?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:librpc: factor out xxx_send_request() to dcerpc_send_request()
[Samba.git] / source4 / librpc / rpc / dcerpc.c
blob9e893d0d8989962d4fa84e7762c0663865ef3e28
1 /*
2 Unix SMB/CIFS implementation.
3 raw dcerpc operations
4
5 Copyright (C) Tim Potter 2003
6 Copyright (C) Andrew Tridgell 2003-2005
7 Copyright (C) Jelmer Vernooij 2004-2005
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "system/filesys.h"
25 #include "../lib/util/dlinklist.h"
26 #include "lib/events/events.h"
27 #include "librpc/rpc/dcerpc.h"
28 #include "librpc/rpc/dcerpc_proto.h"
29 #include "librpc/gen_ndr/ndr_misc.h"
30 #include "librpc/gen_ndr/ndr_dcerpc.h"
31 #include "auth/gensec/gensec.h"
32 #include "param/param.h"
33 #include "lib/util/tevent_ntstatus.h"
34 #include "librpc/rpc/rpc_common.h"
35 #include "lib/tsocket/tsocket.h"
36 #include "libcli/smb/tstream_smbXcli_np.h"
37
38
39 enum rpc_request_state {
40 RPC_REQUEST_QUEUED,
41 RPC_REQUEST_PENDING,
42 RPC_REQUEST_DONE
43 };
44
45 /*
46 handle for an async dcerpc request
47 */
48 struct rpc_request {
49 struct rpc_request *next, *prev;
50 struct dcerpc_pipe *p;
51 NTSTATUS status;
52 uint32_t call_id;
53 enum rpc_request_state state;
54 DATA_BLOB payload;
55 uint32_t flags;
56 uint32_t fault_code;
57
58 /* this is used to distinguish bind and alter_context requests
59 from normal requests */
60 void (*recv_handler)(struct rpc_request *conn,
61 DATA_BLOB *blob, struct ncacn_packet *pkt);
62
63 const struct GUID *object;
64 uint16_t opnum;
65 DATA_BLOB request_data;
66 bool ignore_timeout;
67 bool wait_for_sync;
68
69 struct {
70 void (*callback)(struct rpc_request *);
71 void *private_data;
72 } async;
73 };
74
75 _PUBLIC_ NTSTATUS dcerpc_init(void)
76 {
77 return gensec_init();
78 }
79
80 static void dcerpc_connection_dead(struct dcecli_connection *conn, NTSTATUS status);
81 static void dcerpc_schedule_io_trigger(struct dcecli_connection *c);
82
83 static struct rpc_request *dcerpc_request_send(TALLOC_CTX *mem_ctx,
84 struct dcerpc_pipe *p,
85 const struct GUID *object,
86 uint16_t opnum,
87 DATA_BLOB *stub_data);
88 static NTSTATUS dcerpc_request_recv(struct rpc_request *req,
89 TALLOC_CTX *mem_ctx,
90 DATA_BLOB *stub_data);
91 static NTSTATUS dcerpc_ndr_validate_in(struct dcecli_connection *c,
92 TALLOC_CTX *mem_ctx,
93 DATA_BLOB blob,
94 size_t struct_size,
95 ndr_push_flags_fn_t ndr_push,
96 ndr_pull_flags_fn_t ndr_pull);
97 static NTSTATUS dcerpc_ndr_validate_out(struct dcecli_connection *c,
98 struct ndr_pull *pull_in,
99 void *struct_ptr,
100 size_t struct_size,
101 ndr_push_flags_fn_t ndr_push,
102 ndr_pull_flags_fn_t ndr_pull,
103 ndr_print_function_t ndr_print);
104 static NTSTATUS dcerpc_shutdown_pipe(struct dcecli_connection *p, NTSTATUS status);
105 static NTSTATUS dcerpc_send_request(struct dcecli_connection *p, DATA_BLOB *data,
106 bool trigger_read);
107 static NTSTATUS dcerpc_send_read(struct dcecli_connection *p);
108
109 /* destroy a dcerpc connection */
110 static int dcerpc_connection_destructor(struct dcecli_connection *conn)
111 {
112 if (conn->dead) {
113 conn->free_skipped = true;
114 return -1;
115 }
116 dcerpc_connection_dead(conn, NT_STATUS_LOCAL_DISCONNECT);
117 return 0;
118 }
119
120
121 /* initialise a dcerpc connection.
122 the event context is optional
123 */
124 static struct dcecli_connection *dcerpc_connection_init(TALLOC_CTX *mem_ctx,
125 struct tevent_context *ev)
126 {
127 struct dcecli_connection *c;
128
129 c = talloc_zero(mem_ctx, struct dcecli_connection);
130 if (!c) {
131 return NULL;
132 }
133
134 c->event_ctx = ev;
135
136 if (c->event_ctx == NULL) {
137 talloc_free(c);
138 return NULL;
139 }
140
141 c->call_id = 1;
142 c->security_state.auth_info = NULL;
143 c->security_state.session_key = dcerpc_generic_session_key;
144 c->security_state.generic_state = NULL;
145 c->binding_string = NULL;
146 c->flags = 0;
147 /*
148 * Windows uses 5840 for ncacn_ip_tcp,
149 * so we also use it (for every transport)
150 * by default. But we give the transport
151 * the chance to overwrite it.
152 */
153 c->srv_max_xmit_frag = 5840;
154 c->srv_max_recv_frag = 5840;
155 c->pending = NULL;
156
157 c->io_trigger = tevent_create_immediate(c);
158 if (c->io_trigger == NULL) {
159 talloc_free(c);
160 return NULL;
161 }
162
163 talloc_set_destructor(c, dcerpc_connection_destructor);
164
165 return c;
166 }
167
168 struct dcerpc_bh_state {
169 struct dcerpc_pipe *p;
170 };
171
172 static bool dcerpc_bh_is_connected(struct dcerpc_binding_handle *h)
173 {
174 struct dcerpc_bh_state *hs = dcerpc_binding_handle_data(h,
175 struct dcerpc_bh_state);
176
177 if (!hs->p) {
178 return false;
179 }
180
181 if (!hs->p->conn) {
182 return false;
183 }
184
185 if (hs->p->conn->dead) {
186 return false;
187 }
188
189 return true;
190 }
191
192 static uint32_t dcerpc_bh_set_timeout(struct dcerpc_binding_handle *h,
193 uint32_t timeout)
194 {
195 struct dcerpc_bh_state *hs = dcerpc_binding_handle_data(h,
196 struct dcerpc_bh_state);
197 uint32_t old;
198
199 if (!hs->p) {
200 return DCERPC_REQUEST_TIMEOUT;
201 }
202
203 old = hs->p->request_timeout;
204 hs->p->request_timeout = timeout;
205
206 return old;
207 }
208
209 static void dcerpc_bh_auth_info(struct dcerpc_binding_handle *h,
210 enum dcerpc_AuthType *auth_type,
211 enum dcerpc_AuthLevel *auth_level)
212 {
213 struct dcerpc_bh_state *hs = dcerpc_binding_handle_data(h,
214 struct dcerpc_bh_state);
215
216 if (hs->p == NULL) {
217 return;
218 }
219
220 if (hs->p->conn == NULL) {
221 return;
222 }
223
224 if (hs->p->conn->security_state.auth_info == NULL) {
225 return;
226 }
227
228 *auth_type = hs->p->conn->security_state.auth_info->auth_type;
229 *auth_level = hs->p->conn->security_state.auth_info->auth_level;
230 }
231
232 struct dcerpc_bh_raw_call_state {
233 struct tevent_context *ev;
234 struct dcerpc_binding_handle *h;
235 DATA_BLOB in_data;
236 DATA_BLOB out_data;
237 uint32_t out_flags;
238 };
239
240 static void dcerpc_bh_raw_call_done(struct rpc_request *subreq);
241
242 static struct tevent_req *dcerpc_bh_raw_call_send(TALLOC_CTX *mem_ctx,
243 struct tevent_context *ev,
244 struct dcerpc_binding_handle *h,
245 const struct GUID *object,
246 uint32_t opnum,
247 uint32_t in_flags,
248 const uint8_t *in_data,
249 size_t in_length)
250 {
251 struct dcerpc_bh_state *hs = dcerpc_binding_handle_data(h,
252 struct dcerpc_bh_state);
253 struct tevent_req *req;
254 struct dcerpc_bh_raw_call_state *state;
255 bool ok;
256 struct rpc_request *subreq;
257
258 req = tevent_req_create(mem_ctx, &state,
259 struct dcerpc_bh_raw_call_state);
260 if (req == NULL) {
261 return NULL;
262 }
263 state->ev = ev;
264 state->h = h;
265 state->in_data.data = discard_const_p(uint8_t, in_data);
266 state->in_data.length = in_length;
267
268 ok = dcerpc_bh_is_connected(h);
269 if (!ok) {
270 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
271 return tevent_req_post(req, ev);
272 }
273
274 subreq = dcerpc_request_send(state,
275 hs->p,
276 object,
277 opnum,
278 &state->in_data);
279 if (tevent_req_nomem(subreq, req)) {
280 return tevent_req_post(req, ev);
281 }
282 subreq->async.callback = dcerpc_bh_raw_call_done;
283 subreq->async.private_data = req;
284
285 return req;
286 }
287
288 static void dcerpc_bh_raw_call_done(struct rpc_request *subreq)
289 {
290 struct tevent_req *req =
291 talloc_get_type_abort(subreq->async.private_data,
292 struct tevent_req);
293 struct dcerpc_bh_raw_call_state *state =
294 tevent_req_data(req,
295 struct dcerpc_bh_raw_call_state);
296 NTSTATUS status;
297 uint32_t fault_code;
298
299 state->out_flags = 0;
300 if (subreq->flags & DCERPC_PULL_BIGENDIAN) {
301 state->out_flags |= LIBNDR_FLAG_BIGENDIAN;
302 }
303
304 fault_code = subreq->fault_code;
305
306 status = dcerpc_request_recv(subreq, state, &state->out_data);
307 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
308 status = dcerpc_fault_to_nt_status(fault_code);
309 }
310
311 /*
312 * We trigger the callback in the next event run
313 * because the code in this file might trigger
314 * multiple request callbacks from within a single
315 * while loop.
316 *
317 * In order to avoid segfaults from within
318 * dcerpc_connection_dead() we call
319 * tevent_req_defer_callback().
320 */
321 tevent_req_defer_callback(req, state->ev);
322
323 if (!NT_STATUS_IS_OK(status)) {
324 tevent_req_nterror(req, status);
325 return;
326 }
327
328 tevent_req_done(req);
329 }
330
331 static NTSTATUS dcerpc_bh_raw_call_recv(struct tevent_req *req,
332 TALLOC_CTX *mem_ctx,
333 uint8_t **out_data,
334 size_t *out_length,
335 uint32_t *out_flags)
336 {
337 struct dcerpc_bh_raw_call_state *state =
338 tevent_req_data(req,
339 struct dcerpc_bh_raw_call_state);
340 NTSTATUS status;
341
342 if (tevent_req_is_nterror(req, &status)) {
343 tevent_req_received(req);
344 return status;
345 }
346
347 *out_data = talloc_move(mem_ctx, &state->out_data.data);
348 *out_length = state->out_data.length;
349 *out_flags = state->out_flags;
350 tevent_req_received(req);
351 return NT_STATUS_OK;
352 }
353
354 struct dcerpc_bh_disconnect_state {
355 uint8_t _dummy;
356 };
357
358 static struct tevent_req *dcerpc_bh_disconnect_send(TALLOC_CTX *mem_ctx,
359 struct tevent_context *ev,
360 struct dcerpc_binding_handle *h)
361 {
362 struct dcerpc_bh_state *hs = dcerpc_binding_handle_data(h,
363 struct dcerpc_bh_state);
364 struct tevent_req *req;
365 struct dcerpc_bh_disconnect_state *state;
366 bool ok;
367
368 req = tevent_req_create(mem_ctx, &state,
369 struct dcerpc_bh_disconnect_state);
370 if (req == NULL) {
371 return NULL;
372 }
373
374 ok = dcerpc_bh_is_connected(h);
375 if (!ok) {
376 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
377 return tevent_req_post(req, ev);
378 }
379
380 /* TODO: do a real disconnect ... */
381 hs->p = NULL;
382
383 tevent_req_done(req);
384 return tevent_req_post(req, ev);
385 }
386
387 static NTSTATUS dcerpc_bh_disconnect_recv(struct tevent_req *req)
388 {
389 NTSTATUS status;
390
391 if (tevent_req_is_nterror(req, &status)) {
392 tevent_req_received(req);
393 return status;
394 }
395
396 tevent_req_received(req);
397 return NT_STATUS_OK;
398 }
399
400 static bool dcerpc_bh_push_bigendian(struct dcerpc_binding_handle *h)
401 {
402 struct dcerpc_bh_state *hs = dcerpc_binding_handle_data(h,
403 struct dcerpc_bh_state);
404
405 if (hs->p->conn->flags & DCERPC_PUSH_BIGENDIAN) {
406 return true;
407 }
408
409 return false;
410 }
411
412 static bool dcerpc_bh_ref_alloc(struct dcerpc_binding_handle *h)
413 {
414 struct dcerpc_bh_state *hs = dcerpc_binding_handle_data(h,
415 struct dcerpc_bh_state);
416
417 if (hs->p->conn->flags & DCERPC_NDR_REF_ALLOC) {
418 return true;
419 }
420
421 return false;
422 }
423
424 static bool dcerpc_bh_use_ndr64(struct dcerpc_binding_handle *h)
425 {
426 struct dcerpc_bh_state *hs = dcerpc_binding_handle_data(h,
427 struct dcerpc_bh_state);
428
429 if (hs->p->conn->flags & DCERPC_NDR64) {
430 return true;
431 }
432
433 return false;
434 }
435
436 static void dcerpc_bh_do_ndr_print(struct dcerpc_binding_handle *h,
437 int ndr_flags,
438 const void *_struct_ptr,
439 const struct ndr_interface_call *call)
440 {
441 struct dcerpc_bh_state *hs = dcerpc_binding_handle_data(h,
442 struct dcerpc_bh_state);
443 void *struct_ptr = discard_const(_struct_ptr);
444
445 if (ndr_flags & NDR_IN) {
446 if (hs->p->conn->flags & DCERPC_DEBUG_PRINT_IN) {
447 ndr_print_function_debug(call->ndr_print,
448 call->name,
449 ndr_flags,
450 struct_ptr);
451 }
452 }
453 if (ndr_flags & NDR_OUT) {
454 if (hs->p->conn->flags & DCERPC_DEBUG_PRINT_OUT) {
455 ndr_print_function_debug(call->ndr_print,
456 call->name,
457 ndr_flags,
458 struct_ptr);
459 }
460 }
461 }
462
463 static void dcerpc_bh_ndr_push_failed(struct dcerpc_binding_handle *h,
464 NTSTATUS error,
465 const void *struct_ptr,
466 const struct ndr_interface_call *call)
467 {
468 DEBUG(2,("Unable to ndr_push structure for %s - %s\n",
469 call->name, nt_errstr(error)));
470 }
471
472 static void dcerpc_bh_ndr_pull_failed(struct dcerpc_binding_handle *h,
473 NTSTATUS error,
474 const DATA_BLOB *blob,
475 const struct ndr_interface_call *call)
476 {
477 struct dcerpc_bh_state *hs = dcerpc_binding_handle_data(h,
478 struct dcerpc_bh_state);
479 const uint32_t num_examples = 20;
480 uint32_t i;
481
482 DEBUG(2,("Unable to ndr_pull structure for %s - %s\n",
483 call->name, nt_errstr(error)));
484
485 if (hs->p->conn->packet_log_dir == NULL) return;
486
487 for (i=0;i<num_examples;i++) {
488 char *name=NULL;
489 asprintf(&name, "%s/rpclog/%s-out.%d",
490 hs->p->conn->packet_log_dir,
491 call->name, i);
492 if (name == NULL) {
493 return;
494 }
495 if (!file_exist(name)) {
496 if (file_save(name, blob->data, blob->length)) {
497 DEBUG(10,("Logged rpc packet to %s\n", name));
498 }
499 free(name);
500 break;
501 }
502 free(name);
503 }
504 }
505
506 static NTSTATUS dcerpc_bh_ndr_validate_in(struct dcerpc_binding_handle *h,
507 TALLOC_CTX *mem_ctx,
508 const DATA_BLOB *blob,
509 const struct ndr_interface_call *call)
510 {
511 struct dcerpc_bh_state *hs = dcerpc_binding_handle_data(h,
512 struct dcerpc_bh_state);
513
514 if (hs->p->conn->flags & DCERPC_DEBUG_VALIDATE_IN) {
515 NTSTATUS status;
516
517 status = dcerpc_ndr_validate_in(hs->p->conn,
518 mem_ctx,
519 *blob,
520 call->struct_size,
521 call->ndr_push,
522 call->ndr_pull);
523 if (!NT_STATUS_IS_OK(status)) {
524 DEBUG(0,("Validation [in] failed for %s - %s\n",
525 call->name, nt_errstr(status)));
526 return status;
527 }
528 }
529
530 DEBUG(10,("rpc request data:\n"));
531 dump_data(10, blob->data, blob->length);
532
533 return NT_STATUS_OK;
534 }
535
536 static NTSTATUS dcerpc_bh_ndr_validate_out(struct dcerpc_binding_handle *h,
537 struct ndr_pull *pull_in,
538 const void *_struct_ptr,
539 const struct ndr_interface_call *call)
540 {
541 struct dcerpc_bh_state *hs = dcerpc_binding_handle_data(h,
542 struct dcerpc_bh_state);
543 void *struct_ptr = discard_const(_struct_ptr);
544
545 DEBUG(10,("rpc reply data:\n"));
546 dump_data(10, pull_in->data, pull_in->data_size);
547
548 if (pull_in->offset != pull_in->data_size) {
549 DEBUG(0,("Warning! ignoring %u unread bytes at ofs:%u (0x%08X) for %s!\n",
550 pull_in->data_size - pull_in->offset,
551 pull_in->offset, pull_in->offset,
552 call->name));
553 /* we used to return NT_STATUS_INFO_LENGTH_MISMATCH here,
554 but it turns out that early versions of NT
555 (specifically NT3.1) add junk onto the end of rpc
556 packets, so if we want to interoperate at all with
557 those versions then we need to ignore this error */
558 }
559
560 if (hs->p->conn->flags & DCERPC_DEBUG_VALIDATE_OUT) {
561 NTSTATUS status;
562
563 status = dcerpc_ndr_validate_out(hs->p->conn,
564 pull_in,
565 struct_ptr,
566 call->struct_size,
567 call->ndr_push,
568 call->ndr_pull,
569 call->ndr_print);
570 if (!NT_STATUS_IS_OK(status)) {
571 DEBUG(2,("Validation [out] failed for %s - %s\n",
572 call->name, nt_errstr(status)));
573 return status;
574 }
575 }
576
577 return NT_STATUS_OK;
578 }
579
580 static const struct dcerpc_binding_handle_ops dcerpc_bh_ops = {
581 .name = "dcerpc",
582 .is_connected = dcerpc_bh_is_connected,
583 .set_timeout = dcerpc_bh_set_timeout,
584 .auth_info = dcerpc_bh_auth_info,
585 .raw_call_send = dcerpc_bh_raw_call_send,
586 .raw_call_recv = dcerpc_bh_raw_call_recv,
587 .disconnect_send = dcerpc_bh_disconnect_send,
588 .disconnect_recv = dcerpc_bh_disconnect_recv,
589
590 .push_bigendian = dcerpc_bh_push_bigendian,
591 .ref_alloc = dcerpc_bh_ref_alloc,
592 .use_ndr64 = dcerpc_bh_use_ndr64,
593 .do_ndr_print = dcerpc_bh_do_ndr_print,
594 .ndr_push_failed = dcerpc_bh_ndr_push_failed,
595 .ndr_pull_failed = dcerpc_bh_ndr_pull_failed,
596 .ndr_validate_in = dcerpc_bh_ndr_validate_in,
597 .ndr_validate_out = dcerpc_bh_ndr_validate_out,
598 };
599
600 /* initialise a dcerpc pipe. */
601 struct dcerpc_binding_handle *dcerpc_pipe_binding_handle(struct dcerpc_pipe *p)
602 {
603 struct dcerpc_binding_handle *h;
604 struct dcerpc_bh_state *hs;
605
606 h = dcerpc_binding_handle_create(p,
607 &dcerpc_bh_ops,
608 NULL,
609 NULL, /* TODO */
610 &hs,
611 struct dcerpc_bh_state,
612 __location__);
613 if (h == NULL) {
614 return NULL;
615 }
616 hs->p = p;
617
618 dcerpc_binding_handle_set_sync_ev(h, p->conn->event_ctx);
619
620 return h;
621 }
622
623 /* initialise a dcerpc pipe. */
624 _PUBLIC_ struct dcerpc_pipe *dcerpc_pipe_init(TALLOC_CTX *mem_ctx, struct tevent_context *ev)
625 {
626 struct dcerpc_pipe *p;
627
628 p = talloc_zero(mem_ctx, struct dcerpc_pipe);
629 if (!p) {
630 return NULL;
631 }
632
633 p->conn = dcerpc_connection_init(p, ev);
634 if (p->conn == NULL) {
635 talloc_free(p);
636 return NULL;
637 }
638
639 p->last_fault_code = 0;
640 p->context_id = 0;
641 p->request_timeout = DCERPC_REQUEST_TIMEOUT;
642 p->binding = NULL;
643
644 ZERO_STRUCT(p->syntax);
645 ZERO_STRUCT(p->transfer_syntax);
646
647 if (DEBUGLVL(100)) {
648 p->conn->flags |= DCERPC_DEBUG_PRINT_BOTH;
649 }
650
651 p->binding_handle = dcerpc_pipe_binding_handle(p);
652 if (p->binding_handle == NULL) {
653 talloc_free(p);
654 return NULL;
655 }
656
657 return p;
658 }
659
660
661 /*
662 choose the next call id to use
663 */
664 static uint32_t next_call_id(struct dcecli_connection *c)
665 {
666 c->call_id++;
667 if (c->call_id == 0) {
668 c->call_id++;
669 }
670 return c->call_id;
671 }
672
673 /**
674 setup for a ndr pull, also setting up any flags from the binding string
675 */
676 static struct ndr_pull *ndr_pull_init_flags(struct dcecli_connection *c,
677 DATA_BLOB *blob, TALLOC_CTX *mem_ctx)
678 {
679 struct ndr_pull *ndr = ndr_pull_init_blob(blob, mem_ctx);
680
681 if (ndr == NULL) return ndr;
682
683 if (c->flags & DCERPC_DEBUG_PAD_CHECK) {
684 ndr->flags |= LIBNDR_FLAG_PAD_CHECK;
685 }
686
687 if (c->flags & DCERPC_NDR_REF_ALLOC) {
688 ndr->flags |= LIBNDR_FLAG_REF_ALLOC;
689 }
690
691 if (c->flags & DCERPC_NDR64) {
692 ndr->flags |= LIBNDR_FLAG_NDR64;
693 }
694
695 return ndr;
696 }
697
698 /*
699 parse a data blob into a ncacn_packet structure. This handles both
700 input and output packets
701 */
702 static NTSTATUS ncacn_pull(struct dcecli_connection *c, DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
703 struct ncacn_packet *pkt)
704 {
705 struct ndr_pull *ndr;
706 enum ndr_err_code ndr_err;
707
708 ndr = ndr_pull_init_blob(blob, mem_ctx);
709 if (!ndr) {
710 return NT_STATUS_NO_MEMORY;
711 }
712
713 if (! (CVAL(blob->data, DCERPC_DREP_OFFSET) & DCERPC_DREP_LE)) {
714 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
715 }
716
717 if (CVAL(blob->data, DCERPC_PFC_OFFSET) & DCERPC_PFC_FLAG_OBJECT_UUID) {
718 ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
719 }
720
721 ndr_err = ndr_pull_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
722 TALLOC_FREE(ndr);
723 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
724 return ndr_map_error2ntstatus(ndr_err);
725 }
726
727 if (pkt->frag_length != blob->length) {
728 return NT_STATUS_RPC_PROTOCOL_ERROR;
729 }
730
731 return NT_STATUS_OK;
732 }
733
734 /*
735 parse the authentication information on a dcerpc response packet
736 */
737 static NTSTATUS ncacn_pull_request_auth(struct dcecli_connection *c, TALLOC_CTX *mem_ctx,
738 DATA_BLOB *raw_packet,
739 struct ncacn_packet *pkt)
740 {
741 NTSTATUS status;
742 struct dcerpc_auth auth;
743 uint32_t auth_length;
744
745 if (!c->security_state.auth_info ||
746 !c->security_state.generic_state) {
747 return NT_STATUS_OK;
748 }
749
750 switch (c->security_state.auth_info->auth_level) {
751 case DCERPC_AUTH_LEVEL_PRIVACY:
752 case DCERPC_AUTH_LEVEL_INTEGRITY:
753 break;
754
755 case DCERPC_AUTH_LEVEL_CONNECT:
756 if (pkt->auth_length != 0) {
757 break;
758 }
759 return NT_STATUS_OK;
760 case DCERPC_AUTH_LEVEL_NONE:
761 if (pkt->auth_length != 0) {
762 return NT_STATUS_INVALID_NETWORK_RESPONSE;
763 }
764 return NT_STATUS_OK;
765
766 default:
767 return NT_STATUS_INVALID_LEVEL;
768 }
769
770 status = dcerpc_pull_auth_trailer(pkt, mem_ctx,
771 &pkt->u.response.stub_and_verifier,
772 &auth, &auth_length, false);
773 NT_STATUS_NOT_OK_RETURN(status);
774
775 pkt->u.response.stub_and_verifier.length -= auth_length;
776
777 /* check signature or unseal the packet */
778 switch (c->security_state.auth_info->auth_level) {
779 case DCERPC_AUTH_LEVEL_PRIVACY:
780 status = gensec_unseal_packet(c->security_state.generic_state,
781 raw_packet->data + DCERPC_REQUEST_LENGTH,
782 pkt->u.response.stub_and_verifier.length,
783 raw_packet->data,
784 raw_packet->length - auth.credentials.length,
785 &auth.credentials);
786 memcpy(pkt->u.response.stub_and_verifier.data,
787 raw_packet->data + DCERPC_REQUEST_LENGTH,
788 pkt->u.response.stub_and_verifier.length);
789 break;
790
791 case DCERPC_AUTH_LEVEL_INTEGRITY:
792 status = gensec_check_packet(c->security_state.generic_state,
793 pkt->u.response.stub_and_verifier.data,
794 pkt->u.response.stub_and_verifier.length,
795 raw_packet->data,
796 raw_packet->length - auth.credentials.length,
797 &auth.credentials);
798 break;
799
800 case DCERPC_AUTH_LEVEL_CONNECT:
801 /* for now we ignore possible signatures here */
802 status = NT_STATUS_OK;
803 break;
804
805 default:
806 status = NT_STATUS_INVALID_LEVEL;
807 break;
808 }
809
810 /* remove the indicated amount of padding */
811 if (pkt->u.response.stub_and_verifier.length < auth.auth_pad_length) {
812 return NT_STATUS_INFO_LENGTH_MISMATCH;
813 }
814 pkt->u.response.stub_and_verifier.length -= auth.auth_pad_length;
815
816 return status;
817 }
818
819
820 /*
821 push a dcerpc request packet into a blob, possibly signing it.
822 */
823 static NTSTATUS ncacn_push_request_sign(struct dcecli_connection *c,
824 DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
825 size_t sig_size,
826 struct ncacn_packet *pkt)
827 {
828 NTSTATUS status;
829 struct ndr_push *ndr;
830 DATA_BLOB creds2;
831 size_t payload_length;
832 enum ndr_err_code ndr_err;
833 size_t hdr_size = DCERPC_REQUEST_LENGTH;
834
835 /* non-signed packets are simpler */
836 if (sig_size == 0) {
837 return ncacn_push_auth(blob, mem_ctx, pkt, NULL);
838 }
839
840 switch (c->security_state.auth_info->auth_level) {
841 case DCERPC_AUTH_LEVEL_PRIVACY:
842 case DCERPC_AUTH_LEVEL_INTEGRITY:
843 break;
844
845 case DCERPC_AUTH_LEVEL_CONNECT:
846 /* TODO: let the gensec mech decide if it wants to generate a signature */
847 return ncacn_push_auth(blob, mem_ctx, pkt, NULL);
848
849 case DCERPC_AUTH_LEVEL_NONE:
850 return ncacn_push_auth(blob, mem_ctx, pkt, NULL);
851
852 default:
853 return NT_STATUS_INVALID_LEVEL;
854 }
855
856 ndr = ndr_push_init_ctx(mem_ctx);
857 if (!ndr) {
858 return NT_STATUS_NO_MEMORY;
859 }
860
861 if (c->flags & DCERPC_PUSH_BIGENDIAN) {
862 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
863 }
864
865 if (c->flags & DCERPC_NDR64) {
866 ndr->flags |= LIBNDR_FLAG_NDR64;
867 }
868
869 if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
870 ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
871 hdr_size += 16;
872 }
873
874 ndr_err = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
875 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
876 return ndr_map_error2ntstatus(ndr_err);
877 }
878
879 /* pad to 16 byte multiple in the payload portion of the
880 packet. This matches what w2k3 does. Note that we can't use
881 ndr_push_align() as that is relative to the start of the
882 whole packet, whereas w2k8 wants it relative to the start
883 of the stub */
884 c->security_state.auth_info->auth_pad_length =
885 (16 - (pkt->u.request.stub_and_verifier.length & 15)) & 15;
886 ndr_err = ndr_push_zero(ndr, c->security_state.auth_info->auth_pad_length);
887 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
888 return ndr_map_error2ntstatus(ndr_err);
889 }
890
891 payload_length = pkt->u.request.stub_and_verifier.length +
892 c->security_state.auth_info->auth_pad_length;
893
894 /* we start without signature, it will appended later */
895 c->security_state.auth_info->credentials = data_blob(NULL,0);
896
897 /* add the auth verifier */
898 ndr_err = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, c->security_state.auth_info);
899 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
900 return ndr_map_error2ntstatus(ndr_err);
901 }
902
903 /* extract the whole packet as a blob */
904 *blob = ndr_push_blob(ndr);
905
906 /*
907 * Setup the frag and auth length in the packet buffer.
908 * This is needed if the GENSEC mech does AEAD signing
909 * of the packet headers. The signature itself will be
910 * appended later.
911 */
912 dcerpc_set_frag_length(blob, blob->length + sig_size);
913 dcerpc_set_auth_length(blob, sig_size);
914
915 /* sign or seal the packet */
916 switch (c->security_state.auth_info->auth_level) {
917 case DCERPC_AUTH_LEVEL_PRIVACY:
918 status = gensec_seal_packet(c->security_state.generic_state,
919 mem_ctx,
920 blob->data + hdr_size,
921 payload_length,
922 blob->data,
923 blob->length,
924 &creds2);
925 if (!NT_STATUS_IS_OK(status)) {
926 return status;
927 }
928 break;
929
930 case DCERPC_AUTH_LEVEL_INTEGRITY:
931 status = gensec_sign_packet(c->security_state.generic_state,
932 mem_ctx,
933 blob->data + hdr_size,
934 payload_length,
935 blob->data,
936 blob->length,
937 &creds2);
938 if (!NT_STATUS_IS_OK(status)) {
939 return status;
940 }
941 break;
942
943 default:
944 status = NT_STATUS_INVALID_LEVEL;
945 break;
946 }
947
948 if (creds2.length != sig_size) {
949 /* this means the sig_size estimate for the signature
950 was incorrect. We have to correct the packet
951 sizes. That means we could go over the max fragment
952 length */
953 DEBUG(3,("ncacn_push_request_sign: creds2.length[%u] != sig_size[%u] pad[%u] stub[%u]\n",
954 (unsigned) creds2.length,
955 (unsigned) sig_size,
956 (unsigned) c->security_state.auth_info->auth_pad_length,
957 (unsigned) pkt->u.request.stub_and_verifier.length));
958 dcerpc_set_frag_length(blob, blob->length + creds2.length);
959 dcerpc_set_auth_length(blob, creds2.length);
960 }
961
962 if (!data_blob_append(mem_ctx, blob, creds2.data, creds2.length)) {
963 return NT_STATUS_NO_MEMORY;
964 }
965
966 return NT_STATUS_OK;
967 }
968
969
970 /*
971 fill in the fixed values in a dcerpc header
972 */
973 static void init_ncacn_hdr(struct dcecli_connection *c, struct ncacn_packet *pkt)
974 {
975 pkt->rpc_vers = 5;
976 pkt->rpc_vers_minor = 0;
977 if (c->flags & DCERPC_PUSH_BIGENDIAN) {
978 pkt->drep[0] = 0;
979 } else {
980 pkt->drep[0] = DCERPC_DREP_LE;
981 }
982 pkt->drep[1] = 0;
983 pkt->drep[2] = 0;
984 pkt->drep[3] = 0;
985 }
986
987 /*
988 map a bind nak reason to a NTSTATUS
989 */
990 static NTSTATUS dcerpc_map_reason(uint16_t reason)
991 {
992 switch (reason) {
993 case DCERPC_BIND_REASON_ASYNTAX:
994 return NT_STATUS_RPC_UNSUPPORTED_NAME_SYNTAX;
995 case DCERPC_BIND_REASON_INVALID_AUTH_TYPE:
996 return NT_STATUS_INVALID_PARAMETER;
997 }
998 return NT_STATUS_UNSUCCESSFUL;
999 }
1000
1001 /*
1002 remove requests from the pending or queued queues
1003 */
1004 static int dcerpc_req_dequeue(struct rpc_request *req)
1005 {
1006 switch (req->state) {
1007 case RPC_REQUEST_QUEUED:
1008 DLIST_REMOVE(req->p->conn->request_queue, req);
1009 break;
1010 case RPC_REQUEST_PENDING:
1011 DLIST_REMOVE(req->p->conn->pending, req);
1012 break;
1013 case RPC_REQUEST_DONE:
1014 break;
1015 }
1016 return 0;
1017 }
1018
1019
1020 /*
1021 mark the dcerpc connection dead. All outstanding requests get an error
1022 */
1023 static void dcerpc_connection_dead(struct dcecli_connection *conn, NTSTATUS status)
1024 {
1025 if (conn->dead) return;
1026
1027 conn->dead = true;
1028
1029 TALLOC_FREE(conn->io_trigger);
1030 conn->io_trigger_pending = false;
1031
1032 conn->transport.recv_data = NULL;
1033
1034 dcerpc_shutdown_pipe(conn, status);
1035
1036 /* all pending requests get the error */
1037 while (conn->pending) {
1038 struct rpc_request *req = conn->pending;
1039 dcerpc_req_dequeue(req);
1040 req->state = RPC_REQUEST_DONE;
1041 req->status = status;
1042 if (req->async.callback) {
1043 req->async.callback(req);
1044 }
1045 }
1046
1047 /* all requests, which are not shipped */
1048 while (conn->request_queue) {
1049 struct rpc_request *req = conn->request_queue;
1050 dcerpc_req_dequeue(req);
1051 req->state = RPC_REQUEST_DONE;
1052 req->status = status;
1053 if (req->async.callback) {
1054 req->async.callback(req);
1055 }
1056 }
1057
1058 talloc_set_destructor(conn, NULL);
1059 if (conn->free_skipped) {
1060 talloc_free(conn);
1061 }
1062 }
1063
1064 /*
1065 forward declarations of the recv_data handlers for the types of
1066 packets we need to handle
1067 */
1068 static void dcerpc_request_recv_data(struct dcecli_connection *c,
1069 DATA_BLOB *raw_packet, struct ncacn_packet *pkt);
1070
1071 /*
1072 receive a dcerpc reply from the transport. Here we work out what
1073 type of reply it is (normal request, bind or alter context) and
1074 dispatch to the appropriate handler
1075 */
1076 static void dcerpc_recv_data(struct dcecli_connection *conn, DATA_BLOB *blob, NTSTATUS status)
1077 {
1078 struct ncacn_packet pkt;
1079
1080 if (NT_STATUS_IS_OK(status) && blob->length == 0) {
1081 status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
1082 }
1083
1084 /* the transport may be telling us of a severe error, such as
1085 a dropped socket */
1086 if (!NT_STATUS_IS_OK(status)) {
1087 data_blob_free(blob);
1088 dcerpc_connection_dead(conn, status);
1089 return;
1090 }
1091
1092 /* parse the basic packet to work out what type of response this is */
1093 status = ncacn_pull(conn, blob, blob->data, &pkt);
1094 if (!NT_STATUS_IS_OK(status)) {
1095 data_blob_free(blob);
1096 dcerpc_connection_dead(conn, status);
1097 return;
1098 }
1099
1100 dcerpc_request_recv_data(conn, blob, &pkt);
1101 }
1102
1103 /*
1104 handle timeouts of individual dcerpc requests
1105 */
1106 static void dcerpc_timeout_handler(struct tevent_context *ev, struct tevent_timer *te,
1107 struct timeval t, void *private_data)
1108 {
1109 struct rpc_request *req = talloc_get_type(private_data, struct rpc_request);
1110
1111 if (req->ignore_timeout) {
1112 dcerpc_req_dequeue(req);
1113 req->state = RPC_REQUEST_DONE;
1114 req->status = NT_STATUS_IO_TIMEOUT;
1115 if (req->async.callback) {
1116 req->async.callback(req);
1117 }
1118 return;
1119 }
1120
1121 dcerpc_connection_dead(req->p->conn, NT_STATUS_IO_TIMEOUT);
1122 }
1123
1124 struct dcerpc_bind_state {
1125 struct tevent_context *ev;
1126 struct dcerpc_pipe *p;
1127 };
1128
1129 static void dcerpc_bind_fail_handler(struct rpc_request *subreq);
1130 static void dcerpc_bind_recv_handler(struct rpc_request *subreq,
1131 DATA_BLOB *raw_packet,
1132 struct ncacn_packet *pkt);
1133
1134 struct tevent_req *dcerpc_bind_send(TALLOC_CTX *mem_ctx,
1135 struct tevent_context *ev,
1136 struct dcerpc_pipe *p,
1137 const struct ndr_syntax_id *syntax,
1138 const struct ndr_syntax_id *transfer_syntax)
1139 {
1140 struct tevent_req *req;
1141 struct dcerpc_bind_state *state;
1142 struct ncacn_packet pkt;
1143 DATA_BLOB blob;
1144 NTSTATUS status;
1145 struct rpc_request *subreq;
1146
1147 req = tevent_req_create(mem_ctx, &state,
1148 struct dcerpc_bind_state);
1149 if (req == NULL) {
1150 return NULL;
1151 }
1152
1153 state->ev = ev;
1154 state->p = p;
1155
1156 p->syntax = *syntax;
1157 p->transfer_syntax = *transfer_syntax;
1158
1159 init_ncacn_hdr(p->conn, &pkt);
1160
1161 pkt.ptype = DCERPC_PKT_BIND;
1162 pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
1163 pkt.call_id = p->conn->call_id;
1164 pkt.auth_length = 0;
1165
1166 if (p->binding->flags & DCERPC_CONCURRENT_MULTIPLEX) {
1167 pkt.pfc_flags |= DCERPC_PFC_FLAG_CONC_MPX;
1168 }
1169
1170 if (p->conn->flags & DCERPC_PROPOSE_HEADER_SIGNING) {
1171 pkt.pfc_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
1172 }
1173
1174 pkt.u.bind.max_xmit_frag = p->conn->srv_max_xmit_frag;
1175 pkt.u.bind.max_recv_frag = p->conn->srv_max_recv_frag;
1176 pkt.u.bind.assoc_group_id = p->binding->assoc_group_id;
1177 pkt.u.bind.num_contexts = 1;
1178 pkt.u.bind.ctx_list = talloc_array(mem_ctx, struct dcerpc_ctx_list, 1);
1179 if (tevent_req_nomem(pkt.u.bind.ctx_list, req)) {
1180 return tevent_req_post(req, ev);
1181 }
1182 pkt.u.bind.ctx_list[0].context_id = p->context_id;
1183 pkt.u.bind.ctx_list[0].num_transfer_syntaxes = 1;
1184 pkt.u.bind.ctx_list[0].abstract_syntax = p->syntax;
1185 pkt.u.bind.ctx_list[0].transfer_syntaxes = &p->transfer_syntax;
1186 pkt.u.bind.auth_info = data_blob(NULL, 0);
1187
1188 /* construct the NDR form of the packet */
1189 status = ncacn_push_auth(&blob, state, &pkt,
1190 p->conn->security_state.auth_info);
1191 if (tevent_req_nterror(req, status)) {
1192 return tevent_req_post(req, ev);
1193 }
1194
1195 p->conn->transport.recv_data = dcerpc_recv_data;
1196
1197 /*
1198 * we allocate a dcerpc_request so we can be in the same
1199 * request queue as normal requests
1200 */
1201 subreq = talloc_zero(state, struct rpc_request);
1202 if (tevent_req_nomem(subreq, req)) {
1203 return tevent_req_post(req, ev);
1204 }
1205
1206 subreq->state = RPC_REQUEST_PENDING;
1207 subreq->call_id = pkt.call_id;
1208 subreq->async.private_data = req;
1209 subreq->async.callback = dcerpc_bind_fail_handler;
1210 subreq->p = p;
1211 subreq->recv_handler = dcerpc_bind_recv_handler;
1212 DLIST_ADD_END(p->conn->pending, subreq, struct rpc_request *);
1213 talloc_set_destructor(subreq, dcerpc_req_dequeue);
1214
1215 status = dcerpc_send_request(p->conn, &blob, true);
1216 if (tevent_req_nterror(req, status)) {
1217 return tevent_req_post(req, ev);
1218 }
1219
1220 tevent_add_timer(ev, subreq,
1221 timeval_current_ofs(DCERPC_REQUEST_TIMEOUT, 0),
1222 dcerpc_timeout_handler, subreq);
1223
1224 return req;
1225 }
1226
1227 static void dcerpc_bind_fail_handler(struct rpc_request *subreq)
1228 {
1229 struct tevent_req *req =
1230 talloc_get_type_abort(subreq->async.private_data,
1231 struct tevent_req);
1232 struct dcerpc_bind_state *state =
1233 tevent_req_data(req,
1234 struct dcerpc_bind_state);
1235 NTSTATUS status = subreq->status;
1236
1237 TALLOC_FREE(subreq);
1238
1239 /*
1240 * We trigger the callback in the next event run
1241 * because the code in this file might trigger
1242 * multiple request callbacks from within a single
1243 * while loop.
1244 *
1245 * In order to avoid segfaults from within
1246 * dcerpc_connection_dead() we call
1247 * tevent_req_defer_callback().
1248 */
1249 tevent_req_defer_callback(req, state->ev);
1250
1251 tevent_req_nterror(req, status);
1252 }
1253
1254 static void dcerpc_bind_recv_handler(struct rpc_request *subreq,
1255 DATA_BLOB *raw_packet,
1256 struct ncacn_packet *pkt)
1257 {
1258 struct tevent_req *req =
1259 talloc_get_type_abort(subreq->async.private_data,
1260 struct tevent_req);
1261 struct dcerpc_bind_state *state =
1262 tevent_req_data(req,
1263 struct dcerpc_bind_state);
1264 struct dcecli_connection *conn = state->p->conn;
1265 NTSTATUS status;
1266
1267 /*
1268 * Note that pkt is allocated under raw_packet->data,
1269 * while raw_packet->data is a child of subreq.
1270 */
1271 talloc_steal(state, raw_packet->data);
1272 TALLOC_FREE(subreq);
1273
1274 /*
1275 * We trigger the callback in the next event run
1276 * because the code in this file might trigger
1277 * multiple request callbacks from within a single
1278 * while loop.
1279 *
1280 * In order to avoid segfaults from within
1281 * dcerpc_connection_dead() we call
1282 * tevent_req_defer_callback().
1283 */
1284 tevent_req_defer_callback(req, state->ev);
1285
1286 if (pkt->ptype == DCERPC_PKT_BIND_NAK) {
1287 status = dcerpc_map_reason(pkt->u.bind_nak.reject_reason);
1288
1289 DEBUG(2,("dcerpc: bind_nak reason %d - %s\n",
1290 pkt->u.bind_nak.reject_reason, nt_errstr(status)));
1291
1292 tevent_req_nterror(req, status);
1293 return;
1294 }
1295
1296 if ((pkt->ptype != DCERPC_PKT_BIND_ACK) ||
1297 (pkt->u.bind_ack.num_results == 0) ||
1298 (pkt->u.bind_ack.ctx_list[0].result != 0)) {
1299 state->p->last_fault_code = DCERPC_NCA_S_PROTO_ERROR;
1300 tevent_req_nterror(req, NT_STATUS_NET_WRITE_FAULT);
1301 return;
1302 }
1303
1304 /*
1305 * DCE-RPC 1.1 (c706) specifies
1306 * CONST_MUST_RCV_FRAG_SIZE as 1432
1307 */
1308 if (pkt->u.bind_ack.max_xmit_frag < 1432) {
1309 state->p->last_fault_code = DCERPC_NCA_S_PROTO_ERROR;
1310 tevent_req_nterror(req, NT_STATUS_NET_WRITE_FAULT);
1311 return;
1312 }
1313 if (pkt->u.bind_ack.max_recv_frag < 1432) {
1314 state->p->last_fault_code = DCERPC_NCA_S_PROTO_ERROR;
1315 tevent_req_nterror(req, NT_STATUS_NET_WRITE_FAULT);
1316 return;
1317 }
1318 conn->srv_max_xmit_frag = MIN(conn->srv_max_xmit_frag,
1319 pkt->u.bind_ack.max_xmit_frag);
1320 conn->srv_max_recv_frag = MIN(conn->srv_max_recv_frag,
1321 pkt->u.bind_ack.max_recv_frag);
1322
1323 if ((state->p->binding->flags & DCERPC_CONCURRENT_MULTIPLEX) &&
1324 (pkt->pfc_flags & DCERPC_PFC_FLAG_CONC_MPX)) {
1325 conn->flags |= DCERPC_CONCURRENT_MULTIPLEX;
1326 }
1327
1328 if ((conn->flags & DCERPC_PROPOSE_HEADER_SIGNING) &&
1329 (pkt->pfc_flags & DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN)) {
1330 conn->flags |= DCERPC_HEADER_SIGNING;
1331 }
1332
1333 /* the bind_ack might contain a reply set of credentials */
1334 if (conn->security_state.auth_info && pkt->u.bind_ack.auth_info.length) {
1335 uint32_t auth_length;
1336
1337 status = dcerpc_pull_auth_trailer(pkt, conn, &pkt->u.bind_ack.auth_info,
1338 conn->security_state.auth_info, &auth_length, true);
1339 if (tevent_req_nterror(req, status)) {
1340 return;
1341 }
1342 }
1343
1344 state->p->assoc_group_id = pkt->u.bind_ack.assoc_group_id;
1345
1346 tevent_req_done(req);
1347 }
1348
1349 NTSTATUS dcerpc_bind_recv(struct tevent_req *req)
1350 {
1351 return tevent_req_simple_recv_ntstatus(req);
1352 }
1353
1354 /*
1355 perform a continued bind (and auth3)
1356 */
1357 NTSTATUS dcerpc_auth3(struct dcerpc_pipe *p,
1358 TALLOC_CTX *mem_ctx)
1359 {
1360 struct ncacn_packet pkt;
1361 NTSTATUS status;
1362 DATA_BLOB blob;
1363
1364 init_ncacn_hdr(p->conn, &pkt);
1365
1366 pkt.ptype = DCERPC_PKT_AUTH3;
1367 pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
1368 pkt.call_id = next_call_id(p->conn);
1369 pkt.auth_length = 0;
1370 pkt.u.auth3.auth_info = data_blob(NULL, 0);
1371
1372 if (p->binding->flags & DCERPC_CONCURRENT_MULTIPLEX) {
1373 pkt.pfc_flags |= DCERPC_PFC_FLAG_CONC_MPX;
1374 }
1375
1376 /* construct the NDR form of the packet */
1377 status = ncacn_push_auth(&blob, mem_ctx,
1378 &pkt,
1379 p->conn->security_state.auth_info);
1380 if (!NT_STATUS_IS_OK(status)) {
1381 return status;
1382 }
1383
1384 /* send it on its way */
1385 status = dcerpc_send_request(p->conn, &blob, false);
1386 if (!NT_STATUS_IS_OK(status)) {
1387 return status;
1388 }
1389
1390 return NT_STATUS_OK;
1391 }
1392
1393
1394 /*
1395 process a fragment received from the transport layer during a
1396 request
1397
1398 This function frees the data
1399 */
1400 static void dcerpc_request_recv_data(struct dcecli_connection *c,
1401 DATA_BLOB *raw_packet, struct ncacn_packet *pkt)
1402 {
1403 struct rpc_request *req;
1404 unsigned int length;
1405 NTSTATUS status = NT_STATUS_OK;
1406
1407 /*
1408 if this is an authenticated connection then parse and check
1409 the auth info. We have to do this before finding the
1410 matching packet, as the request structure might have been
1411 removed due to a timeout, but if it has been we still need
1412 to run the auth routines so that we don't get the sign/seal
1413 info out of step with the server
1414 */
1415 if (c->security_state.auth_info && c->security_state.generic_state &&
1416 pkt->ptype == DCERPC_PKT_RESPONSE) {
1417 status = ncacn_pull_request_auth(c, raw_packet->data, raw_packet, pkt);
1418 }
1419
1420 /* find the matching request */
1421 for (req=c->pending;req;req=req->next) {
1422 if (pkt->call_id == req->call_id) break;
1423 }
1424
1425 #if 0
1426 /* useful for testing certain vendors RPC servers */
1427 if (req == NULL && c->pending && pkt->call_id == 0) {
1428 DEBUG(0,("HACK FOR INCORRECT CALL ID\n"));
1429 req = c->pending;
1430 }
1431 #endif
1432
1433 if (req == NULL) {
1434 DEBUG(2,("dcerpc_request: unmatched call_id %u in response packet\n", pkt->call_id));
1435 data_blob_free(raw_packet);
1436 return;
1437 }
1438
1439 talloc_steal(req, raw_packet->data);
1440
1441 if (req->recv_handler != NULL) {
1442 dcerpc_req_dequeue(req);
1443 req->state = RPC_REQUEST_DONE;
1444
1445 /*
1446 * We have to look at shipping further requests before calling
1447 * the async function, that one might close the pipe
1448 */
1449 dcerpc_schedule_io_trigger(c);
1450
1451 req->recv_handler(req, raw_packet, pkt);
1452 return;
1453 }
1454
1455 if (pkt->ptype == DCERPC_PKT_FAULT) {
1456 DEBUG(5,("rpc fault: %s\n", dcerpc_errstr(c, pkt->u.fault.status)));
1457 req->fault_code = pkt->u.fault.status;
1458 req->status = NT_STATUS_NET_WRITE_FAULT;
1459 goto req_done;
1460 }
1461
1462 if (pkt->ptype != DCERPC_PKT_RESPONSE) {
1463 DEBUG(2,("Unexpected packet type %d in dcerpc response\n",
1464 (int)pkt->ptype));
1465 req->fault_code = DCERPC_FAULT_OTHER;
1466 req->status = NT_STATUS_NET_WRITE_FAULT;
1467 goto req_done;
1468 }
1469
1470 /* now check the status from the auth routines, and if it failed then fail
1471 this request accordingly */
1472 if (!NT_STATUS_IS_OK(status)) {
1473 req->status = status;
1474 goto req_done;
1475 }
1476
1477 length = pkt->u.response.stub_and_verifier.length;
1478
1479 if (length > 0) {
1480 req->payload.data = talloc_realloc(req,
1481 req->payload.data,
1482 uint8_t,
1483 req->payload.length + length);
1484 if (!req->payload.data) {
1485 req->status = NT_STATUS_NO_MEMORY;
1486 goto req_done;
1487 }
1488 memcpy(req->payload.data+req->payload.length,
1489 pkt->u.response.stub_and_verifier.data, length);
1490 req->payload.length += length;
1491 }
1492
1493 if (!(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
1494 data_blob_free(raw_packet);
1495 dcerpc_send_read(c);
1496 return;
1497 }
1498
1499 if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
1500 req->flags |= DCERPC_PULL_BIGENDIAN;
1501 } else {
1502 req->flags &= ~DCERPC_PULL_BIGENDIAN;
1503 }
1504
1505 req_done:
1506 data_blob_free(raw_packet);
1507
1508 /* we've got the full payload */
1509 dcerpc_req_dequeue(req);
1510 req->state = RPC_REQUEST_DONE;
1511
1512 /*
1513 * We have to look at shipping further requests before calling
1514 * the async function, that one might close the pipe
1515 */
1516 dcerpc_schedule_io_trigger(c);
1517
1518 if (req->async.callback) {
1519 req->async.callback(req);
1520 }
1521 }
1522
1523 /*
1524 perform the send side of a async dcerpc request
1525 */
1526 static struct rpc_request *dcerpc_request_send(TALLOC_CTX *mem_ctx,
1527 struct dcerpc_pipe *p,
1528 const struct GUID *object,
1529 uint16_t opnum,
1530 DATA_BLOB *stub_data)
1531 {
1532 struct rpc_request *req;
1533
1534 p->conn->transport.recv_data = dcerpc_recv_data;
1535
1536 req = talloc_zero(mem_ctx, struct rpc_request);
1537 if (req == NULL) {
1538 return NULL;
1539 }
1540
1541 req->p = p;
1542 req->call_id = next_call_id(p->conn);
1543 req->state = RPC_REQUEST_QUEUED;
1544
1545 if (object != NULL) {
1546 req->object = (struct GUID *)talloc_memdup(req, (const void *)object, sizeof(*object));
1547 if (req->object == NULL) {
1548 talloc_free(req);
1549 return NULL;
1550 }
1551 }
1552
1553 req->opnum = opnum;
1554 req->request_data.length = stub_data->length;
1555 req->request_data.data = stub_data->data;
1556
1557 DLIST_ADD_END(p->conn->request_queue, req, struct rpc_request *);
1558 talloc_set_destructor(req, dcerpc_req_dequeue);
1559
1560 dcerpc_schedule_io_trigger(p->conn);
1561
1562 if (p->request_timeout) {
1563 tevent_add_timer(dcerpc_event_context(p), req,
1564 timeval_current_ofs(p->request_timeout, 0),
1565 dcerpc_timeout_handler, req);
1566 }
1567
1568 return req;
1569 }
1570
1571 /*
1572 Send a request using the transport
1573 */
1574
1575 static void dcerpc_ship_next_request(struct dcecli_connection *c)
1576 {
1577 struct rpc_request *req;
1578 struct dcerpc_pipe *p;
1579 DATA_BLOB *stub_data;
1580 struct ncacn_packet pkt;
1581 DATA_BLOB blob;
1582 uint32_t remaining, chunk_size;
1583 bool first_packet = true;
1584 size_t sig_size = 0;
1585 bool need_async = false;
1586 bool can_async = true;
1587
1588 req = c->request_queue;
1589 if (req == NULL) {
1590 return;
1591 }
1592
1593 p = req->p;
1594 stub_data = &req->request_data;
1595
1596 if (c->pending) {
1597 need_async = true;
1598 }
1599
1600 if (c->security_state.auth_info &&
1601 c->security_state.generic_state)
1602 {
1603 struct gensec_security *gensec = c->security_state.generic_state;
1604
1605 switch (c->security_state.auth_info->auth_level) {
1606 case DCERPC_AUTH_LEVEL_PRIVACY:
1607 case DCERPC_AUTH_LEVEL_INTEGRITY:
1608 can_async = gensec_have_feature(gensec,
1609 GENSEC_FEATURE_ASYNC_REPLIES);
1610 break;
1611 case DCERPC_AUTH_LEVEL_CONNECT:
1612 case DCERPC_AUTH_LEVEL_NONE:
1613 can_async = true;
1614 break;
1615 default:
1616 can_async = false;
1617 break;
1618 }
1619 }
1620
1621 if (need_async && !can_async) {
1622 req->wait_for_sync = true;
1623 return;
1624 }
1625
1626 DLIST_REMOVE(c->request_queue, req);
1627 DLIST_ADD(c->pending, req);
1628 req->state = RPC_REQUEST_PENDING;
1629
1630 init_ncacn_hdr(p->conn, &pkt);
1631
1632 remaining = stub_data->length;
1633
1634 /* we can write a full max_recv_frag size, minus the dcerpc
1635 request header size */
1636 chunk_size = p->conn->srv_max_recv_frag;
1637 chunk_size -= DCERPC_REQUEST_LENGTH;
1638 if (c->security_state.auth_info &&
1639 c->security_state.generic_state) {
1640 sig_size = gensec_sig_size(c->security_state.generic_state,
1641 p->conn->srv_max_recv_frag);
1642 if (sig_size) {
1643 chunk_size -= DCERPC_AUTH_TRAILER_LENGTH;
1644 chunk_size -= sig_size;
1645 }
1646 }
1647 chunk_size -= (chunk_size % 16);
1648
1649 pkt.ptype = DCERPC_PKT_REQUEST;
1650 pkt.call_id = req->call_id;
1651 pkt.auth_length = 0;
1652 pkt.pfc_flags = 0;
1653 pkt.u.request.context_id = p->context_id;
1654 pkt.u.request.opnum = req->opnum;
1655
1656 if (req->object) {
1657 pkt.u.request.object.object = *req->object;
1658 pkt.pfc_flags |= DCERPC_PFC_FLAG_OBJECT_UUID;
1659 chunk_size -= ndr_size_GUID(req->object,0);
1660 }
1661
1662 /* we send a series of pdus without waiting for a reply */
1663 while (remaining > 0 || first_packet) {
1664 uint32_t chunk = MIN(chunk_size, remaining);
1665 bool last_frag = false;
1666 bool do_trans = false;
1667
1668 first_packet = false;
1669 pkt.pfc_flags &= ~(DCERPC_PFC_FLAG_FIRST |DCERPC_PFC_FLAG_LAST);
1670
1671 if (remaining == stub_data->length) {
1672 pkt.pfc_flags |= DCERPC_PFC_FLAG_FIRST;
1673 }
1674 if (chunk == remaining) {
1675 pkt.pfc_flags |= DCERPC_PFC_FLAG_LAST;
1676 last_frag = true;
1677 }
1678
1679 pkt.u.request.alloc_hint = remaining;
1680 pkt.u.request.stub_and_verifier.data = stub_data->data +
1681 (stub_data->length - remaining);
1682 pkt.u.request.stub_and_verifier.length = chunk;
1683
1684 req->status = ncacn_push_request_sign(p->conn, &blob, req, sig_size, &pkt);
1685 if (!NT_STATUS_IS_OK(req->status)) {
1686 req->state = RPC_REQUEST_DONE;
1687 DLIST_REMOVE(p->conn->pending, req);
1688 return;
1689 }
1690
1691 if (last_frag && !need_async) {
1692 do_trans = true;
1693 }
1694
1695 req->status = dcerpc_send_request(p->conn, &blob, do_trans);
1696 if (!NT_STATUS_IS_OK(req->status)) {
1697 req->state = RPC_REQUEST_DONE;
1698 DLIST_REMOVE(p->conn->pending, req);
1699 return;
1700 }
1701
1702 if (last_frag && !do_trans) {
1703 req->status = dcerpc_send_read(p->conn);
1704 if (!NT_STATUS_IS_OK(req->status)) {
1705 req->state = RPC_REQUEST_DONE;
1706 DLIST_REMOVE(p->conn->pending, req);
1707 return;
1708 }
1709 }
1710
1711 remaining -= chunk;
1712 }
1713 }
1714
1715 static void dcerpc_io_trigger(struct tevent_context *ctx,
1716 struct tevent_immediate *im,
1717 void *private_data)
1718 {
1719 struct dcecli_connection *c =
1720 talloc_get_type_abort(private_data,
1721 struct dcecli_connection);
1722
1723 c->io_trigger_pending = false;
1724
1725 dcerpc_schedule_io_trigger(c);
1726
1727 dcerpc_ship_next_request(c);
1728 }
1729
1730 static void dcerpc_schedule_io_trigger(struct dcecli_connection *c)
1731 {
1732 if (c->dead) {
1733 return;
1734 }
1735
1736 if (c->request_queue == NULL) {
1737 return;
1738 }
1739
1740 if (c->request_queue->wait_for_sync && c->pending) {
1741 return;
1742 }
1743
1744 if (c->io_trigger_pending) {
1745 return;
1746 }
1747
1748 c->io_trigger_pending = true;
1749
1750 tevent_schedule_immediate(c->io_trigger,
1751 c->event_ctx,
1752 dcerpc_io_trigger,
1753 c);
1754 }
1755
1756 /*
1757 return the event context for a dcerpc pipe
1758 used by callers who wish to operate asynchronously
1759 */
1760 _PUBLIC_ struct tevent_context *dcerpc_event_context(struct dcerpc_pipe *p)
1761 {
1762 return p->conn->event_ctx;
1763 }
1764
1765
1766
1767 /*
1768 perform the receive side of a async dcerpc request
1769 */
1770 static NTSTATUS dcerpc_request_recv(struct rpc_request *req,
1771 TALLOC_CTX *mem_ctx,
1772 DATA_BLOB *stub_data)
1773 {
1774 NTSTATUS status;
1775
1776 while (req->state != RPC_REQUEST_DONE) {
1777 struct tevent_context *ctx = dcerpc_event_context(req->p);
1778 if (tevent_loop_once(ctx) != 0) {
1779 return NT_STATUS_CONNECTION_DISCONNECTED;
1780 }
1781 }
1782 *stub_data = req->payload;
1783 status = req->status;
1784 if (stub_data->data) {
1785 stub_data->data = talloc_steal(mem_ctx, stub_data->data);
1786 }
1787 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
1788 req->p->last_fault_code = req->fault_code;
1789 }
1790 talloc_unlink(talloc_parent(req), req);
1791 return status;
1792 }
1793
1794 /*
1795 this is a paranoid NDR validator. For every packet we push onto the wire
1796 we pull it back again, then push it again. Then we compare the raw NDR data
1797 for that to the NDR we initially generated. If they don't match then we know
1798 we must have a bug in either the pull or push side of our code
1799 */
1800 static NTSTATUS dcerpc_ndr_validate_in(struct dcecli_connection *c,
1801 TALLOC_CTX *mem_ctx,
1802 DATA_BLOB blob,
1803 size_t struct_size,
1804 ndr_push_flags_fn_t ndr_push,
1805 ndr_pull_flags_fn_t ndr_pull)
1806 {
1807 void *st;
1808 struct ndr_pull *pull;
1809 struct ndr_push *push;
1810 DATA_BLOB blob2;
1811 enum ndr_err_code ndr_err;
1812
1813 st = talloc_size(mem_ctx, struct_size);
1814 if (!st) {
1815 return NT_STATUS_NO_MEMORY;
1816 }
1817
1818 pull = ndr_pull_init_flags(c, &blob, mem_ctx);
1819 if (!pull) {
1820 return NT_STATUS_NO_MEMORY;
1821 }
1822 pull->flags |= LIBNDR_FLAG_REF_ALLOC;
1823
1824 if (c->flags & DCERPC_PUSH_BIGENDIAN) {
1825 pull->flags |= LIBNDR_FLAG_BIGENDIAN;
1826 }
1827
1828 if (c->flags & DCERPC_NDR64) {
1829 pull->flags |= LIBNDR_FLAG_NDR64;
1830 }
1831
1832 ndr_err = ndr_pull(pull, NDR_IN, st);
1833 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1834 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1835 ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
1836 "failed input validation pull - %s",
1837 nt_errstr(status));
1838 return ndr_map_error2ntstatus(ndr_err);
1839 }
1840
1841 push = ndr_push_init_ctx(mem_ctx);
1842 if (!push) {
1843 return NT_STATUS_NO_MEMORY;
1844 }
1845
1846 if (c->flags & DCERPC_PUSH_BIGENDIAN) {
1847 push->flags |= LIBNDR_FLAG_BIGENDIAN;
1848 }
1849
1850 if (c->flags & DCERPC_NDR64) {
1851 push->flags |= LIBNDR_FLAG_NDR64;
1852 }
1853
1854 ndr_err = ndr_push(push, NDR_IN, st);
1855 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1856 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1857 ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
1858 "failed input validation push - %s",
1859 nt_errstr(status));
1860 return ndr_map_error2ntstatus(ndr_err);
1861 }
1862
1863 blob2 = ndr_push_blob(push);
1864
1865 if (data_blob_cmp(&blob, &blob2) != 0) {
1866 DEBUG(3,("original:\n"));
1867 dump_data(3, blob.data, blob.length);
1868 DEBUG(3,("secondary:\n"));
1869 dump_data(3, blob2.data, blob2.length);
1870 ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
1871 "failed input validation blobs doesn't match");
1872 return ndr_map_error2ntstatus(ndr_err);
1873 }
1874
1875 return NT_STATUS_OK;
1876 }
1877
1878 /*
1879 this is a paranoid NDR input validator. For every packet we pull
1880 from the wire we push it back again then pull and push it
1881 again. Then we compare the raw NDR data for that to the NDR we
1882 initially generated. If they don't match then we know we must have a
1883 bug in either the pull or push side of our code
1884 */
1885 static NTSTATUS dcerpc_ndr_validate_out(struct dcecli_connection *c,
1886 struct ndr_pull *pull_in,
1887 void *struct_ptr,
1888 size_t struct_size,
1889 ndr_push_flags_fn_t ndr_push,
1890 ndr_pull_flags_fn_t ndr_pull,
1891 ndr_print_function_t ndr_print)
1892 {
1893 void *st;
1894 struct ndr_pull *pull;
1895 struct ndr_push *push;
1896 DATA_BLOB blob, blob2;
1897 TALLOC_CTX *mem_ctx = pull_in;
1898 char *s1, *s2;
1899 enum ndr_err_code ndr_err;
1900
1901 st = talloc_size(mem_ctx, struct_size);
1902 if (!st) {
1903 return NT_STATUS_NO_MEMORY;
1904 }
1905 memcpy(st, struct_ptr, struct_size);
1906
1907 push = ndr_push_init_ctx(mem_ctx);
1908 if (!push) {
1909 return NT_STATUS_NO_MEMORY;
1910 }
1911
1912 ndr_err = ndr_push(push, NDR_OUT, struct_ptr);
1913 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1914 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1915 ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
1916 "failed output validation push - %s",
1917 nt_errstr(status));
1918 return ndr_map_error2ntstatus(ndr_err);
1919 }
1920
1921 blob = ndr_push_blob(push);
1922
1923 pull = ndr_pull_init_flags(c, &blob, mem_ctx);
1924 if (!pull) {
1925 return NT_STATUS_NO_MEMORY;
1926 }
1927
1928 pull->flags |= LIBNDR_FLAG_REF_ALLOC;
1929 ndr_err = ndr_pull(pull, NDR_OUT, st);
1930 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1931 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1932 ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
1933 "failed output validation pull - %s",
1934 nt_errstr(status));
1935 return ndr_map_error2ntstatus(ndr_err);
1936 }
1937
1938 push = ndr_push_init_ctx(mem_ctx);
1939 if (!push) {
1940 return NT_STATUS_NO_MEMORY;
1941 }
1942
1943 ndr_err = ndr_push(push, NDR_OUT, st);
1944 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1945 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1946 ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
1947 "failed output validation push2 - %s",
1948 nt_errstr(status));
1949 return ndr_map_error2ntstatus(ndr_err);
1950 }
1951
1952 blob2 = ndr_push_blob(push);
1953
1954 if (data_blob_cmp(&blob, &blob2) != 0) {
1955 DEBUG(3,("original:\n"));
1956 dump_data(3, blob.data, blob.length);
1957 DEBUG(3,("secondary:\n"));
1958 dump_data(3, blob2.data, blob2.length);
1959 ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
1960 "failed output validation blobs doesn't match");
1961 return ndr_map_error2ntstatus(ndr_err);
1962 }
1963
1964 /* this checks the printed forms of the two structures, which effectively
1965 tests all of the value() attributes */
1966 s1 = ndr_print_function_string(mem_ctx, ndr_print, "VALIDATE",
1967 NDR_OUT, struct_ptr);
1968 s2 = ndr_print_function_string(mem_ctx, ndr_print, "VALIDATE",
1969 NDR_OUT, st);
1970 if (strcmp(s1, s2) != 0) {
1971 #if 1
1972 DEBUG(3,("VALIDATE ERROR:\nWIRE:\n%s\n GEN:\n%s\n", s1, s2));
1973 #else
1974 /* this is sometimes useful */
1975 printf("VALIDATE ERROR\n");
1976 file_save("wire.dat", s1, strlen(s1));
1977 file_save("gen.dat", s2, strlen(s2));
1978 system("diff -u wire.dat gen.dat");
1979 #endif
1980 ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
1981 "failed output validation strings doesn't match");
1982 return ndr_map_error2ntstatus(ndr_err);
1983 }
1984
1985 return NT_STATUS_OK;
1986 }
1987
1988 /*
1989 a useful function for retrieving the server name we connected to
1990 */
1991 _PUBLIC_ const char *dcerpc_server_name(struct dcerpc_pipe *p)
1992 {
1993 return p->conn ? p->conn->server_name : NULL;
1994 }
1995
1996
1997 /*
1998 get the dcerpc auth_level for a open connection
1999 */
2000 uint32_t dcerpc_auth_level(struct dcecli_connection *c)
2001 {
2002 uint8_t auth_level;
2003
2004 if (c->flags & DCERPC_SEAL) {
2005 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
2006 } else if (c->flags & DCERPC_SIGN) {
2007 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
2008 } else if (c->flags & DCERPC_CONNECT) {
2009 auth_level = DCERPC_AUTH_LEVEL_CONNECT;
2010 } else {
2011 auth_level = DCERPC_AUTH_LEVEL_NONE;
2012 }
2013 return auth_level;
2014 }
2015
2016 struct dcerpc_alter_context_state {
2017 struct tevent_context *ev;
2018 struct dcerpc_pipe *p;
2019 };
2020
2021 static void dcerpc_alter_context_fail_handler(struct rpc_request *subreq);
2022 static void dcerpc_alter_context_recv_handler(struct rpc_request *req,
2023 DATA_BLOB *raw_packet,
2024 struct ncacn_packet *pkt);
2025
2026 struct tevent_req *dcerpc_alter_context_send(TALLOC_CTX *mem_ctx,
2027 struct tevent_context *ev,
2028 struct dcerpc_pipe *p,
2029 const struct ndr_syntax_id *syntax,
2030 const struct ndr_syntax_id *transfer_syntax)
2031 {
2032 struct tevent_req *req;
2033 struct dcerpc_alter_context_state *state;
2034 struct ncacn_packet pkt;
2035 DATA_BLOB blob;
2036 NTSTATUS status;
2037 struct rpc_request *subreq;
2038
2039 req = tevent_req_create(mem_ctx, &state,
2040 struct dcerpc_alter_context_state);
2041 if (req == NULL) {
2042 return NULL;
2043 }
2044
2045 state->ev = ev;
2046 state->p = p;
2047
2048 p->syntax = *syntax;
2049 p->transfer_syntax = *transfer_syntax;
2050
2051 init_ncacn_hdr(p->conn, &pkt);
2052
2053 pkt.ptype = DCERPC_PKT_ALTER;
2054 pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
2055 pkt.call_id = p->conn->call_id;
2056 pkt.auth_length = 0;
2057
2058 if (p->binding->flags & DCERPC_CONCURRENT_MULTIPLEX) {
2059 pkt.pfc_flags |= DCERPC_PFC_FLAG_CONC_MPX;
2060 }
2061
2062 pkt.u.alter.max_xmit_frag = p->conn->srv_max_xmit_frag;
2063 pkt.u.alter.max_recv_frag = p->conn->srv_max_recv_frag;
2064 pkt.u.alter.assoc_group_id = p->binding->assoc_group_id;
2065 pkt.u.alter.num_contexts = 1;
2066 pkt.u.alter.ctx_list = talloc_array(state, struct dcerpc_ctx_list, 1);
2067 if (tevent_req_nomem(pkt.u.alter.ctx_list, req)) {
2068 return tevent_req_post(req, ev);
2069 }
2070 pkt.u.alter.ctx_list[0].context_id = p->context_id;
2071 pkt.u.alter.ctx_list[0].num_transfer_syntaxes = 1;
2072 pkt.u.alter.ctx_list[0].abstract_syntax = p->syntax;
2073 pkt.u.alter.ctx_list[0].transfer_syntaxes = &p->transfer_syntax;
2074 pkt.u.alter.auth_info = data_blob(NULL, 0);
2075
2076 /* construct the NDR form of the packet */
2077 status = ncacn_push_auth(&blob, state, &pkt,
2078 p->conn->security_state.auth_info);
2079 if (tevent_req_nterror(req, status)) {
2080 return tevent_req_post(req, ev);
2081 }
2082
2083 p->conn->transport.recv_data = dcerpc_recv_data;
2084
2085 /*
2086 * we allocate a dcerpc_request so we can be in the same
2087 * request queue as normal requests
2088 */
2089 subreq = talloc_zero(state, struct rpc_request);
2090 if (tevent_req_nomem(subreq, req)) {
2091 return tevent_req_post(req, ev);
2092 }
2093
2094 subreq->state = RPC_REQUEST_PENDING;
2095 subreq->call_id = pkt.call_id;
2096 subreq->async.private_data = req;
2097 subreq->async.callback = dcerpc_alter_context_fail_handler;
2098 subreq->p = p;
2099 subreq->recv_handler = dcerpc_alter_context_recv_handler;
2100 DLIST_ADD_END(p->conn->pending, subreq, struct rpc_request *);
2101 talloc_set_destructor(subreq, dcerpc_req_dequeue);
2102
2103 status = dcerpc_send_request(p->conn, &blob, true);
2104 if (tevent_req_nterror(req, status)) {
2105 return tevent_req_post(req, ev);
2106 }
2107
2108 tevent_add_timer(ev, subreq,
2109 timeval_current_ofs(DCERPC_REQUEST_TIMEOUT, 0),
2110 dcerpc_timeout_handler, subreq);
2111
2112 return req;
2113 }
2114
2115 static void dcerpc_alter_context_fail_handler(struct rpc_request *subreq)
2116 {
2117 struct tevent_req *req =
2118 talloc_get_type_abort(subreq->async.private_data,
2119 struct tevent_req);
2120 struct dcerpc_alter_context_state *state =
2121 tevent_req_data(req,
2122 struct dcerpc_alter_context_state);
2123 NTSTATUS status = subreq->status;
2124
2125 TALLOC_FREE(subreq);
2126
2127 /*
2128 * We trigger the callback in the next event run
2129 * because the code in this file might trigger
2130 * multiple request callbacks from within a single
2131 * while loop.
2132 *
2133 * In order to avoid segfaults from within
2134 * dcerpc_connection_dead() we call
2135 * tevent_req_defer_callback().
2136 */
2137 tevent_req_defer_callback(req, state->ev);
2138
2139 tevent_req_nterror(req, status);
2140 }
2141
2142 static void dcerpc_alter_context_recv_handler(struct rpc_request *subreq,
2143 DATA_BLOB *raw_packet,
2144 struct ncacn_packet *pkt)
2145 {
2146 struct tevent_req *req =
2147 talloc_get_type_abort(subreq->async.private_data,
2148 struct tevent_req);
2149 struct dcerpc_alter_context_state *state =
2150 tevent_req_data(req,
2151 struct dcerpc_alter_context_state);
2152 struct dcecli_connection *conn = state->p->conn;
2153 NTSTATUS status;
2154
2155 /*
2156 * Note that pkt is allocated under raw_packet->data,
2157 * while raw_packet->data is a child of subreq.
2158 */
2159 talloc_steal(state, raw_packet->data);
2160 TALLOC_FREE(subreq);
2161
2162 /*
2163 * We trigger the callback in the next event run
2164 * because the code in this file might trigger
2165 * multiple request callbacks from within a single
2166 * while loop.
2167 *
2168 * In order to avoid segfaults from within
2169 * dcerpc_connection_dead() we call
2170 * tevent_req_defer_callback().
2171 */
2172 tevent_req_defer_callback(req, state->ev);
2173
2174 if (pkt->ptype == DCERPC_PKT_ALTER_RESP &&
2175 pkt->u.alter_resp.num_results == 1 &&
2176 pkt->u.alter_resp.ctx_list[0].result != 0) {
2177 status = dcerpc_map_reason(pkt->u.alter_resp.ctx_list[0].reason);
2178 DEBUG(2,("dcerpc: alter_resp failed - reason %d - %s\n",
2179 pkt->u.alter_resp.ctx_list[0].reason,
2180 nt_errstr(status)));
2181 tevent_req_nterror(req, status);
2182 return;
2183 }
2184
2185 if (pkt->ptype == DCERPC_PKT_FAULT) {
2186 DEBUG(5,("dcerpc: alter_resp - rpc fault: %s\n",
2187 dcerpc_errstr(state, pkt->u.fault.status)));
2188 if (pkt->u.fault.status == DCERPC_FAULT_ACCESS_DENIED) {
2189 state->p->last_fault_code = pkt->u.fault.status;
2190 tevent_req_nterror(req, NT_STATUS_LOGON_FAILURE);
2191 } else {
2192 state->p->last_fault_code = pkt->u.fault.status;
2193 tevent_req_nterror(req, NT_STATUS_NET_WRITE_FAULT);
2194 }
2195 return;
2196 }
2197
2198 if (pkt->ptype != DCERPC_PKT_ALTER_RESP ||
2199 pkt->u.alter_resp.num_results == 0 ||
2200 pkt->u.alter_resp.ctx_list[0].result != 0) {
2201 state->p->last_fault_code = DCERPC_NCA_S_PROTO_ERROR;
2202 tevent_req_nterror(req, NT_STATUS_NET_WRITE_FAULT);
2203 return;
2204 }
2205
2206 /* the alter_resp might contain a reply set of credentials */
2207 if (conn->security_state.auth_info &&
2208 pkt->u.alter_resp.auth_info.length) {
2209 uint32_t auth_length;
2210
2211 status = dcerpc_pull_auth_trailer(pkt, conn, &pkt->u.alter_resp.auth_info,
2212 conn->security_state.auth_info, &auth_length, true);
2213 if (tevent_req_nterror(req, status)) {
2214 return;
2215 }
2216 }
2217
2218 tevent_req_done(req);
2219 }
2220
2221 NTSTATUS dcerpc_alter_context_recv(struct tevent_req *req)
2222 {
2223 return tevent_req_simple_recv_ntstatus(req);
2224 }
2225
2226 /*
2227 send a dcerpc alter_context request
2228 */
2229 _PUBLIC_ NTSTATUS dcerpc_alter_context(struct dcerpc_pipe *p,
2230 TALLOC_CTX *mem_ctx,
2231 const struct ndr_syntax_id *syntax,
2232 const struct ndr_syntax_id *transfer_syntax)
2233 {
2234 struct tevent_req *subreq;
2235 struct tevent_context *ev = p->conn->event_ctx;
2236 bool ok;
2237
2238 /* TODO: create a new event context here */
2239
2240 subreq = dcerpc_alter_context_send(mem_ctx, p->conn->event_ctx,
2241 p, syntax, transfer_syntax);
2242 if (subreq == NULL) {
2243 return NT_STATUS_NO_MEMORY;
2244 }
2245
2246 ok = tevent_req_poll(subreq, ev);
2247 if (!ok) {
2248 NTSTATUS status;
2249 status = map_nt_error_from_unix_common(errno);
2250 return status;
2251 }
2252
2253 return dcerpc_alter_context_recv(subreq);
2254 }
2255
2256 static void dcerpc_transport_dead(struct dcecli_connection *c, NTSTATUS status)
2257 {
2258 if (c->transport.stream == NULL) {
2259 return;
2260 }
2261
2262 tevent_queue_stop(c->transport.write_queue);
2263 TALLOC_FREE(c->transport.read_subreq);
2264 TALLOC_FREE(c->transport.stream);
2265
2266 if (NT_STATUS_EQUAL(NT_STATUS_UNSUCCESSFUL, status)) {
2267 status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
2268 }
2269
2270 if (NT_STATUS_EQUAL(NT_STATUS_OK, status)) {
2271 status = NT_STATUS_END_OF_FILE;
2272 }
2273
2274 if (c->transport.recv_data) {
2275 c->transport.recv_data(c, NULL, status);
2276 }
2277 }
2278
2279
2280 /*
2281 shutdown SMB pipe connection
2282 */
2283 struct dcerpc_shutdown_pipe_state {
2284 struct dcecli_connection *c;
2285 NTSTATUS status;
2286 };
2287
2288 static void dcerpc_shutdown_pipe_done(struct tevent_req *subreq);
2289
2290 static NTSTATUS dcerpc_shutdown_pipe(struct dcecli_connection *c, NTSTATUS status)
2291 {
2292 struct dcerpc_shutdown_pipe_state *state;
2293 struct tevent_req *subreq;
2294
2295 if (c->transport.stream == NULL) {
2296 return NT_STATUS_OK;
2297 }
2298
2299 state = talloc_zero(c, struct dcerpc_shutdown_pipe_state);
2300 if (state == NULL) {
2301 return NT_STATUS_NO_MEMORY;
2302 }
2303 state->c = c;
2304 state->status = status;
2305
2306 subreq = tstream_disconnect_send(state, c->event_ctx, c->transport.stream);
2307 if (subreq == NULL) {
2308 return NT_STATUS_NO_MEMORY;
2309 }
2310 tevent_req_set_callback(subreq, dcerpc_shutdown_pipe_done, state);
2311
2312 return status;
2313 }
2314
2315 static void dcerpc_shutdown_pipe_done(struct tevent_req *subreq)
2316 {
2317 struct dcerpc_shutdown_pipe_state *state =
2318 tevent_req_callback_data(subreq, struct dcerpc_shutdown_pipe_state);
2319 struct dcecli_connection *c = state->c;
2320 NTSTATUS status = state->status;
2321 int error;
2322
2323 /*
2324 * here we ignore the return values...
2325 */
2326 tstream_disconnect_recv(subreq, &error);
2327 TALLOC_FREE(subreq);
2328
2329 TALLOC_FREE(state);
2330
2331 dcerpc_transport_dead(c, status);
2332 }
2333
2334
2335
2336 struct dcerpc_send_read_state {
2337 struct dcecli_connection *p;
2338 };
2339
2340 static int dcerpc_send_read_state_destructor(struct dcerpc_send_read_state *state)
2341 {
2342 struct dcecli_connection *p = state->p;
2343
2344 p->transport.read_subreq = NULL;
2345
2346 return 0;
2347 }
2348
2349 static void dcerpc_send_read_done(struct tevent_req *subreq);
2350
2351 static NTSTATUS dcerpc_send_read(struct dcecli_connection *p)
2352 {
2353 struct dcerpc_send_read_state *state;
2354
2355 if (p->transport.read_subreq != NULL) {
2356 p->transport.pending_reads++;
2357 return NT_STATUS_OK;
2358 }
2359
2360 state = talloc_zero(p, struct dcerpc_send_read_state);
2361 if (state == NULL) {
2362 return NT_STATUS_NO_MEMORY;
2363 }
2364 state->p = p;
2365
2366 talloc_set_destructor(state, dcerpc_send_read_state_destructor);
2367
2368 p->transport.read_subreq = dcerpc_read_ncacn_packet_send(state,
2369 p->event_ctx,
2370 p->transport.stream);
2371 if (p->transport.read_subreq == NULL) {
2372 return NT_STATUS_NO_MEMORY;
2373 }
2374 tevent_req_set_callback(p->transport.read_subreq, dcerpc_send_read_done, state);
2375
2376 return NT_STATUS_OK;
2377 }
2378
2379 static void dcerpc_send_read_done(struct tevent_req *subreq)
2380 {
2381 struct dcerpc_send_read_state *state =
2382 tevent_req_callback_data(subreq,
2383 struct dcerpc_send_read_state);
2384 struct dcecli_connection *p = state->p;
2385 NTSTATUS status;
2386 struct ncacn_packet *pkt;
2387 DATA_BLOB blob;
2388
2389 status = dcerpc_read_ncacn_packet_recv(subreq, state,
2390 &pkt, &blob);
2391 TALLOC_FREE(subreq);
2392 if (!NT_STATUS_IS_OK(status)) {
2393 TALLOC_FREE(state);
2394 dcerpc_transport_dead(p, status);
2395 return;
2396 }
2397
2398 /*
2399 * here we steal into thet connection context,
2400 * but p->transport.recv_data() will steal or free it again
2401 */
2402 talloc_steal(p, blob.data);
2403 TALLOC_FREE(state);
2404
2405 if (p->transport.pending_reads > 0) {
2406 p->transport.pending_reads--;
2407
2408 status = dcerpc_send_read(p);
2409 if (!NT_STATUS_IS_OK(status)) {
2410 dcerpc_transport_dead(p, status);
2411 return;
2412 }
2413 }
2414
2415 if (p->transport.recv_data) {
2416 p->transport.recv_data(p, &blob, NT_STATUS_OK);
2417 }
2418 }
2419
2420 struct dcerpc_send_request_state {
2421 struct dcecli_connection *p;
2422 DATA_BLOB blob;
2423 struct iovec iov;
2424 };
2425
2426 static int dcerpc_send_request_state_destructor(struct dcerpc_send_request_state *state)
2427 {
2428 struct dcecli_connection *p = state->p;
2429
2430 p->transport.read_subreq = NULL;
2431
2432 return 0;
2433 }
2434
2435 static void dcerpc_send_request_wait_done(struct tevent_req *subreq);
2436 static void dcerpc_send_request_done(struct tevent_req *subreq);
2437
2438 static NTSTATUS dcerpc_send_request(struct dcecli_connection *p, DATA_BLOB *data,
2439 bool trigger_read)
2440 {
2441 struct dcerpc_send_request_state *state;
2442 struct tevent_req *subreq;
2443 bool use_trans = trigger_read;
2444
2445 if (p->transport.stream == NULL) {
2446 return NT_STATUS_CONNECTION_DISCONNECTED;
2447 }
2448
2449 state = talloc_zero(p, struct dcerpc_send_request_state);
2450 if (state == NULL) {
2451 return NT_STATUS_NO_MEMORY;
2452 }
2453 state->p = p;
2454
2455 state->blob = data_blob_talloc(state, data->data, data->length);
2456 if (state->blob.data == NULL) {
2457 TALLOC_FREE(state);
2458 return NT_STATUS_NO_MEMORY;
2459 }
2460 state->iov.iov_base = (void *)state->blob.data;
2461 state->iov.iov_len = state->blob.length;
2462
2463 if (p->transport.read_subreq != NULL) {
2464 use_trans = false;
2465 }
2466
2467 if (!tstream_is_smbXcli_np(p->transport.stream)) {
2468 use_trans = false;
2469 }
2470
2471 if (use_trans) {
2472 /*
2473 * we need to block reads until our write is
2474 * the next in the write queue.
2475 */
2476 p->transport.read_subreq = tevent_queue_wait_send(state, p->event_ctx,
2477 p->transport.write_queue);
2478 if (p->transport.read_subreq == NULL) {
2479 TALLOC_FREE(state);
2480 return NT_STATUS_NO_MEMORY;
2481 }
2482 tevent_req_set_callback(p->transport.read_subreq,
2483 dcerpc_send_request_wait_done,
2484 state);
2485
2486 talloc_set_destructor(state, dcerpc_send_request_state_destructor);
2487
2488 trigger_read = false;
2489 }
2490
2491 subreq = tstream_writev_queue_send(state, p->event_ctx,
2492 p->transport.stream,
2493 p->transport.write_queue,
2494 &state->iov, 1);
2495 if (subreq == NULL) {
2496 TALLOC_FREE(state);
2497 return NT_STATUS_NO_MEMORY;
2498 }
2499 tevent_req_set_callback(subreq, dcerpc_send_request_done, state);
2500
2501 if (trigger_read) {
2502 dcerpc_send_read(p);
2503 }
2504
2505 return NT_STATUS_OK;
2506 }
2507
2508 static void dcerpc_send_request_wait_done(struct tevent_req *subreq)
2509 {
2510 struct dcerpc_send_request_state *state =
2511 tevent_req_callback_data(subreq,
2512 struct dcerpc_send_request_state);
2513 struct dcecli_connection *p = state->p;
2514 NTSTATUS status;
2515 bool ok;
2516
2517 p->transport.read_subreq = NULL;
2518 talloc_set_destructor(state, NULL);
2519
2520 ok = tevent_queue_wait_recv(subreq);
2521 if (!ok) {
2522 TALLOC_FREE(state);
2523 dcerpc_transport_dead(p, NT_STATUS_NO_MEMORY);
2524 return;
2525 }
2526
2527 if (tevent_queue_length(p->transport.write_queue) <= 2) {
2528 status = tstream_smbXcli_np_use_trans(p->transport.stream);
2529 if (!NT_STATUS_IS_OK(status)) {
2530 TALLOC_FREE(state);
2531 dcerpc_transport_dead(p, status);
2532 return;
2533 }
2534 }
2535
2536 /* we free subreq after tstream_cli_np_use_trans */
2537 TALLOC_FREE(subreq);
2538
2539 dcerpc_send_read(p);
2540 }
2541
2542 static void dcerpc_send_request_done(struct tevent_req *subreq)
2543 {
2544 struct dcerpc_send_request_state *state =
2545 tevent_req_callback_data(subreq,
2546 struct dcerpc_send_request_state);
2547 int ret;
2548 int error;
2549
2550 ret = tstream_writev_queue_recv(subreq, &error);
2551 TALLOC_FREE(subreq);
2552 if (ret == -1) {
2553 struct dcecli_connection *p = state->p;
2554 NTSTATUS status = map_nt_error_from_unix_common(error);
2555
2556 TALLOC_FREE(state);
2557 dcerpc_transport_dead(p, status);
2558 return;
2559 }
2560
2561 TALLOC_FREE(state);
2562 }
Samba GIT mirror