
1243 return;
1244 }
1245 state->rdata_len = RPC_HEADER_LEN;
1246
1247 subreq = recvall_send(state, state->ev, state->cli->trans.sock.fd,
1248 state->rdata, RPC_HEADER_LEN, 0);
1249 if (async_req_nomem(subreq, req)) {
1250 return;
1251 }
1252 subreq->async.fn = cli_api_pipe_sock_read_done;
1253 subreq->async.priv = req;
1254 }
1255
1256 static void cli_api_pipe_sock_read_done(struct async_req *subreq)
1257 {
1258 struct async_req *req = talloc_get_type_abort(
1259 subreq->async.priv, struct async_req);
1260 NTSTATUS status;
1261
1262 status = recvall_recv(subreq);
1263 TALLOC_FREE(subreq);
1264 if (!NT_STATUS_IS_OK(status)) {
1265 async_req_error(req, status);
1266 return;
1267 }
1268 async_req_done(req);
1269 }
1270
1271 static NTSTATUS cli_api_pipe_recv(struct async_req *req, TALLOC_CTX *mem_ctx,
1272 uint8_t **prdata, uint32_t *prdata_len)
1273 {
1274 struct cli_api_pipe_state *state = talloc_get_type_abort(
1275 req->private_data, struct cli_api_pipe_state);
1276 NTSTATUS status;
1277
1278 if (async_req_is_error(req, &status)) {
1279 return status;
1280 }
1281
1282 *prdata = talloc_move(mem_ctx, &state->rdata);
1283 *prdata_len = state->rdata_len;
1284 return NT_STATUS_OK;
1285 }
1286
1287 /****************************************************************************
1288 Send data on an rpc pipe via trans. The prs_struct data must be the last
1289 pdu fragment of an NDR data stream.
1290
1291 Receive response data from an rpc pipe, which may be large...
1292
1293 Read the first fragment: unfortunately have to use SMBtrans for the first
1294 bit, then SMBreadX for subsequent bits.
1295
1296 If first fragment received also wasn't the last fragment, continue
1297 getting fragments until we _do_ receive the last fragment.
1298
1299 Request/Response PDU's look like the following...
1300
1301 |<------------------PDU len----------------------------------------------->|
1302 |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
1303
1304 +------------+-----------------+-------------+---------------+-------------+
1305 | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR | AUTH DATA |
1306 +------------+-----------------+-------------+---------------+-------------+
1307
1308 Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
1309 signing & sealing being negotiated.
1310
1311 ****************************************************************************/
1312
1313 struct rpc_api_pipe_state {
1314 struct event_context *ev;
1315 struct rpc_pipe_client *cli;
1316 uint8_t expected_pkt_type;
1317
1318 prs_struct incoming_frag;
1319 struct rpc_hdr_info rhdr;
1320
1321 prs_struct incoming_pdu; /* Incoming reply */
1322 uint32_t incoming_pdu_offset;
1323 };
1324
1325 static int rpc_api_pipe_state_destructor(struct rpc_api_pipe_state *state)
1326 {
1327 prs_mem_free(&state->incoming_frag);
1328 prs_mem_free(&state->incoming_pdu);
1329 return 0;
1330 }
1331
1332 static void rpc_api_pipe_trans_done(struct async_req *subreq);
1333 static void rpc_api_pipe_got_pdu(struct async_req *subreq);
1334
1335 static struct async_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
1336 struct event_context *ev,
1337 struct rpc_pipe_client *cli,
1338 prs_struct *data, /* Outgoing PDU */
1339 uint8_t expected_pkt_type)
1340 {
1341 struct async_req *result, *subreq;
1342 struct rpc_api_pipe_state *state;
1343 uint16_t max_recv_frag;
1344 NTSTATUS status;
1345
1346 if (!async_req_setup(mem_ctx, &result, &state,
1347 struct rpc_api_pipe_state)) {
1348 return NULL;
1349 }
1350 state->ev = ev;
1351 state->cli = cli;
1352 state->expected_pkt_type = expected_pkt_type;
1353 state->incoming_pdu_offset = 0;
1354
1355 prs_init_empty(&state->incoming_frag, state, UNMARSHALL);
1356
1357 prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
1358 /* Make incoming_pdu dynamic with no memory. */
1359 prs_give_memory(&state->incoming_pdu, 0, 0, true);
1360
1361 talloc_set_destructor(state, rpc_api_pipe_state_destructor);
1362
1363 /*
1364 * Ensure we're not sending too much.
1365 */
1366 if (prs_offset(data) > cli->max_xmit_frag) {
1367 status = NT_STATUS_INVALID_PARAMETER;
1368 goto post_status;
1369 }
1370
1371 DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(debug_ctx(), cli)));
1372
1373 max_recv_frag = cli->max_recv_frag;
1374
1375 #ifdef DEVELOPER
1376 max_recv_frag = RPC_HEADER_LEN + 10 + (sys_random() % 32);
1377 #endif
1378
1379 subreq = cli_api_pipe_send(state, ev, cli, (uint8_t *)prs_data_p(data),
1380 prs_offset(data), max_recv_frag);
1381 if (subreq == NULL) {
1382 status = NT_STATUS_NO_MEMORY;
1383 goto post_status;
1384 }
1385 subreq->async.fn = rpc_api_pipe_trans_done;
1386 subreq->async.priv = result;
1387 return result;
1388
1389 post_status:
1390 if (async_post_status(result, ev, status)) {
1391 return result;
1392 }
1393 TALLOC_FREE(result);
1394 return NULL;
1395 }
1396
1397 static void rpc_api_pipe_trans_done(struct async_req *subreq)
1398 {
1399 struct async_req *req = talloc_get_type_abort(
1400 subreq->async.priv, struct async_req);
1401 struct rpc_api_pipe_state *state = talloc_get_type_abort(
1402 req->private_data, struct rpc_api_pipe_state);
1403 NTSTATUS status;
1404 uint8_t *rdata = NULL;
1405 uint32_t rdata_len = 0;
1406 char *rdata_copy;
1407
1408 status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
1409 TALLOC_FREE(subreq);
1410 if (!NT_STATUS_IS_OK(status)) {
1411 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
1412 async_req_error(req, status);
1413 return;
1414 }
1415
1416 if (rdata == NULL) {
1417 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
1418 rpccli_pipe_txt(debug_ctx(), state->cli)));
1419 async_req_done(req);
1420 return;
1421 }
1422
1423 /*
1424 * Give the memory received from cli_trans as dynamic to the current
1425 * pdu. Duplicating it sucks, but prs_struct doesn't know about talloc
1426 * :-(
1427 */
1428 rdata_copy = (char *)memdup(rdata, rdata_len);
1429 TALLOC_FREE(rdata);
1430 if (async_req_nomem(rdata_copy, req)) {
1431 return;
1432 }
1433 prs_give_memory(&state->incoming_frag, rdata_copy, rdata_len, true);
1434
1435 /* Ensure we have enough data for a pdu. */
1436 subreq = get_complete_frag_send(state, state->ev, state->cli,
1437 &state->rhdr, &state->incoming_frag);
1438 if (async_req_nomem(subreq, req)) {
1439 return;
1440 }
1441 subreq->async.fn = rpc_api_pipe_got_pdu;
1442 subreq->async.priv = req;
1443 }
1444
1445 static void rpc_api_pipe_got_pdu(struct async_req *subreq)
1446 {
1447 struct async_req *req = talloc_get_type_abort(
1448 subreq->async.priv, struct async_req);
1449 struct rpc_api_pipe_state *state = talloc_get_type_abort(
1450 req->private_data, struct rpc_api_pipe_state);
1451 NTSTATUS status;
1452 char *rdata = NULL;
1453 uint32_t rdata_len = 0;
1454
1455 status = get_complete_frag_recv(subreq);
1456 TALLOC_FREE(subreq);
1457 if (!NT_STATUS_IS_OK(status)) {
1458 DEBUG(5, ("get_complete_frag failed: %s\n",
1459 nt_errstr(status)));
1460 async_req_error(req, status);
1461 return;
1462 }
1463
1464 status = cli_pipe_validate_current_pdu(
1465 state->cli, &state->rhdr, &state->incoming_frag,
1466 state->expected_pkt_type, &rdata, &rdata_len,
1467 &state->incoming_pdu);
1468
1469 DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
1470 (unsigned)prs_data_size(&state->incoming_frag),
1471 (unsigned)state->incoming_pdu_offset,
1472 nt_errstr(status)));
1473
1474 if (!NT_STATUS_IS_OK(status)) {
1475 async_req_error(req, status);
1476 return;
1477 }
1478
1479 if ((state->rhdr.flags & RPC_FLG_FIRST)
1480 && (state->rhdr.pack_type[0] == 0)) {
1481 /*
1482 * Set the data type correctly for big-endian data on the
1483 * first packet.
1484 */
1485 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
1486 "big-endian.\n",
1487 rpccli_pipe_txt(debug_ctx(), state->cli)));
1488 prs_set_endian_data(&state->incoming_pdu, RPC_BIG_ENDIAN);
1489 }
1490 /*
1491 * Check endianness on subsequent packets.
1492 */
1493 if (state->incoming_frag.bigendian_data
1494 != state->incoming_pdu.bigendian_data) {
1495 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
1496 "%s\n",
1497 state->incoming_pdu.bigendian_data?"big":"little",
1498 state->incoming_frag.bigendian_data?"big":"little"));
1499 async_req_error(req, NT_STATUS_INVALID_PARAMETER);
1500 return;
1501 }
1502
1503 /* Now copy the data portion out of the pdu into rbuf. */
1504 if (!prs_force_grow(&state->incoming_pdu, rdata_len)) {
1505 async_req_error(req, NT_STATUS_NO_MEMORY);
1506 return;
1507 }
1508
1509 memcpy(prs_data_p(&state->incoming_pdu) + state->incoming_pdu_offset,
1510 rdata, (size_t)rdata_len);
1511 state->incoming_pdu_offset += rdata_len;
1512
1513 status = cli_pipe_reset_current_pdu(state->cli, &state->rhdr,
1514 &state->incoming_frag);
1515 if (!NT_STATUS_IS_OK(status)) {
1516 async_req_error(req, status);
1517 return;
1518 }
1519
1520 if (state->rhdr.flags & RPC_FLG_LAST) {
1521 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
1522 rpccli_pipe_txt(debug_ctx(), state->cli),
1523 (unsigned)prs_data_size(&state->incoming_pdu)));
1524 async_req_done(req);
1525 return;
1526 }
1527
1528 subreq = get_complete_frag_send(state, state->ev, state->cli,
1529 &state->rhdr, &state->incoming_frag);
1530 if (async_req_nomem(subreq, req)) {
1531 return;
1532 }
1533 subreq->async.fn = rpc_api_pipe_got_pdu;
1534 subreq->async.priv = req;
1535 }
1536
1537 static NTSTATUS rpc_api_pipe_recv(struct async_req *req, TALLOC_CTX *mem_ctx,
1538 prs_struct *reply_pdu)
1539 {
1540 struct rpc_api_pipe_state *state = talloc_get_type_abort(
1541 req->private_data, struct rpc_api_pipe_state);
1542 NTSTATUS status;
1543
1544 if (async_req_is_error(req, &status)) {
1545 return status;
1546 }
1547
1548 *reply_pdu = state->incoming_pdu;
1549 reply_pdu->mem_ctx = mem_ctx;
1550
1551 /*
1552 * Prevent state->incoming_pdu from being freed in
1553 * rpc_api_pipe_state_destructor()
1554 */
1555 prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
1556
1557 return NT_STATUS_OK;
1558 }
1559
1560 /*******************************************************************
1561 Creates krb5 auth bind.
1562 ********************************************************************/
1563
1564 static NTSTATUS create_krb5_auth_bind_req( struct rpc_pipe_client *cli,
1565 enum pipe_auth_level auth_level,
1566 RPC_HDR_AUTH *pauth_out,
1567 prs_struct *auth_data)
1568 {
1569 #ifdef HAVE_KRB5
1570 int ret;
1571 struct kerberos_auth_struct *a = cli->auth->a_u.kerberos_auth;
1572 DATA_BLOB tkt = data_blob_null;
1573 DATA_BLOB tkt_wrapped = data_blob_null;
1574
1575 /* We may change the pad length before marshalling. */
1576 init_rpc_hdr_auth(pauth_out, RPC_KRB5_AUTH_TYPE, (int)auth_level, 0, 1);
1577
1578 DEBUG(5, ("create_krb5_auth_bind_req: creating a service ticket for principal %s\n",
1579 a->service_principal ));
1580
1581 /* Create the ticket for the service principal and return it in a gss-api wrapped blob. */
1582
1583 ret = cli_krb5_get_ticket(a->service_principal, 0, &tkt,
1584 &a->session_key, (uint32)AP_OPTS_MUTUAL_REQUIRED, NULL, NULL);
1585
1586 if (ret) {
1587 DEBUG(1,("create_krb5_auth_bind_req: cli_krb5_get_ticket for principal %s "
1588 "failed with %s\n",
1589 a->service_principal,
1590 error_message(ret) ));
1591
1592 data_blob_free(&tkt);
1593 prs_mem_free(auth_data);
1594 return NT_STATUS_INVALID_PARAMETER;
1595 }
1596
1597 /* wrap that up in a nice GSS-API wrapping */
1598 tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
1599
1600 data_blob_free(&tkt);
1601
1602 /* Auth len in the rpc header doesn't include auth_header. */
1603 if (!prs_copy_data_in(auth_data, (char *)tkt_wrapped.data, tkt_wrapped.length)) {
1604 data_blob_free(&tkt_wrapped);
1605 prs_mem_free(auth_data);
1606 return NT_STATUS_NO_MEMORY;
1607 }
1608
1609 DEBUG(5, ("create_krb5_auth_bind_req: Created krb5 GSS blob :\n"));
1610 dump_data(5, tkt_wrapped.data, tkt_wrapped.length);
1611
1612 data_blob_free(&tkt_wrapped);
1613 return NT_STATUS_OK;
1614 #else
1615 return NT_STATUS_INVALID_PARAMETER;
1616 #endif
1617 }
1618
1619 /*******************************************************************
1620 Creates SPNEGO NTLMSSP auth bind.
1621 ********************************************************************/
1622
1623 static NTSTATUS create_spnego_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1624 enum pipe_auth_level auth_level,
1625 RPC_HDR_AUTH *pauth_out,
1626 prs_struct *auth_data)
1627 {
1628 NTSTATUS nt_status;
1629 DATA_BLOB null_blob = data_blob_null;
1630 DATA_BLOB request = data_blob_null;
1631 DATA_BLOB spnego_msg = data_blob_null;
1632
1633 /* We may change the pad length before marshalling. */
1634 init_rpc_hdr_auth(pauth_out, RPC_SPNEGO_AUTH_TYPE, (int)auth_level, 0, 1);
1635
1636 DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1637 nt_status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
1638 null_blob,
1639 &request);
1640
1641 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1642 data_blob_free(&request);
1643 prs_mem_free(auth_data);
1644 return nt_status;
1645 }
1646
1647 /* Wrap this in SPNEGO. */
1648 spnego_msg = gen_negTokenInit(OID_NTLMSSP, request);
1649
1650 data_blob_free(&request);
1651
1652 /* Auth len in the rpc header doesn't include auth_header. */
1653 if (!prs_copy_data_in(auth_data, (char *)spnego_msg.data, spnego_msg.length)) {
1654 data_blob_free(&spnego_msg);
1655 prs_mem_free(auth_data);
1656 return NT_STATUS_NO_MEMORY;
1657 }
1658
1659 DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1660 dump_data(5, spnego_msg.data, spnego_msg.length);
1661
1662 data_blob_free(&spnego_msg);
1663 return NT_STATUS_OK;
1664 }
1665
1666 /*******************************************************************
1667 Creates NTLMSSP auth bind.
1668 ********************************************************************/
1669
1670 static NTSTATUS create_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1671 enum pipe_auth_level auth_level,
1672 RPC_HDR_AUTH *pauth_out,
1673 prs_struct *auth_data)
1674 {
1675 NTSTATUS nt_status;
1676 DATA_BLOB null_blob = data_blob_null;
1677 DATA_BLOB request = data_blob_null;
1678
1679 /* We may change the pad length before marshalling. */
1680 init_rpc_hdr_auth(pauth_out, RPC_NTLMSSP_AUTH_TYPE, (int)auth_level, 0, 1);
1681
1682 DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1683 nt_status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
1684 null_blob,
1685 &request);
1686
1687 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1688 data_blob_free(&request);
1689 prs_mem_free(auth_data);
1690 return nt_status;
1691 }
1692
1693 /* Auth len in the rpc header doesn't include auth_header. */
1694 if (!prs_copy_data_in(auth_data, (char *)request.data, request.length)) {
1695 data_blob_free(&request);
1696 prs_mem_free(auth_data);
1697 return NT_STATUS_NO_MEMORY;
1698 }
1699
1700 DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1701 dump_data(5, request.data, request.length);
1702
1703 data_blob_free(&request);
1704 return NT_STATUS_OK;
1705 }
1706
1707 /*******************************************************************
1708 Creates schannel auth bind.
1709 ********************************************************************/
1710
1711 static NTSTATUS create_schannel_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1712 enum pipe_auth_level auth_level,
1713 RPC_HDR_AUTH *pauth_out,
1714 prs_struct *auth_data)
1715 {
1716 RPC_AUTH_SCHANNEL_NEG schannel_neg;
1717
1718 /* We may change the pad length before marshalling. */
1719 init_rpc_hdr_auth(pauth_out, RPC_SCHANNEL_AUTH_TYPE, (int)auth_level, 0, 1);
1720
1721 /* Use lp_workgroup() if domain not specified */
1722
1723 if (!cli->auth->domain || !cli->auth->domain[0]) {
1724 cli->auth->domain = talloc_strdup(cli, lp_workgroup());
1725 if (cli->auth->domain == NULL) {
1726 return NT_STATUS_NO_MEMORY;
1727 }
1728 }
1729
1730 init_rpc_auth_schannel_neg(&schannel_neg, cli->auth->domain,
1731 global_myname());
1732
1733 /*
1734 * Now marshall the data into the auth parse_struct.
1735 */
1736
1737 if(!smb_io_rpc_auth_schannel_neg("schannel_neg",
1738 &schannel_neg, auth_data, 0)) {
1739 DEBUG(0,("Failed to marshall RPC_AUTH_SCHANNEL_NEG.\n"));
1740 prs_mem_free(auth_data);
1741 return NT_STATUS_NO_MEMORY;
1742 }
1743
1744 return NT_STATUS_OK;
1745 }
1746
1747 /*******************************************************************
1748 Creates the internals of a DCE/RPC bind request or alter context PDU.
1749 ********************************************************************/
1750
1751 static NTSTATUS create_bind_or_alt_ctx_internal(enum RPC_PKT_TYPE pkt_type,
1752 prs_struct *rpc_out,
1753 uint32 rpc_call_id,
1754 const RPC_IFACE *abstract,
1755 const RPC_IFACE *transfer,
1756 RPC_HDR_AUTH *phdr_auth,
1757 prs_struct *pauth_info)
1758 {
1759 RPC_HDR hdr;
1760 RPC_HDR_RB hdr_rb;
1761 RPC_CONTEXT rpc_ctx;
1762 uint16 auth_len = prs_offset(pauth_info);
1763 uint8 ss_padding_len = 0;
1764 uint16 frag_len = 0;
1765
1766 /* create the RPC context. */
1767 init_rpc_context(&rpc_ctx, 0 /* context id */, abstract, transfer);
1768
1769 /* create the bind request RPC_HDR_RB */
1770 init_rpc_hdr_rb(&hdr_rb, RPC_MAX_PDU_FRAG_LEN, RPC_MAX_PDU_FRAG_LEN, 0x0, &rpc_ctx);
1771
1772 /* Start building the frag length. */
1773 frag_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&hdr_rb);
1774
1775 /* Do we need to pad ? */
1776 if (auth_len) {
1777 uint16 data_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&hdr_rb);
1778 if (data_len % 8) {
1779 ss_padding_len = 8 - (data_len % 8);
1780 phdr_auth->auth_pad_len = ss_padding_len;
1781 }
1782 frag_len += RPC_HDR_AUTH_LEN + auth_len + ss_padding_len;
1783 }
1784
1785 /* Create the request RPC_HDR */
1786 init_rpc_hdr(&hdr, pkt_type, RPC_FLG_FIRST|RPC_FLG_LAST, rpc_call_id, frag_len, auth_len);
1787
1788 /* Marshall the RPC header */
1789 if(!smb_io_rpc_hdr("hdr" , &hdr, rpc_out, 0)) {
1790 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR.\n"));
1791 return NT_STATUS_NO_MEMORY;
1792 }
1793
1794 /* Marshall the bind request data */
1795 if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_out, 0)) {
1796 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1797 return NT_STATUS_NO_MEMORY;
1798 }
1799
1800 /*
1801 * Grow the outgoing buffer to store any auth info.
1802 */
1803
1804 if(auth_len != 0) {
1805 if (ss_padding_len) {
1806 char pad[8];
1807 memset(pad, '\0', 8);
1808 if (!prs_copy_data_in(rpc_out, pad, ss_padding_len)) {
1809 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall padding.\n"));
1810 return NT_STATUS_NO_MEMORY;
1811 }
1812 }
1813
1814 if(!smb_io_rpc_hdr_auth("hdr_auth", phdr_auth, rpc_out, 0)) {
1815 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_AUTH.\n"));
1816 return NT_STATUS_NO_MEMORY;
1817 }
1818
1819
1820 if(!prs_append_prs_data( rpc_out, pauth_info)) {
1821 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to grow parse struct to add auth.\n"));
1822 return NT_STATUS_NO_MEMORY;
1823 }
1824 }
1825
1826 return NT_STATUS_OK;
1827 }
1828
1829 /*******************************************************************
1830 Creates a DCE/RPC bind request.
1831 ********************************************************************/
1832
1833 static NTSTATUS create_rpc_bind_req(struct rpc_pipe_client *cli,
1834 prs_struct *rpc_out,
1835 uint32 rpc_call_id,
1836 const RPC_IFACE *abstract,
1837 const RPC_IFACE *transfer,
1838 enum pipe_auth_type auth_type,
1839 enum pipe_auth_level auth_level)
1840 {
1841 RPC_HDR_AUTH hdr_auth;
1842 prs_struct auth_info;
1843 NTSTATUS ret = NT_STATUS_OK;
1844
1845 ZERO_STRUCT(hdr_auth);
1846 if (!prs_init(&auth_info, RPC_HDR_AUTH_LEN, prs_get_mem_context(rpc_out), MARSHALL))
1847 return NT_STATUS_NO_MEMORY;
1848
1849 switch (auth_type) {
1850 case PIPE_AUTH_TYPE_SCHANNEL:
1851 ret = create_schannel_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1852 if (!NT_STATUS_IS_OK(ret)) {
1853 prs_mem_free(&auth_info);
1854 return ret;
1855 }
1856 break;
1857
1858 case PIPE_AUTH_TYPE_NTLMSSP:
1859 ret = create_ntlmssp_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1860 if (!NT_STATUS_IS_OK(ret)) {
1861 prs_mem_free(&auth_info);
1862 return ret;
1863 }
1864 break;
1865
1866 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1867 ret = create_spnego_ntlmssp_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1868 if (!NT_STATUS_IS_OK(ret)) {
1869 prs_mem_free(&auth_info);
1870 return ret;
1871 }
1872 break;
1873
1874 case PIPE_AUTH_TYPE_KRB5:
1875 ret = create_krb5_auth_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1876 if (!NT_STATUS_IS_OK(ret)) {
1877 prs_mem_free(&auth_info);
1878 return ret;
1879 }
1880 break;
1881
1882 case PIPE_AUTH_TYPE_NONE:
1883 break;
1884
1885 default:
1886 /* "Can't" happen. */
1887 return NT_STATUS_INVALID_INFO_CLASS;
1888 }
1889
1890 ret = create_bind_or_alt_ctx_internal(RPC_BIND,
1891 rpc_out,
1892 rpc_call_id,
1893 abstract,
1894 transfer,
1895 &hdr_auth,
1896 &auth_info);
1897
1898 prs_mem_free(&auth_info);
1899 return ret;
1900 }
1901
1902 /*******************************************************************
1903 Create and add the NTLMSSP sign/seal auth header and data.
1904 ********************************************************************/
1905
1906 static NTSTATUS add_ntlmssp_auth_footer(struct rpc_pipe_client *cli,
1907 RPC_HDR *phdr,
1908 uint32 ss_padding_len,
1909 prs_struct *outgoing_pdu)
1910 {
1911 RPC_HDR_AUTH auth_info;
1912 NTSTATUS status;
1913 DATA_BLOB auth_blob = data_blob_null;
1914 uint16 data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
1915
1916 if (!cli->auth->a_u.ntlmssp_state) {
1917 return NT_STATUS_INVALID_PARAMETER;
1918 }
1919
1920 /* Init and marshall the auth header. */
1921 init_rpc_hdr_auth(&auth_info,
1922 map_pipe_auth_type_to_rpc_auth_type(
1923 cli->auth->auth_type),
1924 cli->auth->auth_level,
1925 ss_padding_len,
1926 1 /* context id. */);
1927
1928 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
1929 DEBUG(0,("add_ntlmssp_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
1930 data_blob_free(&auth_blob);
1931 return NT_STATUS_NO_MEMORY;
1932 }
1933
1934 switch (cli->auth->auth_level) {
1935 case PIPE_AUTH_LEVEL_PRIVACY:
1936 /* Data portion is encrypted. */
1937 status = ntlmssp_seal_packet(cli->auth->a_u.ntlmssp_state,
1938 (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
1939 data_and_pad_len,
1940 (unsigned char *)prs_data_p(outgoing_pdu),
1941 (size_t)prs_offset(outgoing_pdu),
1942 &auth_blob);
1943 if (!NT_STATUS_IS_OK(status)) {
1944 data_blob_free(&auth_blob);
1945 return status;
1946 }
1947 break;
1948
1949 case PIPE_AUTH_LEVEL_INTEGRITY:
1950 /* Data is signed. */
1951 status = ntlmssp_sign_packet(cli->auth->a_u.ntlmssp_state,
1952 (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
1953 data_and_pad_len,
1954 (unsigned char *)prs_data_p(outgoing_pdu),
1955 (size_t)prs_offset(outgoing_pdu),
1956 &auth_blob);
1957 if (!NT_STATUS_IS_OK(status)) {
1958 data_blob_free(&auth_blob);
1959 return status;
1960 }
1961 break;
1962
1963 default:
1964 /* Can't happen. */
1965 smb_panic("bad auth level");
1966 /* Notreached. */
1967 return NT_STATUS_INVALID_PARAMETER;
1968 }
1969
1970 /* Finally marshall the blob. */
1971
1972 if (!prs_copy_data_in(outgoing_pdu, (const char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
1973 DEBUG(0,("add_ntlmssp_auth_footer: failed to add %u bytes auth blob.\n",
1974 (unsigned int)NTLMSSP_SIG_SIZE));
1975 data_blob_free(&auth_blob);
1976 return NT_STATUS_NO_MEMORY;
1977 }
1978
1979 data_blob_free(&auth_blob);
1980 return NT_STATUS_OK;
1981 }
1982
1983 /*******************************************************************
1984 Create and add the schannel sign/seal auth header and data.
1985 ********************************************************************/
1986
1987 static NTSTATUS add_schannel_auth_footer(struct rpc_pipe_client *cli,
1988 RPC_HDR *phdr,
1989 uint32 ss_padding_len,
1990 prs_struct *outgoing_pdu)
1991 {
1992 RPC_HDR_AUTH auth_info;
1993 RPC_AUTH_SCHANNEL_CHK verf;
1994 struct schannel_auth_struct *sas = cli->auth->a_u.schannel_auth;
1995 char *data_p = prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
1996 size_t data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
1997
1998 if (!sas) {
1999 return NT_STATUS_INVALID_PARAMETER;
2000 }
2001
2002 /* Init and marshall the auth header. */
2003 init_rpc_hdr_auth(&auth_info,
2004 map_pipe_auth_type_to_rpc_auth_type(cli->auth->auth_type),
2005 cli->auth->auth_level,
2006 ss_padding_len,
2007 1 /* context id. */);
2008
2009 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
2010 DEBUG(0,("add_schannel_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
2011 return NT_STATUS_NO_MEMORY;
2012 }
2013
2014 switch (cli->auth->auth_level) {
2015 case PIPE_AUTH_LEVEL_PRIVACY:
2016 case PIPE_AUTH_LEVEL_INTEGRITY:
2017 DEBUG(10,("add_schannel_auth_footer: SCHANNEL seq_num=%d\n",
2018 sas->seq_num));
2019
2020 schannel_encode(sas,
2021 cli->auth->auth_level,
2022 SENDER_IS_INITIATOR,
2023 &verf,
2024 data_p,
2025 data_and_pad_len);
2026
2027 sas->seq_num++;
2028 break;
2029
2030 default:
2031 /* Can't happen. */
2032 smb_panic("bad auth level");
2033 /* Notreached. */
2034 return NT_STATUS_INVALID_PARAMETER;
2035 }
2036
2037 /* Finally marshall the blob. */
2038 smb_io_rpc_auth_schannel_chk("",
2039 RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
2040 &verf,
2041 outgoing_pdu,
2042 0);
2043
2044 return NT_STATUS_OK;
2045 }
2046
2047 /*******************************************************************
2048 Calculate how much data we're going to send in this packet, also
2049 work out any sign/seal padding length.
2050 ********************************************************************/
2051
2052 static uint32 calculate_data_len_tosend(struct rpc_pipe_client *cli,
2053 uint32 data_left,
2054 uint16 *p_frag_len,
2055 uint16 *p_auth_len,
2056 uint32 *p_ss_padding)
2057 {
2058 uint32 data_space, data_len;
2059
2060 #ifdef DEVELOPER
2061 if ((data_left > 0) && (sys_random() % 2)) {
2062 data_left = MAX(data_left/2, 1);
2063 }
2064 #endif
2065
2066 switch (cli->auth->auth_level) {
2067 case PIPE_AUTH_LEVEL_NONE:
2068 case PIPE_AUTH_LEVEL_CONNECT:
2069 data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN;
2070 data_len = MIN(data_space, data_left);
2071 *p_ss_padding = 0;
2072 *p_auth_len = 0;
2073 *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + data_len;
2074 return data_len;
2075
2076 case PIPE_AUTH_LEVEL_INTEGRITY:
2077 case PIPE_AUTH_LEVEL_PRIVACY:
2078 /* Treat the same for all authenticated rpc requests. */
2079 switch(cli->auth->auth_type) {
2080 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2081 case PIPE_AUTH_TYPE_NTLMSSP:
2082 *p_auth_len = NTLMSSP_SIG_SIZE;
2083 break;
2084 case PIPE_AUTH_TYPE_SCHANNEL:
2085 *p_auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
2086 break;
2087 default:
2088 smb_panic("bad auth type");
2089 break;
2090 }
2091
2092 data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2093 RPC_HDR_AUTH_LEN - *p_auth_len;
2094
2095 data_len = MIN(data_space, data_left);
2096 *p_ss_padding = 0;
2097 if (data_len % 8) {
2098 *p_ss_padding = 8 - (data_len % 8);
2099 }
2100 *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + /* Normal headers. */
2101 data_len + *p_ss_padding + /* data plus padding. */
2102 RPC_HDR_AUTH_LEN + *p_auth_len; /* Auth header and auth data. */
2103 return data_len;
2104
2105 default:
2106 smb_panic("bad auth level");
2107 /* Notreached. */
2108 return 0;
2109 }
2110 }
2111
2112 /*******************************************************************
2113 External interface.
2114 Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
2115 Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
2116 and deals with signing/sealing details.
2117 ********************************************************************/
2118
2119 struct rpc_api_pipe_req_state {
2120 struct event_context *ev;
2121 struct rpc_pipe_client *cli;
2122 uint8_t op_num;
2123 uint32_t call_id;
2124 prs_struct *req_data;
2125 uint32_t req_data_sent;
2126 prs_struct outgoing_frag;
2127 prs_struct reply_pdu;
2128 };
2129
2130 static int rpc_api_pipe_req_state_destructor(struct rpc_api_pipe_req_state *s)
2131 {
2132 prs_mem_free(&s->outgoing_frag);
2133 prs_mem_free(&s->reply_pdu);
2134 return 0;
2135 }
2136
2137 static void rpc_api_pipe_req_write_done(struct async_req *subreq);
2138 static void rpc_api_pipe_req_done(struct async_req *subreq);
2139 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
2140 bool *is_last_frag);
2141
2142 struct async_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
2143 struct event_context *ev,
2144 struct rpc_pipe_client *cli,
2145 uint8_t op_num,
2146 prs_struct *req_data)
2147 {
2148 struct async_req *result, *subreq;
2149 struct rpc_api_pipe_req_state *state;
2150 NTSTATUS status;
2151 bool is_last_frag;
2152
2153 if (!async_req_setup(mem_ctx, &result, &state,
2154 struct rpc_api_pipe_req_state)) {
2155 return NULL;
2156 }
2157 state->ev = ev;
2158 state->cli = cli;
2159 state->op_num = op_num;
2160 state->req_data = req_data;
2161 state->req_data_sent = 0;
2162 state->call_id = get_rpc_call_id();
2163
2164 if (cli->max_xmit_frag
2165 < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_MAX_SIGN_SIZE) {
2166 /* Server is screwed up ! */
2167 status = NT_STATUS_INVALID_PARAMETER;
2168 goto post_status;
2169 }
2170
2171 prs_init_empty(&state->reply_pdu, state, UNMARSHALL);
2172
2173 if (!prs_init(&state->outgoing_frag, cli->max_xmit_frag,
2174 state, MARSHALL)) {
2175 status = NT_STATUS_NO_MEMORY;
2176 goto post_status;
2177 }
2178
2179 talloc_set_destructor(state, rpc_api_pipe_req_state_destructor);
2180
2181 status = prepare_next_frag(state, &is_last_frag);
2182 if (!NT_STATUS_IS_OK(status)) {
2183 goto post_status;
2184 }
2185
2186 if (is_last_frag) {
2187 subreq = rpc_api_pipe_send(state, ev, state->cli,
2188 &state->outgoing_frag,
2189 RPC_RESPONSE);
2190 if (subreq == NULL) {
2191 status = NT_STATUS_NO_MEMORY;
2192 goto post_status;
2193 }
2194 subreq->async.fn = rpc_api_pipe_req_done;
2195 subreq->async.priv = result;
2196 } else {
2197 subreq = rpc_write_send(state, ev, cli,
2198 prs_data_p(&state->outgoing_frag),
2199 prs_offset(&state->outgoing_frag));
2200 if (subreq == NULL) {
2201 status = NT_STATUS_NO_MEMORY;
2202 goto post_status;
2203 }
2204 subreq->async.fn = rpc_api_pipe_req_write_done;
2205 subreq->async.priv = result;
2206 }
2207 return result;
2208
2209 post_status:
2210 if (async_post_status(result, ev, status)) {
2211 return result;
2212 }
2213 TALLOC_FREE(result);
2214 return NULL;
2215 }
2216
2217 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
2218 bool *is_last_frag)
2219 {
2220 RPC_HDR hdr;
2221 RPC_HDR_REQ hdr_req;
2222 uint32_t data_sent_thistime;
2223 uint16_t auth_len;
2224 uint16_t frag_len;
2225 uint8_t flags = 0;
2226 uint32_t ss_padding;
2227 uint32_t data_left;
2228 char pad[8] = { 0, };
2229 NTSTATUS status;
2230
2231 data_left = prs_offset(state->req_data) - state->req_data_sent;
2232
2233 data_sent_thistime = calculate_data_len_tosend(
2234 state->cli, data_left, &frag_len, &auth_len, &ss_padding);
2235
2236 if (state->req_data_sent == 0) {
2237 flags = RPC_FLG_FIRST;
2238 }
2239
2240 if (data_sent_thistime == data_left) {
2241 flags |= RPC_FLG_LAST;
2242 }
2243
2244 if (!prs_set_offset(&state->outgoing_frag, 0)) {
2245 return NT_STATUS_NO_MEMORY;
2246 }
2247
2248 /* Create and marshall the header and request header. */
2249 init_rpc_hdr(&hdr, RPC_REQUEST, flags, state->call_id, frag_len,
2250 auth_len);
2251
2252 if (!smb_io_rpc_hdr("hdr ", &hdr, &state->outgoing_frag, 0)) {
2253 return NT_STATUS_NO_MEMORY;
2254 }
2255
2256 /* Create the rpc request RPC_HDR_REQ */
2257 init_rpc_hdr_req(&hdr_req, prs_offset(state->req_data),
2258 state->op_num);
2259
2260 if (!smb_io_rpc_hdr_req("hdr_req", &hdr_req,
2261 &state->outgoing_frag, 0)) {
2262 return NT_STATUS_NO_MEMORY;
2263 }
2264
2265 /* Copy in the data, plus any ss padding. */
2266 if (!prs_append_some_prs_data(&state->outgoing_frag,
2267 state->req_data, state->req_data_sent,
2268 data_sent_thistime)) {
2269 return NT_STATUS_NO_MEMORY;
2270 }
2271
2272 /* Copy the sign/seal padding data. */
2273 if (!prs_copy_data_in(&state->outgoing_frag, pad, ss_padding)) {
2274 return NT_STATUS_NO_MEMORY;
2275 }
2276
2277 /* Generate any auth sign/seal and add the auth footer. */
2278 switch (state->cli->auth->auth_type) {
2279 case PIPE_AUTH_TYPE_NONE:
2280 status = NT_STATUS_OK;
2281 break;
2282 case PIPE_AUTH_TYPE_NTLMSSP:
2283 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2284 status = add_ntlmssp_auth_footer(state->cli, &hdr, ss_padding,
2285 &state->outgoing_frag);
2286 break;
2287 case PIPE_AUTH_TYPE_SCHANNEL:
2288 status = add_schannel_auth_footer(state->cli, &hdr, ss_padding,
2289 &state->outgoing_frag);
2290 break;
2291 default:
2292 status = NT_STATUS_INVALID_PARAMETER;
2293 break;
2294 }
2295
2296 state->req_data_sent += data_sent_thistime;
2297 *is_last_frag = ((flags & RPC_FLG_LAST) != 0);
2298
2299 return status;
2300 }
2301
2302 static void rpc_api_pipe_req_write_done(struct async_req *subreq)
2303 {
2304 struct async_req *req = talloc_get_type_abort(
2305 subreq->async.priv, struct async_req);
2306 struct rpc_api_pipe_req_state *state = talloc_get_type_abort(
2307 req->private_data, struct rpc_api_pipe_req_state);
2308 NTSTATUS status;
2309 bool is_last_frag;
2310
2311 status = rpc_write_recv(subreq);
2312 TALLOC_FREE(subreq);
2313 if (!NT_STATUS_IS_OK(status)) {
2314 async_req_error(req, status);
2315 return;
2316 }
2317
2318 status = prepare_next_frag(state, &is_last_frag);
2319 if (!NT_STATUS_IS_OK(status)) {
2320 async_req_error(req, status);
2321 return;
2322 }
2323
2324 if (is_last_frag) {
2325 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2326 &state->outgoing_frag,
2327 RPC_RESPONSE);
2328 if (async_req_nomem(subreq, req)) {
2329 return;
2330 }
2331 subreq->async.fn = rpc_api_pipe_req_done;
2332 subreq->async.priv = req;
2333 } else {
2334 subreq = rpc_write_send(state, state->ev, state->cli,
2335 prs_data_p(&state->outgoing_frag),
2336 prs_offset(&state->outgoing_frag));
2337 if (async_req_nomem(subreq, req)) {
2338 return;
2339 }
2340 subreq->async.fn = rpc_api_pipe_req_write_done;
2341 subreq->async.priv = req;
2342 }
2343 }
2344
2345 static void rpc_api_pipe_req_done(struct async_req *subreq)
2346 {
2347 struct async_req *req = talloc_get_type_abort(
2348 subreq->async.priv, struct async_req);
2349 struct rpc_api_pipe_req_state *state = talloc_get_type_abort(
2350 req->private_data, struct rpc_api_pipe_req_state);
2351 NTSTATUS status;
2352
2353 status = rpc_api_pipe_recv(subreq, state, &state->reply_pdu);
2354 TALLOC_FREE(subreq);
2355 if (!NT_STATUS_IS_OK(status)) {
2356 async_req_error(req, status);
2357 return;
2358 }
2359 async_req_done(req);
2360 }
2361
2362 NTSTATUS rpc_api_pipe_req_recv(struct async_req *req, TALLOC_CTX *mem_ctx,
2363 prs_struct *reply_pdu)
2364 {
2365 struct rpc_api_pipe_req_state *state = talloc_get_type_abort(
2366 req->private_data, struct rpc_api_pipe_req_state);
2367 NTSTATUS status;
2368
2369 if (async_req_is_error(req, &status)) {
2370 /*
2371 * We always have to initialize to reply pdu, even if there is
2372 * none. The rpccli_* caller routines expect this.
2373 */
2374 prs_init_empty(reply_pdu, mem_ctx, UNMARSHALL);
2375 return status;
2376 }
2377
2378 *reply_pdu = state->reply_pdu;
2379 reply_pdu->mem_ctx = mem_ctx;
2380
2381 /*
2382 * Prevent state->req_pdu from being freed in
2383 * rpc_api_pipe_req_state_destructor()
2384 */
2385 prs_init_empty(&state->reply_pdu, state, UNMARSHALL);
2386
2387 return NT_STATUS_OK;
2388 }
2389
2390 NTSTATUS rpc_api_pipe_req(TALLOC_CTX *mem_ctx, struct rpc_pipe_client *cli,
2391 uint8 op_num,
2392 prs_struct *in_data,
2393 prs_struct *out_data)
2394 {
2395 TALLOC_CTX *frame = talloc_stackframe();
2396 struct event_context *ev;
2397 struct async_req *req;
2398 NTSTATUS status = NT_STATUS_NO_MEMORY;
2399
2400 ev = event_context_init(frame);
2401 if (ev == NULL) {
2402 goto fail;
2403 }
2404
2405 req = rpc_api_pipe_req_send(frame, ev, cli, op_num, in_data);
2406 if (req == NULL) {
2407 goto fail;
2408 }
2409
2410 while (req->state < ASYNC_REQ_DONE) {
2411 event_loop_once(ev);
2412 }
2413
2414 status = rpc_api_pipe_req_recv(req, mem_ctx, out_data);
2415 fail:
2416 TALLOC_FREE(frame);
2417 return status;
2418 }
2419
2420 #if 0
2421 /****************************************************************************
2422 Set the handle state.
2423 ****************************************************************************/
2424
2425 static bool rpc_pipe_set_hnd_state(struct rpc_pipe_client *cli,
2426 const char *pipe_name, uint16 device_state)
2427 {
2428 bool state_set = False;
2429 char param[2];
2430 uint16 setup[2]; /* only need 2 uint16 setup parameters */
2431 char *rparam = NULL;
2432 char *rdata = NULL;
2433 uint32 rparam_len, rdata_len;
2434
2435 if (pipe_name == NULL)
2436 return False;
2437
2438 DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
2439 cli->fnum, pipe_name, device_state));
2440
2441 /* create parameters: device state */
2442 SSVAL(param, 0, device_state);
2443
2444 /* create setup parameters. */
2445 setup[0] = 0x0001;
2446 setup[1] = cli->fnum; /* pipe file handle. got this from an SMBOpenX. */
2447
2448 /* send the data on \PIPE\ */
2449 if (cli_api_pipe(cli->cli, "\\PIPE\\",
2450 setup, 2, 0, /* setup, length, max */
2451 param, 2, 0, /* param, length, max */
2452 NULL, 0, 1024, /* data, length, max */
2453 &rparam, &rparam_len, /* return param, length */
2454 &rdata, &rdata_len)) /* return data, length */
2455 {
2456 DEBUG(5, ("Set Handle state: return OK\n"));
2457 state_set = True;
2458 }
2459
2460 SAFE_FREE(rparam);
2461 SAFE_FREE(rdata);
2462
2463 return state_set;
2464 }
2465 #endif
2466
2467 /****************************************************************************
2468 Check the rpc bind acknowledge response.
2469 ****************************************************************************/
2470
2471 static bool check_bind_response(RPC_HDR_BA *hdr_ba, const RPC_IFACE *transfer)
2472 {
2473 if ( hdr_ba->addr.len == 0) {
2474 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
2475 }
2476
2477 /* check the transfer syntax */
2478 if ((hdr_ba->transfer.if_version != transfer->if_version) ||
2479 (memcmp(&hdr_ba->transfer.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
2480 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
2481 return False;
2482 }
2483
2484 if (hdr_ba->res.num_results != 0x1 || hdr_ba->res.result != 0) {
2485 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
2486 hdr_ba->res.num_results, hdr_ba->res.reason));
2487 }
2488
2489 DEBUG(5,("check_bind_response: accepted!\n"));
2490 return True;
2491 }
2492
2493 /*******************************************************************
2494 Creates a DCE/RPC bind authentication response.
2495 This is the packet that is sent back to the server once we
2496 have received a BIND-ACK, to finish the third leg of
2497 the authentication handshake.
2498 ********************************************************************/
2499
2500 static NTSTATUS create_rpc_bind_auth3(struct rpc_pipe_client *cli,
2501 uint32 rpc_call_id,
2502 enum pipe_auth_type auth_type,
2503 enum pipe_auth_level auth_level,
2504 DATA_BLOB *pauth_blob,
2505 prs_struct *rpc_out)
2506 {
2507 RPC_HDR hdr;
2508 RPC_HDR_AUTH hdr_auth;
2509 uint32 pad = 0;
2510
2511 /* Create the request RPC_HDR */
2512 init_rpc_hdr(&hdr, RPC_AUTH3, RPC_FLG_FIRST|RPC_FLG_LAST, rpc_call_id,
2513 RPC_HEADER_LEN + 4 /* pad */ + RPC_HDR_AUTH_LEN + pauth_blob->length,
2514 pauth_blob->length );
2515
2516 /* Marshall it. */
2517 if(!smb_io_rpc_hdr("hdr", &hdr, rpc_out, 0)) {
2518 DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR.\n"));
2519 return NT_STATUS_NO_MEMORY;
2520 }
2521
2522 /*
2523 I'm puzzled about this - seems to violate the DCE RPC auth rules,
2524 about padding - shouldn't this pad to length 8 ? JRA.
2525 */
2526
2527 /* 4 bytes padding. */
2528 if (!prs_uint32("pad", rpc_out, 0, &pad)) {
2529 DEBUG(0,("create_rpc_bind_auth3: failed to marshall 4 byte pad.\n"));
2530 return NT_STATUS_NO_MEMORY;
2531 }
2532
2533 /* Create the request RPC_HDR_AUTHA */
2534 init_rpc_hdr_auth(&hdr_auth,
2535 map_pipe_auth_type_to_rpc_auth_type(auth_type),
2536 auth_level, 0, 1);
2537
2538 if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, rpc_out, 0)) {
2539 DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR_AUTHA.\n"));
2540 return NT_STATUS_NO_MEMORY;
2541 }
2542
2543 /*
2544 * Append the auth data to the outgoing buffer.
2545 */
2546
2547 if(!prs_copy_data_in(rpc_out, (char *)pauth_blob->data, pauth_blob->length)) {
2548 DEBUG(0,("create_rpc_bind_auth3: failed to marshall auth blob.\n"));
2549 return NT_STATUS_NO_MEMORY;
2550 }
2551
2552 return NT_STATUS_OK;
2553 }
2554
2555 /*******************************************************************
2556 Creates a DCE/RPC bind alter context authentication request which
2557 may contain a spnego auth blobl
2558 ********************************************************************/
2559
2560 static NTSTATUS create_rpc_alter_context(uint32 rpc_call_id,
2561 const RPC_IFACE *abstract,
2562 const RPC_IFACE *transfer,
2563 enum pipe_auth_level auth_level,
2564 const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
2565 prs_struct *rpc_out)
2566 {
2567 RPC_HDR_AUTH hdr_auth;
2568 prs_struct auth_info;
2569 NTSTATUS ret = NT_STATUS_OK;
2570
2571 ZERO_STRUCT(hdr_auth);
2572 if (!prs_init(&auth_info, RPC_HDR_AUTH_LEN, prs_get_mem_context(rpc_out), MARSHALL))
2573 return NT_STATUS_NO_MEMORY;
2574
2575 /* We may change the pad length before marshalling. */
2576 init_rpc_hdr_auth(&hdr_auth, RPC_SPNEGO_AUTH_TYPE, (int)auth_level, 0, 1);
2577
2578 if (pauth_blob->length) {
2579 if (!prs_copy_data_in(&auth_info, (const char *)pauth_blob->data, pauth_blob->length)) {
2580 prs_mem_free(&auth_info);
2581 return NT_STATUS_NO_MEMORY;
2582 }
2583 }
2584
2585 ret = create_bind_or_alt_ctx_internal(RPC_ALTCONT,
2586 rpc_out,
2587 rpc_call_id,
2588 abstract,
2589 transfer,
2590 &hdr_auth,
2591 &auth_info);
2592 prs_mem_free(&auth_info);
2593 return ret;
2594 }
2595
2596 /****************************************************************************
2597 Do an rpc bind.
2598 ****************************************************************************/
2599
2600 struct rpc_pipe_bind_state {
2601 struct event_context *ev;
2602 struct rpc_pipe_client *cli;
2603 prs_struct rpc_out;
2604 uint32_t rpc_call_id;
2605 };
2606
2607 static int rpc_pipe_bind_state_destructor(struct rpc_pipe_bind_state *state)
2608 {
2609 prs_mem_free(&state->rpc_out);
2610 return 0;
2611 }
2612
2613 static void rpc_pipe_bind_step_one_done(struct async_req *subreq);
2614 static NTSTATUS rpc_finish_auth3_bind_send(struct async_req *req,
2615 struct rpc_pipe_bind_state *state,
2616 struct rpc_hdr_info *phdr,
2617 prs_struct *reply_pdu);
2618 static void rpc_bind_auth3_write_done(struct async_req *subreq);
2619 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct async_req *req,
2620 struct rpc_pipe_bind_state *state,
2621 struct rpc_hdr_info *phdr,
2622 prs_struct *reply_pdu);
2623 static void rpc_bind_ntlmssp_api_done(struct async_req *subreq);
2624
2625 struct async_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
2626 struct event_context *ev,
2627 struct rpc_pipe_client *cli,
2628 struct cli_pipe_auth_data *auth)
2629 {
2630 struct async_req *result, *subreq;
2631 struct rpc_pipe_bind_state *state;
2632 NTSTATUS status;
2633
2634 if (!async_req_setup(mem_ctx, &result, &state,
2635 struct rpc_pipe_bind_state)) {
2636 return NULL;
2637 }
2638
2639 DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
2640 rpccli_pipe_txt(debug_ctx(), cli),
2641 (unsigned int)auth->auth_type,
2642 (unsigned int)auth->auth_level ));
2643
2644 state->ev = ev;
2645 state->cli = cli;
2646 state->rpc_call_id = get_rpc_call_id();
2647
2648 prs_init_empty(&state->rpc_out, state, MARSHALL);
2649 talloc_set_destructor(state, rpc_pipe_bind_state_destructor);
2650
2651 cli->auth = talloc_move(cli, &auth);
2652
2653 /* Marshall the outgoing data. */
2654 status = create_rpc_bind_req(cli, &state->rpc_out,
2655 state->rpc_call_id,
2656 &cli->abstract_syntax,
2657 &cli->transfer_syntax,
2658 cli->auth->auth_type,
2659 cli->auth->auth_level);
2660
2661 if (!NT_STATUS_IS_OK(status)) {
2662 goto post_status;
2663 }
2664
2665 subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
2666 RPC_BINDACK);
2667 if (subreq == NULL) {
2668 status = NT_STATUS_NO_MEMORY;
2669 goto post_status;
2670 }
2671 subreq->async.fn = rpc_pipe_bind_step_one_done;
2672 subreq->async.priv = result;
2673 return result;
2674
2675 post_status:
2676 if (async_post_status(result, ev, status)) {
2677 return result;
2678 }
2679 TALLOC_FREE(result);
2680 return NULL;
2681 }
2682
2683 static void rpc_pipe_bind_step_one_done(struct async_req *subreq)
2684 {
2685 struct async_req *req = talloc_get_type_abort(
2686 subreq->async.priv, struct async_req);
2687 struct rpc_pipe_bind_state *state = talloc_get_type_abort(
2688 req->private_data, struct rpc_pipe_bind_state);
2689 prs_struct reply_pdu;
2690 struct rpc_hdr_info hdr;
2691 struct rpc_hdr_ba_info hdr_ba;
2692 NTSTATUS status;
2693
2694 status = rpc_api_pipe_recv(subreq, talloc_tos(), &reply_pdu);
2695 TALLOC_FREE(subreq);
2696 if (!NT_STATUS_IS_OK(status)) {
2697 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
2698 rpccli_pipe_txt(debug_ctx(), state->cli),
2699 nt_errstr(status)));
2700 async_req_error(req, status);
2701 return;
2702 }
2703
2704 /* Unmarshall the RPC header */
2705 if (!smb_io_rpc_hdr("hdr", &hdr, &reply_pdu, 0)) {
2706 DEBUG(0, ("rpc_pipe_bind: failed to unmarshall RPC_HDR.\n"));
2707 async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
2708 return;
2709 }
2710
2711 if (!smb_io_rpc_hdr_ba("", &hdr_ba, &reply_pdu, 0)) {
2712 DEBUG(0, ("rpc_pipe_bind: Failed to unmarshall "
2713 "RPC_HDR_BA.\n"));
2714 async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
2715 return;
2716 }
2717
2718 if (!check_bind_response(&hdr_ba, &state->cli->transfer_syntax)) {
2719 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
2720 async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
2721 return;
2722 }
2723
2724 state->cli->max_xmit_frag = hdr_ba.bba.max_tsize;
2725 state->cli->max_recv_frag = hdr_ba.bba.max_rsize;
2726
2727 /*
2728 * For authenticated binds we may need to do 3 or 4 leg binds.
2729 */
2730
2731 switch(state->cli->auth->auth_type) {
2732
2733 case PIPE_AUTH_TYPE_NONE:
2734 case PIPE_AUTH_TYPE_SCHANNEL:
2735 /* Bind complete. */
2736 async_req_done(req);
2737 break;
2738
2739 case PIPE_AUTH_TYPE_NTLMSSP:
2740 /* Need to send AUTH3 packet - no reply. */
2741 status = rpc_finish_auth3_bind_send(req, state, &hdr,
2742 &reply_pdu);
2743 if (!NT_STATUS_IS_OK(status)) {
2744 async_req_error(req, status);
2745 }
2746 break;
2747
2748 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2749 /* Need to send alter context request and reply. */
2750 status = rpc_finish_spnego_ntlmssp_bind_send(req, state, &hdr,
2751 &reply_pdu);
2752 if (!NT_STATUS_IS_OK(status)) {
2753 async_req_error(req, status);
2754 }
2755 break;
2756
2757 case PIPE_AUTH_TYPE_KRB5:
2758 /* */
2759
2760 default:
2761 DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
2762 (unsigned int)state->cli->auth->auth_type));
2763 async_req_error(req, NT_STATUS_INTERNAL_ERROR);
2764 }
2765 }
2766
2767 static NTSTATUS rpc_finish_auth3_bind_send(struct async_req *req,
2768 struct rpc_pipe_bind_state *state,
2769 struct rpc_hdr_info *phdr,
2770 prs_struct *reply_pdu)
2771 {
2772 DATA_BLOB server_response = data_blob_null;
2773 DATA_BLOB client_reply = data_blob_null;
2774 struct rpc_hdr_auth_info hdr_auth;
2775 struct async_req *subreq;
2776 NTSTATUS status;
2777
2778 if ((phdr->auth_len == 0)
2779 || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
2780 return NT_STATUS_INVALID_PARAMETER;
2781 }
2782
2783 if (!prs_set_offset(
2784 reply_pdu,
2785 phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
2786 return NT_STATUS_INVALID_PARAMETER;
2787 }
2788
2789 if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, reply_pdu, 0)) {
2790 return NT_STATUS_INVALID_PARAMETER;
2791 }
2792
2793 /* TODO - check auth_type/auth_level match. */
2794
2795 server_response = data_blob_talloc(talloc_tos(), NULL, phdr->auth_len);
2796 prs_copy_data_out((char *)server_response.data, reply_pdu,
2797 phdr->auth_len);
2798
2799 status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
2800 server_response, &client_reply);
2801
2802 if (!NT_STATUS_IS_OK(status)) {
2803 DEBUG(0, ("rpc_finish_auth3_bind: NTLMSSP update using server "
2804 "blob failed: %s.\n", nt_errstr(status)));
2805 return status;
2806 }
2807
2808 prs_init_empty(&state->rpc_out, talloc_tos(), MARSHALL);
2809
2810 status = create_rpc_bind_auth3(state->cli, state->rpc_call_id,
2811 state->cli->auth->auth_type,
2812 state->cli->auth->auth_level,
2813 &client_reply, &state->rpc_out);
2814 data_blob_free(&client_reply);
2815
2816 if (!NT_STATUS_IS_OK(status)) {
2817 return status;
2818 }
2819
2820 subreq = rpc_write_send(state, state->ev, state->cli,
2821 prs_data_p(&state->rpc_out),
2822 prs_offset(&state->rpc_out));
2823 if (subreq == NULL) {
2824 return NT_STATUS_NO_MEMORY;
2825 }
2826 subreq->async.fn = rpc_bind_auth3_write_done;
2827 subreq->async.priv = req;
2828 return NT_STATUS_OK;
2829 }
2830
2831 static void rpc_bind_auth3_write_done(struct async_req *subreq)
2832 {
2833 struct async_req *req = talloc_get_type_abort(
2834 subreq->async.priv, struct async_req);
2835 NTSTATUS status;
2836
2837 status = rpc_write_recv(subreq);
2838 TALLOC_FREE(subreq);
2839 if (!NT_STATUS_IS_OK(status)) {
2840 async_req_error(req, status);
2841 return;
2842 }
2843 async_req_done(req);
2844 }
2845
2846 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct async_req *req,
2847 struct rpc_pipe_bind_state *state,
2848 struct rpc_hdr_info *phdr,
2849 prs_struct *reply_pdu)
2850 {
2851 DATA_BLOB server_spnego_response = data_blob_null;
2852 DATA_BLOB server_ntlm_response = data_blob_null;
2853 DATA_BLOB client_reply = data_blob_null;
2854 DATA_BLOB tmp_blob = data_blob_null;
2855 RPC_HDR_AUTH hdr_auth;
2856 struct async_req *subreq;
2857 NTSTATUS status;
2858
2859 if ((phdr->auth_len == 0)
2860 || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
2861 return NT_STATUS_INVALID_PARAMETER;
2862 }
2863
2864 /* Process the returned NTLMSSP blob first. */
2865 if (!prs_set_offset(
2866 reply_pdu,
2867 phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
2868 return NT_STATUS_INVALID_PARAMETER;
2869 }
2870
2871 if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, reply_pdu, 0)) {
2872 return NT_STATUS_INVALID_PARAMETER;
2873 }
2874
2875 server_spnego_response = data_blob(NULL, phdr->auth_len);
2876 prs_copy_data_out((char *)server_spnego_response.data,
2877 reply_pdu, phdr->auth_len);
2878
2879 /*
2880 * The server might give us back two challenges - tmp_blob is for the
2881 * second.
2882 */
2883 if (!spnego_parse_challenge(server_spnego_response,
2884 &server_ntlm_response, &tmp_blob)) {
2885 data_blob_free(&server_spnego_response);
2886 data_blob_free(&server_ntlm_response);
2887 data_blob_free(&tmp_blob);
2888 return NT_STATUS_INVALID_PARAMETER;
2889 }
2890
2891 /* We're finished with the server spnego response and the tmp_blob. */
2892 data_blob_free(&server_spnego_response);
2893 data_blob_free(&tmp_blob);
2894
2895 status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
2896 server_ntlm_response, &client_reply);
2897
2898 /* Finished with the server_ntlm response */
2899 data_blob_free(&server_ntlm_response);
2900
2901 if (!NT_STATUS_IS_OK(status)) {
2902 DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: NTLMSSP update "
2903 "using server blob failed.\n"));
2904 data_blob_free(&client_reply);
2905 return status;
2906 }
2907
2908 /* SPNEGO wrap the client reply. */
2909 tmp_blob = spnego_gen_auth(client_reply);
2910 data_blob_free(&client_reply);
2911 client_reply = tmp_blob;
2912 tmp_blob = data_blob_null;
2913
2914 /* Now prepare the alter context pdu. */
2915 prs_init_empty(&state->rpc_out, state, MARSHALL);
2916
2917 status = create_rpc_alter_context(state->rpc_call_id,
2918 &state->cli->abstract_syntax,
2919 &state->cli->transfer_syntax,
2920 state->cli->auth->auth_level,
2921 &client_reply,
2922 &state->rpc_out);
2923 data_blob_free(&client_reply);
2924
2925 if (!NT_STATUS_IS_OK(status)) {
2926 return status;
2927 }
2928
2929 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2930 &state->rpc_out, RPC_ALTCONTRESP);
2931 if (subreq == NULL) {
2932 return NT_STATUS_NO_MEMORY;
2933 }
2934 subreq->async.fn = rpc_bind_ntlmssp_api_done;
2935 subreq->async.priv = req;
2936 return NT_STATUS_OK;
2937 }
2938
2939 static void rpc_bind_ntlmssp_api_done(struct async_req *subreq)
2940 {
2941 struct async_req *req = talloc_get_type_abort(
2942 subreq->async.priv, struct async_req);
2943 struct rpc_pipe_bind_state *state = talloc_get_type_abort(
2944 req->private_data, struct rpc_pipe_bind_state);
2945 DATA_BLOB server_spnego_response = data_blob_null;
2946 DATA_BLOB tmp_blob = data_blob_null;
2947 prs_struct reply_pdu;
2948 struct rpc_hdr_info hdr;
2949 struct rpc_hdr_auth_info hdr_auth;
2950 NTSTATUS status;
2951
2952 status = rpc_api_pipe_recv(subreq, talloc_tos(), &reply_pdu);
2953 TALLOC_FREE(subreq);
2954 if (!NT_STATUS_IS_OK(status)) {
2955 async_req_error(req, status);
2956 return;
2957 }
2958
2959 /* Get the auth blob from the reply. */
2960 if (!smb_io_rpc_hdr("rpc_hdr ", &hdr, &reply_pdu, 0)) {
2961 DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: Failed to "
2962 "unmarshall RPC_HDR.\n"));
2963 async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
2964 return;
2965 }
2966
2967 if (!prs_set_offset(
2968 &reply_pdu,
2969 hdr.frag_len - hdr.auth_len - RPC_HDR_AUTH_LEN)) {
2970 async_req_error(req, NT_STATUS_INVALID_PARAMETER);
2971 return;
2972 }
2973
2974 if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &reply_pdu, 0)) {
2975 async_req_error(req, NT_STATUS_INVALID_PARAMETER);
2976 return;
2977 }
2978
2979 server_spnego_response = data_blob(NULL, hdr.auth_len);
2980 prs_copy_data_out((char *)server_spnego_response.data, &reply_pdu,
2981 hdr.auth_len);
2982
2983 /* Check we got a valid auth response. */
2984 if (!spnego_parse_auth_response(server_spnego_response, NT_STATUS_OK,
2985 OID_NTLMSSP, &tmp_blob)) {
2986 data_blob_free(&server_spnego_response);
2987 data_blob_free(&tmp_blob);
2988 async_req_error(req, NT_STATUS_INVALID_PARAMETER);
2989 return;
2990 }
2991
2992 data_blob_free(&server_spnego_response);
2993 data_blob_free(&tmp_blob);
2994
2995 DEBUG(5,("rpc_finish_spnego_ntlmssp_bind: alter context request to "
2996 "%s.\n", rpccli_pipe_txt(debug_ctx(), state->cli)));
2997 async_req_done(req);
2998 }
2999
3000 NTSTATUS rpc_pipe_bind_recv(struct async_req *req)
3001 {
3002 return async_req_simple_recv(req);
3003 }
3004
3005 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
3006 struct cli_pipe_auth_data *auth)
3007 {
3008 TALLOC_CTX *frame = talloc_stackframe();
3009 struct event_context *ev;
3010 struct async_req *req;
3011 NTSTATUS status = NT_STATUS_NO_MEMORY;
3012
3013 ev = event_context_init(frame);
3014 if (ev == NULL) {
3015 goto fail;
3016 }
3017
3018 req = rpc_pipe_bind_send(frame, ev, cli, auth);
3019 if (req == NULL) {
3020 goto fail;
3021 }
3022
3023 while (req->state < ASYNC_REQ_DONE) {
3024 event_loop_once(ev);
3025 }
3026
3027 status = rpc_pipe_bind_recv(req);
3028 fail:
3029 TALLOC_FREE(frame);
3030 return status;
3031 }
3032
3033 unsigned int rpccli_set_timeout(struct rpc_pipe_client *cli,
3034 unsigned int timeout)
3035 {
3036 return cli_set_timeout(cli->trans.np.cli, timeout);
3037 }
3038
3039 bool rpccli_get_pwd_hash(struct rpc_pipe_client *cli, uint8_t nt_hash[16])
3040 {
3041 if ((cli->auth->auth_type == PIPE_AUTH_TYPE_NTLMSSP)
3042 || (cli->auth->auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP)) {
3043 memcpy(nt_hash, cli->auth->a_u.ntlmssp_state->nt_hash, 16);
3044 return true;
3045 }
3046
3047 if (cli->transport_type == NCACN_NP) {
3048 E_md4hash(cli->trans.np.cli->pwd.password, nt_hash);
3049 return true;
3050 }
3051
3052 return false;
3053 }
3054
3055 struct cli_state *rpc_pipe_np_smb_conn(struct rpc_pipe_client *p)
3056 {
3057 if (p->transport_type == NCACN_NP) {
3058 return p->trans.np.cli;
3059 }
3060 return NULL;
3061 }
3062
3063 static int rpc_pipe_destructor(struct rpc_pipe_client *p)
3064 {
3065 if (p->transport_type == NCACN_NP) {
3066 bool ret;
3067 ret = cli_close(p->trans.np.cli, p->trans.np.fnum);
3068 if (!ret) {
3069 DEBUG(1, ("rpc_pipe_destructor: cli_close failed on "
3070 "pipe %s. Error was %s\n",
3071 rpccli_pipe_txt(debug_ctx(), p),
3072 cli_errstr(p->trans.np.cli)));
3073 }
3074
3075 DEBUG(10, ("rpc_pipe_destructor: closed %s\n",
3076 rpccli_pipe_txt(debug_ctx(), p)));
3077
3078 DLIST_REMOVE(p->trans.np.cli->pipe_list, p);
3079 return ret ? -1 : 0;
3080 }
3081
3082 return -1;
3083 }
3084
3085 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
3086 struct cli_pipe_auth_data **presult)
3087 {
3088 struct cli_pipe_auth_data *result;
3089
3090 result = talloc(mem_ctx, struct cli_pipe_auth_data);
3091 if (result == NULL) {
3092 return NT_STATUS_NO_MEMORY;
3093 }
3094
3095 result->auth_type = PIPE_AUTH_TYPE_NONE;
3096 result->auth_level = PIPE_AUTH_LEVEL_NONE;
3097
3098 result->user_name = talloc_strdup(result, "");
3099 result->domain = talloc_strdup(result, "");
3100 if ((result->user_name == NULL) || (result->domain == NULL)) {
3101 TALLOC_FREE(result);
3102 return NT_STATUS_NO_MEMORY;
3103 }
3104
3105 *presult = result;
3106 return NT_STATUS_OK;
3107 }
3108
3109 static int cli_auth_ntlmssp_data_destructor(struct cli_pipe_auth_data *auth)
3110 {
3111 ntlmssp_end(&auth->a_u.ntlmssp_state);
3112 return 0;
3113 }
3114
3115 NTSTATUS rpccli_ntlmssp_bind_data(TALLOC_CTX *mem_ctx,
3116 enum pipe_auth_type auth_type,
3117 enum pipe_auth_level auth_level,
3118 const char *domain,
3119 const char *username,
3120 const char *password,
3121 struct cli_pipe_auth_data **presult)
3122 {
3123 struct cli_pipe_auth_data *result;
3124 NTSTATUS status;
3125
3126 result = talloc(mem_ctx, struct cli_pipe_auth_data);
3127 if (result == NULL) {
3128 return NT_STATUS_NO_MEMORY;
3129 }
3130
3131 result->auth_type = auth_type;
3132 result->auth_level = auth_level;
3133
3134 result->user_name = talloc_strdup(result, username);
3135 result->domain = talloc_strdup(result, domain);
3136 if ((result->user_name == NULL) || (result->domain == NULL)) {
3137 status = NT_STATUS_NO_MEMORY;
3138 goto fail;
3139 }
3140
3141 status = ntlmssp_client_start(&result->a_u.ntlmssp_state);
3142 if (!NT_STATUS_IS_OK(status)) {
3143 goto fail;
3144 }
3145
3146 talloc_set_destructor(result, cli_auth_ntlmssp_data_destructor);
3147
3148 status = ntlmssp_set_username(result->a_u.ntlmssp_state, username);
3149 if (!NT_STATUS_IS_OK(status)) {
3150 goto fail;
3151 }
3152
3153 status = ntlmssp_set_domain(result->a_u.ntlmssp_state, domain);
3154 if (!NT_STATUS_IS_OK(status)) {
3155 goto fail;
3156 }
3157
3158 status = ntlmssp_set_password(result->a_u.ntlmssp_state, password);
3159 if (!NT_STATUS_IS_OK(status)) {
3160 goto fail;
3161 }
3162
3163 /*
3164 * Turn off sign+seal to allow selected auth level to turn it back on.
3165 */
3166 result->a_u.ntlmssp_state->neg_flags &=
3167 ~(NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_SEAL);
3168
3169 if (auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
3170 result->a_u.ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
3171 } else if (auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
3172 result->a_u.ntlmssp_state->neg_flags
3173 |= NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN;
3174 }
3175
3176 *presult = result;
3177 return NT_STATUS_OK;
3178
3179 fail:
3180 TALLOC_FREE(result);
3181 return status;
3182 }
3183
3184 NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
3185 enum pipe_auth_level auth_level,
3186 const uint8_t sess_key[16],
3187 struct cli_pipe_auth_data **presult)
3188 {
3189 struct cli_pipe_auth_data *result;
3190
3191 result = talloc(mem_ctx, struct cli_pipe_auth_data);
3192 if (result == NULL) {
3193 return NT_STATUS_NO_MEMORY;
3194 }
3195
3196 result->auth_type = PIPE_AUTH_TYPE_SCHANNEL;
3197 result->auth_level = auth_level;
3198
3199 result->user_name = talloc_strdup(result, "");
3200 result->domain = talloc_strdup(result, domain);
3201 if ((result->user_name == NULL) || (result->domain == NULL)) {
3202 goto fail;
3203 }
3204
3205 result->a_u.schannel_auth = talloc(result,
3206 struct schannel_auth_struct);
3207 if (result->a_u.schannel_auth == NULL) {
3208 goto fail;
3209 }
3210
3211 memcpy(result->a_u.schannel_auth->sess_key, sess_key,
3212 sizeof(result->a_u.schannel_auth->sess_key));
3213 result->a_u.schannel_auth->seq_num = 0;
3214
3215 *presult = result;
3216 return NT_STATUS_OK;
3217
3218 fail:
3219 TALLOC_FREE(result);
3220 return NT_STATUS_NO_MEMORY;
3221 }
3222
3223 #ifdef HAVE_KRB5
3224 static int cli_auth_kerberos_data_destructor(struct kerberos_auth_struct *auth)
3225 {
3226 data_blob_free(&auth->session_key);
3227 return 0;
3228 }
3229 #endif
3230
3231 NTSTATUS rpccli_kerberos_bind_data(TALLOC_CTX *mem_ctx,
3232 enum pipe_auth_level auth_level,
3233 const char *service_princ,
3234 const char *username,
3235 const char *password,
3236 struct cli_pipe_auth_data **presult)
3237 {
3238 #ifdef HAVE_KRB5
3239 struct cli_pipe_auth_data *result;
3240
3241 if ((username != NULL) && (password != NULL)) {
3242 int ret = kerberos_kinit_password(username, password, 0, NULL);
3243 if (ret != 0) {
3244 return NT_STATUS_ACCESS_DENIED;
3245 }
3246 }
3247
3248 result = talloc(mem_ctx, struct cli_pipe_auth_data);
3249 if (result == NULL) {
3250 return NT_STATUS_NO_MEMORY;
3251 }
3252
3253 result->auth_type = PIPE_AUTH_TYPE_KRB5;
3254 result->auth_level = auth_level;
3255
3256 /*
3257 * Username / domain need fixing!
3258 */
3259 result->user_name = talloc_strdup(result, "");
3260 result->domain = talloc_strdup(result, "");
3261 if ((result->user_name == NULL) || (result->domain == NULL)) {
3262 goto fail;
3263 }
3264
3265 result->a_u.kerberos_auth = TALLOC_ZERO_P(
3266 result, struct kerberos_auth_struct);
3267 if (result->a_u.kerberos_auth == NULL) {
3268 goto fail;
3269 }
3270 talloc_set_destructor(result->a_u.kerberos_auth,
3271 cli_auth_kerberos_data_destructor);
3272
3273 result->a_u.kerberos_auth->service_principal = talloc_strdup(
3274 result, service_princ);
3275 if (result->a_u.kerberos_auth->service_principal == NULL) {
3276 goto fail;
3277 }
3278
3279 *presult = result;
3280 return NT_STATUS_OK;
3281
3282 fail:
3283 TALLOC_FREE(result);
3284 return NT_STATUS_NO_MEMORY;
3285 #else
3286 return NT_STATUS_NOT_SUPPORTED;
3287 #endif
3288 }
3289
3290 static int rpc_pipe_sock_destructor(struct rpc_pipe_client *p)
3291 {
3292 close(p->trans.sock.fd);
3293 return 0;
3294 }
3295
3296 /**
3297 * Create an rpc pipe client struct, connecting to a tcp port.
3298 */
3299 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
3300 uint16_t port,
3301 const struct ndr_syntax_id *abstract_syntax,
3302 struct rpc_pipe_client **presult)
3303 {
3304 struct rpc_pipe_client *result;
3305 struct sockaddr_storage addr;
3306 NTSTATUS status;
3307
3308 result = TALLOC_ZERO_P(mem_ctx, struct rpc_pipe_client);
3309 if (result == NULL) {
3310 return NT_STATUS_NO_MEMORY;
3311 }
3312
3313 result->transport_type = NCACN_IP_TCP;
3314
3315 result->abstract_syntax = *abstract_syntax;
3316 result->transfer_syntax = ndr_transfer_syntax;
3317 result->dispatch = cli_do_rpc_ndr;
3318
3319 result->desthost = talloc_strdup(result, host);
3320 result->srv_name_slash = talloc_asprintf_strupper_m(
3321 result, "\\\\%s", result->desthost);
3322 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3323 status = NT_STATUS_NO_MEMORY;
3324 goto fail;
3325 }
3326
3327 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3328 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3329
3330 if (!resolve_name(host, &addr, 0)) {
3331 status = NT_STATUS_NOT_FOUND;
3332 goto fail;
3333 }
3334
3335 status = open_socket_out(&addr, port, 60, &result->trans.sock.fd);
3336 if (!NT_STATUS_IS_OK(status)) {
3337 goto fail;
3338 }
3339
3340 talloc_set_destructor(result, rpc_pipe_sock_destructor);
3341
3342 *presult = result;
3343 return NT_STATUS_OK;
3344
3345 fail:
3346 TALLOC_FREE(result);
3347 return status;
3348 }
3349
3350 /**
3351 * Determine the tcp port on which a dcerpc interface is listening
3352 * for the ncacn_ip_tcp transport via the endpoint mapper of the
3353 * target host.
3354 */
3355 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
3356 const struct ndr_syntax_id *abstract_syntax,
3357 uint16_t *pport)
3358 {
3359 NTSTATUS status;
3360 struct rpc_pipe_client *epm_pipe = NULL;
3361 struct cli_pipe_auth_data *auth = NULL;
3362 struct dcerpc_binding *map_binding = NULL;
3363 struct dcerpc_binding *res_binding = NULL;
3364 struct epm_twr_t *map_tower = NULL;
3365 struct epm_twr_t *res_towers = NULL;
3366 struct policy_handle *entry_handle = NULL;
3367 uint32_t num_towers = 0;
3368 uint32_t max_towers = 1;
3369 struct epm_twr_p_t towers;
3370 TALLOC_CTX *tmp_ctx = talloc_stackframe();
3371
3372 if (pport == NULL) {
3373 status = NT_STATUS_INVALID_PARAMETER;
3374 goto done;
3375 }
3376
3377 /* open the connection to the endpoint mapper */
3378 status = rpc_pipe_open_tcp_port(tmp_ctx, host, 135,
3379 &ndr_table_epmapper.syntax_id,
3380 &epm_pipe);
3381
3382 if (!NT_STATUS_IS_OK(status)) {
3383 goto done;
3384 }
3385
3386 status = rpccli_anon_bind_data(tmp_ctx, &auth);
3387 if (!NT_STATUS_IS_OK(status)) {
3388 goto done;
3389 }
3390
3391 status = rpc_pipe_bind(epm_pipe, auth);
3392 if (!NT_STATUS_IS_OK(status)) {
3393 goto done;
3394 }
3395
3396 /* create tower for asking the epmapper */
3397
3398 map_binding = TALLOC_ZERO_P(tmp_ctx, struct dcerpc_binding);
3399 if (map_binding == NULL) {
3400 status = NT_STATUS_NO_MEMORY;
3401 goto done;
3402 }
3403
3404 map_binding->transport = NCACN_IP_TCP;
3405 map_binding->object = *abstract_syntax;
3406 map_binding->host = host; /* needed? */
3407 map_binding->endpoint = "0"; /* correct? needed? */
3408
3409 map_tower = TALLOC_ZERO_P(tmp_ctx, struct epm_twr_t);
3410 if (map_tower == NULL) {
3411 status = NT_STATUS_NO_MEMORY;
3412 goto done;
3413 }
3414
3415 status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
3416 &(map_tower->tower));
3417 if (!NT_STATUS_IS_OK(status)) {
3418 goto done;
3419 }
3420
3421 /* allocate further parameters for the epm_Map call */
3422
3423 res_towers = TALLOC_ARRAY(tmp_ctx, struct epm_twr_t, max_towers);
3424 if (res_towers == NULL) {
3425 status = NT_STATUS_NO_MEMORY;
3426 goto done;
3427 }
3428 towers.twr = res_towers;
3429
3430 entry_handle = TALLOC_ZERO_P(tmp_ctx, struct policy_handle);
3431 if (entry_handle == NULL) {
3432 status = NT_STATUS_NO_MEMORY;
3433 goto done;
3434 }
3435
3436 /* ask the endpoint mapper for the port */
3437
3438 status = rpccli_epm_Map(epm_pipe,
3439 tmp_ctx,
3440 CONST_DISCARD(struct GUID *,
3441 &(abstract_syntax->uuid)),
3442 map_tower,
3443 entry_handle,
3444 max_towers,
3445 &num_towers,
3446 &towers);
3447
3448 if (!NT_STATUS_IS_OK(status)) {
3449 goto done;
3450 }
3451
3452 if (num_towers != 1) {
3453 status = NT_STATUS_UNSUCCESSFUL;
3454 goto done;
3455 }
3456
3457 /* extract the port from the answer */
3458
3459 status = dcerpc_binding_from_tower(tmp_ctx,
3460 &(towers.twr->tower),
3461 &res_binding);
3462 if (!NT_STATUS_IS_OK(status)) {
3463 goto done;
3464 }
3465
3466 /* are further checks here necessary? */
3467 if (res_binding->transport != NCACN_IP_TCP) {
3468 status = NT_STATUS_UNSUCCESSFUL;
3469 goto done;
3470 }
3471
3472 *pport = (uint16_t)atoi(res_binding->endpoint);
3473
3474 done:
3475 TALLOC_FREE(tmp_ctx);
3476 return status;
3477 }
3478
3479 /**
3480 * Create a rpc pipe client struct, connecting to a host via tcp.
3481 * The port is determined by asking the endpoint mapper on the given
3482 * host.
3483 */
3484 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
3485 const struct ndr_syntax_id *abstract_syntax,
3486 struct rpc_pipe_client **presult)
3487 {
3488 NTSTATUS status;
3489 uint16_t port = 0;
3490
3491 *presult = NULL;
3492
3493 status = rpc_pipe_get_tcp_port(host, abstract_syntax, &port);
3494 if (!NT_STATUS_IS_OK(status)) {
3495 goto done;
3496 }
3497
3498 status = rpc_pipe_open_tcp_port(mem_ctx, host, port,
3499 abstract_syntax, presult);
3500
3501 done:
3502 return status;
3503 }
3504
3505 /********************************************************************
3506 Create a rpc pipe client struct, connecting to a unix domain socket
3507 ********************************************************************/
3508 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
3509 const struct ndr_syntax_id *abstract_syntax,
3510 struct rpc_pipe_client **presult)
3511 {
3512 struct rpc_pipe_client *result;
3513 struct sockaddr_un addr;
3514 NTSTATUS status;
3515
3516 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
3517 if (result == NULL) {
3518 return NT_STATUS_NO_MEMORY;
3519 }
3520
3521 result->transport_type = NCACN_UNIX_STREAM;
3522
3523 result->abstract_syntax = *abstract_syntax;
3524 result->transfer_syntax = ndr_transfer_syntax;
3525 result->dispatch = cli_do_rpc_ndr;
3526
3527 result->desthost = talloc_get_myname(result);
3528 result->srv_name_slash = talloc_asprintf_strupper_m(
3529 result, "\\\\%s", result->desthost);
3530 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3531 status = NT_STATUS_NO_MEMORY;
3532 goto fail;
3533 }
3534
3535 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3536 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3537
3538 result->trans.sock.fd = socket(AF_UNIX, SOCK_STREAM, 0);
3539 if (result->trans.sock.fd == -1) {
3540 status = map_nt_error_from_unix(errno);
3541 goto fail;
3542 }
3543
3544 talloc_set_destructor(result, rpc_pipe_sock_destructor);
3545
3546 ZERO_STRUCT(addr);
3547 addr.sun_family = AF_UNIX;
3548 strncpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
3549
3550 if (sys_connect(result->trans.sock.fd,
3551 (struct sockaddr *)&addr) == -1) {
3552 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
3553 strerror(errno)));
3554 close(result->trans.sock.fd);
3555 return map_nt_error_from_unix(errno);
3556 }
3557
3558 *presult = result;
3559 return NT_STATUS_OK;
3560
3561 fail:
3562 TALLOC_FREE(result);
3563 return status;
3564 }
3565
3566
3567 /****************************************************************************
3568 Open a named pipe over SMB to a remote server.
3569 *
3570 * CAVEAT CALLER OF THIS FUNCTION:
3571 * The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
3572 * so be sure that this function is called AFTER any structure (vs pointer)
3573 * assignment of the cli. In particular, libsmbclient does structure
3574 * assignments of cli, which invalidates the data in the returned
3575 * rpc_pipe_client if this function is called before the structure assignment
3576 * of cli.
3577 *
3578 ****************************************************************************/
3579
3580 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
3581 const struct ndr_syntax_id *abstract_syntax,
3582 struct rpc_pipe_client **presult)
3583 {
3584 struct rpc_pipe_client *result;
3585 int fnum;
3586
3587 /* sanity check to protect against crashes */
3588
3589 if ( !cli ) {
3590 return NT_STATUS_INVALID_HANDLE;
3591 }
3592
3593 result = TALLOC_ZERO_P(NULL, struct rpc_pipe_client);
3594 if (result == NULL) {
3595 return NT_STATUS_NO_MEMORY;
3596 }
3597
3598 result->transport_type = NCACN_NP;
3599
3600 result->trans.np.pipe_name = cli_get_pipe_name_from_iface(
3601 result, abstract_syntax);
3602 if (result->trans.np.pipe_name == NULL) {
3603 DEBUG(1, ("Could not find pipe for interface\n"));
3604 TALLOC_FREE(result);
3605 return NT_STATUS_INVALID_PARAMETER;
3606 }
3607
3608 result->trans.np.cli = cli;
3609 result->abstract_syntax = *abstract_syntax;
3610 result->transfer_syntax = ndr_transfer_syntax;
3611 result->dispatch = cli_do_rpc_ndr;
3612 result->desthost = talloc_strdup(result, cli->desthost);
3613 result->srv_name_slash = talloc_asprintf_strupper_m(
3614 result, "\\\\%s", result->desthost);
3615
3616 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3617 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3618
3619 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3620 TALLOC_FREE(result);
3621 return NT_STATUS_NO_MEMORY;
3622 }
3623
3624 fnum = cli_nt_create(cli, result->trans.np.pipe_name,
3625 DESIRED_ACCESS_PIPE);
3626 if (fnum == -1) {
3627 DEBUG(3,("rpc_pipe_open_np: cli_nt_create failed on pipe %s "
3628 "to machine %s. Error was %s\n",
3629 result->trans.np.pipe_name, cli->desthost,
3630 cli_errstr(cli)));
3631 TALLOC_FREE(result);
3632 return cli_get_nt_error(cli);
3633 }
3634
3635 result->trans.np.fnum = fnum;
3636
3637 DLIST_ADD(cli->pipe_list, result);
3638 talloc_set_destructor(result, rpc_pipe_destructor);
3639
3640 *presult = result;
3641 return NT_STATUS_OK;
3642 }
3643
3644 /****************************************************************************
3645 Open a pipe to a remote server.
3646 ****************************************************************************/
3647
3648 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
3649 const struct ndr_syntax_id *interface,
3650 struct rpc_pipe_client **presult)
3651 {
3652 if (ndr_syntax_id_equal(interface, &ndr_table_drsuapi.syntax_id)) {
3653 /*
3654 * We should have a better way to figure out this drsuapi
3655 * speciality...
3656 */
3657 return rpc_pipe_open_tcp(NULL, cli->desthost, interface,
3658 presult);
3659 }
3660
3661 return rpc_pipe_open_np(cli, interface, presult);
3662 }
3663
3664 /****************************************************************************
3665 Open a named pipe to an SMB server and bind anonymously.
3666 ****************************************************************************/
3667
3668 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
3669 const struct ndr_syntax_id *interface,
3670 struct rpc_pipe_client **presult)
3671 {
3672 struct rpc_pipe_client *result;
3673 struct cli_pipe_auth_data *auth;
3674 NTSTATUS status;
3675
3676 status = cli_rpc_pipe_open(cli, interface, &result);
3677 if (!NT_STATUS_IS_OK(status)) {
3678 return status;
3679 }
3680
3681 status = rpccli_anon_bind_data(result, &auth);
3682 if (!NT_STATUS_IS_OK(status)) {
3683 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
3684 nt_errstr(status)));
3685 TALLOC_FREE(result);
3686 return status;
3687 }
3688
3689 /*
3690 * This is a bit of an abstraction violation due to the fact that an
3691 * anonymous bind on an authenticated SMB inherits the user/domain
3692 * from the enclosing SMB creds
3693 */
3694
3695 TALLOC_FREE(auth->user_name);
3696 TALLOC_FREE(auth->domain);
3697
3698 auth->user_name = talloc_strdup(auth, cli->user_name);
3699 auth->domain = talloc_strdup(auth, cli->domain);
3700 auth->user_session_key = data_blob_talloc(auth,
3701 cli->user_session_key.data,
3702 cli->user_session_key.length);
3703
3704 if ((auth->user_name == NULL) || (auth->domain == NULL)) {
3705 TALLOC_FREE(result);
3706 return NT_STATUS_NO_MEMORY;
3707 }
3708
3709 status = rpc_pipe_bind(result, auth);
3710 if (!NT_STATUS_IS_OK(status)) {
3711 int lvl = 0;
3712 if (ndr_syntax_id_equal(interface,
3713 &ndr_table_dssetup.syntax_id)) {
3714 /* non AD domains just don't have this pipe, avoid
3715 * level 0 statement in that case - gd */
3716 lvl = 3;
3717 }
3718 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
3719 "%s failed with error %s\n",
3720 cli_get_pipe_name_from_iface(debug_ctx(),
3721 interface),
3722 nt_errstr(status) ));
3723 TALLOC_FREE(result);
3724 return status;
3725 }
3726
3727 DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
3728 "%s and bound anonymously.\n", result->trans.np.pipe_name,
3729 cli->desthost ));
3730
3731 *presult = result;
3732 return NT_STATUS_OK;
3733 }
3734
3735 /****************************************************************************
3736 Open a named pipe to an SMB server and bind using NTLMSSP or SPNEGO NTLMSSP
3737 ****************************************************************************/
3738
3739 static NTSTATUS cli_rpc_pipe_open_ntlmssp_internal(struct cli_state *cli,
3740 const struct ndr_syntax_id *interface,
3741 enum pipe_auth_type auth_type,
3742 enum pipe_auth_level auth_level,
3743 const char *domain,
3744 const char *username,
3745 const char *password,
3746 struct rpc_pipe_client **presult)
3747 {
3748 struct rpc_pipe_client *result;
3749 struct cli_pipe_auth_data *auth;
3750 NTSTATUS status;
3751
3752 status = cli_rpc_pipe_open(cli, interface, &result);
3753 if (!NT_STATUS_IS_OK(status)) {
3754 return status;
3755 }
3756
3757 status = rpccli_ntlmssp_bind_data(
3758 result, auth_type, auth_level, domain, username,
3759 cli->pwd.null_pwd ? NULL : password, &auth);
3760 if (!NT_STATUS_IS_OK(status)) {
3761 DEBUG(0, ("rpccli_ntlmssp_bind_data returned %s\n",
3762 nt_errstr(status)));
3763 goto err;
3764 }
3765
3766 status = rpc_pipe_bind(result, auth);
3767 if (!NT_STATUS_IS_OK(status)) {
3768 DEBUG(0, ("cli_rpc_pipe_open_ntlmssp_internal: cli_rpc_pipe_bind failed with error %s\n",
3769 nt_errstr(status) ));
3770 goto err;
3771 }
3772
3773 DEBUG(10,("cli_rpc_pipe_open_ntlmssp_internal: opened pipe %s to "
3774 "machine %s and bound NTLMSSP as user %s\\%s.\n",
3775 result->trans.np.pipe_name, cli->desthost,
3776 domain, username ));
3777
3778 *presult = result;
3779 return NT_STATUS_OK;
3780
3781 err:
3782
3783 TALLOC_FREE(result);
3784 return status;
3785 }
3786
3787 /****************************************************************************
3788 External interface.
3789 Open a named pipe to an SMB server and bind using NTLMSSP (bind type 10)
3790 ****************************************************************************/
3791
3792 NTSTATUS cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
3793 const struct ndr_syntax_id *interface,
3794 enum pipe_auth_level auth_level,
3795 const char *domain,
3796 const char *username,
3797 const char *password,
3798 struct rpc_pipe_client **presult)
3799 {
3800 return cli_rpc_pipe_open_ntlmssp_internal(cli,
3801 interface,
3802 PIPE_AUTH_TYPE_NTLMSSP,
3803 auth_level,
3804 domain,
3805 username,
3806 password,
3807 presult);
3808 }
3809
3810 /****************************************************************************
3811 External interface.
3812 Open a named pipe to an SMB server and bind using spnego NTLMSSP (bind type 9)
3813 ****************************************************************************/
3814
3815 NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
3816 const struct ndr_syntax_id *interface,
3817 enum pipe_auth_level auth_level,
3818 const char *domain,
3819 const char *username,
3820 const char *password,
3821 struct rpc_pipe_client **presult)
3822 {
3823 return cli_rpc_pipe_open_ntlmssp_internal(cli,
3824 interface,
3825 PIPE_AUTH_TYPE_SPNEGO_NTLMSSP,
3826 auth_level,
3827 domain,
3828 username,
3829 password,
3830 presult);
3831 }
3832
3833 /****************************************************************************
3834 Get a the schannel session key out of an already opened netlogon pipe.
3835 ****************************************************************************/
3836 static NTSTATUS get_schannel_session_key_common(struct rpc_pipe_client *netlogon_pipe,
3837 struct cli_state *cli,
3838 const char *domain,
3839 uint32 *pneg_flags)
3840 {
3841 uint32 sec_chan_type = 0;
3842 unsigned char machine_pwd[16];
3843 const char *machine_account;
3844 NTSTATUS status;
3845
3846 /* Get the machine account credentials from secrets.tdb. */
3847 if (!get_trust_pw_hash(domain, machine_pwd, &machine_account,
3848 &sec_chan_type))
3849 {
3850 DEBUG(0, ("get_schannel_session_key: could not fetch "
3851 "trust account password for domain '%s'\n",
3852 domain));
3853 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
3854 }
3855
3856 status = rpccli_netlogon_setup_creds(netlogon_pipe,
3857 cli->desthost, /* server name */
3858 domain, /* domain */
3859 global_myname(), /* client name */
3860 machine_account, /* machine account name */
3861 machine_pwd,
3862 sec_chan_type,
3863 pneg_flags);
3864
3865 if (!NT_STATUS_IS_OK(status)) {
3866 DEBUG(3, ("get_schannel_session_key_common: "
3867 "rpccli_netlogon_setup_creds failed with result %s "
3868 "to server %s, domain %s, machine account %s.\n",
3869 nt_errstr(status), cli->desthost, domain,
3870 machine_account ));
3871 return status;
3872 }
3873
3874 if (((*pneg_flags) & NETLOGON_NEG_SCHANNEL) == 0) {
3875 DEBUG(3, ("get_schannel_session_key: Server %s did not offer schannel\n",
3876 cli->desthost));
3877 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3878 }
3879
3880 return NT_STATUS_OK;;
3881 }
3882
3883 /****************************************************************************
3884 Open a netlogon pipe and get the schannel session key.
3885 Now exposed to external callers.
3886 ****************************************************************************/
3887
3888
3889 NTSTATUS get_schannel_session_key(struct cli_state *cli,
3890 const char *domain,
3891 uint32 *pneg_flags,
3892 struct rpc_pipe_client **presult)
3893 {
3894 struct rpc_pipe_client *netlogon_pipe = NULL;
3895 NTSTATUS status;
3896
3897 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
3898 &netlogon_pipe);
3899 if (!NT_STATUS_IS_OK(status)) {
3900 return status;
3901 }
3902
3903 status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
3904 pneg_flags);
3905 if (!NT_STATUS_IS_OK(status)) {
3906 TALLOC_FREE(netlogon_pipe);
3907 return status;
3908 }
3909
3910 *presult = netlogon_pipe;
3911 return NT_STATUS_OK;
3912 }
3913
3914 /****************************************************************************
3915 External interface.
3916 Open a named pipe to an SMB server and bind using schannel (bind type 68)
3917 using session_key. sign and seal.
3918 ****************************************************************************/
3919
3920 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
3921 const struct ndr_syntax_id *interface,
3922 enum pipe_auth_level auth_level,
3923 const char *domain,
3924 const struct dcinfo *pdc,
3925 struct rpc_pipe_client **presult)
3926 {
3927 struct rpc_pipe_client *result;
3928 struct cli_pipe_auth_data *auth;
3929 NTSTATUS status;
3930
3931 status = cli_rpc_pipe_open(cli, interface, &result);
3932 if (!NT_STATUS_IS_OK(status)) {
3933 return status;
3934 }
3935
3936 status = rpccli_schannel_bind_data(result, domain, auth_level,
3937 pdc->sess_key, &auth);
3938 if (!NT_STATUS_IS_OK(status)) {
3939 DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
3940 nt_errstr(status)));
3941 TALLOC_FREE(result);
3942 return status;
3943 }
3944
3945 status = rpc_pipe_bind(result, auth);
3946 if (!NT_STATUS_IS_OK(status)) {
3947 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
3948 "cli_rpc_pipe_bind failed with error %s\n",
3949 nt_errstr(status) ));
3950 TALLOC_FREE(result);
3951 return status;
3952 }
3953
3954 /*
3955 * The credentials on a new netlogon pipe are the ones we are passed
3956 * in - copy them over.
3957 */
3958 result->dc = (struct dcinfo *)talloc_memdup(result, pdc, sizeof(*pdc));
3959 if (result->dc == NULL) {
3960 DEBUG(0, ("talloc failed\n"));
3961 TALLOC_FREE(result);
3962 return NT_STATUS_NO_MEMORY;
3963 }
3964
3965 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
3966 "for domain %s "
3967 "and bound using schannel.\n",
3968 result->trans.np.pipe_name, cli->desthost, domain ));
3969
3970 *presult = result;
3971 return NT_STATUS_OK;
3972 }
3973
3974 /****************************************************************************
3975 Open a named pipe to an SMB server and bind using schannel (bind type 68).
3976 Fetch the session key ourselves using a temporary netlogon pipe. This
3977 version uses an ntlmssp auth bound netlogon pipe to get the key.
3978 ****************************************************************************/
3979
3980 static NTSTATUS get_schannel_session_key_auth_ntlmssp(struct cli_state *cli,
3981 const char *domain,
3982 const char *username,
3983 const char *password,
3984 uint32 *pneg_flags,
3985 struct rpc_pipe_client **presult)
3986 {
3987 struct rpc_pipe_client *netlogon_pipe = NULL;
3988 NTSTATUS status;
3989
3990 status = cli_rpc_pipe_open_spnego_ntlmssp(
3991 cli, &ndr_table_netlogon.syntax_id, PIPE_AUTH_LEVEL_PRIVACY,
3992 domain, username, password, &netlogon_pipe);
3993 if (!NT_STATUS_IS_OK(status)) {
3994 return status;
3995 }
3996
3997 status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
3998 pneg_flags);
3999 if (!NT_STATUS_IS_OK(status)) {
4000 TALLOC_FREE(netlogon_pipe);
4001 return status;
4002 }
4003
4004 *presult = netlogon_pipe;
4005 return NT_STATUS_OK;
4006 }
4007
4008 /****************************************************************************
4009 Open a named pipe to an SMB server and bind using schannel (bind type 68).
4010 Fetch the session key ourselves using a temporary netlogon pipe. This version
4011 uses an ntlmssp bind to get the session key.
4012 ****************************************************************************/
4013
4014 NTSTATUS cli_rpc_pipe_open_ntlmssp_auth_schannel(struct cli_state *cli,
4015 const struct ndr_syntax_id *interface,
4016 enum pipe_auth_level auth_level,
4017 const char *domain,
4018 const char *username,
4019 const char *password,
4020 struct rpc_pipe_client **presult)
4021 {
4022 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
4023 struct rpc_pipe_client *netlogon_pipe = NULL;
4024 struct rpc_pipe_client *result = NULL;
4025 NTSTATUS status;
4026
4027 status = get_schannel_session_key_auth_ntlmssp(
4028 cli, domain, username, password, &neg_flags, &netlogon_pipe);
4029 if (!NT_STATUS_IS_OK(status)) {
4030 DEBUG(0,("cli_rpc_pipe_open_ntlmssp_auth_schannel: failed to get schannel session "
4031 "key from server %s for domain %s.\n",
4032 cli->desthost, domain ));
4033 return status;
4034 }
4035
4036 status = cli_rpc_pipe_open_schannel_with_key(
4037 cli, interface, auth_level, domain, netlogon_pipe->dc,
4038 &result);
4039
4040 /* Now we've bound using the session key we can close the netlog pipe. */
4041 TALLOC_FREE(netlogon_pipe);
4042
4043 if (NT_STATUS_IS_OK(status)) {
4044 *presult = result;
4045 }
4046 return status;
4047 }
4048
4049 /****************************************************************************
4050 Open a named pipe to an SMB server and bind using schannel (bind type 68).
4051 Fetch the session key ourselves using a temporary netlogon pipe.
4052 ****************************************************************************/
4053
4054 NTSTATUS cli_rpc_pipe_open_schannel(struct cli_state *cli,
4055 const struct ndr_syntax_id *interface,
4056 enum pipe_auth_level auth_level,
4057 const char *domain,
4058 struct rpc_pipe_client **presult)
4059 {
4060 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
4061 struct rpc_pipe_client *netlogon_pipe = NULL;
4062 struct rpc_pipe_client *result = NULL;
4063 NTSTATUS status;
4064
4065 status = get_schannel_session_key(cli, domain, &neg_flags,
4066 &netlogon_pipe);
4067 if (!NT_STATUS_IS_OK(status)) {
4068 DEBUG(0,("cli_rpc_pipe_open_schannel: failed to get schannel session "
4069 "key from server %s for domain %s.\n",
4070 cli->desthost, domain ));
4071 return status;
4072 }
4073
4074 status = cli_rpc_pipe_open_schannel_with_key(
4075 cli, interface, auth_level, domain, netlogon_pipe->dc,
4076 &result);
4077
4078 /* Now we've bound using the session key we can close the netlog pipe. */
4079 TALLOC_FREE(netlogon_pipe);
4080
4081 if (NT_STATUS_IS_OK(status)) {
4082 *presult = result;
4083 }
4084
4085 return NT_STATUS_OK;
4086 }
4087
4088 /****************************************************************************
4089 Open a named pipe to an SMB server and bind using krb5 (bind type 16).
4090 The idea is this can be called with service_princ, username and password all
4091 NULL so long as the caller has a TGT.
4092 ****************************************************************************/
4093
4094 NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
4095 const struct ndr_syntax_id *interface,
4096 enum pipe_auth_level auth_level,
4097 const char *service_princ,
4098 const char *username,
4099 const char *password,
4100 struct rpc_pipe_client **presult)
4101 {
4102 #ifdef HAVE_KRB5
4103 struct rpc_pipe_client *result;
4104 struct cli_pipe_auth_data *auth;
4105 NTSTATUS status;
4106
4107 status = cli_rpc_pipe_open(cli, interface, &result);
4108 if (!NT_STATUS_IS_OK(status)) {
4109 return status;
4110 }
4111
4112 status = rpccli_kerberos_bind_data(result, auth_level, service_princ,
4113 username, password, &auth);
4114 if (!NT_STATUS_IS_OK(status)) {
4115 DEBUG(0, ("rpccli_kerberos_bind_data returned %s\n",
4116 nt_errstr(status)));
4117 TALLOC_FREE(result);
4118 return status;
4119 }
4120
4121 status = rpc_pipe_bind(result, auth);
4122 if (!NT_STATUS_IS_OK(status)) {
4123 DEBUG(0, ("cli_rpc_pipe_open_krb5: cli_rpc_pipe_bind failed "
4124 "with error %s\n", nt_errstr(status)));
4125 TALLOC_FREE(result);
4126 return status;
4127 }
4128
4129 *presult = result;
4130 return NT_STATUS_OK;
4131 #else
4132 DEBUG(0,("cli_rpc_pipe_open_krb5: kerberos not found at compile time.\n"));
4133 return NT_STATUS_NOT_IMPLEMENTED;
4134 #endif
4135 }
4136
4137 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
4138 struct rpc_pipe_client *cli,
4139 DATA_BLOB *session_key)
4140 {
4141 if (!session_key || !cli) {
4142 return NT_STATUS_INVALID_PARAMETER;
4143 }
4144
4145 if (!cli->auth) {
4146 return NT_STATUS_INVALID_PARAMETER;
4147 }
4148
4149 switch (cli->auth->auth_type) {
4150 case PIPE_AUTH_TYPE_SCHANNEL:
4151 *session_key = data_blob_talloc(mem_ctx,
4152 cli->auth->a_u.schannel_auth->sess_key, 16);
4153 break;
4154 case PIPE_AUTH_TYPE_NTLMSSP:
4155 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
4156 *session_key = data_blob_talloc(mem_ctx,
4157 cli->auth->a_u.ntlmssp_state->session_key.data,
4158 cli->auth->a_u.ntlmssp_state->session_key.length);
4159 break;
4160 case PIPE_AUTH_TYPE_KRB5:
4161 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
4162 *session_key = data_blob_talloc(mem_ctx,
4163 cli->auth->a_u.kerberos_auth->session_key.data,
4164 cli->auth->a_u.kerberos_auth->session_key.length);
4165 break;
4166 case PIPE_AUTH_TYPE_NONE:
4167 *session_key = data_blob_talloc(mem_ctx,
4168 cli->auth->user_session_key.data,
4169 cli->auth->user_session_key.length);
4170 break;
4171 default:
4172 return NT_STATUS_NO_USER_SESSION_KEY;
4173 }
4174
4175 return NT_STATUS_OK;
4176 }
4177
4178 /**
4179 * Create a new RPC client context which uses a local dispatch function.
4180 */
4181 NTSTATUS rpc_pipe_open_internal(TALLOC_CTX *mem_ctx, const struct ndr_syntax_id *abstract_syntax,
4182 NTSTATUS (*dispatch) (struct rpc_pipe_client *cli, TALLOC_CTX *mem_ctx, const struct ndr_interface_table *table, uint32_t opnum, void *r),
4183 struct auth_serversupplied_info *serversupplied_info,
4184 struct rpc_pipe_client **presult)
4185 {
4186 struct rpc_pipe_client *result;
4187
4188 result = TALLOC_ZERO_P(mem_ctx, struct rpc_pipe_client);
4189 if (result == NULL) {
4190 return NT_STATUS_NO_MEMORY;
4191 }
4192
4193 result->transport_type = NCACN_INTERNAL;
4194
4195 result->abstract_syntax = *abstract_syntax;
4196 result->transfer_syntax = ndr_transfer_syntax;
4197 result->dispatch = dispatch;
4198
4199 result->pipes_struct = TALLOC_ZERO_P(mem_ctx, pipes_struct);
4200 if (result->pipes_struct == NULL) {
4201 TALLOC_FREE(result);
4202 return NT_STATUS_NO_MEMORY;
4203 }
4204 result->pipes_struct->mem_ctx = mem_ctx;
4205 result->pipes_struct->server_info = serversupplied_info;
4206 result->pipes_struct->pipe_bound = true;
4207
4208 result->max_xmit_frag = -1;
4209 result->max_recv_frag = -1;
4210
4211 *presult = result;
4212 return NT_STATUS_OK;
4213 }
4214
4215
Samba GIT mirror