source4/librpc/rpc/dcerpc_roh_channel_in.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    [MS-RPCH] - RPC over HTTP client
   5
   6    Copyright (C) 2013 Samuel Cabrero <samuelcabrero@kernevil.me>
   7    Copyright (C) Julien Kerihuel <j.kerihuel@openchange.org> 2013
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include <tevent.h>
  25 #include <talloc.h>
  26 #include "lib/tsocket/tsocket.h"
  27 #include "lib/tls/tls.h"
  28 #include "lib/util/tevent_ntstatus.h"
  29 #include "lib/util/util_net.h"
  30 #include "libcli/resolve/resolve.h"
  31 #include "libcli/composite/composite.h"
  32 #include "auth/credentials/credentials.h"
  33 #include "auth/credentials/credentials_internal.h"
  34 #include <gen_ndr/dcerpc.h>
  35 #include <gen_ndr/ndr_dcerpc.h>
  36
  37 #include "librpc/rpc/dcerpc.h"
  38 #include "librpc/rpc/dcerpc_roh.h"
  39 #include "librpc/rpc/dcerpc_proto.h"
  40 #include "lib/http/http.h"
  41
  42 struct roh_connect_channel_state {
  43         struct tevent_context           *ev;
  44         struct cli_credentials          *credentials;
  45         struct roh_connection           *roh;
  46         struct tstream_tls_params       *tls_params;
  47 };
  48
  49 static void roh_connect_channel_in_done(struct tevent_req *);
  50 struct tevent_req *roh_connect_channel_in_send(TALLOC_CTX *mem_ctx,
  51                                                struct tevent_context *ev,
  52                                                const char *rpcproxy_ip_address,
  53                                                unsigned int rpcproxy_port,
  54                                                struct cli_credentials *credentials,
  55                                                struct roh_connection *roh,
  56                                                bool tls,
  57                                                struct tstream_tls_params *tls_params)
  58 {
  59         struct tevent_req                       *req;
  60         struct tevent_req                       *subreq;
  61         struct roh_connect_channel_state        *state;
  62
  63         DEBUG(8, ("%s: Connecting channel in socket, RPC proxy is %s:%d (TLS: %s)\n",
  64                   __func__, rpcproxy_ip_address, rpcproxy_port,
  65                   (tls ? "true" : "false")));
  66
  67         req = tevent_req_create(mem_ctx, &state, struct roh_connect_channel_state);
  68         if (req == NULL) {
  69                 return NULL;
  70         }
  71
  72         if (!is_ipaddress(rpcproxy_ip_address)) {
  73                 DEBUG(0, ("%s: Invalid host (%s), needs to be an IP address\n",
  74                           __func__, rpcproxy_ip_address));
  75                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
  76                 return tevent_req_post(req, ev);
  77         }
  78
  79         state->ev = ev;
  80         state->credentials = credentials;
  81         state->roh = roh;
  82         state->tls_params = tls_params;
  83
  84         /* Initialize channel structure */
  85         state->roh->default_channel_in = talloc_zero(roh, struct roh_channel);
  86         if (tevent_req_nomem(state->roh->default_channel_in, req)) {
  87                 return tevent_req_post(req, ev);
  88         }
  89
  90         state->roh->default_channel_in->channel_cookie = GUID_random();
  91
  92         subreq = http_connect_send(state,
  93                                    ev,
  94                                    rpcproxy_ip_address,
  95                                    rpcproxy_port,
  96                                    credentials,
  97                                    tls ? tls_params : NULL);
  98         if (tevent_req_nomem(subreq, req)) {
  99                 return tevent_req_post(req, ev);
 100         }
 101         tevent_req_set_callback(subreq, roh_connect_channel_in_done, req);
 102
 103         return req;
 104 }
 105
 106 static void roh_connect_channel_in_done(struct tevent_req *subreq)
 107 {
 108         NTSTATUS                                status;
 109         struct tevent_req                       *req;
 110         struct roh_connect_channel_state        *state;
 111         int ret;
 112
 113         req = tevent_req_callback_data(subreq, struct tevent_req);
 114         state = tevent_req_data(req, struct roh_connect_channel_state);
 115
 116         ret = http_connect_recv(subreq,
 117                                 state->roh->default_channel_in,
 118                                 &state->roh->default_channel_in->http_conn);
 119         TALLOC_FREE(subreq);
 120         if (ret != 0) {
 121                 status = map_nt_error_from_unix_common(ret);
 122                 tevent_req_nterror(req, status);
 123                 return;
 124         }
 125
 126         DBG_DEBUG("HTTP connected\n");
 127         tevent_req_done(req);
 128 }
 129
 130 NTSTATUS roh_connect_channel_in_recv(struct tevent_req *req)
 131 {
 132         NTSTATUS status;
 133
 134         if (tevent_req_is_nterror(req, &status)) {
 135                 tevent_req_received(req);
 136                 return status;
 137         }
 138
 139         tevent_req_received(req);
 140         return NT_STATUS_OK;
 141 }
 142
 143 struct roh_request_state {
 144         struct http_request     *request;
 145         struct http_request     *response;
 146 };
 147
 148 static void roh_send_RPC_DATA_IN_done(struct tevent_req *subreq);
 149 struct tevent_req *roh_send_RPC_DATA_IN_send(TALLOC_CTX *mem_ctx,
 150                                              struct loadparm_context *lp_ctx,
 151                                              struct tevent_context *ev,
 152                                              struct cli_credentials *credentials,
 153                                              struct roh_connection *roh,
 154                                              const char *rpc_server,
 155                                              uint32_t rpc_server_port,
 156                                              const char *rpc_proxy,
 157                                              uint8_t http_auth)
 158 {
 159         struct tevent_req               *req;
 160         struct tevent_req               *subreq;
 161         struct roh_request_state        *state;
 162         const char                      *path;
 163         char                            *query;
 164         char                            *uri;
 165
 166         DEBUG(8, ("%s: Sending RPC_IN_DATA request\n", __func__));
 167
 168         req = tevent_req_create(mem_ctx, &state, struct roh_request_state);
 169         if (req == NULL) {
 170                 return NULL;
 171         }
 172
 173         state->request = talloc_zero(state, struct http_request);
 174         if (tevent_req_nomem(state->request, req)) {
 175                 return tevent_req_post(req, ev);
 176         }
 177
 178         /* Build URI, as specified in section 2.2.2 */
 179         query = talloc_asprintf(state, "%s:%d", rpc_server, rpc_server_port);
 180         if (tevent_req_nomem(query, req)) {
 181                 return tevent_req_post(req, ev);
 182         }
 183
 184         /*
 185          * TODO This path changes to "/rpcwithcert/rpcproxy.dll" when using
 186          * certificates
 187          */
 188         path = "/rpc/rpcproxy.dll";
 189         uri = talloc_asprintf(state, "%s?%s", path, query);
 190         if (tevent_req_nomem(uri, req)) {
 191                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 192                 return tevent_req_post(req, ev);
 193         }
 194         TALLOC_FREE(query);
 195
 196         /*
 197          * Create the HTTP channel IN request as specified in the
 198          * section 2.1.2.1.1
 199          */
 200         state->request->type = HTTP_REQ_RPC_IN_DATA;
 201         state->request->uri = uri;
 202         state->request->body.length = 0;
 203         state->request->body.data = NULL;
 204         state->request->major = '1';
 205         state->request->minor = '0';
 206
 207         http_add_header(state, &state->request->headers,
 208                         "Accept", "application/rpc");
 209         http_add_header(state, &state->request->headers,
 210                         "User-Agent", "MSRPC");
 211         http_add_header(state, &state->request->headers,
 212                         "Host", rpc_proxy);
 213         http_add_header(state, &state->request->headers,
 214                         "Connection", "keep-alive");
 215         http_add_header(state, &state->request->headers,
 216                         "Content-Length", "1073741824");
 217         http_add_header(state, &state->request->headers,
 218                         "Cache-Control", "no-cache");
 219         http_add_header(state, &state->request->headers,
 220                         "Pragma", "no-cache");
 221
 222         subreq = http_send_auth_request_send(state,
 223                                         ev,
 224                                         roh->default_channel_in->http_conn,
 225                                         state->request,
 226                                         credentials,
 227                                         lp_ctx,
 228                                         http_auth);
 229         if (tevent_req_nomem(subreq, req)) {
 230                 return tevent_req_post(req, ev);
 231         }
 232         tevent_req_set_callback(subreq, roh_send_RPC_DATA_IN_done, req);
 233
 234         return req;
 235 }
 236
 237 static void roh_send_RPC_DATA_IN_done(struct tevent_req *subreq)
 238 {
 239         NTSTATUS                status;
 240         struct tevent_req       *req;
 241
 242         req = tevent_req_callback_data(subreq, struct tevent_req);
 243
 244         /* Receive the sent bytes to check if request has been properly sent */
 245         status = http_send_auth_request_recv(subreq);
 246         TALLOC_FREE(subreq);
 247         if (tevent_req_nterror(req, status)) {
 248                 return;
 249         }
 250
 251         DEBUG(8, ("%s: RPC_IN_DATA sent\n", __func__));
 252
 253         tevent_req_done(req);
 254 }
 255
 256 NTSTATUS roh_send_RPC_DATA_IN_recv(struct tevent_req *req)
 257 {
 258         NTSTATUS status;
 259
 260         if (tevent_req_is_nterror(req, &status)) {
 261                 tevent_req_received(req);
 262                 return status;
 263         }
 264
 265         tevent_req_received(req);
 266         return NT_STATUS_OK;
 267 }
 268
 269 struct roh_send_pdu_state {
 270         DATA_BLOB       buffer;
 271         struct iovec    iov;
 272         int             bytes_written;
 273         int             sys_errno;
 274 };
 275
 276 static void roh_send_CONN_B1_done(struct tevent_req *subreq);
 277 struct tevent_req *roh_send_CONN_B1_send(TALLOC_CTX *mem_ctx,
 278                                          struct tevent_context *ev,
 279                                          struct roh_connection *roh)
 280 {
 281         struct tevent_req               *req;
 282         struct tevent_req               *subreq;
 283         struct roh_send_pdu_state       *state;
 284         struct dcerpc_rts               rts;
 285         struct ncacn_packet             pkt;
 286         struct ndr_push                 *ndr;
 287         struct tstream_context          *stream = NULL;
 288         struct tevent_queue             *send_queue = NULL;
 289
 290         DEBUG(8, ("%s: Sending CONN/B1 request\n", __func__));
 291
 292         req = tevent_req_create(mem_ctx, &state, struct roh_send_pdu_state);
 293         if (req == NULL) {
 294                 return NULL;
 295         }
 296
 297         rts.Flags = RTS_FLAG_NONE;
 298         rts.NumberOfCommands = 6;
 299         rts.Commands = talloc_array(state, struct dcerpc_rts_cmd, 6);
 300
 301         /* CONN/B1: Version RTS command */
 302         rts.Commands[0].CommandType = 0x00000006;
 303         rts.Commands[0].Command.Version.Version = 0x00000001;
 304
 305         /* CONN/B1: VirtualConnectionCookie RTS command */
 306         rts.Commands[1].CommandType = 0x00000003;
 307         rts.Commands[1].Command.Cookie.Cookie.Cookie = roh->connection_cookie;
 308
 309         /* CONN/B1: InChannelCookie RTS command */
 310         rts.Commands[2].CommandType = 0x00000003;
 311         rts.Commands[2].Command.Cookie.Cookie.Cookie =
 312                         roh->default_channel_in->channel_cookie;
 313
 314         /* CONN/B1: ChannelLifetime */
 315         rts.Commands[3].CommandType = 0x00000004;
 316         rts.Commands[3].Command.ReceiveWindowSize.ReceiveWindowSize =
 317                         0x40000000;
 318
 319         /* CONN/B1: ClientKeepAlive */
 320         rts.Commands[4].CommandType = 0x00000005;
 321         rts.Commands[4].Command.ClientKeepalive.ClientKeepalive = 0x000493e0;
 322
 323         /* CONN/B1: AssociationGroupId */
 324         rts.Commands[5].CommandType = 0x0000000C;
 325         rts.Commands[5].Command.AssociationGroupId.AssociationGroupId.Cookie =
 326                         roh->association_group_id_cookie;
 327
 328         pkt.rpc_vers = 5;
 329         pkt.rpc_vers_minor = 0;
 330         pkt.ptype = DCERPC_PKT_RTS;
 331         pkt.pfc_flags = DCERPC_PFC_FLAG_LAST | DCERPC_PFC_FLAG_FIRST;
 332         pkt.drep[0] = DCERPC_DREP_LE;
 333         pkt.drep[1] = 0;
 334         pkt.drep[2] = 0;
 335         pkt.drep[3] = 0;
 336         pkt.frag_length = 104;
 337         pkt.auth_length = 0;
 338         pkt.call_id = 0;
 339         pkt.u.rts = rts;
 340
 341         ndr = ndr_push_init_ctx(state);
 342         if (ndr == NULL) {
 343                 return NULL;
 344         }
 345         ndr->offset = 0;
 346         ndr_push_ncacn_packet(ndr, NDR_SCALARS, &pkt);
 347
 348         state->buffer = ndr_push_blob(ndr);
 349         state->iov.iov_base = (char *) state->buffer.data;
 350         state->iov.iov_len = state->buffer.length;
 351
 352         stream = http_conn_tstream(roh->default_channel_in->http_conn);
 353         send_queue = http_conn_send_queue(roh->default_channel_in->http_conn);
 354
 355         subreq = tstream_writev_queue_send(mem_ctx,
 356                                            ev,
 357                                            stream,
 358                                            send_queue,
 359                                            &state->iov,
 360                                            1);
 361         if (tevent_req_nomem(subreq, req)) {
 362                 return tevent_req_post(req, ev);
 363         }
 364         tevent_req_set_callback(subreq, roh_send_CONN_B1_done, req);
 365
 366         return req;
 367 }
 368
 369 static void roh_send_CONN_B1_done(struct tevent_req *subreq)
 370 {
 371         NTSTATUS                        status;
 372         struct tevent_req               *req;
 373         struct roh_send_pdu_state       *state;
 374         int                             sys_errno;
 375
 376         req = tevent_req_callback_data(subreq, struct tevent_req);
 377         state = tevent_req_data(req, struct roh_send_pdu_state);
 378
 379         state->bytes_written = tstream_writev_queue_recv(subreq, &sys_errno);
 380         state->sys_errno = sys_errno;
 381         TALLOC_FREE(subreq);
 382         if (state->bytes_written <= 0 && state->sys_errno != 0) {
 383                 status = map_nt_error_from_unix_common(sys_errno);
 384                 tevent_req_nterror(req, status);
 385                 return;
 386         }
 387         DEBUG(8, ("%s: CONN/B1 sent (%d bytes written)\n",
 388                   __func__, state->bytes_written));
 389
 390         tevent_req_done(req);
 391 }
 392
 393 NTSTATUS roh_send_CONN_B1_recv(struct tevent_req *req)
 394 {
 395         NTSTATUS status;
 396
 397         if (tevent_req_is_nterror(req, &status)) {
 398                 tevent_req_received(req);
 399                 return status;
 400         }
 401
 402         tevent_req_received(req);
 403         return NT_STATUS_OK;
 404 }