source4/librpc/rpc/dcerpc_roh_channel_in.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    [MS-RPCH] - RPC over HTTP client
   5
   6    Copyright (C) 2013 Samuel Cabrero <samuelcabrero@kernevil.me>
   7    Copyright (C) Julien Kerihuel <j.kerihuel@openchange.org> 2013
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include <tevent.h>
  25 #include "lib/talloc/talloc.h"
  26 #include "lib/tsocket/tsocket.h"
  27 #include "lib/tls/tls.h"
  28 #include "lib/util/tevent_ntstatus.h"
  29 #include "lib/util/util_net.h"
  30 #include "libcli/resolve/resolve.h"
  31 #include "libcli/composite/composite.h"
  32 #include "auth/credentials/credentials.h"
  33 #include "auth/credentials/credentials_internal.h"
  34 #include <gen_ndr/dcerpc.h>
  35 #include <gen_ndr/ndr_dcerpc.h>
  36
  37 #include "librpc/rpc/dcerpc.h"
  38 #include "librpc/rpc/dcerpc_roh.h"
  39 #include "librpc/rpc/dcerpc_proto.h"
  40 #include "lib/http/http.h"
  41
  42 struct roh_connect_channel_state {
  43         struct tevent_context           *ev;
  44         struct tsocket_address          *local_address;
  45         struct tsocket_address          *remote_address;
  46         struct cli_credentials          *credentials;
  47         struct roh_connection           *roh;
  48         bool                            tls;
  49         struct tstream_tls_params       *tls_params;
  50 };
  51
  52 static void roh_connect_channel_in_done(struct tevent_req *);
  53 struct tevent_req *roh_connect_channel_in_send(TALLOC_CTX *mem_ctx,
  54                                                struct tevent_context *ev,
  55                                                const char *rpcproxy_ip_address,
  56                                                unsigned int rpcproxy_port,
  57                                                struct cli_credentials *credentials,
  58                                                struct roh_connection *roh,
  59                                                bool tls,
  60                                                struct tstream_tls_params *tls_params)
  61 {
  62         NTSTATUS                                status;
  63         struct tevent_req                       *req;
  64         struct tevent_req                       *subreq;
  65         struct roh_connect_channel_state        *state;
  66         int                                     ret;
  67
  68         DEBUG(8, ("%s: Connecting channel in socket, RPC proxy is %s:%d (TLS: %s)\n",
  69                   __func__, rpcproxy_ip_address, rpcproxy_port,
  70                   (tls ? "true" : "false")));
  71
  72         req = tevent_req_create(mem_ctx, &state, struct roh_connect_channel_state);
  73         if (req == NULL) {
  74                 return NULL;
  75         }
  76
  77         if (!is_ipaddress(rpcproxy_ip_address)) {
  78                 DEBUG(0, ("%s: Invalid host (%s), needs to be an IP address\n",
  79                           __func__, rpcproxy_ip_address));
  80                 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
  81                 return tevent_req_post(req, ev);
  82         }
  83
  84         state->ev = ev;
  85         state->credentials = credentials;
  86         state->roh = roh;
  87         state->tls = tls;
  88         state->tls_params = tls_params;
  89         ret = tsocket_address_inet_from_strings(state, "ip", NULL, 0,
  90                                                 &state->local_address);
  91         if (ret != 0) {
  92                 DEBUG(0, ("%s: Cannot create local socket address, error: %s (%d)\n",
  93                           __func__, strerror(errno), errno));
  94                 status = map_nt_error_from_unix_common(errno);
  95                 tevent_req_nterror(req, status);
  96                 return tevent_req_post(req, ev);
  97         }
  98
  99         ret = tsocket_address_inet_from_strings(state, "ip",
 100                                                 rpcproxy_ip_address,
 101                                                 rpcproxy_port,
 102                                                 &state->remote_address);
 103         if (ret != 0) {
 104                 DEBUG(0, ("%s: Cannot create remote socket address, error: %s (%d)\n",
 105                           __func__, strerror(errno), errno));
 106                 status = map_nt_error_from_unix_common(errno);
 107                 tevent_req_nterror(req, status);
 108                 return tevent_req_post(req, ev);
 109         }
 110
 111         /* Initialize channel structure */
 112         state->roh->default_channel_in = talloc_zero(roh, struct roh_channel);
 113         if (tevent_req_nomem(state->roh->default_channel_in, req)) {
 114                 return tevent_req_post(req, ev);
 115         }
 116
 117         state->roh->default_channel_in->send_queue =
 118                         tevent_queue_create(state->roh->default_channel_in,
 119                                             "RoH IN virtual channel send queue");
 120         if (tevent_req_nomem(state->roh->default_channel_in->send_queue, req)) {
 121                 return tevent_req_post(req, ev);
 122         }
 123
 124         state->roh->default_channel_in->channel_cookie = GUID_random();
 125         subreq = tstream_inet_tcp_connect_send(state, ev, state->local_address,
 126                                                state->remote_address);
 127         if (tevent_req_nomem(subreq, req)) {
 128                 return tevent_req_post(req, ev);
 129         }
 130         tevent_req_set_callback(subreq, roh_connect_channel_in_done, req);
 131
 132         return req;
 133 }
 134
 135 static void roh_connect_channel_in_tls_done(struct tevent_req *subreq);
 136 static void roh_connect_channel_in_done(struct tevent_req *subreq)
 137 {
 138         NTSTATUS                                status;
 139         struct tevent_req                       *req;
 140         struct roh_connect_channel_state        *state;
 141         int                                     ret;
 142         int                                     sys_errno;
 143
 144         req = tevent_req_callback_data(subreq, struct tevent_req);
 145         state = tevent_req_data(req, struct roh_connect_channel_state);
 146         ret = tstream_inet_tcp_connect_recv(subreq, &sys_errno, state,
 147                                             &state->roh->default_channel_in->streams.raw,
 148                                             NULL);
 149         talloc_steal(state->roh->default_channel_in,
 150                      state->roh->default_channel_in->streams.raw);
 151         state->roh->default_channel_in->streams.active = state->roh->default_channel_in->streams.raw;
 152         TALLOC_FREE(subreq);
 153         if (ret != 0) {
 154                 status = map_nt_error_from_unix_common(sys_errno);
 155                 tevent_req_nterror(req, status);
 156                 return;
 157         }
 158
 159         DEBUG(8, ("%s: Socket connected\n", __func__));
 160         if (state->tls) {
 161                 DEBUG(8, ("%s: Starting TLS handshake\n", __func__));
 162                 subreq = _tstream_tls_connect_send(state,
 163                                                    state->ev,
 164                                                    state->roh->default_channel_in->streams.raw,
 165                                                    state->tls_params,
 166                                                    __location__);
 167                 if (tevent_req_nomem(subreq, req)) {
 168                         return;
 169                 }
 170                 tevent_req_set_callback(subreq, roh_connect_channel_in_tls_done, req);
 171                 return;
 172         }
 173
 174         tevent_req_done(req);
 175 }
 176
 177 static void roh_connect_channel_in_tls_done(struct tevent_req *subreq)
 178 {
 179         NTSTATUS                                status;
 180         struct tevent_req                       *req;
 181         struct roh_connect_channel_state        *state;
 182         int                                     ret;
 183         int                                     sys_errno;
 184
 185         req = tevent_req_callback_data(subreq, struct tevent_req);
 186         state = tevent_req_data(req, struct roh_connect_channel_state);
 187         ret = tstream_tls_connect_recv(subreq, &sys_errno, state,
 188                                        &state->roh->default_channel_in->streams.tls);
 189         talloc_steal(state->roh->default_channel_in,
 190                      state->roh->default_channel_in->streams.tls);
 191         state->roh->default_channel_in->streams.active = state->roh->default_channel_in->streams.tls;
 192         TALLOC_FREE(subreq);
 193         if (ret != 0) {
 194                 status = map_nt_error_from_unix_common(sys_errno);
 195                 tevent_req_nterror(req, status);
 196                 return;
 197         }
 198         DEBUG(8, ("%s: TLS handshake completed\n", __func__));
 199
 200         tevent_req_done(req);
 201 }
 202
 203 NTSTATUS roh_connect_channel_in_recv(struct tevent_req *req)
 204 {
 205         NTSTATUS status;
 206
 207         if (tevent_req_is_nterror(req, &status)) {
 208                 tevent_req_received(req);
 209                 return status;
 210         }
 211
 212         tevent_req_received(req);
 213         return NT_STATUS_OK;
 214 }
 215
 216 struct roh_request_state {
 217         struct http_request     *request;
 218         struct http_request     *response;
 219 };
 220
 221 static void roh_send_RPC_DATA_IN_done(struct tevent_req *subreq);
 222 struct tevent_req *roh_send_RPC_DATA_IN_send(TALLOC_CTX *mem_ctx,
 223                                              struct loadparm_context *lp_ctx,
 224                                              struct tevent_context *ev,
 225                                              struct cli_credentials *credentials,
 226                                              struct roh_connection *roh,
 227                                              const char *rpc_server,
 228                                              uint32_t rpc_server_port,
 229                                              const char *rpc_proxy,
 230                                              uint8_t http_auth)
 231 {
 232         struct tevent_req               *req;
 233         struct tevent_req               *subreq;
 234         struct roh_request_state        *state;
 235         const char                      *path;
 236         char                            *query;
 237         char                            *uri;
 238
 239         DEBUG(8, ("%s: Sending RPC_IN_DATA request\n", __func__));
 240
 241         req = tevent_req_create(mem_ctx, &state, struct roh_request_state);
 242         if (req == NULL) {
 243                 return NULL;
 244         }
 245
 246         state->request = talloc_zero(state, struct http_request);
 247         if (tevent_req_nomem(state->request, req)) {
 248                 return tevent_req_post(req, ev);
 249         }
 250
 251         /* Build URI, as specified in section 2.2.2 */
 252         query = talloc_asprintf(state, "%s:%d", rpc_server, rpc_server_port);
 253         if (tevent_req_nomem(query, req)) {
 254                 return tevent_req_post(req, ev);
 255         }
 256
 257         /*
 258          * TODO This path changes to "/rpcwithcert/rpcproxy.dll" when using
 259          * certificates
 260          */
 261         path = "/rpc/rpcproxy.dll";
 262         uri = talloc_asprintf(state, "%s?%s", path, query);
 263         if (tevent_req_nomem(uri, req)) {
 264                 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
 265                 return tevent_req_post(req, ev);
 266         }
 267         TALLOC_FREE(query);
 268
 269         /*
 270          * Create the HTTP channel IN request as specified in the
 271          * section 2.1.2.1.1
 272          */
 273         state->request->type = HTTP_REQ_RPC_IN_DATA;
 274         state->request->uri = uri;
 275         state->request->body.length = 0;
 276         state->request->body.data = NULL;
 277         state->request->major = '1';
 278         state->request->minor = '0';
 279
 280         http_add_header(state, &state->request->headers,
 281                         "Accept", "application/rpc");
 282         http_add_header(state, &state->request->headers,
 283                         "User-Agent", "MSRPC");
 284         http_add_header(state, &state->request->headers,
 285                         "Host", rpc_proxy);
 286         http_add_header(state, &state->request->headers,
 287                         "Connection", "keep-alive");
 288         http_add_header(state, &state->request->headers,
 289                         "Content-Length", "1073741824");
 290         http_add_header(state, &state->request->headers,
 291                         "Cache-Control", "no-cache");
 292         http_add_header(state, &state->request->headers,
 293                         "Pragma", "no-cache");
 294
 295         subreq = http_send_auth_request_send(state,
 296                                         ev,
 297                                         roh->default_channel_in->streams.active,
 298                                         roh->default_channel_in->send_queue,
 299                                         state->request,
 300                                         credentials,
 301                                         lp_ctx,
 302                                         http_auth);
 303         if (tevent_req_nomem(subreq, req)) {
 304                 return tevent_req_post(req, ev);
 305         }
 306         tevent_req_set_callback(subreq, roh_send_RPC_DATA_IN_done, req);
 307
 308         return req;
 309 }
 310
 311 static void roh_send_RPC_DATA_IN_done(struct tevent_req *subreq)
 312 {
 313         NTSTATUS                status;
 314         struct tevent_req       *req;
 315
 316         req = tevent_req_callback_data(subreq, struct tevent_req);
 317
 318         /* Receive the sent bytes to check if request has been properly sent */
 319         status = http_send_auth_request_recv(subreq);
 320         TALLOC_FREE(subreq);
 321         if (tevent_req_nterror(req, status)) {
 322                 return;
 323         }
 324
 325         DEBUG(8, ("%s: RPC_IN_DATA sent\n", __func__));
 326
 327         tevent_req_done(req);
 328 }
 329
 330 NTSTATUS roh_send_RPC_DATA_IN_recv(struct tevent_req *req)
 331 {
 332         NTSTATUS status;
 333
 334         if (tevent_req_is_nterror(req, &status)) {
 335                 tevent_req_received(req);
 336                 return status;
 337         }
 338
 339         tevent_req_received(req);
 340         return NT_STATUS_OK;
 341 }
 342
 343 struct roh_send_pdu_state {
 344         DATA_BLOB       buffer;
 345         struct iovec    iov;
 346         int             bytes_written;
 347         int             sys_errno;
 348 };
 349
 350 static void roh_send_CONN_B1_done(struct tevent_req *subreq);
 351 struct tevent_req *roh_send_CONN_B1_send(TALLOC_CTX *mem_ctx,
 352                                          struct tevent_context *ev,
 353                                          struct roh_connection *roh)
 354 {
 355         struct tevent_req               *req;
 356         struct tevent_req               *subreq;
 357         struct roh_send_pdu_state       *state;
 358         struct dcerpc_rts               rts;
 359         struct ncacn_packet             pkt;
 360         struct ndr_push                 *ndr;
 361
 362         DEBUG(8, ("%s: Sending CONN/B1 request\n", __func__));
 363
 364         req = tevent_req_create(mem_ctx, &state, struct roh_send_pdu_state);
 365         if (req == NULL) {
 366                 return NULL;
 367         }
 368
 369         rts.Flags = RTS_FLAG_NONE;
 370         rts.NumberOfCommands = 6;
 371         rts.Commands = talloc_array(state, struct dcerpc_rts_cmd, 6);
 372
 373         /* CONN/B1: Version RTS command */
 374         rts.Commands[0].CommandType = 0x00000006;
 375         rts.Commands[0].Command.Version.Version = 0x00000001;
 376
 377         /* CONN/B1: VirtualConnectionCookie RTS command */
 378         rts.Commands[1].CommandType = 0x00000003;
 379         rts.Commands[1].Command.Cookie.Cookie.Cookie = roh->connection_cookie;
 380
 381         /* CONN/B1: InChannelCookie RTS command */
 382         rts.Commands[2].CommandType = 0x00000003;
 383         rts.Commands[2].Command.Cookie.Cookie.Cookie =
 384                         roh->default_channel_in->channel_cookie;
 385
 386         /* CONN/B1: ChannelLifetime */
 387         rts.Commands[3].CommandType = 0x00000004;
 388         rts.Commands[3].Command.ReceiveWindowSize.ReceiveWindowSize =
 389                         0x40000000;
 390
 391         /* CONN/B1: ClientKeepAlive */
 392         rts.Commands[4].CommandType = 0x00000005;
 393         rts.Commands[4].Command.ClientKeepalive.ClientKeepalive = 0x000493e0;
 394
 395         /* CONN/B1: AssociationGroupId */
 396         rts.Commands[5].CommandType = 0x0000000C;
 397         rts.Commands[5].Command.AssociationGroupId.AssociationGroupId.Cookie =
 398                         roh->association_group_id_cookie;
 399
 400         pkt.rpc_vers = 5;
 401         pkt.rpc_vers_minor = 0;
 402         pkt.ptype = DCERPC_PKT_RTS;
 403         pkt.pfc_flags = DCERPC_PFC_FLAG_LAST | DCERPC_PFC_FLAG_FIRST;
 404         pkt.drep[0] = DCERPC_DREP_LE;
 405         pkt.drep[1] = 0;
 406         pkt.drep[2] = 0;
 407         pkt.drep[3] = 0;
 408         pkt.frag_length = 104;
 409         pkt.auth_length = 0;
 410         pkt.call_id = 0;
 411         pkt.u.rts = rts;
 412
 413         ndr = ndr_push_init_ctx(state);
 414         ndr->offset = 0;
 415         ndr_push_ncacn_packet(ndr, NDR_SCALARS, &pkt);
 416
 417         state->buffer = ndr_push_blob(ndr);
 418         state->iov.iov_base = (char *) state->buffer.data;
 419         state->iov.iov_len = state->buffer.length;
 420
 421         subreq = tstream_writev_queue_send(mem_ctx,
 422                                            ev,
 423                                            roh->default_channel_in->streams.active,
 424                                            roh->default_channel_in->send_queue,
 425                                            &state->iov,
 426                                            1);
 427         if (tevent_req_nomem(subreq, req)) {
 428                 return tevent_req_post(req, ev);
 429         }
 430         tevent_req_set_callback(subreq, roh_send_CONN_B1_done, req);
 431
 432         return req;
 433 }
 434
 435 static void roh_send_CONN_B1_done(struct tevent_req *subreq)
 436 {
 437         NTSTATUS                        status;
 438         struct tevent_req               *req;
 439         struct roh_send_pdu_state       *state;
 440         int                             sys_errno;
 441
 442         req = tevent_req_callback_data(subreq, struct tevent_req);
 443         state = tevent_req_data(req, struct roh_send_pdu_state);
 444
 445         state->bytes_written = tstream_writev_queue_recv(subreq, &sys_errno);
 446         state->sys_errno = sys_errno;
 447         TALLOC_FREE(subreq);
 448         if (state->bytes_written <= 0 && state->sys_errno != 0) {
 449                 status = map_nt_error_from_unix_common(sys_errno);
 450                 tevent_req_nterror(req, status);
 451                 return;
 452         }
 453         DEBUG(8, ("%s: CONN/B1 sent (%d bytes written)\n",
 454                   __func__, state->bytes_written));
 455
 456         tevent_req_done(req);
 457 }
 458
 459 NTSTATUS roh_send_CONN_B1_recv(struct tevent_req *req)
 460 {
 461         NTSTATUS status;
 462
 463         if (tevent_req_is_nterror(req, &status)) {
 464                 tevent_req_received(req);
 465                 return status;
 466         }
 467
 468         tevent_req_received(req);
 469         return NT_STATUS_OK;
 470 }