?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ctdb-scripts: Drop all public IP addresses from 10.interface
[Samba.git] / source3 / rpc_client / cli_pipe.c
blob6cff27a8d4d4e712189739660a4cd6f426a22600
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client routines
4 * Largely rewritten by Jeremy Allison 2005.
5 * Heavily modified by Simo Sorce 2010.
6 * Copyright Andrew Bartlett 2011.
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "../lib/util/tevent_ntstatus.h"
24 #include "librpc/gen_ndr/ndr_epmapper_c.h"
25 #include "../librpc/gen_ndr/ndr_dssetup.h"
26 #include "../libcli/auth/schannel.h"
27 #include "../libcli/auth/netlogon_creds_cli.h"
28 #include "auth_generic.h"
29 #include "librpc/gen_ndr/ndr_dcerpc.h"
30 #include "librpc/gen_ndr/ndr_netlogon_c.h"
31 #include "librpc/rpc/dcerpc.h"
32 #include "rpc_dce.h"
33 #include "cli_pipe.h"
34 #include "libsmb/libsmb.h"
35 #include "auth/gensec/gensec.h"
36 #include "auth/credentials/credentials.h"
37 #include "../libcli/smb/smbXcli_base.h"
38
39 #undef DBGC_CLASS
40 #define DBGC_CLASS DBGC_RPC_CLI
41
42 /********************************************************************
43 Pipe description for a DEBUG
44 ********************************************************************/
45 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
46 struct rpc_pipe_client *cli)
47 {
48 char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
49 if (result == NULL) {
50 return "pipe";
51 }
52 return result;
53 }
54
55 /********************************************************************
56 Rpc pipe call id.
57 ********************************************************************/
58
59 static uint32_t get_rpc_call_id(void)
60 {
61 static uint32_t call_id = 0;
62 return ++call_id;
63 }
64
65 /*******************************************************************
66 Use SMBreadX to get rest of one fragment's worth of rpc data.
67 Reads the whole size or give an error message
68 ********************************************************************/
69
70 struct rpc_read_state {
71 struct tevent_context *ev;
72 struct rpc_cli_transport *transport;
73 uint8_t *data;
74 size_t size;
75 size_t num_read;
76 };
77
78 static void rpc_read_done(struct tevent_req *subreq);
79
80 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
81 struct tevent_context *ev,
82 struct rpc_cli_transport *transport,
83 uint8_t *data, size_t size)
84 {
85 struct tevent_req *req, *subreq;
86 struct rpc_read_state *state;
87
88 req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
89 if (req == NULL) {
90 return NULL;
91 }
92 state->ev = ev;
93 state->transport = transport;
94 state->data = data;
95 state->size = size;
96 state->num_read = 0;
97
98 DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
99
100 subreq = transport->read_send(state, ev, (uint8_t *)data, size,
101 transport->priv);
102 if (subreq == NULL) {
103 goto fail;
104 }
105 tevent_req_set_callback(subreq, rpc_read_done, req);
106 return req;
107
108 fail:
109 TALLOC_FREE(req);
110 return NULL;
111 }
112
113 static void rpc_read_done(struct tevent_req *subreq)
114 {
115 struct tevent_req *req = tevent_req_callback_data(
116 subreq, struct tevent_req);
117 struct rpc_read_state *state = tevent_req_data(
118 req, struct rpc_read_state);
119 NTSTATUS status;
120 ssize_t received;
121
122 status = state->transport->read_recv(subreq, &received);
123 TALLOC_FREE(subreq);
124 if (!NT_STATUS_IS_OK(status)) {
125 tevent_req_nterror(req, status);
126 return;
127 }
128
129 state->num_read += received;
130 if (state->num_read == state->size) {
131 tevent_req_done(req);
132 return;
133 }
134
135 subreq = state->transport->read_send(state, state->ev,
136 state->data + state->num_read,
137 state->size - state->num_read,
138 state->transport->priv);
139 if (tevent_req_nomem(subreq, req)) {
140 return;
141 }
142 tevent_req_set_callback(subreq, rpc_read_done, req);
143 }
144
145 static NTSTATUS rpc_read_recv(struct tevent_req *req)
146 {
147 return tevent_req_simple_recv_ntstatus(req);
148 }
149
150 struct rpc_write_state {
151 struct tevent_context *ev;
152 struct rpc_cli_transport *transport;
153 const uint8_t *data;
154 size_t size;
155 size_t num_written;
156 };
157
158 static void rpc_write_done(struct tevent_req *subreq);
159
160 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
161 struct tevent_context *ev,
162 struct rpc_cli_transport *transport,
163 const uint8_t *data, size_t size)
164 {
165 struct tevent_req *req, *subreq;
166 struct rpc_write_state *state;
167
168 req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
169 if (req == NULL) {
170 return NULL;
171 }
172 state->ev = ev;
173 state->transport = transport;
174 state->data = data;
175 state->size = size;
176 state->num_written = 0;
177
178 DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
179
180 subreq = transport->write_send(state, ev, data, size, transport->priv);
181 if (subreq == NULL) {
182 goto fail;
183 }
184 tevent_req_set_callback(subreq, rpc_write_done, req);
185 return req;
186 fail:
187 TALLOC_FREE(req);
188 return NULL;
189 }
190
191 static void rpc_write_done(struct tevent_req *subreq)
192 {
193 struct tevent_req *req = tevent_req_callback_data(
194 subreq, struct tevent_req);
195 struct rpc_write_state *state = tevent_req_data(
196 req, struct rpc_write_state);
197 NTSTATUS status;
198 ssize_t written;
199
200 status = state->transport->write_recv(subreq, &written);
201 TALLOC_FREE(subreq);
202 if (!NT_STATUS_IS_OK(status)) {
203 tevent_req_nterror(req, status);
204 return;
205 }
206
207 state->num_written += written;
208
209 if (state->num_written == state->size) {
210 tevent_req_done(req);
211 return;
212 }
213
214 subreq = state->transport->write_send(state, state->ev,
215 state->data + state->num_written,
216 state->size - state->num_written,
217 state->transport->priv);
218 if (tevent_req_nomem(subreq, req)) {
219 return;
220 }
221 tevent_req_set_callback(subreq, rpc_write_done, req);
222 }
223
224 static NTSTATUS rpc_write_recv(struct tevent_req *req)
225 {
226 return tevent_req_simple_recv_ntstatus(req);
227 }
228
229
230 /****************************************************************************
231 Try and get a PDU's worth of data from current_pdu. If not, then read more
232 from the wire.
233 ****************************************************************************/
234
235 struct get_complete_frag_state {
236 struct tevent_context *ev;
237 struct rpc_pipe_client *cli;
238 uint16_t frag_len;
239 DATA_BLOB *pdu;
240 };
241
242 static void get_complete_frag_got_header(struct tevent_req *subreq);
243 static void get_complete_frag_got_rest(struct tevent_req *subreq);
244
245 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
246 struct tevent_context *ev,
247 struct rpc_pipe_client *cli,
248 DATA_BLOB *pdu)
249 {
250 struct tevent_req *req, *subreq;
251 struct get_complete_frag_state *state;
252 size_t received;
253 NTSTATUS status;
254
255 req = tevent_req_create(mem_ctx, &state,
256 struct get_complete_frag_state);
257 if (req == NULL) {
258 return NULL;
259 }
260 state->ev = ev;
261 state->cli = cli;
262 state->frag_len = RPC_HEADER_LEN;
263 state->pdu = pdu;
264
265 received = pdu->length;
266 if (received < RPC_HEADER_LEN) {
267 if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
268 status = NT_STATUS_NO_MEMORY;
269 goto post_status;
270 }
271 subreq = rpc_read_send(state, state->ev,
272 state->cli->transport,
273 pdu->data + received,
274 RPC_HEADER_LEN - received);
275 if (subreq == NULL) {
276 status = NT_STATUS_NO_MEMORY;
277 goto post_status;
278 }
279 tevent_req_set_callback(subreq, get_complete_frag_got_header,
280 req);
281 return req;
282 }
283
284 state->frag_len = dcerpc_get_frag_length(pdu);
285 if (state->frag_len < RPC_HEADER_LEN) {
286 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
287 return tevent_req_post(req, ev);
288 }
289
290 /*
291 * Ensure we have frag_len bytes of data.
292 */
293 if (received < state->frag_len) {
294 if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
295 status = NT_STATUS_NO_MEMORY;
296 goto post_status;
297 }
298 subreq = rpc_read_send(state, state->ev,
299 state->cli->transport,
300 pdu->data + received,
301 state->frag_len - received);
302 if (subreq == NULL) {
303 status = NT_STATUS_NO_MEMORY;
304 goto post_status;
305 }
306 tevent_req_set_callback(subreq, get_complete_frag_got_rest,
307 req);
308 return req;
309 }
310
311 status = NT_STATUS_OK;
312 post_status:
313 if (NT_STATUS_IS_OK(status)) {
314 tevent_req_done(req);
315 } else {
316 tevent_req_nterror(req, status);
317 }
318 return tevent_req_post(req, ev);
319 }
320
321 static void get_complete_frag_got_header(struct tevent_req *subreq)
322 {
323 struct tevent_req *req = tevent_req_callback_data(
324 subreq, struct tevent_req);
325 struct get_complete_frag_state *state = tevent_req_data(
326 req, struct get_complete_frag_state);
327 NTSTATUS status;
328
329 status = rpc_read_recv(subreq);
330 TALLOC_FREE(subreq);
331 if (!NT_STATUS_IS_OK(status)) {
332 tevent_req_nterror(req, status);
333 return;
334 }
335
336 state->frag_len = dcerpc_get_frag_length(state->pdu);
337 if (state->frag_len < RPC_HEADER_LEN) {
338 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
339 return;
340 }
341
342 if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
343 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
344 return;
345 }
346
347 /*
348 * We're here in this piece of code because we've read exactly
349 * RPC_HEADER_LEN bytes into state->pdu.
350 */
351
352 subreq = rpc_read_send(state, state->ev, state->cli->transport,
353 state->pdu->data + RPC_HEADER_LEN,
354 state->frag_len - RPC_HEADER_LEN);
355 if (tevent_req_nomem(subreq, req)) {
356 return;
357 }
358 tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
359 }
360
361 static void get_complete_frag_got_rest(struct tevent_req *subreq)
362 {
363 struct tevent_req *req = tevent_req_callback_data(
364 subreq, struct tevent_req);
365 NTSTATUS status;
366
367 status = rpc_read_recv(subreq);
368 TALLOC_FREE(subreq);
369 if (!NT_STATUS_IS_OK(status)) {
370 tevent_req_nterror(req, status);
371 return;
372 }
373 tevent_req_done(req);
374 }
375
376 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
377 {
378 return tevent_req_simple_recv_ntstatus(req);
379 }
380
381 /****************************************************************************
382 Do basic authentication checks on an incoming pdu.
383 ****************************************************************************/
384
385 static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
386 struct rpc_pipe_client *cli,
387 struct ncacn_packet *pkt,
388 DATA_BLOB *pdu,
389 uint8_t expected_pkt_type,
390 uint32_t call_id,
391 DATA_BLOB *rdata,
392 DATA_BLOB *reply_pdu)
393 {
394 struct dcerpc_response *r;
395 NTSTATUS ret = NT_STATUS_OK;
396 size_t pad_len = 0;
397
398 /*
399 * Point the return values at the real data including the RPC
400 * header. Just in case the caller wants it.
401 */
402 *rdata = *pdu;
403
404 /* Ensure we have the correct type. */
405 switch (pkt->ptype) {
406 case DCERPC_PKT_ALTER_RESP:
407 case DCERPC_PKT_BIND_ACK:
408
409 /* Client code never receives this kind of packets */
410 break;
411
412
413 case DCERPC_PKT_RESPONSE:
414
415 r = &pkt->u.response;
416
417 /* Here's where we deal with incoming sign/seal. */
418 ret = dcerpc_check_auth(cli->auth, pkt,
419 &r->stub_and_verifier,
420 DCERPC_RESPONSE_LENGTH,
421 pdu, &pad_len);
422 if (!NT_STATUS_IS_OK(ret)) {
423 return ret;
424 }
425
426 if (pkt->frag_length < DCERPC_RESPONSE_LENGTH + pad_len) {
427 return NT_STATUS_BUFFER_TOO_SMALL;
428 }
429
430 /* Point the return values at the NDR data. */
431 rdata->data = r->stub_and_verifier.data;
432
433 if (pkt->auth_length) {
434 /* We've already done integer wrap tests in
435 * dcerpc_check_auth(). */
436 rdata->length = r->stub_and_verifier.length
437 - pad_len
438 - DCERPC_AUTH_TRAILER_LENGTH
439 - pkt->auth_length;
440 } else {
441 rdata->length = r->stub_and_verifier.length;
442 }
443
444 DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
445 (long unsigned int)pdu->length,
446 (long unsigned int)rdata->length,
447 (unsigned int)pad_len));
448
449 /*
450 * If this is the first reply, and the allocation hint is
451 * reasonable, try and set up the reply_pdu DATA_BLOB to the
452 * correct size.
453 */
454
455 if ((reply_pdu->length == 0) &&
456 r->alloc_hint && (r->alloc_hint < 15*1024*1024)) {
457 if (!data_blob_realloc(mem_ctx, reply_pdu,
458 r->alloc_hint)) {
459 DEBUG(0, ("reply alloc hint %d too "
460 "large to allocate\n",
461 (int)r->alloc_hint));
462 return NT_STATUS_NO_MEMORY;
463 }
464 }
465
466 break;
467
468 case DCERPC_PKT_BIND_NAK:
469 DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
470 rpccli_pipe_txt(talloc_tos(), cli)));
471 /* Use this for now... */
472 return NT_STATUS_NETWORK_ACCESS_DENIED;
473
474 case DCERPC_PKT_FAULT:
475
476 DEBUG(1, (__location__ ": RPC fault code %s received "
477 "from %s!\n",
478 dcerpc_errstr(talloc_tos(),
479 pkt->u.fault.status),
480 rpccli_pipe_txt(talloc_tos(), cli)));
481
482 return dcerpc_fault_to_nt_status(pkt->u.fault.status);
483
484 default:
485 DEBUG(0, (__location__ "Unknown packet type %u received "
486 "from %s!\n",
487 (unsigned int)pkt->ptype,
488 rpccli_pipe_txt(talloc_tos(), cli)));
489 return NT_STATUS_RPC_PROTOCOL_ERROR;
490 }
491
492 if (pkt->ptype != expected_pkt_type) {
493 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
494 "RPC packet type - %u, not %u\n",
495 rpccli_pipe_txt(talloc_tos(), cli),
496 pkt->ptype, expected_pkt_type));
497 return NT_STATUS_RPC_PROTOCOL_ERROR;
498 }
499
500 if (pkt->call_id != call_id) {
501 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
502 "RPC call_id - %u, not %u\n",
503 rpccli_pipe_txt(talloc_tos(), cli),
504 pkt->call_id, call_id));
505 return NT_STATUS_RPC_PROTOCOL_ERROR;
506 }
507
508 /* Do this just before return - we don't want to modify any rpc header
509 data before now as we may have needed to do cryptographic actions on
510 it before. */
511
512 if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
513 !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
514 DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
515 "fragment first/last ON.\n"));
516 pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
517 }
518
519 return NT_STATUS_OK;
520 }
521
522 /****************************************************************************
523 Call a remote api on an arbitrary pipe. takes param, data and setup buffers.
524 ****************************************************************************/
525
526 struct cli_api_pipe_state {
527 struct tevent_context *ev;
528 struct rpc_cli_transport *transport;
529 uint8_t *rdata;
530 uint32_t rdata_len;
531 };
532
533 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
534 static void cli_api_pipe_write_done(struct tevent_req *subreq);
535 static void cli_api_pipe_read_done(struct tevent_req *subreq);
536
537 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
538 struct tevent_context *ev,
539 struct rpc_cli_transport *transport,
540 uint8_t *data, size_t data_len,
541 uint32_t max_rdata_len)
542 {
543 struct tevent_req *req, *subreq;
544 struct cli_api_pipe_state *state;
545 NTSTATUS status;
546
547 req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
548 if (req == NULL) {
549 return NULL;
550 }
551 state->ev = ev;
552 state->transport = transport;
553
554 if (max_rdata_len < RPC_HEADER_LEN) {
555 /*
556 * For a RPC reply we always need at least RPC_HEADER_LEN
557 * bytes. We check this here because we will receive
558 * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
559 */
560 status = NT_STATUS_INVALID_PARAMETER;
561 goto post_status;
562 }
563
564 if (transport->trans_send != NULL) {
565 subreq = transport->trans_send(state, ev, data, data_len,
566 max_rdata_len, transport->priv);
567 if (subreq == NULL) {
568 goto fail;
569 }
570 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
571 return req;
572 }
573
574 /*
575 * If the transport does not provide a "trans" routine, i.e. for
576 * example the ncacn_ip_tcp transport, do the write/read step here.
577 */
578
579 subreq = rpc_write_send(state, ev, transport, data, data_len);
580 if (subreq == NULL) {
581 goto fail;
582 }
583 tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
584 return req;
585
586 post_status:
587 tevent_req_nterror(req, status);
588 return tevent_req_post(req, ev);
589 fail:
590 TALLOC_FREE(req);
591 return NULL;
592 }
593
594 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
595 {
596 struct tevent_req *req = tevent_req_callback_data(
597 subreq, struct tevent_req);
598 struct cli_api_pipe_state *state = tevent_req_data(
599 req, struct cli_api_pipe_state);
600 NTSTATUS status;
601
602 status = state->transport->trans_recv(subreq, state, &state->rdata,
603 &state->rdata_len);
604 TALLOC_FREE(subreq);
605 if (!NT_STATUS_IS_OK(status)) {
606 tevent_req_nterror(req, status);
607 return;
608 }
609 tevent_req_done(req);
610 }
611
612 static void cli_api_pipe_write_done(struct tevent_req *subreq)
613 {
614 struct tevent_req *req = tevent_req_callback_data(
615 subreq, struct tevent_req);
616 struct cli_api_pipe_state *state = tevent_req_data(
617 req, struct cli_api_pipe_state);
618 NTSTATUS status;
619
620 status = rpc_write_recv(subreq);
621 TALLOC_FREE(subreq);
622 if (!NT_STATUS_IS_OK(status)) {
623 tevent_req_nterror(req, status);
624 return;
625 }
626
627 state->rdata = talloc_array(state, uint8_t, RPC_HEADER_LEN);
628 if (tevent_req_nomem(state->rdata, req)) {
629 return;
630 }
631
632 /*
633 * We don't need to use rpc_read_send here, the upper layer will cope
634 * with a short read, transport->trans_send could also return less
635 * than state->max_rdata_len.
636 */
637 subreq = state->transport->read_send(state, state->ev, state->rdata,
638 RPC_HEADER_LEN,
639 state->transport->priv);
640 if (tevent_req_nomem(subreq, req)) {
641 return;
642 }
643 tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
644 }
645
646 static void cli_api_pipe_read_done(struct tevent_req *subreq)
647 {
648 struct tevent_req *req = tevent_req_callback_data(
649 subreq, struct tevent_req);
650 struct cli_api_pipe_state *state = tevent_req_data(
651 req, struct cli_api_pipe_state);
652 NTSTATUS status;
653 ssize_t received;
654
655 status = state->transport->read_recv(subreq, &received);
656 TALLOC_FREE(subreq);
657 if (!NT_STATUS_IS_OK(status)) {
658 tevent_req_nterror(req, status);
659 return;
660 }
661 state->rdata_len = received;
662 tevent_req_done(req);
663 }
664
665 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
666 uint8_t **prdata, uint32_t *prdata_len)
667 {
668 struct cli_api_pipe_state *state = tevent_req_data(
669 req, struct cli_api_pipe_state);
670 NTSTATUS status;
671
672 if (tevent_req_is_nterror(req, &status)) {
673 return status;
674 }
675
676 *prdata = talloc_move(mem_ctx, &state->rdata);
677 *prdata_len = state->rdata_len;
678 return NT_STATUS_OK;
679 }
680
681 /****************************************************************************
682 Send data on an rpc pipe via trans. The data must be the last
683 pdu fragment of an NDR data stream.
684
685 Receive response data from an rpc pipe, which may be large...
686
687 Read the first fragment: unfortunately have to use SMBtrans for the first
688 bit, then SMBreadX for subsequent bits.
689
690 If first fragment received also wasn't the last fragment, continue
691 getting fragments until we _do_ receive the last fragment.
692
693 Request/Response PDU's look like the following...
694
695 |<------------------PDU len----------------------------------------------->|
696 |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
697
698 +------------+-----------------+-------------+---------------+-------------+
699 | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR | AUTH DATA |
700 +------------+-----------------+-------------+---------------+-------------+
701
702 Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
703 signing & sealing being negotiated.
704
705 ****************************************************************************/
706
707 struct rpc_api_pipe_state {
708 struct tevent_context *ev;
709 struct rpc_pipe_client *cli;
710 uint8_t expected_pkt_type;
711 uint32_t call_id;
712
713 DATA_BLOB incoming_frag;
714 struct ncacn_packet *pkt;
715
716 /* Incoming reply */
717 DATA_BLOB reply_pdu;
718 size_t reply_pdu_offset;
719 uint8_t endianess;
720 };
721
722 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
723 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
724 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq);
725
726 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
727 struct tevent_context *ev,
728 struct rpc_pipe_client *cli,
729 DATA_BLOB *data, /* Outgoing PDU */
730 uint8_t expected_pkt_type,
731 uint32_t call_id)
732 {
733 struct tevent_req *req, *subreq;
734 struct rpc_api_pipe_state *state;
735 uint16_t max_recv_frag;
736 NTSTATUS status;
737
738 req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
739 if (req == NULL) {
740 return NULL;
741 }
742 state->ev = ev;
743 state->cli = cli;
744 state->expected_pkt_type = expected_pkt_type;
745 state->call_id = call_id;
746 state->endianess = DCERPC_DREP_LE;
747
748 /*
749 * Ensure we're not sending too much.
750 */
751 if (data->length > cli->max_xmit_frag) {
752 status = NT_STATUS_INVALID_PARAMETER;
753 goto post_status;
754 }
755
756 DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
757
758 if (state->expected_pkt_type == DCERPC_PKT_AUTH3) {
759 subreq = rpc_write_send(state, ev, cli->transport,
760 data->data, data->length);
761 if (subreq == NULL) {
762 goto fail;
763 }
764 tevent_req_set_callback(subreq, rpc_api_pipe_auth3_done, req);
765 return req;
766 }
767
768 /* get the header first, then fetch the rest once we have
769 * the frag_length available */
770 max_recv_frag = RPC_HEADER_LEN;
771
772 subreq = cli_api_pipe_send(state, ev, cli->transport,
773 data->data, data->length, max_recv_frag);
774 if (subreq == NULL) {
775 goto fail;
776 }
777 tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
778 return req;
779
780 post_status:
781 tevent_req_nterror(req, status);
782 return tevent_req_post(req, ev);
783 fail:
784 TALLOC_FREE(req);
785 return NULL;
786 }
787
788 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq)
789 {
790 struct tevent_req *req =
791 tevent_req_callback_data(subreq,
792 struct tevent_req);
793 NTSTATUS status;
794
795 status = rpc_write_recv(subreq);
796 TALLOC_FREE(subreq);
797 if (!NT_STATUS_IS_OK(status)) {
798 tevent_req_nterror(req, status);
799 return;
800 }
801
802 tevent_req_done(req);
803 }
804
805 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
806 {
807 struct tevent_req *req = tevent_req_callback_data(
808 subreq, struct tevent_req);
809 struct rpc_api_pipe_state *state = tevent_req_data(
810 req, struct rpc_api_pipe_state);
811 NTSTATUS status;
812 uint8_t *rdata = NULL;
813 uint32_t rdata_len = 0;
814
815 status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
816 TALLOC_FREE(subreq);
817 if (!NT_STATUS_IS_OK(status)) {
818 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
819 tevent_req_nterror(req, status);
820 return;
821 }
822
823 if (rdata == NULL) {
824 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
825 rpccli_pipe_txt(talloc_tos(), state->cli)));
826 tevent_req_done(req);
827 return;
828 }
829
830 /*
831 * Move data on state->incoming_frag.
832 */
833 state->incoming_frag.data = talloc_move(state, &rdata);
834 state->incoming_frag.length = rdata_len;
835 if (!state->incoming_frag.data) {
836 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
837 return;
838 }
839
840 /* Ensure we have enough data for a pdu. */
841 subreq = get_complete_frag_send(state, state->ev, state->cli,
842 &state->incoming_frag);
843 if (tevent_req_nomem(subreq, req)) {
844 return;
845 }
846 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
847 }
848
849 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
850 {
851 struct tevent_req *req = tevent_req_callback_data(
852 subreq, struct tevent_req);
853 struct rpc_api_pipe_state *state = tevent_req_data(
854 req, struct rpc_api_pipe_state);
855 NTSTATUS status;
856 DATA_BLOB rdata = data_blob_null;
857
858 status = get_complete_frag_recv(subreq);
859 TALLOC_FREE(subreq);
860 if (!NT_STATUS_IS_OK(status)) {
861 DEBUG(5, ("get_complete_frag failed: %s\n",
862 nt_errstr(status)));
863 tevent_req_nterror(req, status);
864 return;
865 }
866
867 state->pkt = talloc(state, struct ncacn_packet);
868 if (!state->pkt) {
869 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
870 return;
871 }
872
873 status = dcerpc_pull_ncacn_packet(state->pkt,
874 &state->incoming_frag,
875 state->pkt,
876 !state->endianess);
877 if (!NT_STATUS_IS_OK(status)) {
878 tevent_req_nterror(req, status);
879 return;
880 }
881
882 if (state->incoming_frag.length != state->pkt->frag_length) {
883 DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
884 (unsigned int)state->incoming_frag.length,
885 (unsigned int)state->pkt->frag_length));
886 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
887 return;
888 }
889
890 status = cli_pipe_validate_current_pdu(state,
891 state->cli, state->pkt,
892 &state->incoming_frag,
893 state->expected_pkt_type,
894 state->call_id,
895 &rdata,
896 &state->reply_pdu);
897
898 DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
899 (unsigned)state->incoming_frag.length,
900 (unsigned)state->reply_pdu_offset,
901 nt_errstr(status)));
902
903 if (!NT_STATUS_IS_OK(status)) {
904 tevent_req_nterror(req, status);
905 return;
906 }
907
908 if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
909 && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
910 /*
911 * Set the data type correctly for big-endian data on the
912 * first packet.
913 */
914 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
915 "big-endian.\n",
916 rpccli_pipe_txt(talloc_tos(), state->cli)));
917 state->endianess = 0x00; /* BIG ENDIAN */
918 }
919 /*
920 * Check endianness on subsequent packets.
921 */
922 if (state->endianess != state->pkt->drep[0]) {
923 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
924 "%s\n",
925 state->endianess?"little":"big",
926 state->pkt->drep[0]?"little":"big"));
927 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
928 return;
929 }
930
931 /* Now copy the data portion out of the pdu into rbuf. */
932 if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
933 if (!data_blob_realloc(NULL, &state->reply_pdu,
934 state->reply_pdu_offset + rdata.length)) {
935 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
936 return;
937 }
938 }
939
940 memcpy(state->reply_pdu.data + state->reply_pdu_offset,
941 rdata.data, rdata.length);
942 state->reply_pdu_offset += rdata.length;
943
944 /* reset state->incoming_frag, there is no need to free it,
945 * it will be reallocated to the right size the next time
946 * it is used */
947 state->incoming_frag.length = 0;
948
949 if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
950 /* make sure the pdu length is right now that we
951 * have all the data available (alloc hint may
952 * have allocated more than was actually used) */
953 state->reply_pdu.length = state->reply_pdu_offset;
954 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
955 rpccli_pipe_txt(talloc_tos(), state->cli),
956 (unsigned)state->reply_pdu.length));
957 tevent_req_done(req);
958 return;
959 }
960
961 subreq = get_complete_frag_send(state, state->ev, state->cli,
962 &state->incoming_frag);
963 if (tevent_req_nomem(subreq, req)) {
964 return;
965 }
966 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
967 }
968
969 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
970 struct ncacn_packet **pkt,
971 DATA_BLOB *reply_pdu)
972 {
973 struct rpc_api_pipe_state *state = tevent_req_data(
974 req, struct rpc_api_pipe_state);
975 NTSTATUS status;
976
977 if (tevent_req_is_nterror(req, &status)) {
978 return status;
979 }
980
981 /* return data to caller and assign it ownership of memory */
982 if (reply_pdu) {
983 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
984 reply_pdu->length = state->reply_pdu.length;
985 state->reply_pdu.length = 0;
986 } else {
987 data_blob_free(&state->reply_pdu);
988 }
989
990 if (pkt) {
991 *pkt = talloc_steal(mem_ctx, state->pkt);
992 }
993
994 return NT_STATUS_OK;
995 }
996
997 /*******************************************************************
998 Creates NTLMSSP auth bind.
999 ********************************************************************/
1000
1001 static NTSTATUS create_generic_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1002 TALLOC_CTX *mem_ctx,
1003 DATA_BLOB *auth_token,
1004 bool *client_hdr_signing)
1005 {
1006 struct gensec_security *gensec_security;
1007 DATA_BLOB null_blob = data_blob_null;
1008 NTSTATUS status;
1009
1010 gensec_security = cli->auth->auth_ctx;
1011
1012 DEBUG(5, ("create_generic_auth_rpc_bind_req: generate first token\n"));
1013 status = gensec_update(gensec_security, mem_ctx, null_blob, auth_token);
1014
1015 if (!NT_STATUS_IS_OK(status) &&
1016 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED))
1017 {
1018 return status;
1019 }
1020
1021 if (client_hdr_signing == NULL) {
1022 return status;
1023 }
1024
1025 if (cli->auth->auth_level < DCERPC_AUTH_LEVEL_INTEGRITY) {
1026 *client_hdr_signing = false;
1027 return status;
1028 }
1029
1030 *client_hdr_signing = gensec_have_feature(gensec_security,
1031 GENSEC_FEATURE_SIGN_PKT_HEADER);
1032
1033 return status;
1034 }
1035
1036 /*******************************************************************
1037 Creates the internals of a DCE/RPC bind request or alter context PDU.
1038 ********************************************************************/
1039
1040 static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
1041 enum dcerpc_pkt_type ptype,
1042 uint32_t rpc_call_id,
1043 const struct ndr_syntax_id *abstract,
1044 const struct ndr_syntax_id *transfer,
1045 const DATA_BLOB *auth_info,
1046 bool client_hdr_signing,
1047 DATA_BLOB *blob)
1048 {
1049 uint16_t auth_len = auth_info->length;
1050 NTSTATUS status;
1051 union dcerpc_payload u;
1052 struct dcerpc_ctx_list ctx_list;
1053 uint8_t pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
1054
1055 if (auth_len) {
1056 auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
1057 }
1058
1059 if (client_hdr_signing) {
1060 pfc_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
1061 }
1062
1063 ctx_list.context_id = 0;
1064 ctx_list.num_transfer_syntaxes = 1;
1065 ctx_list.abstract_syntax = *abstract;
1066 ctx_list.transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer);
1067
1068 u.bind.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1069 u.bind.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1070 u.bind.assoc_group_id = 0x0;
1071 u.bind.num_contexts = 1;
1072 u.bind.ctx_list = &ctx_list;
1073 u.bind.auth_info = *auth_info;
1074
1075 status = dcerpc_push_ncacn_packet(mem_ctx,
1076 ptype, pfc_flags,
1077 auth_len,
1078 rpc_call_id,
1079 &u,
1080 blob);
1081 if (!NT_STATUS_IS_OK(status)) {
1082 DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
1083 return status;
1084 }
1085
1086 return NT_STATUS_OK;
1087 }
1088
1089 /*******************************************************************
1090 Creates a DCE/RPC bind request.
1091 ********************************************************************/
1092
1093 static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
1094 struct rpc_pipe_client *cli,
1095 struct pipe_auth_data *auth,
1096 uint32_t rpc_call_id,
1097 const struct ndr_syntax_id *abstract,
1098 const struct ndr_syntax_id *transfer,
1099 DATA_BLOB *rpc_out)
1100 {
1101 DATA_BLOB auth_token = data_blob_null;
1102 DATA_BLOB auth_info = data_blob_null;
1103 NTSTATUS ret = NT_STATUS_OK;
1104
1105 switch (auth->auth_type) {
1106 case DCERPC_AUTH_TYPE_NONE:
1107 break;
1108
1109 default:
1110 ret = create_generic_auth_rpc_bind_req(cli, mem_ctx,
1111 &auth_token,
1112 &auth->client_hdr_signing);
1113
1114 if (!NT_STATUS_IS_OK(ret) &&
1115 !NT_STATUS_EQUAL(ret, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1116 return ret;
1117 }
1118 break;
1119 }
1120
1121 if (auth_token.length != 0) {
1122 ret = dcerpc_push_dcerpc_auth(cli,
1123 auth->auth_type,
1124 auth->auth_level,
1125 0, /* auth_pad_length */
1126 1, /* auth_context_id */
1127 &auth_token,
1128 &auth_info);
1129 if (!NT_STATUS_IS_OK(ret)) {
1130 return ret;
1131 }
1132 data_blob_free(&auth_token);
1133 }
1134
1135 ret = create_bind_or_alt_ctx_internal(mem_ctx,
1136 DCERPC_PKT_BIND,
1137 rpc_call_id,
1138 abstract,
1139 transfer,
1140 &auth_info,
1141 auth->client_hdr_signing,
1142 rpc_out);
1143 return ret;
1144 }
1145
1146 /*******************************************************************
1147 External interface.
1148 Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
1149 Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
1150 and deals with signing/sealing details.
1151 ********************************************************************/
1152
1153 struct rpc_api_pipe_req_state {
1154 struct tevent_context *ev;
1155 struct rpc_pipe_client *cli;
1156 uint8_t op_num;
1157 uint32_t call_id;
1158 const DATA_BLOB *req_data;
1159 uint32_t req_data_sent;
1160 DATA_BLOB req_trailer;
1161 uint32_t req_trailer_sent;
1162 bool verify_bitmask1;
1163 bool verify_pcontext;
1164 DATA_BLOB rpc_out;
1165 DATA_BLOB reply_pdu;
1166 };
1167
1168 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
1169 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
1170 static NTSTATUS prepare_verification_trailer(struct rpc_api_pipe_req_state *state);
1171 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1172 bool *is_last_frag);
1173
1174 static struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
1175 struct tevent_context *ev,
1176 struct rpc_pipe_client *cli,
1177 uint8_t op_num,
1178 const DATA_BLOB *req_data)
1179 {
1180 struct tevent_req *req, *subreq;
1181 struct rpc_api_pipe_req_state *state;
1182 NTSTATUS status;
1183 bool is_last_frag;
1184
1185 req = tevent_req_create(mem_ctx, &state,
1186 struct rpc_api_pipe_req_state);
1187 if (req == NULL) {
1188 return NULL;
1189 }
1190 state->ev = ev;
1191 state->cli = cli;
1192 state->op_num = op_num;
1193 state->req_data = req_data;
1194 state->req_data_sent = 0;
1195 state->call_id = get_rpc_call_id();
1196 state->reply_pdu = data_blob_null;
1197 state->rpc_out = data_blob_null;
1198
1199 if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
1200 + RPC_MAX_SIGN_SIZE) {
1201 /* Server is screwed up ! */
1202 status = NT_STATUS_INVALID_PARAMETER;
1203 goto post_status;
1204 }
1205
1206 status = prepare_verification_trailer(state);
1207 if (!NT_STATUS_IS_OK(status)) {
1208 goto post_status;
1209 }
1210
1211 status = prepare_next_frag(state, &is_last_frag);
1212 if (!NT_STATUS_IS_OK(status)) {
1213 goto post_status;
1214 }
1215
1216 if (is_last_frag) {
1217 subreq = rpc_api_pipe_send(state, ev, state->cli,
1218 &state->rpc_out,
1219 DCERPC_PKT_RESPONSE,
1220 state->call_id);
1221 if (subreq == NULL) {
1222 goto fail;
1223 }
1224 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1225 } else {
1226 subreq = rpc_write_send(state, ev, cli->transport,
1227 state->rpc_out.data,
1228 state->rpc_out.length);
1229 if (subreq == NULL) {
1230 goto fail;
1231 }
1232 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1233 req);
1234 }
1235 return req;
1236
1237 post_status:
1238 tevent_req_nterror(req, status);
1239 return tevent_req_post(req, ev);
1240 fail:
1241 TALLOC_FREE(req);
1242 return NULL;
1243 }
1244
1245 static NTSTATUS prepare_verification_trailer(struct rpc_api_pipe_req_state *state)
1246 {
1247 struct pipe_auth_data *a = state->cli->auth;
1248 struct dcerpc_sec_verification_trailer *t;
1249 struct dcerpc_sec_vt *c = NULL;
1250 struct ndr_push *ndr = NULL;
1251 enum ndr_err_code ndr_err;
1252 size_t align = 0;
1253 size_t pad = 0;
1254
1255 if (a == NULL) {
1256 return NT_STATUS_OK;
1257 }
1258
1259 if (a->auth_level < DCERPC_AUTH_LEVEL_INTEGRITY) {
1260 return NT_STATUS_OK;
1261 }
1262
1263 t = talloc_zero(state, struct dcerpc_sec_verification_trailer);
1264 if (t == NULL) {
1265 return NT_STATUS_NO_MEMORY;
1266 }
1267
1268 if (!a->verified_bitmask1) {
1269 t->commands = talloc_realloc(t, t->commands,
1270 struct dcerpc_sec_vt,
1271 t->count.count + 1);
1272 if (t->commands == NULL) {
1273 return NT_STATUS_NO_MEMORY;
1274 }
1275 c = &t->commands[t->count.count++];
1276 ZERO_STRUCTP(c);
1277
1278 c->command = DCERPC_SEC_VT_COMMAND_BITMASK1;
1279 if (a->client_hdr_signing) {
1280 c->u.bitmask1 = DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING;
1281 }
1282 state->verify_bitmask1 = true;
1283 }
1284
1285 if (!state->cli->verified_pcontext) {
1286 t->commands = talloc_realloc(t, t->commands,
1287 struct dcerpc_sec_vt,
1288 t->count.count + 1);
1289 if (t->commands == NULL) {
1290 return NT_STATUS_NO_MEMORY;
1291 }
1292 c = &t->commands[t->count.count++];
1293 ZERO_STRUCTP(c);
1294
1295 c->command = DCERPC_SEC_VT_COMMAND_PCONTEXT;
1296 c->u.pcontext.abstract_syntax = state->cli->abstract_syntax;
1297 c->u.pcontext.transfer_syntax = state->cli->transfer_syntax;
1298
1299 state->verify_pcontext = true;
1300 }
1301
1302 if (!a->hdr_signing) {
1303 t->commands = talloc_realloc(t, t->commands,
1304 struct dcerpc_sec_vt,
1305 t->count.count + 1);
1306 if (t->commands == NULL) {
1307 return NT_STATUS_NO_MEMORY;
1308 }
1309 c = &t->commands[t->count.count++];
1310 ZERO_STRUCTP(c);
1311
1312 c->command = DCERPC_SEC_VT_COMMAND_HEADER2;
1313 c->u.header2.ptype = DCERPC_PKT_REQUEST;
1314 c->u.header2.drep[0] = DCERPC_DREP_LE;
1315 c->u.header2.drep[1] = 0;
1316 c->u.header2.drep[2] = 0;
1317 c->u.header2.drep[3] = 0;
1318 c->u.header2.call_id = state->call_id;
1319 c->u.header2.context_id = 0;
1320 c->u.header2.opnum = state->op_num;
1321 }
1322
1323 if (t->count.count == 0) {
1324 TALLOC_FREE(t);
1325 return NT_STATUS_OK;
1326 }
1327
1328 c = &t->commands[t->count.count - 1];
1329 c->command |= DCERPC_SEC_VT_COMMAND_END;
1330
1331 if (DEBUGLEVEL >= 10) {
1332 NDR_PRINT_DEBUG(dcerpc_sec_verification_trailer, t);
1333 }
1334
1335 ndr = ndr_push_init_ctx(state);
1336 if (ndr == NULL) {
1337 return NT_STATUS_NO_MEMORY;
1338 }
1339
1340 ndr_err = ndr_push_dcerpc_sec_verification_trailer(ndr,
1341 NDR_SCALARS | NDR_BUFFERS,
1342 t);
1343 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1344 return ndr_map_error2ntstatus(ndr_err);
1345 }
1346 state->req_trailer = ndr_push_blob(ndr);
1347
1348 align = state->req_data->length & 0x3;
1349 if (align > 0) {
1350 pad = 4 - align;
1351 }
1352 if (pad > 0) {
1353 bool ok;
1354 uint8_t *p;
1355 const uint8_t zeros[4] = { 0, };
1356
1357 ok = data_blob_append(ndr, &state->req_trailer, zeros, pad);
1358 if (!ok) {
1359 return NT_STATUS_NO_MEMORY;
1360 }
1361
1362 /* move the padding to the start */
1363 p = state->req_trailer.data;
1364 memmove(p + pad, p, state->req_trailer.length - pad);
1365 memset(p, 0, pad);
1366 }
1367
1368 return NT_STATUS_OK;
1369 }
1370
1371 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1372 bool *is_last_frag)
1373 {
1374 size_t auth_len;
1375 size_t frag_len;
1376 uint8_t flags = 0;
1377 size_t pad_len;
1378 size_t data_left;
1379 size_t data_thistime;
1380 size_t trailer_left;
1381 size_t trailer_thistime = 0;
1382 size_t total_left;
1383 size_t total_thistime;
1384 NTSTATUS status;
1385 bool ok;
1386 union dcerpc_payload u;
1387
1388 data_left = state->req_data->length - state->req_data_sent;
1389 trailer_left = state->req_trailer.length - state->req_trailer_sent;
1390 total_left = data_left + trailer_left;
1391 if ((total_left < data_left) || (total_left < trailer_left)) {
1392 /*
1393 * overflow
1394 */
1395 return NT_STATUS_INVALID_PARAMETER_MIX;
1396 }
1397
1398 status = dcerpc_guess_sizes(state->cli->auth,
1399 DCERPC_REQUEST_LENGTH, total_left,
1400 state->cli->max_xmit_frag,
1401 CLIENT_NDR_PADDING_SIZE,
1402 &total_thistime,
1403 &frag_len, &auth_len, &pad_len);
1404 if (!NT_STATUS_IS_OK(status)) {
1405 return status;
1406 }
1407
1408 if (state->req_data_sent == 0) {
1409 flags = DCERPC_PFC_FLAG_FIRST;
1410 }
1411
1412 if (total_thistime == total_left) {
1413 flags |= DCERPC_PFC_FLAG_LAST;
1414 }
1415
1416 data_thistime = MIN(total_thistime, data_left);
1417 if (data_thistime < total_thistime) {
1418 trailer_thistime = total_thistime - data_thistime;
1419 }
1420
1421 data_blob_free(&state->rpc_out);
1422
1423 ZERO_STRUCT(u.request);
1424
1425 u.request.alloc_hint = total_left;
1426 u.request.context_id = 0;
1427 u.request.opnum = state->op_num;
1428
1429 status = dcerpc_push_ncacn_packet(state,
1430 DCERPC_PKT_REQUEST,
1431 flags,
1432 auth_len,
1433 state->call_id,
1434 &u,
1435 &state->rpc_out);
1436 if (!NT_STATUS_IS_OK(status)) {
1437 return status;
1438 }
1439
1440 /* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
1441 * compute it right for requests because the auth trailer is missing
1442 * at this stage */
1443 dcerpc_set_frag_length(&state->rpc_out, frag_len);
1444
1445 if (data_thistime > 0) {
1446 /* Copy in the data. */
1447 ok = data_blob_append(NULL, &state->rpc_out,
1448 state->req_data->data + state->req_data_sent,
1449 data_thistime);
1450 if (!ok) {
1451 return NT_STATUS_NO_MEMORY;
1452 }
1453 state->req_data_sent += data_thistime;
1454 }
1455
1456 if (trailer_thistime > 0) {
1457 /* Copy in the verification trailer. */
1458 ok = data_blob_append(NULL, &state->rpc_out,
1459 state->req_trailer.data + state->req_trailer_sent,
1460 trailer_thistime);
1461 if (!ok) {
1462 return NT_STATUS_NO_MEMORY;
1463 }
1464 state->req_trailer_sent += trailer_thistime;
1465 }
1466
1467 switch (state->cli->auth->auth_level) {
1468 case DCERPC_AUTH_LEVEL_NONE:
1469 case DCERPC_AUTH_LEVEL_CONNECT:
1470 case DCERPC_AUTH_LEVEL_PACKET:
1471 break;
1472 case DCERPC_AUTH_LEVEL_INTEGRITY:
1473 case DCERPC_AUTH_LEVEL_PRIVACY:
1474 status = dcerpc_add_auth_footer(state->cli->auth, pad_len,
1475 &state->rpc_out);
1476 if (!NT_STATUS_IS_OK(status)) {
1477 return status;
1478 }
1479 break;
1480 default:
1481 return NT_STATUS_INVALID_PARAMETER;
1482 }
1483
1484 *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
1485
1486 return status;
1487 }
1488
1489 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
1490 {
1491 struct tevent_req *req = tevent_req_callback_data(
1492 subreq, struct tevent_req);
1493 struct rpc_api_pipe_req_state *state = tevent_req_data(
1494 req, struct rpc_api_pipe_req_state);
1495 NTSTATUS status;
1496 bool is_last_frag;
1497
1498 status = rpc_write_recv(subreq);
1499 TALLOC_FREE(subreq);
1500 if (!NT_STATUS_IS_OK(status)) {
1501 tevent_req_nterror(req, status);
1502 return;
1503 }
1504
1505 status = prepare_next_frag(state, &is_last_frag);
1506 if (!NT_STATUS_IS_OK(status)) {
1507 tevent_req_nterror(req, status);
1508 return;
1509 }
1510
1511 if (is_last_frag) {
1512 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1513 &state->rpc_out,
1514 DCERPC_PKT_RESPONSE,
1515 state->call_id);
1516 if (tevent_req_nomem(subreq, req)) {
1517 return;
1518 }
1519 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1520 } else {
1521 subreq = rpc_write_send(state, state->ev,
1522 state->cli->transport,
1523 state->rpc_out.data,
1524 state->rpc_out.length);
1525 if (tevent_req_nomem(subreq, req)) {
1526 return;
1527 }
1528 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1529 req);
1530 }
1531 }
1532
1533 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
1534 {
1535 struct tevent_req *req = tevent_req_callback_data(
1536 subreq, struct tevent_req);
1537 struct rpc_api_pipe_req_state *state = tevent_req_data(
1538 req, struct rpc_api_pipe_req_state);
1539 NTSTATUS status;
1540
1541 status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
1542 TALLOC_FREE(subreq);
1543 if (!NT_STATUS_IS_OK(status)) {
1544 tevent_req_nterror(req, status);
1545 return;
1546 }
1547
1548 if (state->cli->auth == NULL) {
1549 tevent_req_done(req);
1550 return;
1551 }
1552
1553 if (state->verify_bitmask1) {
1554 state->cli->auth->verified_bitmask1 = true;
1555 }
1556
1557 if (state->verify_pcontext) {
1558 state->cli->verified_pcontext = true;
1559 }
1560
1561 tevent_req_done(req);
1562 }
1563
1564 static NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1565 DATA_BLOB *reply_pdu)
1566 {
1567 struct rpc_api_pipe_req_state *state = tevent_req_data(
1568 req, struct rpc_api_pipe_req_state);
1569 NTSTATUS status;
1570
1571 if (tevent_req_is_nterror(req, &status)) {
1572 /*
1573 * We always have to initialize to reply pdu, even if there is
1574 * none. The rpccli_* caller routines expect this.
1575 */
1576 *reply_pdu = data_blob_null;
1577 return status;
1578 }
1579
1580 /* return data to caller and assign it ownership of memory */
1581 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1582 reply_pdu->length = state->reply_pdu.length;
1583 state->reply_pdu.length = 0;
1584
1585 return NT_STATUS_OK;
1586 }
1587
1588 /****************************************************************************
1589 Check the rpc bind acknowledge response.
1590 ****************************************************************************/
1591
1592 static bool check_bind_response(const struct dcerpc_bind_ack *r,
1593 const struct ndr_syntax_id *transfer)
1594 {
1595 struct dcerpc_ack_ctx ctx;
1596
1597 if (r->secondary_address_size == 0) {
1598 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
1599 }
1600
1601 if (r->num_results < 1 || !r->ctx_list) {
1602 return false;
1603 }
1604
1605 ctx = r->ctx_list[0];
1606
1607 /* check the transfer syntax */
1608 if ((ctx.syntax.if_version != transfer->if_version) ||
1609 (memcmp(&ctx.syntax.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1610 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1611 return False;
1612 }
1613
1614 if (r->num_results != 0x1 || ctx.result != 0) {
1615 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1616 r->num_results, ctx.reason.value));
1617 }
1618
1619 DEBUG(5,("check_bind_response: accepted!\n"));
1620 return True;
1621 }
1622
1623 /*******************************************************************
1624 Creates a DCE/RPC bind authentication response.
1625 This is the packet that is sent back to the server once we
1626 have received a BIND-ACK, to finish the third leg of
1627 the authentication handshake.
1628 ********************************************************************/
1629
1630 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
1631 struct rpc_pipe_client *cli,
1632 uint32_t rpc_call_id,
1633 enum dcerpc_AuthType auth_type,
1634 enum dcerpc_AuthLevel auth_level,
1635 DATA_BLOB *pauth_blob,
1636 DATA_BLOB *rpc_out)
1637 {
1638 NTSTATUS status;
1639 union dcerpc_payload u;
1640
1641 u.auth3._pad = 0;
1642
1643 status = dcerpc_push_dcerpc_auth(mem_ctx,
1644 auth_type,
1645 auth_level,
1646 0, /* auth_pad_length */
1647 1, /* auth_context_id */
1648 pauth_blob,
1649 &u.auth3.auth_info);
1650 if (!NT_STATUS_IS_OK(status)) {
1651 return status;
1652 }
1653
1654 status = dcerpc_push_ncacn_packet(mem_ctx,
1655 DCERPC_PKT_AUTH3,
1656 DCERPC_PFC_FLAG_FIRST |
1657 DCERPC_PFC_FLAG_LAST,
1658 pauth_blob->length,
1659 rpc_call_id,
1660 &u,
1661 rpc_out);
1662 data_blob_free(&u.auth3.auth_info);
1663 if (!NT_STATUS_IS_OK(status)) {
1664 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1665 return status;
1666 }
1667
1668 return NT_STATUS_OK;
1669 }
1670
1671 /*******************************************************************
1672 Creates a DCE/RPC bind alter context authentication request which
1673 may contain a spnego auth blobl
1674 ********************************************************************/
1675
1676 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
1677 enum dcerpc_AuthType auth_type,
1678 enum dcerpc_AuthLevel auth_level,
1679 uint32_t rpc_call_id,
1680 const struct ndr_syntax_id *abstract,
1681 const struct ndr_syntax_id *transfer,
1682 const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
1683 DATA_BLOB *rpc_out)
1684 {
1685 DATA_BLOB auth_info;
1686 NTSTATUS status;
1687
1688 status = dcerpc_push_dcerpc_auth(mem_ctx,
1689 auth_type,
1690 auth_level,
1691 0, /* auth_pad_length */
1692 1, /* auth_context_id */
1693 pauth_blob,
1694 &auth_info);
1695 if (!NT_STATUS_IS_OK(status)) {
1696 return status;
1697 }
1698
1699 status = create_bind_or_alt_ctx_internal(mem_ctx,
1700 DCERPC_PKT_ALTER,
1701 rpc_call_id,
1702 abstract,
1703 transfer,
1704 &auth_info,
1705 false, /* client_hdr_signing */
1706 rpc_out);
1707 data_blob_free(&auth_info);
1708 return status;
1709 }
1710
1711 /****************************************************************************
1712 Do an rpc bind.
1713 ****************************************************************************/
1714
1715 struct rpc_pipe_bind_state {
1716 struct tevent_context *ev;
1717 struct rpc_pipe_client *cli;
1718 DATA_BLOB rpc_out;
1719 bool auth3;
1720 uint32_t rpc_call_id;
1721 };
1722
1723 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
1724 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1725 struct rpc_pipe_bind_state *state,
1726 DATA_BLOB *credentials);
1727 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1728 struct rpc_pipe_bind_state *state,
1729 DATA_BLOB *credentials);
1730
1731 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
1732 struct tevent_context *ev,
1733 struct rpc_pipe_client *cli,
1734 struct pipe_auth_data *auth)
1735 {
1736 struct tevent_req *req, *subreq;
1737 struct rpc_pipe_bind_state *state;
1738 NTSTATUS status;
1739
1740 req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
1741 if (req == NULL) {
1742 return NULL;
1743 }
1744
1745 DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
1746 rpccli_pipe_txt(talloc_tos(), cli),
1747 (unsigned int)auth->auth_type,
1748 (unsigned int)auth->auth_level ));
1749
1750 state->ev = ev;
1751 state->cli = cli;
1752 state->rpc_call_id = get_rpc_call_id();
1753
1754 cli->auth = talloc_move(cli, &auth);
1755
1756 /* Marshall the outgoing data. */
1757 status = create_rpc_bind_req(state, cli,
1758 cli->auth,
1759 state->rpc_call_id,
1760 &cli->abstract_syntax,
1761 &cli->transfer_syntax,
1762 &state->rpc_out);
1763
1764 if (!NT_STATUS_IS_OK(status) &&
1765 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1766 goto post_status;
1767 }
1768
1769 subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
1770 DCERPC_PKT_BIND_ACK, state->rpc_call_id);
1771 if (subreq == NULL) {
1772 goto fail;
1773 }
1774 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1775 return req;
1776
1777 post_status:
1778 tevent_req_nterror(req, status);
1779 return tevent_req_post(req, ev);
1780 fail:
1781 TALLOC_FREE(req);
1782 return NULL;
1783 }
1784
1785 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
1786 {
1787 struct tevent_req *req = tevent_req_callback_data(
1788 subreq, struct tevent_req);
1789 struct rpc_pipe_bind_state *state = tevent_req_data(
1790 req, struct rpc_pipe_bind_state);
1791 struct pipe_auth_data *pauth = state->cli->auth;
1792 struct gensec_security *gensec_security;
1793 struct ncacn_packet *pkt = NULL;
1794 struct dcerpc_auth auth;
1795 DATA_BLOB auth_token = data_blob_null;
1796 NTSTATUS status;
1797
1798 status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
1799 TALLOC_FREE(subreq);
1800 if (!NT_STATUS_IS_OK(status)) {
1801 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
1802 rpccli_pipe_txt(talloc_tos(), state->cli),
1803 nt_errstr(status)));
1804 tevent_req_nterror(req, status);
1805 return;
1806 }
1807
1808 if (state->auth3) {
1809 tevent_req_done(req);
1810 return;
1811 }
1812
1813 if (!check_bind_response(&pkt->u.bind_ack, &state->cli->transfer_syntax)) {
1814 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
1815 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1816 return;
1817 }
1818
1819 state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
1820 state->cli->max_recv_frag = pkt->u.bind_ack.max_recv_frag;
1821
1822 switch(pauth->auth_type) {
1823
1824 case DCERPC_AUTH_TYPE_NONE:
1825 /* Bind complete. */
1826 tevent_req_done(req);
1827 return;
1828
1829 default:
1830 /* Paranoid lenght checks */
1831 if (pkt->frag_length < DCERPC_AUTH_TRAILER_LENGTH
1832 + pkt->auth_length) {
1833 tevent_req_nterror(req,
1834 NT_STATUS_INFO_LENGTH_MISMATCH);
1835 return;
1836 }
1837 /* get auth credentials */
1838 status = dcerpc_pull_dcerpc_auth(talloc_tos(),
1839 &pkt->u.bind_ack.auth_info,
1840 &auth, false);
1841 if (!NT_STATUS_IS_OK(status)) {
1842 DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
1843 nt_errstr(status)));
1844 tevent_req_nterror(req, status);
1845 return;
1846 }
1847 break;
1848 }
1849
1850 /*
1851 * For authenticated binds we may need to do 3 or 4 leg binds.
1852 */
1853
1854 switch(pauth->auth_type) {
1855
1856 case DCERPC_AUTH_TYPE_NONE:
1857 /* Bind complete. */
1858 tevent_req_done(req);
1859 return;
1860
1861 default:
1862 gensec_security = pauth->auth_ctx;
1863
1864 if (pkt->pfc_flags & DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN) {
1865 if (pauth->client_hdr_signing) {
1866 pauth->hdr_signing = true;
1867 gensec_want_feature(gensec_security,
1868 GENSEC_FEATURE_SIGN_PKT_HEADER);
1869 }
1870 }
1871
1872 status = gensec_update(gensec_security, state,
1873 auth.credentials, &auth_token);
1874 if (NT_STATUS_EQUAL(status,
1875 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1876 status = rpc_bind_next_send(req, state,
1877 &auth_token);
1878 } else if (NT_STATUS_IS_OK(status)) {
1879 if (auth_token.length == 0) {
1880 /* Bind complete. */
1881 tevent_req_done(req);
1882 return;
1883 }
1884 status = rpc_bind_finish_send(req, state,
1885 &auth_token);
1886 }
1887 break;
1888 }
1889
1890 if (!NT_STATUS_IS_OK(status)) {
1891 tevent_req_nterror(req, status);
1892 }
1893 return;
1894 }
1895
1896 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1897 struct rpc_pipe_bind_state *state,
1898 DATA_BLOB *auth_token)
1899 {
1900 struct pipe_auth_data *auth = state->cli->auth;
1901 struct tevent_req *subreq;
1902 NTSTATUS status;
1903
1904 /* Now prepare the alter context pdu. */
1905 data_blob_free(&state->rpc_out);
1906
1907 status = create_rpc_alter_context(state,
1908 auth->auth_type,
1909 auth->auth_level,
1910 state->rpc_call_id,
1911 &state->cli->abstract_syntax,
1912 &state->cli->transfer_syntax,
1913 auth_token,
1914 &state->rpc_out);
1915 if (!NT_STATUS_IS_OK(status)) {
1916 return status;
1917 }
1918
1919 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1920 &state->rpc_out, DCERPC_PKT_ALTER_RESP,
1921 state->rpc_call_id);
1922 if (subreq == NULL) {
1923 return NT_STATUS_NO_MEMORY;
1924 }
1925 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1926 return NT_STATUS_OK;
1927 }
1928
1929 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1930 struct rpc_pipe_bind_state *state,
1931 DATA_BLOB *auth_token)
1932 {
1933 struct pipe_auth_data *auth = state->cli->auth;
1934 struct tevent_req *subreq;
1935 NTSTATUS status;
1936
1937 state->auth3 = true;
1938
1939 /* Now prepare the auth3 context pdu. */
1940 data_blob_free(&state->rpc_out);
1941
1942 status = create_rpc_bind_auth3(state, state->cli,
1943 state->rpc_call_id,
1944 auth->auth_type,
1945 auth->auth_level,
1946 auth_token,
1947 &state->rpc_out);
1948 if (!NT_STATUS_IS_OK(status)) {
1949 return status;
1950 }
1951
1952 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1953 &state->rpc_out, DCERPC_PKT_AUTH3,
1954 state->rpc_call_id);
1955 if (subreq == NULL) {
1956 return NT_STATUS_NO_MEMORY;
1957 }
1958 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1959 return NT_STATUS_OK;
1960 }
1961
1962 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
1963 {
1964 return tevent_req_simple_recv_ntstatus(req);
1965 }
1966
1967 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
1968 struct pipe_auth_data *auth)
1969 {
1970 TALLOC_CTX *frame = talloc_stackframe();
1971 struct tevent_context *ev;
1972 struct tevent_req *req;
1973 NTSTATUS status = NT_STATUS_OK;
1974
1975 ev = samba_tevent_context_init(frame);
1976 if (ev == NULL) {
1977 status = NT_STATUS_NO_MEMORY;
1978 goto fail;
1979 }
1980
1981 req = rpc_pipe_bind_send(frame, ev, cli, auth);
1982 if (req == NULL) {
1983 status = NT_STATUS_NO_MEMORY;
1984 goto fail;
1985 }
1986
1987 if (!tevent_req_poll(req, ev)) {
1988 status = map_nt_error_from_unix(errno);
1989 goto fail;
1990 }
1991
1992 status = rpc_pipe_bind_recv(req);
1993 fail:
1994 TALLOC_FREE(frame);
1995 return status;
1996 }
1997
1998 #define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */
1999
2000 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
2001 unsigned int timeout)
2002 {
2003 unsigned int old;
2004
2005 if (rpc_cli->transport == NULL) {
2006 return RPCCLI_DEFAULT_TIMEOUT;
2007 }
2008
2009 if (rpc_cli->transport->set_timeout == NULL) {
2010 return RPCCLI_DEFAULT_TIMEOUT;
2011 }
2012
2013 old = rpc_cli->transport->set_timeout(rpc_cli->transport->priv, timeout);
2014 if (old == 0) {
2015 return RPCCLI_DEFAULT_TIMEOUT;
2016 }
2017
2018 return old;
2019 }
2020
2021 bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
2022 {
2023 if (rpc_cli == NULL) {
2024 return false;
2025 }
2026
2027 if (rpc_cli->transport == NULL) {
2028 return false;
2029 }
2030
2031 return rpc_cli->transport->is_connected(rpc_cli->transport->priv);
2032 }
2033
2034 struct rpccli_bh_state {
2035 struct rpc_pipe_client *rpc_cli;
2036 };
2037
2038 static bool rpccli_bh_is_connected(struct dcerpc_binding_handle *h)
2039 {
2040 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2041 struct rpccli_bh_state);
2042
2043 return rpccli_is_connected(hs->rpc_cli);
2044 }
2045
2046 static uint32_t rpccli_bh_set_timeout(struct dcerpc_binding_handle *h,
2047 uint32_t timeout)
2048 {
2049 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2050 struct rpccli_bh_state);
2051
2052 return rpccli_set_timeout(hs->rpc_cli, timeout);
2053 }
2054
2055 static void rpccli_bh_auth_info(struct dcerpc_binding_handle *h,
2056 enum dcerpc_AuthType *auth_type,
2057 enum dcerpc_AuthLevel *auth_level)
2058 {
2059 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2060 struct rpccli_bh_state);
2061
2062 if (hs->rpc_cli == NULL) {
2063 return;
2064 }
2065
2066 if (hs->rpc_cli->auth == NULL) {
2067 return;
2068 }
2069
2070 *auth_type = hs->rpc_cli->auth->auth_type;
2071 *auth_level = hs->rpc_cli->auth->auth_level;
2072 }
2073
2074 struct rpccli_bh_raw_call_state {
2075 DATA_BLOB in_data;
2076 DATA_BLOB out_data;
2077 uint32_t out_flags;
2078 };
2079
2080 static void rpccli_bh_raw_call_done(struct tevent_req *subreq);
2081
2082 static struct tevent_req *rpccli_bh_raw_call_send(TALLOC_CTX *mem_ctx,
2083 struct tevent_context *ev,
2084 struct dcerpc_binding_handle *h,
2085 const struct GUID *object,
2086 uint32_t opnum,
2087 uint32_t in_flags,
2088 const uint8_t *in_data,
2089 size_t in_length)
2090 {
2091 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2092 struct rpccli_bh_state);
2093 struct tevent_req *req;
2094 struct rpccli_bh_raw_call_state *state;
2095 bool ok;
2096 struct tevent_req *subreq;
2097
2098 req = tevent_req_create(mem_ctx, &state,
2099 struct rpccli_bh_raw_call_state);
2100 if (req == NULL) {
2101 return NULL;
2102 }
2103 state->in_data.data = discard_const_p(uint8_t, in_data);
2104 state->in_data.length = in_length;
2105
2106 ok = rpccli_bh_is_connected(h);
2107 if (!ok) {
2108 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2109 return tevent_req_post(req, ev);
2110 }
2111
2112 subreq = rpc_api_pipe_req_send(state, ev, hs->rpc_cli,
2113 opnum, &state->in_data);
2114 if (tevent_req_nomem(subreq, req)) {
2115 return tevent_req_post(req, ev);
2116 }
2117 tevent_req_set_callback(subreq, rpccli_bh_raw_call_done, req);
2118
2119 return req;
2120 }
2121
2122 static void rpccli_bh_raw_call_done(struct tevent_req *subreq)
2123 {
2124 struct tevent_req *req =
2125 tevent_req_callback_data(subreq,
2126 struct tevent_req);
2127 struct rpccli_bh_raw_call_state *state =
2128 tevent_req_data(req,
2129 struct rpccli_bh_raw_call_state);
2130 NTSTATUS status;
2131
2132 state->out_flags = 0;
2133
2134 /* TODO: support bigendian responses */
2135
2136 status = rpc_api_pipe_req_recv(subreq, state, &state->out_data);
2137 TALLOC_FREE(subreq);
2138 if (!NT_STATUS_IS_OK(status)) {
2139 tevent_req_nterror(req, status);
2140 return;
2141 }
2142
2143 tevent_req_done(req);
2144 }
2145
2146 static NTSTATUS rpccli_bh_raw_call_recv(struct tevent_req *req,
2147 TALLOC_CTX *mem_ctx,
2148 uint8_t **out_data,
2149 size_t *out_length,
2150 uint32_t *out_flags)
2151 {
2152 struct rpccli_bh_raw_call_state *state =
2153 tevent_req_data(req,
2154 struct rpccli_bh_raw_call_state);
2155 NTSTATUS status;
2156
2157 if (tevent_req_is_nterror(req, &status)) {
2158 tevent_req_received(req);
2159 return status;
2160 }
2161
2162 *out_data = talloc_move(mem_ctx, &state->out_data.data);
2163 *out_length = state->out_data.length;
2164 *out_flags = state->out_flags;
2165 tevent_req_received(req);
2166 return NT_STATUS_OK;
2167 }
2168
2169 struct rpccli_bh_disconnect_state {
2170 uint8_t _dummy;
2171 };
2172
2173 static struct tevent_req *rpccli_bh_disconnect_send(TALLOC_CTX *mem_ctx,
2174 struct tevent_context *ev,
2175 struct dcerpc_binding_handle *h)
2176 {
2177 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2178 struct rpccli_bh_state);
2179 struct tevent_req *req;
2180 struct rpccli_bh_disconnect_state *state;
2181 bool ok;
2182
2183 req = tevent_req_create(mem_ctx, &state,
2184 struct rpccli_bh_disconnect_state);
2185 if (req == NULL) {
2186 return NULL;
2187 }
2188
2189 ok = rpccli_bh_is_connected(h);
2190 if (!ok) {
2191 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2192 return tevent_req_post(req, ev);
2193 }
2194
2195 /*
2196 * TODO: do a real async disconnect ...
2197 *
2198 * For now the caller needs to free rpc_cli
2199 */
2200 hs->rpc_cli = NULL;
2201
2202 tevent_req_done(req);
2203 return tevent_req_post(req, ev);
2204 }
2205
2206 static NTSTATUS rpccli_bh_disconnect_recv(struct tevent_req *req)
2207 {
2208 NTSTATUS status;
2209
2210 if (tevent_req_is_nterror(req, &status)) {
2211 tevent_req_received(req);
2212 return status;
2213 }
2214
2215 tevent_req_received(req);
2216 return NT_STATUS_OK;
2217 }
2218
2219 static bool rpccli_bh_ref_alloc(struct dcerpc_binding_handle *h)
2220 {
2221 return true;
2222 }
2223
2224 static void rpccli_bh_do_ndr_print(struct dcerpc_binding_handle *h,
2225 int ndr_flags,
2226 const void *_struct_ptr,
2227 const struct ndr_interface_call *call)
2228 {
2229 void *struct_ptr = discard_const(_struct_ptr);
2230
2231 if (DEBUGLEVEL < 10) {
2232 return;
2233 }
2234
2235 if (ndr_flags & NDR_IN) {
2236 ndr_print_function_debug(call->ndr_print,
2237 call->name,
2238 ndr_flags,
2239 struct_ptr);
2240 }
2241 if (ndr_flags & NDR_OUT) {
2242 ndr_print_function_debug(call->ndr_print,
2243 call->name,
2244 ndr_flags,
2245 struct_ptr);
2246 }
2247 }
2248
2249 static const struct dcerpc_binding_handle_ops rpccli_bh_ops = {
2250 .name = "rpccli",
2251 .is_connected = rpccli_bh_is_connected,
2252 .set_timeout = rpccli_bh_set_timeout,
2253 .auth_info = rpccli_bh_auth_info,
2254 .raw_call_send = rpccli_bh_raw_call_send,
2255 .raw_call_recv = rpccli_bh_raw_call_recv,
2256 .disconnect_send = rpccli_bh_disconnect_send,
2257 .disconnect_recv = rpccli_bh_disconnect_recv,
2258
2259 .ref_alloc = rpccli_bh_ref_alloc,
2260 .do_ndr_print = rpccli_bh_do_ndr_print,
2261 };
2262
2263 /* initialise a rpc_pipe_client binding handle */
2264 struct dcerpc_binding_handle *rpccli_bh_create(struct rpc_pipe_client *c,
2265 const struct GUID *object,
2266 const struct ndr_interface_table *table)
2267 {
2268 struct dcerpc_binding_handle *h;
2269 struct rpccli_bh_state *hs;
2270
2271 h = dcerpc_binding_handle_create(c,
2272 &rpccli_bh_ops,
2273 object,
2274 table,
2275 &hs,
2276 struct rpccli_bh_state,
2277 __location__);
2278 if (h == NULL) {
2279 return NULL;
2280 }
2281 hs->rpc_cli = c;
2282
2283 return h;
2284 }
2285
2286 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2287 struct pipe_auth_data **presult)
2288 {
2289 struct pipe_auth_data *result;
2290 struct auth_generic_state *auth_generic_ctx;
2291 NTSTATUS status;
2292
2293 result = talloc_zero(mem_ctx, struct pipe_auth_data);
2294 if (result == NULL) {
2295 return NT_STATUS_NO_MEMORY;
2296 }
2297
2298 result->auth_type = DCERPC_AUTH_TYPE_NONE;
2299 result->auth_level = DCERPC_AUTH_LEVEL_NONE;
2300
2301 status = auth_generic_client_prepare(result,
2302 &auth_generic_ctx);
2303 if (!NT_STATUS_IS_OK(status)) {
2304 DEBUG(1, ("Failed to create auth_generic context: %s\n",
2305 nt_errstr(status)));
2306 }
2307
2308 status = auth_generic_set_username(auth_generic_ctx, "");
2309 if (!NT_STATUS_IS_OK(status)) {
2310 DEBUG(1, ("Failed to set username: %s\n",
2311 nt_errstr(status)));
2312 }
2313
2314 status = auth_generic_set_domain(auth_generic_ctx, "");
2315 if (!NT_STATUS_IS_OK(status)) {
2316 DEBUG(1, ("Failed to set domain: %s\n",
2317 nt_errstr(status)));
2318 return status;
2319 }
2320
2321 status = gensec_set_credentials(auth_generic_ctx->gensec_security,
2322 auth_generic_ctx->credentials);
2323 if (!NT_STATUS_IS_OK(status)) {
2324 DEBUG(1, ("Failed to set GENSEC credentials: %s\n",
2325 nt_errstr(status)));
2326 return status;
2327 }
2328 talloc_unlink(auth_generic_ctx, auth_generic_ctx->credentials);
2329 auth_generic_ctx->credentials = NULL;
2330
2331 result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2332 talloc_free(auth_generic_ctx);
2333 *presult = result;
2334 return NT_STATUS_OK;
2335 }
2336
2337 static NTSTATUS rpccli_generic_bind_data(TALLOC_CTX *mem_ctx,
2338 enum dcerpc_AuthType auth_type,
2339 enum dcerpc_AuthLevel auth_level,
2340 const char *server,
2341 const char *target_service,
2342 const char *domain,
2343 const char *username,
2344 const char *password,
2345 enum credentials_use_kerberos use_kerberos,
2346 struct netlogon_creds_CredentialState *creds,
2347 struct pipe_auth_data **presult)
2348 {
2349 struct auth_generic_state *auth_generic_ctx;
2350 struct pipe_auth_data *result;
2351 NTSTATUS status;
2352
2353 result = talloc_zero(mem_ctx, struct pipe_auth_data);
2354 if (result == NULL) {
2355 return NT_STATUS_NO_MEMORY;
2356 }
2357
2358 result->auth_type = auth_type;
2359 result->auth_level = auth_level;
2360
2361 status = auth_generic_client_prepare(result,
2362 &auth_generic_ctx);
2363 if (!NT_STATUS_IS_OK(status)) {
2364 goto fail;
2365 }
2366
2367 status = auth_generic_set_username(auth_generic_ctx, username);
2368 if (!NT_STATUS_IS_OK(status)) {
2369 goto fail;
2370 }
2371
2372 status = auth_generic_set_domain(auth_generic_ctx, domain);
2373 if (!NT_STATUS_IS_OK(status)) {
2374 goto fail;
2375 }
2376
2377 status = auth_generic_set_password(auth_generic_ctx, password);
2378 if (!NT_STATUS_IS_OK(status)) {
2379 goto fail;
2380 }
2381
2382 status = gensec_set_target_service(auth_generic_ctx->gensec_security, target_service);
2383 if (!NT_STATUS_IS_OK(status)) {
2384 goto fail;
2385 }
2386
2387 status = gensec_set_target_hostname(auth_generic_ctx->gensec_security, server);
2388 if (!NT_STATUS_IS_OK(status)) {
2389 goto fail;
2390 }
2391
2392 cli_credentials_set_kerberos_state(auth_generic_ctx->credentials, use_kerberos);
2393 cli_credentials_set_netlogon_creds(auth_generic_ctx->credentials, creds);
2394
2395 status = auth_generic_client_start_by_authtype(auth_generic_ctx, auth_type, auth_level);
2396 if (!NT_STATUS_IS_OK(status)) {
2397 goto fail;
2398 }
2399
2400 result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2401 talloc_free(auth_generic_ctx);
2402 *presult = result;
2403 return NT_STATUS_OK;
2404
2405 fail:
2406 TALLOC_FREE(result);
2407 return status;
2408 }
2409
2410 /* This routine steals the creds pointer that is passed in */
2411 static NTSTATUS rpccli_generic_bind_data_from_creds(TALLOC_CTX *mem_ctx,
2412 enum dcerpc_AuthType auth_type,
2413 enum dcerpc_AuthLevel auth_level,
2414 const char *server,
2415 const char *target_service,
2416 struct cli_credentials *creds,
2417 struct pipe_auth_data **presult)
2418 {
2419 struct auth_generic_state *auth_generic_ctx;
2420 struct pipe_auth_data *result;
2421 NTSTATUS status;
2422
2423 result = talloc_zero(mem_ctx, struct pipe_auth_data);
2424 if (result == NULL) {
2425 return NT_STATUS_NO_MEMORY;
2426 }
2427
2428 result->auth_type = auth_type;
2429 result->auth_level = auth_level;
2430
2431 status = auth_generic_client_prepare(result,
2432 &auth_generic_ctx);
2433 if (!NT_STATUS_IS_OK(status)) {
2434 goto fail;
2435 }
2436
2437 status = auth_generic_set_creds(auth_generic_ctx, creds);
2438 if (!NT_STATUS_IS_OK(status)) {
2439 goto fail;
2440 }
2441
2442 status = gensec_set_target_service(auth_generic_ctx->gensec_security, target_service);
2443 if (!NT_STATUS_IS_OK(status)) {
2444 goto fail;
2445 }
2446
2447 status = gensec_set_target_hostname(auth_generic_ctx->gensec_security, server);
2448 if (!NT_STATUS_IS_OK(status)) {
2449 goto fail;
2450 }
2451
2452 status = auth_generic_client_start_by_authtype(auth_generic_ctx, auth_type, auth_level);
2453 if (!NT_STATUS_IS_OK(status)) {
2454 goto fail;
2455 }
2456
2457 result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2458 talloc_free(auth_generic_ctx);
2459 *presult = result;
2460 return NT_STATUS_OK;
2461
2462 fail:
2463 TALLOC_FREE(result);
2464 return status;
2465 }
2466
2467 NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx,
2468 struct pipe_auth_data **presult)
2469 {
2470 return rpccli_generic_bind_data(mem_ctx,
2471 DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM,
2472 DCERPC_AUTH_LEVEL_CONNECT,
2473 NULL, /* server */
2474 "host", /* target_service */
2475 NAME_NT_AUTHORITY, /* domain */
2476 "SYSTEM",
2477 "", /* password */
2478 CRED_DONT_USE_KERBEROS,
2479 NULL, /* netlogon_creds_CredentialState */
2480 presult);
2481 }
2482
2483 /**
2484 * Create an rpc pipe client struct, connecting to a tcp port.
2485 */
2486 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
2487 const struct sockaddr_storage *ss_addr,
2488 uint16_t port,
2489 const struct ndr_interface_table *table,
2490 struct rpc_pipe_client **presult)
2491 {
2492 struct rpc_pipe_client *result;
2493 struct sockaddr_storage addr;
2494 NTSTATUS status;
2495 int fd;
2496
2497 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2498 if (result == NULL) {
2499 return NT_STATUS_NO_MEMORY;
2500 }
2501
2502 result->abstract_syntax = table->syntax_id;
2503 result->transfer_syntax = ndr_transfer_syntax_ndr;
2504
2505 result->desthost = talloc_strdup(result, host);
2506 result->srv_name_slash = talloc_asprintf_strupper_m(
2507 result, "\\\\%s", result->desthost);
2508 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2509 status = NT_STATUS_NO_MEMORY;
2510 goto fail;
2511 }
2512
2513 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2514 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2515
2516 if (ss_addr == NULL) {
2517 if (!resolve_name(host, &addr, NBT_NAME_SERVER, false)) {
2518 status = NT_STATUS_NOT_FOUND;
2519 goto fail;
2520 }
2521 } else {
2522 addr = *ss_addr;
2523 }
2524
2525 status = open_socket_out(&addr, port, 60*1000, &fd);
2526 if (!NT_STATUS_IS_OK(status)) {
2527 goto fail;
2528 }
2529 set_socket_options(fd, lp_socket_options());
2530
2531 status = rpc_transport_sock_init(result, fd, &result->transport);
2532 if (!NT_STATUS_IS_OK(status)) {
2533 close(fd);
2534 goto fail;
2535 }
2536
2537 result->transport->transport = NCACN_IP_TCP;
2538
2539 result->binding_handle = rpccli_bh_create(result, NULL, table);
2540 if (result->binding_handle == NULL) {
2541 TALLOC_FREE(result);
2542 return NT_STATUS_NO_MEMORY;
2543 }
2544
2545 *presult = result;
2546 return NT_STATUS_OK;
2547
2548 fail:
2549 TALLOC_FREE(result);
2550 return status;
2551 }
2552
2553 /**
2554 * Determine the tcp port on which a dcerpc interface is listening
2555 * for the ncacn_ip_tcp transport via the endpoint mapper of the
2556 * target host.
2557 */
2558 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
2559 const struct sockaddr_storage *addr,
2560 const struct ndr_interface_table *table,
2561 uint16_t *pport)
2562 {
2563 NTSTATUS status;
2564 struct rpc_pipe_client *epm_pipe = NULL;
2565 struct dcerpc_binding_handle *epm_handle = NULL;
2566 struct pipe_auth_data *auth = NULL;
2567 struct dcerpc_binding *map_binding = NULL;
2568 struct dcerpc_binding *res_binding = NULL;
2569 enum dcerpc_transport_t transport;
2570 const char *endpoint = NULL;
2571 struct epm_twr_t *map_tower = NULL;
2572 struct epm_twr_t *res_towers = NULL;
2573 struct policy_handle *entry_handle = NULL;
2574 uint32_t num_towers = 0;
2575 uint32_t max_towers = 1;
2576 struct epm_twr_p_t towers;
2577 TALLOC_CTX *tmp_ctx = talloc_stackframe();
2578 uint32_t result = 0;
2579
2580 if (pport == NULL) {
2581 status = NT_STATUS_INVALID_PARAMETER;
2582 goto done;
2583 }
2584
2585 if (ndr_syntax_id_equal(&table->syntax_id,
2586 &ndr_table_epmapper.syntax_id)) {
2587 *pport = 135;
2588 status = NT_STATUS_OK;
2589 goto done;
2590 }
2591
2592 /* open the connection to the endpoint mapper */
2593 status = rpc_pipe_open_tcp_port(tmp_ctx, host, addr, 135,
2594 &ndr_table_epmapper,
2595 &epm_pipe);
2596
2597 if (!NT_STATUS_IS_OK(status)) {
2598 goto done;
2599 }
2600 epm_handle = epm_pipe->binding_handle;
2601
2602 status = rpccli_anon_bind_data(tmp_ctx, &auth);
2603 if (!NT_STATUS_IS_OK(status)) {
2604 goto done;
2605 }
2606
2607 status = rpc_pipe_bind(epm_pipe, auth);
2608 if (!NT_STATUS_IS_OK(status)) {
2609 goto done;
2610 }
2611
2612 /* create tower for asking the epmapper */
2613
2614 status = dcerpc_parse_binding(tmp_ctx, "ncacn_ip_tcp:[135]",
2615 &map_binding);
2616 if (!NT_STATUS_IS_OK(status)) {
2617 goto done;
2618 }
2619
2620 status = dcerpc_binding_set_abstract_syntax(map_binding,
2621 &table->syntax_id);
2622 if (!NT_STATUS_IS_OK(status)) {
2623 goto done;
2624 }
2625
2626 map_tower = talloc_zero(tmp_ctx, struct epm_twr_t);
2627 if (map_tower == NULL) {
2628 status = NT_STATUS_NO_MEMORY;
2629 goto done;
2630 }
2631
2632 status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
2633 &(map_tower->tower));
2634 if (!NT_STATUS_IS_OK(status)) {
2635 goto done;
2636 }
2637
2638 /* allocate further parameters for the epm_Map call */
2639
2640 res_towers = talloc_array(tmp_ctx, struct epm_twr_t, max_towers);
2641 if (res_towers == NULL) {
2642 status = NT_STATUS_NO_MEMORY;
2643 goto done;
2644 }
2645 towers.twr = res_towers;
2646
2647 entry_handle = talloc_zero(tmp_ctx, struct policy_handle);
2648 if (entry_handle == NULL) {
2649 status = NT_STATUS_NO_MEMORY;
2650 goto done;
2651 }
2652
2653 /* ask the endpoint mapper for the port */
2654
2655 status = dcerpc_epm_Map(epm_handle,
2656 tmp_ctx,
2657 discard_const_p(struct GUID,
2658 &(table->syntax_id.uuid)),
2659 map_tower,
2660 entry_handle,
2661 max_towers,
2662 &num_towers,
2663 &towers,
2664 &result);
2665
2666 if (!NT_STATUS_IS_OK(status)) {
2667 goto done;
2668 }
2669
2670 if (result != EPMAPPER_STATUS_OK) {
2671 status = NT_STATUS_UNSUCCESSFUL;
2672 goto done;
2673 }
2674
2675 if (num_towers != 1) {
2676 status = NT_STATUS_UNSUCCESSFUL;
2677 goto done;
2678 }
2679
2680 /* extract the port from the answer */
2681
2682 status = dcerpc_binding_from_tower(tmp_ctx,
2683 &(towers.twr->tower),
2684 &res_binding);
2685 if (!NT_STATUS_IS_OK(status)) {
2686 goto done;
2687 }
2688
2689 transport = dcerpc_binding_get_transport(res_binding);
2690 endpoint = dcerpc_binding_get_string_option(res_binding, "endpoint");
2691
2692 /* are further checks here necessary? */
2693 if (transport != NCACN_IP_TCP) {
2694 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2695 goto done;
2696 }
2697
2698 if (endpoint == NULL) {
2699 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2700 goto done;
2701 }
2702
2703 *pport = (uint16_t)atoi(endpoint);
2704
2705 done:
2706 TALLOC_FREE(tmp_ctx);
2707 return status;
2708 }
2709
2710 /**
2711 * Create a rpc pipe client struct, connecting to a host via tcp.
2712 * The port is determined by asking the endpoint mapper on the given
2713 * host.
2714 */
2715 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
2716 const struct sockaddr_storage *addr,
2717 const struct ndr_interface_table *table,
2718 struct rpc_pipe_client **presult)
2719 {
2720 NTSTATUS status;
2721 uint16_t port = 0;
2722
2723 status = rpc_pipe_get_tcp_port(host, addr, table, &port);
2724 if (!NT_STATUS_IS_OK(status)) {
2725 return status;
2726 }
2727
2728 return rpc_pipe_open_tcp_port(mem_ctx, host, addr, port,
2729 table, presult);
2730 }
2731
2732 /********************************************************************
2733 Create a rpc pipe client struct, connecting to a unix domain socket
2734 ********************************************************************/
2735 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
2736 const struct ndr_interface_table *table,
2737 struct rpc_pipe_client **presult)
2738 {
2739 struct rpc_pipe_client *result;
2740 struct sockaddr_un addr;
2741 NTSTATUS status;
2742 int fd;
2743 socklen_t salen;
2744
2745 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2746 if (result == NULL) {
2747 return NT_STATUS_NO_MEMORY;
2748 }
2749
2750 result->abstract_syntax = table->syntax_id;
2751 result->transfer_syntax = ndr_transfer_syntax_ndr;
2752
2753 result->desthost = get_myname(result);
2754 result->srv_name_slash = talloc_asprintf_strupper_m(
2755 result, "\\\\%s", result->desthost);
2756 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2757 status = NT_STATUS_NO_MEMORY;
2758 goto fail;
2759 }
2760
2761 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2762 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2763
2764 fd = socket(AF_UNIX, SOCK_STREAM, 0);
2765 if (fd == -1) {
2766 status = map_nt_error_from_unix(errno);
2767 goto fail;
2768 }
2769
2770 ZERO_STRUCT(addr);
2771 addr.sun_family = AF_UNIX;
2772 strlcpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
2773 salen = sizeof(struct sockaddr_un);
2774
2775 if (connect(fd, (struct sockaddr *)(void *)&addr, salen) == -1) {
2776 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
2777 strerror(errno)));
2778 close(fd);
2779 return map_nt_error_from_unix(errno);
2780 }
2781
2782 status = rpc_transport_sock_init(result, fd, &result->transport);
2783 if (!NT_STATUS_IS_OK(status)) {
2784 close(fd);
2785 goto fail;
2786 }
2787
2788 result->transport->transport = NCALRPC;
2789
2790 result->binding_handle = rpccli_bh_create(result, NULL, table);
2791 if (result->binding_handle == NULL) {
2792 TALLOC_FREE(result);
2793 return NT_STATUS_NO_MEMORY;
2794 }
2795
2796 *presult = result;
2797 return NT_STATUS_OK;
2798
2799 fail:
2800 TALLOC_FREE(result);
2801 return status;
2802 }
2803
2804 struct rpc_pipe_client_np_ref {
2805 struct cli_state *cli;
2806 struct rpc_pipe_client *pipe;
2807 };
2808
2809 static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
2810 {
2811 DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
2812 return 0;
2813 }
2814
2815 /****************************************************************************
2816 Open a named pipe over SMB to a remote server.
2817 *
2818 * CAVEAT CALLER OF THIS FUNCTION:
2819 * The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
2820 * so be sure that this function is called AFTER any structure (vs pointer)
2821 * assignment of the cli. In particular, libsmbclient does structure
2822 * assignments of cli, which invalidates the data in the returned
2823 * rpc_pipe_client if this function is called before the structure assignment
2824 * of cli.
2825 *
2826 ****************************************************************************/
2827
2828 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
2829 const struct ndr_interface_table *table,
2830 struct rpc_pipe_client **presult)
2831 {
2832 struct rpc_pipe_client *result;
2833 NTSTATUS status;
2834 struct rpc_pipe_client_np_ref *np_ref;
2835
2836 /* sanity check to protect against crashes */
2837
2838 if ( !cli ) {
2839 return NT_STATUS_INVALID_HANDLE;
2840 }
2841
2842 result = talloc_zero(NULL, struct rpc_pipe_client);
2843 if (result == NULL) {
2844 return NT_STATUS_NO_MEMORY;
2845 }
2846
2847 result->abstract_syntax = table->syntax_id;
2848 result->transfer_syntax = ndr_transfer_syntax_ndr;
2849 result->desthost = talloc_strdup(result, smbXcli_conn_remote_name(cli->conn));
2850 result->srv_name_slash = talloc_asprintf_strupper_m(
2851 result, "\\\\%s", result->desthost);
2852
2853 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2854 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2855
2856 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2857 TALLOC_FREE(result);
2858 return NT_STATUS_NO_MEMORY;
2859 }
2860
2861 status = rpc_transport_np_init(result, cli, table,
2862 &result->transport);
2863 if (!NT_STATUS_IS_OK(status)) {
2864 TALLOC_FREE(result);
2865 return status;
2866 }
2867
2868 result->transport->transport = NCACN_NP;
2869
2870 np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
2871 if (np_ref == NULL) {
2872 TALLOC_FREE(result);
2873 return NT_STATUS_NO_MEMORY;
2874 }
2875 np_ref->cli = cli;
2876 np_ref->pipe = result;
2877
2878 DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
2879 talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
2880
2881 result->binding_handle = rpccli_bh_create(result, NULL, table);
2882 if (result->binding_handle == NULL) {
2883 TALLOC_FREE(result);
2884 return NT_STATUS_NO_MEMORY;
2885 }
2886
2887 *presult = result;
2888 return NT_STATUS_OK;
2889 }
2890
2891 /****************************************************************************
2892 Open a pipe to a remote server.
2893 ****************************************************************************/
2894
2895 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
2896 enum dcerpc_transport_t transport,
2897 const struct ndr_interface_table *table,
2898 struct rpc_pipe_client **presult)
2899 {
2900 switch (transport) {
2901 case NCACN_IP_TCP:
2902 return rpc_pipe_open_tcp(NULL,
2903 smbXcli_conn_remote_name(cli->conn),
2904 smbXcli_conn_remote_sockaddr(cli->conn),
2905 table, presult);
2906 case NCACN_NP:
2907 return rpc_pipe_open_np(cli, table, presult);
2908 default:
2909 return NT_STATUS_NOT_IMPLEMENTED;
2910 }
2911 }
2912
2913 /****************************************************************************
2914 Open a named pipe to an SMB server and bind anonymously.
2915 ****************************************************************************/
2916
2917 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
2918 enum dcerpc_transport_t transport,
2919 const struct ndr_interface_table *table,
2920 struct rpc_pipe_client **presult)
2921 {
2922 struct rpc_pipe_client *result;
2923 struct pipe_auth_data *auth;
2924 NTSTATUS status;
2925
2926 status = cli_rpc_pipe_open(cli, transport, table, &result);
2927 if (!NT_STATUS_IS_OK(status)) {
2928 return status;
2929 }
2930
2931 status = rpccli_anon_bind_data(result, &auth);
2932 if (!NT_STATUS_IS_OK(status)) {
2933 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
2934 nt_errstr(status)));
2935 TALLOC_FREE(result);
2936 return status;
2937 }
2938
2939 /*
2940 * This is a bit of an abstraction violation due to the fact that an
2941 * anonymous bind on an authenticated SMB inherits the user/domain
2942 * from the enclosing SMB creds
2943 */
2944
2945 if (transport == NCACN_NP) {
2946 struct smbXcli_session *session;
2947
2948 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
2949 session = cli->smb2.session;
2950 } else {
2951 session = cli->smb1.session;
2952 }
2953
2954 status = smbXcli_session_application_key(session, auth,
2955 &auth->transport_session_key);
2956 if (!NT_STATUS_IS_OK(status)) {
2957 auth->transport_session_key = data_blob_null;
2958 }
2959 }
2960
2961 status = rpc_pipe_bind(result, auth);
2962 if (!NT_STATUS_IS_OK(status)) {
2963 int lvl = 0;
2964 if (ndr_syntax_id_equal(&table->syntax_id,
2965 &ndr_table_dssetup.syntax_id)) {
2966 /* non AD domains just don't have this pipe, avoid
2967 * level 0 statement in that case - gd */
2968 lvl = 3;
2969 }
2970 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
2971 "%s failed with error %s\n",
2972 table->name,
2973 nt_errstr(status) ));
2974 TALLOC_FREE(result);
2975 return status;
2976 }
2977
2978 DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
2979 "%s and bound anonymously.\n",
2980 table->name,
2981 result->desthost));
2982
2983 *presult = result;
2984 return NT_STATUS_OK;
2985 }
2986
2987 /****************************************************************************
2988 ****************************************************************************/
2989
2990 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
2991 const struct ndr_interface_table *table,
2992 struct rpc_pipe_client **presult)
2993 {
2994 return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
2995 table, presult);
2996 }
2997
2998 /****************************************************************************
2999 Open a named pipe to an SMB server and bind using the mech specified
3000
3001 This routine references the creds pointer that is passed in
3002 ****************************************************************************/
3003
3004 NTSTATUS cli_rpc_pipe_open_with_creds(struct cli_state *cli,
3005 const struct ndr_interface_table *table,
3006 enum dcerpc_transport_t transport,
3007 enum dcerpc_AuthType auth_type,
3008 enum dcerpc_AuthLevel auth_level,
3009 const char *server,
3010 struct cli_credentials *creds,
3011 struct rpc_pipe_client **presult)
3012 {
3013 struct rpc_pipe_client *result;
3014 struct pipe_auth_data *auth = NULL;
3015 const char *target_service = table->authservices->names[0];
3016
3017 NTSTATUS status;
3018
3019 status = cli_rpc_pipe_open(cli, transport, table, &result);
3020 if (!NT_STATUS_IS_OK(status)) {
3021 return status;
3022 }
3023
3024 status = rpccli_generic_bind_data_from_creds(result,
3025 auth_type, auth_level,
3026 server, target_service,
3027 creds,
3028 &auth);
3029 if (!NT_STATUS_IS_OK(status)) {
3030 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
3031 nt_errstr(status)));
3032 goto err;
3033 }
3034
3035 status = rpc_pipe_bind(result, auth);
3036 if (!NT_STATUS_IS_OK(status)) {
3037 DEBUG(0, ("cli_rpc_pipe_open_generic_auth: cli_rpc_pipe_bind failed with error %s\n",
3038 nt_errstr(status) ));
3039 goto err;
3040 }
3041
3042 DEBUG(10,("cli_rpc_pipe_open_generic_auth: opened pipe %s to "
3043 "machine %s and bound as user %s.\n", table->name,
3044 result->desthost, cli_credentials_get_unparsed_name(creds, talloc_tos())));
3045
3046 *presult = result;
3047 return NT_STATUS_OK;
3048
3049 err:
3050
3051 TALLOC_FREE(result);
3052 return status;
3053 }
3054
3055 /****************************************************************************
3056 Open a named pipe to an SMB server and bind using the mech specified
3057
3058 This routine steals the creds pointer that is passed in
3059 ****************************************************************************/
3060
3061 NTSTATUS cli_rpc_pipe_open_generic_auth(struct cli_state *cli,
3062 const struct ndr_interface_table *table,
3063 enum dcerpc_transport_t transport,
3064 enum credentials_use_kerberos use_kerberos,
3065 enum dcerpc_AuthType auth_type,
3066 enum dcerpc_AuthLevel auth_level,
3067 const char *server,
3068 const char *domain,
3069 const char *username,
3070 const char *password,
3071 struct rpc_pipe_client **presult)
3072 {
3073 struct rpc_pipe_client *result;
3074 struct pipe_auth_data *auth = NULL;
3075 const char *target_service = table->authservices->names[0];
3076
3077 NTSTATUS status;
3078
3079 status = cli_rpc_pipe_open(cli, transport, table, &result);
3080 if (!NT_STATUS_IS_OK(status)) {
3081 return status;
3082 }
3083
3084 status = rpccli_generic_bind_data(result,
3085 auth_type, auth_level,
3086 server, target_service,
3087 domain, username, password,
3088 CRED_AUTO_USE_KERBEROS,
3089 NULL,
3090 &auth);
3091 if (!NT_STATUS_IS_OK(status)) {
3092 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
3093 nt_errstr(status)));
3094 goto err;
3095 }
3096
3097 status = rpc_pipe_bind(result, auth);
3098 if (!NT_STATUS_IS_OK(status)) {
3099 DEBUG(0, ("cli_rpc_pipe_open_generic_auth: cli_rpc_pipe_bind failed with error %s\n",
3100 nt_errstr(status) ));
3101 goto err;
3102 }
3103
3104 DEBUG(10,("cli_rpc_pipe_open_generic_auth: opened pipe %s to "
3105 "machine %s and bound as user %s\\%s.\n", table->name,
3106 result->desthost, domain, username));
3107
3108 *presult = result;
3109 return NT_STATUS_OK;
3110
3111 err:
3112
3113 TALLOC_FREE(result);
3114 return status;
3115 }
3116
3117 NTSTATUS cli_rpc_pipe_open_schannel_with_creds(struct cli_state *cli,
3118 const struct ndr_interface_table *table,
3119 enum dcerpc_transport_t transport,
3120 struct cli_credentials *cli_creds,
3121 struct netlogon_creds_cli_context *netlogon_creds,
3122 struct rpc_pipe_client **_rpccli)
3123 {
3124 struct rpc_pipe_client *rpccli;
3125 struct pipe_auth_data *rpcauth;
3126 const char *target_service = table->authservices->names[0];
3127 struct netlogon_creds_CredentialState *ncreds = NULL;
3128 enum dcerpc_AuthLevel auth_level;
3129 NTSTATUS status;
3130 int rpc_pipe_bind_dbglvl = 0;
3131
3132 status = cli_rpc_pipe_open(cli, transport, table, &rpccli);
3133 if (!NT_STATUS_IS_OK(status)) {
3134 return status;
3135 }
3136
3137 status = netlogon_creds_cli_lock(netlogon_creds, rpccli, &ncreds);
3138 if (!NT_STATUS_IS_OK(status)) {
3139 DEBUG(0, ("netlogon_creds_cli_get returned %s\n",
3140 nt_errstr(status)));
3141 TALLOC_FREE(rpccli);
3142 return status;
3143 }
3144
3145 auth_level = netlogon_creds_cli_auth_level(netlogon_creds);
3146
3147 cli_credentials_set_netlogon_creds(cli_creds, ncreds);
3148
3149 status = rpccli_generic_bind_data_from_creds(rpccli,
3150 DCERPC_AUTH_TYPE_SCHANNEL,
3151 auth_level,
3152 rpccli->desthost,
3153 target_service,
3154 cli_creds,
3155 &rpcauth);
3156 if (!NT_STATUS_IS_OK(status)) {
3157 DEBUG(0, ("rpccli_generic_bind_data_from_creds returned %s\n",
3158 nt_errstr(status)));
3159 TALLOC_FREE(rpccli);
3160 return status;
3161 }
3162
3163 status = rpc_pipe_bind(rpccli, rpcauth);
3164 cli_credentials_set_netlogon_creds(cli_creds, NULL);
3165 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
3166 rpc_pipe_bind_dbglvl = 1;
3167 netlogon_creds_cli_delete(netlogon_creds, &ncreds);
3168 }
3169 if (!NT_STATUS_IS_OK(status)) {
3170 DEBUG(rpc_pipe_bind_dbglvl,
3171 ("%s: rpc_pipe_bind failed with error %s\n",
3172 __func__, nt_errstr(status)));
3173 TALLOC_FREE(rpccli);
3174 return status;
3175 }
3176
3177 TALLOC_FREE(ncreds);
3178
3179 if (!ndr_syntax_id_equal(&table->syntax_id, &ndr_table_netlogon.syntax_id)) {
3180 goto done;
3181 }
3182
3183 status = netlogon_creds_cli_check(netlogon_creds,
3184 rpccli->binding_handle);
3185 if (!NT_STATUS_IS_OK(status)) {
3186 DEBUG(0, ("netlogon_creds_cli_check failed with %s\n",
3187 nt_errstr(status)));
3188 TALLOC_FREE(rpccli);
3189 return status;
3190 }
3191
3192
3193 done:
3194 DEBUG(10,("%s: opened pipe %s to machine %s "
3195 "for domain %s and bound using schannel.\n",
3196 __func__, table->name,
3197 rpccli->desthost, cli_credentials_get_domain(cli_creds)));
3198
3199 *_rpccli = rpccli;
3200 return NT_STATUS_OK;
3201 }
3202
3203 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
3204 struct rpc_pipe_client *cli,
3205 DATA_BLOB *session_key)
3206 {
3207 NTSTATUS status;
3208 struct pipe_auth_data *a;
3209 struct gensec_security *gensec_security;
3210 DATA_BLOB sk = data_blob_null;
3211 bool make_dup = false;
3212
3213 if (!session_key || !cli) {
3214 return NT_STATUS_INVALID_PARAMETER;
3215 }
3216
3217 a = cli->auth;
3218
3219 if (a == NULL) {
3220 return NT_STATUS_INVALID_PARAMETER;
3221 }
3222
3223 switch (cli->auth->auth_type) {
3224 case DCERPC_AUTH_TYPE_NONE:
3225 sk = data_blob_const(a->transport_session_key.data,
3226 a->transport_session_key.length);
3227 make_dup = true;
3228 break;
3229 default:
3230 gensec_security = a->auth_ctx;
3231 status = gensec_session_key(gensec_security, mem_ctx, &sk);
3232 if (!NT_STATUS_IS_OK(status)) {
3233 return status;
3234 }
3235 make_dup = false;
3236 break;
3237 }
3238
3239 if (!sk.data) {
3240 return NT_STATUS_NO_USER_SESSION_KEY;
3241 }
3242
3243 if (make_dup) {
3244 *session_key = data_blob_dup_talloc(mem_ctx, sk);
3245 } else {
3246 *session_key = sk;
3247 }
3248
3249 return NT_STATUS_OK;
3250 }
Samba GIT mirror