?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
rpc_client: Simplify get_complete_frag_send()
[Samba.git] / source3 / rpc_client / cli_pipe.c
blob2ec672c133924cef5a031a0c9dd2a6d594bc643d
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client routines
4 * Largely rewritten by Jeremy Allison 2005.
5 * Heavily modified by Simo Sorce 2010.
6 * Copyright Andrew Bartlett 2011.
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "libsmb/namequery.h"
24 #include "../lib/util/tevent_ntstatus.h"
25 #include "librpc/gen_ndr/ndr_epmapper_c.h"
26 #include "../librpc/gen_ndr/ndr_dssetup.h"
27 #include "../libcli/auth/schannel.h"
28 #include "../libcli/auth/netlogon_creds_cli.h"
29 #include "auth_generic.h"
30 #include "librpc/gen_ndr/ndr_dcerpc.h"
31 #include "librpc/gen_ndr/ndr_netlogon_c.h"
32 #include "librpc/rpc/dcerpc.h"
33 #include "librpc/rpc/dcerpc_util.h"
34 #include "rpc_dce.h"
35 #include "cli_pipe.h"
36 #include "libsmb/libsmb.h"
37 #include "auth/gensec/gensec.h"
38 #include "auth/credentials/credentials.h"
39 #include "../libcli/smb/smbXcli_base.h"
40
41 #undef DBGC_CLASS
42 #define DBGC_CLASS DBGC_RPC_CLI
43
44 /********************************************************************
45 Pipe description for a DEBUG
46 ********************************************************************/
47 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
48 struct rpc_pipe_client *cli)
49 {
50 char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
51 if (result == NULL) {
52 return "pipe";
53 }
54 return result;
55 }
56
57 /********************************************************************
58 Rpc pipe call id.
59 ********************************************************************/
60
61 static uint32_t get_rpc_call_id(void)
62 {
63 static uint32_t call_id = 0;
64 return ++call_id;
65 }
66
67 /*******************************************************************
68 Use SMBreadX to get rest of one fragment's worth of rpc data.
69 Reads the whole size or give an error message
70 ********************************************************************/
71
72 struct rpc_read_state {
73 struct tevent_context *ev;
74 struct rpc_cli_transport *transport;
75 uint8_t *data;
76 size_t size;
77 size_t num_read;
78 };
79
80 static void rpc_read_done(struct tevent_req *subreq);
81
82 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
83 struct tevent_context *ev,
84 struct rpc_cli_transport *transport,
85 uint8_t *data, size_t size)
86 {
87 struct tevent_req *req, *subreq;
88 struct rpc_read_state *state;
89
90 req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
91 if (req == NULL) {
92 return NULL;
93 }
94 state->ev = ev;
95 state->transport = transport;
96 state->data = data;
97 state->size = size;
98 state->num_read = 0;
99
100 DBG_INFO("data_to_read: %zu\n", size);
101
102 subreq = transport->read_send(state, ev, (uint8_t *)data, size,
103 transport->priv);
104 if (subreq == NULL) {
105 goto fail;
106 }
107 tevent_req_set_callback(subreq, rpc_read_done, req);
108 return req;
109
110 fail:
111 TALLOC_FREE(req);
112 return NULL;
113 }
114
115 static void rpc_read_done(struct tevent_req *subreq)
116 {
117 struct tevent_req *req = tevent_req_callback_data(
118 subreq, struct tevent_req);
119 struct rpc_read_state *state = tevent_req_data(
120 req, struct rpc_read_state);
121 NTSTATUS status;
122 ssize_t received;
123
124 status = state->transport->read_recv(subreq, &received);
125 TALLOC_FREE(subreq);
126 if (tevent_req_nterror(req, status)) {
127 return;
128 }
129
130 state->num_read += received;
131 if (state->num_read == state->size) {
132 tevent_req_done(req);
133 return;
134 }
135
136 subreq = state->transport->read_send(state, state->ev,
137 state->data + state->num_read,
138 state->size - state->num_read,
139 state->transport->priv);
140 if (tevent_req_nomem(subreq, req)) {
141 return;
142 }
143 tevent_req_set_callback(subreq, rpc_read_done, req);
144 }
145
146 static NTSTATUS rpc_read_recv(struct tevent_req *req)
147 {
148 return tevent_req_simple_recv_ntstatus(req);
149 }
150
151 struct rpc_write_state {
152 struct tevent_context *ev;
153 struct rpc_cli_transport *transport;
154 const uint8_t *data;
155 size_t size;
156 size_t num_written;
157 };
158
159 static void rpc_write_done(struct tevent_req *subreq);
160
161 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
162 struct tevent_context *ev,
163 struct rpc_cli_transport *transport,
164 const uint8_t *data, size_t size)
165 {
166 struct tevent_req *req, *subreq;
167 struct rpc_write_state *state;
168
169 req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
170 if (req == NULL) {
171 return NULL;
172 }
173 state->ev = ev;
174 state->transport = transport;
175 state->data = data;
176 state->size = size;
177 state->num_written = 0;
178
179 DBG_INFO("data_to_write: %zu\n", size);
180
181 subreq = transport->write_send(state, ev, data, size, transport->priv);
182 if (tevent_req_nomem(subreq, req)) {
183 return tevent_req_post(req, ev);
184 }
185 tevent_req_set_callback(subreq, rpc_write_done, req);
186 return req;
187 }
188
189 static void rpc_write_done(struct tevent_req *subreq)
190 {
191 struct tevent_req *req = tevent_req_callback_data(
192 subreq, struct tevent_req);
193 struct rpc_write_state *state = tevent_req_data(
194 req, struct rpc_write_state);
195 NTSTATUS status;
196 ssize_t written;
197
198 status = state->transport->write_recv(subreq, &written);
199 TALLOC_FREE(subreq);
200 if (tevent_req_nterror(req, status)) {
201 return;
202 }
203
204 state->num_written += written;
205
206 if (state->num_written == state->size) {
207 tevent_req_done(req);
208 return;
209 }
210
211 subreq = state->transport->write_send(state, state->ev,
212 state->data + state->num_written,
213 state->size - state->num_written,
214 state->transport->priv);
215 if (tevent_req_nomem(subreq, req)) {
216 return;
217 }
218 tevent_req_set_callback(subreq, rpc_write_done, req);
219 }
220
221 static NTSTATUS rpc_write_recv(struct tevent_req *req)
222 {
223 return tevent_req_simple_recv_ntstatus(req);
224 }
225
226
227 /****************************************************************************
228 Try and get a PDU's worth of data from current_pdu. If not, then read more
229 from the wire.
230 ****************************************************************************/
231
232 struct get_complete_frag_state {
233 struct tevent_context *ev;
234 struct rpc_pipe_client *cli;
235 uint16_t frag_len;
236 DATA_BLOB *pdu;
237 };
238
239 static void get_complete_frag_got_header(struct tevent_req *subreq);
240 static void get_complete_frag_got_rest(struct tevent_req *subreq);
241
242 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
243 struct tevent_context *ev,
244 struct rpc_pipe_client *cli,
245 DATA_BLOB *pdu)
246 {
247 struct tevent_req *req, *subreq;
248 struct get_complete_frag_state *state;
249 size_t received;
250
251 req = tevent_req_create(mem_ctx, &state,
252 struct get_complete_frag_state);
253 if (req == NULL) {
254 return NULL;
255 }
256 state->ev = ev;
257 state->cli = cli;
258 state->frag_len = RPC_HEADER_LEN;
259 state->pdu = pdu;
260
261 received = pdu->length;
262 if (received < RPC_HEADER_LEN) {
263 if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
264 tevent_req_oom(req);
265 return tevent_req_post(req, ev);
266 }
267 subreq = rpc_read_send(state, state->ev,
268 state->cli->transport,
269 pdu->data + received,
270 RPC_HEADER_LEN - received);
271 if (tevent_req_nomem(subreq, req)) {
272 return tevent_req_post(req, ev);
273 }
274 tevent_req_set_callback(subreq, get_complete_frag_got_header,
275 req);
276 return req;
277 }
278
279 state->frag_len = dcerpc_get_frag_length(pdu);
280 if (state->frag_len < RPC_HEADER_LEN) {
281 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
282 return tevent_req_post(req, ev);
283 }
284
285 if (received >= state->frag_len) {
286 /*
287 * Got the whole fragment
288 */
289 tevent_req_done(req);
290 return tevent_req_post(req, ev);
291 }
292
293 if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
294 tevent_req_oom(req);
295 return tevent_req_post(req, ev);
296 }
297
298 subreq = rpc_read_send(
299 state,
300 state->ev,
301 state->cli->transport,
302 pdu->data + received,
303 state->frag_len - received);
304 if (tevent_req_nomem(subreq, req)) {
305 return tevent_req_post(req, ev);
306 }
307 tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
308 return req;
309 }
310
311 static void get_complete_frag_got_header(struct tevent_req *subreq)
312 {
313 struct tevent_req *req = tevent_req_callback_data(
314 subreq, struct tevent_req);
315 struct get_complete_frag_state *state = tevent_req_data(
316 req, struct get_complete_frag_state);
317 NTSTATUS status;
318
319 status = rpc_read_recv(subreq);
320 TALLOC_FREE(subreq);
321 if (tevent_req_nterror(req, status)) {
322 return;
323 }
324
325 state->frag_len = dcerpc_get_frag_length(state->pdu);
326 if (state->frag_len < RPC_HEADER_LEN) {
327 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
328 return;
329 }
330
331 if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
332 tevent_req_oom(req);
333 return;
334 }
335
336 /*
337 * We're here in this piece of code because we've read exactly
338 * RPC_HEADER_LEN bytes into state->pdu.
339 */
340
341 subreq = rpc_read_send(state, state->ev, state->cli->transport,
342 state->pdu->data + RPC_HEADER_LEN,
343 state->frag_len - RPC_HEADER_LEN);
344 if (tevent_req_nomem(subreq, req)) {
345 return;
346 }
347 tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
348 }
349
350 static void get_complete_frag_got_rest(struct tevent_req *subreq)
351 {
352 NTSTATUS status = rpc_read_recv(subreq);
353 return tevent_req_simple_finish_ntstatus(subreq, status);
354 }
355
356 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
357 {
358 return tevent_req_simple_recv_ntstatus(req);
359 }
360
361 /****************************************************************************
362 Do basic authentication checks on an incoming pdu.
363 ****************************************************************************/
364
365 static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
366 struct rpc_pipe_client *cli,
367 struct ncacn_packet *pkt,
368 DATA_BLOB *pdu,
369 uint8_t expected_pkt_type,
370 uint32_t call_id,
371 DATA_BLOB *rdata,
372 DATA_BLOB *reply_pdu)
373 {
374 const struct dcerpc_response *r = NULL;
375 DATA_BLOB tmp_stub = { .data = NULL };
376 NTSTATUS ret;
377
378 /*
379 * Point the return values at the real data including the RPC
380 * header. Just in case the caller wants it.
381 */
382 *rdata = *pdu;
383
384 if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
385 !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
386 /*
387 * TODO: do we still need this hack which was introduced
388 * in commit a42afcdcc7ab9aa9ed193ae36d3dbb10843447f0.
389 *
390 * I don't even know what AS/U might be...
391 */
392 DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
393 "fragment first/last ON.\n"));
394 pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
395 }
396
397 /* Ensure we have the correct type. */
398 switch (pkt->ptype) {
399 case DCERPC_PKT_BIND_NAK:
400 DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
401 rpccli_pipe_txt(talloc_tos(), cli)));
402
403 ret = dcerpc_verify_ncacn_packet_header(pkt,
404 DCERPC_PKT_BIND_NAK,
405 0, /* max_auth_info */
406 DCERPC_PFC_FLAG_FIRST |
407 DCERPC_PFC_FLAG_LAST,
408 0); /* optional flags */
409 if (!NT_STATUS_IS_OK(ret)) {
410 DEBUG(1, (__location__ ": Connection to %s got an unexpected "
411 "RPC packet type - %u, expected %u: %s\n",
412 rpccli_pipe_txt(talloc_tos(), cli),
413 pkt->ptype, expected_pkt_type,
414 nt_errstr(ret)));
415 NDR_PRINT_DEBUG(ncacn_packet, pkt);
416 return ret;
417 }
418
419 /* Use this for now... */
420 return NT_STATUS_NETWORK_ACCESS_DENIED;
421
422 case DCERPC_PKT_BIND_ACK:
423 ret = dcerpc_verify_ncacn_packet_header(pkt,
424 expected_pkt_type,
425 pkt->u.bind_ack.auth_info.length,
426 DCERPC_PFC_FLAG_FIRST |
427 DCERPC_PFC_FLAG_LAST,
428 DCERPC_PFC_FLAG_CONC_MPX |
429 DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN);
430 if (!NT_STATUS_IS_OK(ret)) {
431 DEBUG(1, (__location__ ": Connection to %s got an unexpected "
432 "RPC packet type - %u, expected %u: %s\n",
433 rpccli_pipe_txt(talloc_tos(), cli),
434 pkt->ptype, expected_pkt_type,
435 nt_errstr(ret)));
436 NDR_PRINT_DEBUG(ncacn_packet, pkt);
437 return ret;
438 }
439
440 break;
441
442 case DCERPC_PKT_ALTER_RESP:
443 ret = dcerpc_verify_ncacn_packet_header(pkt,
444 expected_pkt_type,
445 pkt->u.alter_resp.auth_info.length,
446 DCERPC_PFC_FLAG_FIRST |
447 DCERPC_PFC_FLAG_LAST,
448 DCERPC_PFC_FLAG_CONC_MPX |
449 DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN);
450 if (!NT_STATUS_IS_OK(ret)) {
451 DEBUG(1, (__location__ ": Connection to %s got an unexpected "
452 "RPC packet type - %u, expected %u: %s\n",
453 rpccli_pipe_txt(talloc_tos(), cli),
454 pkt->ptype, expected_pkt_type,
455 nt_errstr(ret)));
456 NDR_PRINT_DEBUG(ncacn_packet, pkt);
457 return ret;
458 }
459
460 break;
461
462 case DCERPC_PKT_RESPONSE:
463
464 r = &pkt->u.response;
465
466 ret = dcerpc_verify_ncacn_packet_header(pkt,
467 expected_pkt_type,
468 r->stub_and_verifier.length,
469 0, /* required_flags */
470 DCERPC_PFC_FLAG_FIRST |
471 DCERPC_PFC_FLAG_LAST);
472 if (!NT_STATUS_IS_OK(ret)) {
473 DEBUG(1, (__location__ ": Connection to %s got an unexpected "
474 "RPC packet type - %u, expected %u: %s\n",
475 rpccli_pipe_txt(talloc_tos(), cli),
476 pkt->ptype, expected_pkt_type,
477 nt_errstr(ret)));
478 NDR_PRINT_DEBUG(ncacn_packet, pkt);
479 return ret;
480 }
481
482 tmp_stub.data = r->stub_and_verifier.data;
483 tmp_stub.length = r->stub_and_verifier.length;
484
485 /* Here's where we deal with incoming sign/seal. */
486 ret = dcerpc_check_auth(cli->auth, pkt,
487 &tmp_stub,
488 DCERPC_RESPONSE_LENGTH,
489 pdu);
490 if (!NT_STATUS_IS_OK(ret)) {
491 DEBUG(1, (__location__ ": Connection to %s got an unexpected "
492 "RPC packet type - %u, expected %u: %s\n",
493 rpccli_pipe_txt(talloc_tos(), cli),
494 pkt->ptype, expected_pkt_type,
495 nt_errstr(ret)));
496 NDR_PRINT_DEBUG(ncacn_packet, pkt);
497 return ret;
498 }
499
500 /* Point the return values at the NDR data. */
501 *rdata = tmp_stub;
502
503 DEBUG(10, ("Got pdu len %lu, data_len %lu\n",
504 (long unsigned int)pdu->length,
505 (long unsigned int)rdata->length));
506
507 /*
508 * If this is the first reply, and the allocation hint is
509 * reasonable, try and set up the reply_pdu DATA_BLOB to the
510 * correct size.
511 */
512
513 if ((reply_pdu->length == 0) &&
514 r->alloc_hint && (r->alloc_hint < 15*1024*1024)) {
515 if (!data_blob_realloc(mem_ctx, reply_pdu,
516 r->alloc_hint)) {
517 DEBUG(0, ("reply alloc hint %d too "
518 "large to allocate\n",
519 (int)r->alloc_hint));
520 return NT_STATUS_NO_MEMORY;
521 }
522 }
523
524 break;
525
526 case DCERPC_PKT_FAULT:
527
528 ret = dcerpc_verify_ncacn_packet_header(pkt,
529 DCERPC_PKT_FAULT,
530 0, /* max_auth_info */
531 DCERPC_PFC_FLAG_FIRST |
532 DCERPC_PFC_FLAG_LAST,
533 DCERPC_PFC_FLAG_DID_NOT_EXECUTE);
534 if (!NT_STATUS_IS_OK(ret)) {
535 DEBUG(1, (__location__ ": Connection to %s got an unexpected "
536 "RPC packet type - %u, expected %u: %s\n",
537 rpccli_pipe_txt(talloc_tos(), cli),
538 pkt->ptype, expected_pkt_type,
539 nt_errstr(ret)));
540 NDR_PRINT_DEBUG(ncacn_packet, pkt);
541 return ret;
542 }
543
544 DEBUG(1, (__location__ ": RPC fault code %s received "
545 "from %s!\n",
546 dcerpc_errstr(talloc_tos(),
547 pkt->u.fault.status),
548 rpccli_pipe_txt(talloc_tos(), cli)));
549
550 return dcerpc_fault_to_nt_status(pkt->u.fault.status);
551
552 default:
553 DEBUG(0, (__location__ "Unknown packet type %u received "
554 "from %s!\n",
555 (unsigned int)pkt->ptype,
556 rpccli_pipe_txt(talloc_tos(), cli)));
557 return NT_STATUS_RPC_PROTOCOL_ERROR;
558 }
559
560
561 if (pkt->call_id != call_id) {
562 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
563 "RPC call_id - %u, not %u\n",
564 rpccli_pipe_txt(talloc_tos(), cli),
565 pkt->call_id, call_id));
566 return NT_STATUS_RPC_PROTOCOL_ERROR;
567 }
568
569 return NT_STATUS_OK;
570 }
571
572 /****************************************************************************
573 Call a remote api on an arbitrary pipe. takes param, data and setup buffers.
574 ****************************************************************************/
575
576 struct cli_api_pipe_state {
577 struct tevent_context *ev;
578 struct rpc_cli_transport *transport;
579 uint8_t *rdata;
580 uint32_t rdata_len;
581 };
582
583 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
584 static void cli_api_pipe_write_done(struct tevent_req *subreq);
585 static void cli_api_pipe_read_done(struct tevent_req *subreq);
586
587 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
588 struct tevent_context *ev,
589 struct rpc_cli_transport *transport,
590 uint8_t *data, size_t data_len,
591 uint32_t max_rdata_len)
592 {
593 struct tevent_req *req, *subreq;
594 struct cli_api_pipe_state *state;
595 NTSTATUS status;
596
597 req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
598 if (req == NULL) {
599 return NULL;
600 }
601 state->ev = ev;
602 state->transport = transport;
603
604 if (max_rdata_len < RPC_HEADER_LEN) {
605 /*
606 * For a RPC reply we always need at least RPC_HEADER_LEN
607 * bytes. We check this here because we will receive
608 * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
609 */
610 status = NT_STATUS_INVALID_PARAMETER;
611 goto post_status;
612 }
613
614 if (transport->trans_send != NULL) {
615 subreq = transport->trans_send(state, ev, data, data_len,
616 max_rdata_len, transport->priv);
617 if (subreq == NULL) {
618 goto fail;
619 }
620 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
621 return req;
622 }
623
624 /*
625 * If the transport does not provide a "trans" routine, i.e. for
626 * example the ncacn_ip_tcp transport, do the write/read step here.
627 */
628
629 subreq = rpc_write_send(state, ev, transport, data, data_len);
630 if (subreq == NULL) {
631 goto fail;
632 }
633 tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
634 return req;
635
636 post_status:
637 tevent_req_nterror(req, status);
638 return tevent_req_post(req, ev);
639 fail:
640 TALLOC_FREE(req);
641 return NULL;
642 }
643
644 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
645 {
646 struct tevent_req *req = tevent_req_callback_data(
647 subreq, struct tevent_req);
648 struct cli_api_pipe_state *state = tevent_req_data(
649 req, struct cli_api_pipe_state);
650 NTSTATUS status;
651
652 status = state->transport->trans_recv(subreq, state, &state->rdata,
653 &state->rdata_len);
654 TALLOC_FREE(subreq);
655 if (!NT_STATUS_IS_OK(status)) {
656 tevent_req_nterror(req, status);
657 return;
658 }
659 tevent_req_done(req);
660 }
661
662 static void cli_api_pipe_write_done(struct tevent_req *subreq)
663 {
664 struct tevent_req *req = tevent_req_callback_data(
665 subreq, struct tevent_req);
666 struct cli_api_pipe_state *state = tevent_req_data(
667 req, struct cli_api_pipe_state);
668 NTSTATUS status;
669
670 status = rpc_write_recv(subreq);
671 TALLOC_FREE(subreq);
672 if (!NT_STATUS_IS_OK(status)) {
673 tevent_req_nterror(req, status);
674 return;
675 }
676
677 state->rdata = talloc_array(state, uint8_t, RPC_HEADER_LEN);
678 if (tevent_req_nomem(state->rdata, req)) {
679 return;
680 }
681
682 /*
683 * We don't need to use rpc_read_send here, the upper layer will cope
684 * with a short read, transport->trans_send could also return less
685 * than state->max_rdata_len.
686 */
687 subreq = state->transport->read_send(state, state->ev, state->rdata,
688 RPC_HEADER_LEN,
689 state->transport->priv);
690 if (tevent_req_nomem(subreq, req)) {
691 return;
692 }
693 tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
694 }
695
696 static void cli_api_pipe_read_done(struct tevent_req *subreq)
697 {
698 struct tevent_req *req = tevent_req_callback_data(
699 subreq, struct tevent_req);
700 struct cli_api_pipe_state *state = tevent_req_data(
701 req, struct cli_api_pipe_state);
702 NTSTATUS status;
703 ssize_t received;
704
705 status = state->transport->read_recv(subreq, &received);
706 TALLOC_FREE(subreq);
707 if (!NT_STATUS_IS_OK(status)) {
708 tevent_req_nterror(req, status);
709 return;
710 }
711 state->rdata_len = received;
712 tevent_req_done(req);
713 }
714
715 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
716 uint8_t **prdata, uint32_t *prdata_len)
717 {
718 struct cli_api_pipe_state *state = tevent_req_data(
719 req, struct cli_api_pipe_state);
720 NTSTATUS status;
721
722 if (tevent_req_is_nterror(req, &status)) {
723 return status;
724 }
725
726 *prdata = talloc_move(mem_ctx, &state->rdata);
727 *prdata_len = state->rdata_len;
728 return NT_STATUS_OK;
729 }
730
731 /****************************************************************************
732 Send data on an rpc pipe via trans. The data must be the last
733 pdu fragment of an NDR data stream.
734
735 Receive response data from an rpc pipe, which may be large...
736
737 Read the first fragment: unfortunately have to use SMBtrans for the first
738 bit, then SMBreadX for subsequent bits.
739
740 If first fragment received also wasn't the last fragment, continue
741 getting fragments until we _do_ receive the last fragment.
742
743 Request/Response PDU's look like the following...
744
745 |<------------------PDU len----------------------------------------------->|
746 |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
747
748 +------------+-----------------+-------------+---------------+-------------+
749 | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR | AUTH DATA |
750 +------------+-----------------+-------------+---------------+-------------+
751
752 Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
753 signing & sealing being negotiated.
754
755 ****************************************************************************/
756
757 struct rpc_api_pipe_state {
758 struct tevent_context *ev;
759 struct rpc_pipe_client *cli;
760 uint8_t expected_pkt_type;
761 uint32_t call_id;
762
763 DATA_BLOB incoming_frag;
764 struct ncacn_packet *pkt;
765
766 /* Incoming reply */
767 DATA_BLOB reply_pdu;
768 size_t reply_pdu_offset;
769 uint8_t endianess;
770 };
771
772 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
773 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
774 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq);
775
776 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
777 struct tevent_context *ev,
778 struct rpc_pipe_client *cli,
779 DATA_BLOB *data, /* Outgoing PDU */
780 uint8_t expected_pkt_type,
781 uint32_t call_id)
782 {
783 struct tevent_req *req, *subreq;
784 struct rpc_api_pipe_state *state;
785 uint16_t max_recv_frag;
786
787 req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
788 if (req == NULL) {
789 return NULL;
790 }
791 state->ev = ev;
792 state->cli = cli;
793 state->expected_pkt_type = expected_pkt_type;
794 state->call_id = call_id;
795 state->endianess = DCERPC_DREP_LE;
796
797 /*
798 * Ensure we're not sending too much.
799 */
800 if (data->length > cli->max_xmit_frag) {
801 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
802 return tevent_req_post(req, ev);
803 }
804
805 DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
806
807 if (state->expected_pkt_type == DCERPC_PKT_AUTH3) {
808 subreq = rpc_write_send(state, ev, cli->transport,
809 data->data, data->length);
810 if (tevent_req_nomem(subreq, req)) {
811 return tevent_req_post(req, ev);
812 }
813 tevent_req_set_callback(subreq, rpc_api_pipe_auth3_done, req);
814 return req;
815 }
816
817 /* get the header first, then fetch the rest once we have
818 * the frag_length available */
819 max_recv_frag = RPC_HEADER_LEN;
820
821 subreq = cli_api_pipe_send(state, ev, cli->transport,
822 data->data, data->length, max_recv_frag);
823 if (tevent_req_nomem(subreq, req)) {
824 return tevent_req_post(req, ev);
825 }
826 tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
827 return req;
828 }
829
830 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq)
831 {
832 NTSTATUS status = rpc_write_recv(subreq);
833 return tevent_req_simple_finish_ntstatus(subreq, status);
834 }
835
836 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
837 {
838 struct tevent_req *req = tevent_req_callback_data(
839 subreq, struct tevent_req);
840 struct rpc_api_pipe_state *state = tevent_req_data(
841 req, struct rpc_api_pipe_state);
842 NTSTATUS status;
843 uint8_t *rdata = NULL;
844 uint32_t rdata_len = 0;
845
846 status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
847 TALLOC_FREE(subreq);
848 if (tevent_req_nterror(req, status)) {;
849 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
850 return;
851 }
852
853 if (rdata == NULL) {
854 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
855 rpccli_pipe_txt(talloc_tos(), state->cli)));
856 tevent_req_done(req);
857 return;
858 }
859
860 /*
861 * Move data on state->incoming_frag.
862 */
863 state->incoming_frag.data = talloc_move(state, &rdata);
864 state->incoming_frag.length = rdata_len;
865 if (!state->incoming_frag.data) {
866 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
867 return;
868 }
869
870 /* Ensure we have enough data for a pdu. */
871 subreq = get_complete_frag_send(state, state->ev, state->cli,
872 &state->incoming_frag);
873 if (tevent_req_nomem(subreq, req)) {
874 return;
875 }
876 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
877 }
878
879 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
880 {
881 struct tevent_req *req = tevent_req_callback_data(
882 subreq, struct tevent_req);
883 struct rpc_api_pipe_state *state = tevent_req_data(
884 req, struct rpc_api_pipe_state);
885 NTSTATUS status;
886 DATA_BLOB rdata = { .data = NULL };
887
888 status = get_complete_frag_recv(subreq);
889 TALLOC_FREE(subreq);
890 if (tevent_req_nterror(req, status)) {
891 DEBUG(5, ("get_complete_frag failed: %s\n",
892 nt_errstr(status)));
893 return;
894 }
895
896 state->pkt = talloc(state, struct ncacn_packet);
897 if (!state->pkt) {
898 /*
899 * TODO: do a real async disconnect ...
900 *
901 * For now do it sync...
902 */
903 TALLOC_FREE(state->cli->transport);
904 tevent_req_oom(req);
905 return;
906 }
907
908 status = dcerpc_pull_ncacn_packet(state->pkt,
909 &state->incoming_frag,
910 state->pkt);
911 if (tevent_req_nterror(req, status)) {
912 /*
913 * TODO: do a real async disconnect ...
914 *
915 * For now do it sync...
916 */
917 TALLOC_FREE(state->cli->transport);
918 return;
919 }
920
921 if (DEBUGLEVEL >= 10) {
922 NDR_PRINT_DEBUG(ncacn_packet, state->pkt);
923 }
924
925 status = cli_pipe_validate_current_pdu(state,
926 state->cli, state->pkt,
927 &state->incoming_frag,
928 state->expected_pkt_type,
929 state->call_id,
930 &rdata,
931 &state->reply_pdu);
932
933 DBG_DEBUG("got frag len of %zu at offset %zu: %s\n",
934 state->incoming_frag.length,
935 state->reply_pdu_offset,
936 nt_errstr(status));
937
938 if (state->pkt->ptype != DCERPC_PKT_FAULT && !NT_STATUS_IS_OK(status)) {
939 /*
940 * TODO: do a real async disconnect ...
941 *
942 * For now do it sync...
943 */
944 TALLOC_FREE(state->cli->transport);
945 } else if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTOCOL_ERROR)) {
946 /*
947 * TODO: do a real async disconnect ...
948 *
949 * For now do it sync...
950 */
951 TALLOC_FREE(state->cli->transport);
952 } else if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_SEC_PKG_ERROR)) {
953 /*
954 * TODO: do a real async disconnect ...
955 *
956 * For now do it sync...
957 */
958 TALLOC_FREE(state->cli->transport);
959 }
960 if (tevent_req_nterror(req, status)) {
961 return;
962 }
963
964 if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
965 && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
966 /*
967 * Set the data type correctly for big-endian data on the
968 * first packet.
969 */
970 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
971 "big-endian.\n",
972 rpccli_pipe_txt(talloc_tos(), state->cli)));
973 state->endianess = 0x00; /* BIG ENDIAN */
974 }
975 /*
976 * Check endianness on subsequent packets.
977 */
978 if (state->endianess != state->pkt->drep[0]) {
979 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
980 "%s\n",
981 state->endianess?"little":"big",
982 state->pkt->drep[0]?"little":"big"));
983 /*
984 * TODO: do a real async disconnect ...
985 *
986 * For now do it sync...
987 */
988 TALLOC_FREE(state->cli->transport);
989 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
990 return;
991 }
992
993 if (state->reply_pdu_offset + rdata.length > MAX_RPC_DATA_SIZE) {
994 /*
995 * TODO: do a real async disconnect ...
996 *
997 * For now do it sync...
998 */
999 TALLOC_FREE(state->cli->transport);
1000 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
1001 return;
1002 }
1003
1004 /* Now copy the data portion out of the pdu into rbuf. */
1005 if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
1006 if (!data_blob_realloc(NULL, &state->reply_pdu,
1007 state->reply_pdu_offset + rdata.length)) {
1008 /*
1009 * TODO: do a real async disconnect ...
1010 *
1011 * For now do it sync...
1012 */
1013 TALLOC_FREE(state->cli->transport);
1014 tevent_req_oom(req);
1015 return;
1016 }
1017 }
1018
1019 memcpy(state->reply_pdu.data + state->reply_pdu_offset,
1020 rdata.data, rdata.length);
1021 state->reply_pdu_offset += rdata.length;
1022
1023 /* reset state->incoming_frag, there is no need to free it,
1024 * it will be reallocated to the right size the next time
1025 * it is used */
1026 state->incoming_frag.length = 0;
1027
1028 if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1029 /* make sure the pdu length is right now that we
1030 * have all the data available (alloc hint may
1031 * have allocated more than was actually used) */
1032 state->reply_pdu.length = state->reply_pdu_offset;
1033 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
1034 rpccli_pipe_txt(talloc_tos(), state->cli),
1035 (unsigned)state->reply_pdu.length));
1036 tevent_req_done(req);
1037 return;
1038 }
1039
1040 subreq = get_complete_frag_send(state, state->ev, state->cli,
1041 &state->incoming_frag);
1042 if (subreq == NULL) {
1043 /*
1044 * TODO: do a real async disconnect ...
1045 *
1046 * For now do it sync...
1047 */
1048 TALLOC_FREE(state->cli->transport);
1049 }
1050 if (tevent_req_nomem(subreq, req)) {
1051 return;
1052 }
1053 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
1054 }
1055
1056 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1057 struct ncacn_packet **pkt,
1058 DATA_BLOB *reply_pdu)
1059 {
1060 struct rpc_api_pipe_state *state = tevent_req_data(
1061 req, struct rpc_api_pipe_state);
1062 NTSTATUS status;
1063
1064 if (tevent_req_is_nterror(req, &status)) {
1065 return status;
1066 }
1067
1068 /* return data to caller and assign it ownership of memory */
1069 if (reply_pdu) {
1070 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1071 reply_pdu->length = state->reply_pdu.length;
1072 state->reply_pdu.length = 0;
1073 } else {
1074 data_blob_free(&state->reply_pdu);
1075 }
1076
1077 if (pkt) {
1078 *pkt = talloc_steal(mem_ctx, state->pkt);
1079 }
1080
1081 return NT_STATUS_OK;
1082 }
1083
1084 /*******************************************************************
1085 Creates NTLMSSP auth bind.
1086 ********************************************************************/
1087
1088 static NTSTATUS create_generic_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1089 TALLOC_CTX *mem_ctx,
1090 DATA_BLOB *auth_token,
1091 bool *client_hdr_signing)
1092 {
1093 struct gensec_security *gensec_security;
1094 DATA_BLOB null_blob = { .data = NULL };
1095 NTSTATUS status;
1096
1097 gensec_security = cli->auth->auth_ctx;
1098
1099 DEBUG(5, ("create_generic_auth_rpc_bind_req: generate first token\n"));
1100 status = gensec_update(gensec_security, mem_ctx, null_blob, auth_token);
1101
1102 if (!NT_STATUS_IS_OK(status) &&
1103 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED))
1104 {
1105 return status;
1106 }
1107
1108 if (client_hdr_signing == NULL) {
1109 return status;
1110 }
1111
1112 if (cli->auth->auth_level < DCERPC_AUTH_LEVEL_PACKET) {
1113 *client_hdr_signing = false;
1114 return status;
1115 }
1116
1117 *client_hdr_signing = gensec_have_feature(gensec_security,
1118 GENSEC_FEATURE_SIGN_PKT_HEADER);
1119
1120 return status;
1121 }
1122
1123 /*******************************************************************
1124 Creates the internals of a DCE/RPC bind request or alter context PDU.
1125 ********************************************************************/
1126
1127 static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
1128 enum dcerpc_pkt_type ptype,
1129 uint32_t rpc_call_id,
1130 const struct ndr_syntax_id *abstract,
1131 const struct ndr_syntax_id *transfer,
1132 const DATA_BLOB *auth_info,
1133 bool client_hdr_signing,
1134 DATA_BLOB *blob)
1135 {
1136 uint16_t auth_len = auth_info->length;
1137 NTSTATUS status;
1138 struct dcerpc_ctx_list ctx_list = {
1139 .context_id = 0,
1140 .num_transfer_syntaxes = 1,
1141 .abstract_syntax = *abstract,
1142 .transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer),
1143 };
1144 union dcerpc_payload u = {
1145 .bind.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN,
1146 .bind.max_recv_frag = RPC_MAX_PDU_FRAG_LEN,
1147 .bind.num_contexts = 1,
1148 .bind.ctx_list = &ctx_list,
1149 .bind.auth_info = *auth_info,
1150 };
1151 uint8_t pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
1152
1153 if (auth_len) {
1154 auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
1155 }
1156
1157 if (client_hdr_signing) {
1158 pfc_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
1159 }
1160
1161 status = dcerpc_push_ncacn_packet(mem_ctx,
1162 ptype, pfc_flags,
1163 auth_len,
1164 rpc_call_id,
1165 &u,
1166 blob);
1167 if (!NT_STATUS_IS_OK(status)) {
1168 DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
1169 return status;
1170 }
1171
1172 return NT_STATUS_OK;
1173 }
1174
1175 /*******************************************************************
1176 Creates a DCE/RPC bind request.
1177 ********************************************************************/
1178
1179 static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
1180 struct rpc_pipe_client *cli,
1181 struct pipe_auth_data *auth,
1182 uint32_t rpc_call_id,
1183 const struct ndr_syntax_id *abstract,
1184 const struct ndr_syntax_id *transfer,
1185 DATA_BLOB *rpc_out)
1186 {
1187 DATA_BLOB auth_token = { .data = NULL };
1188 DATA_BLOB auth_info = { .data = NULL };
1189 NTSTATUS ret;
1190
1191 if (auth->auth_type != DCERPC_AUTH_TYPE_NONE) {
1192 ret = create_generic_auth_rpc_bind_req(
1193 cli, mem_ctx, &auth_token, &auth->client_hdr_signing);
1194
1195 if (!NT_STATUS_IS_OK(ret) &&
1196 !NT_STATUS_EQUAL(ret, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1197 return ret;
1198 }
1199 }
1200
1201 if (auth_token.length != 0) {
1202 ret = dcerpc_push_dcerpc_auth(cli,
1203 auth->auth_type,
1204 auth->auth_level,
1205 0, /* auth_pad_length */
1206 auth->auth_context_id,
1207 &auth_token,
1208 &auth_info);
1209 if (!NT_STATUS_IS_OK(ret)) {
1210 return ret;
1211 }
1212 data_blob_free(&auth_token);
1213 }
1214
1215 ret = create_bind_or_alt_ctx_internal(mem_ctx,
1216 DCERPC_PKT_BIND,
1217 rpc_call_id,
1218 abstract,
1219 transfer,
1220 &auth_info,
1221 auth->client_hdr_signing,
1222 rpc_out);
1223 data_blob_free(&auth_info);
1224
1225 return ret;
1226 }
1227
1228 /*******************************************************************
1229 External interface.
1230 Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
1231 Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
1232 and deals with signing/sealing details.
1233 ********************************************************************/
1234
1235 struct rpc_api_pipe_req_state {
1236 struct tevent_context *ev;
1237 struct rpc_pipe_client *cli;
1238 uint8_t op_num;
1239 uint32_t call_id;
1240 const DATA_BLOB *req_data;
1241 const struct GUID *object_uuid;
1242 uint32_t req_data_sent;
1243 DATA_BLOB req_trailer;
1244 uint32_t req_trailer_sent;
1245 bool verify_bitmask1;
1246 bool verify_pcontext;
1247 DATA_BLOB rpc_out;
1248 DATA_BLOB reply_pdu;
1249 };
1250
1251 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
1252 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
1253 static NTSTATUS prepare_verification_trailer(struct rpc_api_pipe_req_state *state);
1254 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1255 bool *is_last_frag);
1256
1257 static struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
1258 struct tevent_context *ev,
1259 struct rpc_pipe_client *cli,
1260 uint8_t op_num,
1261 const struct GUID *object_uuid,
1262 const DATA_BLOB *req_data)
1263 {
1264 struct tevent_req *req, *subreq;
1265 struct rpc_api_pipe_req_state *state;
1266 NTSTATUS status;
1267 bool is_last_frag;
1268
1269 req = tevent_req_create(mem_ctx, &state,
1270 struct rpc_api_pipe_req_state);
1271 if (req == NULL) {
1272 return NULL;
1273 }
1274 state->ev = ev;
1275 state->cli = cli;
1276 state->op_num = op_num;
1277 state->object_uuid = object_uuid;
1278 state->req_data = req_data;
1279 state->call_id = get_rpc_call_id();
1280
1281 if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
1282 + RPC_MAX_SIGN_SIZE) {
1283 /* Server is screwed up ! */
1284 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
1285 return tevent_req_post(req, ev);
1286 }
1287
1288 status = prepare_verification_trailer(state);
1289 if (tevent_req_nterror(req, status)) {
1290 return tevent_req_post(req, ev);
1291 }
1292
1293 status = prepare_next_frag(state, &is_last_frag);
1294 if (tevent_req_nterror(req, status)) {
1295 return tevent_req_post(req, ev);
1296 }
1297
1298 if (is_last_frag) {
1299 subreq = rpc_api_pipe_send(state, ev, state->cli,
1300 &state->rpc_out,
1301 DCERPC_PKT_RESPONSE,
1302 state->call_id);
1303 if (tevent_req_nomem(subreq, req)) {
1304 return tevent_req_post(req, ev);
1305 }
1306 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1307 } else {
1308 subreq = rpc_write_send(state, ev, cli->transport,
1309 state->rpc_out.data,
1310 state->rpc_out.length);
1311 if (tevent_req_nomem(subreq, req)) {
1312 return tevent_req_post(req, ev);
1313 }
1314 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1315 req);
1316 }
1317 return req;
1318 }
1319
1320 static NTSTATUS prepare_verification_trailer(struct rpc_api_pipe_req_state *state)
1321 {
1322 struct pipe_auth_data *a = state->cli->auth;
1323 struct dcerpc_sec_verification_trailer *t;
1324 struct ndr_push *ndr = NULL;
1325 enum ndr_err_code ndr_err;
1326 size_t align = 0;
1327 size_t pad = 0;
1328
1329 if (a == NULL) {
1330 return NT_STATUS_OK;
1331 }
1332
1333 if (a->auth_level < DCERPC_AUTH_LEVEL_PACKET) {
1334 return NT_STATUS_OK;
1335 }
1336
1337 t = talloc_zero(state, struct dcerpc_sec_verification_trailer);
1338 if (t == NULL) {
1339 return NT_STATUS_NO_MEMORY;
1340 }
1341
1342 if (!a->verified_bitmask1) {
1343 t->commands = talloc_realloc(t, t->commands,
1344 struct dcerpc_sec_vt,
1345 t->count.count + 1);
1346 if (t->commands == NULL) {
1347 return NT_STATUS_NO_MEMORY;
1348 }
1349 t->commands[t->count.count++] = (struct dcerpc_sec_vt) {
1350 .command = DCERPC_SEC_VT_COMMAND_BITMASK1,
1351 .u.bitmask1 = (a->client_hdr_signing) ?
1352 DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING :
1353 0,
1354 };
1355 state->verify_bitmask1 = true;
1356 }
1357
1358 if (!state->cli->verified_pcontext) {
1359 t->commands = talloc_realloc(t, t->commands,
1360 struct dcerpc_sec_vt,
1361 t->count.count + 1);
1362 if (t->commands == NULL) {
1363 return NT_STATUS_NO_MEMORY;
1364 }
1365 t->commands[t->count.count++] = (struct dcerpc_sec_vt) {
1366 .command = DCERPC_SEC_VT_COMMAND_PCONTEXT,
1367 .u.pcontext.abstract_syntax =
1368 state->cli->abstract_syntax,
1369 .u.pcontext.transfer_syntax =
1370 state->cli->transfer_syntax,
1371 };
1372 state->verify_pcontext = true;
1373 }
1374
1375 if (!a->hdr_signing) {
1376 t->commands = talloc_realloc(t, t->commands,
1377 struct dcerpc_sec_vt,
1378 t->count.count + 1);
1379 if (t->commands == NULL) {
1380 return NT_STATUS_NO_MEMORY;
1381 }
1382 t->commands[t->count.count++] = (struct dcerpc_sec_vt) {
1383 .command = DCERPC_SEC_VT_COMMAND_HEADER2,
1384 .u.header2.ptype = DCERPC_PKT_REQUEST,
1385 .u.header2.drep[0] = DCERPC_DREP_LE,
1386 .u.header2.call_id = state->call_id,
1387 .u.header2.context_id = 0,
1388 .u.header2.opnum = state->op_num,
1389 };
1390 }
1391
1392 if (t->count.count == 0) {
1393 TALLOC_FREE(t);
1394 return NT_STATUS_OK;
1395 }
1396
1397 t->commands[t->count.count - 1].command |= DCERPC_SEC_VT_COMMAND_END;
1398
1399 if (DEBUGLEVEL >= 10) {
1400 NDR_PRINT_DEBUG(dcerpc_sec_verification_trailer, t);
1401 }
1402
1403 ndr = ndr_push_init_ctx(state);
1404 if (ndr == NULL) {
1405 return NT_STATUS_NO_MEMORY;
1406 }
1407
1408 ndr_err = ndr_push_dcerpc_sec_verification_trailer(ndr,
1409 NDR_SCALARS | NDR_BUFFERS,
1410 t);
1411 TALLOC_FREE(t);
1412 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1413 return ndr_map_error2ntstatus(ndr_err);
1414 }
1415 state->req_trailer = ndr_push_blob(ndr);
1416
1417 align = state->req_data->length & 0x3;
1418 if (align > 0) {
1419 pad = 4 - align;
1420 }
1421 if (pad > 0) {
1422 bool ok;
1423 uint8_t *p;
1424 const uint8_t zeros[4] = { 0, };
1425
1426 ok = data_blob_append(ndr, &state->req_trailer, zeros, pad);
1427 if (!ok) {
1428 return NT_STATUS_NO_MEMORY;
1429 }
1430
1431 /* move the padding to the start */
1432 p = state->req_trailer.data;
1433 memmove(p + pad, p, state->req_trailer.length - pad);
1434 memset(p, 0, pad);
1435 }
1436
1437 return NT_STATUS_OK;
1438 }
1439
1440 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1441 bool *is_last_frag)
1442 {
1443 size_t auth_len;
1444 size_t frag_len;
1445 uint8_t flags = 0;
1446 size_t pad_len;
1447 size_t data_left;
1448 size_t data_thistime;
1449 size_t trailer_left;
1450 size_t trailer_thistime = 0;
1451 size_t total_left;
1452 size_t total_thistime;
1453 NTSTATUS status;
1454 bool ok;
1455 union dcerpc_payload u;
1456
1457 data_left = state->req_data->length - state->req_data_sent;
1458 trailer_left = state->req_trailer.length - state->req_trailer_sent;
1459 total_left = data_left + trailer_left;
1460 if ((total_left < data_left) || (total_left < trailer_left)) {
1461 /*
1462 * overflow
1463 */
1464 return NT_STATUS_INVALID_PARAMETER_MIX;
1465 }
1466
1467 status = dcerpc_guess_sizes(state->cli->auth,
1468 DCERPC_REQUEST_LENGTH, total_left,
1469 state->cli->max_xmit_frag,
1470 &total_thistime,
1471 &frag_len, &auth_len, &pad_len);
1472 if (!NT_STATUS_IS_OK(status)) {
1473 return status;
1474 }
1475
1476 if (state->req_data_sent == 0) {
1477 flags = DCERPC_PFC_FLAG_FIRST;
1478 }
1479
1480 if (total_thistime == total_left) {
1481 flags |= DCERPC_PFC_FLAG_LAST;
1482 }
1483
1484 data_thistime = MIN(total_thistime, data_left);
1485 if (data_thistime < total_thistime) {
1486 trailer_thistime = total_thistime - data_thistime;
1487 }
1488
1489 data_blob_free(&state->rpc_out);
1490
1491 u = (union dcerpc_payload) {
1492 .request.alloc_hint = total_left,
1493 .request.context_id = 0,
1494 .request.opnum = state->op_num,
1495 };
1496
1497 if (state->object_uuid) {
1498 flags |= DCERPC_PFC_FLAG_OBJECT_UUID;
1499 u.request.object.object = *state->object_uuid;
1500 frag_len += ndr_size_GUID(state->object_uuid, 0);
1501 }
1502
1503 status = dcerpc_push_ncacn_packet(state,
1504 DCERPC_PKT_REQUEST,
1505 flags,
1506 auth_len,
1507 state->call_id,
1508 &u,
1509 &state->rpc_out);
1510 if (!NT_STATUS_IS_OK(status)) {
1511 return status;
1512 }
1513
1514 /* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
1515 * compute it right for requests because the auth trailer is missing
1516 * at this stage */
1517 dcerpc_set_frag_length(&state->rpc_out, frag_len);
1518
1519 if (data_thistime > 0) {
1520 /* Copy in the data. */
1521 ok = data_blob_append(NULL, &state->rpc_out,
1522 state->req_data->data + state->req_data_sent,
1523 data_thistime);
1524 if (!ok) {
1525 return NT_STATUS_NO_MEMORY;
1526 }
1527 state->req_data_sent += data_thistime;
1528 }
1529
1530 if (trailer_thistime > 0) {
1531 /* Copy in the verification trailer. */
1532 ok = data_blob_append(NULL, &state->rpc_out,
1533 state->req_trailer.data + state->req_trailer_sent,
1534 trailer_thistime);
1535 if (!ok) {
1536 return NT_STATUS_NO_MEMORY;
1537 }
1538 state->req_trailer_sent += trailer_thistime;
1539 }
1540
1541 switch (state->cli->auth->auth_level) {
1542 case DCERPC_AUTH_LEVEL_NONE:
1543 case DCERPC_AUTH_LEVEL_CONNECT:
1544 break;
1545 case DCERPC_AUTH_LEVEL_PACKET:
1546 case DCERPC_AUTH_LEVEL_INTEGRITY:
1547 case DCERPC_AUTH_LEVEL_PRIVACY:
1548 status = dcerpc_add_auth_footer(state->cli->auth, pad_len,
1549 &state->rpc_out);
1550 if (!NT_STATUS_IS_OK(status)) {
1551 return status;
1552 }
1553 break;
1554 default:
1555 return NT_STATUS_INVALID_PARAMETER;
1556 }
1557
1558 *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
1559
1560 return status;
1561 }
1562
1563 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
1564 {
1565 struct tevent_req *req = tevent_req_callback_data(
1566 subreq, struct tevent_req);
1567 struct rpc_api_pipe_req_state *state = tevent_req_data(
1568 req, struct rpc_api_pipe_req_state);
1569 NTSTATUS status;
1570 bool is_last_frag;
1571
1572 status = rpc_write_recv(subreq);
1573 TALLOC_FREE(subreq);
1574 if (tevent_req_nterror(req, status)) {
1575 return;
1576 }
1577
1578 status = prepare_next_frag(state, &is_last_frag);
1579 if (tevent_req_nterror(req, status)) {
1580 return;
1581 }
1582
1583 if (is_last_frag) {
1584 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1585 &state->rpc_out,
1586 DCERPC_PKT_RESPONSE,
1587 state->call_id);
1588 if (tevent_req_nomem(subreq, req)) {
1589 return;
1590 }
1591 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1592 } else {
1593 subreq = rpc_write_send(state, state->ev,
1594 state->cli->transport,
1595 state->rpc_out.data,
1596 state->rpc_out.length);
1597 if (tevent_req_nomem(subreq, req)) {
1598 return;
1599 }
1600 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1601 req);
1602 }
1603 }
1604
1605 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
1606 {
1607 struct tevent_req *req = tevent_req_callback_data(
1608 subreq, struct tevent_req);
1609 struct rpc_api_pipe_req_state *state = tevent_req_data(
1610 req, struct rpc_api_pipe_req_state);
1611 NTSTATUS status;
1612
1613 status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
1614 TALLOC_FREE(subreq);
1615 if (tevent_req_nterror(req, status)) {
1616 return;
1617 }
1618
1619 if (state->cli->auth == NULL) {
1620 tevent_req_done(req);
1621 return;
1622 }
1623
1624 if (state->verify_bitmask1) {
1625 state->cli->auth->verified_bitmask1 = true;
1626 }
1627
1628 if (state->verify_pcontext) {
1629 state->cli->verified_pcontext = true;
1630 }
1631
1632 tevent_req_done(req);
1633 }
1634
1635 static NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1636 DATA_BLOB *reply_pdu)
1637 {
1638 struct rpc_api_pipe_req_state *state = tevent_req_data(
1639 req, struct rpc_api_pipe_req_state);
1640 NTSTATUS status;
1641
1642 if (tevent_req_is_nterror(req, &status)) {
1643 /*
1644 * We always have to initialize to reply pdu, even if there is
1645 * none. The rpccli_* caller routines expect this.
1646 */
1647 *reply_pdu = data_blob_null;
1648 return status;
1649 }
1650
1651 /* return data to caller and assign it ownership of memory */
1652 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1653 reply_pdu->length = state->reply_pdu.length;
1654 state->reply_pdu.length = 0;
1655
1656 return NT_STATUS_OK;
1657 }
1658
1659 /****************************************************************************
1660 Check the rpc bind acknowledge response.
1661 ****************************************************************************/
1662
1663 static bool check_bind_response(const struct dcerpc_bind_ack *r,
1664 const struct ndr_syntax_id *transfer)
1665 {
1666 struct dcerpc_ack_ctx ctx;
1667 bool equal;
1668
1669 if (r->secondary_address_size == 0) {
1670 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
1671 }
1672
1673 if (r->num_results < 1 || !r->ctx_list) {
1674 return false;
1675 }
1676
1677 ctx = r->ctx_list[0];
1678
1679 /* check the transfer syntax */
1680 equal = ndr_syntax_id_equal(&ctx.syntax, transfer);
1681 if (!equal) {
1682 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1683 return False;
1684 }
1685
1686 if (r->num_results != 0x1 || ctx.result != 0) {
1687 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1688 r->num_results, ctx.reason.value));
1689 }
1690
1691 DEBUG(5,("check_bind_response: accepted!\n"));
1692 return True;
1693 }
1694
1695 /*******************************************************************
1696 Creates a DCE/RPC bind authentication response.
1697 This is the packet that is sent back to the server once we
1698 have received a BIND-ACK, to finish the third leg of
1699 the authentication handshake.
1700 ********************************************************************/
1701
1702 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
1703 struct rpc_pipe_client *cli,
1704 struct pipe_auth_data *auth,
1705 uint32_t rpc_call_id,
1706 DATA_BLOB *pauth_blob,
1707 DATA_BLOB *rpc_out)
1708 {
1709 NTSTATUS status;
1710 union dcerpc_payload u = { .auth3._pad = 0, };
1711
1712 status = dcerpc_push_dcerpc_auth(mem_ctx,
1713 auth->auth_type,
1714 auth->auth_level,
1715 0, /* auth_pad_length */
1716 auth->auth_context_id,
1717 pauth_blob,
1718 &u.auth3.auth_info);
1719 if (!NT_STATUS_IS_OK(status)) {
1720 return status;
1721 }
1722
1723 status = dcerpc_push_ncacn_packet(mem_ctx,
1724 DCERPC_PKT_AUTH3,
1725 DCERPC_PFC_FLAG_FIRST |
1726 DCERPC_PFC_FLAG_LAST,
1727 pauth_blob->length,
1728 rpc_call_id,
1729 &u,
1730 rpc_out);
1731 data_blob_free(&u.auth3.auth_info);
1732 if (!NT_STATUS_IS_OK(status)) {
1733 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1734 return status;
1735 }
1736
1737 return NT_STATUS_OK;
1738 }
1739
1740 /*******************************************************************
1741 Creates a DCE/RPC bind alter context authentication request which
1742 may contain a spnego auth blob
1743 ********************************************************************/
1744
1745 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
1746 struct pipe_auth_data *auth,
1747 uint32_t rpc_call_id,
1748 const struct ndr_syntax_id *abstract,
1749 const struct ndr_syntax_id *transfer,
1750 const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
1751 DATA_BLOB *rpc_out)
1752 {
1753 DATA_BLOB auth_info;
1754 NTSTATUS status;
1755
1756 status = dcerpc_push_dcerpc_auth(mem_ctx,
1757 auth->auth_type,
1758 auth->auth_level,
1759 0, /* auth_pad_length */
1760 auth->auth_context_id,
1761 pauth_blob,
1762 &auth_info);
1763 if (!NT_STATUS_IS_OK(status)) {
1764 return status;
1765 }
1766
1767 status = create_bind_or_alt_ctx_internal(mem_ctx,
1768 DCERPC_PKT_ALTER,
1769 rpc_call_id,
1770 abstract,
1771 transfer,
1772 &auth_info,
1773 false, /* client_hdr_signing */
1774 rpc_out);
1775 data_blob_free(&auth_info);
1776 return status;
1777 }
1778
1779 /****************************************************************************
1780 Do an rpc bind.
1781 ****************************************************************************/
1782
1783 struct rpc_pipe_bind_state {
1784 struct tevent_context *ev;
1785 struct rpc_pipe_client *cli;
1786 DATA_BLOB rpc_out;
1787 bool auth3;
1788 uint32_t rpc_call_id;
1789 };
1790
1791 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
1792 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1793 struct rpc_pipe_bind_state *state,
1794 DATA_BLOB *credentials);
1795 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1796 struct rpc_pipe_bind_state *state,
1797 DATA_BLOB *credentials);
1798
1799 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
1800 struct tevent_context *ev,
1801 struct rpc_pipe_client *cli,
1802 struct pipe_auth_data *auth)
1803 {
1804 struct tevent_req *req, *subreq;
1805 struct rpc_pipe_bind_state *state;
1806 NTSTATUS status;
1807
1808 req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
1809 if (req == NULL) {
1810 return NULL;
1811 }
1812
1813 DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
1814 rpccli_pipe_txt(talloc_tos(), cli),
1815 (unsigned int)auth->auth_type,
1816 (unsigned int)auth->auth_level ));
1817
1818 state->ev = ev;
1819 state->cli = cli;
1820 state->rpc_call_id = get_rpc_call_id();
1821
1822 cli->auth = talloc_move(cli, &auth);
1823
1824 /* Marshall the outgoing data. */
1825 status = create_rpc_bind_req(state, cli,
1826 cli->auth,
1827 state->rpc_call_id,
1828 &cli->abstract_syntax,
1829 &cli->transfer_syntax,
1830 &state->rpc_out);
1831
1832 if (!NT_STATUS_IS_OK(status) &&
1833 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1834 tevent_req_nterror(req, status);
1835 return tevent_req_post(req, ev);
1836 }
1837
1838 subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
1839 DCERPC_PKT_BIND_ACK, state->rpc_call_id);
1840 if (tevent_req_nomem(subreq, req)) {
1841 return tevent_req_post(req, ev);
1842 }
1843 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1844 return req;
1845 }
1846
1847 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
1848 {
1849 struct tevent_req *req = tevent_req_callback_data(
1850 subreq, struct tevent_req);
1851 struct rpc_pipe_bind_state *state = tevent_req_data(
1852 req, struct rpc_pipe_bind_state);
1853 struct pipe_auth_data *pauth = state->cli->auth;
1854 struct gensec_security *gensec_security;
1855 struct ncacn_packet *pkt = NULL;
1856 struct dcerpc_auth auth;
1857 DATA_BLOB auth_token = { .data = NULL };
1858 NTSTATUS status;
1859
1860 status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
1861 TALLOC_FREE(subreq);
1862 if (tevent_req_nterror(req, status)) {
1863 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
1864 rpccli_pipe_txt(talloc_tos(), state->cli),
1865 nt_errstr(status)));
1866 return;
1867 }
1868
1869 if (state->auth3) {
1870 tevent_req_done(req);
1871 return;
1872 }
1873
1874 if (!check_bind_response(&pkt->u.bind_ack, &state->cli->transfer_syntax)) {
1875 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
1876 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1877 return;
1878 }
1879
1880 if (pkt->ptype == DCERPC_PKT_BIND_ACK) {
1881 if (pkt->pfc_flags & DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN) {
1882 if (pauth->client_hdr_signing) {
1883 pauth->hdr_signing = true;
1884 }
1885 }
1886 }
1887
1888 state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
1889
1890 if (pauth->auth_type == DCERPC_AUTH_TYPE_NONE) {
1891 /* Bind complete. */
1892 tevent_req_done(req);
1893 return;
1894 }
1895
1896 if (pkt->auth_length == 0) {
1897 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
1898 return;
1899 }
1900
1901 /* get auth credentials */
1902 status = dcerpc_pull_auth_trailer(pkt, talloc_tos(),
1903 &pkt->u.bind_ack.auth_info,
1904 &auth, NULL, true);
1905 if (tevent_req_nterror(req, status)) {
1906 DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
1907 nt_errstr(status)));
1908 return;
1909 }
1910
1911 if (auth.auth_type != pauth->auth_type) {
1912 DBG_ERR("Auth type %u mismatch expected %u.\n",
1913 auth.auth_type, pauth->auth_type);
1914 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
1915 return;
1916 }
1917
1918 if (auth.auth_level != pauth->auth_level) {
1919 DBG_ERR("Auth level %u mismatch expected %u.\n",
1920 auth.auth_level, pauth->auth_level);
1921 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
1922 return;
1923 }
1924
1925 if (auth.auth_context_id != pauth->auth_context_id) {
1926 DBG_ERR("Auth context id %"PRIu32" mismatch "
1927 "expected %"PRIu32".\n",
1928 auth.auth_context_id,
1929 pauth->auth_context_id);
1930 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
1931 return;
1932 }
1933
1934 /*
1935 * For authenticated binds we may need to do 3 or 4 leg binds.
1936 */
1937
1938 if (pauth->auth_type == DCERPC_AUTH_TYPE_NONE) {
1939 /* Bind complete. */
1940 tevent_req_done(req);
1941 return;
1942 }
1943
1944 gensec_security = pauth->auth_ctx;
1945
1946 status = gensec_update(gensec_security, state,
1947 auth.credentials, &auth_token);
1948 if (NT_STATUS_EQUAL(status,
1949 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1950 status = rpc_bind_next_send(req, state,
1951 &auth_token);
1952 } else if (NT_STATUS_IS_OK(status)) {
1953 if (pauth->hdr_signing) {
1954 gensec_want_feature(gensec_security,
1955 GENSEC_FEATURE_SIGN_PKT_HEADER);
1956 }
1957
1958 if (auth_token.length == 0) {
1959 /* Bind complete. */
1960 tevent_req_done(req);
1961 return;
1962 }
1963 status = rpc_bind_finish_send(req, state,
1964 &auth_token);
1965 }
1966
1967 if (!NT_STATUS_IS_OK(status)) {
1968 tevent_req_nterror(req, status);
1969 }
1970 return;
1971 }
1972
1973 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1974 struct rpc_pipe_bind_state *state,
1975 DATA_BLOB *auth_token)
1976 {
1977 struct pipe_auth_data *auth = state->cli->auth;
1978 struct tevent_req *subreq;
1979 NTSTATUS status;
1980
1981 /* Now prepare the alter context pdu. */
1982 data_blob_free(&state->rpc_out);
1983
1984 status = create_rpc_alter_context(state, auth,
1985 state->rpc_call_id,
1986 &state->cli->abstract_syntax,
1987 &state->cli->transfer_syntax,
1988 auth_token,
1989 &state->rpc_out);
1990 if (!NT_STATUS_IS_OK(status)) {
1991 return status;
1992 }
1993
1994 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1995 &state->rpc_out, DCERPC_PKT_ALTER_RESP,
1996 state->rpc_call_id);
1997 if (subreq == NULL) {
1998 return NT_STATUS_NO_MEMORY;
1999 }
2000 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
2001 return NT_STATUS_OK;
2002 }
2003
2004 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
2005 struct rpc_pipe_bind_state *state,
2006 DATA_BLOB *auth_token)
2007 {
2008 struct pipe_auth_data *auth = state->cli->auth;
2009 struct tevent_req *subreq;
2010 NTSTATUS status;
2011
2012 state->auth3 = true;
2013
2014 /* Now prepare the auth3 context pdu. */
2015 data_blob_free(&state->rpc_out);
2016
2017 status = create_rpc_bind_auth3(state, state->cli, auth,
2018 state->rpc_call_id,
2019 auth_token,
2020 &state->rpc_out);
2021 if (!NT_STATUS_IS_OK(status)) {
2022 return status;
2023 }
2024
2025 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2026 &state->rpc_out, DCERPC_PKT_AUTH3,
2027 state->rpc_call_id);
2028 if (subreq == NULL) {
2029 return NT_STATUS_NO_MEMORY;
2030 }
2031 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
2032 return NT_STATUS_OK;
2033 }
2034
2035 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
2036 {
2037 return tevent_req_simple_recv_ntstatus(req);
2038 }
2039
2040 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
2041 struct pipe_auth_data *auth)
2042 {
2043 TALLOC_CTX *frame = talloc_stackframe();
2044 struct tevent_context *ev;
2045 struct tevent_req *req;
2046 NTSTATUS status = NT_STATUS_OK;
2047
2048 ev = samba_tevent_context_init(frame);
2049 if (ev == NULL) {
2050 status = NT_STATUS_NO_MEMORY;
2051 goto fail;
2052 }
2053
2054 req = rpc_pipe_bind_send(frame, ev, cli, auth);
2055 if (req == NULL) {
2056 status = NT_STATUS_NO_MEMORY;
2057 goto fail;
2058 }
2059
2060 if (!tevent_req_poll_ntstatus(req, ev, &status)) {
2061 goto fail;
2062 }
2063
2064 status = rpc_pipe_bind_recv(req);
2065 fail:
2066 TALLOC_FREE(frame);
2067 return status;
2068 }
2069
2070 #define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */
2071
2072 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
2073 unsigned int timeout)
2074 {
2075 if (rpc_cli == NULL) {
2076 return RPCCLI_DEFAULT_TIMEOUT;
2077 }
2078
2079 if (rpc_cli->binding_handle == NULL) {
2080 return RPCCLI_DEFAULT_TIMEOUT;
2081 }
2082
2083 return dcerpc_binding_handle_set_timeout(rpc_cli->binding_handle,
2084 timeout);
2085 }
2086
2087 bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
2088 {
2089 if (rpc_cli == NULL) {
2090 return false;
2091 }
2092
2093 if (rpc_cli->binding_handle == NULL) {
2094 return false;
2095 }
2096
2097 return dcerpc_binding_handle_is_connected(rpc_cli->binding_handle);
2098 }
2099
2100 struct rpccli_bh_state {
2101 struct rpc_pipe_client *rpc_cli;
2102 };
2103
2104 static bool rpccli_bh_is_connected(struct dcerpc_binding_handle *h)
2105 {
2106 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2107 struct rpccli_bh_state);
2108 struct rpc_cli_transport *transport = hs->rpc_cli->transport;
2109
2110 if (transport == NULL) {
2111 return false;
2112 }
2113
2114 if (transport->is_connected == NULL) {
2115 return false;
2116 }
2117
2118 return transport->is_connected(transport->priv);
2119 }
2120
2121 static uint32_t rpccli_bh_set_timeout(struct dcerpc_binding_handle *h,
2122 uint32_t timeout)
2123 {
2124 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2125 struct rpccli_bh_state);
2126 struct rpc_cli_transport *transport = hs->rpc_cli->transport;
2127 unsigned int old;
2128
2129 if (transport == NULL) {
2130 return RPCCLI_DEFAULT_TIMEOUT;
2131 }
2132
2133 if (transport->set_timeout == NULL) {
2134 return RPCCLI_DEFAULT_TIMEOUT;
2135 }
2136
2137 old = transport->set_timeout(transport->priv, timeout);
2138 if (old == 0) {
2139 return RPCCLI_DEFAULT_TIMEOUT;
2140 }
2141
2142 return old;
2143 }
2144
2145 static void rpccli_bh_auth_info(struct dcerpc_binding_handle *h,
2146 enum dcerpc_AuthType *auth_type,
2147 enum dcerpc_AuthLevel *auth_level)
2148 {
2149 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2150 struct rpccli_bh_state);
2151
2152 if (hs->rpc_cli == NULL) {
2153 return;
2154 }
2155
2156 if (hs->rpc_cli->auth == NULL) {
2157 return;
2158 }
2159
2160 *auth_type = hs->rpc_cli->auth->auth_type;
2161 *auth_level = hs->rpc_cli->auth->auth_level;
2162 }
2163
2164 struct rpccli_bh_raw_call_state {
2165 DATA_BLOB in_data;
2166 DATA_BLOB out_data;
2167 uint32_t out_flags;
2168 };
2169
2170 static void rpccli_bh_raw_call_done(struct tevent_req *subreq);
2171
2172 static struct tevent_req *rpccli_bh_raw_call_send(TALLOC_CTX *mem_ctx,
2173 struct tevent_context *ev,
2174 struct dcerpc_binding_handle *h,
2175 const struct GUID *object,
2176 uint32_t opnum,
2177 uint32_t in_flags,
2178 const uint8_t *in_data,
2179 size_t in_length)
2180 {
2181 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2182 struct rpccli_bh_state);
2183 struct tevent_req *req;
2184 struct rpccli_bh_raw_call_state *state;
2185 bool ok;
2186 struct tevent_req *subreq;
2187
2188 req = tevent_req_create(mem_ctx, &state,
2189 struct rpccli_bh_raw_call_state);
2190 if (req == NULL) {
2191 return NULL;
2192 }
2193 state->in_data.data = discard_const_p(uint8_t, in_data);
2194 state->in_data.length = in_length;
2195
2196 ok = rpccli_bh_is_connected(h);
2197 if (!ok) {
2198 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2199 return tevent_req_post(req, ev);
2200 }
2201
2202 subreq = rpc_api_pipe_req_send(state, ev, hs->rpc_cli,
2203 opnum, object, &state->in_data);
2204 if (tevent_req_nomem(subreq, req)) {
2205 return tevent_req_post(req, ev);
2206 }
2207 tevent_req_set_callback(subreq, rpccli_bh_raw_call_done, req);
2208
2209 return req;
2210 }
2211
2212 static void rpccli_bh_raw_call_done(struct tevent_req *subreq)
2213 {
2214 struct tevent_req *req =
2215 tevent_req_callback_data(subreq,
2216 struct tevent_req);
2217 struct rpccli_bh_raw_call_state *state =
2218 tevent_req_data(req,
2219 struct rpccli_bh_raw_call_state);
2220 NTSTATUS status;
2221
2222 state->out_flags = 0;
2223
2224 /* TODO: support bigendian responses */
2225
2226 status = rpc_api_pipe_req_recv(subreq, state, &state->out_data);
2227 TALLOC_FREE(subreq);
2228 if (tevent_req_nterror(req, status)) {
2229 return;
2230 }
2231
2232 tevent_req_done(req);
2233 }
2234
2235 static NTSTATUS rpccli_bh_raw_call_recv(struct tevent_req *req,
2236 TALLOC_CTX *mem_ctx,
2237 uint8_t **out_data,
2238 size_t *out_length,
2239 uint32_t *out_flags)
2240 {
2241 struct rpccli_bh_raw_call_state *state =
2242 tevent_req_data(req,
2243 struct rpccli_bh_raw_call_state);
2244 NTSTATUS status;
2245
2246 if (tevent_req_is_nterror(req, &status)) {
2247 tevent_req_received(req);
2248 return status;
2249 }
2250
2251 *out_data = talloc_move(mem_ctx, &state->out_data.data);
2252 *out_length = state->out_data.length;
2253 *out_flags = state->out_flags;
2254 tevent_req_received(req);
2255 return NT_STATUS_OK;
2256 }
2257
2258 struct rpccli_bh_disconnect_state {
2259 uint8_t _dummy;
2260 };
2261
2262 static struct tevent_req *rpccli_bh_disconnect_send(TALLOC_CTX *mem_ctx,
2263 struct tevent_context *ev,
2264 struct dcerpc_binding_handle *h)
2265 {
2266 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2267 struct rpccli_bh_state);
2268 struct tevent_req *req;
2269 struct rpccli_bh_disconnect_state *state;
2270 bool ok;
2271
2272 req = tevent_req_create(mem_ctx, &state,
2273 struct rpccli_bh_disconnect_state);
2274 if (req == NULL) {
2275 return NULL;
2276 }
2277
2278 ok = rpccli_bh_is_connected(h);
2279 if (!ok) {
2280 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2281 return tevent_req_post(req, ev);
2282 }
2283
2284 /*
2285 * TODO: do a real async disconnect ...
2286 *
2287 * For now we do it sync...
2288 */
2289 TALLOC_FREE(hs->rpc_cli->transport);
2290 hs->rpc_cli = NULL;
2291
2292 tevent_req_done(req);
2293 return tevent_req_post(req, ev);
2294 }
2295
2296 static NTSTATUS rpccli_bh_disconnect_recv(struct tevent_req *req)
2297 {
2298 return tevent_req_simple_recv_ntstatus(req);
2299 }
2300
2301 static bool rpccli_bh_ref_alloc(struct dcerpc_binding_handle *h)
2302 {
2303 return true;
2304 }
2305
2306 static void rpccli_bh_do_ndr_print(struct dcerpc_binding_handle *h,
2307 int ndr_flags,
2308 const void *_struct_ptr,
2309 const struct ndr_interface_call *call)
2310 {
2311 void *struct_ptr = discard_const(_struct_ptr);
2312
2313 if (DEBUGLEVEL < 10) {
2314 return;
2315 }
2316
2317 if (ndr_flags & NDR_IN) {
2318 ndr_print_function_debug(call->ndr_print,
2319 call->name,
2320 ndr_flags,
2321 struct_ptr);
2322 }
2323 if (ndr_flags & NDR_OUT) {
2324 ndr_print_function_debug(call->ndr_print,
2325 call->name,
2326 ndr_flags,
2327 struct_ptr);
2328 }
2329 }
2330
2331 static const struct dcerpc_binding_handle_ops rpccli_bh_ops = {
2332 .name = "rpccli",
2333 .is_connected = rpccli_bh_is_connected,
2334 .set_timeout = rpccli_bh_set_timeout,
2335 .auth_info = rpccli_bh_auth_info,
2336 .raw_call_send = rpccli_bh_raw_call_send,
2337 .raw_call_recv = rpccli_bh_raw_call_recv,
2338 .disconnect_send = rpccli_bh_disconnect_send,
2339 .disconnect_recv = rpccli_bh_disconnect_recv,
2340
2341 .ref_alloc = rpccli_bh_ref_alloc,
2342 .do_ndr_print = rpccli_bh_do_ndr_print,
2343 };
2344
2345 /* initialise a rpc_pipe_client binding handle */
2346 struct dcerpc_binding_handle *rpccli_bh_create(struct rpc_pipe_client *c,
2347 const struct GUID *object,
2348 const struct ndr_interface_table *table)
2349 {
2350 struct dcerpc_binding_handle *h;
2351 struct rpccli_bh_state *hs;
2352
2353 h = dcerpc_binding_handle_create(c,
2354 &rpccli_bh_ops,
2355 object,
2356 table,
2357 &hs,
2358 struct rpccli_bh_state,
2359 __location__);
2360 if (h == NULL) {
2361 return NULL;
2362 }
2363 hs->rpc_cli = c;
2364
2365 return h;
2366 }
2367
2368 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2369 struct pipe_auth_data **presult)
2370 {
2371 struct pipe_auth_data *result;
2372 struct auth_generic_state *auth_generic_ctx;
2373 NTSTATUS status;
2374
2375 result = talloc_zero(mem_ctx, struct pipe_auth_data);
2376 if (result == NULL) {
2377 return NT_STATUS_NO_MEMORY;
2378 }
2379
2380 result->auth_type = DCERPC_AUTH_TYPE_NONE;
2381 result->auth_level = DCERPC_AUTH_LEVEL_NONE;
2382 result->auth_context_id = 0;
2383
2384 status = auth_generic_client_prepare(result,
2385 &auth_generic_ctx);
2386 if (!NT_STATUS_IS_OK(status)) {
2387 DEBUG(1, ("Failed to create auth_generic context: %s\n",
2388 nt_errstr(status)));
2389 }
2390
2391 status = auth_generic_set_username(auth_generic_ctx, "");
2392 if (!NT_STATUS_IS_OK(status)) {
2393 DEBUG(1, ("Failed to set username: %s\n",
2394 nt_errstr(status)));
2395 }
2396
2397 status = auth_generic_set_domain(auth_generic_ctx, "");
2398 if (!NT_STATUS_IS_OK(status)) {
2399 DEBUG(1, ("Failed to set domain: %s\n",
2400 nt_errstr(status)));
2401 return status;
2402 }
2403
2404 status = gensec_set_credentials(auth_generic_ctx->gensec_security,
2405 auth_generic_ctx->credentials);
2406 if (!NT_STATUS_IS_OK(status)) {
2407 DEBUG(1, ("Failed to set GENSEC credentials: %s\n",
2408 nt_errstr(status)));
2409 return status;
2410 }
2411 talloc_unlink(auth_generic_ctx, auth_generic_ctx->credentials);
2412 auth_generic_ctx->credentials = NULL;
2413
2414 result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2415 talloc_free(auth_generic_ctx);
2416 *presult = result;
2417 return NT_STATUS_OK;
2418 }
2419
2420 static NTSTATUS rpccli_generic_bind_data(TALLOC_CTX *mem_ctx,
2421 enum dcerpc_AuthType auth_type,
2422 enum dcerpc_AuthLevel auth_level,
2423 const char *server,
2424 const char *target_service,
2425 const char *domain,
2426 const char *username,
2427 const char *password,
2428 enum credentials_use_kerberos use_kerberos,
2429 struct netlogon_creds_CredentialState *creds,
2430 struct pipe_auth_data **presult)
2431 {
2432 struct auth_generic_state *auth_generic_ctx;
2433 struct pipe_auth_data *result;
2434 NTSTATUS status;
2435
2436 result = talloc_zero(mem_ctx, struct pipe_auth_data);
2437 if (result == NULL) {
2438 return NT_STATUS_NO_MEMORY;
2439 }
2440
2441 result->auth_type = auth_type;
2442 result->auth_level = auth_level;
2443 result->auth_context_id = 1;
2444
2445 status = auth_generic_client_prepare(result,
2446 &auth_generic_ctx);
2447 if (!NT_STATUS_IS_OK(status)) {
2448 goto fail;
2449 }
2450
2451 status = auth_generic_set_username(auth_generic_ctx, username);
2452 if (!NT_STATUS_IS_OK(status)) {
2453 goto fail;
2454 }
2455
2456 status = auth_generic_set_domain(auth_generic_ctx, domain);
2457 if (!NT_STATUS_IS_OK(status)) {
2458 goto fail;
2459 }
2460
2461 status = auth_generic_set_password(auth_generic_ctx, password);
2462 if (!NT_STATUS_IS_OK(status)) {
2463 goto fail;
2464 }
2465
2466 status = gensec_set_target_service(auth_generic_ctx->gensec_security, target_service);
2467 if (!NT_STATUS_IS_OK(status)) {
2468 goto fail;
2469 }
2470
2471 status = gensec_set_target_hostname(auth_generic_ctx->gensec_security, server);
2472 if (!NT_STATUS_IS_OK(status)) {
2473 goto fail;
2474 }
2475
2476 cli_credentials_set_kerberos_state(auth_generic_ctx->credentials,
2477 use_kerberos,
2478 CRED_SPECIFIED);
2479 cli_credentials_set_netlogon_creds(auth_generic_ctx->credentials, creds);
2480
2481 status = auth_generic_client_start_by_authtype(auth_generic_ctx, auth_type, auth_level);
2482 if (!NT_STATUS_IS_OK(status)) {
2483 goto fail;
2484 }
2485
2486 result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2487 talloc_free(auth_generic_ctx);
2488 *presult = result;
2489 return NT_STATUS_OK;
2490
2491 fail:
2492 TALLOC_FREE(result);
2493 return status;
2494 }
2495
2496 /* This routine steals the creds pointer that is passed in */
2497 static NTSTATUS rpccli_generic_bind_data_from_creds(TALLOC_CTX *mem_ctx,
2498 enum dcerpc_AuthType auth_type,
2499 enum dcerpc_AuthLevel auth_level,
2500 const char *server,
2501 const char *target_service,
2502 struct cli_credentials *creds,
2503 struct pipe_auth_data **presult)
2504 {
2505 struct auth_generic_state *auth_generic_ctx;
2506 struct pipe_auth_data *result;
2507 NTSTATUS status;
2508
2509 result = talloc_zero(mem_ctx, struct pipe_auth_data);
2510 if (result == NULL) {
2511 return NT_STATUS_NO_MEMORY;
2512 }
2513
2514 result->auth_type = auth_type;
2515 result->auth_level = auth_level;
2516 result->auth_context_id = 1;
2517
2518 status = auth_generic_client_prepare(result,
2519 &auth_generic_ctx);
2520 if (!NT_STATUS_IS_OK(status)) {
2521 goto fail;
2522 }
2523
2524 status = auth_generic_set_creds(auth_generic_ctx, creds);
2525 if (!NT_STATUS_IS_OK(status)) {
2526 goto fail;
2527 }
2528
2529 status = gensec_set_target_service(auth_generic_ctx->gensec_security, target_service);
2530 if (!NT_STATUS_IS_OK(status)) {
2531 goto fail;
2532 }
2533
2534 status = gensec_set_target_hostname(auth_generic_ctx->gensec_security, server);
2535 if (!NT_STATUS_IS_OK(status)) {
2536 goto fail;
2537 }
2538
2539 status = auth_generic_client_start_by_authtype(auth_generic_ctx, auth_type, auth_level);
2540 if (!NT_STATUS_IS_OK(status)) {
2541 goto fail;
2542 }
2543
2544 result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2545 talloc_free(auth_generic_ctx);
2546 *presult = result;
2547 return NT_STATUS_OK;
2548
2549 fail:
2550 TALLOC_FREE(result);
2551 return status;
2552 }
2553
2554 NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx,
2555 struct pipe_auth_data **presult)
2556 {
2557 return rpccli_generic_bind_data(mem_ctx,
2558 DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM,
2559 DCERPC_AUTH_LEVEL_CONNECT,
2560 NULL, /* server */
2561 "host", /* target_service */
2562 NAME_NT_AUTHORITY, /* domain */
2563 "SYSTEM",
2564 NULL, /* password */
2565 CRED_USE_KERBEROS_DISABLED,
2566 NULL, /* netlogon_creds_CredentialState */
2567 presult);
2568 }
2569
2570 /**
2571 * Create an rpc pipe client struct, connecting to a tcp port.
2572 */
2573 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
2574 const struct sockaddr_storage *ss_addr,
2575 uint16_t port,
2576 const struct ndr_interface_table *table,
2577 struct rpc_pipe_client **presult)
2578 {
2579 struct rpc_pipe_client *result;
2580 struct sockaddr_storage addr;
2581 NTSTATUS status;
2582 int fd;
2583
2584 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2585 if (result == NULL) {
2586 return NT_STATUS_NO_MEMORY;
2587 }
2588
2589 result->abstract_syntax = table->syntax_id;
2590 result->transfer_syntax = ndr_transfer_syntax_ndr;
2591
2592 result->desthost = talloc_strdup(result, host);
2593 if (result->desthost == NULL) {
2594 status = NT_STATUS_NO_MEMORY;
2595 goto fail;
2596 }
2597
2598 result->srv_name_slash = talloc_asprintf_strupper_m(
2599 result, "\\\\%s", result->desthost);
2600 if (result->srv_name_slash == NULL) {
2601 status = NT_STATUS_NO_MEMORY;
2602 goto fail;
2603 }
2604
2605 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2606
2607 if (ss_addr == NULL) {
2608 if (!resolve_name(host, &addr, NBT_NAME_SERVER, false)) {
2609 status = NT_STATUS_NOT_FOUND;
2610 goto fail;
2611 }
2612 } else {
2613 addr = *ss_addr;
2614 }
2615
2616 status = open_socket_out(&addr, port, 60*1000, &fd);
2617 if (!NT_STATUS_IS_OK(status)) {
2618 goto fail;
2619 }
2620 set_socket_options(fd, lp_socket_options());
2621
2622 status = rpc_transport_sock_init(result, fd, &result->transport);
2623 if (!NT_STATUS_IS_OK(status)) {
2624 close(fd);
2625 goto fail;
2626 }
2627
2628 result->transport->transport = NCACN_IP_TCP;
2629
2630 result->binding_handle = rpccli_bh_create(result, NULL, table);
2631 if (result->binding_handle == NULL) {
2632 TALLOC_FREE(result);
2633 return NT_STATUS_NO_MEMORY;
2634 }
2635
2636 *presult = result;
2637 return NT_STATUS_OK;
2638
2639 fail:
2640 TALLOC_FREE(result);
2641 return status;
2642 }
2643
2644 static NTSTATUS rpccli_epm_map_binding(
2645 struct dcerpc_binding_handle *epm_connection,
2646 struct dcerpc_binding *binding,
2647 TALLOC_CTX *mem_ctx,
2648 char **pendpoint)
2649 {
2650 TALLOC_CTX *frame = talloc_stackframe();
2651 enum dcerpc_transport_t transport =
2652 dcerpc_binding_get_transport(binding);
2653 enum dcerpc_transport_t res_transport;
2654 struct dcerpc_binding *res_binding = NULL;
2655 struct epm_twr_t *map_tower = NULL;
2656 struct epm_twr_p_t res_towers = { .twr = NULL };
2657 struct policy_handle *entry_handle = NULL;
2658 uint32_t num_towers = 0;
2659 const uint32_t max_towers = 1;
2660 const char *endpoint = NULL;
2661 char *tmp = NULL;
2662 uint32_t result;
2663 NTSTATUS status;
2664
2665 map_tower = talloc_zero(frame, struct epm_twr_t);
2666 if (map_tower == NULL) {
2667 goto nomem;
2668 }
2669
2670 status = dcerpc_binding_build_tower(
2671 frame, binding, &(map_tower->tower));
2672 if (!NT_STATUS_IS_OK(status)) {
2673 DBG_DEBUG("dcerpc_binding_build_tower failed: %s\n",
2674 nt_errstr(status));
2675 goto done;
2676 }
2677
2678 res_towers.twr = talloc_array(frame, struct epm_twr_t, max_towers);
2679 if (res_towers.twr == NULL) {
2680 goto nomem;
2681 }
2682
2683 entry_handle = talloc_zero(frame, struct policy_handle);
2684 if (entry_handle == NULL) {
2685 goto nomem;
2686 }
2687
2688 status = dcerpc_epm_Map(
2689 epm_connection,
2690 frame,
2691 NULL,
2692 map_tower,
2693 entry_handle,
2694 max_towers,
2695 &num_towers,
2696 &res_towers,
2697 &result);
2698
2699 if (!NT_STATUS_IS_OK(status)) {
2700 DBG_DEBUG("dcerpc_epm_Map failed: %s\n", nt_errstr(status));
2701 goto done;
2702 }
2703
2704 if (result != EPMAPPER_STATUS_OK) {
2705 DBG_DEBUG("dcerpc_epm_Map returned %"PRIu32"\n", result);
2706 status = NT_STATUS_NOT_FOUND;
2707 goto done;
2708 }
2709
2710 if (num_towers != 1) {
2711 DBG_DEBUG("dcerpc_epm_Map returned %"PRIu32" towers\n",
2712 num_towers);
2713 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2714 goto done;
2715 }
2716
2717 status = dcerpc_binding_from_tower(
2718 frame, &(res_towers.twr->tower), &res_binding);
2719 if (!NT_STATUS_IS_OK(status)) {
2720 DBG_DEBUG("dcerpc_binding_from_tower failed: %s\n",
2721 nt_errstr(status));
2722 goto done;
2723 }
2724
2725 res_transport = dcerpc_binding_get_transport(res_binding);
2726 if (res_transport != transport) {
2727 DBG_DEBUG("dcerpc_epm_Map returned transport %d, "
2728 "expected %d\n",
2729 (int)res_transport,
2730 (int)transport);
2731 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2732 goto done;
2733 }
2734
2735 endpoint = dcerpc_binding_get_string_option(res_binding, "endpoint");
2736 if (endpoint == NULL) {
2737 DBG_DEBUG("dcerpc_epm_Map returned no endpoint\n");
2738 status = NT_STATUS_INVALID_NETWORK_RESPONSE;
2739 goto done;
2740 }
2741
2742 tmp = talloc_strdup(mem_ctx, endpoint);
2743 if (tmp == NULL) {
2744 goto nomem;
2745 }
2746 *pendpoint = tmp;
2747
2748 status = NT_STATUS_OK;
2749 goto done;
2750
2751 nomem:
2752 status = NT_STATUS_NO_MEMORY;
2753 done:
2754 TALLOC_FREE(frame);
2755 return status;
2756 }
2757
2758 static NTSTATUS rpccli_epm_map_interface(
2759 struct dcerpc_binding_handle *epm_connection,
2760 enum dcerpc_transport_t transport,
2761 const struct ndr_syntax_id *iface,
2762 TALLOC_CTX *mem_ctx,
2763 char **pendpoint)
2764 {
2765 struct dcerpc_binding *binding = NULL;
2766 char *endpoint = NULL;
2767 NTSTATUS status;
2768
2769 status = dcerpc_parse_binding(mem_ctx, "", &binding);
2770 if (!NT_STATUS_IS_OK(status)) {
2771 DBG_DEBUG("dcerpc_parse_binding failed: %s\n",
2772 nt_errstr(status));
2773 goto done;
2774 }
2775
2776 status = dcerpc_binding_set_transport(binding, transport);
2777 if (!NT_STATUS_IS_OK(status)) {
2778 DBG_DEBUG("dcerpc_binding_set_transport failed: %s\n",
2779 nt_errstr(status));
2780 goto done;
2781 }
2782
2783 status = dcerpc_binding_set_abstract_syntax(binding, iface);
2784 if (!NT_STATUS_IS_OK(status)) {
2785 DBG_DEBUG("dcerpc_binding_set_abstract_syntax failed: %s\n",
2786 nt_errstr(status));
2787 goto done;
2788 }
2789
2790 status = rpccli_epm_map_binding(
2791 epm_connection, binding, mem_ctx, &endpoint);
2792 if (!NT_STATUS_IS_OK(status)) {
2793 DBG_DEBUG("rpccli_epm_map_binding failed: %s\n",
2794 nt_errstr(status));
2795 goto done;
2796 }
2797 *pendpoint = endpoint;
2798
2799 done:
2800 TALLOC_FREE(binding);
2801 return status;
2802 }
2803
2804 /**
2805 * Determine the tcp port on which a dcerpc interface is listening
2806 * for the ncacn_ip_tcp transport via the endpoint mapper of the
2807 * target host.
2808 */
2809 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
2810 const struct sockaddr_storage *addr,
2811 const struct ndr_interface_table *table,
2812 uint16_t *pport)
2813 {
2814 NTSTATUS status;
2815 struct rpc_pipe_client *epm_pipe = NULL;
2816 struct pipe_auth_data *auth = NULL;
2817 char *endpoint = NULL;
2818 TALLOC_CTX *tmp_ctx = talloc_stackframe();
2819
2820 if (pport == NULL) {
2821 status = NT_STATUS_INVALID_PARAMETER;
2822 goto done;
2823 }
2824
2825 if (ndr_syntax_id_equal(&table->syntax_id,
2826 &ndr_table_epmapper.syntax_id)) {
2827 *pport = 135;
2828 status = NT_STATUS_OK;
2829 goto done;
2830 }
2831
2832 /* open the connection to the endpoint mapper */
2833 status = rpc_pipe_open_tcp_port(tmp_ctx, host, addr, 135,
2834 &ndr_table_epmapper,
2835 &epm_pipe);
2836
2837 if (!NT_STATUS_IS_OK(status)) {
2838 goto done;
2839 }
2840
2841 status = rpccli_anon_bind_data(tmp_ctx, &auth);
2842 if (!NT_STATUS_IS_OK(status)) {
2843 goto done;
2844 }
2845
2846 status = rpc_pipe_bind(epm_pipe, auth);
2847 if (!NT_STATUS_IS_OK(status)) {
2848 goto done;
2849 }
2850
2851 status = rpccli_epm_map_interface(
2852 epm_pipe->binding_handle,
2853 NCACN_IP_TCP,
2854 &table->syntax_id,
2855 tmp_ctx,
2856 &endpoint);
2857 if (!NT_STATUS_IS_OK(status)) {
2858 DBG_DEBUG("rpccli_epm_map_interface failed: %s\n",
2859 nt_errstr(status));
2860 goto done;
2861 }
2862
2863 *pport = (uint16_t)atoi(endpoint);
2864
2865 done:
2866 TALLOC_FREE(tmp_ctx);
2867 return status;
2868 }
2869
2870 /**
2871 * Create a rpc pipe client struct, connecting to a host via tcp.
2872 * The port is determined by asking the endpoint mapper on the given
2873 * host.
2874 */
2875 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
2876 const struct sockaddr_storage *addr,
2877 const struct ndr_interface_table *table,
2878 struct rpc_pipe_client **presult)
2879 {
2880 NTSTATUS status;
2881 uint16_t port = 0;
2882
2883 status = rpc_pipe_get_tcp_port(host, addr, table, &port);
2884 if (!NT_STATUS_IS_OK(status)) {
2885 return status;
2886 }
2887
2888 return rpc_pipe_open_tcp_port(mem_ctx, host, addr, port,
2889 table, presult);
2890 }
2891
2892 static NTSTATUS rpc_pipe_get_ncalrpc_name(
2893 const struct ndr_syntax_id *iface,
2894 TALLOC_CTX *mem_ctx,
2895 char **psocket_name)
2896 {
2897 TALLOC_CTX *frame = talloc_stackframe();
2898 struct rpc_pipe_client *epm_pipe = NULL;
2899 struct pipe_auth_data *auth = NULL;
2900 NTSTATUS status = NT_STATUS_OK;
2901 bool is_epm;
2902
2903 is_epm = ndr_syntax_id_equal(iface, &ndr_table_epmapper.syntax_id);
2904 if (is_epm) {
2905 char *endpoint = talloc_strdup(mem_ctx, "EPMAPPER");
2906 if (endpoint == NULL) {
2907 status = NT_STATUS_NO_MEMORY;
2908 goto done;
2909 }
2910 *psocket_name = endpoint;
2911 goto done;
2912 }
2913
2914 status = rpc_pipe_open_ncalrpc(
2915 frame, &ndr_table_epmapper, &epm_pipe);
2916 if (!NT_STATUS_IS_OK(status)) {
2917 DBG_DEBUG("rpc_pipe_open_ncalrpc failed: %s\n",
2918 nt_errstr(status));
2919 goto done;
2920 }
2921
2922 status = rpccli_anon_bind_data(epm_pipe, &auth);
2923 if (!NT_STATUS_IS_OK(status)) {
2924 DBG_DEBUG("rpccli_anon_bind_data failed: %s\n",
2925 nt_errstr(status));
2926 goto done;
2927 }
2928
2929 status = rpc_pipe_bind(epm_pipe, auth);
2930 if (!NT_STATUS_IS_OK(status)) {
2931 DBG_DEBUG("rpc_pipe_bind failed: %s\n", nt_errstr(status));
2932 goto done;
2933 }
2934
2935 status = rpccli_epm_map_interface(
2936 epm_pipe->binding_handle,
2937 NCALRPC,
2938 iface,
2939 mem_ctx,
2940 psocket_name);
2941 if (!NT_STATUS_IS_OK(status)) {
2942 DBG_DEBUG("rpccli_epm_map_interface failed: %s\n",
2943 nt_errstr(status));
2944 }
2945
2946 done:
2947 TALLOC_FREE(frame);
2948 return status;
2949 }
2950
2951 /********************************************************************
2952 Create a rpc pipe client struct, connecting to a unix domain socket
2953 ********************************************************************/
2954 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx,
2955 const struct ndr_interface_table *table,
2956 struct rpc_pipe_client **presult)
2957 {
2958 char *socket_name = NULL;
2959 struct rpc_pipe_client *result;
2960 struct sockaddr_un addr = { .sun_family = AF_UNIX };
2961 socklen_t salen = sizeof(addr);
2962 int pathlen;
2963 NTSTATUS status;
2964 int fd = -1;
2965
2966 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2967 if (result == NULL) {
2968 return NT_STATUS_NO_MEMORY;
2969 }
2970
2971 status = rpc_pipe_get_ncalrpc_name(
2972 &table->syntax_id, result, &socket_name);
2973 if (!NT_STATUS_IS_OK(status)) {
2974 DBG_DEBUG("rpc_pipe_get_ncalrpc_name failed: %s\n",
2975 nt_errstr(status));
2976 goto fail;
2977 }
2978
2979 pathlen = snprintf(
2980 addr.sun_path,
2981 sizeof(addr.sun_path),
2982 "%s/%s",
2983 lp_ncalrpc_dir(),
2984 socket_name);
2985 if ((pathlen < 0) || ((size_t)pathlen >= sizeof(addr.sun_path))) {
2986 DBG_DEBUG("socket_path for %s too long\n", socket_name);
2987 status = NT_STATUS_NAME_TOO_LONG;
2988 goto fail;
2989 }
2990 TALLOC_FREE(socket_name);
2991
2992 result->abstract_syntax = table->syntax_id;
2993 result->transfer_syntax = ndr_transfer_syntax_ndr;
2994
2995 result->desthost = get_myname(result);
2996 if (result->desthost == NULL) {
2997 status = NT_STATUS_NO_MEMORY;
2998 goto fail;
2999 }
3000
3001 result->srv_name_slash = talloc_asprintf_strupper_m(
3002 result, "\\\\%s", result->desthost);
3003 if (result->srv_name_slash == NULL) {
3004 status = NT_STATUS_NO_MEMORY;
3005 goto fail;
3006 }
3007
3008 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3009
3010 fd = socket(AF_UNIX, SOCK_STREAM, 0);
3011 if (fd == -1) {
3012 status = map_nt_error_from_unix(errno);
3013 goto fail;
3014 }
3015
3016 if (connect(fd, (struct sockaddr *)(void *)&addr, salen) == -1) {
3017 DBG_ERR("connect(%s) failed: %s\n",
3018 addr.sun_path,
3019 strerror(errno));
3020 status = map_nt_error_from_unix(errno);
3021 goto fail;
3022 }
3023
3024 status = rpc_transport_sock_init(result, fd, &result->transport);
3025 if (!NT_STATUS_IS_OK(status)) {
3026 goto fail;
3027 }
3028 fd = -1;
3029
3030 result->transport->transport = NCALRPC;
3031
3032 result->binding_handle = rpccli_bh_create(result, NULL, table);
3033 if (result->binding_handle == NULL) {
3034 status = NT_STATUS_NO_MEMORY;
3035 goto fail;
3036 }
3037
3038 *presult = result;
3039 return NT_STATUS_OK;
3040
3041 fail:
3042 if (fd != -1) {
3043 close(fd);
3044 }
3045 TALLOC_FREE(result);
3046 return status;
3047 }
3048
3049 struct rpc_pipe_client_np_ref {
3050 struct cli_state *cli;
3051 struct rpc_pipe_client *pipe;
3052 };
3053
3054 static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
3055 {
3056 DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
3057 return 0;
3058 }
3059
3060 /****************************************************************************
3061 Open a named pipe over SMB to a remote server.
3062 *
3063 * CAVEAT CALLER OF THIS FUNCTION:
3064 * The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
3065 * so be sure that this function is called AFTER any structure (vs pointer)
3066 * assignment of the cli. In particular, libsmbclient does structure
3067 * assignments of cli, which invalidates the data in the returned
3068 * rpc_pipe_client if this function is called before the structure assignment
3069 * of cli.
3070 *
3071 ****************************************************************************/
3072
3073 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
3074 const struct ndr_interface_table *table,
3075 struct rpc_pipe_client **presult)
3076 {
3077 struct rpc_pipe_client *result;
3078 NTSTATUS status;
3079 struct rpc_pipe_client_np_ref *np_ref;
3080
3081 /* sanity check to protect against crashes */
3082
3083 if ( !cli ) {
3084 return NT_STATUS_INVALID_HANDLE;
3085 }
3086
3087 result = talloc_zero(NULL, struct rpc_pipe_client);
3088 if (result == NULL) {
3089 return NT_STATUS_NO_MEMORY;
3090 }
3091
3092 result->abstract_syntax = table->syntax_id;
3093 result->transfer_syntax = ndr_transfer_syntax_ndr;
3094
3095 result->desthost = talloc_strdup(
3096 result, smbXcli_conn_remote_name(cli->conn));
3097 if (result->desthost == NULL) {
3098 TALLOC_FREE(result);
3099 return NT_STATUS_NO_MEMORY;
3100 }
3101
3102 result->srv_name_slash = talloc_asprintf_strupper_m(
3103 result, "\\\\%s", result->desthost);
3104 if (result->srv_name_slash == NULL) {
3105 TALLOC_FREE(result);
3106 return NT_STATUS_NO_MEMORY;
3107 }
3108
3109 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3110
3111 status = rpc_transport_np_init(result, cli, table,
3112 &result->transport);
3113 if (!NT_STATUS_IS_OK(status)) {
3114 TALLOC_FREE(result);
3115 return status;
3116 }
3117
3118 result->transport->transport = NCACN_NP;
3119
3120 np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
3121 if (np_ref == NULL) {
3122 TALLOC_FREE(result);
3123 return NT_STATUS_NO_MEMORY;
3124 }
3125 np_ref->cli = cli;
3126 np_ref->pipe = result;
3127
3128 DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
3129 talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
3130
3131 result->binding_handle = rpccli_bh_create(result, NULL, table);
3132 if (result->binding_handle == NULL) {
3133 TALLOC_FREE(result);
3134 return NT_STATUS_NO_MEMORY;
3135 }
3136
3137 *presult = result;
3138 return NT_STATUS_OK;
3139 }
3140
3141 /****************************************************************************
3142 Open a pipe to a remote server.
3143 ****************************************************************************/
3144
3145 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
3146 enum dcerpc_transport_t transport,
3147 const struct ndr_interface_table *table,
3148 struct rpc_pipe_client **presult)
3149 {
3150 switch (transport) {
3151 case NCACN_IP_TCP:
3152 return rpc_pipe_open_tcp(NULL,
3153 smbXcli_conn_remote_name(cli->conn),
3154 smbXcli_conn_remote_sockaddr(cli->conn),
3155 table, presult);
3156 case NCACN_NP:
3157 return rpc_pipe_open_np(cli, table, presult);
3158 default:
3159 return NT_STATUS_NOT_IMPLEMENTED;
3160 }
3161 }
3162
3163 /****************************************************************************
3164 Open a named pipe to an SMB server and bind anonymously.
3165 ****************************************************************************/
3166
3167 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
3168 enum dcerpc_transport_t transport,
3169 const struct ndr_interface_table *table,
3170 struct rpc_pipe_client **presult)
3171 {
3172 struct rpc_pipe_client *result;
3173 struct pipe_auth_data *auth;
3174 NTSTATUS status;
3175
3176 status = cli_rpc_pipe_open(cli, transport, table, &result);
3177 if (!NT_STATUS_IS_OK(status)) {
3178 return status;
3179 }
3180
3181 status = rpccli_anon_bind_data(result, &auth);
3182 if (!NT_STATUS_IS_OK(status)) {
3183 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
3184 nt_errstr(status)));
3185 TALLOC_FREE(result);
3186 return status;
3187 }
3188
3189 /*
3190 * This is a bit of an abstraction violation due to the fact that an
3191 * anonymous bind on an authenticated SMB inherits the user/domain
3192 * from the enclosing SMB creds
3193 */
3194
3195 if (transport == NCACN_NP) {
3196 struct smbXcli_session *session;
3197
3198 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
3199 session = cli->smb2.session;
3200 } else {
3201 session = cli->smb1.session;
3202 }
3203
3204 status = smbXcli_session_application_key(session, auth,
3205 &auth->transport_session_key);
3206 if (!NT_STATUS_IS_OK(status)) {
3207 auth->transport_session_key = data_blob_null;
3208 }
3209 }
3210
3211 status = rpc_pipe_bind(result, auth);
3212 if (!NT_STATUS_IS_OK(status)) {
3213 int lvl = 0;
3214 if (ndr_syntax_id_equal(&table->syntax_id,
3215 &ndr_table_dssetup.syntax_id)) {
3216 /* non AD domains just don't have this pipe, avoid
3217 * level 0 statement in that case - gd */
3218 lvl = 3;
3219 }
3220 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
3221 "%s failed with error %s\n",
3222 table->name,
3223 nt_errstr(status) ));
3224 TALLOC_FREE(result);
3225 return status;
3226 }
3227
3228 DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
3229 "%s and bound anonymously.\n",
3230 table->name,
3231 result->desthost));
3232
3233 *presult = result;
3234 return NT_STATUS_OK;
3235 }
3236
3237 /****************************************************************************
3238 ****************************************************************************/
3239
3240 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
3241 const struct ndr_interface_table *table,
3242 struct rpc_pipe_client **presult)
3243 {
3244 return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
3245 table, presult);
3246 }
3247
3248 /****************************************************************************
3249 Open a named pipe to an SMB server and bind using the mech specified
3250
3251 This routine references the creds pointer that is passed in
3252 ****************************************************************************/
3253
3254 NTSTATUS cli_rpc_pipe_open_with_creds(struct cli_state *cli,
3255 const struct ndr_interface_table *table,
3256 enum dcerpc_transport_t transport,
3257 enum dcerpc_AuthType auth_type,
3258 enum dcerpc_AuthLevel auth_level,
3259 const char *server,
3260 struct cli_credentials *creds,
3261 struct rpc_pipe_client **presult)
3262 {
3263 struct rpc_pipe_client *result;
3264 struct pipe_auth_data *auth = NULL;
3265 const char *target_service = table->authservices->names[0];
3266 NTSTATUS status;
3267
3268 status = cli_rpc_pipe_open(cli, transport, table, &result);
3269 if (!NT_STATUS_IS_OK(status)) {
3270 return status;
3271 }
3272
3273 status = rpccli_generic_bind_data_from_creds(result,
3274 auth_type, auth_level,
3275 server, target_service,
3276 creds,
3277 &auth);
3278 if (!NT_STATUS_IS_OK(status)) {
3279 DBG_ERR("rpccli_generic_bind_data_from_creds returned %s\n",
3280 nt_errstr(status));
3281 goto err;
3282 }
3283
3284 status = rpc_pipe_bind(result, auth);
3285 if (!NT_STATUS_IS_OK(status)) {
3286 DBG_ERR("cli_rpc_pipe_bind failed with error %s\n",
3287 nt_errstr(status));
3288 goto err;
3289 }
3290
3291 DBG_DEBUG("opened pipe %s to machine %s and bound as user %s.\n",
3292 table->name,
3293 result->desthost,
3294 cli_credentials_get_unparsed_name(creds, talloc_tos()));
3295
3296 *presult = result;
3297 return NT_STATUS_OK;
3298
3299 err:
3300
3301 TALLOC_FREE(result);
3302 return status;
3303 }
3304
3305 NTSTATUS cli_rpc_pipe_open_bind_schannel(
3306 struct cli_state *cli,
3307 const struct ndr_interface_table *table,
3308 enum dcerpc_transport_t transport,
3309 struct netlogon_creds_cli_context *netlogon_creds,
3310 struct rpc_pipe_client **_rpccli)
3311 {
3312 struct rpc_pipe_client *rpccli;
3313 struct pipe_auth_data *rpcauth;
3314 const char *target_service = table->authservices->names[0];
3315 struct cli_credentials *cli_creds;
3316 enum dcerpc_AuthLevel auth_level;
3317 NTSTATUS status;
3318
3319 status = cli_rpc_pipe_open(cli, transport, table, &rpccli);
3320 if (!NT_STATUS_IS_OK(status)) {
3321 return status;
3322 }
3323
3324 auth_level = netlogon_creds_cli_auth_level(netlogon_creds);
3325
3326 status = netlogon_creds_bind_cli_credentials(
3327 netlogon_creds, rpccli, &cli_creds);
3328 if (!NT_STATUS_IS_OK(status)) {
3329 DBG_DEBUG("netlogon_creds_bind_cli_credentials failed: %s\n",
3330 nt_errstr(status));
3331 TALLOC_FREE(rpccli);
3332 return status;
3333 }
3334
3335 status = rpccli_generic_bind_data_from_creds(rpccli,
3336 DCERPC_AUTH_TYPE_SCHANNEL,
3337 auth_level,
3338 rpccli->desthost,
3339 target_service,
3340 cli_creds,
3341 &rpcauth);
3342 if (!NT_STATUS_IS_OK(status)) {
3343 DEBUG(0, ("rpccli_generic_bind_data_from_creds returned %s\n",
3344 nt_errstr(status)));
3345 TALLOC_FREE(rpccli);
3346 return status;
3347 }
3348
3349 status = rpc_pipe_bind(rpccli, rpcauth);
3350
3351 /* No TALLOC_FREE, gensec takes references */
3352 talloc_unlink(rpccli, cli_creds);
3353 cli_creds = NULL;
3354
3355 if (!NT_STATUS_IS_OK(status)) {
3356 DBG_DEBUG("rpc_pipe_bind failed with error %s\n",
3357 nt_errstr(status));
3358 TALLOC_FREE(rpccli);
3359 return status;
3360 }
3361
3362 *_rpccli = rpccli;
3363
3364 return NT_STATUS_OK;
3365 }
3366
3367 NTSTATUS cli_rpc_pipe_open_schannel_with_creds(struct cli_state *cli,
3368 const struct ndr_interface_table *table,
3369 enum dcerpc_transport_t transport,
3370 struct netlogon_creds_cli_context *netlogon_creds,
3371 struct rpc_pipe_client **_rpccli)
3372 {
3373 TALLOC_CTX *frame = talloc_stackframe();
3374 struct rpc_pipe_client *rpccli;
3375 struct netlogon_creds_cli_lck *lck;
3376 NTSTATUS status;
3377
3378 status = netlogon_creds_cli_lck(
3379 netlogon_creds, NETLOGON_CREDS_CLI_LCK_EXCLUSIVE,
3380 frame, &lck);
3381 if (!NT_STATUS_IS_OK(status)) {
3382 DBG_WARNING("netlogon_creds_cli_lck returned %s\n",
3383 nt_errstr(status));
3384 TALLOC_FREE(frame);
3385 return status;
3386 }
3387
3388 status = cli_rpc_pipe_open_bind_schannel(
3389 cli, table, transport, netlogon_creds, &rpccli);
3390 if (NT_STATUS_EQUAL(status, NT_STATUS_NETWORK_ACCESS_DENIED)) {
3391 netlogon_creds_cli_delete_lck(netlogon_creds);
3392 }
3393 if (!NT_STATUS_IS_OK(status)) {
3394 DBG_DEBUG("cli_rpc_pipe_open_bind_schannel failed: %s\n",
3395 nt_errstr(status));
3396 TALLOC_FREE(frame);
3397 return status;
3398 }
3399
3400 if (ndr_syntax_id_equal(&table->syntax_id,
3401 &ndr_table_netlogon.syntax_id)) {
3402 status = netlogon_creds_cli_check(netlogon_creds,
3403 rpccli->binding_handle,
3404 NULL);
3405 if (!NT_STATUS_IS_OK(status)) {
3406 DEBUG(0, ("netlogon_creds_cli_check failed with %s\n",
3407 nt_errstr(status)));
3408 TALLOC_FREE(frame);
3409 return status;
3410 }
3411 }
3412
3413 DBG_DEBUG("opened pipe %s to machine %s with key %s "
3414 "and bound using schannel.\n",
3415 table->name, rpccli->desthost,
3416 netlogon_creds_cli_debug_string(netlogon_creds, lck));
3417
3418 TALLOC_FREE(frame);
3419
3420 *_rpccli = rpccli;
3421 return NT_STATUS_OK;
3422 }
3423
3424 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
3425 struct rpc_pipe_client *cli,
3426 DATA_BLOB *session_key)
3427 {
3428 NTSTATUS status;
3429 struct pipe_auth_data *a;
3430 struct gensec_security *gensec_security;
3431 DATA_BLOB sk = { .data = NULL };
3432 bool make_dup = false;
3433
3434 if (!session_key || !cli) {
3435 return NT_STATUS_INVALID_PARAMETER;
3436 }
3437
3438 a = cli->auth;
3439
3440 if (a == NULL) {
3441 return NT_STATUS_INVALID_PARAMETER;
3442 }
3443
3444 switch (cli->auth->auth_type) {
3445 case DCERPC_AUTH_TYPE_NONE:
3446 sk = data_blob_const(a->transport_session_key.data,
3447 a->transport_session_key.length);
3448 make_dup = true;
3449 break;
3450 default:
3451 gensec_security = a->auth_ctx;
3452 status = gensec_session_key(gensec_security, mem_ctx, &sk);
3453 if (!NT_STATUS_IS_OK(status)) {
3454 return status;
3455 }
3456 make_dup = false;
3457 break;
3458 }
3459
3460 if (!sk.data) {
3461 return NT_STATUS_NO_USER_SESSION_KEY;
3462 }
3463
3464 if (make_dup) {
3465 *session_key = data_blob_dup_talloc(mem_ctx, sk);
3466 } else {
3467 *session_key = sk;
3468 }
3469
3470 return NT_STATUS_OK;
3471 }
Samba GIT mirror