?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-dcerpc: Add next authentication step with gssapi
[Samba.git] / source3 / rpc_client / cli_pipe.c
blob4a3229d7cc16b65df78662ac1b07943cf408ac7e
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Largely rewritten by Jeremy Allison 2005.
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "librpc/gen_ndr/cli_epmapper.h"
22 #include "../librpc/gen_ndr/ndr_schannel.h"
23 #include "../librpc/gen_ndr/ndr_dssetup.h"
24 #include "../librpc/gen_ndr/ndr_netlogon.h"
25 #include "../libcli/auth/schannel.h"
26 #include "../libcli/auth/spnego.h"
27 #include "smb_krb5.h"
28 #include "../libcli/auth/ntlmssp.h"
29 #include "ntlmssp_wrap.h"
30 #include "rpc_client/cli_netlogon.h"
31 #include "librpc/gen_ndr/ndr_dcerpc.h"
32 #include "librpc/rpc/dcerpc.h"
33 #include "librpc/rpc/dcerpc_gssapi.h"
34
35 #undef DBGC_CLASS
36 #define DBGC_CLASS DBGC_RPC_CLI
37
38 /********************************************************************
39 Pipe description for a DEBUG
40 ********************************************************************/
41 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
42 struct rpc_pipe_client *cli)
43 {
44 char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
45 if (result == NULL) {
46 return "pipe";
47 }
48 return result;
49 }
50
51 /********************************************************************
52 Rpc pipe call id.
53 ********************************************************************/
54
55 static uint32 get_rpc_call_id(void)
56 {
57 static uint32 call_id = 0;
58 return ++call_id;
59 }
60
61 /*******************************************************************
62 Use SMBreadX to get rest of one fragment's worth of rpc data.
63 Reads the whole size or give an error message
64 ********************************************************************/
65
66 struct rpc_read_state {
67 struct event_context *ev;
68 struct rpc_cli_transport *transport;
69 uint8_t *data;
70 size_t size;
71 size_t num_read;
72 };
73
74 static void rpc_read_done(struct tevent_req *subreq);
75
76 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
77 struct event_context *ev,
78 struct rpc_cli_transport *transport,
79 uint8_t *data, size_t size)
80 {
81 struct tevent_req *req, *subreq;
82 struct rpc_read_state *state;
83
84 req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
85 if (req == NULL) {
86 return NULL;
87 }
88 state->ev = ev;
89 state->transport = transport;
90 state->data = data;
91 state->size = size;
92 state->num_read = 0;
93
94 DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
95
96 subreq = transport->read_send(state, ev, (uint8_t *)data, size,
97 transport->priv);
98 if (subreq == NULL) {
99 goto fail;
100 }
101 tevent_req_set_callback(subreq, rpc_read_done, req);
102 return req;
103
104 fail:
105 TALLOC_FREE(req);
106 return NULL;
107 }
108
109 static void rpc_read_done(struct tevent_req *subreq)
110 {
111 struct tevent_req *req = tevent_req_callback_data(
112 subreq, struct tevent_req);
113 struct rpc_read_state *state = tevent_req_data(
114 req, struct rpc_read_state);
115 NTSTATUS status;
116 ssize_t received;
117
118 status = state->transport->read_recv(subreq, &received);
119 TALLOC_FREE(subreq);
120 if (!NT_STATUS_IS_OK(status)) {
121 tevent_req_nterror(req, status);
122 return;
123 }
124
125 state->num_read += received;
126 if (state->num_read == state->size) {
127 tevent_req_done(req);
128 return;
129 }
130
131 subreq = state->transport->read_send(state, state->ev,
132 state->data + state->num_read,
133 state->size - state->num_read,
134 state->transport->priv);
135 if (tevent_req_nomem(subreq, req)) {
136 return;
137 }
138 tevent_req_set_callback(subreq, rpc_read_done, req);
139 }
140
141 static NTSTATUS rpc_read_recv(struct tevent_req *req)
142 {
143 return tevent_req_simple_recv_ntstatus(req);
144 }
145
146 struct rpc_write_state {
147 struct event_context *ev;
148 struct rpc_cli_transport *transport;
149 const uint8_t *data;
150 size_t size;
151 size_t num_written;
152 };
153
154 static void rpc_write_done(struct tevent_req *subreq);
155
156 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
157 struct event_context *ev,
158 struct rpc_cli_transport *transport,
159 const uint8_t *data, size_t size)
160 {
161 struct tevent_req *req, *subreq;
162 struct rpc_write_state *state;
163
164 req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
165 if (req == NULL) {
166 return NULL;
167 }
168 state->ev = ev;
169 state->transport = transport;
170 state->data = data;
171 state->size = size;
172 state->num_written = 0;
173
174 DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
175
176 subreq = transport->write_send(state, ev, data, size, transport->priv);
177 if (subreq == NULL) {
178 goto fail;
179 }
180 tevent_req_set_callback(subreq, rpc_write_done, req);
181 return req;
182 fail:
183 TALLOC_FREE(req);
184 return NULL;
185 }
186
187 static void rpc_write_done(struct tevent_req *subreq)
188 {
189 struct tevent_req *req = tevent_req_callback_data(
190 subreq, struct tevent_req);
191 struct rpc_write_state *state = tevent_req_data(
192 req, struct rpc_write_state);
193 NTSTATUS status;
194 ssize_t written;
195
196 status = state->transport->write_recv(subreq, &written);
197 TALLOC_FREE(subreq);
198 if (!NT_STATUS_IS_OK(status)) {
199 tevent_req_nterror(req, status);
200 return;
201 }
202
203 state->num_written += written;
204
205 if (state->num_written == state->size) {
206 tevent_req_done(req);
207 return;
208 }
209
210 subreq = state->transport->write_send(state, state->ev,
211 state->data + state->num_written,
212 state->size - state->num_written,
213 state->transport->priv);
214 if (tevent_req_nomem(subreq, req)) {
215 return;
216 }
217 tevent_req_set_callback(subreq, rpc_write_done, req);
218 }
219
220 static NTSTATUS rpc_write_recv(struct tevent_req *req)
221 {
222 return tevent_req_simple_recv_ntstatus(req);
223 }
224
225
226 /****************************************************************************
227 Try and get a PDU's worth of data from current_pdu. If not, then read more
228 from the wire.
229 ****************************************************************************/
230
231 struct get_complete_frag_state {
232 struct event_context *ev;
233 struct rpc_pipe_client *cli;
234 uint16_t frag_len;
235 DATA_BLOB *pdu;
236 };
237
238 static void get_complete_frag_got_header(struct tevent_req *subreq);
239 static void get_complete_frag_got_rest(struct tevent_req *subreq);
240
241 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
242 struct event_context *ev,
243 struct rpc_pipe_client *cli,
244 DATA_BLOB *pdu)
245 {
246 struct tevent_req *req, *subreq;
247 struct get_complete_frag_state *state;
248 size_t received;
249 NTSTATUS status;
250
251 req = tevent_req_create(mem_ctx, &state,
252 struct get_complete_frag_state);
253 if (req == NULL) {
254 return NULL;
255 }
256 state->ev = ev;
257 state->cli = cli;
258 state->frag_len = RPC_HEADER_LEN;
259 state->pdu = pdu;
260
261 received = pdu->length;
262 if (received < RPC_HEADER_LEN) {
263 if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
264 status = NT_STATUS_NO_MEMORY;
265 goto post_status;
266 }
267 subreq = rpc_read_send(state, state->ev,
268 state->cli->transport,
269 pdu->data + received,
270 RPC_HEADER_LEN - received);
271 if (subreq == NULL) {
272 status = NT_STATUS_NO_MEMORY;
273 goto post_status;
274 }
275 tevent_req_set_callback(subreq, get_complete_frag_got_header,
276 req);
277 return req;
278 }
279
280 state->frag_len = dcerpc_get_frag_length(pdu);
281
282 /*
283 * Ensure we have frag_len bytes of data.
284 */
285 if (received < state->frag_len) {
286 if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
287 status = NT_STATUS_NO_MEMORY;
288 goto post_status;
289 }
290 subreq = rpc_read_send(state, state->ev,
291 state->cli->transport,
292 pdu->data + received,
293 state->frag_len - received);
294 if (subreq == NULL) {
295 status = NT_STATUS_NO_MEMORY;
296 goto post_status;
297 }
298 tevent_req_set_callback(subreq, get_complete_frag_got_rest,
299 req);
300 return req;
301 }
302
303 status = NT_STATUS_OK;
304 post_status:
305 if (NT_STATUS_IS_OK(status)) {
306 tevent_req_done(req);
307 } else {
308 tevent_req_nterror(req, status);
309 }
310 return tevent_req_post(req, ev);
311 }
312
313 static void get_complete_frag_got_header(struct tevent_req *subreq)
314 {
315 struct tevent_req *req = tevent_req_callback_data(
316 subreq, struct tevent_req);
317 struct get_complete_frag_state *state = tevent_req_data(
318 req, struct get_complete_frag_state);
319 NTSTATUS status;
320
321 status = rpc_read_recv(subreq);
322 TALLOC_FREE(subreq);
323 if (!NT_STATUS_IS_OK(status)) {
324 tevent_req_nterror(req, status);
325 return;
326 }
327
328 state->frag_len = dcerpc_get_frag_length(state->pdu);
329
330 if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
331 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
332 return;
333 }
334
335 /*
336 * We're here in this piece of code because we've read exactly
337 * RPC_HEADER_LEN bytes into state->pdu.
338 */
339
340 subreq = rpc_read_send(state, state->ev, state->cli->transport,
341 state->pdu->data + RPC_HEADER_LEN,
342 state->frag_len - RPC_HEADER_LEN);
343 if (tevent_req_nomem(subreq, req)) {
344 return;
345 }
346 tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
347 }
348
349 static void get_complete_frag_got_rest(struct tevent_req *subreq)
350 {
351 struct tevent_req *req = tevent_req_callback_data(
352 subreq, struct tevent_req);
353 NTSTATUS status;
354
355 status = rpc_read_recv(subreq);
356 TALLOC_FREE(subreq);
357 if (!NT_STATUS_IS_OK(status)) {
358 tevent_req_nterror(req, status);
359 return;
360 }
361 tevent_req_done(req);
362 }
363
364 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
365 {
366 return tevent_req_simple_recv_ntstatus(req);
367 }
368
369 /****************************************************************************
370 Do basic authentication checks on an incoming pdu.
371 ****************************************************************************/
372
373 static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
374 struct rpc_pipe_client *cli,
375 struct ncacn_packet *pkt,
376 DATA_BLOB *pdu,
377 uint8_t expected_pkt_type,
378 DATA_BLOB *rdata,
379 DATA_BLOB *reply_pdu)
380 {
381 NTSTATUS ret = NT_STATUS_OK;
382 size_t pad_len = 0;
383
384 ret = dcerpc_pull_ncacn_packet(cli, pdu, pkt, false);
385 if (!NT_STATUS_IS_OK(ret)) {
386 return ret;
387 }
388
389 if (pdu->length != pkt->frag_length) {
390 DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
391 (unsigned int)pdu->length,
392 (unsigned int)pkt->frag_length));
393 return NT_STATUS_INVALID_PARAMETER;
394 }
395
396 /*
397 * Point the return values at the real data including the RPC
398 * header. Just in case the caller wants it.
399 */
400 *rdata = *pdu;
401
402 /* Ensure we have the correct type. */
403 switch (pkt->ptype) {
404 case DCERPC_PKT_ALTER_RESP:
405 case DCERPC_PKT_BIND_ACK:
406
407 /* Alter context and bind ack share the same packet definitions. */
408 break;
409
410
411 case DCERPC_PKT_RESPONSE:
412
413 /* Here's where we deal with incoming sign/seal. */
414 ret = dcerpc_check_auth(cli->auth, pkt,
415 &pkt->u.response.stub_and_verifier,
416 DCERPC_RESPONSE_LENGTH,
417 pdu, &pad_len);
418 if (!NT_STATUS_IS_OK(ret)) {
419 return ret;
420 }
421
422 if (pdu->length < DCERPC_RESPONSE_LENGTH + pad_len) {
423 return NT_STATUS_BUFFER_TOO_SMALL;
424 }
425
426 /* Point the return values at the NDR data. */
427 rdata->data = pdu->data + DCERPC_RESPONSE_LENGTH;
428
429 if (pkt->auth_length) {
430 /* We've already done integer wrap tests in
431 * dcerpc_check_auth(). */
432 rdata->length = pdu->length
433 - DCERPC_RESPONSE_LENGTH
434 - pad_len
435 - DCERPC_AUTH_TRAILER_LENGTH
436 - pkt->auth_length;
437 } else {
438 rdata->length = pdu->length - DCERPC_RESPONSE_LENGTH;
439 }
440
441 DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
442 (long unsigned int)pdu->length,
443 (long unsigned int)rdata->length,
444 (unsigned int)pad_len));
445
446 /*
447 * If this is the first reply, and the allocation hint is
448 * reasonable, try and set up the reply_pdu DATA_BLOB to the
449 * correct size.
450 */
451
452 if ((reply_pdu->length == 0) &&
453 pkt->u.response.alloc_hint &&
454 (pkt->u.response.alloc_hint < 15*1024*1024)) {
455 if (!data_blob_realloc(mem_ctx, reply_pdu,
456 pkt->u.response.alloc_hint)) {
457 DEBUG(0, ("reply alloc hint %d too "
458 "large to allocate\n",
459 (int)pkt->u.response.alloc_hint));
460 return NT_STATUS_NO_MEMORY;
461 }
462 }
463
464 break;
465
466 case DCERPC_PKT_BIND_NAK:
467 DEBUG(1, ("cli_pipe_validate_current_pdu: Bind NACK "
468 "received from %s!\n",
469 rpccli_pipe_txt(talloc_tos(), cli)));
470 /* Use this for now... */
471 return NT_STATUS_NETWORK_ACCESS_DENIED;
472
473 case DCERPC_PKT_FAULT:
474
475 DEBUG(1, ("cli_pipe_validate_current_pdu: RPC fault "
476 "code %s received from %s!\n",
477 dcerpc_errstr(talloc_tos(),
478 pkt->u.fault.status),
479 rpccli_pipe_txt(talloc_tos(), cli)));
480
481 if (NT_STATUS_IS_OK(NT_STATUS(pkt->u.fault.status))) {
482 return NT_STATUS_UNSUCCESSFUL;
483 } else {
484 return NT_STATUS(pkt->u.fault.status);
485 }
486
487 default:
488 DEBUG(0, ("Unknown packet type %u received from %s!\n",
489 (unsigned int)pkt->ptype,
490 rpccli_pipe_txt(talloc_tos(), cli)));
491 return NT_STATUS_INVALID_INFO_CLASS;
492 }
493
494 if (pkt->ptype != expected_pkt_type) {
495 DEBUG(3, ("cli_pipe_validate_current_pdu: Connection to %s "
496 "got an unexpected RPC packet type - %u, not %u\n",
497 rpccli_pipe_txt(talloc_tos(), cli),
498 pkt->ptype,
499 expected_pkt_type));
500 return NT_STATUS_INVALID_INFO_CLASS;
501 }
502
503 /* Do this just before return - we don't want to modify any rpc header
504 data before now as we may have needed to do cryptographic actions on
505 it before. */
506
507 if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
508 !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
509 DEBUG(5,("cli_pipe_validate_current_pdu: bug in server (AS/U?), "
510 "setting fragment first/last ON.\n"));
511 pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST |
512 DCERPC_PFC_FLAG_LAST;
513 }
514
515 return NT_STATUS_OK;
516 }
517
518 /****************************************************************************
519 Call a remote api on an arbitrary pipe. takes param, data and setup buffers.
520 ****************************************************************************/
521
522 struct cli_api_pipe_state {
523 struct event_context *ev;
524 struct rpc_cli_transport *transport;
525 uint8_t *rdata;
526 uint32_t rdata_len;
527 };
528
529 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
530 static void cli_api_pipe_write_done(struct tevent_req *subreq);
531 static void cli_api_pipe_read_done(struct tevent_req *subreq);
532
533 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
534 struct event_context *ev,
535 struct rpc_cli_transport *transport,
536 uint8_t *data, size_t data_len,
537 uint32_t max_rdata_len)
538 {
539 struct tevent_req *req, *subreq;
540 struct cli_api_pipe_state *state;
541 NTSTATUS status;
542
543 req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
544 if (req == NULL) {
545 return NULL;
546 }
547 state->ev = ev;
548 state->transport = transport;
549
550 if (max_rdata_len < RPC_HEADER_LEN) {
551 /*
552 * For a RPC reply we always need at least RPC_HEADER_LEN
553 * bytes. We check this here because we will receive
554 * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
555 */
556 status = NT_STATUS_INVALID_PARAMETER;
557 goto post_status;
558 }
559
560 if (transport->trans_send != NULL) {
561 subreq = transport->trans_send(state, ev, data, data_len,
562 max_rdata_len, transport->priv);
563 if (subreq == NULL) {
564 goto fail;
565 }
566 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
567 return req;
568 }
569
570 /*
571 * If the transport does not provide a "trans" routine, i.e. for
572 * example the ncacn_ip_tcp transport, do the write/read step here.
573 */
574
575 subreq = rpc_write_send(state, ev, transport, data, data_len);
576 if (subreq == NULL) {
577 goto fail;
578 }
579 tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
580 return req;
581
582 post_status:
583 tevent_req_nterror(req, status);
584 return tevent_req_post(req, ev);
585 fail:
586 TALLOC_FREE(req);
587 return NULL;
588 }
589
590 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
591 {
592 struct tevent_req *req = tevent_req_callback_data(
593 subreq, struct tevent_req);
594 struct cli_api_pipe_state *state = tevent_req_data(
595 req, struct cli_api_pipe_state);
596 NTSTATUS status;
597
598 status = state->transport->trans_recv(subreq, state, &state->rdata,
599 &state->rdata_len);
600 TALLOC_FREE(subreq);
601 if (!NT_STATUS_IS_OK(status)) {
602 tevent_req_nterror(req, status);
603 return;
604 }
605 tevent_req_done(req);
606 }
607
608 static void cli_api_pipe_write_done(struct tevent_req *subreq)
609 {
610 struct tevent_req *req = tevent_req_callback_data(
611 subreq, struct tevent_req);
612 struct cli_api_pipe_state *state = tevent_req_data(
613 req, struct cli_api_pipe_state);
614 NTSTATUS status;
615
616 status = rpc_write_recv(subreq);
617 TALLOC_FREE(subreq);
618 if (!NT_STATUS_IS_OK(status)) {
619 tevent_req_nterror(req, status);
620 return;
621 }
622
623 state->rdata = TALLOC_ARRAY(state, uint8_t, RPC_HEADER_LEN);
624 if (tevent_req_nomem(state->rdata, req)) {
625 return;
626 }
627
628 /*
629 * We don't need to use rpc_read_send here, the upper layer will cope
630 * with a short read, transport->trans_send could also return less
631 * than state->max_rdata_len.
632 */
633 subreq = state->transport->read_send(state, state->ev, state->rdata,
634 RPC_HEADER_LEN,
635 state->transport->priv);
636 if (tevent_req_nomem(subreq, req)) {
637 return;
638 }
639 tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
640 }
641
642 static void cli_api_pipe_read_done(struct tevent_req *subreq)
643 {
644 struct tevent_req *req = tevent_req_callback_data(
645 subreq, struct tevent_req);
646 struct cli_api_pipe_state *state = tevent_req_data(
647 req, struct cli_api_pipe_state);
648 NTSTATUS status;
649 ssize_t received;
650
651 status = state->transport->read_recv(subreq, &received);
652 TALLOC_FREE(subreq);
653 if (!NT_STATUS_IS_OK(status)) {
654 tevent_req_nterror(req, status);
655 return;
656 }
657 state->rdata_len = received;
658 tevent_req_done(req);
659 }
660
661 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
662 uint8_t **prdata, uint32_t *prdata_len)
663 {
664 struct cli_api_pipe_state *state = tevent_req_data(
665 req, struct cli_api_pipe_state);
666 NTSTATUS status;
667
668 if (tevent_req_is_nterror(req, &status)) {
669 return status;
670 }
671
672 *prdata = talloc_move(mem_ctx, &state->rdata);
673 *prdata_len = state->rdata_len;
674 return NT_STATUS_OK;
675 }
676
677 /****************************************************************************
678 Send data on an rpc pipe via trans. The data must be the last
679 pdu fragment of an NDR data stream.
680
681 Receive response data from an rpc pipe, which may be large...
682
683 Read the first fragment: unfortunately have to use SMBtrans for the first
684 bit, then SMBreadX for subsequent bits.
685
686 If first fragment received also wasn't the last fragment, continue
687 getting fragments until we _do_ receive the last fragment.
688
689 Request/Response PDU's look like the following...
690
691 |<------------------PDU len----------------------------------------------->|
692 |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
693
694 +------------+-----------------+-------------+---------------+-------------+
695 | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR | AUTH DATA |
696 +------------+-----------------+-------------+---------------+-------------+
697
698 Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
699 signing & sealing being negotiated.
700
701 ****************************************************************************/
702
703 struct rpc_api_pipe_state {
704 struct event_context *ev;
705 struct rpc_pipe_client *cli;
706 uint8_t expected_pkt_type;
707
708 DATA_BLOB incoming_frag;
709 struct ncacn_packet *pkt;
710
711 /* Incoming reply */
712 DATA_BLOB reply_pdu;
713 size_t reply_pdu_offset;
714 uint8_t endianess;
715 };
716
717 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
718 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
719
720 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
721 struct event_context *ev,
722 struct rpc_pipe_client *cli,
723 DATA_BLOB *data, /* Outgoing PDU */
724 uint8_t expected_pkt_type)
725 {
726 struct tevent_req *req, *subreq;
727 struct rpc_api_pipe_state *state;
728 uint16_t max_recv_frag;
729 NTSTATUS status;
730
731 req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
732 if (req == NULL) {
733 return NULL;
734 }
735 state->ev = ev;
736 state->cli = cli;
737 state->expected_pkt_type = expected_pkt_type;
738 state->incoming_frag = data_blob_null;
739 state->reply_pdu = data_blob_null;
740 state->reply_pdu_offset = 0;
741 state->endianess = DCERPC_DREP_LE;
742
743 /*
744 * Ensure we're not sending too much.
745 */
746 if (data->length > cli->max_xmit_frag) {
747 status = NT_STATUS_INVALID_PARAMETER;
748 goto post_status;
749 }
750
751 DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
752
753 /* get the header first, then fetch the rest once we have
754 * the frag_length available */
755 max_recv_frag = RPC_HEADER_LEN;
756
757 subreq = cli_api_pipe_send(state, ev, cli->transport,
758 data->data, data->length, max_recv_frag);
759 if (subreq == NULL) {
760 goto fail;
761 }
762 tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
763 return req;
764
765 post_status:
766 tevent_req_nterror(req, status);
767 return tevent_req_post(req, ev);
768 fail:
769 TALLOC_FREE(req);
770 return NULL;
771 }
772
773 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
774 {
775 struct tevent_req *req = tevent_req_callback_data(
776 subreq, struct tevent_req);
777 struct rpc_api_pipe_state *state = tevent_req_data(
778 req, struct rpc_api_pipe_state);
779 NTSTATUS status;
780 uint8_t *rdata = NULL;
781 uint32_t rdata_len = 0;
782
783 status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
784 TALLOC_FREE(subreq);
785 if (!NT_STATUS_IS_OK(status)) {
786 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
787 tevent_req_nterror(req, status);
788 return;
789 }
790
791 if (rdata == NULL) {
792 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
793 rpccli_pipe_txt(talloc_tos(), state->cli)));
794 tevent_req_done(req);
795 return;
796 }
797
798 /*
799 * Move data on state->incoming_frag.
800 */
801 state->incoming_frag.data = talloc_move(state, &rdata);
802 state->incoming_frag.length = rdata_len;
803 if (!state->incoming_frag.data) {
804 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
805 return;
806 }
807
808 /* Ensure we have enough data for a pdu. */
809 subreq = get_complete_frag_send(state, state->ev, state->cli,
810 &state->incoming_frag);
811 if (tevent_req_nomem(subreq, req)) {
812 return;
813 }
814 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
815 }
816
817 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
818 {
819 struct tevent_req *req = tevent_req_callback_data(
820 subreq, struct tevent_req);
821 struct rpc_api_pipe_state *state = tevent_req_data(
822 req, struct rpc_api_pipe_state);
823 NTSTATUS status;
824 DATA_BLOB rdata = data_blob_null;
825
826 status = get_complete_frag_recv(subreq);
827 TALLOC_FREE(subreq);
828 if (!NT_STATUS_IS_OK(status)) {
829 DEBUG(5, ("get_complete_frag failed: %s\n",
830 nt_errstr(status)));
831 tevent_req_nterror(req, status);
832 return;
833 }
834
835 state->pkt = talloc(state, struct ncacn_packet);
836 if (!state->pkt) {
837 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
838 return;
839 }
840
841 status = cli_pipe_validate_current_pdu(state,
842 state->cli, state->pkt,
843 &state->incoming_frag,
844 state->expected_pkt_type,
845 &rdata,
846 &state->reply_pdu);
847
848 DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
849 (unsigned)state->incoming_frag.length,
850 (unsigned)state->reply_pdu_offset,
851 nt_errstr(status)));
852
853 if (!NT_STATUS_IS_OK(status)) {
854 tevent_req_nterror(req, status);
855 return;
856 }
857
858 if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
859 && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
860 /*
861 * Set the data type correctly for big-endian data on the
862 * first packet.
863 */
864 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
865 "big-endian.\n",
866 rpccli_pipe_txt(talloc_tos(), state->cli)));
867 state->endianess = 0x00; /* BIG ENDIAN */
868 }
869 /*
870 * Check endianness on subsequent packets.
871 */
872 if (state->endianess != state->pkt->drep[0]) {
873 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
874 "%s\n",
875 state->endianess?"little":"big",
876 state->pkt->drep[0]?"little":"big"));
877 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
878 return;
879 }
880
881 /* Now copy the data portion out of the pdu into rbuf. */
882 if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
883 if (!data_blob_realloc(NULL, &state->reply_pdu,
884 state->reply_pdu_offset + rdata.length)) {
885 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
886 return;
887 }
888 }
889
890 memcpy(state->reply_pdu.data + state->reply_pdu_offset,
891 rdata.data, rdata.length);
892 state->reply_pdu_offset += rdata.length;
893
894 /* reset state->incoming_frag, there is no need to free it,
895 * it will be reallocated to the right size the next time
896 * it is used */
897 state->incoming_frag.length = 0;
898
899 if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
900 /* make sure the pdu length is right now that we
901 * have all the data available (alloc hint may
902 * have allocated more than was actually used) */
903 state->reply_pdu.length = state->reply_pdu_offset;
904 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
905 rpccli_pipe_txt(talloc_tos(), state->cli),
906 (unsigned)state->reply_pdu.length));
907 tevent_req_done(req);
908 return;
909 }
910
911 subreq = get_complete_frag_send(state, state->ev, state->cli,
912 &state->incoming_frag);
913 if (tevent_req_nomem(subreq, req)) {
914 return;
915 }
916 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
917 }
918
919 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
920 struct ncacn_packet **pkt,
921 DATA_BLOB *reply_pdu)
922 {
923 struct rpc_api_pipe_state *state = tevent_req_data(
924 req, struct rpc_api_pipe_state);
925 NTSTATUS status;
926
927 if (tevent_req_is_nterror(req, &status)) {
928 return status;
929 }
930
931 /* return data to caller and assign it ownership of memory */
932 if (reply_pdu) {
933 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
934 reply_pdu->length = state->reply_pdu.length;
935 state->reply_pdu.length = 0;
936 } else {
937 data_blob_free(&state->reply_pdu);
938 }
939
940 if (pkt) {
941 *pkt = talloc_steal(mem_ctx, state->pkt);
942 }
943
944 return NT_STATUS_OK;
945 }
946
947 /*******************************************************************
948 Creates krb5 auth bind.
949 ********************************************************************/
950
951 static NTSTATUS create_gssapi_auth_bind_req(TALLOC_CTX *mem_ctx,
952 struct pipe_auth_data *auth,
953 DATA_BLOB *auth_info)
954 {
955 DATA_BLOB in_token = data_blob_null;
956 DATA_BLOB auth_token = data_blob_null;
957 NTSTATUS status;
958
959 /* Negotiate the initial auth token */
960 status = gse_get_client_auth_token(mem_ctx,
961 auth->a_u.gssapi_state,
962 &in_token,
963 &auth_token);
964 if (!NT_STATUS_IS_OK(status)) {
965 return status;
966 }
967
968 status = dcerpc_push_dcerpc_auth(mem_ctx,
969 auth->auth_type,
970 auth->auth_level,
971 0, /* auth_pad_length */
972 1, /* auth_context_id */
973 &auth_token,
974 auth_info);
975 if (!NT_STATUS_IS_OK(status)) {
976 data_blob_free(&auth_token);
977 return status;
978 }
979
980 DEBUG(5, ("Created GSS Authentication Token:\n"));
981 dump_data(5, auth_token.data, auth_token.length);
982
983 data_blob_free(&auth_token);
984 return NT_STATUS_OK;
985 }
986
987 /*******************************************************************
988 Creates SPNEGO NTLMSSP auth bind.
989 ********************************************************************/
990
991 static NTSTATUS create_spnego_ntlmssp_auth_rpc_bind_req(struct rpc_pipe_client *cli,
992 enum dcerpc_AuthLevel auth_level,
993 DATA_BLOB *auth_info)
994 {
995 NTSTATUS status;
996 DATA_BLOB null_blob = data_blob_null;
997 DATA_BLOB request = data_blob_null;
998 DATA_BLOB spnego_msg = data_blob_null;
999 const char *OIDs_ntlm[] = {OID_NTLMSSP, NULL};
1000
1001 DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1002 status = auth_ntlmssp_update(cli->auth->a_u.auth_ntlmssp_state,
1003 null_blob,
1004 &request);
1005
1006 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1007 data_blob_free(&request);
1008 return status;
1009 }
1010
1011 /* Wrap this in SPNEGO. */
1012 spnego_msg = spnego_gen_negTokenInit(talloc_tos(), OIDs_ntlm, &request, NULL);
1013
1014 data_blob_free(&request);
1015
1016 status = dcerpc_push_dcerpc_auth(cli,
1017 DCERPC_AUTH_TYPE_SPNEGO,
1018 auth_level,
1019 0, /* auth_pad_length */
1020 1, /* auth_context_id */
1021 &spnego_msg,
1022 auth_info);
1023
1024 if (!NT_STATUS_IS_OK(status)) {
1025 data_blob_free(&spnego_msg);
1026 return status;
1027 }
1028
1029 DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1030 dump_data(5, spnego_msg.data, spnego_msg.length);
1031 data_blob_free(&spnego_msg);
1032
1033 return NT_STATUS_OK;
1034 }
1035
1036 /*******************************************************************
1037 Creates NTLMSSP auth bind.
1038 ********************************************************************/
1039
1040 static NTSTATUS create_ntlmssp_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1041 enum dcerpc_AuthLevel auth_level,
1042 DATA_BLOB *auth_info)
1043 {
1044 NTSTATUS status;
1045 DATA_BLOB null_blob = data_blob_null;
1046 DATA_BLOB request = data_blob_null;
1047
1048 DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1049 status = auth_ntlmssp_update(cli->auth->a_u.auth_ntlmssp_state,
1050 null_blob,
1051 &request);
1052
1053 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1054 data_blob_free(&request);
1055 return status;
1056 }
1057
1058 status = dcerpc_push_dcerpc_auth(cli,
1059 DCERPC_AUTH_TYPE_NTLMSSP,
1060 auth_level,
1061 0, /* auth_pad_length */
1062 1, /* auth_context_id */
1063 &request,
1064 auth_info);
1065 if (!NT_STATUS_IS_OK(status)) {
1066 data_blob_free(&request);
1067 return status;
1068 }
1069
1070 DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1071 dump_data(5, request.data, request.length);
1072
1073 return NT_STATUS_OK;
1074 }
1075
1076 /*******************************************************************
1077 Creates schannel auth bind.
1078 ********************************************************************/
1079
1080 static NTSTATUS create_schannel_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1081 enum dcerpc_AuthLevel auth_level,
1082 DATA_BLOB *auth_info)
1083 {
1084 NTSTATUS status;
1085 struct NL_AUTH_MESSAGE r;
1086 DATA_BLOB schannel_blob;
1087
1088 /* Use lp_workgroup() if domain not specified */
1089
1090 if (!cli->auth->domain || !cli->auth->domain[0]) {
1091 cli->auth->domain = talloc_strdup(cli, lp_workgroup());
1092 if (cli->auth->domain == NULL) {
1093 return NT_STATUS_NO_MEMORY;
1094 }
1095 }
1096
1097 /*
1098 * Now marshall the data into the auth parse_struct.
1099 */
1100
1101 r.MessageType = NL_NEGOTIATE_REQUEST;
1102 r.Flags = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
1103 NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
1104 r.oem_netbios_domain.a = cli->auth->domain;
1105 r.oem_netbios_computer.a = global_myname();
1106
1107 status = dcerpc_push_schannel_bind(cli, &r, &schannel_blob);
1108 if (!NT_STATUS_IS_OK(status)) {
1109 return status;
1110 }
1111
1112 status = dcerpc_push_dcerpc_auth(cli,
1113 DCERPC_AUTH_TYPE_SCHANNEL,
1114 auth_level,
1115 0, /* auth_pad_length */
1116 1, /* auth_context_id */
1117 &schannel_blob,
1118 auth_info);
1119 if (!NT_STATUS_IS_OK(status)) {
1120 return status;
1121 }
1122
1123 return NT_STATUS_OK;
1124 }
1125
1126 /*******************************************************************
1127 Creates the internals of a DCE/RPC bind request or alter context PDU.
1128 ********************************************************************/
1129
1130 static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
1131 enum dcerpc_pkt_type ptype,
1132 uint32 rpc_call_id,
1133 const struct ndr_syntax_id *abstract,
1134 const struct ndr_syntax_id *transfer,
1135 const DATA_BLOB *auth_info,
1136 DATA_BLOB *blob)
1137 {
1138 uint16 auth_len = auth_info->length;
1139 NTSTATUS status;
1140 union dcerpc_payload u;
1141 struct dcerpc_ctx_list ctx_list;
1142
1143 if (auth_len) {
1144 auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
1145 }
1146
1147 ctx_list.context_id = 0;
1148 ctx_list.num_transfer_syntaxes = 1;
1149 ctx_list.abstract_syntax = *abstract;
1150 ctx_list.transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer);
1151
1152 u.bind.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1153 u.bind.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1154 u.bind.assoc_group_id = 0x0;
1155 u.bind.num_contexts = 1;
1156 u.bind.ctx_list = &ctx_list;
1157 u.bind.auth_info = *auth_info;
1158
1159 status = dcerpc_push_ncacn_packet(mem_ctx,
1160 ptype,
1161 DCERPC_PFC_FLAG_FIRST |
1162 DCERPC_PFC_FLAG_LAST,
1163 auth_len,
1164 rpc_call_id,
1165 &u,
1166 blob);
1167 if (!NT_STATUS_IS_OK(status)) {
1168 DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
1169 return status;
1170 }
1171
1172 return NT_STATUS_OK;
1173 }
1174
1175 /*******************************************************************
1176 Creates a DCE/RPC bind request.
1177 ********************************************************************/
1178
1179 static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
1180 struct rpc_pipe_client *cli,
1181 struct pipe_auth_data *auth,
1182 uint32 rpc_call_id,
1183 const struct ndr_syntax_id *abstract,
1184 const struct ndr_syntax_id *transfer,
1185 DATA_BLOB *rpc_out)
1186 {
1187 DATA_BLOB auth_info = data_blob_null;
1188 NTSTATUS ret = NT_STATUS_OK;
1189
1190 switch (auth->auth_type) {
1191 case DCERPC_AUTH_TYPE_SCHANNEL:
1192 ret = create_schannel_auth_rpc_bind_req(cli,
1193 auth->auth_level,
1194 &auth_info);
1195 if (!NT_STATUS_IS_OK(ret)) {
1196 return ret;
1197 }
1198 break;
1199
1200 case DCERPC_AUTH_TYPE_NTLMSSP:
1201 ret = create_ntlmssp_auth_rpc_bind_req(cli,
1202 auth->auth_level,
1203 &auth_info);
1204 if (!NT_STATUS_IS_OK(ret)) {
1205 return ret;
1206 }
1207 break;
1208
1209 case DCERPC_AUTH_TYPE_SPNEGO:
1210 if (auth->spnego_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP) {
1211 /* "Can't" happen. */
1212 return NT_STATUS_INVALID_INFO_CLASS;
1213 }
1214 ret = create_spnego_ntlmssp_auth_rpc_bind_req(cli,
1215 auth->auth_level,
1216 &auth_info);
1217 if (!NT_STATUS_IS_OK(ret)) {
1218 return ret;
1219 }
1220 break;
1221
1222 case DCERPC_AUTH_TYPE_KRB5:
1223 ret = create_gssapi_auth_bind_req(mem_ctx, auth, &auth_info);
1224 if (!NT_STATUS_IS_OK(ret)) {
1225 return ret;
1226 }
1227 break;
1228
1229 case DCERPC_AUTH_TYPE_NONE:
1230 break;
1231
1232 default:
1233 /* "Can't" happen. */
1234 return NT_STATUS_INVALID_INFO_CLASS;
1235 }
1236
1237 ret = create_bind_or_alt_ctx_internal(mem_ctx,
1238 DCERPC_PKT_BIND,
1239 rpc_call_id,
1240 abstract,
1241 transfer,
1242 &auth_info,
1243 rpc_out);
1244 return ret;
1245 }
1246
1247 /*******************************************************************
1248 Calculate how much data we're going to send in this packet, also
1249 work out any sign/seal padding length.
1250 ********************************************************************/
1251
1252 static NTSTATUS calculate_data_len_tosend(struct rpc_pipe_client *cli,
1253 uint32_t data_left,
1254 uint32_t *data_to_send,
1255 uint16_t *p_frag_len,
1256 uint16_t *p_auth_len,
1257 uint32_t *p_ss_padding)
1258 {
1259 uint32_t data_space, data_len;
1260
1261 switch (cli->auth->auth_level) {
1262 case DCERPC_AUTH_LEVEL_NONE:
1263 case DCERPC_AUTH_LEVEL_CONNECT:
1264 case DCERPC_AUTH_LEVEL_PACKET:
1265 data_space = cli->max_xmit_frag - DCERPC_REQUEST_LENGTH;
1266 data_len = MIN(data_space, data_left);
1267 *p_ss_padding = 0;
1268 *p_auth_len = 0;
1269 *p_frag_len = DCERPC_REQUEST_LENGTH + data_len;
1270 *data_to_send = data_len;
1271 return NT_STATUS_OK;
1272
1273 case DCERPC_AUTH_LEVEL_INTEGRITY:
1274 case DCERPC_AUTH_LEVEL_PRIVACY:
1275 /* Treat the same for all authenticated rpc requests. */
1276 switch(cli->auth->auth_type) {
1277 case DCERPC_AUTH_TYPE_SPNEGO:
1278 switch (cli->auth->spnego_type) {
1279 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1280 *p_auth_len = NTLMSSP_SIG_SIZE;
1281 break;
1282 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
1283 *p_auth_len = 0; /* no signing */
1284 break;
1285 default:
1286 return NT_STATUS_INVALID_PARAMETER;
1287 }
1288 case DCERPC_AUTH_TYPE_NTLMSSP:
1289 *p_auth_len = NTLMSSP_SIG_SIZE;
1290 break;
1291 case DCERPC_AUTH_TYPE_SCHANNEL:
1292 *p_auth_len = NL_AUTH_SIGNATURE_SIZE;
1293 break;
1294 case DCERPC_AUTH_TYPE_KRB5:
1295 *p_auth_len = 0; /* no signing */
1296 break;
1297 default:
1298 return NT_STATUS_INVALID_PARAMETER;
1299 }
1300
1301 data_space = cli->max_xmit_frag
1302 - DCERPC_REQUEST_LENGTH
1303 - DCERPC_AUTH_TRAILER_LENGTH
1304 - *p_auth_len;
1305
1306 data_len = MIN(data_space, data_left);
1307 *p_ss_padding = 0;
1308 if (data_len % CLIENT_NDR_PADDING_SIZE) {
1309 *p_ss_padding = CLIENT_NDR_PADDING_SIZE - (data_len % CLIENT_NDR_PADDING_SIZE);
1310 }
1311 *p_frag_len = DCERPC_REQUEST_LENGTH
1312 + data_len + *p_ss_padding
1313 + DCERPC_AUTH_TRAILER_LENGTH
1314 + *p_auth_len;
1315 *data_to_send = data_len;
1316 return NT_STATUS_OK;
1317
1318 default:
1319 break;
1320 }
1321
1322 return NT_STATUS_INVALID_PARAMETER;
1323 }
1324
1325 /*******************************************************************
1326 External interface.
1327 Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
1328 Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
1329 and deals with signing/sealing details.
1330 ********************************************************************/
1331
1332 struct rpc_api_pipe_req_state {
1333 struct event_context *ev;
1334 struct rpc_pipe_client *cli;
1335 uint8_t op_num;
1336 uint32_t call_id;
1337 DATA_BLOB *req_data;
1338 uint32_t req_data_sent;
1339 DATA_BLOB rpc_out;
1340 DATA_BLOB reply_pdu;
1341 };
1342
1343 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
1344 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
1345 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1346 bool *is_last_frag);
1347
1348 struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
1349 struct event_context *ev,
1350 struct rpc_pipe_client *cli,
1351 uint8_t op_num,
1352 DATA_BLOB *req_data)
1353 {
1354 struct tevent_req *req, *subreq;
1355 struct rpc_api_pipe_req_state *state;
1356 NTSTATUS status;
1357 bool is_last_frag;
1358
1359 req = tevent_req_create(mem_ctx, &state,
1360 struct rpc_api_pipe_req_state);
1361 if (req == NULL) {
1362 return NULL;
1363 }
1364 state->ev = ev;
1365 state->cli = cli;
1366 state->op_num = op_num;
1367 state->req_data = req_data;
1368 state->req_data_sent = 0;
1369 state->call_id = get_rpc_call_id();
1370 state->reply_pdu = data_blob_null;
1371 state->rpc_out = data_blob_null;
1372
1373 if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
1374 + RPC_MAX_SIGN_SIZE) {
1375 /* Server is screwed up ! */
1376 status = NT_STATUS_INVALID_PARAMETER;
1377 goto post_status;
1378 }
1379
1380 status = prepare_next_frag(state, &is_last_frag);
1381 if (!NT_STATUS_IS_OK(status)) {
1382 goto post_status;
1383 }
1384
1385 if (is_last_frag) {
1386 subreq = rpc_api_pipe_send(state, ev, state->cli,
1387 &state->rpc_out,
1388 DCERPC_PKT_RESPONSE);
1389 if (subreq == NULL) {
1390 goto fail;
1391 }
1392 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1393 } else {
1394 subreq = rpc_write_send(state, ev, cli->transport,
1395 state->rpc_out.data,
1396 state->rpc_out.length);
1397 if (subreq == NULL) {
1398 goto fail;
1399 }
1400 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1401 req);
1402 }
1403 return req;
1404
1405 post_status:
1406 tevent_req_nterror(req, status);
1407 return tevent_req_post(req, ev);
1408 fail:
1409 TALLOC_FREE(req);
1410 return NULL;
1411 }
1412
1413 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1414 bool *is_last_frag)
1415 {
1416 uint32_t data_sent_thistime;
1417 uint16_t auth_len;
1418 uint16_t frag_len;
1419 uint8_t flags = 0;
1420 uint32_t pad_len;
1421 uint32_t data_left;
1422 NTSTATUS status;
1423 union dcerpc_payload u;
1424
1425 data_left = state->req_data->length - state->req_data_sent;
1426
1427 status = calculate_data_len_tosend(state->cli, data_left,
1428 &data_sent_thistime,
1429 &frag_len, &auth_len,
1430 &pad_len);
1431 if (!NT_STATUS_IS_OK(status)) {
1432 return status;
1433 }
1434
1435 if (state->req_data_sent == 0) {
1436 flags = DCERPC_PFC_FLAG_FIRST;
1437 }
1438
1439 if (data_sent_thistime == data_left) {
1440 flags |= DCERPC_PFC_FLAG_LAST;
1441 }
1442
1443 data_blob_free(&state->rpc_out);
1444
1445 ZERO_STRUCT(u.request);
1446
1447 u.request.alloc_hint = state->req_data->length;
1448 u.request.context_id = 0;
1449 u.request.opnum = state->op_num;
1450
1451 status = dcerpc_push_ncacn_packet(state,
1452 DCERPC_PKT_REQUEST,
1453 flags,
1454 auth_len,
1455 state->call_id,
1456 &u,
1457 &state->rpc_out);
1458 if (!NT_STATUS_IS_OK(status)) {
1459 return status;
1460 }
1461
1462 /* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
1463 * compute it right for requests because the auth trailer is missing
1464 * at this stage */
1465 dcerpc_set_frag_length(&state->rpc_out, frag_len);
1466
1467 /* Copy in the data. */
1468 if (!data_blob_append(NULL, &state->rpc_out,
1469 state->req_data->data + state->req_data_sent,
1470 data_sent_thistime)) {
1471 return NT_STATUS_NO_MEMORY;
1472 }
1473
1474 switch (state->cli->auth->auth_level) {
1475 case DCERPC_AUTH_LEVEL_NONE:
1476 case DCERPC_AUTH_LEVEL_CONNECT:
1477 case DCERPC_AUTH_LEVEL_PACKET:
1478 break;
1479 case DCERPC_AUTH_LEVEL_INTEGRITY:
1480 case DCERPC_AUTH_LEVEL_PRIVACY:
1481 status = dcerpc_add_auth_footer(state->cli->auth, pad_len,
1482 &state->rpc_out);
1483 if (!NT_STATUS_IS_OK(status)) {
1484 return status;
1485 }
1486 break;
1487 default:
1488 return NT_STATUS_INVALID_PARAMETER;
1489 }
1490
1491 state->req_data_sent += data_sent_thistime;
1492 *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
1493
1494 return status;
1495 }
1496
1497 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
1498 {
1499 struct tevent_req *req = tevent_req_callback_data(
1500 subreq, struct tevent_req);
1501 struct rpc_api_pipe_req_state *state = tevent_req_data(
1502 req, struct rpc_api_pipe_req_state);
1503 NTSTATUS status;
1504 bool is_last_frag;
1505
1506 status = rpc_write_recv(subreq);
1507 TALLOC_FREE(subreq);
1508 if (!NT_STATUS_IS_OK(status)) {
1509 tevent_req_nterror(req, status);
1510 return;
1511 }
1512
1513 status = prepare_next_frag(state, &is_last_frag);
1514 if (!NT_STATUS_IS_OK(status)) {
1515 tevent_req_nterror(req, status);
1516 return;
1517 }
1518
1519 if (is_last_frag) {
1520 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1521 &state->rpc_out,
1522 DCERPC_PKT_RESPONSE);
1523 if (tevent_req_nomem(subreq, req)) {
1524 return;
1525 }
1526 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1527 } else {
1528 subreq = rpc_write_send(state, state->ev,
1529 state->cli->transport,
1530 state->rpc_out.data,
1531 state->rpc_out.length);
1532 if (tevent_req_nomem(subreq, req)) {
1533 return;
1534 }
1535 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1536 req);
1537 }
1538 }
1539
1540 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
1541 {
1542 struct tevent_req *req = tevent_req_callback_data(
1543 subreq, struct tevent_req);
1544 struct rpc_api_pipe_req_state *state = tevent_req_data(
1545 req, struct rpc_api_pipe_req_state);
1546 NTSTATUS status;
1547
1548 status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
1549 TALLOC_FREE(subreq);
1550 if (!NT_STATUS_IS_OK(status)) {
1551 tevent_req_nterror(req, status);
1552 return;
1553 }
1554 tevent_req_done(req);
1555 }
1556
1557 NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1558 DATA_BLOB *reply_pdu)
1559 {
1560 struct rpc_api_pipe_req_state *state = tevent_req_data(
1561 req, struct rpc_api_pipe_req_state);
1562 NTSTATUS status;
1563
1564 if (tevent_req_is_nterror(req, &status)) {
1565 /*
1566 * We always have to initialize to reply pdu, even if there is
1567 * none. The rpccli_* caller routines expect this.
1568 */
1569 *reply_pdu = data_blob_null;
1570 return status;
1571 }
1572
1573 /* return data to caller and assign it ownership of memory */
1574 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1575 reply_pdu->length = state->reply_pdu.length;
1576 state->reply_pdu.length = 0;
1577
1578 return NT_STATUS_OK;
1579 }
1580
1581 #if 0
1582 /****************************************************************************
1583 Set the handle state.
1584 ****************************************************************************/
1585
1586 static bool rpc_pipe_set_hnd_state(struct rpc_pipe_client *cli,
1587 const char *pipe_name, uint16 device_state)
1588 {
1589 bool state_set = False;
1590 char param[2];
1591 uint16 setup[2]; /* only need 2 uint16 setup parameters */
1592 char *rparam = NULL;
1593 char *rdata = NULL;
1594 uint32 rparam_len, rdata_len;
1595
1596 if (pipe_name == NULL)
1597 return False;
1598
1599 DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
1600 cli->fnum, pipe_name, device_state));
1601
1602 /* create parameters: device state */
1603 SSVAL(param, 0, device_state);
1604
1605 /* create setup parameters. */
1606 setup[0] = 0x0001;
1607 setup[1] = cli->fnum; /* pipe file handle. got this from an SMBOpenX. */
1608
1609 /* send the data on \PIPE\ */
1610 if (cli_api_pipe(cli->cli, "\\PIPE\\",
1611 setup, 2, 0, /* setup, length, max */
1612 param, 2, 0, /* param, length, max */
1613 NULL, 0, 1024, /* data, length, max */
1614 &rparam, &rparam_len, /* return param, length */
1615 &rdata, &rdata_len)) /* return data, length */
1616 {
1617 DEBUG(5, ("Set Handle state: return OK\n"));
1618 state_set = True;
1619 }
1620
1621 SAFE_FREE(rparam);
1622 SAFE_FREE(rdata);
1623
1624 return state_set;
1625 }
1626 #endif
1627
1628 /****************************************************************************
1629 Check the rpc bind acknowledge response.
1630 ****************************************************************************/
1631
1632 static bool check_bind_response(const struct dcerpc_bind_ack *r,
1633 const struct ndr_syntax_id *transfer)
1634 {
1635 struct dcerpc_ack_ctx ctx;
1636
1637 if (r->secondary_address_size == 0) {
1638 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
1639 }
1640
1641 if (r->num_results < 1 || !r->ctx_list) {
1642 return false;
1643 }
1644
1645 ctx = r->ctx_list[0];
1646
1647 /* check the transfer syntax */
1648 if ((ctx.syntax.if_version != transfer->if_version) ||
1649 (memcmp(&ctx.syntax.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1650 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1651 return False;
1652 }
1653
1654 if (r->num_results != 0x1 || ctx.result != 0) {
1655 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1656 r->num_results, ctx.reason));
1657 }
1658
1659 DEBUG(5,("check_bind_response: accepted!\n"));
1660 return True;
1661 }
1662
1663 /*******************************************************************
1664 Creates a DCE/RPC bind authentication response.
1665 This is the packet that is sent back to the server once we
1666 have received a BIND-ACK, to finish the third leg of
1667 the authentication handshake.
1668 ********************************************************************/
1669
1670 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
1671 struct rpc_pipe_client *cli,
1672 uint32 rpc_call_id,
1673 enum dcerpc_AuthType auth_type,
1674 enum dcerpc_AuthLevel auth_level,
1675 DATA_BLOB *pauth_blob,
1676 DATA_BLOB *rpc_out)
1677 {
1678 NTSTATUS status;
1679 union dcerpc_payload u;
1680
1681 u.auth3._pad = 0;
1682
1683 status = dcerpc_push_dcerpc_auth(mem_ctx,
1684 auth_type,
1685 auth_level,
1686 0, /* auth_pad_length */
1687 1, /* auth_context_id */
1688 pauth_blob,
1689 &u.auth3.auth_info);
1690 if (!NT_STATUS_IS_OK(status)) {
1691 return status;
1692 }
1693
1694 status = dcerpc_push_ncacn_packet(mem_ctx,
1695 DCERPC_PKT_AUTH3,
1696 DCERPC_PFC_FLAG_FIRST |
1697 DCERPC_PFC_FLAG_LAST,
1698 pauth_blob->length,
1699 rpc_call_id,
1700 &u,
1701 rpc_out);
1702 data_blob_free(&u.auth3.auth_info);
1703 if (!NT_STATUS_IS_OK(status)) {
1704 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1705 return status;
1706 }
1707
1708 return NT_STATUS_OK;
1709 }
1710
1711 /*******************************************************************
1712 Creates a DCE/RPC bind alter context authentication request which
1713 may contain a spnego auth blobl
1714 ********************************************************************/
1715
1716 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
1717 enum dcerpc_AuthType auth_type,
1718 enum dcerpc_AuthLevel auth_level,
1719 uint32 rpc_call_id,
1720 const struct ndr_syntax_id *abstract,
1721 const struct ndr_syntax_id *transfer,
1722 const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
1723 DATA_BLOB *rpc_out)
1724 {
1725 DATA_BLOB auth_info;
1726 NTSTATUS status;
1727
1728 status = dcerpc_push_dcerpc_auth(mem_ctx,
1729 auth_type,
1730 auth_level,
1731 0, /* auth_pad_length */
1732 1, /* auth_context_id */
1733 pauth_blob,
1734 &auth_info);
1735 if (!NT_STATUS_IS_OK(status)) {
1736 return status;
1737 }
1738
1739 status = create_bind_or_alt_ctx_internal(mem_ctx,
1740 DCERPC_PKT_ALTER,
1741 rpc_call_id,
1742 abstract,
1743 transfer,
1744 &auth_info,
1745 rpc_out);
1746 data_blob_free(&auth_info);
1747 return status;
1748 }
1749
1750 /****************************************************************************
1751 Do an rpc bind.
1752 ****************************************************************************/
1753
1754 struct rpc_pipe_bind_state {
1755 struct event_context *ev;
1756 struct rpc_pipe_client *cli;
1757 DATA_BLOB rpc_out;
1758 uint32_t rpc_call_id;
1759 };
1760
1761 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
1762 static NTSTATUS rpc_finish_auth3_bind_send(struct tevent_req *req,
1763 struct rpc_pipe_bind_state *state,
1764 DATA_BLOB *credentials);
1765 static void rpc_bind_auth3_write_done(struct tevent_req *subreq);
1766 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct tevent_req *req,
1767 struct rpc_pipe_bind_state *state,
1768 DATA_BLOB *credentials);
1769 static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq);
1770 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1771 struct rpc_pipe_bind_state *state,
1772 DATA_BLOB *credentials);
1773 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1774 struct rpc_pipe_bind_state *state,
1775 DATA_BLOB *credentials);
1776
1777 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
1778 struct event_context *ev,
1779 struct rpc_pipe_client *cli,
1780 struct pipe_auth_data *auth)
1781 {
1782 struct tevent_req *req, *subreq;
1783 struct rpc_pipe_bind_state *state;
1784 NTSTATUS status;
1785
1786 req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
1787 if (req == NULL) {
1788 return NULL;
1789 }
1790
1791 DEBUG(5,("Bind RPC Pipe: %s auth_type %u(%u), auth_level %u\n",
1792 rpccli_pipe_txt(talloc_tos(), cli),
1793 (unsigned int)auth->auth_type,
1794 (unsigned int)auth->spnego_type,
1795 (unsigned int)auth->auth_level ));
1796
1797 state->ev = ev;
1798 state->cli = cli;
1799 state->rpc_call_id = get_rpc_call_id();
1800 state->rpc_out = data_blob_null;
1801
1802 cli->auth = talloc_move(cli, &auth);
1803
1804 /* Marshall the outgoing data. */
1805 status = create_rpc_bind_req(state, cli,
1806 cli->auth,
1807 state->rpc_call_id,
1808 &cli->abstract_syntax,
1809 &cli->transfer_syntax,
1810 &state->rpc_out);
1811
1812 if (!NT_STATUS_IS_OK(status)) {
1813 goto post_status;
1814 }
1815
1816 subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
1817 DCERPC_PKT_BIND_ACK);
1818 if (subreq == NULL) {
1819 goto fail;
1820 }
1821 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1822 return req;
1823
1824 post_status:
1825 tevent_req_nterror(req, status);
1826 return tevent_req_post(req, ev);
1827 fail:
1828 TALLOC_FREE(req);
1829 return NULL;
1830 }
1831
1832 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
1833 {
1834 struct tevent_req *req = tevent_req_callback_data(
1835 subreq, struct tevent_req);
1836 struct rpc_pipe_bind_state *state = tevent_req_data(
1837 req, struct rpc_pipe_bind_state);
1838 struct pipe_auth_data *pauth = state->cli->auth;
1839 DATA_BLOB reply_pdu;
1840 struct ncacn_packet *pkt;
1841 struct dcerpc_auth auth;
1842 DATA_BLOB auth_token = data_blob_null;
1843 NTSTATUS status;
1844
1845 status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, &reply_pdu);
1846 TALLOC_FREE(subreq);
1847 if (!NT_STATUS_IS_OK(status)) {
1848 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
1849 rpccli_pipe_txt(talloc_tos(), state->cli),
1850 nt_errstr(status)));
1851 tevent_req_nterror(req, status);
1852 return;
1853 }
1854
1855 if (!check_bind_response(&pkt->u.bind_ack, &state->cli->transfer_syntax)) {
1856 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
1857 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1858 return;
1859 }
1860
1861 state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
1862 state->cli->max_recv_frag = pkt->u.bind_ack.max_recv_frag;
1863
1864 switch(state->cli->auth->auth_type) {
1865
1866 case DCERPC_AUTH_TYPE_NONE:
1867 case DCERPC_AUTH_TYPE_SCHANNEL:
1868 /* Bind complete. */
1869 tevent_req_done(req);
1870 return;
1871
1872 case DCERPC_AUTH_TYPE_NTLMSSP:
1873 case DCERPC_AUTH_TYPE_SPNEGO:
1874 case DCERPC_AUTH_TYPE_KRB5:
1875 /* Paranoid lenght checks */
1876 if (pkt->frag_length < DCERPC_AUTH_TRAILER_LENGTH
1877 + pkt->auth_length) {
1878 tevent_req_nterror(req,
1879 NT_STATUS_INFO_LENGTH_MISMATCH);
1880 return;
1881 }
1882 /* get auth credentials */
1883 status = dcerpc_pull_dcerpc_auth(talloc_tos(),
1884 &pkt->u.bind_ack.auth_info,
1885 &auth, false);
1886 if (!NT_STATUS_IS_OK(status)) {
1887 DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
1888 nt_errstr(status)));
1889 tevent_req_nterror(req, status);
1890 return;
1891 }
1892 break;
1893
1894 default:
1895 goto err_out;
1896 }
1897
1898 /*
1899 * For authenticated binds we may need to do 3 or 4 leg binds.
1900 */
1901
1902 switch(state->cli->auth->auth_type) {
1903
1904 case DCERPC_AUTH_TYPE_NONE:
1905 case DCERPC_AUTH_TYPE_SCHANNEL:
1906 /* Bind complete. */
1907 tevent_req_done(req);
1908 return;
1909
1910 case DCERPC_AUTH_TYPE_NTLMSSP:
1911 /* Need to send AUTH3 packet - no reply. */
1912 status = rpc_finish_auth3_bind_send(req, state,
1913 &auth.credentials);
1914 break;
1915
1916 case DCERPC_AUTH_TYPE_SPNEGO:
1917 if (state->cli->auth->spnego_type !=
1918 PIPE_AUTH_TYPE_SPNEGO_NTLMSSP) {
1919 goto err_out;
1920 }
1921 /* Need to send alter context request and reply. */
1922 status = rpc_finish_spnego_ntlmssp_bind_send(req, state,
1923 &auth.credentials);
1924 break;
1925
1926 case DCERPC_AUTH_TYPE_KRB5:
1927 status = gse_get_client_auth_token(state,
1928 pauth->a_u.gssapi_state,
1929 &auth.credentials,
1930 &auth_token);
1931 if (!NT_STATUS_IS_OK(status)) {
1932 break;
1933 }
1934
1935 if (gse_require_more_processing(pauth->a_u.gssapi_state)) {
1936 status = rpc_bind_next_send(req, state, &auth_token);
1937 } else {
1938 status = rpc_bind_finish_send(req, state, &auth_token);
1939 }
1940 break;
1941
1942 default:
1943 goto err_out;
1944 }
1945
1946 if (!NT_STATUS_IS_OK(status)) {
1947 tevent_req_nterror(req, status);
1948 }
1949 return;
1950
1951 err_out:
1952 DEBUG(0,("cli_finish_bind_auth: unknown auth type %u(%u)\n",
1953 (unsigned int)state->cli->auth->auth_type,
1954 (unsigned int)state->cli->auth->spnego_type));
1955 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
1956 }
1957
1958 static NTSTATUS rpc_finish_auth3_bind_send(struct tevent_req *req,
1959 struct rpc_pipe_bind_state *state,
1960 DATA_BLOB *credentials)
1961 {
1962 struct pipe_auth_data *auth = state->cli->auth;
1963 DATA_BLOB client_reply = data_blob_null;
1964 struct tevent_req *subreq;
1965 NTSTATUS status;
1966
1967 /* TODO - check auth_type/auth_level match. */
1968
1969 status = auth_ntlmssp_update(auth->a_u.auth_ntlmssp_state,
1970 *credentials, &client_reply);
1971
1972 if (!NT_STATUS_IS_OK(status)) {
1973 DEBUG(0, ("rpc_finish_auth3_bind: NTLMSSP update using server "
1974 "blob failed: %s.\n", nt_errstr(status)));
1975 return status;
1976 }
1977
1978 data_blob_free(&state->rpc_out);
1979
1980 status = create_rpc_bind_auth3(state, state->cli,
1981 state->rpc_call_id,
1982 auth->auth_type,
1983 auth->auth_level,
1984 &client_reply,
1985 &state->rpc_out);
1986 data_blob_free(&client_reply);
1987
1988 if (!NT_STATUS_IS_OK(status)) {
1989 return status;
1990 }
1991
1992 subreq = rpc_write_send(state, state->ev, state->cli->transport,
1993 state->rpc_out.data, state->rpc_out.length);
1994 if (subreq == NULL) {
1995 return NT_STATUS_NO_MEMORY;
1996 }
1997 tevent_req_set_callback(subreq, rpc_bind_auth3_write_done, req);
1998 return NT_STATUS_OK;
1999 }
2000
2001 static void rpc_bind_auth3_write_done(struct tevent_req *subreq)
2002 {
2003 struct tevent_req *req = tevent_req_callback_data(
2004 subreq, struct tevent_req);
2005 NTSTATUS status;
2006
2007 status = rpc_write_recv(subreq);
2008 TALLOC_FREE(subreq);
2009 if (!NT_STATUS_IS_OK(status)) {
2010 tevent_req_nterror(req, status);
2011 return;
2012 }
2013 tevent_req_done(req);
2014 }
2015
2016 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct tevent_req *req,
2017 struct rpc_pipe_bind_state *state,
2018 DATA_BLOB *credentials)
2019 {
2020 struct pipe_auth_data *auth = state->cli->auth;
2021 DATA_BLOB server_ntlm_response = data_blob_null;
2022 DATA_BLOB client_reply = data_blob_null;
2023 DATA_BLOB tmp_blob = data_blob_null;
2024 struct tevent_req *subreq;
2025 NTSTATUS status;
2026
2027 /*
2028 * The server might give us back two challenges - tmp_blob is for the
2029 * second.
2030 */
2031 if (!spnego_parse_challenge(state, *credentials,
2032 &server_ntlm_response,
2033 &tmp_blob)) {
2034 data_blob_free(&server_ntlm_response);
2035 data_blob_free(&tmp_blob);
2036 return NT_STATUS_INVALID_PARAMETER;
2037 }
2038
2039 /* We're finished with the server spnego response and the tmp_blob. */
2040 data_blob_free(&tmp_blob);
2041
2042 status = auth_ntlmssp_update(auth->a_u.auth_ntlmssp_state,
2043 server_ntlm_response, &client_reply);
2044
2045 /* Finished with the server_ntlm response */
2046 data_blob_free(&server_ntlm_response);
2047
2048 if (!NT_STATUS_IS_OK(status)) {
2049 DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: NTLMSSP update "
2050 "using server blob failed.\n"));
2051 data_blob_free(&client_reply);
2052 return status;
2053 }
2054
2055 /* SPNEGO wrap the client reply. */
2056 tmp_blob = spnego_gen_auth(state, client_reply);
2057 data_blob_free(&client_reply);
2058 client_reply = tmp_blob;
2059 tmp_blob = data_blob_null;
2060
2061 /* Now prepare the alter context pdu. */
2062 data_blob_free(&state->rpc_out);
2063
2064 status = create_rpc_alter_context(state,
2065 auth->auth_type,
2066 auth->auth_level,
2067 state->rpc_call_id,
2068 &state->cli->abstract_syntax,
2069 &state->cli->transfer_syntax,
2070 &client_reply,
2071 &state->rpc_out);
2072 data_blob_free(&client_reply);
2073
2074 if (!NT_STATUS_IS_OK(status)) {
2075 return status;
2076 }
2077
2078 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2079 &state->rpc_out, DCERPC_PKT_ALTER_RESP);
2080 if (subreq == NULL) {
2081 return NT_STATUS_NO_MEMORY;
2082 }
2083 tevent_req_set_callback(subreq, rpc_bind_ntlmssp_api_done, req);
2084 return NT_STATUS_OK;
2085 }
2086
2087 static void rpc_bind_ntlmssp_api_done(struct tevent_req *subreq)
2088 {
2089 struct tevent_req *req = tevent_req_callback_data(
2090 subreq, struct tevent_req);
2091 struct rpc_pipe_bind_state *state = tevent_req_data(
2092 req, struct rpc_pipe_bind_state);
2093 DATA_BLOB tmp_blob = data_blob_null;
2094 struct ncacn_packet *pkt;
2095 struct dcerpc_auth auth;
2096 NTSTATUS status;
2097
2098 status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
2099 TALLOC_FREE(subreq);
2100 if (!NT_STATUS_IS_OK(status)) {
2101 tevent_req_nterror(req, status);
2102 return;
2103 }
2104
2105 status = dcerpc_pull_dcerpc_auth(pkt,
2106 &pkt->u.alter_resp.auth_info,
2107 &auth, false);
2108 if (!NT_STATUS_IS_OK(status)) {
2109 tevent_req_nterror(req, status);
2110 return;
2111 }
2112
2113 /* Check we got a valid auth response. */
2114 if (!spnego_parse_auth_response(talloc_tos(), auth.credentials,
2115 NT_STATUS_OK,
2116 OID_NTLMSSP, &tmp_blob)) {
2117 data_blob_free(&tmp_blob);
2118 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
2119 return;
2120 }
2121
2122 data_blob_free(&tmp_blob);
2123
2124 DEBUG(5,("rpc_finish_spnego_ntlmssp_bind: alter context request to "
2125 "%s.\n", rpccli_pipe_txt(talloc_tos(), state->cli)));
2126 tevent_req_done(req);
2127 }
2128
2129 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
2130 struct rpc_pipe_bind_state *state,
2131 DATA_BLOB *auth_token)
2132 {
2133 struct pipe_auth_data *auth = state->cli->auth;
2134 struct tevent_req *subreq;
2135 NTSTATUS status;
2136
2137 /* Now prepare the alter context pdu. */
2138 data_blob_free(&state->rpc_out);
2139
2140 status = create_rpc_alter_context(state,
2141 auth->auth_type,
2142 auth->auth_level,
2143 state->rpc_call_id,
2144 &state->cli->abstract_syntax,
2145 &state->cli->transfer_syntax,
2146 auth_token,
2147 &state->rpc_out);
2148 if (!NT_STATUS_IS_OK(status)) {
2149 return status;
2150 }
2151
2152 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2153 &state->rpc_out, DCERPC_PKT_ALTER_RESP);
2154 if (subreq == NULL) {
2155 return NT_STATUS_NO_MEMORY;
2156 }
2157 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
2158 return NT_STATUS_OK;
2159 }
2160
2161 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
2162 struct rpc_pipe_bind_state *state,
2163 DATA_BLOB *auth_token)
2164 {
2165 struct pipe_auth_data *auth = state->cli->auth;
2166 struct tevent_req *subreq;
2167 NTSTATUS status;
2168
2169 /* Now prepare the auth3 context pdu. */
2170 data_blob_free(&state->rpc_out);
2171
2172 status = create_rpc_bind_auth3(state, state->cli,
2173 state->rpc_call_id,
2174 auth->auth_type,
2175 auth->auth_level,
2176 auth_token,
2177 &state->rpc_out);
2178 if (!NT_STATUS_IS_OK(status)) {
2179 return status;
2180 }
2181
2182 subreq = rpc_write_send(state, state->ev, state->cli->transport,
2183 state->rpc_out.data, state->rpc_out.length);
2184 if (subreq == NULL) {
2185 return NT_STATUS_NO_MEMORY;
2186 }
2187 tevent_req_set_callback(subreq, rpc_bind_auth3_write_done, req);
2188 return NT_STATUS_OK;
2189 }
2190
2191 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
2192 {
2193 return tevent_req_simple_recv_ntstatus(req);
2194 }
2195
2196 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
2197 struct pipe_auth_data *auth)
2198 {
2199 TALLOC_CTX *frame = talloc_stackframe();
2200 struct event_context *ev;
2201 struct tevent_req *req;
2202 NTSTATUS status = NT_STATUS_OK;
2203
2204 ev = event_context_init(frame);
2205 if (ev == NULL) {
2206 status = NT_STATUS_NO_MEMORY;
2207 goto fail;
2208 }
2209
2210 req = rpc_pipe_bind_send(frame, ev, cli, auth);
2211 if (req == NULL) {
2212 status = NT_STATUS_NO_MEMORY;
2213 goto fail;
2214 }
2215
2216 if (!tevent_req_poll(req, ev)) {
2217 status = map_nt_error_from_unix(errno);
2218 goto fail;
2219 }
2220
2221 status = rpc_pipe_bind_recv(req);
2222 fail:
2223 TALLOC_FREE(frame);
2224 return status;
2225 }
2226
2227 #define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */
2228
2229 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
2230 unsigned int timeout)
2231 {
2232 unsigned int old;
2233
2234 if (rpc_cli->transport == NULL) {
2235 return RPCCLI_DEFAULT_TIMEOUT;
2236 }
2237
2238 if (rpc_cli->transport->set_timeout == NULL) {
2239 return RPCCLI_DEFAULT_TIMEOUT;
2240 }
2241
2242 old = rpc_cli->transport->set_timeout(rpc_cli->transport->priv, timeout);
2243 if (old == 0) {
2244 return RPCCLI_DEFAULT_TIMEOUT;
2245 }
2246
2247 return old;
2248 }
2249
2250 bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
2251 {
2252 if (rpc_cli == NULL) {
2253 return false;
2254 }
2255
2256 if (rpc_cli->transport == NULL) {
2257 return false;
2258 }
2259
2260 return rpc_cli->transport->is_connected(rpc_cli->transport->priv);
2261 }
2262
2263 bool rpccli_get_pwd_hash(struct rpc_pipe_client *rpc_cli, uint8_t nt_hash[16])
2264 {
2265 struct cli_state *cli;
2266
2267 if ((rpc_cli->auth->auth_type == DCERPC_AUTH_TYPE_NTLMSSP)
2268 || ((rpc_cli->auth->auth_type == DCERPC_AUTH_TYPE_SPNEGO
2269 && rpc_cli->auth->spnego_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2270 memcpy(nt_hash, auth_ntlmssp_get_nt_hash(rpc_cli->auth->a_u.auth_ntlmssp_state), 16);
2271 return true;
2272 }
2273
2274 cli = rpc_pipe_np_smb_conn(rpc_cli);
2275 if (cli == NULL) {
2276 return false;
2277 }
2278 E_md4hash(cli->password ? cli->password : "", nt_hash);
2279 return true;
2280 }
2281
2282 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2283 struct pipe_auth_data **presult)
2284 {
2285 struct pipe_auth_data *result;
2286
2287 result = talloc(mem_ctx, struct pipe_auth_data);
2288 if (result == NULL) {
2289 return NT_STATUS_NO_MEMORY;
2290 }
2291
2292 result->auth_type = DCERPC_AUTH_TYPE_NONE;
2293 result->spnego_type = PIPE_AUTH_TYPE_SPNEGO_NONE;
2294 result->auth_level = DCERPC_AUTH_LEVEL_NONE;
2295
2296 result->user_name = talloc_strdup(result, "");
2297 result->domain = talloc_strdup(result, "");
2298 if ((result->user_name == NULL) || (result->domain == NULL)) {
2299 TALLOC_FREE(result);
2300 return NT_STATUS_NO_MEMORY;
2301 }
2302
2303 *presult = result;
2304 return NT_STATUS_OK;
2305 }
2306
2307 static int cli_auth_ntlmssp_data_destructor(struct pipe_auth_data *auth)
2308 {
2309 TALLOC_FREE(auth->a_u.auth_ntlmssp_state);
2310 return 0;
2311 }
2312
2313 static NTSTATUS rpccli_ntlmssp_bind_data(TALLOC_CTX *mem_ctx,
2314 enum dcerpc_AuthType auth_type,
2315 enum pipe_auth_type_spnego spnego_type,
2316 enum dcerpc_AuthLevel auth_level,
2317 const char *domain,
2318 const char *username,
2319 const char *password,
2320 struct pipe_auth_data **presult)
2321 {
2322 struct pipe_auth_data *result;
2323 NTSTATUS status;
2324
2325 result = talloc(mem_ctx, struct pipe_auth_data);
2326 if (result == NULL) {
2327 return NT_STATUS_NO_MEMORY;
2328 }
2329
2330 result->auth_type = auth_type;
2331 result->spnego_type = spnego_type;
2332 result->auth_level = auth_level;
2333
2334 result->user_name = talloc_strdup(result, username);
2335 result->domain = talloc_strdup(result, domain);
2336 if ((result->user_name == NULL) || (result->domain == NULL)) {
2337 status = NT_STATUS_NO_MEMORY;
2338 goto fail;
2339 }
2340
2341 status = auth_ntlmssp_client_start(NULL,
2342 global_myname(),
2343 lp_workgroup(),
2344 lp_client_ntlmv2_auth(),
2345 &result->a_u.auth_ntlmssp_state);
2346 if (!NT_STATUS_IS_OK(status)) {
2347 goto fail;
2348 }
2349
2350 talloc_set_destructor(result, cli_auth_ntlmssp_data_destructor);
2351
2352 status = auth_ntlmssp_set_username(result->a_u.auth_ntlmssp_state,
2353 username);
2354 if (!NT_STATUS_IS_OK(status)) {
2355 goto fail;
2356 }
2357
2358 status = auth_ntlmssp_set_domain(result->a_u.auth_ntlmssp_state,
2359 domain);
2360 if (!NT_STATUS_IS_OK(status)) {
2361 goto fail;
2362 }
2363
2364 status = auth_ntlmssp_set_password(result->a_u.auth_ntlmssp_state,
2365 password);
2366 if (!NT_STATUS_IS_OK(status)) {
2367 goto fail;
2368 }
2369
2370 /*
2371 * Turn off sign+seal to allow selected auth level to turn it back on.
2372 */
2373 auth_ntlmssp_and_flags(result->a_u.auth_ntlmssp_state,
2374 ~(NTLMSSP_NEGOTIATE_SIGN |
2375 NTLMSSP_NEGOTIATE_SEAL));
2376
2377 if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
2378 auth_ntlmssp_or_flags(result->a_u.auth_ntlmssp_state,
2379 NTLMSSP_NEGOTIATE_SIGN);
2380 } else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
2381 auth_ntlmssp_or_flags(result->a_u.auth_ntlmssp_state,
2382 NTLMSSP_NEGOTIATE_SEAL |
2383 NTLMSSP_NEGOTIATE_SIGN);
2384 }
2385
2386 *presult = result;
2387 return NT_STATUS_OK;
2388
2389 fail:
2390 TALLOC_FREE(result);
2391 return status;
2392 }
2393
2394 NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
2395 enum dcerpc_AuthLevel auth_level,
2396 struct netlogon_creds_CredentialState *creds,
2397 struct pipe_auth_data **presult)
2398 {
2399 struct pipe_auth_data *result;
2400
2401 result = talloc(mem_ctx, struct pipe_auth_data);
2402 if (result == NULL) {
2403 return NT_STATUS_NO_MEMORY;
2404 }
2405
2406 result->auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
2407 result->spnego_type = PIPE_AUTH_TYPE_SPNEGO_NONE;
2408 result->auth_level = auth_level;
2409
2410 result->user_name = talloc_strdup(result, "");
2411 result->domain = talloc_strdup(result, domain);
2412 if ((result->user_name == NULL) || (result->domain == NULL)) {
2413 goto fail;
2414 }
2415
2416 result->a_u.schannel_auth = talloc(result, struct schannel_state);
2417 if (result->a_u.schannel_auth == NULL) {
2418 goto fail;
2419 }
2420
2421 result->a_u.schannel_auth->state = SCHANNEL_STATE_START;
2422 result->a_u.schannel_auth->seq_num = 0;
2423 result->a_u.schannel_auth->initiator = true;
2424 result->a_u.schannel_auth->creds = creds;
2425
2426 *presult = result;
2427 return NT_STATUS_OK;
2428
2429 fail:
2430 TALLOC_FREE(result);
2431 return NT_STATUS_NO_MEMORY;
2432 }
2433
2434 /**
2435 * Create an rpc pipe client struct, connecting to a tcp port.
2436 */
2437 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
2438 uint16_t port,
2439 const struct ndr_syntax_id *abstract_syntax,
2440 struct rpc_pipe_client **presult)
2441 {
2442 struct rpc_pipe_client *result;
2443 struct sockaddr_storage addr;
2444 NTSTATUS status;
2445 int fd;
2446
2447 result = TALLOC_ZERO_P(mem_ctx, struct rpc_pipe_client);
2448 if (result == NULL) {
2449 return NT_STATUS_NO_MEMORY;
2450 }
2451
2452 result->abstract_syntax = *abstract_syntax;
2453 result->transfer_syntax = ndr_transfer_syntax;
2454 result->dispatch = cli_do_rpc_ndr;
2455 result->dispatch_send = cli_do_rpc_ndr_send;
2456 result->dispatch_recv = cli_do_rpc_ndr_recv;
2457
2458 result->desthost = talloc_strdup(result, host);
2459 result->srv_name_slash = talloc_asprintf_strupper_m(
2460 result, "\\\\%s", result->desthost);
2461 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2462 status = NT_STATUS_NO_MEMORY;
2463 goto fail;
2464 }
2465
2466 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2467 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2468
2469 if (!resolve_name(host, &addr, 0, false)) {
2470 status = NT_STATUS_NOT_FOUND;
2471 goto fail;
2472 }
2473
2474 status = open_socket_out(&addr, port, 60, &fd);
2475 if (!NT_STATUS_IS_OK(status)) {
2476 goto fail;
2477 }
2478 set_socket_options(fd, lp_socket_options());
2479
2480 status = rpc_transport_sock_init(result, fd, &result->transport);
2481 if (!NT_STATUS_IS_OK(status)) {
2482 close(fd);
2483 goto fail;
2484 }
2485
2486 result->transport->transport = NCACN_IP_TCP;
2487
2488 *presult = result;
2489 return NT_STATUS_OK;
2490
2491 fail:
2492 TALLOC_FREE(result);
2493 return status;
2494 }
2495
2496 /**
2497 * Determine the tcp port on which a dcerpc interface is listening
2498 * for the ncacn_ip_tcp transport via the endpoint mapper of the
2499 * target host.
2500 */
2501 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
2502 const struct ndr_syntax_id *abstract_syntax,
2503 uint16_t *pport)
2504 {
2505 NTSTATUS status;
2506 struct rpc_pipe_client *epm_pipe = NULL;
2507 struct pipe_auth_data *auth = NULL;
2508 struct dcerpc_binding *map_binding = NULL;
2509 struct dcerpc_binding *res_binding = NULL;
2510 struct epm_twr_t *map_tower = NULL;
2511 struct epm_twr_t *res_towers = NULL;
2512 struct policy_handle *entry_handle = NULL;
2513 uint32_t num_towers = 0;
2514 uint32_t max_towers = 1;
2515 struct epm_twr_p_t towers;
2516 TALLOC_CTX *tmp_ctx = talloc_stackframe();
2517
2518 if (pport == NULL) {
2519 status = NT_STATUS_INVALID_PARAMETER;
2520 goto done;
2521 }
2522
2523 /* open the connection to the endpoint mapper */
2524 status = rpc_pipe_open_tcp_port(tmp_ctx, host, 135,
2525 &ndr_table_epmapper.syntax_id,
2526 &epm_pipe);
2527
2528 if (!NT_STATUS_IS_OK(status)) {
2529 goto done;
2530 }
2531
2532 status = rpccli_anon_bind_data(tmp_ctx, &auth);
2533 if (!NT_STATUS_IS_OK(status)) {
2534 goto done;
2535 }
2536
2537 status = rpc_pipe_bind(epm_pipe, auth);
2538 if (!NT_STATUS_IS_OK(status)) {
2539 goto done;
2540 }
2541
2542 /* create tower for asking the epmapper */
2543
2544 map_binding = TALLOC_ZERO_P(tmp_ctx, struct dcerpc_binding);
2545 if (map_binding == NULL) {
2546 status = NT_STATUS_NO_MEMORY;
2547 goto done;
2548 }
2549
2550 map_binding->transport = NCACN_IP_TCP;
2551 map_binding->object = *abstract_syntax;
2552 map_binding->host = host; /* needed? */
2553 map_binding->endpoint = "0"; /* correct? needed? */
2554
2555 map_tower = TALLOC_ZERO_P(tmp_ctx, struct epm_twr_t);
2556 if (map_tower == NULL) {
2557 status = NT_STATUS_NO_MEMORY;
2558 goto done;
2559 }
2560
2561 status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
2562 &(map_tower->tower));
2563 if (!NT_STATUS_IS_OK(status)) {
2564 goto done;
2565 }
2566
2567 /* allocate further parameters for the epm_Map call */
2568
2569 res_towers = TALLOC_ARRAY(tmp_ctx, struct epm_twr_t, max_towers);
2570 if (res_towers == NULL) {
2571 status = NT_STATUS_NO_MEMORY;
2572 goto done;
2573 }
2574 towers.twr = res_towers;
2575
2576 entry_handle = TALLOC_ZERO_P(tmp_ctx, struct policy_handle);
2577 if (entry_handle == NULL) {
2578 status = NT_STATUS_NO_MEMORY;
2579 goto done;
2580 }
2581
2582 /* ask the endpoint mapper for the port */
2583
2584 status = rpccli_epm_Map(epm_pipe,
2585 tmp_ctx,
2586 CONST_DISCARD(struct GUID *,
2587 &(abstract_syntax->uuid)),
2588 map_tower,
2589 entry_handle,
2590 max_towers,
2591 &num_towers,
2592 &towers);
2593
2594 if (!NT_STATUS_IS_OK(status)) {
2595 goto done;
2596 }
2597
2598 if (num_towers != 1) {
2599 status = NT_STATUS_UNSUCCESSFUL;
2600 goto done;
2601 }
2602
2603 /* extract the port from the answer */
2604
2605 status = dcerpc_binding_from_tower(tmp_ctx,
2606 &(towers.twr->tower),
2607 &res_binding);
2608 if (!NT_STATUS_IS_OK(status)) {
2609 goto done;
2610 }
2611
2612 /* are further checks here necessary? */
2613 if (res_binding->transport != NCACN_IP_TCP) {
2614 status = NT_STATUS_UNSUCCESSFUL;
2615 goto done;
2616 }
2617
2618 *pport = (uint16_t)atoi(res_binding->endpoint);
2619
2620 done:
2621 TALLOC_FREE(tmp_ctx);
2622 return status;
2623 }
2624
2625 /**
2626 * Create a rpc pipe client struct, connecting to a host via tcp.
2627 * The port is determined by asking the endpoint mapper on the given
2628 * host.
2629 */
2630 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
2631 const struct ndr_syntax_id *abstract_syntax,
2632 struct rpc_pipe_client **presult)
2633 {
2634 NTSTATUS status;
2635 uint16_t port = 0;
2636
2637 status = rpc_pipe_get_tcp_port(host, abstract_syntax, &port);
2638 if (!NT_STATUS_IS_OK(status)) {
2639 return status;
2640 }
2641
2642 return rpc_pipe_open_tcp_port(mem_ctx, host, port,
2643 abstract_syntax, presult);
2644 }
2645
2646 /********************************************************************
2647 Create a rpc pipe client struct, connecting to a unix domain socket
2648 ********************************************************************/
2649 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
2650 const struct ndr_syntax_id *abstract_syntax,
2651 struct rpc_pipe_client **presult)
2652 {
2653 struct rpc_pipe_client *result;
2654 struct sockaddr_un addr;
2655 NTSTATUS status;
2656 int fd;
2657
2658 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2659 if (result == NULL) {
2660 return NT_STATUS_NO_MEMORY;
2661 }
2662
2663 result->abstract_syntax = *abstract_syntax;
2664 result->transfer_syntax = ndr_transfer_syntax;
2665 result->dispatch = cli_do_rpc_ndr;
2666 result->dispatch_send = cli_do_rpc_ndr_send;
2667 result->dispatch_recv = cli_do_rpc_ndr_recv;
2668
2669 result->desthost = get_myname(result);
2670 result->srv_name_slash = talloc_asprintf_strupper_m(
2671 result, "\\\\%s", result->desthost);
2672 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2673 status = NT_STATUS_NO_MEMORY;
2674 goto fail;
2675 }
2676
2677 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2678 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2679
2680 fd = socket(AF_UNIX, SOCK_STREAM, 0);
2681 if (fd == -1) {
2682 status = map_nt_error_from_unix(errno);
2683 goto fail;
2684 }
2685
2686 ZERO_STRUCT(addr);
2687 addr.sun_family = AF_UNIX;
2688 strncpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
2689
2690 if (sys_connect(fd, (struct sockaddr *)(void *)&addr) == -1) {
2691 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
2692 strerror(errno)));
2693 close(fd);
2694 return map_nt_error_from_unix(errno);
2695 }
2696
2697 status = rpc_transport_sock_init(result, fd, &result->transport);
2698 if (!NT_STATUS_IS_OK(status)) {
2699 close(fd);
2700 goto fail;
2701 }
2702
2703 result->transport->transport = NCALRPC;
2704
2705 *presult = result;
2706 return NT_STATUS_OK;
2707
2708 fail:
2709 TALLOC_FREE(result);
2710 return status;
2711 }
2712
2713 struct rpc_pipe_client_np_ref {
2714 struct cli_state *cli;
2715 struct rpc_pipe_client *pipe;
2716 };
2717
2718 static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
2719 {
2720 DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
2721 return 0;
2722 }
2723
2724 /****************************************************************************
2725 Open a named pipe over SMB to a remote server.
2726 *
2727 * CAVEAT CALLER OF THIS FUNCTION:
2728 * The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
2729 * so be sure that this function is called AFTER any structure (vs pointer)
2730 * assignment of the cli. In particular, libsmbclient does structure
2731 * assignments of cli, which invalidates the data in the returned
2732 * rpc_pipe_client if this function is called before the structure assignment
2733 * of cli.
2734 *
2735 ****************************************************************************/
2736
2737 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
2738 const struct ndr_syntax_id *abstract_syntax,
2739 struct rpc_pipe_client **presult)
2740 {
2741 struct rpc_pipe_client *result;
2742 NTSTATUS status;
2743 struct rpc_pipe_client_np_ref *np_ref;
2744
2745 /* sanity check to protect against crashes */
2746
2747 if ( !cli ) {
2748 return NT_STATUS_INVALID_HANDLE;
2749 }
2750
2751 result = TALLOC_ZERO_P(NULL, struct rpc_pipe_client);
2752 if (result == NULL) {
2753 return NT_STATUS_NO_MEMORY;
2754 }
2755
2756 result->abstract_syntax = *abstract_syntax;
2757 result->transfer_syntax = ndr_transfer_syntax;
2758 result->dispatch = cli_do_rpc_ndr;
2759 result->dispatch_send = cli_do_rpc_ndr_send;
2760 result->dispatch_recv = cli_do_rpc_ndr_recv;
2761 result->desthost = talloc_strdup(result, cli->desthost);
2762 result->srv_name_slash = talloc_asprintf_strupper_m(
2763 result, "\\\\%s", result->desthost);
2764
2765 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2766 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2767
2768 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2769 TALLOC_FREE(result);
2770 return NT_STATUS_NO_MEMORY;
2771 }
2772
2773 status = rpc_transport_np_init(result, cli, abstract_syntax,
2774 &result->transport);
2775 if (!NT_STATUS_IS_OK(status)) {
2776 TALLOC_FREE(result);
2777 return status;
2778 }
2779
2780 result->transport->transport = NCACN_NP;
2781
2782 np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
2783 if (np_ref == NULL) {
2784 TALLOC_FREE(result);
2785 return NT_STATUS_NO_MEMORY;
2786 }
2787 np_ref->cli = cli;
2788 np_ref->pipe = result;
2789
2790 DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
2791 talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
2792
2793 *presult = result;
2794 return NT_STATUS_OK;
2795 }
2796
2797 NTSTATUS rpc_pipe_open_local(TALLOC_CTX *mem_ctx,
2798 struct rpc_cli_smbd_conn *conn,
2799 const struct ndr_syntax_id *syntax,
2800 struct rpc_pipe_client **presult)
2801 {
2802 struct rpc_pipe_client *result;
2803 struct pipe_auth_data *auth;
2804 NTSTATUS status;
2805
2806 result = talloc(mem_ctx, struct rpc_pipe_client);
2807 if (result == NULL) {
2808 return NT_STATUS_NO_MEMORY;
2809 }
2810 result->abstract_syntax = *syntax;
2811 result->transfer_syntax = ndr_transfer_syntax;
2812 result->dispatch = cli_do_rpc_ndr;
2813 result->dispatch_send = cli_do_rpc_ndr_send;
2814 result->dispatch_recv = cli_do_rpc_ndr_recv;
2815 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2816 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2817
2818 result->desthost = talloc_strdup(result, global_myname());
2819 result->srv_name_slash = talloc_asprintf_strupper_m(
2820 result, "\\\\%s", global_myname());
2821 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2822 TALLOC_FREE(result);
2823 return NT_STATUS_NO_MEMORY;
2824 }
2825
2826 status = rpc_transport_smbd_init(result, conn, syntax,
2827 &result->transport);
2828 if (!NT_STATUS_IS_OK(status)) {
2829 DEBUG(1, ("rpc_transport_smbd_init failed: %s\n",
2830 nt_errstr(status)));
2831 TALLOC_FREE(result);
2832 return status;
2833 }
2834
2835 status = rpccli_anon_bind_data(result, &auth);
2836 if (!NT_STATUS_IS_OK(status)) {
2837 DEBUG(1, ("rpccli_anon_bind_data failed: %s\n",
2838 nt_errstr(status)));
2839 TALLOC_FREE(result);
2840 return status;
2841 }
2842
2843 status = rpc_pipe_bind(result, auth);
2844 if (!NT_STATUS_IS_OK(status)) {
2845 DEBUG(1, ("rpc_pipe_bind failed: %s\n", nt_errstr(status)));
2846 TALLOC_FREE(result);
2847 return status;
2848 }
2849
2850 result->transport->transport = NCACN_INTERNAL;
2851
2852 *presult = result;
2853 return NT_STATUS_OK;
2854 }
2855
2856 /****************************************************************************
2857 Open a pipe to a remote server.
2858 ****************************************************************************/
2859
2860 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
2861 enum dcerpc_transport_t transport,
2862 const struct ndr_syntax_id *interface,
2863 struct rpc_pipe_client **presult)
2864 {
2865 switch (transport) {
2866 case NCACN_IP_TCP:
2867 return rpc_pipe_open_tcp(NULL, cli->desthost, interface,
2868 presult);
2869 case NCACN_NP:
2870 return rpc_pipe_open_np(cli, interface, presult);
2871 default:
2872 return NT_STATUS_NOT_IMPLEMENTED;
2873 }
2874 }
2875
2876 /****************************************************************************
2877 Open a named pipe to an SMB server and bind anonymously.
2878 ****************************************************************************/
2879
2880 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
2881 enum dcerpc_transport_t transport,
2882 const struct ndr_syntax_id *interface,
2883 struct rpc_pipe_client **presult)
2884 {
2885 struct rpc_pipe_client *result;
2886 struct pipe_auth_data *auth;
2887 NTSTATUS status;
2888
2889 status = cli_rpc_pipe_open(cli, transport, interface, &result);
2890 if (!NT_STATUS_IS_OK(status)) {
2891 return status;
2892 }
2893
2894 status = rpccli_anon_bind_data(result, &auth);
2895 if (!NT_STATUS_IS_OK(status)) {
2896 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
2897 nt_errstr(status)));
2898 TALLOC_FREE(result);
2899 return status;
2900 }
2901
2902 /*
2903 * This is a bit of an abstraction violation due to the fact that an
2904 * anonymous bind on an authenticated SMB inherits the user/domain
2905 * from the enclosing SMB creds
2906 */
2907
2908 TALLOC_FREE(auth->user_name);
2909 TALLOC_FREE(auth->domain);
2910
2911 auth->user_name = talloc_strdup(auth, cli->user_name);
2912 auth->domain = talloc_strdup(auth, cli->domain);
2913 auth->user_session_key = data_blob_talloc(auth,
2914 cli->user_session_key.data,
2915 cli->user_session_key.length);
2916
2917 if ((auth->user_name == NULL) || (auth->domain == NULL)) {
2918 TALLOC_FREE(result);
2919 return NT_STATUS_NO_MEMORY;
2920 }
2921
2922 status = rpc_pipe_bind(result, auth);
2923 if (!NT_STATUS_IS_OK(status)) {
2924 int lvl = 0;
2925 if (ndr_syntax_id_equal(interface,
2926 &ndr_table_dssetup.syntax_id)) {
2927 /* non AD domains just don't have this pipe, avoid
2928 * level 0 statement in that case - gd */
2929 lvl = 3;
2930 }
2931 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
2932 "%s failed with error %s\n",
2933 get_pipe_name_from_syntax(talloc_tos(), interface),
2934 nt_errstr(status) ));
2935 TALLOC_FREE(result);
2936 return status;
2937 }
2938
2939 DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
2940 "%s and bound anonymously.\n",
2941 get_pipe_name_from_syntax(talloc_tos(), interface),
2942 cli->desthost));
2943
2944 *presult = result;
2945 return NT_STATUS_OK;
2946 }
2947
2948 /****************************************************************************
2949 ****************************************************************************/
2950
2951 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
2952 const struct ndr_syntax_id *interface,
2953 struct rpc_pipe_client **presult)
2954 {
2955 return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
2956 interface, presult);
2957 }
2958
2959 /****************************************************************************
2960 Open a named pipe to an SMB server and bind using NTLMSSP or SPNEGO NTLMSSP
2961 ****************************************************************************/
2962
2963 static NTSTATUS cli_rpc_pipe_open_ntlmssp_internal(struct cli_state *cli,
2964 const struct ndr_syntax_id *interface,
2965 enum dcerpc_transport_t transport,
2966 bool use_spnego,
2967 enum dcerpc_AuthLevel auth_level,
2968 const char *domain,
2969 const char *username,
2970 const char *password,
2971 struct rpc_pipe_client **presult)
2972 {
2973 struct rpc_pipe_client *result;
2974 struct pipe_auth_data *auth;
2975 enum dcerpc_AuthType auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
2976 enum pipe_auth_type_spnego spnego_type = PIPE_AUTH_TYPE_SPNEGO_NONE;
2977 NTSTATUS status;
2978
2979 status = cli_rpc_pipe_open(cli, transport, interface, &result);
2980 if (!NT_STATUS_IS_OK(status)) {
2981 return status;
2982 }
2983
2984 if (use_spnego) {
2985 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
2986 spnego_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
2987 }
2988
2989 status = rpccli_ntlmssp_bind_data(result,
2990 auth_type, spnego_type, auth_level,
2991 domain, username, password,
2992 &auth);
2993 if (!NT_STATUS_IS_OK(status)) {
2994 DEBUG(0, ("rpccli_ntlmssp_bind_data returned %s\n",
2995 nt_errstr(status)));
2996 goto err;
2997 }
2998
2999 status = rpc_pipe_bind(result, auth);
3000 if (!NT_STATUS_IS_OK(status)) {
3001 DEBUG(0, ("cli_rpc_pipe_open_ntlmssp_internal: cli_rpc_pipe_bind failed with error %s\n",
3002 nt_errstr(status) ));
3003 goto err;
3004 }
3005
3006 DEBUG(10,("cli_rpc_pipe_open_ntlmssp_internal: opened pipe %s to "
3007 "machine %s and bound NTLMSSP as user %s\\%s.\n",
3008 get_pipe_name_from_syntax(talloc_tos(), interface),
3009 cli->desthost, domain, username ));
3010
3011 *presult = result;
3012 return NT_STATUS_OK;
3013
3014 err:
3015
3016 TALLOC_FREE(result);
3017 return status;
3018 }
3019
3020 /****************************************************************************
3021 External interface.
3022 Open a named pipe to an SMB server and bind using NTLMSSP (bind type 10)
3023 ****************************************************************************/
3024
3025 NTSTATUS cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
3026 const struct ndr_syntax_id *interface,
3027 enum dcerpc_transport_t transport,
3028 enum dcerpc_AuthLevel auth_level,
3029 const char *domain,
3030 const char *username,
3031 const char *password,
3032 struct rpc_pipe_client **presult)
3033 {
3034 return cli_rpc_pipe_open_ntlmssp_internal(cli,
3035 interface,
3036 transport,
3037 false,
3038 auth_level,
3039 domain,
3040 username,
3041 password,
3042 presult);
3043 }
3044
3045 /****************************************************************************
3046 External interface.
3047 Open a named pipe to an SMB server and bind using spnego NTLMSSP (bind type 9)
3048 ****************************************************************************/
3049
3050 NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
3051 const struct ndr_syntax_id *interface,
3052 enum dcerpc_transport_t transport,
3053 enum dcerpc_AuthLevel auth_level,
3054 const char *domain,
3055 const char *username,
3056 const char *password,
3057 struct rpc_pipe_client **presult)
3058 {
3059 return cli_rpc_pipe_open_ntlmssp_internal(cli,
3060 interface,
3061 transport,
3062 true,
3063 auth_level,
3064 domain,
3065 username,
3066 password,
3067 presult);
3068 }
3069
3070 /****************************************************************************
3071 Get a the schannel session key out of an already opened netlogon pipe.
3072 ****************************************************************************/
3073 static NTSTATUS get_schannel_session_key_common(struct rpc_pipe_client *netlogon_pipe,
3074 struct cli_state *cli,
3075 const char *domain,
3076 uint32 *pneg_flags)
3077 {
3078 enum netr_SchannelType sec_chan_type = 0;
3079 unsigned char machine_pwd[16];
3080 const char *machine_account;
3081 NTSTATUS status;
3082
3083 /* Get the machine account credentials from secrets.tdb. */
3084 if (!get_trust_pw_hash(domain, machine_pwd, &machine_account,
3085 &sec_chan_type))
3086 {
3087 DEBUG(0, ("get_schannel_session_key: could not fetch "
3088 "trust account password for domain '%s'\n",
3089 domain));
3090 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
3091 }
3092
3093 status = rpccli_netlogon_setup_creds(netlogon_pipe,
3094 cli->desthost, /* server name */
3095 domain, /* domain */
3096 global_myname(), /* client name */
3097 machine_account, /* machine account name */
3098 machine_pwd,
3099 sec_chan_type,
3100 pneg_flags);
3101
3102 if (!NT_STATUS_IS_OK(status)) {
3103 DEBUG(3, ("get_schannel_session_key_common: "
3104 "rpccli_netlogon_setup_creds failed with result %s "
3105 "to server %s, domain %s, machine account %s.\n",
3106 nt_errstr(status), cli->desthost, domain,
3107 machine_account ));
3108 return status;
3109 }
3110
3111 if (((*pneg_flags) & NETLOGON_NEG_SCHANNEL) == 0) {
3112 DEBUG(3, ("get_schannel_session_key: Server %s did not offer schannel\n",
3113 cli->desthost));
3114 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3115 }
3116
3117 return NT_STATUS_OK;;
3118 }
3119
3120 /****************************************************************************
3121 Open a netlogon pipe and get the schannel session key.
3122 Now exposed to external callers.
3123 ****************************************************************************/
3124
3125
3126 NTSTATUS get_schannel_session_key(struct cli_state *cli,
3127 const char *domain,
3128 uint32 *pneg_flags,
3129 struct rpc_pipe_client **presult)
3130 {
3131 struct rpc_pipe_client *netlogon_pipe = NULL;
3132 NTSTATUS status;
3133
3134 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
3135 &netlogon_pipe);
3136 if (!NT_STATUS_IS_OK(status)) {
3137 return status;
3138 }
3139
3140 status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
3141 pneg_flags);
3142 if (!NT_STATUS_IS_OK(status)) {
3143 TALLOC_FREE(netlogon_pipe);
3144 return status;
3145 }
3146
3147 *presult = netlogon_pipe;
3148 return NT_STATUS_OK;
3149 }
3150
3151 /****************************************************************************
3152 External interface.
3153 Open a named pipe to an SMB server and bind using schannel (bind type 68)
3154 using session_key. sign and seal.
3155
3156 The *pdc will be stolen onto this new pipe
3157 ****************************************************************************/
3158
3159 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
3160 const struct ndr_syntax_id *interface,
3161 enum dcerpc_transport_t transport,
3162 enum dcerpc_AuthLevel auth_level,
3163 const char *domain,
3164 struct netlogon_creds_CredentialState **pdc,
3165 struct rpc_pipe_client **presult)
3166 {
3167 struct rpc_pipe_client *result;
3168 struct pipe_auth_data *auth;
3169 NTSTATUS status;
3170
3171 status = cli_rpc_pipe_open(cli, transport, interface, &result);
3172 if (!NT_STATUS_IS_OK(status)) {
3173 return status;
3174 }
3175
3176 status = rpccli_schannel_bind_data(result, domain, auth_level,
3177 *pdc, &auth);
3178 if (!NT_STATUS_IS_OK(status)) {
3179 DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
3180 nt_errstr(status)));
3181 TALLOC_FREE(result);
3182 return status;
3183 }
3184
3185 status = rpc_pipe_bind(result, auth);
3186 if (!NT_STATUS_IS_OK(status)) {
3187 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
3188 "cli_rpc_pipe_bind failed with error %s\n",
3189 nt_errstr(status) ));
3190 TALLOC_FREE(result);
3191 return status;
3192 }
3193
3194 /*
3195 * The credentials on a new netlogon pipe are the ones we are passed
3196 * in - reference them in
3197 */
3198 result->dc = talloc_move(result, pdc);
3199
3200 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
3201 "for domain %s and bound using schannel.\n",
3202 get_pipe_name_from_syntax(talloc_tos(), interface),
3203 cli->desthost, domain ));
3204
3205 *presult = result;
3206 return NT_STATUS_OK;
3207 }
3208
3209 /****************************************************************************
3210 Open a named pipe to an SMB server and bind using schannel (bind type 68).
3211 Fetch the session key ourselves using a temporary netlogon pipe. This
3212 version uses an ntlmssp auth bound netlogon pipe to get the key.
3213 ****************************************************************************/
3214
3215 static NTSTATUS get_schannel_session_key_auth_ntlmssp(struct cli_state *cli,
3216 const char *domain,
3217 const char *username,
3218 const char *password,
3219 uint32 *pneg_flags,
3220 struct rpc_pipe_client **presult)
3221 {
3222 struct rpc_pipe_client *netlogon_pipe = NULL;
3223 NTSTATUS status;
3224
3225 status = cli_rpc_pipe_open_spnego_ntlmssp(
3226 cli, &ndr_table_netlogon.syntax_id, NCACN_NP,
3227 DCERPC_AUTH_LEVEL_PRIVACY,
3228 domain, username, password, &netlogon_pipe);
3229 if (!NT_STATUS_IS_OK(status)) {
3230 return status;
3231 }
3232
3233 status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
3234 pneg_flags);
3235 if (!NT_STATUS_IS_OK(status)) {
3236 TALLOC_FREE(netlogon_pipe);
3237 return status;
3238 }
3239
3240 *presult = netlogon_pipe;
3241 return NT_STATUS_OK;
3242 }
3243
3244 /****************************************************************************
3245 Open a named pipe to an SMB server and bind using schannel (bind type 68).
3246 Fetch the session key ourselves using a temporary netlogon pipe. This version
3247 uses an ntlmssp bind to get the session key.
3248 ****************************************************************************/
3249
3250 NTSTATUS cli_rpc_pipe_open_ntlmssp_auth_schannel(struct cli_state *cli,
3251 const struct ndr_syntax_id *interface,
3252 enum dcerpc_transport_t transport,
3253 enum dcerpc_AuthLevel auth_level,
3254 const char *domain,
3255 const char *username,
3256 const char *password,
3257 struct rpc_pipe_client **presult)
3258 {
3259 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
3260 struct rpc_pipe_client *netlogon_pipe = NULL;
3261 struct rpc_pipe_client *result = NULL;
3262 NTSTATUS status;
3263
3264 status = get_schannel_session_key_auth_ntlmssp(
3265 cli, domain, username, password, &neg_flags, &netlogon_pipe);
3266 if (!NT_STATUS_IS_OK(status)) {
3267 DEBUG(0,("cli_rpc_pipe_open_ntlmssp_auth_schannel: failed to get schannel session "
3268 "key from server %s for domain %s.\n",
3269 cli->desthost, domain ));
3270 return status;
3271 }
3272
3273 status = cli_rpc_pipe_open_schannel_with_key(
3274 cli, interface, transport, auth_level, domain, &netlogon_pipe->dc,
3275 &result);
3276
3277 /* Now we've bound using the session key we can close the netlog pipe. */
3278 TALLOC_FREE(netlogon_pipe);
3279
3280 if (NT_STATUS_IS_OK(status)) {
3281 *presult = result;
3282 }
3283 return status;
3284 }
3285
3286 /****************************************************************************
3287 Open a named pipe to an SMB server and bind using schannel (bind type 68).
3288 Fetch the session key ourselves using a temporary netlogon pipe.
3289 ****************************************************************************/
3290
3291 NTSTATUS cli_rpc_pipe_open_schannel(struct cli_state *cli,
3292 const struct ndr_syntax_id *interface,
3293 enum dcerpc_transport_t transport,
3294 enum dcerpc_AuthLevel auth_level,
3295 const char *domain,
3296 struct rpc_pipe_client **presult)
3297 {
3298 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
3299 struct rpc_pipe_client *netlogon_pipe = NULL;
3300 struct rpc_pipe_client *result = NULL;
3301 NTSTATUS status;
3302
3303 status = get_schannel_session_key(cli, domain, &neg_flags,
3304 &netlogon_pipe);
3305 if (!NT_STATUS_IS_OK(status)) {
3306 DEBUG(0,("cli_rpc_pipe_open_schannel: failed to get schannel session "
3307 "key from server %s for domain %s.\n",
3308 cli->desthost, domain ));
3309 return status;
3310 }
3311
3312 status = cli_rpc_pipe_open_schannel_with_key(
3313 cli, interface, transport, auth_level, domain, &netlogon_pipe->dc,
3314 &result);
3315
3316 /* Now we've bound using the session key we can close the netlog pipe. */
3317 TALLOC_FREE(netlogon_pipe);
3318
3319 if (NT_STATUS_IS_OK(status)) {
3320 *presult = result;
3321 }
3322
3323 return status;
3324 }
3325
3326 /****************************************************************************
3327 Open a named pipe to an SMB server and bind using krb5 (bind type 16).
3328 The idea is this can be called with service_princ, username and password all
3329 NULL so long as the caller has a TGT.
3330 ****************************************************************************/
3331
3332 NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
3333 const struct ndr_syntax_id *interface,
3334 enum dcerpc_transport_t transport,
3335 enum dcerpc_AuthLevel auth_level,
3336 const char *server,
3337 const char *username,
3338 const char *password,
3339 struct rpc_pipe_client **presult)
3340 {
3341 #ifdef HAVE_GSSAPI_H
3342 struct rpc_pipe_client *result;
3343 struct pipe_auth_data *auth;
3344 NTSTATUS status;
3345
3346 status = cli_rpc_pipe_open(cli, transport, interface, &result);
3347 if (!NT_STATUS_IS_OK(status)) {
3348 return status;
3349 }
3350
3351 status = gse_init_client(result, DCERPC_AUTH_TYPE_KRB5, auth_level,
3352 NULL, server, "cifs", username, password,
3353 GSS_C_DCE_STYLE, &auth);
3354
3355 if (!NT_STATUS_IS_OK(status)) {
3356 DEBUG(0, ("gse_init_client returned %s\n",
3357 nt_errstr(status)));
3358 TALLOC_FREE(result);
3359 return status;
3360 }
3361
3362 status = rpc_pipe_bind(result, auth);
3363 if (!NT_STATUS_IS_OK(status)) {
3364 DEBUG(0, ("cli_rpc_pipe_open_krb5: cli_rpc_pipe_bind failed "
3365 "with error %s\n", nt_errstr(status)));
3366 TALLOC_FREE(result);
3367 return status;
3368 }
3369
3370 *presult = result;
3371 return NT_STATUS_OK;
3372 #else
3373 DEBUG(0,("cli_rpc_pipe_open_krb5: kerberos not found at compile time.\n"));
3374 return NT_STATUS_NOT_IMPLEMENTED;
3375 #endif
3376 }
3377
3378 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
3379 struct rpc_pipe_client *cli,
3380 DATA_BLOB *session_key)
3381 {
3382 struct pipe_auth_data *a = cli->auth;
3383 DATA_BLOB sk;
3384
3385 if (!session_key || !cli) {
3386 return NT_STATUS_INVALID_PARAMETER;
3387 }
3388
3389 if (!cli->auth) {
3390 return NT_STATUS_INVALID_PARAMETER;
3391 }
3392
3393 switch (cli->auth->auth_type) {
3394 case DCERPC_AUTH_TYPE_SCHANNEL:
3395 sk = data_blob_const(a->a_u.schannel_auth->creds->session_key,
3396 16);
3397 break;
3398 case DCERPC_AUTH_TYPE_SPNEGO:
3399 switch (cli->auth->spnego_type) {
3400 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
3401 sk = auth_ntlmssp_get_session_key(
3402 a->a_u.auth_ntlmssp_state);
3403 break;
3404 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
3405 sk = gse_get_session_key(a->a_u.gssapi_state);
3406 break;
3407 default:
3408 return NT_STATUS_NO_USER_SESSION_KEY;
3409 }
3410 break;
3411 case DCERPC_AUTH_TYPE_NTLMSSP:
3412 sk = auth_ntlmssp_get_session_key(a->a_u.auth_ntlmssp_state);
3413 break;
3414 case DCERPC_AUTH_TYPE_KRB5:
3415 sk = gse_get_session_key(a->a_u.gssapi_state);
3416 break;
3417 case DCERPC_AUTH_TYPE_NONE:
3418 sk = data_blob_const(a->user_session_key.data,
3419 a->user_session_key.length);
3420 break;
3421 default:
3422 return NT_STATUS_NO_USER_SESSION_KEY;
3423 }
3424
3425 *session_key = data_blob_dup_talloc(mem_ctx, &sk);
3426 return NT_STATUS_OK;
3427 }
Samba GIT mirror