?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3: nmbd: Fix bug 10633 - nmbd denial of service
[Samba.git] / source3 / rpc_client / cli_pipe.c
blob97926a203ae279552d1a447efab509b70c854939
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client routines
4 * Largely rewritten by Jeremy Allison 2005.
5 * Heavily modified by Simo Sorce 2010.
6 * Copyright Andrew Bartlett 2011.
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "../lib/util/tevent_ntstatus.h"
24 #include "librpc/gen_ndr/ndr_epmapper_c.h"
25 #include "../librpc/gen_ndr/ndr_schannel.h"
26 #include "../librpc/gen_ndr/ndr_dssetup.h"
27 #include "../libcli/auth/schannel.h"
28 #include "../libcli/auth/spnego.h"
29 #include "../auth/ntlmssp/ntlmssp.h"
30 #include "auth_generic.h"
31 #include "librpc/gen_ndr/ndr_dcerpc.h"
32 #include "librpc/gen_ndr/ndr_netlogon_c.h"
33 #include "librpc/rpc/dcerpc.h"
34 #include "rpc_dce.h"
35 #include "cli_pipe.h"
36 #include "libsmb/libsmb.h"
37 #include "auth/gensec/gensec.h"
38 #include "auth/credentials/credentials.h"
39 #include "../libcli/smb/smbXcli_base.h"
40
41 #undef DBGC_CLASS
42 #define DBGC_CLASS DBGC_RPC_CLI
43
44 /********************************************************************
45 Pipe description for a DEBUG
46 ********************************************************************/
47 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
48 struct rpc_pipe_client *cli)
49 {
50 char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
51 if (result == NULL) {
52 return "pipe";
53 }
54 return result;
55 }
56
57 /********************************************************************
58 Rpc pipe call id.
59 ********************************************************************/
60
61 static uint32 get_rpc_call_id(void)
62 {
63 static uint32 call_id = 0;
64 return ++call_id;
65 }
66
67 /*******************************************************************
68 Use SMBreadX to get rest of one fragment's worth of rpc data.
69 Reads the whole size or give an error message
70 ********************************************************************/
71
72 struct rpc_read_state {
73 struct event_context *ev;
74 struct rpc_cli_transport *transport;
75 uint8_t *data;
76 size_t size;
77 size_t num_read;
78 };
79
80 static void rpc_read_done(struct tevent_req *subreq);
81
82 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
83 struct event_context *ev,
84 struct rpc_cli_transport *transport,
85 uint8_t *data, size_t size)
86 {
87 struct tevent_req *req, *subreq;
88 struct rpc_read_state *state;
89
90 req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
91 if (req == NULL) {
92 return NULL;
93 }
94 state->ev = ev;
95 state->transport = transport;
96 state->data = data;
97 state->size = size;
98 state->num_read = 0;
99
100 DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
101
102 subreq = transport->read_send(state, ev, (uint8_t *)data, size,
103 transport->priv);
104 if (subreq == NULL) {
105 goto fail;
106 }
107 tevent_req_set_callback(subreq, rpc_read_done, req);
108 return req;
109
110 fail:
111 TALLOC_FREE(req);
112 return NULL;
113 }
114
115 static void rpc_read_done(struct tevent_req *subreq)
116 {
117 struct tevent_req *req = tevent_req_callback_data(
118 subreq, struct tevent_req);
119 struct rpc_read_state *state = tevent_req_data(
120 req, struct rpc_read_state);
121 NTSTATUS status;
122 ssize_t received;
123
124 status = state->transport->read_recv(subreq, &received);
125 TALLOC_FREE(subreq);
126 if (!NT_STATUS_IS_OK(status)) {
127 tevent_req_nterror(req, status);
128 return;
129 }
130
131 state->num_read += received;
132 if (state->num_read == state->size) {
133 tevent_req_done(req);
134 return;
135 }
136
137 subreq = state->transport->read_send(state, state->ev,
138 state->data + state->num_read,
139 state->size - state->num_read,
140 state->transport->priv);
141 if (tevent_req_nomem(subreq, req)) {
142 return;
143 }
144 tevent_req_set_callback(subreq, rpc_read_done, req);
145 }
146
147 static NTSTATUS rpc_read_recv(struct tevent_req *req)
148 {
149 return tevent_req_simple_recv_ntstatus(req);
150 }
151
152 struct rpc_write_state {
153 struct event_context *ev;
154 struct rpc_cli_transport *transport;
155 const uint8_t *data;
156 size_t size;
157 size_t num_written;
158 };
159
160 static void rpc_write_done(struct tevent_req *subreq);
161
162 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
163 struct event_context *ev,
164 struct rpc_cli_transport *transport,
165 const uint8_t *data, size_t size)
166 {
167 struct tevent_req *req, *subreq;
168 struct rpc_write_state *state;
169
170 req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
171 if (req == NULL) {
172 return NULL;
173 }
174 state->ev = ev;
175 state->transport = transport;
176 state->data = data;
177 state->size = size;
178 state->num_written = 0;
179
180 DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
181
182 subreq = transport->write_send(state, ev, data, size, transport->priv);
183 if (subreq == NULL) {
184 goto fail;
185 }
186 tevent_req_set_callback(subreq, rpc_write_done, req);
187 return req;
188 fail:
189 TALLOC_FREE(req);
190 return NULL;
191 }
192
193 static void rpc_write_done(struct tevent_req *subreq)
194 {
195 struct tevent_req *req = tevent_req_callback_data(
196 subreq, struct tevent_req);
197 struct rpc_write_state *state = tevent_req_data(
198 req, struct rpc_write_state);
199 NTSTATUS status;
200 ssize_t written;
201
202 status = state->transport->write_recv(subreq, &written);
203 TALLOC_FREE(subreq);
204 if (!NT_STATUS_IS_OK(status)) {
205 tevent_req_nterror(req, status);
206 return;
207 }
208
209 state->num_written += written;
210
211 if (state->num_written == state->size) {
212 tevent_req_done(req);
213 return;
214 }
215
216 subreq = state->transport->write_send(state, state->ev,
217 state->data + state->num_written,
218 state->size - state->num_written,
219 state->transport->priv);
220 if (tevent_req_nomem(subreq, req)) {
221 return;
222 }
223 tevent_req_set_callback(subreq, rpc_write_done, req);
224 }
225
226 static NTSTATUS rpc_write_recv(struct tevent_req *req)
227 {
228 return tevent_req_simple_recv_ntstatus(req);
229 }
230
231
232 /****************************************************************************
233 Try and get a PDU's worth of data from current_pdu. If not, then read more
234 from the wire.
235 ****************************************************************************/
236
237 struct get_complete_frag_state {
238 struct event_context *ev;
239 struct rpc_pipe_client *cli;
240 uint16_t frag_len;
241 DATA_BLOB *pdu;
242 };
243
244 static void get_complete_frag_got_header(struct tevent_req *subreq);
245 static void get_complete_frag_got_rest(struct tevent_req *subreq);
246
247 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
248 struct event_context *ev,
249 struct rpc_pipe_client *cli,
250 DATA_BLOB *pdu)
251 {
252 struct tevent_req *req, *subreq;
253 struct get_complete_frag_state *state;
254 size_t received;
255 NTSTATUS status;
256
257 req = tevent_req_create(mem_ctx, &state,
258 struct get_complete_frag_state);
259 if (req == NULL) {
260 return NULL;
261 }
262 state->ev = ev;
263 state->cli = cli;
264 state->frag_len = RPC_HEADER_LEN;
265 state->pdu = pdu;
266
267 received = pdu->length;
268 if (received < RPC_HEADER_LEN) {
269 if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
270 status = NT_STATUS_NO_MEMORY;
271 goto post_status;
272 }
273 subreq = rpc_read_send(state, state->ev,
274 state->cli->transport,
275 pdu->data + received,
276 RPC_HEADER_LEN - received);
277 if (subreq == NULL) {
278 status = NT_STATUS_NO_MEMORY;
279 goto post_status;
280 }
281 tevent_req_set_callback(subreq, get_complete_frag_got_header,
282 req);
283 return req;
284 }
285
286 state->frag_len = dcerpc_get_frag_length(pdu);
287 if (state->frag_len < RPC_HEADER_LEN) {
288 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
289 return tevent_req_post(req, ev);
290 }
291
292 /*
293 * Ensure we have frag_len bytes of data.
294 */
295 if (received < state->frag_len) {
296 if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
297 status = NT_STATUS_NO_MEMORY;
298 goto post_status;
299 }
300 subreq = rpc_read_send(state, state->ev,
301 state->cli->transport,
302 pdu->data + received,
303 state->frag_len - received);
304 if (subreq == NULL) {
305 status = NT_STATUS_NO_MEMORY;
306 goto post_status;
307 }
308 tevent_req_set_callback(subreq, get_complete_frag_got_rest,
309 req);
310 return req;
311 }
312
313 status = NT_STATUS_OK;
314 post_status:
315 if (NT_STATUS_IS_OK(status)) {
316 tevent_req_done(req);
317 } else {
318 tevent_req_nterror(req, status);
319 }
320 return tevent_req_post(req, ev);
321 }
322
323 static void get_complete_frag_got_header(struct tevent_req *subreq)
324 {
325 struct tevent_req *req = tevent_req_callback_data(
326 subreq, struct tevent_req);
327 struct get_complete_frag_state *state = tevent_req_data(
328 req, struct get_complete_frag_state);
329 NTSTATUS status;
330
331 status = rpc_read_recv(subreq);
332 TALLOC_FREE(subreq);
333 if (!NT_STATUS_IS_OK(status)) {
334 tevent_req_nterror(req, status);
335 return;
336 }
337
338 state->frag_len = dcerpc_get_frag_length(state->pdu);
339 if (state->frag_len < RPC_HEADER_LEN) {
340 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
341 return;
342 }
343
344 if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
345 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
346 return;
347 }
348
349 /*
350 * We're here in this piece of code because we've read exactly
351 * RPC_HEADER_LEN bytes into state->pdu.
352 */
353
354 subreq = rpc_read_send(state, state->ev, state->cli->transport,
355 state->pdu->data + RPC_HEADER_LEN,
356 state->frag_len - RPC_HEADER_LEN);
357 if (tevent_req_nomem(subreq, req)) {
358 return;
359 }
360 tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
361 }
362
363 static void get_complete_frag_got_rest(struct tevent_req *subreq)
364 {
365 struct tevent_req *req = tevent_req_callback_data(
366 subreq, struct tevent_req);
367 NTSTATUS status;
368
369 status = rpc_read_recv(subreq);
370 TALLOC_FREE(subreq);
371 if (!NT_STATUS_IS_OK(status)) {
372 tevent_req_nterror(req, status);
373 return;
374 }
375 tevent_req_done(req);
376 }
377
378 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
379 {
380 return tevent_req_simple_recv_ntstatus(req);
381 }
382
383 /****************************************************************************
384 Do basic authentication checks on an incoming pdu.
385 ****************************************************************************/
386
387 static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
388 struct rpc_pipe_client *cli,
389 struct ncacn_packet *pkt,
390 DATA_BLOB *pdu,
391 uint8_t expected_pkt_type,
392 uint32_t call_id,
393 DATA_BLOB *rdata,
394 DATA_BLOB *reply_pdu)
395 {
396 struct dcerpc_response *r;
397 NTSTATUS ret = NT_STATUS_OK;
398 size_t pad_len = 0;
399
400 /*
401 * Point the return values at the real data including the RPC
402 * header. Just in case the caller wants it.
403 */
404 *rdata = *pdu;
405
406 /* Ensure we have the correct type. */
407 switch (pkt->ptype) {
408 case DCERPC_PKT_ALTER_RESP:
409 case DCERPC_PKT_BIND_ACK:
410
411 /* Client code never receives this kind of packets */
412 break;
413
414
415 case DCERPC_PKT_RESPONSE:
416
417 r = &pkt->u.response;
418
419 /* Here's where we deal with incoming sign/seal. */
420 ret = dcerpc_check_auth(cli->auth, pkt,
421 &r->stub_and_verifier,
422 DCERPC_RESPONSE_LENGTH,
423 pdu, &pad_len);
424 if (!NT_STATUS_IS_OK(ret)) {
425 return ret;
426 }
427
428 if (pkt->frag_length < DCERPC_RESPONSE_LENGTH + pad_len) {
429 return NT_STATUS_BUFFER_TOO_SMALL;
430 }
431
432 /* Point the return values at the NDR data. */
433 rdata->data = r->stub_and_verifier.data;
434
435 if (pkt->auth_length) {
436 /* We've already done integer wrap tests in
437 * dcerpc_check_auth(). */
438 rdata->length = r->stub_and_verifier.length
439 - pad_len
440 - DCERPC_AUTH_TRAILER_LENGTH
441 - pkt->auth_length;
442 } else {
443 rdata->length = r->stub_and_verifier.length;
444 }
445
446 DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
447 (long unsigned int)pdu->length,
448 (long unsigned int)rdata->length,
449 (unsigned int)pad_len));
450
451 /*
452 * If this is the first reply, and the allocation hint is
453 * reasonable, try and set up the reply_pdu DATA_BLOB to the
454 * correct size.
455 */
456
457 if ((reply_pdu->length == 0) &&
458 r->alloc_hint && (r->alloc_hint < 15*1024*1024)) {
459 if (!data_blob_realloc(mem_ctx, reply_pdu,
460 r->alloc_hint)) {
461 DEBUG(0, ("reply alloc hint %d too "
462 "large to allocate\n",
463 (int)r->alloc_hint));
464 return NT_STATUS_NO_MEMORY;
465 }
466 }
467
468 break;
469
470 case DCERPC_PKT_BIND_NAK:
471 DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
472 rpccli_pipe_txt(talloc_tos(), cli)));
473 /* Use this for now... */
474 return NT_STATUS_NETWORK_ACCESS_DENIED;
475
476 case DCERPC_PKT_FAULT:
477
478 DEBUG(1, (__location__ ": RPC fault code %s received "
479 "from %s!\n",
480 dcerpc_errstr(talloc_tos(),
481 pkt->u.fault.status),
482 rpccli_pipe_txt(talloc_tos(), cli)));
483
484 return dcerpc_fault_to_nt_status(pkt->u.fault.status);
485
486 default:
487 DEBUG(0, (__location__ "Unknown packet type %u received "
488 "from %s!\n",
489 (unsigned int)pkt->ptype,
490 rpccli_pipe_txt(talloc_tos(), cli)));
491 return NT_STATUS_RPC_PROTOCOL_ERROR;
492 }
493
494 if (pkt->ptype != expected_pkt_type) {
495 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
496 "RPC packet type - %u, not %u\n",
497 rpccli_pipe_txt(talloc_tos(), cli),
498 pkt->ptype, expected_pkt_type));
499 return NT_STATUS_RPC_PROTOCOL_ERROR;
500 }
501
502 if (pkt->call_id != call_id) {
503 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
504 "RPC call_id - %u, not %u\n",
505 rpccli_pipe_txt(talloc_tos(), cli),
506 pkt->call_id, call_id));
507 return NT_STATUS_RPC_PROTOCOL_ERROR;
508 }
509
510 /* Do this just before return - we don't want to modify any rpc header
511 data before now as we may have needed to do cryptographic actions on
512 it before. */
513
514 if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
515 !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
516 DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
517 "fragment first/last ON.\n"));
518 pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
519 }
520
521 return NT_STATUS_OK;
522 }
523
524 /****************************************************************************
525 Call a remote api on an arbitrary pipe. takes param, data and setup buffers.
526 ****************************************************************************/
527
528 struct cli_api_pipe_state {
529 struct event_context *ev;
530 struct rpc_cli_transport *transport;
531 uint8_t *rdata;
532 uint32_t rdata_len;
533 };
534
535 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
536 static void cli_api_pipe_write_done(struct tevent_req *subreq);
537 static void cli_api_pipe_read_done(struct tevent_req *subreq);
538
539 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
540 struct event_context *ev,
541 struct rpc_cli_transport *transport,
542 uint8_t *data, size_t data_len,
543 uint32_t max_rdata_len)
544 {
545 struct tevent_req *req, *subreq;
546 struct cli_api_pipe_state *state;
547 NTSTATUS status;
548
549 req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
550 if (req == NULL) {
551 return NULL;
552 }
553 state->ev = ev;
554 state->transport = transport;
555
556 if (max_rdata_len < RPC_HEADER_LEN) {
557 /*
558 * For a RPC reply we always need at least RPC_HEADER_LEN
559 * bytes. We check this here because we will receive
560 * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
561 */
562 status = NT_STATUS_INVALID_PARAMETER;
563 goto post_status;
564 }
565
566 if (transport->trans_send != NULL) {
567 subreq = transport->trans_send(state, ev, data, data_len,
568 max_rdata_len, transport->priv);
569 if (subreq == NULL) {
570 goto fail;
571 }
572 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
573 return req;
574 }
575
576 /*
577 * If the transport does not provide a "trans" routine, i.e. for
578 * example the ncacn_ip_tcp transport, do the write/read step here.
579 */
580
581 subreq = rpc_write_send(state, ev, transport, data, data_len);
582 if (subreq == NULL) {
583 goto fail;
584 }
585 tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
586 return req;
587
588 post_status:
589 tevent_req_nterror(req, status);
590 return tevent_req_post(req, ev);
591 fail:
592 TALLOC_FREE(req);
593 return NULL;
594 }
595
596 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
597 {
598 struct tevent_req *req = tevent_req_callback_data(
599 subreq, struct tevent_req);
600 struct cli_api_pipe_state *state = tevent_req_data(
601 req, struct cli_api_pipe_state);
602 NTSTATUS status;
603
604 status = state->transport->trans_recv(subreq, state, &state->rdata,
605 &state->rdata_len);
606 TALLOC_FREE(subreq);
607 if (!NT_STATUS_IS_OK(status)) {
608 tevent_req_nterror(req, status);
609 return;
610 }
611 tevent_req_done(req);
612 }
613
614 static void cli_api_pipe_write_done(struct tevent_req *subreq)
615 {
616 struct tevent_req *req = tevent_req_callback_data(
617 subreq, struct tevent_req);
618 struct cli_api_pipe_state *state = tevent_req_data(
619 req, struct cli_api_pipe_state);
620 NTSTATUS status;
621
622 status = rpc_write_recv(subreq);
623 TALLOC_FREE(subreq);
624 if (!NT_STATUS_IS_OK(status)) {
625 tevent_req_nterror(req, status);
626 return;
627 }
628
629 state->rdata = talloc_array(state, uint8_t, RPC_HEADER_LEN);
630 if (tevent_req_nomem(state->rdata, req)) {
631 return;
632 }
633
634 /*
635 * We don't need to use rpc_read_send here, the upper layer will cope
636 * with a short read, transport->trans_send could also return less
637 * than state->max_rdata_len.
638 */
639 subreq = state->transport->read_send(state, state->ev, state->rdata,
640 RPC_HEADER_LEN,
641 state->transport->priv);
642 if (tevent_req_nomem(subreq, req)) {
643 return;
644 }
645 tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
646 }
647
648 static void cli_api_pipe_read_done(struct tevent_req *subreq)
649 {
650 struct tevent_req *req = tevent_req_callback_data(
651 subreq, struct tevent_req);
652 struct cli_api_pipe_state *state = tevent_req_data(
653 req, struct cli_api_pipe_state);
654 NTSTATUS status;
655 ssize_t received;
656
657 status = state->transport->read_recv(subreq, &received);
658 TALLOC_FREE(subreq);
659 if (!NT_STATUS_IS_OK(status)) {
660 tevent_req_nterror(req, status);
661 return;
662 }
663 state->rdata_len = received;
664 tevent_req_done(req);
665 }
666
667 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
668 uint8_t **prdata, uint32_t *prdata_len)
669 {
670 struct cli_api_pipe_state *state = tevent_req_data(
671 req, struct cli_api_pipe_state);
672 NTSTATUS status;
673
674 if (tevent_req_is_nterror(req, &status)) {
675 return status;
676 }
677
678 *prdata = talloc_move(mem_ctx, &state->rdata);
679 *prdata_len = state->rdata_len;
680 return NT_STATUS_OK;
681 }
682
683 /****************************************************************************
684 Send data on an rpc pipe via trans. The data must be the last
685 pdu fragment of an NDR data stream.
686
687 Receive response data from an rpc pipe, which may be large...
688
689 Read the first fragment: unfortunately have to use SMBtrans for the first
690 bit, then SMBreadX for subsequent bits.
691
692 If first fragment received also wasn't the last fragment, continue
693 getting fragments until we _do_ receive the last fragment.
694
695 Request/Response PDU's look like the following...
696
697 |<------------------PDU len----------------------------------------------->|
698 |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
699
700 +------------+-----------------+-------------+---------------+-------------+
701 | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR | AUTH DATA |
702 +------------+-----------------+-------------+---------------+-------------+
703
704 Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
705 signing & sealing being negotiated.
706
707 ****************************************************************************/
708
709 struct rpc_api_pipe_state {
710 struct event_context *ev;
711 struct rpc_pipe_client *cli;
712 uint8_t expected_pkt_type;
713 uint32_t call_id;
714
715 DATA_BLOB incoming_frag;
716 struct ncacn_packet *pkt;
717
718 /* Incoming reply */
719 DATA_BLOB reply_pdu;
720 size_t reply_pdu_offset;
721 uint8_t endianess;
722 };
723
724 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
725 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
726 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq);
727
728 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
729 struct event_context *ev,
730 struct rpc_pipe_client *cli,
731 DATA_BLOB *data, /* Outgoing PDU */
732 uint8_t expected_pkt_type,
733 uint32_t call_id)
734 {
735 struct tevent_req *req, *subreq;
736 struct rpc_api_pipe_state *state;
737 uint16_t max_recv_frag;
738 NTSTATUS status;
739
740 req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
741 if (req == NULL) {
742 return NULL;
743 }
744 state->ev = ev;
745 state->cli = cli;
746 state->expected_pkt_type = expected_pkt_type;
747 state->call_id = call_id;
748 state->incoming_frag = data_blob_null;
749 state->reply_pdu = data_blob_null;
750 state->reply_pdu_offset = 0;
751 state->endianess = DCERPC_DREP_LE;
752
753 /*
754 * Ensure we're not sending too much.
755 */
756 if (data->length > cli->max_xmit_frag) {
757 status = NT_STATUS_INVALID_PARAMETER;
758 goto post_status;
759 }
760
761 DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
762
763 if (state->expected_pkt_type == DCERPC_PKT_AUTH3) {
764 subreq = rpc_write_send(state, ev, cli->transport,
765 data->data, data->length);
766 if (subreq == NULL) {
767 goto fail;
768 }
769 tevent_req_set_callback(subreq, rpc_api_pipe_auth3_done, req);
770 return req;
771 }
772
773 /* get the header first, then fetch the rest once we have
774 * the frag_length available */
775 max_recv_frag = RPC_HEADER_LEN;
776
777 subreq = cli_api_pipe_send(state, ev, cli->transport,
778 data->data, data->length, max_recv_frag);
779 if (subreq == NULL) {
780 goto fail;
781 }
782 tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
783 return req;
784
785 post_status:
786 tevent_req_nterror(req, status);
787 return tevent_req_post(req, ev);
788 fail:
789 TALLOC_FREE(req);
790 return NULL;
791 }
792
793 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq)
794 {
795 struct tevent_req *req =
796 tevent_req_callback_data(subreq,
797 struct tevent_req);
798 NTSTATUS status;
799
800 status = rpc_write_recv(subreq);
801 TALLOC_FREE(subreq);
802 if (!NT_STATUS_IS_OK(status)) {
803 tevent_req_nterror(req, status);
804 return;
805 }
806
807 tevent_req_done(req);
808 }
809
810 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
811 {
812 struct tevent_req *req = tevent_req_callback_data(
813 subreq, struct tevent_req);
814 struct rpc_api_pipe_state *state = tevent_req_data(
815 req, struct rpc_api_pipe_state);
816 NTSTATUS status;
817 uint8_t *rdata = NULL;
818 uint32_t rdata_len = 0;
819
820 status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
821 TALLOC_FREE(subreq);
822 if (!NT_STATUS_IS_OK(status)) {
823 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
824 tevent_req_nterror(req, status);
825 return;
826 }
827
828 if (rdata == NULL) {
829 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
830 rpccli_pipe_txt(talloc_tos(), state->cli)));
831 tevent_req_done(req);
832 return;
833 }
834
835 /*
836 * Move data on state->incoming_frag.
837 */
838 state->incoming_frag.data = talloc_move(state, &rdata);
839 state->incoming_frag.length = rdata_len;
840 if (!state->incoming_frag.data) {
841 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
842 return;
843 }
844
845 /* Ensure we have enough data for a pdu. */
846 subreq = get_complete_frag_send(state, state->ev, state->cli,
847 &state->incoming_frag);
848 if (tevent_req_nomem(subreq, req)) {
849 return;
850 }
851 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
852 }
853
854 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
855 {
856 struct tevent_req *req = tevent_req_callback_data(
857 subreq, struct tevent_req);
858 struct rpc_api_pipe_state *state = tevent_req_data(
859 req, struct rpc_api_pipe_state);
860 NTSTATUS status;
861 DATA_BLOB rdata = data_blob_null;
862
863 status = get_complete_frag_recv(subreq);
864 TALLOC_FREE(subreq);
865 if (!NT_STATUS_IS_OK(status)) {
866 DEBUG(5, ("get_complete_frag failed: %s\n",
867 nt_errstr(status)));
868 tevent_req_nterror(req, status);
869 return;
870 }
871
872 state->pkt = talloc(state, struct ncacn_packet);
873 if (!state->pkt) {
874 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
875 return;
876 }
877
878 status = dcerpc_pull_ncacn_packet(state->pkt,
879 &state->incoming_frag,
880 state->pkt,
881 !state->endianess);
882 if (!NT_STATUS_IS_OK(status)) {
883 tevent_req_nterror(req, status);
884 return;
885 }
886
887 if (state->incoming_frag.length != state->pkt->frag_length) {
888 DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
889 (unsigned int)state->incoming_frag.length,
890 (unsigned int)state->pkt->frag_length));
891 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
892 return;
893 }
894
895 status = cli_pipe_validate_current_pdu(state,
896 state->cli, state->pkt,
897 &state->incoming_frag,
898 state->expected_pkt_type,
899 state->call_id,
900 &rdata,
901 &state->reply_pdu);
902
903 DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
904 (unsigned)state->incoming_frag.length,
905 (unsigned)state->reply_pdu_offset,
906 nt_errstr(status)));
907
908 if (!NT_STATUS_IS_OK(status)) {
909 tevent_req_nterror(req, status);
910 return;
911 }
912
913 if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
914 && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
915 /*
916 * Set the data type correctly for big-endian data on the
917 * first packet.
918 */
919 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
920 "big-endian.\n",
921 rpccli_pipe_txt(talloc_tos(), state->cli)));
922 state->endianess = 0x00; /* BIG ENDIAN */
923 }
924 /*
925 * Check endianness on subsequent packets.
926 */
927 if (state->endianess != state->pkt->drep[0]) {
928 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
929 "%s\n",
930 state->endianess?"little":"big",
931 state->pkt->drep[0]?"little":"big"));
932 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
933 return;
934 }
935
936 /* Now copy the data portion out of the pdu into rbuf. */
937 if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
938 if (!data_blob_realloc(NULL, &state->reply_pdu,
939 state->reply_pdu_offset + rdata.length)) {
940 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
941 return;
942 }
943 }
944
945 memcpy(state->reply_pdu.data + state->reply_pdu_offset,
946 rdata.data, rdata.length);
947 state->reply_pdu_offset += rdata.length;
948
949 /* reset state->incoming_frag, there is no need to free it,
950 * it will be reallocated to the right size the next time
951 * it is used */
952 state->incoming_frag.length = 0;
953
954 if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
955 /* make sure the pdu length is right now that we
956 * have all the data available (alloc hint may
957 * have allocated more than was actually used) */
958 state->reply_pdu.length = state->reply_pdu_offset;
959 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
960 rpccli_pipe_txt(talloc_tos(), state->cli),
961 (unsigned)state->reply_pdu.length));
962 tevent_req_done(req);
963 return;
964 }
965
966 subreq = get_complete_frag_send(state, state->ev, state->cli,
967 &state->incoming_frag);
968 if (tevent_req_nomem(subreq, req)) {
969 return;
970 }
971 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
972 }
973
974 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
975 struct ncacn_packet **pkt,
976 DATA_BLOB *reply_pdu)
977 {
978 struct rpc_api_pipe_state *state = tevent_req_data(
979 req, struct rpc_api_pipe_state);
980 NTSTATUS status;
981
982 if (tevent_req_is_nterror(req, &status)) {
983 return status;
984 }
985
986 /* return data to caller and assign it ownership of memory */
987 if (reply_pdu) {
988 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
989 reply_pdu->length = state->reply_pdu.length;
990 state->reply_pdu.length = 0;
991 } else {
992 data_blob_free(&state->reply_pdu);
993 }
994
995 if (pkt) {
996 *pkt = talloc_steal(mem_ctx, state->pkt);
997 }
998
999 return NT_STATUS_OK;
1000 }
1001
1002 /*******************************************************************
1003 Creates NTLMSSP auth bind.
1004 ********************************************************************/
1005
1006 static NTSTATUS create_generic_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1007 TALLOC_CTX *mem_ctx,
1008 DATA_BLOB *auth_token)
1009 {
1010 struct gensec_security *gensec_security;
1011 DATA_BLOB null_blob = data_blob_null;
1012
1013 gensec_security = talloc_get_type_abort(cli->auth->auth_ctx,
1014 struct gensec_security);
1015
1016 DEBUG(5, ("create_generic_auth_rpc_bind_req: generate first token\n"));
1017 return gensec_update(gensec_security, mem_ctx, NULL, null_blob, auth_token);
1018 }
1019
1020 /*******************************************************************
1021 Creates schannel auth bind.
1022 ********************************************************************/
1023
1024 static NTSTATUS create_schannel_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1025 DATA_BLOB *auth_token)
1026 {
1027 NTSTATUS status;
1028 struct NL_AUTH_MESSAGE r;
1029
1030 /* Use lp_workgroup() if domain not specified */
1031
1032 if (!cli->auth->domain || !cli->auth->domain[0]) {
1033 cli->auth->domain = talloc_strdup(cli, lp_workgroup());
1034 if (cli->auth->domain == NULL) {
1035 return NT_STATUS_NO_MEMORY;
1036 }
1037 }
1038
1039 /*
1040 * Now marshall the data into the auth parse_struct.
1041 */
1042
1043 r.MessageType = NL_NEGOTIATE_REQUEST;
1044 r.Flags = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
1045 NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
1046 r.oem_netbios_domain.a = cli->auth->domain;
1047 r.oem_netbios_computer.a = lp_netbios_name();
1048
1049 status = dcerpc_push_schannel_bind(cli, &r, auth_token);
1050 if (!NT_STATUS_IS_OK(status)) {
1051 return status;
1052 }
1053
1054 return NT_STATUS_OK;
1055 }
1056
1057 /*******************************************************************
1058 Creates the internals of a DCE/RPC bind request or alter context PDU.
1059 ********************************************************************/
1060
1061 static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
1062 enum dcerpc_pkt_type ptype,
1063 uint32 rpc_call_id,
1064 const struct ndr_syntax_id *abstract,
1065 const struct ndr_syntax_id *transfer,
1066 const DATA_BLOB *auth_info,
1067 DATA_BLOB *blob)
1068 {
1069 uint16 auth_len = auth_info->length;
1070 NTSTATUS status;
1071 union dcerpc_payload u;
1072 struct dcerpc_ctx_list ctx_list;
1073
1074 if (auth_len) {
1075 auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
1076 }
1077
1078 ctx_list.context_id = 0;
1079 ctx_list.num_transfer_syntaxes = 1;
1080 ctx_list.abstract_syntax = *abstract;
1081 ctx_list.transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer);
1082
1083 u.bind.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1084 u.bind.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1085 u.bind.assoc_group_id = 0x0;
1086 u.bind.num_contexts = 1;
1087 u.bind.ctx_list = &ctx_list;
1088 u.bind.auth_info = *auth_info;
1089
1090 status = dcerpc_push_ncacn_packet(mem_ctx,
1091 ptype,
1092 DCERPC_PFC_FLAG_FIRST |
1093 DCERPC_PFC_FLAG_LAST,
1094 auth_len,
1095 rpc_call_id,
1096 &u,
1097 blob);
1098 if (!NT_STATUS_IS_OK(status)) {
1099 DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
1100 return status;
1101 }
1102
1103 return NT_STATUS_OK;
1104 }
1105
1106 /*******************************************************************
1107 Creates a DCE/RPC bind request.
1108 ********************************************************************/
1109
1110 static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
1111 struct rpc_pipe_client *cli,
1112 struct pipe_auth_data *auth,
1113 uint32 rpc_call_id,
1114 const struct ndr_syntax_id *abstract,
1115 const struct ndr_syntax_id *transfer,
1116 DATA_BLOB *rpc_out)
1117 {
1118 DATA_BLOB auth_token = data_blob_null;
1119 DATA_BLOB auth_info = data_blob_null;
1120 NTSTATUS ret = NT_STATUS_OK;
1121
1122 switch (auth->auth_type) {
1123 case DCERPC_AUTH_TYPE_SCHANNEL:
1124 ret = create_schannel_auth_rpc_bind_req(cli, &auth_token);
1125 if (!NT_STATUS_IS_OK(ret)) {
1126 return ret;
1127 }
1128 break;
1129
1130 case DCERPC_AUTH_TYPE_NTLMSSP:
1131 case DCERPC_AUTH_TYPE_KRB5:
1132 case DCERPC_AUTH_TYPE_SPNEGO:
1133 ret = create_generic_auth_rpc_bind_req(cli, mem_ctx, &auth_token);
1134
1135 if (!NT_STATUS_IS_OK(ret) &&
1136 !NT_STATUS_EQUAL(ret, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1137 return ret;
1138 }
1139 break;
1140
1141 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1142 auth_token = data_blob_talloc(mem_ctx,
1143 "NCALRPC_AUTH_TOKEN",
1144 18);
1145 break;
1146
1147 case DCERPC_AUTH_TYPE_NONE:
1148 break;
1149
1150 default:
1151 /* "Can't" happen. */
1152 return NT_STATUS_INVALID_INFO_CLASS;
1153 }
1154
1155 if (auth_token.length != 0) {
1156 ret = dcerpc_push_dcerpc_auth(cli,
1157 auth->auth_type,
1158 auth->auth_level,
1159 0, /* auth_pad_length */
1160 1, /* auth_context_id */
1161 &auth_token,
1162 &auth_info);
1163 if (!NT_STATUS_IS_OK(ret)) {
1164 return ret;
1165 }
1166 data_blob_free(&auth_token);
1167 }
1168
1169 ret = create_bind_or_alt_ctx_internal(mem_ctx,
1170 DCERPC_PKT_BIND,
1171 rpc_call_id,
1172 abstract,
1173 transfer,
1174 &auth_info,
1175 rpc_out);
1176 return ret;
1177 }
1178
1179 /*******************************************************************
1180 External interface.
1181 Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
1182 Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
1183 and deals with signing/sealing details.
1184 ********************************************************************/
1185
1186 struct rpc_api_pipe_req_state {
1187 struct event_context *ev;
1188 struct rpc_pipe_client *cli;
1189 uint8_t op_num;
1190 uint32_t call_id;
1191 DATA_BLOB *req_data;
1192 uint32_t req_data_sent;
1193 DATA_BLOB rpc_out;
1194 DATA_BLOB reply_pdu;
1195 };
1196
1197 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
1198 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
1199 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1200 bool *is_last_frag);
1201
1202 struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
1203 struct event_context *ev,
1204 struct rpc_pipe_client *cli,
1205 uint8_t op_num,
1206 DATA_BLOB *req_data)
1207 {
1208 struct tevent_req *req, *subreq;
1209 struct rpc_api_pipe_req_state *state;
1210 NTSTATUS status;
1211 bool is_last_frag;
1212
1213 req = tevent_req_create(mem_ctx, &state,
1214 struct rpc_api_pipe_req_state);
1215 if (req == NULL) {
1216 return NULL;
1217 }
1218 state->ev = ev;
1219 state->cli = cli;
1220 state->op_num = op_num;
1221 state->req_data = req_data;
1222 state->req_data_sent = 0;
1223 state->call_id = get_rpc_call_id();
1224 state->reply_pdu = data_blob_null;
1225 state->rpc_out = data_blob_null;
1226
1227 if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
1228 + RPC_MAX_SIGN_SIZE) {
1229 /* Server is screwed up ! */
1230 status = NT_STATUS_INVALID_PARAMETER;
1231 goto post_status;
1232 }
1233
1234 status = prepare_next_frag(state, &is_last_frag);
1235 if (!NT_STATUS_IS_OK(status)) {
1236 goto post_status;
1237 }
1238
1239 if (is_last_frag) {
1240 subreq = rpc_api_pipe_send(state, ev, state->cli,
1241 &state->rpc_out,
1242 DCERPC_PKT_RESPONSE,
1243 state->call_id);
1244 if (subreq == NULL) {
1245 goto fail;
1246 }
1247 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1248 } else {
1249 subreq = rpc_write_send(state, ev, cli->transport,
1250 state->rpc_out.data,
1251 state->rpc_out.length);
1252 if (subreq == NULL) {
1253 goto fail;
1254 }
1255 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1256 req);
1257 }
1258 return req;
1259
1260 post_status:
1261 tevent_req_nterror(req, status);
1262 return tevent_req_post(req, ev);
1263 fail:
1264 TALLOC_FREE(req);
1265 return NULL;
1266 }
1267
1268 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1269 bool *is_last_frag)
1270 {
1271 size_t data_sent_thistime;
1272 size_t auth_len;
1273 size_t frag_len;
1274 uint8_t flags = 0;
1275 size_t pad_len;
1276 size_t data_left;
1277 NTSTATUS status;
1278 union dcerpc_payload u;
1279
1280 data_left = state->req_data->length - state->req_data_sent;
1281
1282 status = dcerpc_guess_sizes(state->cli->auth,
1283 DCERPC_REQUEST_LENGTH, data_left,
1284 state->cli->max_xmit_frag,
1285 CLIENT_NDR_PADDING_SIZE,
1286 &data_sent_thistime,
1287 &frag_len, &auth_len, &pad_len);
1288 if (!NT_STATUS_IS_OK(status)) {
1289 return status;
1290 }
1291
1292 if (state->req_data_sent == 0) {
1293 flags = DCERPC_PFC_FLAG_FIRST;
1294 }
1295
1296 if (data_sent_thistime == data_left) {
1297 flags |= DCERPC_PFC_FLAG_LAST;
1298 }
1299
1300 data_blob_free(&state->rpc_out);
1301
1302 ZERO_STRUCT(u.request);
1303
1304 u.request.alloc_hint = state->req_data->length;
1305 u.request.context_id = 0;
1306 u.request.opnum = state->op_num;
1307
1308 status = dcerpc_push_ncacn_packet(state,
1309 DCERPC_PKT_REQUEST,
1310 flags,
1311 auth_len,
1312 state->call_id,
1313 &u,
1314 &state->rpc_out);
1315 if (!NT_STATUS_IS_OK(status)) {
1316 return status;
1317 }
1318
1319 /* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
1320 * compute it right for requests because the auth trailer is missing
1321 * at this stage */
1322 dcerpc_set_frag_length(&state->rpc_out, frag_len);
1323
1324 /* Copy in the data. */
1325 if (!data_blob_append(NULL, &state->rpc_out,
1326 state->req_data->data + state->req_data_sent,
1327 data_sent_thistime)) {
1328 return NT_STATUS_NO_MEMORY;
1329 }
1330
1331 switch (state->cli->auth->auth_level) {
1332 case DCERPC_AUTH_LEVEL_NONE:
1333 case DCERPC_AUTH_LEVEL_CONNECT:
1334 case DCERPC_AUTH_LEVEL_PACKET:
1335 break;
1336 case DCERPC_AUTH_LEVEL_INTEGRITY:
1337 case DCERPC_AUTH_LEVEL_PRIVACY:
1338 status = dcerpc_add_auth_footer(state->cli->auth, pad_len,
1339 &state->rpc_out);
1340 if (!NT_STATUS_IS_OK(status)) {
1341 return status;
1342 }
1343 break;
1344 default:
1345 return NT_STATUS_INVALID_PARAMETER;
1346 }
1347
1348 state->req_data_sent += data_sent_thistime;
1349 *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
1350
1351 return status;
1352 }
1353
1354 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
1355 {
1356 struct tevent_req *req = tevent_req_callback_data(
1357 subreq, struct tevent_req);
1358 struct rpc_api_pipe_req_state *state = tevent_req_data(
1359 req, struct rpc_api_pipe_req_state);
1360 NTSTATUS status;
1361 bool is_last_frag;
1362
1363 status = rpc_write_recv(subreq);
1364 TALLOC_FREE(subreq);
1365 if (!NT_STATUS_IS_OK(status)) {
1366 tevent_req_nterror(req, status);
1367 return;
1368 }
1369
1370 status = prepare_next_frag(state, &is_last_frag);
1371 if (!NT_STATUS_IS_OK(status)) {
1372 tevent_req_nterror(req, status);
1373 return;
1374 }
1375
1376 if (is_last_frag) {
1377 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1378 &state->rpc_out,
1379 DCERPC_PKT_RESPONSE,
1380 state->call_id);
1381 if (tevent_req_nomem(subreq, req)) {
1382 return;
1383 }
1384 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1385 } else {
1386 subreq = rpc_write_send(state, state->ev,
1387 state->cli->transport,
1388 state->rpc_out.data,
1389 state->rpc_out.length);
1390 if (tevent_req_nomem(subreq, req)) {
1391 return;
1392 }
1393 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1394 req);
1395 }
1396 }
1397
1398 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
1399 {
1400 struct tevent_req *req = tevent_req_callback_data(
1401 subreq, struct tevent_req);
1402 struct rpc_api_pipe_req_state *state = tevent_req_data(
1403 req, struct rpc_api_pipe_req_state);
1404 NTSTATUS status;
1405
1406 status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
1407 TALLOC_FREE(subreq);
1408 if (!NT_STATUS_IS_OK(status)) {
1409 tevent_req_nterror(req, status);
1410 return;
1411 }
1412 tevent_req_done(req);
1413 }
1414
1415 NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1416 DATA_BLOB *reply_pdu)
1417 {
1418 struct rpc_api_pipe_req_state *state = tevent_req_data(
1419 req, struct rpc_api_pipe_req_state);
1420 NTSTATUS status;
1421
1422 if (tevent_req_is_nterror(req, &status)) {
1423 /*
1424 * We always have to initialize to reply pdu, even if there is
1425 * none. The rpccli_* caller routines expect this.
1426 */
1427 *reply_pdu = data_blob_null;
1428 return status;
1429 }
1430
1431 /* return data to caller and assign it ownership of memory */
1432 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1433 reply_pdu->length = state->reply_pdu.length;
1434 state->reply_pdu.length = 0;
1435
1436 return NT_STATUS_OK;
1437 }
1438
1439 /****************************************************************************
1440 Check the rpc bind acknowledge response.
1441 ****************************************************************************/
1442
1443 static bool check_bind_response(const struct dcerpc_bind_ack *r,
1444 const struct ndr_syntax_id *transfer)
1445 {
1446 struct dcerpc_ack_ctx ctx;
1447
1448 if (r->secondary_address_size == 0) {
1449 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
1450 }
1451
1452 if (r->num_results < 1 || !r->ctx_list) {
1453 return false;
1454 }
1455
1456 ctx = r->ctx_list[0];
1457
1458 /* check the transfer syntax */
1459 if ((ctx.syntax.if_version != transfer->if_version) ||
1460 (memcmp(&ctx.syntax.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1461 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1462 return False;
1463 }
1464
1465 if (r->num_results != 0x1 || ctx.result != 0) {
1466 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1467 r->num_results, ctx.reason));
1468 }
1469
1470 DEBUG(5,("check_bind_response: accepted!\n"));
1471 return True;
1472 }
1473
1474 /*******************************************************************
1475 Creates a DCE/RPC bind authentication response.
1476 This is the packet that is sent back to the server once we
1477 have received a BIND-ACK, to finish the third leg of
1478 the authentication handshake.
1479 ********************************************************************/
1480
1481 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
1482 struct rpc_pipe_client *cli,
1483 uint32 rpc_call_id,
1484 enum dcerpc_AuthType auth_type,
1485 enum dcerpc_AuthLevel auth_level,
1486 DATA_BLOB *pauth_blob,
1487 DATA_BLOB *rpc_out)
1488 {
1489 NTSTATUS status;
1490 union dcerpc_payload u;
1491
1492 u.auth3._pad = 0;
1493
1494 status = dcerpc_push_dcerpc_auth(mem_ctx,
1495 auth_type,
1496 auth_level,
1497 0, /* auth_pad_length */
1498 1, /* auth_context_id */
1499 pauth_blob,
1500 &u.auth3.auth_info);
1501 if (!NT_STATUS_IS_OK(status)) {
1502 return status;
1503 }
1504
1505 status = dcerpc_push_ncacn_packet(mem_ctx,
1506 DCERPC_PKT_AUTH3,
1507 DCERPC_PFC_FLAG_FIRST |
1508 DCERPC_PFC_FLAG_LAST,
1509 pauth_blob->length,
1510 rpc_call_id,
1511 &u,
1512 rpc_out);
1513 data_blob_free(&u.auth3.auth_info);
1514 if (!NT_STATUS_IS_OK(status)) {
1515 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1516 return status;
1517 }
1518
1519 return NT_STATUS_OK;
1520 }
1521
1522 /*******************************************************************
1523 Creates a DCE/RPC bind alter context authentication request which
1524 may contain a spnego auth blobl
1525 ********************************************************************/
1526
1527 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
1528 enum dcerpc_AuthType auth_type,
1529 enum dcerpc_AuthLevel auth_level,
1530 uint32 rpc_call_id,
1531 const struct ndr_syntax_id *abstract,
1532 const struct ndr_syntax_id *transfer,
1533 const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
1534 DATA_BLOB *rpc_out)
1535 {
1536 DATA_BLOB auth_info;
1537 NTSTATUS status;
1538
1539 status = dcerpc_push_dcerpc_auth(mem_ctx,
1540 auth_type,
1541 auth_level,
1542 0, /* auth_pad_length */
1543 1, /* auth_context_id */
1544 pauth_blob,
1545 &auth_info);
1546 if (!NT_STATUS_IS_OK(status)) {
1547 return status;
1548 }
1549
1550 status = create_bind_or_alt_ctx_internal(mem_ctx,
1551 DCERPC_PKT_ALTER,
1552 rpc_call_id,
1553 abstract,
1554 transfer,
1555 &auth_info,
1556 rpc_out);
1557 data_blob_free(&auth_info);
1558 return status;
1559 }
1560
1561 /****************************************************************************
1562 Do an rpc bind.
1563 ****************************************************************************/
1564
1565 struct rpc_pipe_bind_state {
1566 struct event_context *ev;
1567 struct rpc_pipe_client *cli;
1568 DATA_BLOB rpc_out;
1569 bool auth3;
1570 uint32_t rpc_call_id;
1571 struct netr_Authenticator auth;
1572 struct netr_Authenticator return_auth;
1573 struct netlogon_creds_CredentialState *creds;
1574 union netr_Capabilities capabilities;
1575 struct netr_LogonGetCapabilities r;
1576 };
1577
1578 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
1579 static void rpc_pipe_bind_step_two_trigger(struct tevent_req *req);
1580 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1581 struct rpc_pipe_bind_state *state,
1582 DATA_BLOB *credentials);
1583 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1584 struct rpc_pipe_bind_state *state,
1585 DATA_BLOB *credentials);
1586
1587 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
1588 struct event_context *ev,
1589 struct rpc_pipe_client *cli,
1590 struct pipe_auth_data *auth)
1591 {
1592 struct tevent_req *req, *subreq;
1593 struct rpc_pipe_bind_state *state;
1594 NTSTATUS status;
1595
1596 req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
1597 if (req == NULL) {
1598 return NULL;
1599 }
1600
1601 DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
1602 rpccli_pipe_txt(talloc_tos(), cli),
1603 (unsigned int)auth->auth_type,
1604 (unsigned int)auth->auth_level ));
1605
1606 state->ev = ev;
1607 state->cli = cli;
1608 state->rpc_call_id = get_rpc_call_id();
1609
1610 cli->auth = talloc_move(cli, &auth);
1611
1612 /* Marshall the outgoing data. */
1613 status = create_rpc_bind_req(state, cli,
1614 cli->auth,
1615 state->rpc_call_id,
1616 &cli->abstract_syntax,
1617 &cli->transfer_syntax,
1618 &state->rpc_out);
1619
1620 if (!NT_STATUS_IS_OK(status) &&
1621 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1622 goto post_status;
1623 }
1624
1625 subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
1626 DCERPC_PKT_BIND_ACK, state->rpc_call_id);
1627 if (subreq == NULL) {
1628 goto fail;
1629 }
1630 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1631 return req;
1632
1633 post_status:
1634 tevent_req_nterror(req, status);
1635 return tevent_req_post(req, ev);
1636 fail:
1637 TALLOC_FREE(req);
1638 return NULL;
1639 }
1640
1641 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
1642 {
1643 struct tevent_req *req = tevent_req_callback_data(
1644 subreq, struct tevent_req);
1645 struct rpc_pipe_bind_state *state = tevent_req_data(
1646 req, struct rpc_pipe_bind_state);
1647 struct pipe_auth_data *pauth = state->cli->auth;
1648 struct gensec_security *gensec_security;
1649 struct ncacn_packet *pkt = NULL;
1650 struct dcerpc_auth auth;
1651 DATA_BLOB auth_token = data_blob_null;
1652 NTSTATUS status;
1653
1654 status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
1655 TALLOC_FREE(subreq);
1656 if (!NT_STATUS_IS_OK(status)) {
1657 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
1658 rpccli_pipe_txt(talloc_tos(), state->cli),
1659 nt_errstr(status)));
1660 tevent_req_nterror(req, status);
1661 return;
1662 }
1663
1664 if (state->auth3) {
1665 tevent_req_done(req);
1666 return;
1667 }
1668
1669 if (!check_bind_response(&pkt->u.bind_ack, &state->cli->transfer_syntax)) {
1670 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
1671 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1672 return;
1673 }
1674
1675 state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
1676 state->cli->max_recv_frag = pkt->u.bind_ack.max_recv_frag;
1677
1678 switch(pauth->auth_type) {
1679
1680 case DCERPC_AUTH_TYPE_NONE:
1681 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1682 /* Bind complete. */
1683 tevent_req_done(req);
1684 return;
1685
1686 case DCERPC_AUTH_TYPE_SCHANNEL:
1687 rpc_pipe_bind_step_two_trigger(req);
1688 return;
1689
1690 case DCERPC_AUTH_TYPE_NTLMSSP:
1691 case DCERPC_AUTH_TYPE_SPNEGO:
1692 case DCERPC_AUTH_TYPE_KRB5:
1693 /* Paranoid lenght checks */
1694 if (pkt->frag_length < DCERPC_AUTH_TRAILER_LENGTH
1695 + pkt->auth_length) {
1696 tevent_req_nterror(req,
1697 NT_STATUS_INFO_LENGTH_MISMATCH);
1698 return;
1699 }
1700 /* get auth credentials */
1701 status = dcerpc_pull_dcerpc_auth(talloc_tos(),
1702 &pkt->u.bind_ack.auth_info,
1703 &auth, false);
1704 if (!NT_STATUS_IS_OK(status)) {
1705 DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
1706 nt_errstr(status)));
1707 tevent_req_nterror(req, status);
1708 return;
1709 }
1710 break;
1711
1712 default:
1713 goto err_out;
1714 }
1715
1716 /*
1717 * For authenticated binds we may need to do 3 or 4 leg binds.
1718 */
1719
1720 switch(pauth->auth_type) {
1721
1722 case DCERPC_AUTH_TYPE_NONE:
1723 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1724 case DCERPC_AUTH_TYPE_SCHANNEL:
1725 /* Bind complete. */
1726 tevent_req_done(req);
1727 return;
1728
1729 case DCERPC_AUTH_TYPE_NTLMSSP:
1730 case DCERPC_AUTH_TYPE_KRB5:
1731 case DCERPC_AUTH_TYPE_SPNEGO:
1732 gensec_security = talloc_get_type_abort(pauth->auth_ctx,
1733 struct gensec_security);
1734 status = gensec_update(gensec_security, state, NULL,
1735 auth.credentials, &auth_token);
1736 if (NT_STATUS_EQUAL(status,
1737 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1738 status = rpc_bind_next_send(req, state,
1739 &auth_token);
1740 } else if (NT_STATUS_IS_OK(status)) {
1741 if (auth_token.length == 0) {
1742 /* Bind complete. */
1743 tevent_req_done(req);
1744 return;
1745 }
1746 status = rpc_bind_finish_send(req, state,
1747 &auth_token);
1748 }
1749 break;
1750
1751 default:
1752 goto err_out;
1753 }
1754
1755 if (!NT_STATUS_IS_OK(status)) {
1756 tevent_req_nterror(req, status);
1757 }
1758 return;
1759
1760 err_out:
1761 DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
1762 (unsigned int)state->cli->auth->auth_type));
1763 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
1764 }
1765
1766 static void rpc_pipe_bind_step_two_done(struct tevent_req *subreq);
1767
1768 static void rpc_pipe_bind_step_two_trigger(struct tevent_req *req)
1769 {
1770 struct rpc_pipe_bind_state *state =
1771 tevent_req_data(req,
1772 struct rpc_pipe_bind_state);
1773 struct dcerpc_binding_handle *b = state->cli->binding_handle;
1774 struct schannel_state *schannel_auth =
1775 talloc_get_type_abort(state->cli->auth->auth_ctx,
1776 struct schannel_state);
1777 struct tevent_req *subreq;
1778
1779 if (schannel_auth == NULL ||
1780 !ndr_syntax_id_equal(&state->cli->abstract_syntax,
1781 &ndr_table_netlogon.syntax_id)) {
1782 tevent_req_done(req);
1783 return;
1784 }
1785
1786 ZERO_STRUCT(state->return_auth);
1787
1788 state->creds = netlogon_creds_copy(state, schannel_auth->creds);
1789 if (state->creds == NULL) {
1790 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1791 return;
1792 }
1793
1794 netlogon_creds_client_authenticator(state->creds, &state->auth);
1795
1796 state->r.in.server_name = state->cli->srv_name_slash;
1797 state->r.in.computer_name = state->creds->computer_name;
1798 state->r.in.credential = &state->auth;
1799 state->r.in.query_level = 1;
1800 state->r.in.return_authenticator = &state->return_auth;
1801
1802 state->r.out.capabilities = &state->capabilities;
1803 state->r.out.return_authenticator = &state->return_auth;
1804
1805 subreq = dcerpc_netr_LogonGetCapabilities_r_send(talloc_tos(),
1806 state->ev,
1807 b,
1808 &state->r);
1809 if (subreq == NULL) {
1810 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1811 return;
1812 }
1813
1814 tevent_req_set_callback(subreq, rpc_pipe_bind_step_two_done, req);
1815 return;
1816 }
1817
1818 static void rpc_pipe_bind_step_two_done(struct tevent_req *subreq)
1819 {
1820 struct tevent_req *req =
1821 tevent_req_callback_data(subreq,
1822 struct tevent_req);
1823 struct rpc_pipe_bind_state *state =
1824 tevent_req_data(req,
1825 struct rpc_pipe_bind_state);
1826 NTSTATUS status;
1827
1828 status = dcerpc_netr_LogonGetCapabilities_r_recv(subreq, talloc_tos());
1829 TALLOC_FREE(subreq);
1830 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
1831 if (state->cli->dc && state->cli->dc->negotiate_flags &
1832 NETLOGON_NEG_SUPPORTS_AES) {
1833 DEBUG(5, ("AES is not supported and the error was %s\n",
1834 nt_errstr(status)));
1835 tevent_req_nterror(req,
1836 NT_STATUS_INVALID_NETWORK_RESPONSE);
1837 return;
1838 }
1839
1840 /* This is probably NT */
1841 DEBUG(5, ("We are checking against an NT - %s\n",
1842 nt_errstr(status)));
1843 tevent_req_done(req);
1844 return;
1845 } else if (!NT_STATUS_IS_OK(status)) {
1846 DEBUG(0, ("dcerpc_netr_LogonGetCapabilities_r_recv failed with %s\n",
1847 nt_errstr(status)));
1848 tevent_req_nterror(req, status);
1849 return;
1850 }
1851
1852 if (NT_STATUS_EQUAL(state->r.out.result, NT_STATUS_NOT_IMPLEMENTED)) {
1853 if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
1854 /* This means AES isn't supported. */
1855 DEBUG(5, ("AES is not supported and the error was %s\n",
1856 nt_errstr(state->r.out.result)));
1857 tevent_req_nterror(req,
1858 NT_STATUS_INVALID_NETWORK_RESPONSE);
1859 return;
1860 }
1861
1862 /* This is probably an old Samba version */
1863 DEBUG(5, ("We are checking against an old Samba version - %s\n",
1864 nt_errstr(state->r.out.result)));
1865 tevent_req_done(req);
1866 return;
1867 }
1868
1869 /* We need to check the credential state here, cause win2k3 and earlier
1870 * returns NT_STATUS_NOT_IMPLEMENTED */
1871 if (!netlogon_creds_client_check(state->creds,
1872 &state->r.out.return_authenticator->cred)) {
1873 /*
1874 * Server replied with bad credential. Fail.
1875 */
1876 DEBUG(0,("rpc_pipe_bind_step_two_done: server %s "
1877 "replied with bad credential\n",
1878 state->cli->desthost));
1879 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1880 return;
1881 }
1882
1883 TALLOC_FREE(state->cli->dc);
1884 state->cli->dc = talloc_steal(state->cli, state->creds);
1885
1886 if (!NT_STATUS_IS_OK(state->r.out.result)) {
1887 DEBUG(0, ("dcerpc_netr_LogonGetCapabilities_r_recv failed with %s\n",
1888 nt_errstr(state->r.out.result)));
1889 tevent_req_nterror(req, state->r.out.result);
1890 return;
1891 }
1892
1893 if (state->creds->negotiate_flags !=
1894 state->r.out.capabilities->server_capabilities) {
1895 DEBUG(0, ("The client capabilities don't match the server "
1896 "capabilities: local[0x%08X] remote[0x%08X]\n",
1897 state->creds->negotiate_flags,
1898 state->capabilities.server_capabilities));
1899 tevent_req_nterror(req,
1900 NT_STATUS_INVALID_NETWORK_RESPONSE);
1901 return;
1902 }
1903
1904 /* TODO: Add downgrade dectection. */
1905
1906 tevent_req_done(req);
1907 return;
1908 }
1909
1910 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1911 struct rpc_pipe_bind_state *state,
1912 DATA_BLOB *auth_token)
1913 {
1914 struct pipe_auth_data *auth = state->cli->auth;
1915 struct tevent_req *subreq;
1916 NTSTATUS status;
1917
1918 /* Now prepare the alter context pdu. */
1919 data_blob_free(&state->rpc_out);
1920
1921 status = create_rpc_alter_context(state,
1922 auth->auth_type,
1923 auth->auth_level,
1924 state->rpc_call_id,
1925 &state->cli->abstract_syntax,
1926 &state->cli->transfer_syntax,
1927 auth_token,
1928 &state->rpc_out);
1929 if (!NT_STATUS_IS_OK(status)) {
1930 return status;
1931 }
1932
1933 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1934 &state->rpc_out, DCERPC_PKT_ALTER_RESP,
1935 state->rpc_call_id);
1936 if (subreq == NULL) {
1937 return NT_STATUS_NO_MEMORY;
1938 }
1939 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1940 return NT_STATUS_OK;
1941 }
1942
1943 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1944 struct rpc_pipe_bind_state *state,
1945 DATA_BLOB *auth_token)
1946 {
1947 struct pipe_auth_data *auth = state->cli->auth;
1948 struct tevent_req *subreq;
1949 NTSTATUS status;
1950
1951 state->auth3 = true;
1952
1953 /* Now prepare the auth3 context pdu. */
1954 data_blob_free(&state->rpc_out);
1955
1956 status = create_rpc_bind_auth3(state, state->cli,
1957 state->rpc_call_id,
1958 auth->auth_type,
1959 auth->auth_level,
1960 auth_token,
1961 &state->rpc_out);
1962 if (!NT_STATUS_IS_OK(status)) {
1963 return status;
1964 }
1965
1966 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1967 &state->rpc_out, DCERPC_PKT_AUTH3,
1968 state->rpc_call_id);
1969 if (subreq == NULL) {
1970 return NT_STATUS_NO_MEMORY;
1971 }
1972 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1973 return NT_STATUS_OK;
1974 }
1975
1976 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
1977 {
1978 return tevent_req_simple_recv_ntstatus(req);
1979 }
1980
1981 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
1982 struct pipe_auth_data *auth)
1983 {
1984 TALLOC_CTX *frame = talloc_stackframe();
1985 struct event_context *ev;
1986 struct tevent_req *req;
1987 NTSTATUS status = NT_STATUS_OK;
1988
1989 ev = event_context_init(frame);
1990 if (ev == NULL) {
1991 status = NT_STATUS_NO_MEMORY;
1992 goto fail;
1993 }
1994
1995 req = rpc_pipe_bind_send(frame, ev, cli, auth);
1996 if (req == NULL) {
1997 status = NT_STATUS_NO_MEMORY;
1998 goto fail;
1999 }
2000
2001 if (!tevent_req_poll(req, ev)) {
2002 status = map_nt_error_from_unix(errno);
2003 goto fail;
2004 }
2005
2006 status = rpc_pipe_bind_recv(req);
2007 fail:
2008 TALLOC_FREE(frame);
2009 return status;
2010 }
2011
2012 #define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */
2013
2014 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
2015 unsigned int timeout)
2016 {
2017 unsigned int old;
2018
2019 if (rpc_cli->transport == NULL) {
2020 return RPCCLI_DEFAULT_TIMEOUT;
2021 }
2022
2023 if (rpc_cli->transport->set_timeout == NULL) {
2024 return RPCCLI_DEFAULT_TIMEOUT;
2025 }
2026
2027 old = rpc_cli->transport->set_timeout(rpc_cli->transport->priv, timeout);
2028 if (old == 0) {
2029 return RPCCLI_DEFAULT_TIMEOUT;
2030 }
2031
2032 return old;
2033 }
2034
2035 bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
2036 {
2037 if (rpc_cli == NULL) {
2038 return false;
2039 }
2040
2041 if (rpc_cli->transport == NULL) {
2042 return false;
2043 }
2044
2045 return rpc_cli->transport->is_connected(rpc_cli->transport->priv);
2046 }
2047
2048 struct rpccli_bh_state {
2049 struct rpc_pipe_client *rpc_cli;
2050 };
2051
2052 static bool rpccli_bh_is_connected(struct dcerpc_binding_handle *h)
2053 {
2054 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2055 struct rpccli_bh_state);
2056
2057 return rpccli_is_connected(hs->rpc_cli);
2058 }
2059
2060 static uint32_t rpccli_bh_set_timeout(struct dcerpc_binding_handle *h,
2061 uint32_t timeout)
2062 {
2063 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2064 struct rpccli_bh_state);
2065
2066 return rpccli_set_timeout(hs->rpc_cli, timeout);
2067 }
2068
2069 struct rpccli_bh_raw_call_state {
2070 DATA_BLOB in_data;
2071 DATA_BLOB out_data;
2072 uint32_t out_flags;
2073 };
2074
2075 static void rpccli_bh_raw_call_done(struct tevent_req *subreq);
2076
2077 static struct tevent_req *rpccli_bh_raw_call_send(TALLOC_CTX *mem_ctx,
2078 struct tevent_context *ev,
2079 struct dcerpc_binding_handle *h,
2080 const struct GUID *object,
2081 uint32_t opnum,
2082 uint32_t in_flags,
2083 const uint8_t *in_data,
2084 size_t in_length)
2085 {
2086 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2087 struct rpccli_bh_state);
2088 struct tevent_req *req;
2089 struct rpccli_bh_raw_call_state *state;
2090 bool ok;
2091 struct tevent_req *subreq;
2092
2093 req = tevent_req_create(mem_ctx, &state,
2094 struct rpccli_bh_raw_call_state);
2095 if (req == NULL) {
2096 return NULL;
2097 }
2098 state->in_data.data = discard_const_p(uint8_t, in_data);
2099 state->in_data.length = in_length;
2100
2101 ok = rpccli_bh_is_connected(h);
2102 if (!ok) {
2103 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2104 return tevent_req_post(req, ev);
2105 }
2106
2107 subreq = rpc_api_pipe_req_send(state, ev, hs->rpc_cli,
2108 opnum, &state->in_data);
2109 if (tevent_req_nomem(subreq, req)) {
2110 return tevent_req_post(req, ev);
2111 }
2112 tevent_req_set_callback(subreq, rpccli_bh_raw_call_done, req);
2113
2114 return req;
2115 }
2116
2117 static void rpccli_bh_raw_call_done(struct tevent_req *subreq)
2118 {
2119 struct tevent_req *req =
2120 tevent_req_callback_data(subreq,
2121 struct tevent_req);
2122 struct rpccli_bh_raw_call_state *state =
2123 tevent_req_data(req,
2124 struct rpccli_bh_raw_call_state);
2125 NTSTATUS status;
2126
2127 state->out_flags = 0;
2128
2129 /* TODO: support bigendian responses */
2130
2131 status = rpc_api_pipe_req_recv(subreq, state, &state->out_data);
2132 TALLOC_FREE(subreq);
2133 if (!NT_STATUS_IS_OK(status)) {
2134 tevent_req_nterror(req, status);
2135 return;
2136 }
2137
2138 tevent_req_done(req);
2139 }
2140
2141 static NTSTATUS rpccli_bh_raw_call_recv(struct tevent_req *req,
2142 TALLOC_CTX *mem_ctx,
2143 uint8_t **out_data,
2144 size_t *out_length,
2145 uint32_t *out_flags)
2146 {
2147 struct rpccli_bh_raw_call_state *state =
2148 tevent_req_data(req,
2149 struct rpccli_bh_raw_call_state);
2150 NTSTATUS status;
2151
2152 if (tevent_req_is_nterror(req, &status)) {
2153 tevent_req_received(req);
2154 return status;
2155 }
2156
2157 *out_data = talloc_move(mem_ctx, &state->out_data.data);
2158 *out_length = state->out_data.length;
2159 *out_flags = state->out_flags;
2160 tevent_req_received(req);
2161 return NT_STATUS_OK;
2162 }
2163
2164 struct rpccli_bh_disconnect_state {
2165 uint8_t _dummy;
2166 };
2167
2168 static struct tevent_req *rpccli_bh_disconnect_send(TALLOC_CTX *mem_ctx,
2169 struct tevent_context *ev,
2170 struct dcerpc_binding_handle *h)
2171 {
2172 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2173 struct rpccli_bh_state);
2174 struct tevent_req *req;
2175 struct rpccli_bh_disconnect_state *state;
2176 bool ok;
2177
2178 req = tevent_req_create(mem_ctx, &state,
2179 struct rpccli_bh_disconnect_state);
2180 if (req == NULL) {
2181 return NULL;
2182 }
2183
2184 ok = rpccli_bh_is_connected(h);
2185 if (!ok) {
2186 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2187 return tevent_req_post(req, ev);
2188 }
2189
2190 /*
2191 * TODO: do a real async disconnect ...
2192 *
2193 * For now the caller needs to free rpc_cli
2194 */
2195 hs->rpc_cli = NULL;
2196
2197 tevent_req_done(req);
2198 return tevent_req_post(req, ev);
2199 }
2200
2201 static NTSTATUS rpccli_bh_disconnect_recv(struct tevent_req *req)
2202 {
2203 NTSTATUS status;
2204
2205 if (tevent_req_is_nterror(req, &status)) {
2206 tevent_req_received(req);
2207 return status;
2208 }
2209
2210 tevent_req_received(req);
2211 return NT_STATUS_OK;
2212 }
2213
2214 static bool rpccli_bh_ref_alloc(struct dcerpc_binding_handle *h)
2215 {
2216 return true;
2217 }
2218
2219 static void rpccli_bh_do_ndr_print(struct dcerpc_binding_handle *h,
2220 int ndr_flags,
2221 const void *_struct_ptr,
2222 const struct ndr_interface_call *call)
2223 {
2224 void *struct_ptr = discard_const(_struct_ptr);
2225
2226 if (DEBUGLEVEL < 10) {
2227 return;
2228 }
2229
2230 if (ndr_flags & NDR_IN) {
2231 ndr_print_function_debug(call->ndr_print,
2232 call->name,
2233 ndr_flags,
2234 struct_ptr);
2235 }
2236 if (ndr_flags & NDR_OUT) {
2237 ndr_print_function_debug(call->ndr_print,
2238 call->name,
2239 ndr_flags,
2240 struct_ptr);
2241 }
2242 }
2243
2244 static const struct dcerpc_binding_handle_ops rpccli_bh_ops = {
2245 .name = "rpccli",
2246 .is_connected = rpccli_bh_is_connected,
2247 .set_timeout = rpccli_bh_set_timeout,
2248 .raw_call_send = rpccli_bh_raw_call_send,
2249 .raw_call_recv = rpccli_bh_raw_call_recv,
2250 .disconnect_send = rpccli_bh_disconnect_send,
2251 .disconnect_recv = rpccli_bh_disconnect_recv,
2252
2253 .ref_alloc = rpccli_bh_ref_alloc,
2254 .do_ndr_print = rpccli_bh_do_ndr_print,
2255 };
2256
2257 /* initialise a rpc_pipe_client binding handle */
2258 struct dcerpc_binding_handle *rpccli_bh_create(struct rpc_pipe_client *c)
2259 {
2260 struct dcerpc_binding_handle *h;
2261 struct rpccli_bh_state *hs;
2262
2263 h = dcerpc_binding_handle_create(c,
2264 &rpccli_bh_ops,
2265 NULL,
2266 NULL, /* TODO */
2267 &hs,
2268 struct rpccli_bh_state,
2269 __location__);
2270 if (h == NULL) {
2271 return NULL;
2272 }
2273 hs->rpc_cli = c;
2274
2275 return h;
2276 }
2277
2278 NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx,
2279 struct pipe_auth_data **presult)
2280 {
2281 struct pipe_auth_data *result;
2282
2283 result = talloc(mem_ctx, struct pipe_auth_data);
2284 if (result == NULL) {
2285 return NT_STATUS_NO_MEMORY;
2286 }
2287
2288 result->auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
2289 result->auth_level = DCERPC_AUTH_LEVEL_CONNECT;
2290
2291 result->user_name = talloc_strdup(result, "");
2292 result->domain = talloc_strdup(result, "");
2293 if ((result->user_name == NULL) || (result->domain == NULL)) {
2294 TALLOC_FREE(result);
2295 return NT_STATUS_NO_MEMORY;
2296 }
2297
2298 *presult = result;
2299 return NT_STATUS_OK;
2300 }
2301
2302 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2303 struct pipe_auth_data **presult)
2304 {
2305 struct pipe_auth_data *result;
2306
2307 result = talloc(mem_ctx, struct pipe_auth_data);
2308 if (result == NULL) {
2309 return NT_STATUS_NO_MEMORY;
2310 }
2311
2312 result->auth_type = DCERPC_AUTH_TYPE_NONE;
2313 result->auth_level = DCERPC_AUTH_LEVEL_NONE;
2314
2315 result->user_name = talloc_strdup(result, "");
2316 result->domain = talloc_strdup(result, "");
2317 if ((result->user_name == NULL) || (result->domain == NULL)) {
2318 TALLOC_FREE(result);
2319 return NT_STATUS_NO_MEMORY;
2320 }
2321
2322 *presult = result;
2323 return NT_STATUS_OK;
2324 }
2325
2326 static NTSTATUS rpccli_generic_bind_data(TALLOC_CTX *mem_ctx,
2327 enum dcerpc_AuthType auth_type,
2328 enum dcerpc_AuthLevel auth_level,
2329 const char *server,
2330 const char *target_service,
2331 const char *domain,
2332 const char *username,
2333 const char *password,
2334 enum credentials_use_kerberos use_kerberos,
2335 struct pipe_auth_data **presult)
2336 {
2337 struct auth_generic_state *auth_generic_ctx;
2338 struct pipe_auth_data *result;
2339 NTSTATUS status;
2340
2341 result = talloc(mem_ctx, struct pipe_auth_data);
2342 if (result == NULL) {
2343 return NT_STATUS_NO_MEMORY;
2344 }
2345
2346 result->auth_type = auth_type;
2347 result->auth_level = auth_level;
2348
2349 result->user_name = talloc_strdup(result, username);
2350 result->domain = talloc_strdup(result, domain);
2351 if ((result->user_name == NULL) || (result->domain == NULL)) {
2352 status = NT_STATUS_NO_MEMORY;
2353 goto fail;
2354 }
2355
2356 status = auth_generic_client_prepare(result,
2357 &auth_generic_ctx);
2358 if (!NT_STATUS_IS_OK(status)) {
2359 goto fail;
2360 }
2361
2362 status = auth_generic_set_username(auth_generic_ctx, username);
2363 if (!NT_STATUS_IS_OK(status)) {
2364 goto fail;
2365 }
2366
2367 status = auth_generic_set_domain(auth_generic_ctx, domain);
2368 if (!NT_STATUS_IS_OK(status)) {
2369 goto fail;
2370 }
2371
2372 status = auth_generic_set_password(auth_generic_ctx, password);
2373 if (!NT_STATUS_IS_OK(status)) {
2374 goto fail;
2375 }
2376
2377 status = gensec_set_target_service(auth_generic_ctx->gensec_security, target_service);
2378 if (!NT_STATUS_IS_OK(status)) {
2379 goto fail;
2380 }
2381
2382 status = gensec_set_target_hostname(auth_generic_ctx->gensec_security, server);
2383 if (!NT_STATUS_IS_OK(status)) {
2384 goto fail;
2385 }
2386
2387 cli_credentials_set_kerberos_state(auth_generic_ctx->credentials, use_kerberos);
2388
2389 status = auth_generic_client_start_by_authtype(auth_generic_ctx, auth_type, auth_level);
2390 if (!NT_STATUS_IS_OK(status)) {
2391 goto fail;
2392 }
2393
2394 result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2395 talloc_free(auth_generic_ctx);
2396 *presult = result;
2397 return NT_STATUS_OK;
2398
2399 fail:
2400 TALLOC_FREE(result);
2401 return status;
2402 }
2403
2404 NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
2405 enum dcerpc_AuthLevel auth_level,
2406 struct netlogon_creds_CredentialState *creds,
2407 struct pipe_auth_data **presult)
2408 {
2409 struct schannel_state *schannel_auth;
2410 struct pipe_auth_data *result;
2411
2412 result = talloc(mem_ctx, struct pipe_auth_data);
2413 if (result == NULL) {
2414 return NT_STATUS_NO_MEMORY;
2415 }
2416
2417 result->auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
2418 result->auth_level = auth_level;
2419
2420 result->user_name = talloc_strdup(result, "");
2421 result->domain = talloc_strdup(result, domain);
2422 if ((result->user_name == NULL) || (result->domain == NULL)) {
2423 goto fail;
2424 }
2425
2426 schannel_auth = talloc_zero(result, struct schannel_state);
2427 if (schannel_auth == NULL) {
2428 goto fail;
2429 }
2430
2431 schannel_auth->state = SCHANNEL_STATE_START;
2432 schannel_auth->initiator = true;
2433 schannel_auth->creds = netlogon_creds_copy(result, creds);
2434
2435 result->auth_ctx = schannel_auth;
2436 *presult = result;
2437 return NT_STATUS_OK;
2438
2439 fail:
2440 TALLOC_FREE(result);
2441 return NT_STATUS_NO_MEMORY;
2442 }
2443
2444 /**
2445 * Create an rpc pipe client struct, connecting to a tcp port.
2446 */
2447 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
2448 const struct sockaddr_storage *ss_addr,
2449 uint16_t port,
2450 const struct ndr_syntax_id *abstract_syntax,
2451 struct rpc_pipe_client **presult)
2452 {
2453 struct rpc_pipe_client *result;
2454 struct sockaddr_storage addr;
2455 NTSTATUS status;
2456 int fd;
2457
2458 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2459 if (result == NULL) {
2460 return NT_STATUS_NO_MEMORY;
2461 }
2462
2463 result->abstract_syntax = *abstract_syntax;
2464 result->transfer_syntax = ndr_transfer_syntax_ndr;
2465
2466 result->desthost = talloc_strdup(result, host);
2467 result->srv_name_slash = talloc_asprintf_strupper_m(
2468 result, "\\\\%s", result->desthost);
2469 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2470 status = NT_STATUS_NO_MEMORY;
2471 goto fail;
2472 }
2473
2474 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2475 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2476
2477 if (ss_addr == NULL) {
2478 if (!resolve_name(host, &addr, NBT_NAME_SERVER, false)) {
2479 status = NT_STATUS_NOT_FOUND;
2480 goto fail;
2481 }
2482 } else {
2483 addr = *ss_addr;
2484 }
2485
2486 status = open_socket_out(&addr, port, 60*1000, &fd);
2487 if (!NT_STATUS_IS_OK(status)) {
2488 goto fail;
2489 }
2490 set_socket_options(fd, lp_socket_options());
2491
2492 status = rpc_transport_sock_init(result, fd, &result->transport);
2493 if (!NT_STATUS_IS_OK(status)) {
2494 close(fd);
2495 goto fail;
2496 }
2497
2498 result->transport->transport = NCACN_IP_TCP;
2499
2500 result->binding_handle = rpccli_bh_create(result);
2501 if (result->binding_handle == NULL) {
2502 TALLOC_FREE(result);
2503 return NT_STATUS_NO_MEMORY;
2504 }
2505
2506 *presult = result;
2507 return NT_STATUS_OK;
2508
2509 fail:
2510 TALLOC_FREE(result);
2511 return status;
2512 }
2513
2514 /**
2515 * Determine the tcp port on which a dcerpc interface is listening
2516 * for the ncacn_ip_tcp transport via the endpoint mapper of the
2517 * target host.
2518 */
2519 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
2520 const struct sockaddr_storage *addr,
2521 const struct ndr_syntax_id *abstract_syntax,
2522 uint16_t *pport)
2523 {
2524 NTSTATUS status;
2525 struct rpc_pipe_client *epm_pipe = NULL;
2526 struct dcerpc_binding_handle *epm_handle = NULL;
2527 struct pipe_auth_data *auth = NULL;
2528 struct dcerpc_binding *map_binding = NULL;
2529 struct dcerpc_binding *res_binding = NULL;
2530 struct epm_twr_t *map_tower = NULL;
2531 struct epm_twr_t *res_towers = NULL;
2532 struct policy_handle *entry_handle = NULL;
2533 uint32_t num_towers = 0;
2534 uint32_t max_towers = 1;
2535 struct epm_twr_p_t towers;
2536 TALLOC_CTX *tmp_ctx = talloc_stackframe();
2537 uint32_t result = 0;
2538
2539 if (pport == NULL) {
2540 status = NT_STATUS_INVALID_PARAMETER;
2541 goto done;
2542 }
2543
2544 if (ndr_syntax_id_equal(abstract_syntax,
2545 &ndr_table_epmapper.syntax_id)) {
2546 *pport = 135;
2547 return NT_STATUS_OK;
2548 }
2549
2550 /* open the connection to the endpoint mapper */
2551 status = rpc_pipe_open_tcp_port(tmp_ctx, host, addr, 135,
2552 &ndr_table_epmapper.syntax_id,
2553 &epm_pipe);
2554
2555 if (!NT_STATUS_IS_OK(status)) {
2556 goto done;
2557 }
2558 epm_handle = epm_pipe->binding_handle;
2559
2560 status = rpccli_anon_bind_data(tmp_ctx, &auth);
2561 if (!NT_STATUS_IS_OK(status)) {
2562 goto done;
2563 }
2564
2565 status = rpc_pipe_bind(epm_pipe, auth);
2566 if (!NT_STATUS_IS_OK(status)) {
2567 goto done;
2568 }
2569
2570 /* create tower for asking the epmapper */
2571
2572 map_binding = talloc_zero(tmp_ctx, struct dcerpc_binding);
2573 if (map_binding == NULL) {
2574 status = NT_STATUS_NO_MEMORY;
2575 goto done;
2576 }
2577
2578 map_binding->transport = NCACN_IP_TCP;
2579 map_binding->object = *abstract_syntax;
2580 map_binding->host = host; /* needed? */
2581 map_binding->endpoint = "0"; /* correct? needed? */
2582
2583 map_tower = talloc_zero(tmp_ctx, struct epm_twr_t);
2584 if (map_tower == NULL) {
2585 status = NT_STATUS_NO_MEMORY;
2586 goto done;
2587 }
2588
2589 status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
2590 &(map_tower->tower));
2591 if (!NT_STATUS_IS_OK(status)) {
2592 goto done;
2593 }
2594
2595 /* allocate further parameters for the epm_Map call */
2596
2597 res_towers = talloc_array(tmp_ctx, struct epm_twr_t, max_towers);
2598 if (res_towers == NULL) {
2599 status = NT_STATUS_NO_MEMORY;
2600 goto done;
2601 }
2602 towers.twr = res_towers;
2603
2604 entry_handle = talloc_zero(tmp_ctx, struct policy_handle);
2605 if (entry_handle == NULL) {
2606 status = NT_STATUS_NO_MEMORY;
2607 goto done;
2608 }
2609
2610 /* ask the endpoint mapper for the port */
2611
2612 status = dcerpc_epm_Map(epm_handle,
2613 tmp_ctx,
2614 discard_const_p(struct GUID,
2615 &(abstract_syntax->uuid)),
2616 map_tower,
2617 entry_handle,
2618 max_towers,
2619 &num_towers,
2620 &towers,
2621 &result);
2622
2623 if (!NT_STATUS_IS_OK(status)) {
2624 goto done;
2625 }
2626
2627 if (result != EPMAPPER_STATUS_OK) {
2628 status = NT_STATUS_UNSUCCESSFUL;
2629 goto done;
2630 }
2631
2632 if (num_towers != 1) {
2633 status = NT_STATUS_UNSUCCESSFUL;
2634 goto done;
2635 }
2636
2637 /* extract the port from the answer */
2638
2639 status = dcerpc_binding_from_tower(tmp_ctx,
2640 &(towers.twr->tower),
2641 &res_binding);
2642 if (!NT_STATUS_IS_OK(status)) {
2643 goto done;
2644 }
2645
2646 /* are further checks here necessary? */
2647 if (res_binding->transport != NCACN_IP_TCP) {
2648 status = NT_STATUS_UNSUCCESSFUL;
2649 goto done;
2650 }
2651
2652 *pport = (uint16_t)atoi(res_binding->endpoint);
2653
2654 done:
2655 TALLOC_FREE(tmp_ctx);
2656 return status;
2657 }
2658
2659 /**
2660 * Create a rpc pipe client struct, connecting to a host via tcp.
2661 * The port is determined by asking the endpoint mapper on the given
2662 * host.
2663 */
2664 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
2665 const struct sockaddr_storage *addr,
2666 const struct ndr_syntax_id *abstract_syntax,
2667 struct rpc_pipe_client **presult)
2668 {
2669 NTSTATUS status;
2670 uint16_t port = 0;
2671
2672 status = rpc_pipe_get_tcp_port(host, addr, abstract_syntax, &port);
2673 if (!NT_STATUS_IS_OK(status)) {
2674 return status;
2675 }
2676
2677 return rpc_pipe_open_tcp_port(mem_ctx, host, addr, port,
2678 abstract_syntax, presult);
2679 }
2680
2681 /********************************************************************
2682 Create a rpc pipe client struct, connecting to a unix domain socket
2683 ********************************************************************/
2684 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
2685 const struct ndr_syntax_id *abstract_syntax,
2686 struct rpc_pipe_client **presult)
2687 {
2688 struct rpc_pipe_client *result;
2689 struct sockaddr_un addr;
2690 NTSTATUS status;
2691 int fd;
2692 socklen_t salen;
2693
2694 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2695 if (result == NULL) {
2696 return NT_STATUS_NO_MEMORY;
2697 }
2698
2699 result->abstract_syntax = *abstract_syntax;
2700 result->transfer_syntax = ndr_transfer_syntax_ndr;
2701
2702 result->desthost = get_myname(result);
2703 result->srv_name_slash = talloc_asprintf_strupper_m(
2704 result, "\\\\%s", result->desthost);
2705 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2706 status = NT_STATUS_NO_MEMORY;
2707 goto fail;
2708 }
2709
2710 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2711 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2712
2713 fd = socket(AF_UNIX, SOCK_STREAM, 0);
2714 if (fd == -1) {
2715 status = map_nt_error_from_unix(errno);
2716 goto fail;
2717 }
2718
2719 ZERO_STRUCT(addr);
2720 addr.sun_family = AF_UNIX;
2721 strlcpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
2722 salen = sizeof(struct sockaddr_un);
2723
2724 if (connect(fd, (struct sockaddr *)(void *)&addr, salen) == -1) {
2725 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
2726 strerror(errno)));
2727 close(fd);
2728 return map_nt_error_from_unix(errno);
2729 }
2730
2731 status = rpc_transport_sock_init(result, fd, &result->transport);
2732 if (!NT_STATUS_IS_OK(status)) {
2733 close(fd);
2734 goto fail;
2735 }
2736
2737 result->transport->transport = NCALRPC;
2738
2739 result->binding_handle = rpccli_bh_create(result);
2740 if (result->binding_handle == NULL) {
2741 TALLOC_FREE(result);
2742 return NT_STATUS_NO_MEMORY;
2743 }
2744
2745 *presult = result;
2746 return NT_STATUS_OK;
2747
2748 fail:
2749 TALLOC_FREE(result);
2750 return status;
2751 }
2752
2753 struct rpc_pipe_client_np_ref {
2754 struct cli_state *cli;
2755 struct rpc_pipe_client *pipe;
2756 };
2757
2758 static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
2759 {
2760 DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
2761 return 0;
2762 }
2763
2764 /****************************************************************************
2765 Open a named pipe over SMB to a remote server.
2766 *
2767 * CAVEAT CALLER OF THIS FUNCTION:
2768 * The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
2769 * so be sure that this function is called AFTER any structure (vs pointer)
2770 * assignment of the cli. In particular, libsmbclient does structure
2771 * assignments of cli, which invalidates the data in the returned
2772 * rpc_pipe_client if this function is called before the structure assignment
2773 * of cli.
2774 *
2775 ****************************************************************************/
2776
2777 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
2778 const struct ndr_syntax_id *abstract_syntax,
2779 struct rpc_pipe_client **presult)
2780 {
2781 struct rpc_pipe_client *result;
2782 NTSTATUS status;
2783 struct rpc_pipe_client_np_ref *np_ref;
2784
2785 /* sanity check to protect against crashes */
2786
2787 if ( !cli ) {
2788 return NT_STATUS_INVALID_HANDLE;
2789 }
2790
2791 result = talloc_zero(NULL, struct rpc_pipe_client);
2792 if (result == NULL) {
2793 return NT_STATUS_NO_MEMORY;
2794 }
2795
2796 result->abstract_syntax = *abstract_syntax;
2797 result->transfer_syntax = ndr_transfer_syntax_ndr;
2798 result->desthost = talloc_strdup(result, smbXcli_conn_remote_name(cli->conn));
2799 result->srv_name_slash = talloc_asprintf_strupper_m(
2800 result, "\\\\%s", result->desthost);
2801
2802 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2803 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2804
2805 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2806 TALLOC_FREE(result);
2807 return NT_STATUS_NO_MEMORY;
2808 }
2809
2810 status = rpc_transport_np_init(result, cli, abstract_syntax,
2811 &result->transport);
2812 if (!NT_STATUS_IS_OK(status)) {
2813 TALLOC_FREE(result);
2814 return status;
2815 }
2816
2817 result->transport->transport = NCACN_NP;
2818
2819 np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
2820 if (np_ref == NULL) {
2821 TALLOC_FREE(result);
2822 return NT_STATUS_NO_MEMORY;
2823 }
2824 np_ref->cli = cli;
2825 np_ref->pipe = result;
2826
2827 DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
2828 talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
2829
2830 result->binding_handle = rpccli_bh_create(result);
2831 if (result->binding_handle == NULL) {
2832 TALLOC_FREE(result);
2833 return NT_STATUS_NO_MEMORY;
2834 }
2835
2836 *presult = result;
2837 return NT_STATUS_OK;
2838 }
2839
2840 /****************************************************************************
2841 Open a pipe to a remote server.
2842 ****************************************************************************/
2843
2844 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
2845 enum dcerpc_transport_t transport,
2846 const struct ndr_syntax_id *interface,
2847 struct rpc_pipe_client **presult)
2848 {
2849 switch (transport) {
2850 case NCACN_IP_TCP:
2851 return rpc_pipe_open_tcp(NULL,
2852 smbXcli_conn_remote_name(cli->conn),
2853 smbXcli_conn_remote_sockaddr(cli->conn),
2854 interface, presult);
2855 case NCACN_NP:
2856 return rpc_pipe_open_np(cli, interface, presult);
2857 default:
2858 return NT_STATUS_NOT_IMPLEMENTED;
2859 }
2860 }
2861
2862 /****************************************************************************
2863 Open a named pipe to an SMB server and bind anonymously.
2864 ****************************************************************************/
2865
2866 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
2867 enum dcerpc_transport_t transport,
2868 const struct ndr_syntax_id *interface,
2869 struct rpc_pipe_client **presult)
2870 {
2871 struct rpc_pipe_client *result;
2872 struct pipe_auth_data *auth;
2873 NTSTATUS status;
2874
2875 status = cli_rpc_pipe_open(cli, transport, interface, &result);
2876 if (!NT_STATUS_IS_OK(status)) {
2877 return status;
2878 }
2879
2880 status = rpccli_anon_bind_data(result, &auth);
2881 if (!NT_STATUS_IS_OK(status)) {
2882 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
2883 nt_errstr(status)));
2884 TALLOC_FREE(result);
2885 return status;
2886 }
2887
2888 /*
2889 * This is a bit of an abstraction violation due to the fact that an
2890 * anonymous bind on an authenticated SMB inherits the user/domain
2891 * from the enclosing SMB creds
2892 */
2893
2894 TALLOC_FREE(auth->user_name);
2895 TALLOC_FREE(auth->domain);
2896
2897 auth->user_name = talloc_strdup(auth, cli->user_name);
2898 auth->domain = talloc_strdup(auth, cli->domain);
2899
2900 if (transport == NCACN_NP) {
2901 struct smbXcli_session *session;
2902
2903 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
2904 session = cli->smb2.session;
2905 } else {
2906 session = cli->smb1.session;
2907 }
2908
2909 status = smbXcli_session_application_key(session, auth,
2910 &auth->transport_session_key);
2911 if (!NT_STATUS_IS_OK(status)) {
2912 auth->transport_session_key = data_blob_null;
2913 }
2914 }
2915
2916 if ((auth->user_name == NULL) || (auth->domain == NULL)) {
2917 TALLOC_FREE(result);
2918 return NT_STATUS_NO_MEMORY;
2919 }
2920
2921 status = rpc_pipe_bind(result, auth);
2922 if (!NT_STATUS_IS_OK(status)) {
2923 int lvl = 0;
2924 if (ndr_syntax_id_equal(interface,
2925 &ndr_table_dssetup.syntax_id)) {
2926 /* non AD domains just don't have this pipe, avoid
2927 * level 0 statement in that case - gd */
2928 lvl = 3;
2929 }
2930 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
2931 "%s failed with error %s\n",
2932 get_pipe_name_from_syntax(talloc_tos(), interface),
2933 nt_errstr(status) ));
2934 TALLOC_FREE(result);
2935 return status;
2936 }
2937
2938 DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
2939 "%s and bound anonymously.\n",
2940 get_pipe_name_from_syntax(talloc_tos(), interface),
2941 result->desthost));
2942
2943 *presult = result;
2944 return NT_STATUS_OK;
2945 }
2946
2947 /****************************************************************************
2948 ****************************************************************************/
2949
2950 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
2951 const struct ndr_syntax_id *interface,
2952 struct rpc_pipe_client **presult)
2953 {
2954 return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
2955 interface, presult);
2956 }
2957
2958 /****************************************************************************
2959 Open a named pipe to an SMB server and bind using the mech specified
2960 ****************************************************************************/
2961
2962 NTSTATUS cli_rpc_pipe_open_generic_auth(struct cli_state *cli,
2963 const struct ndr_interface_table *table,
2964 enum dcerpc_transport_t transport,
2965 enum dcerpc_AuthType auth_type,
2966 enum dcerpc_AuthLevel auth_level,
2967 const char *server,
2968 const char *domain,
2969 const char *username,
2970 const char *password,
2971 struct rpc_pipe_client **presult)
2972 {
2973 struct rpc_pipe_client *result;
2974 struct pipe_auth_data *auth = NULL;
2975 const char *target_service = table->authservices->names[0];
2976
2977 NTSTATUS status;
2978
2979 status = cli_rpc_pipe_open(cli, transport, &table->syntax_id, &result);
2980 if (!NT_STATUS_IS_OK(status)) {
2981 return status;
2982 }
2983
2984 status = rpccli_generic_bind_data(result,
2985 auth_type, auth_level,
2986 server, target_service,
2987 domain, username, password,
2988 CRED_AUTO_USE_KERBEROS,
2989 &auth);
2990 if (!NT_STATUS_IS_OK(status)) {
2991 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
2992 nt_errstr(status)));
2993 goto err;
2994 }
2995
2996 status = rpc_pipe_bind(result, auth);
2997 if (!NT_STATUS_IS_OK(status)) {
2998 DEBUG(0, ("cli_rpc_pipe_open_generic_auth: cli_rpc_pipe_bind failed with error %s\n",
2999 nt_errstr(status) ));
3000 goto err;
3001 }
3002
3003 DEBUG(10,("cli_rpc_pipe_open_generic_auth: opened pipe %s to "
3004 "machine %s and bound as user %s\\%s.\n", table->name,
3005 result->desthost, domain, username));
3006
3007 *presult = result;
3008 return NT_STATUS_OK;
3009
3010 err:
3011
3012 TALLOC_FREE(result);
3013 return status;
3014 }
3015
3016 /****************************************************************************
3017 External interface.
3018 Open a named pipe to an SMB server and bind using schannel (bind type 68)
3019 using session_key. sign and seal.
3020
3021 The *pdc will be stolen onto this new pipe
3022 ****************************************************************************/
3023
3024 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
3025 const struct ndr_syntax_id *interface,
3026 enum dcerpc_transport_t transport,
3027 enum dcerpc_AuthLevel auth_level,
3028 const char *domain,
3029 struct netlogon_creds_CredentialState **pdc,
3030 struct rpc_pipe_client **presult)
3031 {
3032 struct rpc_pipe_client *result;
3033 struct pipe_auth_data *auth;
3034 NTSTATUS status;
3035
3036 status = cli_rpc_pipe_open(cli, transport, interface, &result);
3037 if (!NT_STATUS_IS_OK(status)) {
3038 return status;
3039 }
3040
3041 status = rpccli_schannel_bind_data(result, domain, auth_level,
3042 *pdc, &auth);
3043 if (!NT_STATUS_IS_OK(status)) {
3044 DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
3045 nt_errstr(status)));
3046 TALLOC_FREE(result);
3047 return status;
3048 }
3049
3050 status = rpc_pipe_bind(result, auth);
3051 if (!NT_STATUS_IS_OK(status)) {
3052 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
3053 "cli_rpc_pipe_bind failed with error %s\n",
3054 nt_errstr(status) ));
3055 TALLOC_FREE(result);
3056 return status;
3057 }
3058
3059 /*
3060 * The credentials on a new netlogon pipe are the ones we are passed
3061 * in - copy them over
3062 */
3063 if (result->dc == NULL) {
3064 result->dc = netlogon_creds_copy(result, *pdc);
3065 if (result->dc == NULL) {
3066 TALLOC_FREE(result);
3067 return NT_STATUS_NO_MEMORY;
3068 }
3069 }
3070
3071 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
3072 "for domain %s and bound using schannel.\n",
3073 get_pipe_name_from_syntax(talloc_tos(), interface),
3074 result->desthost, domain));
3075
3076 *presult = result;
3077 return NT_STATUS_OK;
3078 }
3079
3080 NTSTATUS cli_rpc_pipe_open_spnego(struct cli_state *cli,
3081 const struct ndr_interface_table *table,
3082 enum dcerpc_transport_t transport,
3083 const char *oid,
3084 enum dcerpc_AuthLevel auth_level,
3085 const char *server,
3086 const char *domain,
3087 const char *username,
3088 const char *password,
3089 struct rpc_pipe_client **presult)
3090 {
3091 struct rpc_pipe_client *result;
3092 struct pipe_auth_data *auth = NULL;
3093 const char *target_service = table->authservices->names[0];
3094
3095 NTSTATUS status;
3096 enum credentials_use_kerberos use_kerberos;
3097
3098 if (strcmp(oid, GENSEC_OID_KERBEROS5) == 0) {
3099 use_kerberos = CRED_MUST_USE_KERBEROS;
3100 } else if (strcmp(oid, GENSEC_OID_NTLMSSP) == 0) {
3101 use_kerberos = CRED_DONT_USE_KERBEROS;
3102 } else {
3103 return NT_STATUS_INVALID_PARAMETER;
3104 }
3105
3106 status = cli_rpc_pipe_open(cli, transport, &table->syntax_id, &result);
3107 if (!NT_STATUS_IS_OK(status)) {
3108 return status;
3109 }
3110
3111 status = rpccli_generic_bind_data(result,
3112 DCERPC_AUTH_TYPE_SPNEGO, auth_level,
3113 server, target_service,
3114 domain, username, password,
3115 use_kerberos,
3116 &auth);
3117 if (!NT_STATUS_IS_OK(status)) {
3118 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
3119 nt_errstr(status)));
3120 goto err;
3121 }
3122
3123 status = rpc_pipe_bind(result, auth);
3124 if (!NT_STATUS_IS_OK(status)) {
3125 DEBUG(0, ("cli_rpc_pipe_open_spnego: cli_rpc_pipe_bind failed with error %s\n",
3126 nt_errstr(status) ));
3127 goto err;
3128 }
3129
3130 DEBUG(10,("cli_rpc_pipe_open_spnego: opened pipe %s to "
3131 "machine %s.\n", table->name,
3132 result->desthost));
3133
3134 *presult = result;
3135 return NT_STATUS_OK;
3136
3137 err:
3138
3139 TALLOC_FREE(result);
3140 return status;
3141 }
3142
3143 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
3144 struct rpc_pipe_client *cli,
3145 DATA_BLOB *session_key)
3146 {
3147 NTSTATUS status;
3148 struct pipe_auth_data *a;
3149 struct schannel_state *schannel_auth;
3150 struct gensec_security *gensec_security;
3151 DATA_BLOB sk = data_blob_null;
3152 bool make_dup = false;
3153
3154 if (!session_key || !cli) {
3155 return NT_STATUS_INVALID_PARAMETER;
3156 }
3157
3158 a = cli->auth;
3159
3160 if (a == NULL) {
3161 return NT_STATUS_INVALID_PARAMETER;
3162 }
3163
3164 switch (cli->auth->auth_type) {
3165 case DCERPC_AUTH_TYPE_SCHANNEL:
3166 schannel_auth = talloc_get_type_abort(a->auth_ctx,
3167 struct schannel_state);
3168 sk = data_blob_const(schannel_auth->creds->session_key, 16);
3169 make_dup = true;
3170 break;
3171 case DCERPC_AUTH_TYPE_SPNEGO:
3172 case DCERPC_AUTH_TYPE_NTLMSSP:
3173 case DCERPC_AUTH_TYPE_KRB5:
3174 gensec_security = talloc_get_type_abort(a->auth_ctx,
3175 struct gensec_security);
3176 status = gensec_session_key(gensec_security, mem_ctx, &sk);
3177 if (!NT_STATUS_IS_OK(status)) {
3178 return status;
3179 }
3180 make_dup = false;
3181 break;
3182 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
3183 case DCERPC_AUTH_TYPE_NONE:
3184 sk = data_blob_const(a->transport_session_key.data,
3185 a->transport_session_key.length);
3186 make_dup = true;
3187 break;
3188 default:
3189 break;
3190 }
3191
3192 if (!sk.data) {
3193 return NT_STATUS_NO_USER_SESSION_KEY;
3194 }
3195
3196 if (make_dup) {
3197 *session_key = data_blob_dup_talloc(mem_ctx, sk);
3198 } else {
3199 *session_key = sk;
3200 }
3201
3202 return NT_STATUS_OK;
3203 }
Samba GIT mirror