?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3:rpc_client: remove netr_LogonGetCapabilities check from rpc_pipe_bind*
[Samba.git] / source3 / rpc_client / cli_pipe.c
blob25c7a44ceac72cffdb51aa4ae00ead714f0df2f3
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client routines
4 * Largely rewritten by Jeremy Allison 2005.
5 * Heavily modified by Simo Sorce 2010.
6 * Copyright Andrew Bartlett 2011.
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "../lib/util/tevent_ntstatus.h"
24 #include "librpc/gen_ndr/ndr_epmapper_c.h"
25 #include "../librpc/gen_ndr/ndr_schannel.h"
26 #include "../librpc/gen_ndr/ndr_dssetup.h"
27 #include "../libcli/auth/schannel.h"
28 #include "../libcli/auth/spnego.h"
29 #include "../auth/ntlmssp/ntlmssp.h"
30 #include "auth_generic.h"
31 #include "librpc/gen_ndr/ndr_dcerpc.h"
32 #include "librpc/gen_ndr/ndr_netlogon_c.h"
33 #include "librpc/rpc/dcerpc.h"
34 #include "rpc_dce.h"
35 #include "cli_pipe.h"
36 #include "libsmb/libsmb.h"
37 #include "auth/gensec/gensec.h"
38 #include "auth/credentials/credentials.h"
39 #include "../libcli/smb/smbXcli_base.h"
40
41 #undef DBGC_CLASS
42 #define DBGC_CLASS DBGC_RPC_CLI
43
44 /********************************************************************
45 Pipe description for a DEBUG
46 ********************************************************************/
47 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
48 struct rpc_pipe_client *cli)
49 {
50 char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
51 if (result == NULL) {
52 return "pipe";
53 }
54 return result;
55 }
56
57 /********************************************************************
58 Rpc pipe call id.
59 ********************************************************************/
60
61 static uint32 get_rpc_call_id(void)
62 {
63 static uint32 call_id = 0;
64 return ++call_id;
65 }
66
67 /*******************************************************************
68 Use SMBreadX to get rest of one fragment's worth of rpc data.
69 Reads the whole size or give an error message
70 ********************************************************************/
71
72 struct rpc_read_state {
73 struct tevent_context *ev;
74 struct rpc_cli_transport *transport;
75 uint8_t *data;
76 size_t size;
77 size_t num_read;
78 };
79
80 static void rpc_read_done(struct tevent_req *subreq);
81
82 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
83 struct tevent_context *ev,
84 struct rpc_cli_transport *transport,
85 uint8_t *data, size_t size)
86 {
87 struct tevent_req *req, *subreq;
88 struct rpc_read_state *state;
89
90 req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
91 if (req == NULL) {
92 return NULL;
93 }
94 state->ev = ev;
95 state->transport = transport;
96 state->data = data;
97 state->size = size;
98 state->num_read = 0;
99
100 DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
101
102 subreq = transport->read_send(state, ev, (uint8_t *)data, size,
103 transport->priv);
104 if (subreq == NULL) {
105 goto fail;
106 }
107 tevent_req_set_callback(subreq, rpc_read_done, req);
108 return req;
109
110 fail:
111 TALLOC_FREE(req);
112 return NULL;
113 }
114
115 static void rpc_read_done(struct tevent_req *subreq)
116 {
117 struct tevent_req *req = tevent_req_callback_data(
118 subreq, struct tevent_req);
119 struct rpc_read_state *state = tevent_req_data(
120 req, struct rpc_read_state);
121 NTSTATUS status;
122 ssize_t received;
123
124 status = state->transport->read_recv(subreq, &received);
125 TALLOC_FREE(subreq);
126 if (!NT_STATUS_IS_OK(status)) {
127 tevent_req_nterror(req, status);
128 return;
129 }
130
131 state->num_read += received;
132 if (state->num_read == state->size) {
133 tevent_req_done(req);
134 return;
135 }
136
137 subreq = state->transport->read_send(state, state->ev,
138 state->data + state->num_read,
139 state->size - state->num_read,
140 state->transport->priv);
141 if (tevent_req_nomem(subreq, req)) {
142 return;
143 }
144 tevent_req_set_callback(subreq, rpc_read_done, req);
145 }
146
147 static NTSTATUS rpc_read_recv(struct tevent_req *req)
148 {
149 return tevent_req_simple_recv_ntstatus(req);
150 }
151
152 struct rpc_write_state {
153 struct tevent_context *ev;
154 struct rpc_cli_transport *transport;
155 const uint8_t *data;
156 size_t size;
157 size_t num_written;
158 };
159
160 static void rpc_write_done(struct tevent_req *subreq);
161
162 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
163 struct tevent_context *ev,
164 struct rpc_cli_transport *transport,
165 const uint8_t *data, size_t size)
166 {
167 struct tevent_req *req, *subreq;
168 struct rpc_write_state *state;
169
170 req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
171 if (req == NULL) {
172 return NULL;
173 }
174 state->ev = ev;
175 state->transport = transport;
176 state->data = data;
177 state->size = size;
178 state->num_written = 0;
179
180 DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
181
182 subreq = transport->write_send(state, ev, data, size, transport->priv);
183 if (subreq == NULL) {
184 goto fail;
185 }
186 tevent_req_set_callback(subreq, rpc_write_done, req);
187 return req;
188 fail:
189 TALLOC_FREE(req);
190 return NULL;
191 }
192
193 static void rpc_write_done(struct tevent_req *subreq)
194 {
195 struct tevent_req *req = tevent_req_callback_data(
196 subreq, struct tevent_req);
197 struct rpc_write_state *state = tevent_req_data(
198 req, struct rpc_write_state);
199 NTSTATUS status;
200 ssize_t written;
201
202 status = state->transport->write_recv(subreq, &written);
203 TALLOC_FREE(subreq);
204 if (!NT_STATUS_IS_OK(status)) {
205 tevent_req_nterror(req, status);
206 return;
207 }
208
209 state->num_written += written;
210
211 if (state->num_written == state->size) {
212 tevent_req_done(req);
213 return;
214 }
215
216 subreq = state->transport->write_send(state, state->ev,
217 state->data + state->num_written,
218 state->size - state->num_written,
219 state->transport->priv);
220 if (tevent_req_nomem(subreq, req)) {
221 return;
222 }
223 tevent_req_set_callback(subreq, rpc_write_done, req);
224 }
225
226 static NTSTATUS rpc_write_recv(struct tevent_req *req)
227 {
228 return tevent_req_simple_recv_ntstatus(req);
229 }
230
231
232 /****************************************************************************
233 Try and get a PDU's worth of data from current_pdu. If not, then read more
234 from the wire.
235 ****************************************************************************/
236
237 struct get_complete_frag_state {
238 struct tevent_context *ev;
239 struct rpc_pipe_client *cli;
240 uint16_t frag_len;
241 DATA_BLOB *pdu;
242 };
243
244 static void get_complete_frag_got_header(struct tevent_req *subreq);
245 static void get_complete_frag_got_rest(struct tevent_req *subreq);
246
247 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
248 struct tevent_context *ev,
249 struct rpc_pipe_client *cli,
250 DATA_BLOB *pdu)
251 {
252 struct tevent_req *req, *subreq;
253 struct get_complete_frag_state *state;
254 size_t received;
255 NTSTATUS status;
256
257 req = tevent_req_create(mem_ctx, &state,
258 struct get_complete_frag_state);
259 if (req == NULL) {
260 return NULL;
261 }
262 state->ev = ev;
263 state->cli = cli;
264 state->frag_len = RPC_HEADER_LEN;
265 state->pdu = pdu;
266
267 received = pdu->length;
268 if (received < RPC_HEADER_LEN) {
269 if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
270 status = NT_STATUS_NO_MEMORY;
271 goto post_status;
272 }
273 subreq = rpc_read_send(state, state->ev,
274 state->cli->transport,
275 pdu->data + received,
276 RPC_HEADER_LEN - received);
277 if (subreq == NULL) {
278 status = NT_STATUS_NO_MEMORY;
279 goto post_status;
280 }
281 tevent_req_set_callback(subreq, get_complete_frag_got_header,
282 req);
283 return req;
284 }
285
286 state->frag_len = dcerpc_get_frag_length(pdu);
287
288 /*
289 * Ensure we have frag_len bytes of data.
290 */
291 if (received < state->frag_len) {
292 if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
293 status = NT_STATUS_NO_MEMORY;
294 goto post_status;
295 }
296 subreq = rpc_read_send(state, state->ev,
297 state->cli->transport,
298 pdu->data + received,
299 state->frag_len - received);
300 if (subreq == NULL) {
301 status = NT_STATUS_NO_MEMORY;
302 goto post_status;
303 }
304 tevent_req_set_callback(subreq, get_complete_frag_got_rest,
305 req);
306 return req;
307 }
308
309 status = NT_STATUS_OK;
310 post_status:
311 if (NT_STATUS_IS_OK(status)) {
312 tevent_req_done(req);
313 } else {
314 tevent_req_nterror(req, status);
315 }
316 return tevent_req_post(req, ev);
317 }
318
319 static void get_complete_frag_got_header(struct tevent_req *subreq)
320 {
321 struct tevent_req *req = tevent_req_callback_data(
322 subreq, struct tevent_req);
323 struct get_complete_frag_state *state = tevent_req_data(
324 req, struct get_complete_frag_state);
325 NTSTATUS status;
326
327 status = rpc_read_recv(subreq);
328 TALLOC_FREE(subreq);
329 if (!NT_STATUS_IS_OK(status)) {
330 tevent_req_nterror(req, status);
331 return;
332 }
333
334 state->frag_len = dcerpc_get_frag_length(state->pdu);
335
336 if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
337 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
338 return;
339 }
340
341 /*
342 * We're here in this piece of code because we've read exactly
343 * RPC_HEADER_LEN bytes into state->pdu.
344 */
345
346 subreq = rpc_read_send(state, state->ev, state->cli->transport,
347 state->pdu->data + RPC_HEADER_LEN,
348 state->frag_len - RPC_HEADER_LEN);
349 if (tevent_req_nomem(subreq, req)) {
350 return;
351 }
352 tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
353 }
354
355 static void get_complete_frag_got_rest(struct tevent_req *subreq)
356 {
357 struct tevent_req *req = tevent_req_callback_data(
358 subreq, struct tevent_req);
359 NTSTATUS status;
360
361 status = rpc_read_recv(subreq);
362 TALLOC_FREE(subreq);
363 if (!NT_STATUS_IS_OK(status)) {
364 tevent_req_nterror(req, status);
365 return;
366 }
367 tevent_req_done(req);
368 }
369
370 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
371 {
372 return tevent_req_simple_recv_ntstatus(req);
373 }
374
375 /****************************************************************************
376 Do basic authentication checks on an incoming pdu.
377 ****************************************************************************/
378
379 static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
380 struct rpc_pipe_client *cli,
381 struct ncacn_packet *pkt,
382 DATA_BLOB *pdu,
383 uint8_t expected_pkt_type,
384 DATA_BLOB *rdata,
385 DATA_BLOB *reply_pdu)
386 {
387 struct dcerpc_response *r;
388 NTSTATUS ret = NT_STATUS_OK;
389 size_t pad_len = 0;
390
391 /*
392 * Point the return values at the real data including the RPC
393 * header. Just in case the caller wants it.
394 */
395 *rdata = *pdu;
396
397 /* Ensure we have the correct type. */
398 switch (pkt->ptype) {
399 case DCERPC_PKT_ALTER_RESP:
400 case DCERPC_PKT_BIND_ACK:
401
402 /* Client code never receives this kind of packets */
403 break;
404
405
406 case DCERPC_PKT_RESPONSE:
407
408 r = &pkt->u.response;
409
410 /* Here's where we deal with incoming sign/seal. */
411 ret = dcerpc_check_auth(cli->auth, pkt,
412 &r->stub_and_verifier,
413 DCERPC_RESPONSE_LENGTH,
414 pdu, &pad_len);
415 if (!NT_STATUS_IS_OK(ret)) {
416 return ret;
417 }
418
419 if (pkt->frag_length < DCERPC_RESPONSE_LENGTH + pad_len) {
420 return NT_STATUS_BUFFER_TOO_SMALL;
421 }
422
423 /* Point the return values at the NDR data. */
424 rdata->data = r->stub_and_verifier.data;
425
426 if (pkt->auth_length) {
427 /* We've already done integer wrap tests in
428 * dcerpc_check_auth(). */
429 rdata->length = r->stub_and_verifier.length
430 - pad_len
431 - DCERPC_AUTH_TRAILER_LENGTH
432 - pkt->auth_length;
433 } else {
434 rdata->length = r->stub_and_verifier.length;
435 }
436
437 DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
438 (long unsigned int)pdu->length,
439 (long unsigned int)rdata->length,
440 (unsigned int)pad_len));
441
442 /*
443 * If this is the first reply, and the allocation hint is
444 * reasonable, try and set up the reply_pdu DATA_BLOB to the
445 * correct size.
446 */
447
448 if ((reply_pdu->length == 0) &&
449 r->alloc_hint && (r->alloc_hint < 15*1024*1024)) {
450 if (!data_blob_realloc(mem_ctx, reply_pdu,
451 r->alloc_hint)) {
452 DEBUG(0, ("reply alloc hint %d too "
453 "large to allocate\n",
454 (int)r->alloc_hint));
455 return NT_STATUS_NO_MEMORY;
456 }
457 }
458
459 break;
460
461 case DCERPC_PKT_BIND_NAK:
462 DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
463 rpccli_pipe_txt(talloc_tos(), cli)));
464 /* Use this for now... */
465 return NT_STATUS_NETWORK_ACCESS_DENIED;
466
467 case DCERPC_PKT_FAULT:
468
469 DEBUG(1, (__location__ ": RPC fault code %s received "
470 "from %s!\n",
471 dcerpc_errstr(talloc_tos(),
472 pkt->u.fault.status),
473 rpccli_pipe_txt(talloc_tos(), cli)));
474
475 return dcerpc_fault_to_nt_status(pkt->u.fault.status);
476
477 default:
478 DEBUG(0, (__location__ "Unknown packet type %u received "
479 "from %s!\n",
480 (unsigned int)pkt->ptype,
481 rpccli_pipe_txt(talloc_tos(), cli)));
482 return NT_STATUS_INVALID_INFO_CLASS;
483 }
484
485 if (pkt->ptype != expected_pkt_type) {
486 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
487 "RPC packet type - %u, not %u\n",
488 rpccli_pipe_txt(talloc_tos(), cli),
489 pkt->ptype, expected_pkt_type));
490 return NT_STATUS_INVALID_INFO_CLASS;
491 }
492
493 /* Do this just before return - we don't want to modify any rpc header
494 data before now as we may have needed to do cryptographic actions on
495 it before. */
496
497 if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
498 !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
499 DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
500 "fragment first/last ON.\n"));
501 pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
502 }
503
504 return NT_STATUS_OK;
505 }
506
507 /****************************************************************************
508 Call a remote api on an arbitrary pipe. takes param, data and setup buffers.
509 ****************************************************************************/
510
511 struct cli_api_pipe_state {
512 struct tevent_context *ev;
513 struct rpc_cli_transport *transport;
514 uint8_t *rdata;
515 uint32_t rdata_len;
516 };
517
518 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
519 static void cli_api_pipe_write_done(struct tevent_req *subreq);
520 static void cli_api_pipe_read_done(struct tevent_req *subreq);
521
522 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
523 struct tevent_context *ev,
524 struct rpc_cli_transport *transport,
525 uint8_t *data, size_t data_len,
526 uint32_t max_rdata_len)
527 {
528 struct tevent_req *req, *subreq;
529 struct cli_api_pipe_state *state;
530 NTSTATUS status;
531
532 req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
533 if (req == NULL) {
534 return NULL;
535 }
536 state->ev = ev;
537 state->transport = transport;
538
539 if (max_rdata_len < RPC_HEADER_LEN) {
540 /*
541 * For a RPC reply we always need at least RPC_HEADER_LEN
542 * bytes. We check this here because we will receive
543 * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
544 */
545 status = NT_STATUS_INVALID_PARAMETER;
546 goto post_status;
547 }
548
549 if (transport->trans_send != NULL) {
550 subreq = transport->trans_send(state, ev, data, data_len,
551 max_rdata_len, transport->priv);
552 if (subreq == NULL) {
553 goto fail;
554 }
555 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
556 return req;
557 }
558
559 /*
560 * If the transport does not provide a "trans" routine, i.e. for
561 * example the ncacn_ip_tcp transport, do the write/read step here.
562 */
563
564 subreq = rpc_write_send(state, ev, transport, data, data_len);
565 if (subreq == NULL) {
566 goto fail;
567 }
568 tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
569 return req;
570
571 post_status:
572 tevent_req_nterror(req, status);
573 return tevent_req_post(req, ev);
574 fail:
575 TALLOC_FREE(req);
576 return NULL;
577 }
578
579 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
580 {
581 struct tevent_req *req = tevent_req_callback_data(
582 subreq, struct tevent_req);
583 struct cli_api_pipe_state *state = tevent_req_data(
584 req, struct cli_api_pipe_state);
585 NTSTATUS status;
586
587 status = state->transport->trans_recv(subreq, state, &state->rdata,
588 &state->rdata_len);
589 TALLOC_FREE(subreq);
590 if (!NT_STATUS_IS_OK(status)) {
591 tevent_req_nterror(req, status);
592 return;
593 }
594 tevent_req_done(req);
595 }
596
597 static void cli_api_pipe_write_done(struct tevent_req *subreq)
598 {
599 struct tevent_req *req = tevent_req_callback_data(
600 subreq, struct tevent_req);
601 struct cli_api_pipe_state *state = tevent_req_data(
602 req, struct cli_api_pipe_state);
603 NTSTATUS status;
604
605 status = rpc_write_recv(subreq);
606 TALLOC_FREE(subreq);
607 if (!NT_STATUS_IS_OK(status)) {
608 tevent_req_nterror(req, status);
609 return;
610 }
611
612 state->rdata = talloc_array(state, uint8_t, RPC_HEADER_LEN);
613 if (tevent_req_nomem(state->rdata, req)) {
614 return;
615 }
616
617 /*
618 * We don't need to use rpc_read_send here, the upper layer will cope
619 * with a short read, transport->trans_send could also return less
620 * than state->max_rdata_len.
621 */
622 subreq = state->transport->read_send(state, state->ev, state->rdata,
623 RPC_HEADER_LEN,
624 state->transport->priv);
625 if (tevent_req_nomem(subreq, req)) {
626 return;
627 }
628 tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
629 }
630
631 static void cli_api_pipe_read_done(struct tevent_req *subreq)
632 {
633 struct tevent_req *req = tevent_req_callback_data(
634 subreq, struct tevent_req);
635 struct cli_api_pipe_state *state = tevent_req_data(
636 req, struct cli_api_pipe_state);
637 NTSTATUS status;
638 ssize_t received;
639
640 status = state->transport->read_recv(subreq, &received);
641 TALLOC_FREE(subreq);
642 if (!NT_STATUS_IS_OK(status)) {
643 tevent_req_nterror(req, status);
644 return;
645 }
646 state->rdata_len = received;
647 tevent_req_done(req);
648 }
649
650 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
651 uint8_t **prdata, uint32_t *prdata_len)
652 {
653 struct cli_api_pipe_state *state = tevent_req_data(
654 req, struct cli_api_pipe_state);
655 NTSTATUS status;
656
657 if (tevent_req_is_nterror(req, &status)) {
658 return status;
659 }
660
661 *prdata = talloc_move(mem_ctx, &state->rdata);
662 *prdata_len = state->rdata_len;
663 return NT_STATUS_OK;
664 }
665
666 /****************************************************************************
667 Send data on an rpc pipe via trans. The data must be the last
668 pdu fragment of an NDR data stream.
669
670 Receive response data from an rpc pipe, which may be large...
671
672 Read the first fragment: unfortunately have to use SMBtrans for the first
673 bit, then SMBreadX for subsequent bits.
674
675 If first fragment received also wasn't the last fragment, continue
676 getting fragments until we _do_ receive the last fragment.
677
678 Request/Response PDU's look like the following...
679
680 |<------------------PDU len----------------------------------------------->|
681 |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
682
683 +------------+-----------------+-------------+---------------+-------------+
684 | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR | AUTH DATA |
685 +------------+-----------------+-------------+---------------+-------------+
686
687 Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
688 signing & sealing being negotiated.
689
690 ****************************************************************************/
691
692 struct rpc_api_pipe_state {
693 struct tevent_context *ev;
694 struct rpc_pipe_client *cli;
695 uint8_t expected_pkt_type;
696
697 DATA_BLOB incoming_frag;
698 struct ncacn_packet *pkt;
699
700 /* Incoming reply */
701 DATA_BLOB reply_pdu;
702 size_t reply_pdu_offset;
703 uint8_t endianess;
704 };
705
706 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
707 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
708 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq);
709
710 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
711 struct tevent_context *ev,
712 struct rpc_pipe_client *cli,
713 DATA_BLOB *data, /* Outgoing PDU */
714 uint8_t expected_pkt_type)
715 {
716 struct tevent_req *req, *subreq;
717 struct rpc_api_pipe_state *state;
718 uint16_t max_recv_frag;
719 NTSTATUS status;
720
721 req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
722 if (req == NULL) {
723 return NULL;
724 }
725 state->ev = ev;
726 state->cli = cli;
727 state->expected_pkt_type = expected_pkt_type;
728 state->endianess = DCERPC_DREP_LE;
729
730 /*
731 * Ensure we're not sending too much.
732 */
733 if (data->length > cli->max_xmit_frag) {
734 status = NT_STATUS_INVALID_PARAMETER;
735 goto post_status;
736 }
737
738 DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
739
740 if (state->expected_pkt_type == DCERPC_PKT_AUTH3) {
741 subreq = rpc_write_send(state, ev, cli->transport,
742 data->data, data->length);
743 if (subreq == NULL) {
744 goto fail;
745 }
746 tevent_req_set_callback(subreq, rpc_api_pipe_auth3_done, req);
747 return req;
748 }
749
750 /* get the header first, then fetch the rest once we have
751 * the frag_length available */
752 max_recv_frag = RPC_HEADER_LEN;
753
754 subreq = cli_api_pipe_send(state, ev, cli->transport,
755 data->data, data->length, max_recv_frag);
756 if (subreq == NULL) {
757 goto fail;
758 }
759 tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
760 return req;
761
762 post_status:
763 tevent_req_nterror(req, status);
764 return tevent_req_post(req, ev);
765 fail:
766 TALLOC_FREE(req);
767 return NULL;
768 }
769
770 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq)
771 {
772 struct tevent_req *req =
773 tevent_req_callback_data(subreq,
774 struct tevent_req);
775 NTSTATUS status;
776
777 status = rpc_write_recv(subreq);
778 TALLOC_FREE(subreq);
779 if (!NT_STATUS_IS_OK(status)) {
780 tevent_req_nterror(req, status);
781 return;
782 }
783
784 tevent_req_done(req);
785 }
786
787 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
788 {
789 struct tevent_req *req = tevent_req_callback_data(
790 subreq, struct tevent_req);
791 struct rpc_api_pipe_state *state = tevent_req_data(
792 req, struct rpc_api_pipe_state);
793 NTSTATUS status;
794 uint8_t *rdata = NULL;
795 uint32_t rdata_len = 0;
796
797 status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
798 TALLOC_FREE(subreq);
799 if (!NT_STATUS_IS_OK(status)) {
800 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
801 tevent_req_nterror(req, status);
802 return;
803 }
804
805 if (rdata == NULL) {
806 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
807 rpccli_pipe_txt(talloc_tos(), state->cli)));
808 tevent_req_done(req);
809 return;
810 }
811
812 /*
813 * Move data on state->incoming_frag.
814 */
815 state->incoming_frag.data = talloc_move(state, &rdata);
816 state->incoming_frag.length = rdata_len;
817 if (!state->incoming_frag.data) {
818 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
819 return;
820 }
821
822 /* Ensure we have enough data for a pdu. */
823 subreq = get_complete_frag_send(state, state->ev, state->cli,
824 &state->incoming_frag);
825 if (tevent_req_nomem(subreq, req)) {
826 return;
827 }
828 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
829 }
830
831 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
832 {
833 struct tevent_req *req = tevent_req_callback_data(
834 subreq, struct tevent_req);
835 struct rpc_api_pipe_state *state = tevent_req_data(
836 req, struct rpc_api_pipe_state);
837 NTSTATUS status;
838 DATA_BLOB rdata = data_blob_null;
839
840 status = get_complete_frag_recv(subreq);
841 TALLOC_FREE(subreq);
842 if (!NT_STATUS_IS_OK(status)) {
843 DEBUG(5, ("get_complete_frag failed: %s\n",
844 nt_errstr(status)));
845 tevent_req_nterror(req, status);
846 return;
847 }
848
849 state->pkt = talloc(state, struct ncacn_packet);
850 if (!state->pkt) {
851 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
852 return;
853 }
854
855 status = dcerpc_pull_ncacn_packet(state->pkt,
856 &state->incoming_frag,
857 state->pkt,
858 !state->endianess);
859 if (!NT_STATUS_IS_OK(status)) {
860 tevent_req_nterror(req, status);
861 return;
862 }
863
864 if (state->incoming_frag.length != state->pkt->frag_length) {
865 DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
866 (unsigned int)state->incoming_frag.length,
867 (unsigned int)state->pkt->frag_length));
868 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
869 return;
870 }
871
872 status = cli_pipe_validate_current_pdu(state,
873 state->cli, state->pkt,
874 &state->incoming_frag,
875 state->expected_pkt_type,
876 &rdata,
877 &state->reply_pdu);
878
879 DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
880 (unsigned)state->incoming_frag.length,
881 (unsigned)state->reply_pdu_offset,
882 nt_errstr(status)));
883
884 if (!NT_STATUS_IS_OK(status)) {
885 tevent_req_nterror(req, status);
886 return;
887 }
888
889 if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
890 && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
891 /*
892 * Set the data type correctly for big-endian data on the
893 * first packet.
894 */
895 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
896 "big-endian.\n",
897 rpccli_pipe_txt(talloc_tos(), state->cli)));
898 state->endianess = 0x00; /* BIG ENDIAN */
899 }
900 /*
901 * Check endianness on subsequent packets.
902 */
903 if (state->endianess != state->pkt->drep[0]) {
904 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
905 "%s\n",
906 state->endianess?"little":"big",
907 state->pkt->drep[0]?"little":"big"));
908 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
909 return;
910 }
911
912 /* Now copy the data portion out of the pdu into rbuf. */
913 if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
914 if (!data_blob_realloc(NULL, &state->reply_pdu,
915 state->reply_pdu_offset + rdata.length)) {
916 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
917 return;
918 }
919 }
920
921 memcpy(state->reply_pdu.data + state->reply_pdu_offset,
922 rdata.data, rdata.length);
923 state->reply_pdu_offset += rdata.length;
924
925 /* reset state->incoming_frag, there is no need to free it,
926 * it will be reallocated to the right size the next time
927 * it is used */
928 state->incoming_frag.length = 0;
929
930 if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
931 /* make sure the pdu length is right now that we
932 * have all the data available (alloc hint may
933 * have allocated more than was actually used) */
934 state->reply_pdu.length = state->reply_pdu_offset;
935 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
936 rpccli_pipe_txt(talloc_tos(), state->cli),
937 (unsigned)state->reply_pdu.length));
938 tevent_req_done(req);
939 return;
940 }
941
942 subreq = get_complete_frag_send(state, state->ev, state->cli,
943 &state->incoming_frag);
944 if (tevent_req_nomem(subreq, req)) {
945 return;
946 }
947 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
948 }
949
950 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
951 struct ncacn_packet **pkt,
952 DATA_BLOB *reply_pdu)
953 {
954 struct rpc_api_pipe_state *state = tevent_req_data(
955 req, struct rpc_api_pipe_state);
956 NTSTATUS status;
957
958 if (tevent_req_is_nterror(req, &status)) {
959 return status;
960 }
961
962 /* return data to caller and assign it ownership of memory */
963 if (reply_pdu) {
964 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
965 reply_pdu->length = state->reply_pdu.length;
966 state->reply_pdu.length = 0;
967 } else {
968 data_blob_free(&state->reply_pdu);
969 }
970
971 if (pkt) {
972 *pkt = talloc_steal(mem_ctx, state->pkt);
973 }
974
975 return NT_STATUS_OK;
976 }
977
978 /*******************************************************************
979 Creates NTLMSSP auth bind.
980 ********************************************************************/
981
982 static NTSTATUS create_generic_auth_rpc_bind_req(struct rpc_pipe_client *cli,
983 TALLOC_CTX *mem_ctx,
984 DATA_BLOB *auth_token)
985 {
986 struct gensec_security *gensec_security;
987 DATA_BLOB null_blob = data_blob_null;
988
989 gensec_security = talloc_get_type_abort(cli->auth->auth_ctx,
990 struct gensec_security);
991
992 DEBUG(5, ("create_generic_auth_rpc_bind_req: generate first token\n"));
993 return gensec_update(gensec_security, mem_ctx, NULL, null_blob, auth_token);
994 }
995
996 /*******************************************************************
997 Creates schannel auth bind.
998 ********************************************************************/
999
1000 static NTSTATUS create_schannel_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1001 DATA_BLOB *auth_token)
1002 {
1003 NTSTATUS status;
1004 struct NL_AUTH_MESSAGE r;
1005
1006 /* Use lp_workgroup() if domain not specified */
1007
1008 if (!cli->auth->domain || !cli->auth->domain[0]) {
1009 cli->auth->domain = talloc_strdup(cli, lp_workgroup());
1010 if (cli->auth->domain == NULL) {
1011 return NT_STATUS_NO_MEMORY;
1012 }
1013 }
1014
1015 /*
1016 * Now marshall the data into the auth parse_struct.
1017 */
1018
1019 r.MessageType = NL_NEGOTIATE_REQUEST;
1020 r.Flags = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
1021 NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
1022 r.oem_netbios_domain.a = cli->auth->domain;
1023 r.oem_netbios_computer.a = lp_netbios_name();
1024
1025 status = dcerpc_push_schannel_bind(cli, &r, auth_token);
1026 if (!NT_STATUS_IS_OK(status)) {
1027 return status;
1028 }
1029
1030 return NT_STATUS_OK;
1031 }
1032
1033 /*******************************************************************
1034 Creates the internals of a DCE/RPC bind request or alter context PDU.
1035 ********************************************************************/
1036
1037 static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
1038 enum dcerpc_pkt_type ptype,
1039 uint32 rpc_call_id,
1040 const struct ndr_syntax_id *abstract,
1041 const struct ndr_syntax_id *transfer,
1042 const DATA_BLOB *auth_info,
1043 DATA_BLOB *blob)
1044 {
1045 uint16 auth_len = auth_info->length;
1046 NTSTATUS status;
1047 union dcerpc_payload u;
1048 struct dcerpc_ctx_list ctx_list;
1049
1050 if (auth_len) {
1051 auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
1052 }
1053
1054 ctx_list.context_id = 0;
1055 ctx_list.num_transfer_syntaxes = 1;
1056 ctx_list.abstract_syntax = *abstract;
1057 ctx_list.transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer);
1058
1059 u.bind.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1060 u.bind.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1061 u.bind.assoc_group_id = 0x0;
1062 u.bind.num_contexts = 1;
1063 u.bind.ctx_list = &ctx_list;
1064 u.bind.auth_info = *auth_info;
1065
1066 status = dcerpc_push_ncacn_packet(mem_ctx,
1067 ptype,
1068 DCERPC_PFC_FLAG_FIRST |
1069 DCERPC_PFC_FLAG_LAST,
1070 auth_len,
1071 rpc_call_id,
1072 &u,
1073 blob);
1074 if (!NT_STATUS_IS_OK(status)) {
1075 DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
1076 return status;
1077 }
1078
1079 return NT_STATUS_OK;
1080 }
1081
1082 /*******************************************************************
1083 Creates a DCE/RPC bind request.
1084 ********************************************************************/
1085
1086 static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
1087 struct rpc_pipe_client *cli,
1088 struct pipe_auth_data *auth,
1089 uint32 rpc_call_id,
1090 const struct ndr_syntax_id *abstract,
1091 const struct ndr_syntax_id *transfer,
1092 DATA_BLOB *rpc_out)
1093 {
1094 DATA_BLOB auth_token = data_blob_null;
1095 DATA_BLOB auth_info = data_blob_null;
1096 NTSTATUS ret = NT_STATUS_OK;
1097
1098 switch (auth->auth_type) {
1099 case DCERPC_AUTH_TYPE_SCHANNEL:
1100 ret = create_schannel_auth_rpc_bind_req(cli, &auth_token);
1101 if (!NT_STATUS_IS_OK(ret)) {
1102 return ret;
1103 }
1104 break;
1105
1106 case DCERPC_AUTH_TYPE_NTLMSSP:
1107 case DCERPC_AUTH_TYPE_KRB5:
1108 case DCERPC_AUTH_TYPE_SPNEGO:
1109 ret = create_generic_auth_rpc_bind_req(cli, mem_ctx, &auth_token);
1110
1111 if (!NT_STATUS_IS_OK(ret) &&
1112 !NT_STATUS_EQUAL(ret, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1113 return ret;
1114 }
1115 break;
1116
1117 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1118 auth_token = data_blob_talloc(mem_ctx,
1119 "NCALRPC_AUTH_TOKEN",
1120 18);
1121 break;
1122
1123 case DCERPC_AUTH_TYPE_NONE:
1124 break;
1125
1126 default:
1127 /* "Can't" happen. */
1128 return NT_STATUS_INVALID_INFO_CLASS;
1129 }
1130
1131 if (auth_token.length != 0) {
1132 ret = dcerpc_push_dcerpc_auth(cli,
1133 auth->auth_type,
1134 auth->auth_level,
1135 0, /* auth_pad_length */
1136 1, /* auth_context_id */
1137 &auth_token,
1138 &auth_info);
1139 if (!NT_STATUS_IS_OK(ret)) {
1140 return ret;
1141 }
1142 data_blob_free(&auth_token);
1143 }
1144
1145 ret = create_bind_or_alt_ctx_internal(mem_ctx,
1146 DCERPC_PKT_BIND,
1147 rpc_call_id,
1148 abstract,
1149 transfer,
1150 &auth_info,
1151 rpc_out);
1152 return ret;
1153 }
1154
1155 /*******************************************************************
1156 External interface.
1157 Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
1158 Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
1159 and deals with signing/sealing details.
1160 ********************************************************************/
1161
1162 struct rpc_api_pipe_req_state {
1163 struct tevent_context *ev;
1164 struct rpc_pipe_client *cli;
1165 uint8_t op_num;
1166 uint32_t call_id;
1167 DATA_BLOB *req_data;
1168 uint32_t req_data_sent;
1169 DATA_BLOB rpc_out;
1170 DATA_BLOB reply_pdu;
1171 };
1172
1173 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
1174 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
1175 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1176 bool *is_last_frag);
1177
1178 struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
1179 struct tevent_context *ev,
1180 struct rpc_pipe_client *cli,
1181 uint8_t op_num,
1182 DATA_BLOB *req_data)
1183 {
1184 struct tevent_req *req, *subreq;
1185 struct rpc_api_pipe_req_state *state;
1186 NTSTATUS status;
1187 bool is_last_frag;
1188
1189 req = tevent_req_create(mem_ctx, &state,
1190 struct rpc_api_pipe_req_state);
1191 if (req == NULL) {
1192 return NULL;
1193 }
1194 state->ev = ev;
1195 state->cli = cli;
1196 state->op_num = op_num;
1197 state->req_data = req_data;
1198 state->req_data_sent = 0;
1199 state->call_id = get_rpc_call_id();
1200 state->reply_pdu = data_blob_null;
1201 state->rpc_out = data_blob_null;
1202
1203 if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
1204 + RPC_MAX_SIGN_SIZE) {
1205 /* Server is screwed up ! */
1206 status = NT_STATUS_INVALID_PARAMETER;
1207 goto post_status;
1208 }
1209
1210 status = prepare_next_frag(state, &is_last_frag);
1211 if (!NT_STATUS_IS_OK(status)) {
1212 goto post_status;
1213 }
1214
1215 if (is_last_frag) {
1216 subreq = rpc_api_pipe_send(state, ev, state->cli,
1217 &state->rpc_out,
1218 DCERPC_PKT_RESPONSE);
1219 if (subreq == NULL) {
1220 goto fail;
1221 }
1222 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1223 } else {
1224 subreq = rpc_write_send(state, ev, cli->transport,
1225 state->rpc_out.data,
1226 state->rpc_out.length);
1227 if (subreq == NULL) {
1228 goto fail;
1229 }
1230 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1231 req);
1232 }
1233 return req;
1234
1235 post_status:
1236 tevent_req_nterror(req, status);
1237 return tevent_req_post(req, ev);
1238 fail:
1239 TALLOC_FREE(req);
1240 return NULL;
1241 }
1242
1243 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1244 bool *is_last_frag)
1245 {
1246 size_t data_sent_thistime;
1247 size_t auth_len;
1248 size_t frag_len;
1249 uint8_t flags = 0;
1250 size_t pad_len;
1251 size_t data_left;
1252 NTSTATUS status;
1253 union dcerpc_payload u;
1254
1255 data_left = state->req_data->length - state->req_data_sent;
1256
1257 status = dcerpc_guess_sizes(state->cli->auth,
1258 DCERPC_REQUEST_LENGTH, data_left,
1259 state->cli->max_xmit_frag,
1260 CLIENT_NDR_PADDING_SIZE,
1261 &data_sent_thistime,
1262 &frag_len, &auth_len, &pad_len);
1263 if (!NT_STATUS_IS_OK(status)) {
1264 return status;
1265 }
1266
1267 if (state->req_data_sent == 0) {
1268 flags = DCERPC_PFC_FLAG_FIRST;
1269 }
1270
1271 if (data_sent_thistime == data_left) {
1272 flags |= DCERPC_PFC_FLAG_LAST;
1273 }
1274
1275 data_blob_free(&state->rpc_out);
1276
1277 ZERO_STRUCT(u.request);
1278
1279 u.request.alloc_hint = state->req_data->length;
1280 u.request.context_id = 0;
1281 u.request.opnum = state->op_num;
1282
1283 status = dcerpc_push_ncacn_packet(state,
1284 DCERPC_PKT_REQUEST,
1285 flags,
1286 auth_len,
1287 state->call_id,
1288 &u,
1289 &state->rpc_out);
1290 if (!NT_STATUS_IS_OK(status)) {
1291 return status;
1292 }
1293
1294 /* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
1295 * compute it right for requests because the auth trailer is missing
1296 * at this stage */
1297 dcerpc_set_frag_length(&state->rpc_out, frag_len);
1298
1299 /* Copy in the data. */
1300 if (!data_blob_append(NULL, &state->rpc_out,
1301 state->req_data->data + state->req_data_sent,
1302 data_sent_thistime)) {
1303 return NT_STATUS_NO_MEMORY;
1304 }
1305
1306 switch (state->cli->auth->auth_level) {
1307 case DCERPC_AUTH_LEVEL_NONE:
1308 case DCERPC_AUTH_LEVEL_CONNECT:
1309 case DCERPC_AUTH_LEVEL_PACKET:
1310 break;
1311 case DCERPC_AUTH_LEVEL_INTEGRITY:
1312 case DCERPC_AUTH_LEVEL_PRIVACY:
1313 status = dcerpc_add_auth_footer(state->cli->auth, pad_len,
1314 &state->rpc_out);
1315 if (!NT_STATUS_IS_OK(status)) {
1316 return status;
1317 }
1318 break;
1319 default:
1320 return NT_STATUS_INVALID_PARAMETER;
1321 }
1322
1323 state->req_data_sent += data_sent_thistime;
1324 *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
1325
1326 return status;
1327 }
1328
1329 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
1330 {
1331 struct tevent_req *req = tevent_req_callback_data(
1332 subreq, struct tevent_req);
1333 struct rpc_api_pipe_req_state *state = tevent_req_data(
1334 req, struct rpc_api_pipe_req_state);
1335 NTSTATUS status;
1336 bool is_last_frag;
1337
1338 status = rpc_write_recv(subreq);
1339 TALLOC_FREE(subreq);
1340 if (!NT_STATUS_IS_OK(status)) {
1341 tevent_req_nterror(req, status);
1342 return;
1343 }
1344
1345 status = prepare_next_frag(state, &is_last_frag);
1346 if (!NT_STATUS_IS_OK(status)) {
1347 tevent_req_nterror(req, status);
1348 return;
1349 }
1350
1351 if (is_last_frag) {
1352 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1353 &state->rpc_out,
1354 DCERPC_PKT_RESPONSE);
1355 if (tevent_req_nomem(subreq, req)) {
1356 return;
1357 }
1358 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1359 } else {
1360 subreq = rpc_write_send(state, state->ev,
1361 state->cli->transport,
1362 state->rpc_out.data,
1363 state->rpc_out.length);
1364 if (tevent_req_nomem(subreq, req)) {
1365 return;
1366 }
1367 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1368 req);
1369 }
1370 }
1371
1372 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
1373 {
1374 struct tevent_req *req = tevent_req_callback_data(
1375 subreq, struct tevent_req);
1376 struct rpc_api_pipe_req_state *state = tevent_req_data(
1377 req, struct rpc_api_pipe_req_state);
1378 NTSTATUS status;
1379
1380 status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
1381 TALLOC_FREE(subreq);
1382 if (!NT_STATUS_IS_OK(status)) {
1383 tevent_req_nterror(req, status);
1384 return;
1385 }
1386 tevent_req_done(req);
1387 }
1388
1389 NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1390 DATA_BLOB *reply_pdu)
1391 {
1392 struct rpc_api_pipe_req_state *state = tevent_req_data(
1393 req, struct rpc_api_pipe_req_state);
1394 NTSTATUS status;
1395
1396 if (tevent_req_is_nterror(req, &status)) {
1397 /*
1398 * We always have to initialize to reply pdu, even if there is
1399 * none. The rpccli_* caller routines expect this.
1400 */
1401 *reply_pdu = data_blob_null;
1402 return status;
1403 }
1404
1405 /* return data to caller and assign it ownership of memory */
1406 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1407 reply_pdu->length = state->reply_pdu.length;
1408 state->reply_pdu.length = 0;
1409
1410 return NT_STATUS_OK;
1411 }
1412
1413 /****************************************************************************
1414 Check the rpc bind acknowledge response.
1415 ****************************************************************************/
1416
1417 static bool check_bind_response(const struct dcerpc_bind_ack *r,
1418 const struct ndr_syntax_id *transfer)
1419 {
1420 struct dcerpc_ack_ctx ctx;
1421
1422 if (r->secondary_address_size == 0) {
1423 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
1424 }
1425
1426 if (r->num_results < 1 || !r->ctx_list) {
1427 return false;
1428 }
1429
1430 ctx = r->ctx_list[0];
1431
1432 /* check the transfer syntax */
1433 if ((ctx.syntax.if_version != transfer->if_version) ||
1434 (memcmp(&ctx.syntax.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1435 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1436 return False;
1437 }
1438
1439 if (r->num_results != 0x1 || ctx.result != 0) {
1440 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1441 r->num_results, ctx.reason));
1442 }
1443
1444 DEBUG(5,("check_bind_response: accepted!\n"));
1445 return True;
1446 }
1447
1448 /*******************************************************************
1449 Creates a DCE/RPC bind authentication response.
1450 This is the packet that is sent back to the server once we
1451 have received a BIND-ACK, to finish the third leg of
1452 the authentication handshake.
1453 ********************************************************************/
1454
1455 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
1456 struct rpc_pipe_client *cli,
1457 uint32 rpc_call_id,
1458 enum dcerpc_AuthType auth_type,
1459 enum dcerpc_AuthLevel auth_level,
1460 DATA_BLOB *pauth_blob,
1461 DATA_BLOB *rpc_out)
1462 {
1463 NTSTATUS status;
1464 union dcerpc_payload u;
1465
1466 u.auth3._pad = 0;
1467
1468 status = dcerpc_push_dcerpc_auth(mem_ctx,
1469 auth_type,
1470 auth_level,
1471 0, /* auth_pad_length */
1472 1, /* auth_context_id */
1473 pauth_blob,
1474 &u.auth3.auth_info);
1475 if (!NT_STATUS_IS_OK(status)) {
1476 return status;
1477 }
1478
1479 status = dcerpc_push_ncacn_packet(mem_ctx,
1480 DCERPC_PKT_AUTH3,
1481 DCERPC_PFC_FLAG_FIRST |
1482 DCERPC_PFC_FLAG_LAST,
1483 pauth_blob->length,
1484 rpc_call_id,
1485 &u,
1486 rpc_out);
1487 data_blob_free(&u.auth3.auth_info);
1488 if (!NT_STATUS_IS_OK(status)) {
1489 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1490 return status;
1491 }
1492
1493 return NT_STATUS_OK;
1494 }
1495
1496 /*******************************************************************
1497 Creates a DCE/RPC bind alter context authentication request which
1498 may contain a spnego auth blobl
1499 ********************************************************************/
1500
1501 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
1502 enum dcerpc_AuthType auth_type,
1503 enum dcerpc_AuthLevel auth_level,
1504 uint32 rpc_call_id,
1505 const struct ndr_syntax_id *abstract,
1506 const struct ndr_syntax_id *transfer,
1507 const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
1508 DATA_BLOB *rpc_out)
1509 {
1510 DATA_BLOB auth_info;
1511 NTSTATUS status;
1512
1513 status = dcerpc_push_dcerpc_auth(mem_ctx,
1514 auth_type,
1515 auth_level,
1516 0, /* auth_pad_length */
1517 1, /* auth_context_id */
1518 pauth_blob,
1519 &auth_info);
1520 if (!NT_STATUS_IS_OK(status)) {
1521 return status;
1522 }
1523
1524 status = create_bind_or_alt_ctx_internal(mem_ctx,
1525 DCERPC_PKT_ALTER,
1526 rpc_call_id,
1527 abstract,
1528 transfer,
1529 &auth_info,
1530 rpc_out);
1531 data_blob_free(&auth_info);
1532 return status;
1533 }
1534
1535 /****************************************************************************
1536 Do an rpc bind.
1537 ****************************************************************************/
1538
1539 struct rpc_pipe_bind_state {
1540 struct tevent_context *ev;
1541 struct rpc_pipe_client *cli;
1542 DATA_BLOB rpc_out;
1543 bool auth3;
1544 uint32_t rpc_call_id;
1545 };
1546
1547 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
1548 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1549 struct rpc_pipe_bind_state *state,
1550 DATA_BLOB *credentials);
1551 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1552 struct rpc_pipe_bind_state *state,
1553 DATA_BLOB *credentials);
1554
1555 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
1556 struct tevent_context *ev,
1557 struct rpc_pipe_client *cli,
1558 struct pipe_auth_data *auth)
1559 {
1560 struct tevent_req *req, *subreq;
1561 struct rpc_pipe_bind_state *state;
1562 NTSTATUS status;
1563
1564 req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
1565 if (req == NULL) {
1566 return NULL;
1567 }
1568
1569 DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
1570 rpccli_pipe_txt(talloc_tos(), cli),
1571 (unsigned int)auth->auth_type,
1572 (unsigned int)auth->auth_level ));
1573
1574 state->ev = ev;
1575 state->cli = cli;
1576 state->rpc_call_id = get_rpc_call_id();
1577
1578 cli->auth = talloc_move(cli, &auth);
1579
1580 /* Marshall the outgoing data. */
1581 status = create_rpc_bind_req(state, cli,
1582 cli->auth,
1583 state->rpc_call_id,
1584 &cli->abstract_syntax,
1585 &cli->transfer_syntax,
1586 &state->rpc_out);
1587
1588 if (!NT_STATUS_IS_OK(status) &&
1589 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1590 goto post_status;
1591 }
1592
1593 subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
1594 DCERPC_PKT_BIND_ACK);
1595 if (subreq == NULL) {
1596 goto fail;
1597 }
1598 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1599 return req;
1600
1601 post_status:
1602 tevent_req_nterror(req, status);
1603 return tevent_req_post(req, ev);
1604 fail:
1605 TALLOC_FREE(req);
1606 return NULL;
1607 }
1608
1609 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
1610 {
1611 struct tevent_req *req = tevent_req_callback_data(
1612 subreq, struct tevent_req);
1613 struct rpc_pipe_bind_state *state = tevent_req_data(
1614 req, struct rpc_pipe_bind_state);
1615 struct pipe_auth_data *pauth = state->cli->auth;
1616 struct gensec_security *gensec_security;
1617 struct ncacn_packet *pkt = NULL;
1618 struct dcerpc_auth auth;
1619 DATA_BLOB auth_token = data_blob_null;
1620 NTSTATUS status;
1621
1622 status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
1623 TALLOC_FREE(subreq);
1624 if (!NT_STATUS_IS_OK(status)) {
1625 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
1626 rpccli_pipe_txt(talloc_tos(), state->cli),
1627 nt_errstr(status)));
1628 tevent_req_nterror(req, status);
1629 return;
1630 }
1631
1632 if (state->auth3) {
1633 tevent_req_done(req);
1634 return;
1635 }
1636
1637 if (!check_bind_response(&pkt->u.bind_ack, &state->cli->transfer_syntax)) {
1638 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
1639 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1640 return;
1641 }
1642
1643 state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
1644 state->cli->max_recv_frag = pkt->u.bind_ack.max_recv_frag;
1645
1646 switch(pauth->auth_type) {
1647
1648 case DCERPC_AUTH_TYPE_NONE:
1649 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1650 case DCERPC_AUTH_TYPE_SCHANNEL:
1651 /* Bind complete. */
1652 tevent_req_done(req);
1653 return;
1654
1655 case DCERPC_AUTH_TYPE_NTLMSSP:
1656 case DCERPC_AUTH_TYPE_SPNEGO:
1657 case DCERPC_AUTH_TYPE_KRB5:
1658 /* Paranoid lenght checks */
1659 if (pkt->frag_length < DCERPC_AUTH_TRAILER_LENGTH
1660 + pkt->auth_length) {
1661 tevent_req_nterror(req,
1662 NT_STATUS_INFO_LENGTH_MISMATCH);
1663 return;
1664 }
1665 /* get auth credentials */
1666 status = dcerpc_pull_dcerpc_auth(talloc_tos(),
1667 &pkt->u.bind_ack.auth_info,
1668 &auth, false);
1669 if (!NT_STATUS_IS_OK(status)) {
1670 DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
1671 nt_errstr(status)));
1672 tevent_req_nterror(req, status);
1673 return;
1674 }
1675 break;
1676
1677 default:
1678 goto err_out;
1679 }
1680
1681 /*
1682 * For authenticated binds we may need to do 3 or 4 leg binds.
1683 */
1684
1685 switch(pauth->auth_type) {
1686
1687 case DCERPC_AUTH_TYPE_NONE:
1688 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1689 case DCERPC_AUTH_TYPE_SCHANNEL:
1690 /* Bind complete. */
1691 tevent_req_done(req);
1692 return;
1693
1694 case DCERPC_AUTH_TYPE_NTLMSSP:
1695 case DCERPC_AUTH_TYPE_KRB5:
1696 case DCERPC_AUTH_TYPE_SPNEGO:
1697 gensec_security = talloc_get_type_abort(pauth->auth_ctx,
1698 struct gensec_security);
1699 status = gensec_update(gensec_security, state, NULL,
1700 auth.credentials, &auth_token);
1701 if (NT_STATUS_EQUAL(status,
1702 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1703 status = rpc_bind_next_send(req, state,
1704 &auth_token);
1705 } else if (NT_STATUS_IS_OK(status)) {
1706 if (auth_token.length == 0) {
1707 /* Bind complete. */
1708 tevent_req_done(req);
1709 return;
1710 }
1711 status = rpc_bind_finish_send(req, state,
1712 &auth_token);
1713 }
1714 break;
1715
1716 default:
1717 goto err_out;
1718 }
1719
1720 if (!NT_STATUS_IS_OK(status)) {
1721 tevent_req_nterror(req, status);
1722 }
1723 return;
1724
1725 err_out:
1726 DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
1727 (unsigned int)state->cli->auth->auth_type));
1728 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
1729 }
1730
1731 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1732 struct rpc_pipe_bind_state *state,
1733 DATA_BLOB *auth_token)
1734 {
1735 struct pipe_auth_data *auth = state->cli->auth;
1736 struct tevent_req *subreq;
1737 NTSTATUS status;
1738
1739 /* Now prepare the alter context pdu. */
1740 data_blob_free(&state->rpc_out);
1741
1742 status = create_rpc_alter_context(state,
1743 auth->auth_type,
1744 auth->auth_level,
1745 state->rpc_call_id,
1746 &state->cli->abstract_syntax,
1747 &state->cli->transfer_syntax,
1748 auth_token,
1749 &state->rpc_out);
1750 if (!NT_STATUS_IS_OK(status)) {
1751 return status;
1752 }
1753
1754 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1755 &state->rpc_out, DCERPC_PKT_ALTER_RESP);
1756 if (subreq == NULL) {
1757 return NT_STATUS_NO_MEMORY;
1758 }
1759 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1760 return NT_STATUS_OK;
1761 }
1762
1763 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1764 struct rpc_pipe_bind_state *state,
1765 DATA_BLOB *auth_token)
1766 {
1767 struct pipe_auth_data *auth = state->cli->auth;
1768 struct tevent_req *subreq;
1769 NTSTATUS status;
1770
1771 state->auth3 = true;
1772
1773 /* Now prepare the auth3 context pdu. */
1774 data_blob_free(&state->rpc_out);
1775
1776 status = create_rpc_bind_auth3(state, state->cli,
1777 state->rpc_call_id,
1778 auth->auth_type,
1779 auth->auth_level,
1780 auth_token,
1781 &state->rpc_out);
1782 if (!NT_STATUS_IS_OK(status)) {
1783 return status;
1784 }
1785
1786 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1787 &state->rpc_out, DCERPC_PKT_AUTH3);
1788 if (subreq == NULL) {
1789 return NT_STATUS_NO_MEMORY;
1790 }
1791 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1792 return NT_STATUS_OK;
1793 }
1794
1795 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
1796 {
1797 return tevent_req_simple_recv_ntstatus(req);
1798 }
1799
1800 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
1801 struct pipe_auth_data *auth)
1802 {
1803 TALLOC_CTX *frame = talloc_stackframe();
1804 struct tevent_context *ev;
1805 struct tevent_req *req;
1806 NTSTATUS status = NT_STATUS_OK;
1807
1808 ev = samba_tevent_context_init(frame);
1809 if (ev == NULL) {
1810 status = NT_STATUS_NO_MEMORY;
1811 goto fail;
1812 }
1813
1814 req = rpc_pipe_bind_send(frame, ev, cli, auth);
1815 if (req == NULL) {
1816 status = NT_STATUS_NO_MEMORY;
1817 goto fail;
1818 }
1819
1820 if (!tevent_req_poll(req, ev)) {
1821 status = map_nt_error_from_unix(errno);
1822 goto fail;
1823 }
1824
1825 status = rpc_pipe_bind_recv(req);
1826 fail:
1827 TALLOC_FREE(frame);
1828 return status;
1829 }
1830
1831 #define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */
1832
1833 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
1834 unsigned int timeout)
1835 {
1836 unsigned int old;
1837
1838 if (rpc_cli->transport == NULL) {
1839 return RPCCLI_DEFAULT_TIMEOUT;
1840 }
1841
1842 if (rpc_cli->transport->set_timeout == NULL) {
1843 return RPCCLI_DEFAULT_TIMEOUT;
1844 }
1845
1846 old = rpc_cli->transport->set_timeout(rpc_cli->transport->priv, timeout);
1847 if (old == 0) {
1848 return RPCCLI_DEFAULT_TIMEOUT;
1849 }
1850
1851 return old;
1852 }
1853
1854 bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
1855 {
1856 if (rpc_cli == NULL) {
1857 return false;
1858 }
1859
1860 if (rpc_cli->transport == NULL) {
1861 return false;
1862 }
1863
1864 return rpc_cli->transport->is_connected(rpc_cli->transport->priv);
1865 }
1866
1867 struct rpccli_bh_state {
1868 struct rpc_pipe_client *rpc_cli;
1869 };
1870
1871 static bool rpccli_bh_is_connected(struct dcerpc_binding_handle *h)
1872 {
1873 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1874 struct rpccli_bh_state);
1875
1876 return rpccli_is_connected(hs->rpc_cli);
1877 }
1878
1879 static uint32_t rpccli_bh_set_timeout(struct dcerpc_binding_handle *h,
1880 uint32_t timeout)
1881 {
1882 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1883 struct rpccli_bh_state);
1884
1885 return rpccli_set_timeout(hs->rpc_cli, timeout);
1886 }
1887
1888 struct rpccli_bh_raw_call_state {
1889 DATA_BLOB in_data;
1890 DATA_BLOB out_data;
1891 uint32_t out_flags;
1892 };
1893
1894 static void rpccli_bh_raw_call_done(struct tevent_req *subreq);
1895
1896 static struct tevent_req *rpccli_bh_raw_call_send(TALLOC_CTX *mem_ctx,
1897 struct tevent_context *ev,
1898 struct dcerpc_binding_handle *h,
1899 const struct GUID *object,
1900 uint32_t opnum,
1901 uint32_t in_flags,
1902 const uint8_t *in_data,
1903 size_t in_length)
1904 {
1905 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1906 struct rpccli_bh_state);
1907 struct tevent_req *req;
1908 struct rpccli_bh_raw_call_state *state;
1909 bool ok;
1910 struct tevent_req *subreq;
1911
1912 req = tevent_req_create(mem_ctx, &state,
1913 struct rpccli_bh_raw_call_state);
1914 if (req == NULL) {
1915 return NULL;
1916 }
1917 state->in_data.data = discard_const_p(uint8_t, in_data);
1918 state->in_data.length = in_length;
1919
1920 ok = rpccli_bh_is_connected(h);
1921 if (!ok) {
1922 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
1923 return tevent_req_post(req, ev);
1924 }
1925
1926 subreq = rpc_api_pipe_req_send(state, ev, hs->rpc_cli,
1927 opnum, &state->in_data);
1928 if (tevent_req_nomem(subreq, req)) {
1929 return tevent_req_post(req, ev);
1930 }
1931 tevent_req_set_callback(subreq, rpccli_bh_raw_call_done, req);
1932
1933 return req;
1934 }
1935
1936 static void rpccli_bh_raw_call_done(struct tevent_req *subreq)
1937 {
1938 struct tevent_req *req =
1939 tevent_req_callback_data(subreq,
1940 struct tevent_req);
1941 struct rpccli_bh_raw_call_state *state =
1942 tevent_req_data(req,
1943 struct rpccli_bh_raw_call_state);
1944 NTSTATUS status;
1945
1946 state->out_flags = 0;
1947
1948 /* TODO: support bigendian responses */
1949
1950 status = rpc_api_pipe_req_recv(subreq, state, &state->out_data);
1951 TALLOC_FREE(subreq);
1952 if (!NT_STATUS_IS_OK(status)) {
1953 tevent_req_nterror(req, status);
1954 return;
1955 }
1956
1957 tevent_req_done(req);
1958 }
1959
1960 static NTSTATUS rpccli_bh_raw_call_recv(struct tevent_req *req,
1961 TALLOC_CTX *mem_ctx,
1962 uint8_t **out_data,
1963 size_t *out_length,
1964 uint32_t *out_flags)
1965 {
1966 struct rpccli_bh_raw_call_state *state =
1967 tevent_req_data(req,
1968 struct rpccli_bh_raw_call_state);
1969 NTSTATUS status;
1970
1971 if (tevent_req_is_nterror(req, &status)) {
1972 tevent_req_received(req);
1973 return status;
1974 }
1975
1976 *out_data = talloc_move(mem_ctx, &state->out_data.data);
1977 *out_length = state->out_data.length;
1978 *out_flags = state->out_flags;
1979 tevent_req_received(req);
1980 return NT_STATUS_OK;
1981 }
1982
1983 struct rpccli_bh_disconnect_state {
1984 uint8_t _dummy;
1985 };
1986
1987 static struct tevent_req *rpccli_bh_disconnect_send(TALLOC_CTX *mem_ctx,
1988 struct tevent_context *ev,
1989 struct dcerpc_binding_handle *h)
1990 {
1991 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1992 struct rpccli_bh_state);
1993 struct tevent_req *req;
1994 struct rpccli_bh_disconnect_state *state;
1995 bool ok;
1996
1997 req = tevent_req_create(mem_ctx, &state,
1998 struct rpccli_bh_disconnect_state);
1999 if (req == NULL) {
2000 return NULL;
2001 }
2002
2003 ok = rpccli_bh_is_connected(h);
2004 if (!ok) {
2005 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2006 return tevent_req_post(req, ev);
2007 }
2008
2009 /*
2010 * TODO: do a real async disconnect ...
2011 *
2012 * For now the caller needs to free rpc_cli
2013 */
2014 hs->rpc_cli = NULL;
2015
2016 tevent_req_done(req);
2017 return tevent_req_post(req, ev);
2018 }
2019
2020 static NTSTATUS rpccli_bh_disconnect_recv(struct tevent_req *req)
2021 {
2022 NTSTATUS status;
2023
2024 if (tevent_req_is_nterror(req, &status)) {
2025 tevent_req_received(req);
2026 return status;
2027 }
2028
2029 tevent_req_received(req);
2030 return NT_STATUS_OK;
2031 }
2032
2033 static bool rpccli_bh_ref_alloc(struct dcerpc_binding_handle *h)
2034 {
2035 return true;
2036 }
2037
2038 static void rpccli_bh_do_ndr_print(struct dcerpc_binding_handle *h,
2039 int ndr_flags,
2040 const void *_struct_ptr,
2041 const struct ndr_interface_call *call)
2042 {
2043 void *struct_ptr = discard_const(_struct_ptr);
2044
2045 if (DEBUGLEVEL < 10) {
2046 return;
2047 }
2048
2049 if (ndr_flags & NDR_IN) {
2050 ndr_print_function_debug(call->ndr_print,
2051 call->name,
2052 ndr_flags,
2053 struct_ptr);
2054 }
2055 if (ndr_flags & NDR_OUT) {
2056 ndr_print_function_debug(call->ndr_print,
2057 call->name,
2058 ndr_flags,
2059 struct_ptr);
2060 }
2061 }
2062
2063 static const struct dcerpc_binding_handle_ops rpccli_bh_ops = {
2064 .name = "rpccli",
2065 .is_connected = rpccli_bh_is_connected,
2066 .set_timeout = rpccli_bh_set_timeout,
2067 .raw_call_send = rpccli_bh_raw_call_send,
2068 .raw_call_recv = rpccli_bh_raw_call_recv,
2069 .disconnect_send = rpccli_bh_disconnect_send,
2070 .disconnect_recv = rpccli_bh_disconnect_recv,
2071
2072 .ref_alloc = rpccli_bh_ref_alloc,
2073 .do_ndr_print = rpccli_bh_do_ndr_print,
2074 };
2075
2076 /* initialise a rpc_pipe_client binding handle */
2077 struct dcerpc_binding_handle *rpccli_bh_create(struct rpc_pipe_client *c)
2078 {
2079 struct dcerpc_binding_handle *h;
2080 struct rpccli_bh_state *hs;
2081
2082 h = dcerpc_binding_handle_create(c,
2083 &rpccli_bh_ops,
2084 NULL,
2085 NULL, /* TODO */
2086 &hs,
2087 struct rpccli_bh_state,
2088 __location__);
2089 if (h == NULL) {
2090 return NULL;
2091 }
2092 hs->rpc_cli = c;
2093
2094 return h;
2095 }
2096
2097 NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx,
2098 struct pipe_auth_data **presult)
2099 {
2100 struct pipe_auth_data *result;
2101
2102 result = talloc(mem_ctx, struct pipe_auth_data);
2103 if (result == NULL) {
2104 return NT_STATUS_NO_MEMORY;
2105 }
2106
2107 result->auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
2108 result->auth_level = DCERPC_AUTH_LEVEL_CONNECT;
2109
2110 result->user_name = talloc_strdup(result, "");
2111 result->domain = talloc_strdup(result, "");
2112 if ((result->user_name == NULL) || (result->domain == NULL)) {
2113 TALLOC_FREE(result);
2114 return NT_STATUS_NO_MEMORY;
2115 }
2116
2117 *presult = result;
2118 return NT_STATUS_OK;
2119 }
2120
2121 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2122 struct pipe_auth_data **presult)
2123 {
2124 struct pipe_auth_data *result;
2125
2126 result = talloc(mem_ctx, struct pipe_auth_data);
2127 if (result == NULL) {
2128 return NT_STATUS_NO_MEMORY;
2129 }
2130
2131 result->auth_type = DCERPC_AUTH_TYPE_NONE;
2132 result->auth_level = DCERPC_AUTH_LEVEL_NONE;
2133
2134 result->user_name = talloc_strdup(result, "");
2135 result->domain = talloc_strdup(result, "");
2136 if ((result->user_name == NULL) || (result->domain == NULL)) {
2137 TALLOC_FREE(result);
2138 return NT_STATUS_NO_MEMORY;
2139 }
2140
2141 *presult = result;
2142 return NT_STATUS_OK;
2143 }
2144
2145 static NTSTATUS rpccli_generic_bind_data(TALLOC_CTX *mem_ctx,
2146 enum dcerpc_AuthType auth_type,
2147 enum dcerpc_AuthLevel auth_level,
2148 const char *server,
2149 const char *target_service,
2150 const char *domain,
2151 const char *username,
2152 const char *password,
2153 enum credentials_use_kerberos use_kerberos,
2154 struct pipe_auth_data **presult)
2155 {
2156 struct auth_generic_state *auth_generic_ctx;
2157 struct pipe_auth_data *result;
2158 NTSTATUS status;
2159
2160 result = talloc(mem_ctx, struct pipe_auth_data);
2161 if (result == NULL) {
2162 return NT_STATUS_NO_MEMORY;
2163 }
2164
2165 result->auth_type = auth_type;
2166 result->auth_level = auth_level;
2167
2168 result->user_name = talloc_strdup(result, username);
2169 result->domain = talloc_strdup(result, domain);
2170 if ((result->user_name == NULL) || (result->domain == NULL)) {
2171 status = NT_STATUS_NO_MEMORY;
2172 goto fail;
2173 }
2174
2175 status = auth_generic_client_prepare(result,
2176 &auth_generic_ctx);
2177 if (!NT_STATUS_IS_OK(status)) {
2178 goto fail;
2179 }
2180
2181 status = auth_generic_set_username(auth_generic_ctx, username);
2182 if (!NT_STATUS_IS_OK(status)) {
2183 goto fail;
2184 }
2185
2186 status = auth_generic_set_domain(auth_generic_ctx, domain);
2187 if (!NT_STATUS_IS_OK(status)) {
2188 goto fail;
2189 }
2190
2191 status = auth_generic_set_password(auth_generic_ctx, password);
2192 if (!NT_STATUS_IS_OK(status)) {
2193 goto fail;
2194 }
2195
2196 status = gensec_set_target_service(auth_generic_ctx->gensec_security, target_service);
2197 if (!NT_STATUS_IS_OK(status)) {
2198 goto fail;
2199 }
2200
2201 status = gensec_set_target_hostname(auth_generic_ctx->gensec_security, server);
2202 if (!NT_STATUS_IS_OK(status)) {
2203 goto fail;
2204 }
2205
2206 cli_credentials_set_kerberos_state(auth_generic_ctx->credentials, use_kerberos);
2207
2208 status = auth_generic_client_start_by_authtype(auth_generic_ctx, auth_type, auth_level);
2209 if (!NT_STATUS_IS_OK(status)) {
2210 goto fail;
2211 }
2212
2213 result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2214 talloc_free(auth_generic_ctx);
2215 *presult = result;
2216 return NT_STATUS_OK;
2217
2218 fail:
2219 TALLOC_FREE(result);
2220 return status;
2221 }
2222
2223 static NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx,
2224 const char *domain,
2225 enum dcerpc_AuthLevel auth_level,
2226 struct netlogon_creds_CredentialState *creds,
2227 struct pipe_auth_data **presult)
2228 {
2229 struct schannel_state *schannel_auth;
2230 struct pipe_auth_data *result;
2231
2232 result = talloc(mem_ctx, struct pipe_auth_data);
2233 if (result == NULL) {
2234 return NT_STATUS_NO_MEMORY;
2235 }
2236
2237 result->auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
2238 result->auth_level = auth_level;
2239
2240 result->user_name = talloc_strdup(result, "");
2241 result->domain = talloc_strdup(result, domain);
2242 if ((result->user_name == NULL) || (result->domain == NULL)) {
2243 goto fail;
2244 }
2245
2246 schannel_auth = talloc_zero(result, struct schannel_state);
2247 if (schannel_auth == NULL) {
2248 goto fail;
2249 }
2250
2251 schannel_auth->state = SCHANNEL_STATE_START;
2252 schannel_auth->initiator = true;
2253 schannel_auth->creds = netlogon_creds_copy(schannel_auth, creds);
2254 if (schannel_auth->creds == NULL) {
2255 goto fail;
2256 }
2257
2258 result->auth_ctx = schannel_auth;
2259 *presult = result;
2260 return NT_STATUS_OK;
2261
2262 fail:
2263 TALLOC_FREE(result);
2264 return NT_STATUS_NO_MEMORY;
2265 }
2266
2267 /**
2268 * Create an rpc pipe client struct, connecting to a tcp port.
2269 */
2270 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
2271 const struct sockaddr_storage *ss_addr,
2272 uint16_t port,
2273 const struct ndr_interface_table *table,
2274 struct rpc_pipe_client **presult)
2275 {
2276 struct rpc_pipe_client *result;
2277 struct sockaddr_storage addr;
2278 NTSTATUS status;
2279 int fd;
2280
2281 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2282 if (result == NULL) {
2283 return NT_STATUS_NO_MEMORY;
2284 }
2285
2286 result->abstract_syntax = table->syntax_id;
2287 result->transfer_syntax = ndr_transfer_syntax_ndr;
2288
2289 result->desthost = talloc_strdup(result, host);
2290 result->srv_name_slash = talloc_asprintf_strupper_m(
2291 result, "\\\\%s", result->desthost);
2292 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2293 status = NT_STATUS_NO_MEMORY;
2294 goto fail;
2295 }
2296
2297 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2298 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2299
2300 if (ss_addr == NULL) {
2301 if (!resolve_name(host, &addr, NBT_NAME_SERVER, false)) {
2302 status = NT_STATUS_NOT_FOUND;
2303 goto fail;
2304 }
2305 } else {
2306 addr = *ss_addr;
2307 }
2308
2309 status = open_socket_out(&addr, port, 60*1000, &fd);
2310 if (!NT_STATUS_IS_OK(status)) {
2311 goto fail;
2312 }
2313 set_socket_options(fd, lp_socket_options());
2314
2315 status = rpc_transport_sock_init(result, fd, &result->transport);
2316 if (!NT_STATUS_IS_OK(status)) {
2317 close(fd);
2318 goto fail;
2319 }
2320
2321 result->transport->transport = NCACN_IP_TCP;
2322
2323 result->binding_handle = rpccli_bh_create(result);
2324 if (result->binding_handle == NULL) {
2325 TALLOC_FREE(result);
2326 return NT_STATUS_NO_MEMORY;
2327 }
2328
2329 *presult = result;
2330 return NT_STATUS_OK;
2331
2332 fail:
2333 TALLOC_FREE(result);
2334 return status;
2335 }
2336
2337 /**
2338 * Determine the tcp port on which a dcerpc interface is listening
2339 * for the ncacn_ip_tcp transport via the endpoint mapper of the
2340 * target host.
2341 */
2342 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
2343 const struct sockaddr_storage *addr,
2344 const struct ndr_interface_table *table,
2345 uint16_t *pport)
2346 {
2347 NTSTATUS status;
2348 struct rpc_pipe_client *epm_pipe = NULL;
2349 struct dcerpc_binding_handle *epm_handle = NULL;
2350 struct pipe_auth_data *auth = NULL;
2351 struct dcerpc_binding *map_binding = NULL;
2352 struct dcerpc_binding *res_binding = NULL;
2353 struct epm_twr_t *map_tower = NULL;
2354 struct epm_twr_t *res_towers = NULL;
2355 struct policy_handle *entry_handle = NULL;
2356 uint32_t num_towers = 0;
2357 uint32_t max_towers = 1;
2358 struct epm_twr_p_t towers;
2359 TALLOC_CTX *tmp_ctx = talloc_stackframe();
2360 uint32_t result = 0;
2361
2362 if (pport == NULL) {
2363 status = NT_STATUS_INVALID_PARAMETER;
2364 goto done;
2365 }
2366
2367 if (ndr_syntax_id_equal(&table->syntax_id,
2368 &ndr_table_epmapper.syntax_id)) {
2369 *pport = 135;
2370 return NT_STATUS_OK;
2371 }
2372
2373 /* open the connection to the endpoint mapper */
2374 status = rpc_pipe_open_tcp_port(tmp_ctx, host, addr, 135,
2375 &ndr_table_epmapper,
2376 &epm_pipe);
2377
2378 if (!NT_STATUS_IS_OK(status)) {
2379 goto done;
2380 }
2381 epm_handle = epm_pipe->binding_handle;
2382
2383 status = rpccli_anon_bind_data(tmp_ctx, &auth);
2384 if (!NT_STATUS_IS_OK(status)) {
2385 goto done;
2386 }
2387
2388 status = rpc_pipe_bind(epm_pipe, auth);
2389 if (!NT_STATUS_IS_OK(status)) {
2390 goto done;
2391 }
2392
2393 /* create tower for asking the epmapper */
2394
2395 map_binding = talloc_zero(tmp_ctx, struct dcerpc_binding);
2396 if (map_binding == NULL) {
2397 status = NT_STATUS_NO_MEMORY;
2398 goto done;
2399 }
2400
2401 map_binding->transport = NCACN_IP_TCP;
2402 map_binding->object = table->syntax_id;
2403 map_binding->host = host; /* needed? */
2404 map_binding->endpoint = "0"; /* correct? needed? */
2405
2406 map_tower = talloc_zero(tmp_ctx, struct epm_twr_t);
2407 if (map_tower == NULL) {
2408 status = NT_STATUS_NO_MEMORY;
2409 goto done;
2410 }
2411
2412 status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
2413 &(map_tower->tower));
2414 if (!NT_STATUS_IS_OK(status)) {
2415 goto done;
2416 }
2417
2418 /* allocate further parameters for the epm_Map call */
2419
2420 res_towers = talloc_array(tmp_ctx, struct epm_twr_t, max_towers);
2421 if (res_towers == NULL) {
2422 status = NT_STATUS_NO_MEMORY;
2423 goto done;
2424 }
2425 towers.twr = res_towers;
2426
2427 entry_handle = talloc_zero(tmp_ctx, struct policy_handle);
2428 if (entry_handle == NULL) {
2429 status = NT_STATUS_NO_MEMORY;
2430 goto done;
2431 }
2432
2433 /* ask the endpoint mapper for the port */
2434
2435 status = dcerpc_epm_Map(epm_handle,
2436 tmp_ctx,
2437 discard_const_p(struct GUID,
2438 &(table->syntax_id.uuid)),
2439 map_tower,
2440 entry_handle,
2441 max_towers,
2442 &num_towers,
2443 &towers,
2444 &result);
2445
2446 if (!NT_STATUS_IS_OK(status)) {
2447 goto done;
2448 }
2449
2450 if (result != EPMAPPER_STATUS_OK) {
2451 status = NT_STATUS_UNSUCCESSFUL;
2452 goto done;
2453 }
2454
2455 if (num_towers != 1) {
2456 status = NT_STATUS_UNSUCCESSFUL;
2457 goto done;
2458 }
2459
2460 /* extract the port from the answer */
2461
2462 status = dcerpc_binding_from_tower(tmp_ctx,
2463 &(towers.twr->tower),
2464 &res_binding);
2465 if (!NT_STATUS_IS_OK(status)) {
2466 goto done;
2467 }
2468
2469 /* are further checks here necessary? */
2470 if (res_binding->transport != NCACN_IP_TCP) {
2471 status = NT_STATUS_UNSUCCESSFUL;
2472 goto done;
2473 }
2474
2475 *pport = (uint16_t)atoi(res_binding->endpoint);
2476
2477 done:
2478 TALLOC_FREE(tmp_ctx);
2479 return status;
2480 }
2481
2482 /**
2483 * Create a rpc pipe client struct, connecting to a host via tcp.
2484 * The port is determined by asking the endpoint mapper on the given
2485 * host.
2486 */
2487 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
2488 const struct sockaddr_storage *addr,
2489 const struct ndr_interface_table *table,
2490 struct rpc_pipe_client **presult)
2491 {
2492 NTSTATUS status;
2493 uint16_t port = 0;
2494
2495 status = rpc_pipe_get_tcp_port(host, addr, table, &port);
2496 if (!NT_STATUS_IS_OK(status)) {
2497 return status;
2498 }
2499
2500 return rpc_pipe_open_tcp_port(mem_ctx, host, addr, port,
2501 table, presult);
2502 }
2503
2504 /********************************************************************
2505 Create a rpc pipe client struct, connecting to a unix domain socket
2506 ********************************************************************/
2507 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
2508 const struct ndr_interface_table *table,
2509 struct rpc_pipe_client **presult)
2510 {
2511 struct rpc_pipe_client *result;
2512 struct sockaddr_un addr;
2513 NTSTATUS status;
2514 int fd;
2515 socklen_t salen;
2516
2517 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2518 if (result == NULL) {
2519 return NT_STATUS_NO_MEMORY;
2520 }
2521
2522 result->abstract_syntax = table->syntax_id;
2523 result->transfer_syntax = ndr_transfer_syntax_ndr;
2524
2525 result->desthost = get_myname(result);
2526 result->srv_name_slash = talloc_asprintf_strupper_m(
2527 result, "\\\\%s", result->desthost);
2528 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2529 status = NT_STATUS_NO_MEMORY;
2530 goto fail;
2531 }
2532
2533 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2534 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2535
2536 fd = socket(AF_UNIX, SOCK_STREAM, 0);
2537 if (fd == -1) {
2538 status = map_nt_error_from_unix(errno);
2539 goto fail;
2540 }
2541
2542 ZERO_STRUCT(addr);
2543 addr.sun_family = AF_UNIX;
2544 strlcpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
2545 salen = sizeof(struct sockaddr_un);
2546
2547 if (connect(fd, (struct sockaddr *)(void *)&addr, salen) == -1) {
2548 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
2549 strerror(errno)));
2550 close(fd);
2551 return map_nt_error_from_unix(errno);
2552 }
2553
2554 status = rpc_transport_sock_init(result, fd, &result->transport);
2555 if (!NT_STATUS_IS_OK(status)) {
2556 close(fd);
2557 goto fail;
2558 }
2559
2560 result->transport->transport = NCALRPC;
2561
2562 result->binding_handle = rpccli_bh_create(result);
2563 if (result->binding_handle == NULL) {
2564 TALLOC_FREE(result);
2565 return NT_STATUS_NO_MEMORY;
2566 }
2567
2568 *presult = result;
2569 return NT_STATUS_OK;
2570
2571 fail:
2572 TALLOC_FREE(result);
2573 return status;
2574 }
2575
2576 struct rpc_pipe_client_np_ref {
2577 struct cli_state *cli;
2578 struct rpc_pipe_client *pipe;
2579 };
2580
2581 static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
2582 {
2583 DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
2584 return 0;
2585 }
2586
2587 /****************************************************************************
2588 Open a named pipe over SMB to a remote server.
2589 *
2590 * CAVEAT CALLER OF THIS FUNCTION:
2591 * The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
2592 * so be sure that this function is called AFTER any structure (vs pointer)
2593 * assignment of the cli. In particular, libsmbclient does structure
2594 * assignments of cli, which invalidates the data in the returned
2595 * rpc_pipe_client if this function is called before the structure assignment
2596 * of cli.
2597 *
2598 ****************************************************************************/
2599
2600 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
2601 const struct ndr_interface_table *table,
2602 struct rpc_pipe_client **presult)
2603 {
2604 struct rpc_pipe_client *result;
2605 NTSTATUS status;
2606 struct rpc_pipe_client_np_ref *np_ref;
2607
2608 /* sanity check to protect against crashes */
2609
2610 if ( !cli ) {
2611 return NT_STATUS_INVALID_HANDLE;
2612 }
2613
2614 result = talloc_zero(NULL, struct rpc_pipe_client);
2615 if (result == NULL) {
2616 return NT_STATUS_NO_MEMORY;
2617 }
2618
2619 result->abstract_syntax = table->syntax_id;
2620 result->transfer_syntax = ndr_transfer_syntax_ndr;
2621 result->desthost = talloc_strdup(result, smbXcli_conn_remote_name(cli->conn));
2622 result->srv_name_slash = talloc_asprintf_strupper_m(
2623 result, "\\\\%s", result->desthost);
2624
2625 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2626 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2627
2628 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2629 TALLOC_FREE(result);
2630 return NT_STATUS_NO_MEMORY;
2631 }
2632
2633 status = rpc_transport_np_init(result, cli, table,
2634 &result->transport);
2635 if (!NT_STATUS_IS_OK(status)) {
2636 TALLOC_FREE(result);
2637 return status;
2638 }
2639
2640 result->transport->transport = NCACN_NP;
2641
2642 np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
2643 if (np_ref == NULL) {
2644 TALLOC_FREE(result);
2645 return NT_STATUS_NO_MEMORY;
2646 }
2647 np_ref->cli = cli;
2648 np_ref->pipe = result;
2649
2650 DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
2651 talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
2652
2653 result->binding_handle = rpccli_bh_create(result);
2654 if (result->binding_handle == NULL) {
2655 TALLOC_FREE(result);
2656 return NT_STATUS_NO_MEMORY;
2657 }
2658
2659 *presult = result;
2660 return NT_STATUS_OK;
2661 }
2662
2663 /****************************************************************************
2664 Open a pipe to a remote server.
2665 ****************************************************************************/
2666
2667 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
2668 enum dcerpc_transport_t transport,
2669 const struct ndr_interface_table *table,
2670 struct rpc_pipe_client **presult)
2671 {
2672 switch (transport) {
2673 case NCACN_IP_TCP:
2674 return rpc_pipe_open_tcp(NULL,
2675 smbXcli_conn_remote_name(cli->conn),
2676 smbXcli_conn_remote_sockaddr(cli->conn),
2677 table, presult);
2678 case NCACN_NP:
2679 return rpc_pipe_open_np(cli, table, presult);
2680 default:
2681 return NT_STATUS_NOT_IMPLEMENTED;
2682 }
2683 }
2684
2685 /****************************************************************************
2686 Open a named pipe to an SMB server and bind anonymously.
2687 ****************************************************************************/
2688
2689 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
2690 enum dcerpc_transport_t transport,
2691 const struct ndr_interface_table *table,
2692 struct rpc_pipe_client **presult)
2693 {
2694 struct rpc_pipe_client *result;
2695 struct pipe_auth_data *auth;
2696 NTSTATUS status;
2697
2698 status = cli_rpc_pipe_open(cli, transport, table, &result);
2699 if (!NT_STATUS_IS_OK(status)) {
2700 return status;
2701 }
2702
2703 status = rpccli_anon_bind_data(result, &auth);
2704 if (!NT_STATUS_IS_OK(status)) {
2705 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
2706 nt_errstr(status)));
2707 TALLOC_FREE(result);
2708 return status;
2709 }
2710
2711 /*
2712 * This is a bit of an abstraction violation due to the fact that an
2713 * anonymous bind on an authenticated SMB inherits the user/domain
2714 * from the enclosing SMB creds
2715 */
2716
2717 TALLOC_FREE(auth->user_name);
2718 TALLOC_FREE(auth->domain);
2719
2720 auth->user_name = talloc_strdup(auth, cli->user_name);
2721 auth->domain = talloc_strdup(auth, cli->domain);
2722
2723 if (transport == NCACN_NP) {
2724 struct smbXcli_session *session;
2725
2726 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
2727 session = cli->smb2.session;
2728 } else {
2729 session = cli->smb1.session;
2730 }
2731
2732 status = smbXcli_session_application_key(session, auth,
2733 &auth->transport_session_key);
2734 if (!NT_STATUS_IS_OK(status)) {
2735 auth->transport_session_key = data_blob_null;
2736 }
2737 }
2738
2739 if ((auth->user_name == NULL) || (auth->domain == NULL)) {
2740 TALLOC_FREE(result);
2741 return NT_STATUS_NO_MEMORY;
2742 }
2743
2744 status = rpc_pipe_bind(result, auth);
2745 if (!NT_STATUS_IS_OK(status)) {
2746 int lvl = 0;
2747 if (ndr_syntax_id_equal(&table->syntax_id,
2748 &ndr_table_dssetup.syntax_id)) {
2749 /* non AD domains just don't have this pipe, avoid
2750 * level 0 statement in that case - gd */
2751 lvl = 3;
2752 }
2753 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
2754 "%s failed with error %s\n",
2755 get_pipe_name_from_syntax(talloc_tos(),
2756 &table->syntax_id),
2757 nt_errstr(status) ));
2758 TALLOC_FREE(result);
2759 return status;
2760 }
2761
2762 DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
2763 "%s and bound anonymously.\n",
2764 get_pipe_name_from_syntax(talloc_tos(), &table->syntax_id),
2765 result->desthost));
2766
2767 *presult = result;
2768 return NT_STATUS_OK;
2769 }
2770
2771 /****************************************************************************
2772 ****************************************************************************/
2773
2774 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
2775 const struct ndr_interface_table *table,
2776 struct rpc_pipe_client **presult)
2777 {
2778 return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
2779 table, presult);
2780 }
2781
2782 /****************************************************************************
2783 Open a named pipe to an SMB server and bind using the mech specified
2784 ****************************************************************************/
2785
2786 NTSTATUS cli_rpc_pipe_open_generic_auth(struct cli_state *cli,
2787 const struct ndr_interface_table *table,
2788 enum dcerpc_transport_t transport,
2789 enum dcerpc_AuthType auth_type,
2790 enum dcerpc_AuthLevel auth_level,
2791 const char *server,
2792 const char *domain,
2793 const char *username,
2794 const char *password,
2795 struct rpc_pipe_client **presult)
2796 {
2797 struct rpc_pipe_client *result;
2798 struct pipe_auth_data *auth = NULL;
2799 const char *target_service = table->authservices->names[0];
2800
2801 NTSTATUS status;
2802
2803 status = cli_rpc_pipe_open(cli, transport, table, &result);
2804 if (!NT_STATUS_IS_OK(status)) {
2805 return status;
2806 }
2807
2808 status = rpccli_generic_bind_data(result,
2809 auth_type, auth_level,
2810 server, target_service,
2811 domain, username, password,
2812 CRED_AUTO_USE_KERBEROS,
2813 &auth);
2814 if (!NT_STATUS_IS_OK(status)) {
2815 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
2816 nt_errstr(status)));
2817 goto err;
2818 }
2819
2820 status = rpc_pipe_bind(result, auth);
2821 if (!NT_STATUS_IS_OK(status)) {
2822 DEBUG(0, ("cli_rpc_pipe_open_generic_auth: cli_rpc_pipe_bind failed with error %s\n",
2823 nt_errstr(status) ));
2824 goto err;
2825 }
2826
2827 DEBUG(10,("cli_rpc_pipe_open_generic_auth: opened pipe %s to "
2828 "machine %s and bound as user %s\\%s.\n", table->name,
2829 result->desthost, domain, username));
2830
2831 *presult = result;
2832 return NT_STATUS_OK;
2833
2834 err:
2835
2836 TALLOC_FREE(result);
2837 return status;
2838 }
2839
2840 /****************************************************************************
2841 External interface.
2842 Open a named pipe to an SMB server and bind using schannel (bind type 68)
2843 using session_key. sign and seal.
2844
2845 The *pdc will be stolen onto this new pipe
2846 ****************************************************************************/
2847
2848 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
2849 const struct ndr_interface_table *table,
2850 enum dcerpc_transport_t transport,
2851 enum dcerpc_AuthLevel auth_level,
2852 const char *domain,
2853 struct netlogon_creds_CredentialState **pdc,
2854 struct rpc_pipe_client **_rpccli)
2855 {
2856 struct rpc_pipe_client *rpccli;
2857 struct pipe_auth_data *rpcauth;
2858 NTSTATUS status;
2859 NTSTATUS result;
2860 struct netlogon_creds_CredentialState save_creds;
2861 struct netr_Authenticator auth;
2862 struct netr_Authenticator return_auth;
2863 union netr_Capabilities capabilities;
2864
2865 status = cli_rpc_pipe_open(cli, transport, table, &rpccli);
2866 if (!NT_STATUS_IS_OK(status)) {
2867 return status;
2868 }
2869
2870 status = rpccli_schannel_bind_data(rpccli, domain, auth_level,
2871 *pdc, &rpcauth);
2872 if (!NT_STATUS_IS_OK(status)) {
2873 DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
2874 nt_errstr(status)));
2875 TALLOC_FREE(rpccli);
2876 return status;
2877 }
2878
2879 /*
2880 * The credentials on a new netlogon pipe are the ones we are passed
2881 * in - copy them over
2882 *
2883 * This may get overwritten... in rpc_pipe_bind()...
2884 */
2885 rpccli->dc = netlogon_creds_copy(rpccli, *pdc);
2886 if (rpccli->dc == NULL) {
2887 TALLOC_FREE(rpccli);
2888 return NT_STATUS_NO_MEMORY;
2889 }
2890
2891 status = rpc_pipe_bind(rpccli, rpcauth);
2892 if (!NT_STATUS_IS_OK(status)) {
2893 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
2894 "cli_rpc_pipe_bind failed with error %s\n",
2895 nt_errstr(status) ));
2896 TALLOC_FREE(rpccli);
2897 return status;
2898 }
2899
2900 if (!ndr_syntax_id_equal(&table->syntax_id, &ndr_table_netlogon.syntax_id)) {
2901 goto done;
2902 }
2903
2904 save_creds = *rpccli->dc;
2905 ZERO_STRUCT(return_auth);
2906 ZERO_STRUCT(capabilities);
2907
2908 netlogon_creds_client_authenticator(&save_creds, &auth);
2909
2910 status = dcerpc_netr_LogonGetCapabilities(rpccli->binding_handle,
2911 talloc_tos(),
2912 rpccli->srv_name_slash,
2913 save_creds.computer_name,
2914 &auth, &return_auth,
2915 1, &capabilities,
2916 &result);
2917 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
2918 if (save_creds.negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
2919 DEBUG(5, ("AES was negotiated and the error was %s - "
2920 "downgrade detected\n",
2921 nt_errstr(status)));
2922 TALLOC_FREE(rpccli);
2923 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2924 }
2925
2926 /* This is probably an old Samba Version */
2927 DEBUG(5, ("We are checking against an NT or old Samba - %s\n",
2928 nt_errstr(status)));
2929 goto done;
2930 }
2931
2932 if (!NT_STATUS_IS_OK(status)) {
2933 DEBUG(0, ("dcerpc_netr_LogonGetCapabilities failed with %s\n",
2934 nt_errstr(status)));
2935 TALLOC_FREE(rpccli);
2936 return status;
2937 }
2938
2939 if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED)) {
2940 if (save_creds.negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
2941 /* This means AES isn't supported. */
2942 DEBUG(5, ("AES was negotiated and the result was %s - "
2943 "downgrade detected\n",
2944 nt_errstr(result)));
2945 TALLOC_FREE(rpccli);
2946 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2947 }
2948
2949 /* This is probably an old Windows version */
2950 DEBUG(5, ("We are checking against an win2k3 or Samba - %s\n",
2951 nt_errstr(result)));
2952 goto done;
2953 }
2954
2955 /*
2956 * We need to check the credential state here, cause win2k3 and earlier
2957 * returns NT_STATUS_NOT_IMPLEMENTED
2958 */
2959 if (!netlogon_creds_client_check(&save_creds, &return_auth.cred)) {
2960 /*
2961 * Server replied with bad credential. Fail.
2962 */
2963 DEBUG(0,("cli_rpc_pipe_open_schannel_with_key: server %s "
2964 "replied with bad credential\n",
2965 rpccli->desthost));
2966 TALLOC_FREE(rpccli);
2967 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2968 }
2969 *rpccli->dc = save_creds;
2970
2971 if (!NT_STATUS_IS_OK(result)) {
2972 DEBUG(0, ("dcerpc_netr_LogonGetCapabilities failed with %s\n",
2973 nt_errstr(result)));
2974 TALLOC_FREE(rpccli);
2975 return result;
2976 }
2977
2978 if (!(save_creds.negotiate_flags & NETLOGON_NEG_SUPPORTS_AES)) {
2979 /* This means AES isn't supported. */
2980 DEBUG(5, ("AES is not negotiated, but netr_LogonGetCapabilities "
2981 "was OK - downgrade detected\n"));
2982 TALLOC_FREE(rpccli);
2983 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2984 }
2985
2986 if (save_creds.negotiate_flags != capabilities.server_capabilities) {
2987 DEBUG(0, ("The client capabilities don't match the server "
2988 "capabilities: local[0x%08X] remote[0x%08X]\n",
2989 save_creds.negotiate_flags,
2990 capabilities.server_capabilities));
2991 TALLOC_FREE(rpccli);
2992 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2993 }
2994
2995 done:
2996 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
2997 "for domain %s and bound using schannel.\n",
2998 get_pipe_name_from_syntax(talloc_tos(), &table->syntax_id),
2999 rpccli->desthost, domain));
3000
3001 *_rpccli = rpccli;
3002 return NT_STATUS_OK;
3003 }
3004
3005 NTSTATUS cli_rpc_pipe_open_spnego(struct cli_state *cli,
3006 const struct ndr_interface_table *table,
3007 enum dcerpc_transport_t transport,
3008 const char *oid,
3009 enum dcerpc_AuthLevel auth_level,
3010 const char *server,
3011 const char *domain,
3012 const char *username,
3013 const char *password,
3014 struct rpc_pipe_client **presult)
3015 {
3016 struct rpc_pipe_client *result;
3017 struct pipe_auth_data *auth = NULL;
3018 const char *target_service = table->authservices->names[0];
3019
3020 NTSTATUS status;
3021 enum credentials_use_kerberos use_kerberos;
3022
3023 if (strcmp(oid, GENSEC_OID_KERBEROS5) == 0) {
3024 use_kerberos = CRED_MUST_USE_KERBEROS;
3025 } else if (strcmp(oid, GENSEC_OID_NTLMSSP) == 0) {
3026 use_kerberos = CRED_DONT_USE_KERBEROS;
3027 } else {
3028 return NT_STATUS_INVALID_PARAMETER;
3029 }
3030
3031 status = cli_rpc_pipe_open(cli, transport, table, &result);
3032 if (!NT_STATUS_IS_OK(status)) {
3033 return status;
3034 }
3035
3036 status = rpccli_generic_bind_data(result,
3037 DCERPC_AUTH_TYPE_SPNEGO, auth_level,
3038 server, target_service,
3039 domain, username, password,
3040 use_kerberos,
3041 &auth);
3042 if (!NT_STATUS_IS_OK(status)) {
3043 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
3044 nt_errstr(status)));
3045 goto err;
3046 }
3047
3048 status = rpc_pipe_bind(result, auth);
3049 if (!NT_STATUS_IS_OK(status)) {
3050 DEBUG(0, ("cli_rpc_pipe_open_spnego: cli_rpc_pipe_bind failed with error %s\n",
3051 nt_errstr(status) ));
3052 goto err;
3053 }
3054
3055 DEBUG(10,("cli_rpc_pipe_open_spnego: opened pipe %s to "
3056 "machine %s.\n", table->name,
3057 result->desthost));
3058
3059 *presult = result;
3060 return NT_STATUS_OK;
3061
3062 err:
3063
3064 TALLOC_FREE(result);
3065 return status;
3066 }
3067
3068 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
3069 struct rpc_pipe_client *cli,
3070 DATA_BLOB *session_key)
3071 {
3072 NTSTATUS status;
3073 struct pipe_auth_data *a;
3074 struct schannel_state *schannel_auth;
3075 struct gensec_security *gensec_security;
3076 DATA_BLOB sk = data_blob_null;
3077 bool make_dup = false;
3078
3079 if (!session_key || !cli) {
3080 return NT_STATUS_INVALID_PARAMETER;
3081 }
3082
3083 a = cli->auth;
3084
3085 if (a == NULL) {
3086 return NT_STATUS_INVALID_PARAMETER;
3087 }
3088
3089 switch (cli->auth->auth_type) {
3090 case DCERPC_AUTH_TYPE_SCHANNEL:
3091 schannel_auth = talloc_get_type_abort(a->auth_ctx,
3092 struct schannel_state);
3093 sk = data_blob_const(schannel_auth->creds->session_key, 16);
3094 make_dup = true;
3095 break;
3096 case DCERPC_AUTH_TYPE_SPNEGO:
3097 case DCERPC_AUTH_TYPE_NTLMSSP:
3098 case DCERPC_AUTH_TYPE_KRB5:
3099 gensec_security = talloc_get_type_abort(a->auth_ctx,
3100 struct gensec_security);
3101 status = gensec_session_key(gensec_security, mem_ctx, &sk);
3102 if (!NT_STATUS_IS_OK(status)) {
3103 return status;
3104 }
3105 make_dup = false;
3106 break;
3107 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
3108 case DCERPC_AUTH_TYPE_NONE:
3109 sk = data_blob_const(a->transport_session_key.data,
3110 a->transport_session_key.length);
3111 make_dup = true;
3112 break;
3113 default:
3114 break;
3115 }
3116
3117 if (!sk.data) {
3118 return NT_STATUS_NO_USER_SESSION_KEY;
3119 }
3120
3121 if (make_dup) {
3122 *session_key = data_blob_dup_talloc(mem_ctx, sk);
3123 } else {
3124 *session_key = sk;
3125 }
3126
3127 return NT_STATUS_OK;
3128 }
Samba GIT mirror