?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Add code to torture the fragmentation code a bit
[Samba.git] / source3 / rpc_client / cli_pipe.c
blobf3affd1cd894f63909176e33bdc833f31c791a45
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Largely rewritten by Jeremy Allison 2005.
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 #include "includes.h"
21 #include "librpc/gen_ndr/cli_epmapper.h"
22
23 #undef DBGC_CLASS
24 #define DBGC_CLASS DBGC_RPC_CLI
25
26 /*******************************************************************
27 interface/version dce/rpc pipe identification
28 ********************************************************************/
29
30 #define PIPE_SRVSVC "\\PIPE\\srvsvc"
31 #define PIPE_SAMR "\\PIPE\\samr"
32 #define PIPE_WINREG "\\PIPE\\winreg"
33 #define PIPE_WKSSVC "\\PIPE\\wkssvc"
34 #define PIPE_NETLOGON "\\PIPE\\NETLOGON"
35 #define PIPE_NTLSA "\\PIPE\\ntlsa"
36 #define PIPE_NTSVCS "\\PIPE\\ntsvcs"
37 #define PIPE_LSASS "\\PIPE\\lsass"
38 #define PIPE_LSARPC "\\PIPE\\lsarpc"
39 #define PIPE_SPOOLSS "\\PIPE\\spoolss"
40 #define PIPE_NETDFS "\\PIPE\\netdfs"
41 #define PIPE_ECHO "\\PIPE\\rpcecho"
42 #define PIPE_SHUTDOWN "\\PIPE\\initshutdown"
43 #define PIPE_EPM "\\PIPE\\epmapper"
44 #define PIPE_SVCCTL "\\PIPE\\svcctl"
45 #define PIPE_EVENTLOG "\\PIPE\\eventlog"
46 #define PIPE_EPMAPPER "\\PIPE\\epmapper"
47 #define PIPE_DRSUAPI "\\PIPE\\drsuapi"
48
49 /*
50 * IMPORTANT!! If you update this structure, make sure to
51 * update the index #defines in smb.h.
52 */
53
54 static const struct pipe_id_info {
55 /* the names appear not to matter: the syntaxes _do_ matter */
56
57 const char *client_pipe;
58 const RPC_IFACE *abstr_syntax; /* this one is the abstract syntax id */
59 } pipe_names [] =
60 {
61 { PIPE_LSARPC, &ndr_table_lsarpc.syntax_id },
62 { PIPE_LSARPC, &ndr_table_dssetup.syntax_id },
63 { PIPE_SAMR, &ndr_table_samr.syntax_id },
64 { PIPE_NETLOGON, &ndr_table_netlogon.syntax_id },
65 { PIPE_SRVSVC, &ndr_table_srvsvc.syntax_id },
66 { PIPE_WKSSVC, &ndr_table_wkssvc.syntax_id },
67 { PIPE_WINREG, &ndr_table_winreg.syntax_id },
68 { PIPE_SPOOLSS, &syntax_spoolss },
69 { PIPE_NETDFS, &ndr_table_netdfs.syntax_id },
70 { PIPE_ECHO, &ndr_table_rpcecho.syntax_id },
71 { PIPE_SHUTDOWN, &ndr_table_initshutdown.syntax_id },
72 { PIPE_SVCCTL, &ndr_table_svcctl.syntax_id },
73 { PIPE_EVENTLOG, &ndr_table_eventlog.syntax_id },
74 { PIPE_NTSVCS, &ndr_table_ntsvcs.syntax_id },
75 { PIPE_EPMAPPER, &ndr_table_epmapper.syntax_id },
76 { PIPE_DRSUAPI, &ndr_table_drsuapi.syntax_id },
77 { NULL, NULL }
78 };
79
80 /****************************************************************************
81 Return the pipe name from the interface.
82 ****************************************************************************/
83
84 const char *cli_get_pipe_name_from_iface(TALLOC_CTX *mem_ctx,
85 struct cli_state *cli,
86 const struct ndr_syntax_id *interface)
87 {
88 int i;
89 for (i = 0; pipe_names[i].client_pipe; i++) {
90 if (ndr_syntax_id_equal(pipe_names[i].abstr_syntax,
91 interface)) {
92 return &pipe_names[i].client_pipe[5];
93 }
94 }
95
96 /*
97 * Here we should ask \\epmapper, but for now our code is only
98 * interested in the known pipes mentioned in pipe_names[]
99 */
100
101 return NULL;
102 }
103
104 /********************************************************************
105 Map internal value to wire value.
106 ********************************************************************/
107
108 static int map_pipe_auth_type_to_rpc_auth_type(enum pipe_auth_type auth_type)
109 {
110 switch (auth_type) {
111
112 case PIPE_AUTH_TYPE_NONE:
113 return RPC_ANONYMOUS_AUTH_TYPE;
114
115 case PIPE_AUTH_TYPE_NTLMSSP:
116 return RPC_NTLMSSP_AUTH_TYPE;
117
118 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
119 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
120 return RPC_SPNEGO_AUTH_TYPE;
121
122 case PIPE_AUTH_TYPE_SCHANNEL:
123 return RPC_SCHANNEL_AUTH_TYPE;
124
125 case PIPE_AUTH_TYPE_KRB5:
126 return RPC_KRB5_AUTH_TYPE;
127
128 default:
129 DEBUG(0,("map_pipe_auth_type_to_rpc_type: unknown pipe "
130 "auth type %u\n",
131 (unsigned int)auth_type ));
132 break;
133 }
134 return -1;
135 }
136
137 /********************************************************************
138 Pipe description for a DEBUG
139 ********************************************************************/
140 static char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx, struct rpc_pipe_client *cli)
141 {
142 char *result;
143
144 switch (cli->transport_type) {
145 case NCACN_NP:
146 result = talloc_asprintf(mem_ctx, "host %s, pipe %s, "
147 "fnum 0x%x",
148 cli->desthost,
149 cli->trans.np.pipe_name,
150 (unsigned int)(cli->trans.np.fnum));
151 break;
152 case NCACN_IP_TCP:
153 case NCACN_UNIX_STREAM:
154 result = talloc_asprintf(mem_ctx, "host %s, fd %d",
155 cli->desthost, cli->trans.sock.fd);
156 break;
157 default:
158 result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
159 break;
160 }
161 SMB_ASSERT(result != NULL);
162 return result;
163 }
164
165 /********************************************************************
166 Rpc pipe call id.
167 ********************************************************************/
168
169 static uint32 get_rpc_call_id(void)
170 {
171 static uint32 call_id = 0;
172 return ++call_id;
173 }
174
175 /*
176 * Realloc pdu to have a least "size" bytes
177 */
178
179 static bool rpc_grow_buffer(prs_struct *pdu, size_t size)
180 {
181 size_t extra_size;
182
183 if (prs_data_size(pdu) >= size) {
184 return true;
185 }
186
187 extra_size = size - prs_data_size(pdu);
188
189 if (!prs_force_grow(pdu, extra_size)) {
190 DEBUG(0, ("rpc_grow_buffer: Failed to grow parse struct by "
191 "%d bytes.\n", (int)extra_size));
192 return false;
193 }
194
195 DEBUG(5, ("rpc_grow_buffer: grew buffer by %d bytes to %u\n",
196 (int)extra_size, prs_data_size(pdu)));
197 return true;
198 }
199
200
201 /*******************************************************************
202 Use SMBreadX to get rest of one fragment's worth of rpc data.
203 Reads the whole size or give an error message
204 ********************************************************************/
205
206 struct rpc_read_state {
207 struct event_context *ev;
208 struct rpc_pipe_client *cli;
209 char *data;
210 size_t size;
211 size_t num_read;
212 };
213
214 static void rpc_read_np_done(struct async_req *subreq);
215 static void rpc_read_sock_done(struct async_req *subreq);
216
217 static struct async_req *rpc_read_send(TALLOC_CTX *mem_ctx,
218 struct event_context *ev,
219 struct rpc_pipe_client *cli,
220 char *data, size_t size)
221 {
222 struct async_req *result, *subreq;
223 struct rpc_read_state *state;
224
225 result = async_req_new(mem_ctx);
226 if (result == NULL) {
227 return NULL;
228 }
229 state = talloc(result, struct rpc_read_state);
230 if (state == NULL) {
231 goto fail;
232 }
233 result->private_data = state;
234
235 state->ev = ev;
236 state->cli = cli;
237 state->data = data;
238 state->size = size;
239 state->num_read = 0;
240
241 DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
242
243 if (cli->transport_type == NCACN_NP) {
244 subreq = cli_read_andx_send(
245 state, ev, cli->trans.np.cli,
246 cli->trans.np.fnum, 0, size);
247 if (subreq == NULL) {
248 DEBUG(10, ("cli_read_andx_send failed\n"));
249 goto fail;
250 }
251 subreq->async.fn = rpc_read_np_done;
252 subreq->async.priv = result;
253 return result;
254 }
255
256 if ((cli->transport_type == NCACN_IP_TCP)
257 || (cli->transport_type == NCACN_UNIX_STREAM)) {
258 subreq = recvall_send(state, ev, cli->trans.sock.fd,
259 data, size, 0);
260 if (subreq == NULL) {
261 DEBUG(10, ("recvall_send failed\n"));
262 goto fail;
263 }
264 subreq->async.fn = rpc_read_sock_done;
265 subreq->async.priv = result;
266 return result;
267 }
268
269 if (async_post_status(result, ev, NT_STATUS_INVALID_PARAMETER)) {
270 return result;
271 }
272 fail:
273 TALLOC_FREE(result);
274 return NULL;
275 }
276
277 static void rpc_read_np_done(struct async_req *subreq)
278 {
279 struct async_req *req = talloc_get_type_abort(
280 subreq->async.priv, struct async_req);
281 struct rpc_read_state *state = talloc_get_type_abort(
282 req->private_data, struct rpc_read_state);
283 NTSTATUS status;
284 ssize_t received;
285 uint8_t *rcvbuf;
286
287 status = cli_read_andx_recv(subreq, &received, &rcvbuf);
288 /*
289 * We can't TALLOC_FREE(subreq) as usual here, as rcvbuf still is a
290 * child of that.
291 */
292 if (NT_STATUS_EQUAL(status, NT_STATUS_BUFFER_TOO_SMALL)) {
293 status = NT_STATUS_OK;
294 }
295 if (!NT_STATUS_IS_OK(status)) {
296 TALLOC_FREE(subreq);
297 async_req_error(req, status);
298 return;
299 }
300
301 memcpy(state->data + state->num_read, rcvbuf, received);
302 TALLOC_FREE(subreq);
303
304 state->num_read += received;
305
306 if (state->num_read == state->size) {
307 async_req_done(req);
308 return;
309 }
310
311 subreq = cli_read_andx_send(
312 state, state->ev, state->cli->trans.np.cli,
313 state->cli->trans.np.fnum, 0,
314 state->size - state->num_read);
315
316 if (async_req_nomem(subreq, req)) {
317 return;
318 }
319
320 subreq->async.fn = rpc_read_np_done;
321 subreq->async.priv = req;
322 }
323
324 static void rpc_read_sock_done(struct async_req *subreq)
325 {
326 struct async_req *req = talloc_get_type_abort(
327 subreq->async.priv, struct async_req);
328 NTSTATUS status;
329
330 status = recvall_recv(subreq);
331 TALLOC_FREE(subreq);
332 if (!NT_STATUS_IS_OK(status)) {
333 async_req_error(req, status);
334 return;
335 }
336
337 async_req_done(req);
338 }
339
340 static NTSTATUS rpc_read_recv(struct async_req *req)
341 {
342 return async_req_simple_recv(req);
343 }
344
345 struct rpc_write_state {
346 struct event_context *ev;
347 struct rpc_pipe_client *cli;
348 const char *data;
349 size_t size;
350 size_t num_written;
351 };
352
353 static void rpc_write_np_done(struct async_req *subreq);
354 static void rpc_write_sock_done(struct async_req *subreq);
355
356 static struct async_req *rpc_write_send(TALLOC_CTX *mem_ctx,
357 struct event_context *ev,
358 struct rpc_pipe_client *cli,
359 const char *data, size_t size)
360 {
361 struct async_req *result, *subreq;
362 struct rpc_write_state *state;
363
364 result = async_req_new(mem_ctx);
365 if (result == NULL) {
366 return NULL;
367 }
368 state = talloc(result, struct rpc_write_state);
369 if (state == NULL) {
370 goto fail;
371 }
372 result->private_data = state;
373
374 state->ev = ev;
375 state->cli = cli;
376 state->data = data;
377 state->size = size;
378 state->num_written = 0;
379
380 DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
381
382 if (cli->transport_type == NCACN_NP) {
383 subreq = cli_write_andx_send(
384 state, ev, cli->trans.np.cli,
385 cli->trans.np.fnum, 8, /* 8 means message mode. */
386 (uint8_t *)data, 0, size);
387 if (subreq == NULL) {
388 DEBUG(10, ("cli_write_andx_send failed\n"));
389 goto fail;
390 }
391 subreq->async.fn = rpc_write_np_done;
392 subreq->async.priv = result;
393 return result;
394 }
395
396 if ((cli->transport_type == NCACN_IP_TCP)
397 || (cli->transport_type == NCACN_UNIX_STREAM)) {
398 subreq = sendall_send(state, ev, cli->trans.sock.fd,
399 data, size, 0);
400 if (subreq == NULL) {
401 DEBUG(10, ("sendall_send failed\n"));
402 goto fail;
403 }
404 subreq->async.fn = rpc_write_sock_done;
405 subreq->async.priv = result;
406 return result;
407 }
408
409 if (async_post_status(result, ev, NT_STATUS_INVALID_PARAMETER)) {
410 return result;
411 }
412 fail:
413 TALLOC_FREE(result);
414 return NULL;
415 }
416
417 static void rpc_write_np_done(struct async_req *subreq)
418 {
419 struct async_req *req = talloc_get_type_abort(
420 subreq->async.priv, struct async_req);
421 struct rpc_write_state *state = talloc_get_type_abort(
422 req->private_data, struct rpc_write_state);
423 NTSTATUS status;
424 size_t written;
425
426 status = cli_write_andx_recv(subreq, &written);
427 TALLOC_FREE(subreq);
428 if (!NT_STATUS_IS_OK(status)) {
429 async_req_error(req, status);
430 return;
431 }
432
433 state->num_written += written;
434
435 if (state->num_written == state->size) {
436 async_req_done(req);
437 return;
438 }
439
440 subreq = cli_write_andx_send(
441 state, state->ev, state->cli->trans.np.cli,
442 state->cli->trans.np.fnum, 8,
443 (uint8_t *)(state->data + state->num_written),
444 0, state->size - state->num_written);
445
446 if (async_req_nomem(subreq, req)) {
447 return;
448 }
449
450 subreq->async.fn = rpc_write_np_done;
451 subreq->async.priv = req;
452 }
453
454 static void rpc_write_sock_done(struct async_req *subreq)
455 {
456 struct async_req *req = talloc_get_type_abort(
457 subreq->async.priv, struct async_req);
458 NTSTATUS status;
459
460 status = sendall_recv(subreq);
461 TALLOC_FREE(subreq);
462 if (!NT_STATUS_IS_OK(status)) {
463 async_req_error(req, status);
464 return;
465 }
466
467 async_req_done(req);
468 }
469
470 static NTSTATUS rpc_write_recv(struct async_req *req)
471 {
472 return async_req_simple_recv(req);
473 }
474
475
476 static NTSTATUS parse_rpc_header(struct rpc_pipe_client *cli,
477 struct rpc_hdr_info *prhdr,
478 prs_struct *pdu)
479 {
480 /*
481 * This next call sets the endian bit correctly in current_pdu. We
482 * will propagate this to rbuf later.
483 */
484
485 if(!smb_io_rpc_hdr("rpc_hdr ", prhdr, pdu, 0)) {
486 DEBUG(0, ("get_current_pdu: Failed to unmarshall RPC_HDR.\n"));
487 return NT_STATUS_BUFFER_TOO_SMALL;
488 }
489
490 if (prhdr->frag_len > cli->max_recv_frag) {
491 DEBUG(0, ("cli_pipe_get_current_pdu: Server sent fraglen %d,"
492 " we only allow %d\n", (int)prhdr->frag_len,
493 (int)cli->max_recv_frag));
494 return NT_STATUS_BUFFER_TOO_SMALL;
495 }
496
497 return NT_STATUS_OK;
498 }
499
500 /****************************************************************************
501 Try and get a PDU's worth of data from current_pdu. If not, then read more
502 from the wire.
503 ****************************************************************************/
504
505 struct get_complete_frag_state {
506 struct event_context *ev;
507 struct rpc_pipe_client *cli;
508 struct rpc_hdr_info *prhdr;
509 prs_struct *pdu;
510 };
511
512 static void get_complete_frag_got_header(struct async_req *subreq);
513 static void get_complete_frag_got_rest(struct async_req *subreq);
514
515 static struct async_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
516 struct event_context *ev,
517 struct rpc_pipe_client *cli,
518 struct rpc_hdr_info *prhdr,
519 prs_struct *pdu)
520 {
521 struct async_req *result, *subreq;
522 struct get_complete_frag_state *state;
523 uint32_t pdu_len;
524 NTSTATUS status;
525
526 result = async_req_new(mem_ctx);
527 if (result == NULL) {
528 return NULL;
529 }
530 state = talloc(result, struct get_complete_frag_state);
531 if (state == NULL) {
532 goto fail;
533 }
534 result->private_data = state;
535
536 state->ev = ev;
537 state->cli = cli;
538 state->prhdr = prhdr;
539 state->pdu = pdu;
540
541 pdu_len = prs_data_size(pdu);
542 if (pdu_len < RPC_HEADER_LEN) {
543 if (!rpc_grow_buffer(pdu, RPC_HEADER_LEN)) {
544 status = NT_STATUS_NO_MEMORY;
545 goto post_status;
546 }
547 subreq = rpc_read_send(state, state->ev, state->cli,
548 prs_data_p(state->pdu) + pdu_len,
549 RPC_HEADER_LEN - pdu_len);
550 if (subreq == NULL) {
551 status = NT_STATUS_NO_MEMORY;
552 goto post_status;
553 }
554 subreq->async.fn = get_complete_frag_got_header;
555 subreq->async.priv = result;
556 return result;
557 }
558
559 status = parse_rpc_header(cli, prhdr, pdu);
560 if (!NT_STATUS_IS_OK(status)) {
561 goto post_status;
562 }
563
564 /*
565 * Ensure we have frag_len bytes of data.
566 */
567 if (pdu_len < prhdr->frag_len) {
568 if (!rpc_grow_buffer(pdu, prhdr->frag_len)) {
569 status = NT_STATUS_NO_MEMORY;
570 goto post_status;
571 }
572 subreq = rpc_read_send(state, state->ev, state->cli,
573 prs_data_p(pdu) + pdu_len,
574 prhdr->frag_len - pdu_len);
575 if (subreq == NULL) {
576 status = NT_STATUS_NO_MEMORY;
577 goto post_status;
578 }
579 subreq->async.fn = get_complete_frag_got_rest;
580 subreq->async.priv = result;
581 return result;
582 }
583
584 status = NT_STATUS_OK;
585 post_status:
586 if (async_post_status(result, ev, status)) {
587 return result;
588 }
589 fail:
590 TALLOC_FREE(result);
591 return NULL;
592 }
593
594 static void get_complete_frag_got_header(struct async_req *subreq)
595 {
596 struct async_req *req = talloc_get_type_abort(
597 subreq->async.priv, struct async_req);
598 struct get_complete_frag_state *state = talloc_get_type_abort(
599 req->private_data, struct get_complete_frag_state);
600 NTSTATUS status;
601
602 status = rpc_read_recv(subreq);
603 TALLOC_FREE(subreq);
604 if (!NT_STATUS_IS_OK(status)) {
605 async_req_error(req, status);
606 return;
607 }
608
609 status = parse_rpc_header(state->cli, state->prhdr, state->pdu);
610 if (!NT_STATUS_IS_OK(status)) {
611 async_req_error(req, status);
612 return;
613 }
614
615 if (!rpc_grow_buffer(state->pdu, state->prhdr->frag_len)) {
616 async_req_error(req, NT_STATUS_NO_MEMORY);
617 return;
618 }
619
620 /*
621 * We're here in this piece of code because we've read exactly
622 * RPC_HEADER_LEN bytes into state->pdu.
623 */
624
625 subreq = rpc_read_send(state, state->ev, state->cli,
626 prs_data_p(state->pdu) + RPC_HEADER_LEN,
627 state->prhdr->frag_len - RPC_HEADER_LEN);
628 if (async_req_nomem(subreq, req)) {
629 return;
630 }
631 subreq->async.fn = get_complete_frag_got_rest;
632 subreq->async.priv = req;
633 }
634
635 static void get_complete_frag_got_rest(struct async_req *subreq)
636 {
637 struct async_req *req = talloc_get_type_abort(
638 subreq->async.priv, struct async_req);
639 NTSTATUS status;
640
641 status = rpc_read_recv(subreq);
642 TALLOC_FREE(subreq);
643 if (!NT_STATUS_IS_OK(status)) {
644 async_req_error(req, status);
645 return;
646 }
647 async_req_done(req);
648 }
649
650 static NTSTATUS get_complete_frag_recv(struct async_req *req)
651 {
652 return async_req_simple_recv(req);
653 }
654
655 /****************************************************************************
656 NTLMSSP specific sign/seal.
657 Virtually identical to rpc_server/srv_pipe.c:api_pipe_ntlmssp_auth_process.
658 In fact I should probably abstract these into identical pieces of code... JRA.
659 ****************************************************************************/
660
661 static NTSTATUS cli_pipe_verify_ntlmssp(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
662 prs_struct *current_pdu,
663 uint8 *p_ss_padding_len)
664 {
665 RPC_HDR_AUTH auth_info;
666 uint32 save_offset = prs_offset(current_pdu);
667 uint32 auth_len = prhdr->auth_len;
668 NTLMSSP_STATE *ntlmssp_state = cli->auth->a_u.ntlmssp_state;
669 unsigned char *data = NULL;
670 size_t data_len;
671 unsigned char *full_packet_data = NULL;
672 size_t full_packet_data_len;
673 DATA_BLOB auth_blob;
674 NTSTATUS status;
675
676 if (cli->auth->auth_level == PIPE_AUTH_LEVEL_NONE
677 || cli->auth->auth_level == PIPE_AUTH_LEVEL_CONNECT) {
678 return NT_STATUS_OK;
679 }
680
681 if (!ntlmssp_state) {
682 return NT_STATUS_INVALID_PARAMETER;
683 }
684
685 /* Ensure there's enough data for an authenticated response. */
686 if ((auth_len > RPC_MAX_SIGN_SIZE) ||
687 (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) {
688 DEBUG(0,("cli_pipe_verify_ntlmssp: auth_len %u is too large.\n",
689 (unsigned int)auth_len ));
690 return NT_STATUS_BUFFER_TOO_SMALL;
691 }
692
693 /*
694 * We need the full packet data + length (minus auth stuff) as well as the packet data + length
695 * after the RPC header.
696 * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
697 * functions as NTLMv2 checks the rpc headers also.
698 */
699
700 data = (unsigned char *)(prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN);
701 data_len = (size_t)(prhdr->frag_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len);
702
703 full_packet_data = (unsigned char *)prs_data_p(current_pdu);
704 full_packet_data_len = prhdr->frag_len - auth_len;
705
706 /* Pull the auth header and the following data into a blob. */
707 if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) {
708 DEBUG(0,("cli_pipe_verify_ntlmssp: cannot move offset to %u.\n",
709 (unsigned int)RPC_HEADER_LEN + (unsigned int)RPC_HDR_RESP_LEN + (unsigned int)data_len ));
710 return NT_STATUS_BUFFER_TOO_SMALL;
711 }
712
713 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) {
714 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unmarshall RPC_HDR_AUTH.\n"));
715 return NT_STATUS_BUFFER_TOO_SMALL;
716 }
717
718 auth_blob.data = (unsigned char *)prs_data_p(current_pdu) + prs_offset(current_pdu);
719 auth_blob.length = auth_len;
720
721 switch (cli->auth->auth_level) {
722 case PIPE_AUTH_LEVEL_PRIVACY:
723 /* Data is encrypted. */
724 status = ntlmssp_unseal_packet(ntlmssp_state,
725 data, data_len,
726 full_packet_data,
727 full_packet_data_len,
728 &auth_blob);
729 if (!NT_STATUS_IS_OK(status)) {
730 DEBUG(0,("cli_pipe_verify_ntlmssp: failed to unseal "
731 "packet from %s. Error was %s.\n",
732 rpccli_pipe_txt(debug_ctx(), cli),
733 nt_errstr(status) ));
734 return status;
735 }
736 break;
737 case PIPE_AUTH_LEVEL_INTEGRITY:
738 /* Data is signed. */
739 status = ntlmssp_check_packet(ntlmssp_state,
740 data, data_len,
741 full_packet_data,
742 full_packet_data_len,
743 &auth_blob);
744 if (!NT_STATUS_IS_OK(status)) {
745 DEBUG(0,("cli_pipe_verify_ntlmssp: check signing failed on "
746 "packet from %s. Error was %s.\n",
747 rpccli_pipe_txt(debug_ctx(), cli),
748 nt_errstr(status) ));
749 return status;
750 }
751 break;
752 default:
753 DEBUG(0, ("cli_pipe_verify_ntlmssp: unknown internal "
754 "auth level %d\n", cli->auth->auth_level));
755 return NT_STATUS_INVALID_INFO_CLASS;
756 }
757
758 /*
759 * Return the current pointer to the data offset.
760 */
761
762 if(!prs_set_offset(current_pdu, save_offset)) {
763 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
764 (unsigned int)save_offset ));
765 return NT_STATUS_BUFFER_TOO_SMALL;
766 }
767
768 /*
769 * Remember the padding length. We must remove it from the real data
770 * stream once the sign/seal is done.
771 */
772
773 *p_ss_padding_len = auth_info.auth_pad_len;
774
775 return NT_STATUS_OK;
776 }
777
778 /****************************************************************************
779 schannel specific sign/seal.
780 ****************************************************************************/
781
782 static NTSTATUS cli_pipe_verify_schannel(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
783 prs_struct *current_pdu,
784 uint8 *p_ss_padding_len)
785 {
786 RPC_HDR_AUTH auth_info;
787 RPC_AUTH_SCHANNEL_CHK schannel_chk;
788 uint32 auth_len = prhdr->auth_len;
789 uint32 save_offset = prs_offset(current_pdu);
790 struct schannel_auth_struct *schannel_auth =
791 cli->auth->a_u.schannel_auth;
792 uint32 data_len;
793
794 if (cli->auth->auth_level == PIPE_AUTH_LEVEL_NONE
795 || cli->auth->auth_level == PIPE_AUTH_LEVEL_CONNECT) {
796 return NT_STATUS_OK;
797 }
798
799 if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
800 DEBUG(0,("cli_pipe_verify_schannel: auth_len %u.\n", (unsigned int)auth_len ));
801 return NT_STATUS_INVALID_PARAMETER;
802 }
803
804 if (!schannel_auth) {
805 return NT_STATUS_INVALID_PARAMETER;
806 }
807
808 /* Ensure there's enough data for an authenticated response. */
809 if ((auth_len > RPC_MAX_SIGN_SIZE) ||
810 (RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_AUTH_LEN + auth_len > prhdr->frag_len)) {
811 DEBUG(0,("cli_pipe_verify_schannel: auth_len %u is too large.\n",
812 (unsigned int)auth_len ));
813 return NT_STATUS_INVALID_PARAMETER;
814 }
815
816 data_len = prhdr->frag_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len;
817
818 if(!prs_set_offset(current_pdu, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len)) {
819 DEBUG(0,("cli_pipe_verify_schannel: cannot move offset to %u.\n",
820 (unsigned int)RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len ));
821 return NT_STATUS_BUFFER_TOO_SMALL;
822 }
823
824 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, current_pdu, 0)) {
825 DEBUG(0,("cli_pipe_verify_schannel: failed to unmarshall RPC_HDR_AUTH.\n"));
826 return NT_STATUS_BUFFER_TOO_SMALL;
827 }
828
829 if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
830 DEBUG(0,("cli_pipe_verify_schannel: Invalid auth info %d on schannel\n",
831 auth_info.auth_type));
832 return NT_STATUS_BUFFER_TOO_SMALL;
833 }
834
835 if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
836 &schannel_chk, current_pdu, 0)) {
837 DEBUG(0,("cli_pipe_verify_schannel: failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
838 return NT_STATUS_BUFFER_TOO_SMALL;
839 }
840
841 if (!schannel_decode(schannel_auth,
842 cli->auth->auth_level,
843 SENDER_IS_ACCEPTOR,
844 &schannel_chk,
845 prs_data_p(current_pdu)+RPC_HEADER_LEN+RPC_HDR_RESP_LEN,
846 data_len)) {
847 DEBUG(3,("cli_pipe_verify_schannel: failed to decode PDU "
848 "Connection to %s.\n",
849 rpccli_pipe_txt(debug_ctx(), cli)));
850 return NT_STATUS_INVALID_PARAMETER;
851 }
852
853 /* The sequence number gets incremented on both send and receive. */
854 schannel_auth->seq_num++;
855
856 /*
857 * Return the current pointer to the data offset.
858 */
859
860 if(!prs_set_offset(current_pdu, save_offset)) {
861 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
862 (unsigned int)save_offset ));
863 return NT_STATUS_BUFFER_TOO_SMALL;
864 }
865
866 /*
867 * Remember the padding length. We must remove it from the real data
868 * stream once the sign/seal is done.
869 */
870
871 *p_ss_padding_len = auth_info.auth_pad_len;
872
873 return NT_STATUS_OK;
874 }
875
876 /****************************************************************************
877 Do the authentication checks on an incoming pdu. Check sign and unseal etc.
878 ****************************************************************************/
879
880 static NTSTATUS cli_pipe_validate_rpc_response(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
881 prs_struct *current_pdu,
882 uint8 *p_ss_padding_len)
883 {
884 NTSTATUS ret = NT_STATUS_OK;
885
886 /* Paranioa checks for auth_len. */
887 if (prhdr->auth_len) {
888 if (prhdr->auth_len > prhdr->frag_len) {
889 return NT_STATUS_INVALID_PARAMETER;
890 }
891
892 if (prhdr->auth_len + (unsigned int)RPC_HDR_AUTH_LEN < prhdr->auth_len ||
893 prhdr->auth_len + (unsigned int)RPC_HDR_AUTH_LEN < (unsigned int)RPC_HDR_AUTH_LEN) {
894 /* Integer wrap attempt. */
895 return NT_STATUS_INVALID_PARAMETER;
896 }
897 }
898
899 /*
900 * Now we have a complete RPC request PDU fragment, try and verify any auth data.
901 */
902
903 switch(cli->auth->auth_type) {
904 case PIPE_AUTH_TYPE_NONE:
905 if (prhdr->auth_len) {
906 DEBUG(3, ("cli_pipe_validate_rpc_response: "
907 "Connection to %s - got non-zero "
908 "auth len %u.\n",
909 rpccli_pipe_txt(debug_ctx(), cli),
910 (unsigned int)prhdr->auth_len ));
911 return NT_STATUS_INVALID_PARAMETER;
912 }
913 break;
914
915 case PIPE_AUTH_TYPE_NTLMSSP:
916 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
917 ret = cli_pipe_verify_ntlmssp(cli, prhdr, current_pdu, p_ss_padding_len);
918 if (!NT_STATUS_IS_OK(ret)) {
919 return ret;
920 }
921 break;
922
923 case PIPE_AUTH_TYPE_SCHANNEL:
924 ret = cli_pipe_verify_schannel(cli, prhdr, current_pdu, p_ss_padding_len);
925 if (!NT_STATUS_IS_OK(ret)) {
926 return ret;
927 }
928 break;
929
930 case PIPE_AUTH_TYPE_KRB5:
931 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
932 default:
933 DEBUG(3, ("cli_pipe_validate_rpc_response: Connection "
934 "to %s - unknown internal auth type %u.\n",
935 rpccli_pipe_txt(debug_ctx(), cli),
936 cli->auth->auth_type ));
937 return NT_STATUS_INVALID_INFO_CLASS;
938 }
939
940 return NT_STATUS_OK;
941 }
942
943 /****************************************************************************
944 Do basic authentication checks on an incoming pdu.
945 ****************************************************************************/
946
947 static NTSTATUS cli_pipe_validate_current_pdu(struct rpc_pipe_client *cli, RPC_HDR *prhdr,
948 prs_struct *current_pdu,
949 uint8 expected_pkt_type,
950 char **ppdata,
951 uint32 *pdata_len,
952 prs_struct *return_data)
953 {
954
955 NTSTATUS ret = NT_STATUS_OK;
956 uint32 current_pdu_len = prs_data_size(current_pdu);
957
958 if (current_pdu_len != prhdr->frag_len) {
959 DEBUG(5,("cli_pipe_validate_current_pdu: incorrect pdu length %u, expected %u\n",
960 (unsigned int)current_pdu_len, (unsigned int)prhdr->frag_len ));
961 return NT_STATUS_INVALID_PARAMETER;
962 }
963
964 /*
965 * Point the return values at the real data including the RPC
966 * header. Just in case the caller wants it.
967 */
968 *ppdata = prs_data_p(current_pdu);
969 *pdata_len = current_pdu_len;
970
971 /* Ensure we have the correct type. */
972 switch (prhdr->pkt_type) {
973 case RPC_ALTCONTRESP:
974 case RPC_BINDACK:
975
976 /* Alter context and bind ack share the same packet definitions. */
977 break;
978
979
980 case RPC_RESPONSE:
981 {
982 RPC_HDR_RESP rhdr_resp;
983 uint8 ss_padding_len = 0;
984
985 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, current_pdu, 0)) {
986 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_RESP.\n"));
987 return NT_STATUS_BUFFER_TOO_SMALL;
988 }
989
990 /* Here's where we deal with incoming sign/seal. */
991 ret = cli_pipe_validate_rpc_response(cli, prhdr,
992 current_pdu, &ss_padding_len);
993 if (!NT_STATUS_IS_OK(ret)) {
994 return ret;
995 }
996
997 /* Point the return values at the NDR data. Remember to remove any ss padding. */
998 *ppdata = prs_data_p(current_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
999
1000 if (current_pdu_len < RPC_HEADER_LEN + RPC_HDR_RESP_LEN + ss_padding_len) {
1001 return NT_STATUS_BUFFER_TOO_SMALL;
1002 }
1003
1004 *pdata_len = current_pdu_len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - ss_padding_len;
1005
1006 /* Remember to remove the auth footer. */
1007 if (prhdr->auth_len) {
1008 /* We've already done integer wrap tests on auth_len in
1009 cli_pipe_validate_rpc_response(). */
1010 if (*pdata_len < RPC_HDR_AUTH_LEN + prhdr->auth_len) {
1011 return NT_STATUS_BUFFER_TOO_SMALL;
1012 }
1013 *pdata_len -= (RPC_HDR_AUTH_LEN + prhdr->auth_len);
1014 }
1015
1016 DEBUG(10,("cli_pipe_validate_current_pdu: got pdu len %u, data_len %u, ss_len %u\n",
1017 current_pdu_len, *pdata_len, ss_padding_len ));
1018
1019 /*
1020 * If this is the first reply, and the allocation hint is reasonably, try and
1021 * set up the return_data parse_struct to the correct size.
1022 */
1023
1024 if ((prs_data_size(return_data) == 0) && rhdr_resp.alloc_hint && (rhdr_resp.alloc_hint < 15*1024*1024)) {
1025 if (!prs_set_buffer_size(return_data, rhdr_resp.alloc_hint)) {
1026 DEBUG(0,("cli_pipe_validate_current_pdu: reply alloc hint %u "
1027 "too large to allocate\n",
1028 (unsigned int)rhdr_resp.alloc_hint ));
1029 return NT_STATUS_NO_MEMORY;
1030 }
1031 }
1032
1033 break;
1034 }
1035
1036 case RPC_BINDNACK:
1037 DEBUG(1, ("cli_pipe_validate_current_pdu: Bind NACK "
1038 "received from %s!\n",
1039 rpccli_pipe_txt(debug_ctx(), cli)));
1040 /* Use this for now... */
1041 return NT_STATUS_NETWORK_ACCESS_DENIED;
1042
1043 case RPC_FAULT:
1044 {
1045 RPC_HDR_RESP rhdr_resp;
1046 RPC_HDR_FAULT fault_resp;
1047
1048 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, current_pdu, 0)) {
1049 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_RESP.\n"));
1050 return NT_STATUS_BUFFER_TOO_SMALL;
1051 }
1052
1053 if(!smb_io_rpc_hdr_fault("fault", &fault_resp, current_pdu, 0)) {
1054 DEBUG(5,("cli_pipe_validate_current_pdu: failed to unmarshal RPC_HDR_FAULT.\n"));
1055 return NT_STATUS_BUFFER_TOO_SMALL;
1056 }
1057
1058 DEBUG(1, ("cli_pipe_validate_current_pdu: RPC fault "
1059 "code %s received from %s!\n",
1060 dcerpc_errstr(debug_ctx(), NT_STATUS_V(fault_resp.status)),
1061 rpccli_pipe_txt(debug_ctx(), cli)));
1062 if (NT_STATUS_IS_OK(fault_resp.status)) {
1063 return NT_STATUS_UNSUCCESSFUL;
1064 } else {
1065 return fault_resp.status;
1066 }
1067 }
1068
1069 default:
1070 DEBUG(0, ("cli_pipe_validate_current_pdu: unknown packet type %u received "
1071 "from %s!\n",
1072 (unsigned int)prhdr->pkt_type,
1073 rpccli_pipe_txt(debug_ctx(), cli)));
1074 return NT_STATUS_INVALID_INFO_CLASS;
1075 }
1076
1077 if (prhdr->pkt_type != expected_pkt_type) {
1078 DEBUG(3, ("cli_pipe_validate_current_pdu: Connection to %s "
1079 "got an unexpected RPC packet type - %u, not %u\n",
1080 rpccli_pipe_txt(debug_ctx(), cli),
1081 prhdr->pkt_type,
1082 expected_pkt_type));
1083 return NT_STATUS_INVALID_INFO_CLASS;
1084 }
1085
1086 /* Do this just before return - we don't want to modify any rpc header
1087 data before now as we may have needed to do cryptographic actions on
1088 it before. */
1089
1090 if ((prhdr->pkt_type == RPC_BINDACK) && !(prhdr->flags & RPC_FLG_LAST)) {
1091 DEBUG(5,("cli_pipe_validate_current_pdu: bug in server (AS/U?), "
1092 "setting fragment first/last ON.\n"));
1093 prhdr->flags |= RPC_FLG_FIRST|RPC_FLG_LAST;
1094 }
1095
1096 return NT_STATUS_OK;
1097 }
1098
1099 /****************************************************************************
1100 Ensure we eat the just processed pdu from the current_pdu prs_struct.
1101 Normally the frag_len and buffer size will match, but on the first trans
1102 reply there is a theoretical chance that buffer size > frag_len, so we must
1103 deal with that.
1104 ****************************************************************************/
1105
1106 static NTSTATUS cli_pipe_reset_current_pdu(struct rpc_pipe_client *cli, RPC_HDR *prhdr, prs_struct *current_pdu)
1107 {
1108 uint32 current_pdu_len = prs_data_size(current_pdu);
1109
1110 if (current_pdu_len < prhdr->frag_len) {
1111 return NT_STATUS_BUFFER_TOO_SMALL;
1112 }
1113
1114 /* Common case. */
1115 if (current_pdu_len == (uint32)prhdr->frag_len) {
1116 prs_mem_free(current_pdu);
1117 prs_init_empty(current_pdu, prs_get_mem_context(current_pdu), UNMARSHALL);
1118 /* Make current_pdu dynamic with no memory. */
1119 prs_give_memory(current_pdu, 0, 0, True);
1120 return NT_STATUS_OK;
1121 }
1122
1123 /*
1124 * Oh no ! More data in buffer than we processed in current pdu.
1125 * Cheat. Move the data down and shrink the buffer.
1126 */
1127
1128 memcpy(prs_data_p(current_pdu), prs_data_p(current_pdu) + prhdr->frag_len,
1129 current_pdu_len - prhdr->frag_len);
1130
1131 /* Remember to set the read offset back to zero. */
1132 prs_set_offset(current_pdu, 0);
1133
1134 /* Shrink the buffer. */
1135 if (!prs_set_buffer_size(current_pdu, current_pdu_len - prhdr->frag_len)) {
1136 return NT_STATUS_BUFFER_TOO_SMALL;
1137 }
1138
1139 return NT_STATUS_OK;
1140 }
1141
1142 /****************************************************************************
1143 Call a remote api on an arbitrary pipe. takes param, data and setup buffers.
1144 ****************************************************************************/
1145
1146 struct cli_api_pipe_state {
1147 struct event_context *ev;
1148 struct rpc_pipe_client *cli;
1149 uint32_t max_rdata_len;
1150 uint8_t *rdata;
1151 uint32_t rdata_len;
1152 };
1153
1154 static void cli_api_pipe_np_trans_done(struct async_req *subreq);
1155 static void cli_api_pipe_sock_send_done(struct async_req *subreq);
1156 static void cli_api_pipe_sock_read_done(struct async_req *subreq);
1157
1158 static struct async_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
1159 struct event_context *ev,
1160 struct rpc_pipe_client *cli,
1161 uint8_t *data, size_t data_len,
1162 uint32_t max_rdata_len)
1163 {
1164 struct async_req *result, *subreq;
1165 struct cli_api_pipe_state *state;
1166 NTSTATUS status;
1167
1168 result = async_req_new(mem_ctx);
1169 if (result == NULL) {
1170 return NULL;
1171 }
1172 state = talloc(result, struct cli_api_pipe_state);
1173 if (state == NULL) {
1174 goto fail;
1175 }
1176 result->private_data = state;
1177
1178 state->ev = ev;
1179 state->cli = cli;
1180 state->max_rdata_len = max_rdata_len;
1181
1182 if (state->max_rdata_len < RPC_HEADER_LEN) {
1183 /*
1184 * For a RPC reply we always need at least RPC_HEADER_LEN
1185 * bytes. We check this here because we will receive
1186 * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
1187 */
1188 status = NT_STATUS_INVALID_PARAMETER;
1189 goto post_status;
1190 }
1191
1192 if (cli->transport_type == NCACN_NP) {
1193
1194 uint16_t setup[2];
1195 SSVAL(setup+0, 0, TRANSACT_DCERPCCMD);
1196 SSVAL(setup+1, 0, cli->trans.np.fnum);
1197
1198 subreq = cli_trans_send(
1199 state, ev, cli->trans.np.cli, SMBtrans,
1200 "\\PIPE\\", 0, 0, 0, setup, 2, 0,
1201 NULL, 0, 0, data, data_len, max_rdata_len);
1202 if (subreq == NULL) {
1203 status = NT_STATUS_NO_MEMORY;
1204 goto post_status;
1205 }
1206 subreq->async.fn = cli_api_pipe_np_trans_done;
1207 subreq->async.priv = result;
1208 return result;
1209 }
1210
1211 if ((cli->transport_type == NCACN_IP_TCP)
1212 || (cli->transport_type == NCACN_UNIX_STREAM)) {
1213 subreq = sendall_send(state, ev, cli->trans.sock.fd,
1214 data, data_len, 0);
1215 if (subreq == NULL) {
1216 status = NT_STATUS_NO_MEMORY;
1217 goto post_status;
1218 }
1219 subreq->async.fn = cli_api_pipe_sock_send_done;
1220 subreq->async.priv = result;
1221 return result;
1222 }
1223
1224 status = NT_STATUS_INVALID_PARAMETER;
1225
1226 post_status:
1227 if (async_post_status(result, ev, status)) {
1228 return result;
1229 }
1230 fail:
1231 TALLOC_FREE(result);
1232 return NULL;
1233 }
1234
1235 static void cli_api_pipe_np_trans_done(struct async_req *subreq)
1236 {
1237 struct async_req *req = talloc_get_type_abort(
1238 subreq->async.priv, struct async_req);
1239 struct cli_api_pipe_state *state = talloc_get_type_abort(
1240 req->private_data, struct cli_api_pipe_state);
1241 NTSTATUS status;
1242
1243 status = cli_trans_recv(subreq, state, NULL, NULL, NULL, NULL,
1244 &state->rdata, &state->rdata_len);
1245 TALLOC_FREE(subreq);
1246 if (!NT_STATUS_IS_OK(status)) {
1247 async_req_error(req, status);
1248 return;
1249 }
1250 async_req_done(req);
1251 }
1252
1253 static void cli_api_pipe_sock_send_done(struct async_req *subreq)
1254 {
1255 struct async_req *req = talloc_get_type_abort(
1256 subreq->async.priv, struct async_req);
1257 struct cli_api_pipe_state *state = talloc_get_type_abort(
1258 req->private_data, struct cli_api_pipe_state);
1259 NTSTATUS status;
1260
1261 status = sendall_recv(subreq);
1262 TALLOC_FREE(subreq);
1263 if (!NT_STATUS_IS_OK(status)) {
1264 async_req_error(req, status);
1265 return;
1266 }
1267
1268 state->rdata = TALLOC_ARRAY(state, uint8_t, RPC_HEADER_LEN);
1269 if (async_req_nomem(state->rdata, req)) {
1270 return;
1271 }
1272 state->rdata_len = RPC_HEADER_LEN;
1273
1274 subreq = recvall_send(state, state->ev, state->cli->trans.sock.fd,
1275 state->rdata, RPC_HEADER_LEN, 0);
1276 if (async_req_nomem(subreq, req)) {
1277 return;
1278 }
1279 subreq->async.fn = cli_api_pipe_sock_read_done;
1280 subreq->async.priv = req;
1281 }
1282
1283 static void cli_api_pipe_sock_read_done(struct async_req *subreq)
1284 {
1285 struct async_req *req = talloc_get_type_abort(
1286 subreq->async.priv, struct async_req);
1287 NTSTATUS status;
1288
1289 status = recvall_recv(subreq);
1290 TALLOC_FREE(subreq);
1291 if (!NT_STATUS_IS_OK(status)) {
1292 async_req_error(req, status);
1293 return;
1294 }
1295 async_req_done(req);
1296 }
1297
1298 static NTSTATUS cli_api_pipe_recv(struct async_req *req, TALLOC_CTX *mem_ctx,
1299 uint8_t **prdata, uint32_t *prdata_len)
1300 {
1301 struct cli_api_pipe_state *state = talloc_get_type_abort(
1302 req->private_data, struct cli_api_pipe_state);
1303 NTSTATUS status;
1304
1305 if (async_req_is_error(req, &status)) {
1306 return status;
1307 }
1308
1309 *prdata = talloc_move(mem_ctx, &state->rdata);
1310 *prdata_len = state->rdata_len;
1311 return NT_STATUS_OK;
1312 }
1313
1314 /****************************************************************************
1315 Send data on an rpc pipe via trans. The prs_struct data must be the last
1316 pdu fragment of an NDR data stream.
1317
1318 Receive response data from an rpc pipe, which may be large...
1319
1320 Read the first fragment: unfortunately have to use SMBtrans for the first
1321 bit, then SMBreadX for subsequent bits.
1322
1323 If first fragment received also wasn't the last fragment, continue
1324 getting fragments until we _do_ receive the last fragment.
1325
1326 Request/Response PDU's look like the following...
1327
1328 |<------------------PDU len----------------------------------------------->|
1329 |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
1330
1331 +------------+-----------------+-------------+---------------+-------------+
1332 | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR | AUTH DATA |
1333 +------------+-----------------+-------------+---------------+-------------+
1334
1335 Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
1336 signing & sealing being negotiated.
1337
1338 ****************************************************************************/
1339
1340 struct rpc_api_pipe_state {
1341 struct event_context *ev;
1342 struct rpc_pipe_client *cli;
1343 uint8_t expected_pkt_type;
1344
1345 prs_struct incoming_frag;
1346 struct rpc_hdr_info rhdr;
1347
1348 prs_struct incoming_pdu; /* Incoming reply */
1349 uint32_t incoming_pdu_offset;
1350 };
1351
1352 static int rpc_api_pipe_state_destructor(struct rpc_api_pipe_state *state)
1353 {
1354 prs_mem_free(&state->incoming_frag);
1355 prs_mem_free(&state->incoming_pdu);
1356 return 0;
1357 }
1358
1359 static void rpc_api_pipe_trans_done(struct async_req *subreq);
1360 static void rpc_api_pipe_got_pdu(struct async_req *subreq);
1361
1362 static struct async_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
1363 struct event_context *ev,
1364 struct rpc_pipe_client *cli,
1365 prs_struct *data, /* Outgoing PDU */
1366 uint8_t expected_pkt_type)
1367 {
1368 struct async_req *result, *subreq;
1369 struct rpc_api_pipe_state *state;
1370 uint16_t max_recv_frag;
1371 NTSTATUS status;
1372
1373 result = async_req_new(mem_ctx);
1374 if (result == NULL) {
1375 return NULL;
1376 }
1377 state = talloc(result, struct rpc_api_pipe_state);
1378 if (state == NULL) {
1379 goto fail;
1380 }
1381 result->private_data = state;
1382
1383 state->ev = ev;
1384 state->cli = cli;
1385 state->expected_pkt_type = expected_pkt_type;
1386 state->incoming_pdu_offset = 0;
1387
1388 prs_init_empty(&state->incoming_frag, state, UNMARSHALL);
1389
1390 prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
1391 /* Make incoming_pdu dynamic with no memory. */
1392 prs_give_memory(&state->incoming_pdu, 0, 0, true);
1393
1394 talloc_set_destructor(state, rpc_api_pipe_state_destructor);
1395
1396 /*
1397 * Ensure we're not sending too much.
1398 */
1399 if (prs_offset(data) > cli->max_xmit_frag) {
1400 status = NT_STATUS_INVALID_PARAMETER;
1401 goto post_status;
1402 }
1403
1404 DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(debug_ctx(), cli)));
1405
1406 max_recv_frag = cli->max_recv_frag;
1407
1408 #ifdef DEVELOPER
1409 max_recv_frag = RPC_HEADER_LEN + 10 + (sys_random() % 32);
1410 #endif
1411
1412 subreq = cli_api_pipe_send(state, ev, cli, (uint8_t *)prs_data_p(data),
1413 prs_offset(data), max_recv_frag);
1414 if (subreq == NULL) {
1415 status = NT_STATUS_NO_MEMORY;
1416 goto post_status;
1417 }
1418 subreq->async.fn = rpc_api_pipe_trans_done;
1419 subreq->async.priv = result;
1420 return result;
1421
1422 post_status:
1423 if (async_post_status(result, ev, status)) {
1424 return result;
1425 }
1426 fail:
1427 TALLOC_FREE(result);
1428 return NULL;
1429 }
1430
1431 static void rpc_api_pipe_trans_done(struct async_req *subreq)
1432 {
1433 struct async_req *req = talloc_get_type_abort(
1434 subreq->async.priv, struct async_req);
1435 struct rpc_api_pipe_state *state = talloc_get_type_abort(
1436 req->private_data, struct rpc_api_pipe_state);
1437 NTSTATUS status;
1438 uint8_t *rdata = NULL;
1439 uint32_t rdata_len = 0;
1440 char *rdata_copy;
1441
1442 status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
1443 TALLOC_FREE(subreq);
1444 if (!NT_STATUS_IS_OK(status)) {
1445 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
1446 async_req_error(req, status);
1447 return;
1448 }
1449
1450 if (rdata == NULL) {
1451 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
1452 rpccli_pipe_txt(debug_ctx(), state->cli)));
1453 async_req_done(req);
1454 return;
1455 }
1456
1457 /*
1458 * Give the memory received from cli_trans as dynamic to the current
1459 * pdu. Duplicating it sucks, but prs_struct doesn't know about talloc
1460 * :-(
1461 */
1462 rdata_copy = (char *)memdup(rdata, rdata_len);
1463 TALLOC_FREE(rdata);
1464 if (async_req_nomem(rdata_copy, req)) {
1465 return;
1466 }
1467 prs_give_memory(&state->incoming_frag, rdata_copy, rdata_len, true);
1468
1469 /* Ensure we have enough data for a pdu. */
1470 subreq = get_complete_frag_send(state, state->ev, state->cli,
1471 &state->rhdr, &state->incoming_frag);
1472 if (async_req_nomem(subreq, req)) {
1473 return;
1474 }
1475 subreq->async.fn = rpc_api_pipe_got_pdu;
1476 subreq->async.priv = req;
1477 }
1478
1479 static void rpc_api_pipe_got_pdu(struct async_req *subreq)
1480 {
1481 struct async_req *req = talloc_get_type_abort(
1482 subreq->async.priv, struct async_req);
1483 struct rpc_api_pipe_state *state = talloc_get_type_abort(
1484 req->private_data, struct rpc_api_pipe_state);
1485 NTSTATUS status;
1486 char *rdata = NULL;
1487 uint32_t rdata_len = 0;
1488
1489 status = get_complete_frag_recv(subreq);
1490 TALLOC_FREE(subreq);
1491 if (!NT_STATUS_IS_OK(status)) {
1492 DEBUG(5, ("get_complete_frag failed: %s\n",
1493 nt_errstr(status)));
1494 async_req_error(req, status);
1495 return;
1496 }
1497
1498 status = cli_pipe_validate_current_pdu(
1499 state->cli, &state->rhdr, &state->incoming_frag,
1500 state->expected_pkt_type, &rdata, &rdata_len,
1501 &state->incoming_pdu);
1502
1503 DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
1504 (unsigned)prs_data_size(&state->incoming_frag),
1505 (unsigned)state->incoming_pdu_offset,
1506 nt_errstr(status)));
1507
1508 if (!NT_STATUS_IS_OK(status)) {
1509 async_req_error(req, status);
1510 return;
1511 }
1512
1513 if ((state->rhdr.flags & RPC_FLG_FIRST)
1514 && (state->rhdr.pack_type[0] == 0)) {
1515 /*
1516 * Set the data type correctly for big-endian data on the
1517 * first packet.
1518 */
1519 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
1520 "big-endian.\n",
1521 rpccli_pipe_txt(debug_ctx(), state->cli)));
1522 prs_set_endian_data(&state->incoming_pdu, RPC_BIG_ENDIAN);
1523 }
1524 /*
1525 * Check endianness on subsequent packets.
1526 */
1527 if (state->incoming_frag.bigendian_data
1528 != state->incoming_pdu.bigendian_data) {
1529 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
1530 "%s\n",
1531 state->incoming_pdu.bigendian_data?"big":"little",
1532 state->incoming_frag.bigendian_data?"big":"little"));
1533 async_req_error(req, NT_STATUS_INVALID_PARAMETER);
1534 return;
1535 }
1536
1537 /* Now copy the data portion out of the pdu into rbuf. */
1538 if (!prs_force_grow(&state->incoming_pdu, rdata_len)) {
1539 async_req_error(req, NT_STATUS_NO_MEMORY);
1540 return;
1541 }
1542
1543 memcpy(prs_data_p(&state->incoming_pdu) + state->incoming_pdu_offset,
1544 rdata, (size_t)rdata_len);
1545 state->incoming_pdu_offset += rdata_len;
1546
1547 status = cli_pipe_reset_current_pdu(state->cli, &state->rhdr,
1548 &state->incoming_frag);
1549 if (!NT_STATUS_IS_OK(status)) {
1550 async_req_error(req, status);
1551 return;
1552 }
1553
1554 if (state->rhdr.flags & RPC_FLG_LAST) {
1555 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
1556 rpccli_pipe_txt(debug_ctx(), state->cli),
1557 (unsigned)prs_data_size(&state->incoming_pdu)));
1558 async_req_done(req);
1559 return;
1560 }
1561
1562 subreq = get_complete_frag_send(state, state->ev, state->cli,
1563 &state->rhdr, &state->incoming_frag);
1564 if (async_req_nomem(subreq, req)) {
1565 return;
1566 }
1567 subreq->async.fn = rpc_api_pipe_got_pdu;
1568 subreq->async.priv = req;
1569 }
1570
1571 static NTSTATUS rpc_api_pipe_recv(struct async_req *req, TALLOC_CTX *mem_ctx,
1572 prs_struct *reply_pdu)
1573 {
1574 struct rpc_api_pipe_state *state = talloc_get_type_abort(
1575 req->private_data, struct rpc_api_pipe_state);
1576 NTSTATUS status;
1577
1578 if (async_req_is_error(req, &status)) {
1579 return status;
1580 }
1581
1582 *reply_pdu = state->incoming_pdu;
1583 reply_pdu->mem_ctx = mem_ctx;
1584
1585 /*
1586 * Prevent state->incoming_pdu from being freed in
1587 * rpc_api_pipe_state_destructor()
1588 */
1589 prs_init_empty(&state->incoming_pdu, state, UNMARSHALL);
1590
1591 return NT_STATUS_OK;
1592 }
1593
1594 /*******************************************************************
1595 Creates krb5 auth bind.
1596 ********************************************************************/
1597
1598 static NTSTATUS create_krb5_auth_bind_req( struct rpc_pipe_client *cli,
1599 enum pipe_auth_level auth_level,
1600 RPC_HDR_AUTH *pauth_out,
1601 prs_struct *auth_data)
1602 {
1603 #ifdef HAVE_KRB5
1604 int ret;
1605 struct kerberos_auth_struct *a = cli->auth->a_u.kerberos_auth;
1606 DATA_BLOB tkt = data_blob_null;
1607 DATA_BLOB tkt_wrapped = data_blob_null;
1608
1609 /* We may change the pad length before marshalling. */
1610 init_rpc_hdr_auth(pauth_out, RPC_KRB5_AUTH_TYPE, (int)auth_level, 0, 1);
1611
1612 DEBUG(5, ("create_krb5_auth_bind_req: creating a service ticket for principal %s\n",
1613 a->service_principal ));
1614
1615 /* Create the ticket for the service principal and return it in a gss-api wrapped blob. */
1616
1617 ret = cli_krb5_get_ticket(a->service_principal, 0, &tkt,
1618 &a->session_key, (uint32)AP_OPTS_MUTUAL_REQUIRED, NULL, NULL);
1619
1620 if (ret) {
1621 DEBUG(1,("create_krb5_auth_bind_req: cli_krb5_get_ticket for principal %s "
1622 "failed with %s\n",
1623 a->service_principal,
1624 error_message(ret) ));
1625
1626 data_blob_free(&tkt);
1627 prs_mem_free(auth_data);
1628 return NT_STATUS_INVALID_PARAMETER;
1629 }
1630
1631 /* wrap that up in a nice GSS-API wrapping */
1632 tkt_wrapped = spnego_gen_krb5_wrap(tkt, TOK_ID_KRB_AP_REQ);
1633
1634 data_blob_free(&tkt);
1635
1636 /* Auth len in the rpc header doesn't include auth_header. */
1637 if (!prs_copy_data_in(auth_data, (char *)tkt_wrapped.data, tkt_wrapped.length)) {
1638 data_blob_free(&tkt_wrapped);
1639 prs_mem_free(auth_data);
1640 return NT_STATUS_NO_MEMORY;
1641 }
1642
1643 DEBUG(5, ("create_krb5_auth_bind_req: Created krb5 GSS blob :\n"));
1644 dump_data(5, tkt_wrapped.data, tkt_wrapped.length);
1645
1646 data_blob_free(&tkt_wrapped);
1647 return NT_STATUS_OK;
1648 #else
1649 return NT_STATUS_INVALID_PARAMETER;
1650 #endif
1651 }
1652
1653 /*******************************************************************
1654 Creates SPNEGO NTLMSSP auth bind.
1655 ********************************************************************/
1656
1657 static NTSTATUS create_spnego_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1658 enum pipe_auth_level auth_level,
1659 RPC_HDR_AUTH *pauth_out,
1660 prs_struct *auth_data)
1661 {
1662 NTSTATUS nt_status;
1663 DATA_BLOB null_blob = data_blob_null;
1664 DATA_BLOB request = data_blob_null;
1665 DATA_BLOB spnego_msg = data_blob_null;
1666
1667 /* We may change the pad length before marshalling. */
1668 init_rpc_hdr_auth(pauth_out, RPC_SPNEGO_AUTH_TYPE, (int)auth_level, 0, 1);
1669
1670 DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1671 nt_status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
1672 null_blob,
1673 &request);
1674
1675 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1676 data_blob_free(&request);
1677 prs_mem_free(auth_data);
1678 return nt_status;
1679 }
1680
1681 /* Wrap this in SPNEGO. */
1682 spnego_msg = gen_negTokenInit(OID_NTLMSSP, request);
1683
1684 data_blob_free(&request);
1685
1686 /* Auth len in the rpc header doesn't include auth_header. */
1687 if (!prs_copy_data_in(auth_data, (char *)spnego_msg.data, spnego_msg.length)) {
1688 data_blob_free(&spnego_msg);
1689 prs_mem_free(auth_data);
1690 return NT_STATUS_NO_MEMORY;
1691 }
1692
1693 DEBUG(5, ("create_spnego_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1694 dump_data(5, spnego_msg.data, spnego_msg.length);
1695
1696 data_blob_free(&spnego_msg);
1697 return NT_STATUS_OK;
1698 }
1699
1700 /*******************************************************************
1701 Creates NTLMSSP auth bind.
1702 ********************************************************************/
1703
1704 static NTSTATUS create_ntlmssp_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1705 enum pipe_auth_level auth_level,
1706 RPC_HDR_AUTH *pauth_out,
1707 prs_struct *auth_data)
1708 {
1709 NTSTATUS nt_status;
1710 DATA_BLOB null_blob = data_blob_null;
1711 DATA_BLOB request = data_blob_null;
1712
1713 /* We may change the pad length before marshalling. */
1714 init_rpc_hdr_auth(pauth_out, RPC_NTLMSSP_AUTH_TYPE, (int)auth_level, 0, 1);
1715
1716 DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1717 nt_status = ntlmssp_update(cli->auth->a_u.ntlmssp_state,
1718 null_blob,
1719 &request);
1720
1721 if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1722 data_blob_free(&request);
1723 prs_mem_free(auth_data);
1724 return nt_status;
1725 }
1726
1727 /* Auth len in the rpc header doesn't include auth_header. */
1728 if (!prs_copy_data_in(auth_data, (char *)request.data, request.length)) {
1729 data_blob_free(&request);
1730 prs_mem_free(auth_data);
1731 return NT_STATUS_NO_MEMORY;
1732 }
1733
1734 DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1735 dump_data(5, request.data, request.length);
1736
1737 data_blob_free(&request);
1738 return NT_STATUS_OK;
1739 }
1740
1741 /*******************************************************************
1742 Creates schannel auth bind.
1743 ********************************************************************/
1744
1745 static NTSTATUS create_schannel_auth_rpc_bind_req( struct rpc_pipe_client *cli,
1746 enum pipe_auth_level auth_level,
1747 RPC_HDR_AUTH *pauth_out,
1748 prs_struct *auth_data)
1749 {
1750 RPC_AUTH_SCHANNEL_NEG schannel_neg;
1751
1752 /* We may change the pad length before marshalling. */
1753 init_rpc_hdr_auth(pauth_out, RPC_SCHANNEL_AUTH_TYPE, (int)auth_level, 0, 1);
1754
1755 /* Use lp_workgroup() if domain not specified */
1756
1757 if (!cli->auth->domain || !cli->auth->domain[0]) {
1758 cli->auth->domain = talloc_strdup(cli, lp_workgroup());
1759 if (cli->auth->domain == NULL) {
1760 return NT_STATUS_NO_MEMORY;
1761 }
1762 }
1763
1764 init_rpc_auth_schannel_neg(&schannel_neg, cli->auth->domain,
1765 global_myname());
1766
1767 /*
1768 * Now marshall the data into the auth parse_struct.
1769 */
1770
1771 if(!smb_io_rpc_auth_schannel_neg("schannel_neg",
1772 &schannel_neg, auth_data, 0)) {
1773 DEBUG(0,("Failed to marshall RPC_AUTH_SCHANNEL_NEG.\n"));
1774 prs_mem_free(auth_data);
1775 return NT_STATUS_NO_MEMORY;
1776 }
1777
1778 return NT_STATUS_OK;
1779 }
1780
1781 /*******************************************************************
1782 Creates the internals of a DCE/RPC bind request or alter context PDU.
1783 ********************************************************************/
1784
1785 static NTSTATUS create_bind_or_alt_ctx_internal(enum RPC_PKT_TYPE pkt_type,
1786 prs_struct *rpc_out,
1787 uint32 rpc_call_id,
1788 const RPC_IFACE *abstract,
1789 const RPC_IFACE *transfer,
1790 RPC_HDR_AUTH *phdr_auth,
1791 prs_struct *pauth_info)
1792 {
1793 RPC_HDR hdr;
1794 RPC_HDR_RB hdr_rb;
1795 RPC_CONTEXT rpc_ctx;
1796 uint16 auth_len = prs_offset(pauth_info);
1797 uint8 ss_padding_len = 0;
1798 uint16 frag_len = 0;
1799
1800 /* create the RPC context. */
1801 init_rpc_context(&rpc_ctx, 0 /* context id */, abstract, transfer);
1802
1803 /* create the bind request RPC_HDR_RB */
1804 init_rpc_hdr_rb(&hdr_rb, RPC_MAX_PDU_FRAG_LEN, RPC_MAX_PDU_FRAG_LEN, 0x0, &rpc_ctx);
1805
1806 /* Start building the frag length. */
1807 frag_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&hdr_rb);
1808
1809 /* Do we need to pad ? */
1810 if (auth_len) {
1811 uint16 data_len = RPC_HEADER_LEN + RPC_HDR_RB_LEN(&hdr_rb);
1812 if (data_len % 8) {
1813 ss_padding_len = 8 - (data_len % 8);
1814 phdr_auth->auth_pad_len = ss_padding_len;
1815 }
1816 frag_len += RPC_HDR_AUTH_LEN + auth_len + ss_padding_len;
1817 }
1818
1819 /* Create the request RPC_HDR */
1820 init_rpc_hdr(&hdr, pkt_type, RPC_FLG_FIRST|RPC_FLG_LAST, rpc_call_id, frag_len, auth_len);
1821
1822 /* Marshall the RPC header */
1823 if(!smb_io_rpc_hdr("hdr" , &hdr, rpc_out, 0)) {
1824 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR.\n"));
1825 return NT_STATUS_NO_MEMORY;
1826 }
1827
1828 /* Marshall the bind request data */
1829 if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_out, 0)) {
1830 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1831 return NT_STATUS_NO_MEMORY;
1832 }
1833
1834 /*
1835 * Grow the outgoing buffer to store any auth info.
1836 */
1837
1838 if(auth_len != 0) {
1839 if (ss_padding_len) {
1840 char pad[8];
1841 memset(pad, '\0', 8);
1842 if (!prs_copy_data_in(rpc_out, pad, ss_padding_len)) {
1843 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall padding.\n"));
1844 return NT_STATUS_NO_MEMORY;
1845 }
1846 }
1847
1848 if(!smb_io_rpc_hdr_auth("hdr_auth", phdr_auth, rpc_out, 0)) {
1849 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_AUTH.\n"));
1850 return NT_STATUS_NO_MEMORY;
1851 }
1852
1853
1854 if(!prs_append_prs_data( rpc_out, pauth_info)) {
1855 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to grow parse struct to add auth.\n"));
1856 return NT_STATUS_NO_MEMORY;
1857 }
1858 }
1859
1860 return NT_STATUS_OK;
1861 }
1862
1863 /*******************************************************************
1864 Creates a DCE/RPC bind request.
1865 ********************************************************************/
1866
1867 static NTSTATUS create_rpc_bind_req(struct rpc_pipe_client *cli,
1868 prs_struct *rpc_out,
1869 uint32 rpc_call_id,
1870 const RPC_IFACE *abstract,
1871 const RPC_IFACE *transfer,
1872 enum pipe_auth_type auth_type,
1873 enum pipe_auth_level auth_level)
1874 {
1875 RPC_HDR_AUTH hdr_auth;
1876 prs_struct auth_info;
1877 NTSTATUS ret = NT_STATUS_OK;
1878
1879 ZERO_STRUCT(hdr_auth);
1880 if (!prs_init(&auth_info, RPC_HDR_AUTH_LEN, prs_get_mem_context(rpc_out), MARSHALL))
1881 return NT_STATUS_NO_MEMORY;
1882
1883 switch (auth_type) {
1884 case PIPE_AUTH_TYPE_SCHANNEL:
1885 ret = create_schannel_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1886 if (!NT_STATUS_IS_OK(ret)) {
1887 prs_mem_free(&auth_info);
1888 return ret;
1889 }
1890 break;
1891
1892 case PIPE_AUTH_TYPE_NTLMSSP:
1893 ret = create_ntlmssp_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1894 if (!NT_STATUS_IS_OK(ret)) {
1895 prs_mem_free(&auth_info);
1896 return ret;
1897 }
1898 break;
1899
1900 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1901 ret = create_spnego_ntlmssp_auth_rpc_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1902 if (!NT_STATUS_IS_OK(ret)) {
1903 prs_mem_free(&auth_info);
1904 return ret;
1905 }
1906 break;
1907
1908 case PIPE_AUTH_TYPE_KRB5:
1909 ret = create_krb5_auth_bind_req(cli, auth_level, &hdr_auth, &auth_info);
1910 if (!NT_STATUS_IS_OK(ret)) {
1911 prs_mem_free(&auth_info);
1912 return ret;
1913 }
1914 break;
1915
1916 case PIPE_AUTH_TYPE_NONE:
1917 break;
1918
1919 default:
1920 /* "Can't" happen. */
1921 return NT_STATUS_INVALID_INFO_CLASS;
1922 }
1923
1924 ret = create_bind_or_alt_ctx_internal(RPC_BIND,
1925 rpc_out,
1926 rpc_call_id,
1927 abstract,
1928 transfer,
1929 &hdr_auth,
1930 &auth_info);
1931
1932 prs_mem_free(&auth_info);
1933 return ret;
1934 }
1935
1936 /*******************************************************************
1937 Create and add the NTLMSSP sign/seal auth header and data.
1938 ********************************************************************/
1939
1940 static NTSTATUS add_ntlmssp_auth_footer(struct rpc_pipe_client *cli,
1941 RPC_HDR *phdr,
1942 uint32 ss_padding_len,
1943 prs_struct *outgoing_pdu)
1944 {
1945 RPC_HDR_AUTH auth_info;
1946 NTSTATUS status;
1947 DATA_BLOB auth_blob = data_blob_null;
1948 uint16 data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
1949
1950 if (!cli->auth->a_u.ntlmssp_state) {
1951 return NT_STATUS_INVALID_PARAMETER;
1952 }
1953
1954 /* Init and marshall the auth header. */
1955 init_rpc_hdr_auth(&auth_info,
1956 map_pipe_auth_type_to_rpc_auth_type(
1957 cli->auth->auth_type),
1958 cli->auth->auth_level,
1959 ss_padding_len,
1960 1 /* context id. */);
1961
1962 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
1963 DEBUG(0,("add_ntlmssp_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
1964 data_blob_free(&auth_blob);
1965 return NT_STATUS_NO_MEMORY;
1966 }
1967
1968 switch (cli->auth->auth_level) {
1969 case PIPE_AUTH_LEVEL_PRIVACY:
1970 /* Data portion is encrypted. */
1971 status = ntlmssp_seal_packet(cli->auth->a_u.ntlmssp_state,
1972 (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
1973 data_and_pad_len,
1974 (unsigned char *)prs_data_p(outgoing_pdu),
1975 (size_t)prs_offset(outgoing_pdu),
1976 &auth_blob);
1977 if (!NT_STATUS_IS_OK(status)) {
1978 data_blob_free(&auth_blob);
1979 return status;
1980 }
1981 break;
1982
1983 case PIPE_AUTH_LEVEL_INTEGRITY:
1984 /* Data is signed. */
1985 status = ntlmssp_sign_packet(cli->auth->a_u.ntlmssp_state,
1986 (unsigned char *)prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
1987 data_and_pad_len,
1988 (unsigned char *)prs_data_p(outgoing_pdu),
1989 (size_t)prs_offset(outgoing_pdu),
1990 &auth_blob);
1991 if (!NT_STATUS_IS_OK(status)) {
1992 data_blob_free(&auth_blob);
1993 return status;
1994 }
1995 break;
1996
1997 default:
1998 /* Can't happen. */
1999 smb_panic("bad auth level");
2000 /* Notreached. */
2001 return NT_STATUS_INVALID_PARAMETER;
2002 }
2003
2004 /* Finally marshall the blob. */
2005
2006 if (!prs_copy_data_in(outgoing_pdu, (const char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
2007 DEBUG(0,("add_ntlmssp_auth_footer: failed to add %u bytes auth blob.\n",
2008 (unsigned int)NTLMSSP_SIG_SIZE));
2009 data_blob_free(&auth_blob);
2010 return NT_STATUS_NO_MEMORY;
2011 }
2012
2013 data_blob_free(&auth_blob);
2014 return NT_STATUS_OK;
2015 }
2016
2017 /*******************************************************************
2018 Create and add the schannel sign/seal auth header and data.
2019 ********************************************************************/
2020
2021 static NTSTATUS add_schannel_auth_footer(struct rpc_pipe_client *cli,
2022 RPC_HDR *phdr,
2023 uint32 ss_padding_len,
2024 prs_struct *outgoing_pdu)
2025 {
2026 RPC_HDR_AUTH auth_info;
2027 RPC_AUTH_SCHANNEL_CHK verf;
2028 struct schannel_auth_struct *sas = cli->auth->a_u.schannel_auth;
2029 char *data_p = prs_data_p(outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN;
2030 size_t data_and_pad_len = prs_offset(outgoing_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
2031
2032 if (!sas) {
2033 return NT_STATUS_INVALID_PARAMETER;
2034 }
2035
2036 /* Init and marshall the auth header. */
2037 init_rpc_hdr_auth(&auth_info,
2038 map_pipe_auth_type_to_rpc_auth_type(cli->auth->auth_type),
2039 cli->auth->auth_level,
2040 ss_padding_len,
2041 1 /* context id. */);
2042
2043 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, outgoing_pdu, 0)) {
2044 DEBUG(0,("add_schannel_auth_footer: failed to marshall RPC_HDR_AUTH.\n"));
2045 return NT_STATUS_NO_MEMORY;
2046 }
2047
2048 switch (cli->auth->auth_level) {
2049 case PIPE_AUTH_LEVEL_PRIVACY:
2050 case PIPE_AUTH_LEVEL_INTEGRITY:
2051 DEBUG(10,("add_schannel_auth_footer: SCHANNEL seq_num=%d\n",
2052 sas->seq_num));
2053
2054 schannel_encode(sas,
2055 cli->auth->auth_level,
2056 SENDER_IS_INITIATOR,
2057 &verf,
2058 data_p,
2059 data_and_pad_len);
2060
2061 sas->seq_num++;
2062 break;
2063
2064 default:
2065 /* Can't happen. */
2066 smb_panic("bad auth level");
2067 /* Notreached. */
2068 return NT_STATUS_INVALID_PARAMETER;
2069 }
2070
2071 /* Finally marshall the blob. */
2072 smb_io_rpc_auth_schannel_chk("",
2073 RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
2074 &verf,
2075 outgoing_pdu,
2076 0);
2077
2078 return NT_STATUS_OK;
2079 }
2080
2081 /*******************************************************************
2082 Calculate how much data we're going to send in this packet, also
2083 work out any sign/seal padding length.
2084 ********************************************************************/
2085
2086 static uint32 calculate_data_len_tosend(struct rpc_pipe_client *cli,
2087 uint32 data_left,
2088 uint16 *p_frag_len,
2089 uint16 *p_auth_len,
2090 uint32 *p_ss_padding)
2091 {
2092 uint32 data_space, data_len;
2093
2094 #ifdef DEVELOPER
2095 if ((data_left > 0) && (sys_random() % 2)) {
2096 data_left = MAX(data_left/2, 1);
2097 }
2098 #endif
2099
2100 switch (cli->auth->auth_level) {
2101 case PIPE_AUTH_LEVEL_NONE:
2102 case PIPE_AUTH_LEVEL_CONNECT:
2103 data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN;
2104 data_len = MIN(data_space, data_left);
2105 *p_ss_padding = 0;
2106 *p_auth_len = 0;
2107 *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + data_len;
2108 return data_len;
2109
2110 case PIPE_AUTH_LEVEL_INTEGRITY:
2111 case PIPE_AUTH_LEVEL_PRIVACY:
2112 /* Treat the same for all authenticated rpc requests. */
2113 switch(cli->auth->auth_type) {
2114 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2115 case PIPE_AUTH_TYPE_NTLMSSP:
2116 *p_auth_len = NTLMSSP_SIG_SIZE;
2117 break;
2118 case PIPE_AUTH_TYPE_SCHANNEL:
2119 *p_auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
2120 break;
2121 default:
2122 smb_panic("bad auth type");
2123 break;
2124 }
2125
2126 data_space = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2127 RPC_HDR_AUTH_LEN - *p_auth_len;
2128
2129 data_len = MIN(data_space, data_left);
2130 *p_ss_padding = 0;
2131 if (data_len % 8) {
2132 *p_ss_padding = 8 - (data_len % 8);
2133 }
2134 *p_frag_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + /* Normal headers. */
2135 data_len + *p_ss_padding + /* data plus padding. */
2136 RPC_HDR_AUTH_LEN + *p_auth_len; /* Auth header and auth data. */
2137 return data_len;
2138
2139 default:
2140 smb_panic("bad auth level");
2141 /* Notreached. */
2142 return 0;
2143 }
2144 }
2145
2146 /*******************************************************************
2147 External interface.
2148 Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
2149 Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
2150 and deals with signing/sealing details.
2151 ********************************************************************/
2152
2153 struct rpc_api_pipe_req_state {
2154 struct event_context *ev;
2155 struct rpc_pipe_client *cli;
2156 uint8_t op_num;
2157 uint32_t call_id;
2158 prs_struct *req_data;
2159 uint32_t req_data_sent;
2160 prs_struct outgoing_frag;
2161 prs_struct reply_pdu;
2162 };
2163
2164 static int rpc_api_pipe_req_state_destructor(struct rpc_api_pipe_req_state *s)
2165 {
2166 prs_mem_free(&s->outgoing_frag);
2167 prs_mem_free(&s->reply_pdu);
2168 return 0;
2169 }
2170
2171 static void rpc_api_pipe_req_write_done(struct async_req *subreq);
2172 static void rpc_api_pipe_req_done(struct async_req *subreq);
2173 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
2174 bool *is_last_frag);
2175
2176 struct async_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
2177 struct event_context *ev,
2178 struct rpc_pipe_client *cli,
2179 uint8_t op_num,
2180 prs_struct *req_data)
2181 {
2182 struct async_req *result, *subreq;
2183 struct rpc_api_pipe_req_state *state;
2184 NTSTATUS status;
2185 bool is_last_frag;
2186
2187 result = async_req_new(mem_ctx);
2188 if (result == NULL) {
2189 return NULL;
2190 }
2191 state = talloc(result, struct rpc_api_pipe_req_state);
2192 if (state == NULL) {
2193 goto fail;
2194 }
2195 result->private_data = state;
2196
2197 state->ev = ev;
2198 state->cli = cli;
2199 state->op_num = op_num;
2200 state->req_data = req_data;
2201 state->req_data_sent = 0;
2202 state->call_id = get_rpc_call_id();
2203
2204 if (cli->max_xmit_frag
2205 < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_MAX_SIGN_SIZE) {
2206 /* Server is screwed up ! */
2207 status = NT_STATUS_INVALID_PARAMETER;
2208 goto post_status;
2209 }
2210
2211 prs_init_empty(&state->reply_pdu, state, UNMARSHALL);
2212
2213 if (!prs_init(&state->outgoing_frag, cli->max_xmit_frag,
2214 state, MARSHALL)) {
2215 status = NT_STATUS_NO_MEMORY;
2216 goto post_status;
2217 }
2218
2219 talloc_set_destructor(state, rpc_api_pipe_req_state_destructor);
2220
2221 status = prepare_next_frag(state, &is_last_frag);
2222 if (!NT_STATUS_IS_OK(status)) {
2223 goto post_status;
2224 }
2225
2226 if (is_last_frag) {
2227 subreq = rpc_api_pipe_send(state, ev, state->cli,
2228 &state->outgoing_frag,
2229 RPC_RESPONSE);
2230 if (subreq == NULL) {
2231 status = NT_STATUS_NO_MEMORY;
2232 goto post_status;
2233 }
2234 subreq->async.fn = rpc_api_pipe_req_done;
2235 subreq->async.priv = result;
2236 } else {
2237 subreq = rpc_write_send(state, ev, cli,
2238 prs_data_p(&state->outgoing_frag),
2239 prs_offset(&state->outgoing_frag));
2240 if (subreq == NULL) {
2241 status = NT_STATUS_NO_MEMORY;
2242 goto post_status;
2243 }
2244 subreq->async.fn = rpc_api_pipe_req_write_done;
2245 subreq->async.priv = result;
2246 }
2247 return result;
2248
2249 post_status:
2250 if (async_post_status(result, ev, status)) {
2251 return result;
2252 }
2253 fail:
2254 TALLOC_FREE(result);
2255 return NULL;
2256 }
2257
2258 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
2259 bool *is_last_frag)
2260 {
2261 RPC_HDR hdr;
2262 RPC_HDR_REQ hdr_req;
2263 uint32_t data_sent_thistime;
2264 uint16_t auth_len;
2265 uint16_t frag_len;
2266 uint8_t flags = 0;
2267 uint32_t ss_padding;
2268 uint32_t data_left;
2269 char pad[8] = { 0, };
2270 NTSTATUS status;
2271
2272 data_left = prs_offset(state->req_data) - state->req_data_sent;
2273
2274 data_sent_thistime = calculate_data_len_tosend(
2275 state->cli, data_left, &frag_len, &auth_len, &ss_padding);
2276
2277 if (state->req_data_sent == 0) {
2278 flags = RPC_FLG_FIRST;
2279 }
2280
2281 if (data_sent_thistime == data_left) {
2282 flags |= RPC_FLG_LAST;
2283 }
2284
2285 if (!prs_set_offset(&state->outgoing_frag, 0)) {
2286 return NT_STATUS_NO_MEMORY;
2287 }
2288
2289 /* Create and marshall the header and request header. */
2290 init_rpc_hdr(&hdr, RPC_REQUEST, flags, state->call_id, frag_len,
2291 auth_len);
2292
2293 if (!smb_io_rpc_hdr("hdr ", &hdr, &state->outgoing_frag, 0)) {
2294 return NT_STATUS_NO_MEMORY;
2295 }
2296
2297 /* Create the rpc request RPC_HDR_REQ */
2298 init_rpc_hdr_req(&hdr_req, prs_offset(state->req_data),
2299 state->op_num);
2300
2301 if (!smb_io_rpc_hdr_req("hdr_req", &hdr_req,
2302 &state->outgoing_frag, 0)) {
2303 return NT_STATUS_NO_MEMORY;
2304 }
2305
2306 /* Copy in the data, plus any ss padding. */
2307 if (!prs_append_some_prs_data(&state->outgoing_frag,
2308 state->req_data, state->req_data_sent,
2309 data_sent_thistime)) {
2310 return NT_STATUS_NO_MEMORY;
2311 }
2312
2313 /* Copy the sign/seal padding data. */
2314 if (!prs_copy_data_in(&state->outgoing_frag, pad, ss_padding)) {
2315 return NT_STATUS_NO_MEMORY;
2316 }
2317
2318 /* Generate any auth sign/seal and add the auth footer. */
2319 switch (state->cli->auth->auth_type) {
2320 case PIPE_AUTH_TYPE_NONE:
2321 status = NT_STATUS_OK;
2322 break;
2323 case PIPE_AUTH_TYPE_NTLMSSP:
2324 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2325 status = add_ntlmssp_auth_footer(state->cli, &hdr, ss_padding,
2326 &state->outgoing_frag);
2327 break;
2328 case PIPE_AUTH_TYPE_SCHANNEL:
2329 status = add_schannel_auth_footer(state->cli, &hdr, ss_padding,
2330 &state->outgoing_frag);
2331 break;
2332 default:
2333 status = NT_STATUS_INVALID_PARAMETER;
2334 break;
2335 }
2336
2337 state->req_data_sent += data_sent_thistime;
2338 *is_last_frag = ((flags & RPC_FLG_LAST) != 0);
2339
2340 return status;
2341 }
2342
2343 static void rpc_api_pipe_req_write_done(struct async_req *subreq)
2344 {
2345 struct async_req *req = talloc_get_type_abort(
2346 subreq->async.priv, struct async_req);
2347 struct rpc_api_pipe_req_state *state = talloc_get_type_abort(
2348 req->private_data, struct rpc_api_pipe_req_state);
2349 NTSTATUS status;
2350 bool is_last_frag;
2351
2352 status = rpc_write_recv(subreq);
2353 TALLOC_FREE(subreq);
2354 if (!NT_STATUS_IS_OK(status)) {
2355 async_req_error(req, status);
2356 return;
2357 }
2358
2359 status = prepare_next_frag(state, &is_last_frag);
2360 if (!NT_STATUS_IS_OK(status)) {
2361 async_req_error(req, status);
2362 return;
2363 }
2364
2365 if (is_last_frag) {
2366 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2367 &state->outgoing_frag,
2368 RPC_RESPONSE);
2369 if (async_req_nomem(subreq, req)) {
2370 return;
2371 }
2372 subreq->async.fn = rpc_api_pipe_req_done;
2373 subreq->async.priv = req;
2374 } else {
2375 subreq = rpc_write_send(state, state->ev, state->cli,
2376 prs_data_p(&state->outgoing_frag),
2377 prs_offset(&state->outgoing_frag));
2378 if (async_req_nomem(subreq, req)) {
2379 return;
2380 }
2381 subreq->async.fn = rpc_api_pipe_req_write_done;
2382 subreq->async.priv = req;
2383 }
2384 }
2385
2386 static void rpc_api_pipe_req_done(struct async_req *subreq)
2387 {
2388 struct async_req *req = talloc_get_type_abort(
2389 subreq->async.priv, struct async_req);
2390 struct rpc_api_pipe_req_state *state = talloc_get_type_abort(
2391 req->private_data, struct rpc_api_pipe_req_state);
2392 NTSTATUS status;
2393
2394 status = rpc_api_pipe_recv(subreq, state, &state->reply_pdu);
2395 TALLOC_FREE(subreq);
2396 if (!NT_STATUS_IS_OK(status)) {
2397 async_req_error(req, status);
2398 return;
2399 }
2400 async_req_done(req);
2401 }
2402
2403 NTSTATUS rpc_api_pipe_req_recv(struct async_req *req, TALLOC_CTX *mem_ctx,
2404 prs_struct *reply_pdu)
2405 {
2406 struct rpc_api_pipe_req_state *state = talloc_get_type_abort(
2407 req->private_data, struct rpc_api_pipe_req_state);
2408 NTSTATUS status;
2409
2410 if (async_req_is_error(req, &status)) {
2411 return status;
2412 }
2413
2414 *reply_pdu = state->reply_pdu;
2415 reply_pdu->mem_ctx = mem_ctx;
2416
2417 /*
2418 * Prevent state->req_pdu from being freed in
2419 * rpc_api_pipe_req_state_destructor()
2420 */
2421 prs_init_empty(&state->reply_pdu, state, UNMARSHALL);
2422
2423 return NT_STATUS_OK;
2424 }
2425
2426 NTSTATUS rpc_api_pipe_req(TALLOC_CTX *mem_ctx, struct rpc_pipe_client *cli,
2427 uint8 op_num,
2428 prs_struct *in_data,
2429 prs_struct *out_data)
2430 {
2431 TALLOC_CTX *frame = talloc_stackframe();
2432 struct event_context *ev;
2433 struct async_req *req;
2434 NTSTATUS status = NT_STATUS_NO_MEMORY;
2435
2436 ev = event_context_init(frame);
2437 if (ev == NULL) {
2438 goto fail;
2439 }
2440
2441 req = rpc_api_pipe_req_send(frame, ev, cli, op_num, in_data);
2442 if (req == NULL) {
2443 goto fail;
2444 }
2445
2446 while (req->state < ASYNC_REQ_DONE) {
2447 event_loop_once(ev);
2448 }
2449
2450 status = rpc_api_pipe_req_recv(req, mem_ctx, out_data);
2451 fail:
2452 TALLOC_FREE(frame);
2453 return status;
2454 }
2455
2456 #if 0
2457 /****************************************************************************
2458 Set the handle state.
2459 ****************************************************************************/
2460
2461 static bool rpc_pipe_set_hnd_state(struct rpc_pipe_client *cli,
2462 const char *pipe_name, uint16 device_state)
2463 {
2464 bool state_set = False;
2465 char param[2];
2466 uint16 setup[2]; /* only need 2 uint16 setup parameters */
2467 char *rparam = NULL;
2468 char *rdata = NULL;
2469 uint32 rparam_len, rdata_len;
2470
2471 if (pipe_name == NULL)
2472 return False;
2473
2474 DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
2475 cli->fnum, pipe_name, device_state));
2476
2477 /* create parameters: device state */
2478 SSVAL(param, 0, device_state);
2479
2480 /* create setup parameters. */
2481 setup[0] = 0x0001;
2482 setup[1] = cli->fnum; /* pipe file handle. got this from an SMBOpenX. */
2483
2484 /* send the data on \PIPE\ */
2485 if (cli_api_pipe(cli->cli, "\\PIPE\\",
2486 setup, 2, 0, /* setup, length, max */
2487 param, 2, 0, /* param, length, max */
2488 NULL, 0, 1024, /* data, length, max */
2489 &rparam, &rparam_len, /* return param, length */
2490 &rdata, &rdata_len)) /* return data, length */
2491 {
2492 DEBUG(5, ("Set Handle state: return OK\n"));
2493 state_set = True;
2494 }
2495
2496 SAFE_FREE(rparam);
2497 SAFE_FREE(rdata);
2498
2499 return state_set;
2500 }
2501 #endif
2502
2503 /****************************************************************************
2504 Check the rpc bind acknowledge response.
2505 ****************************************************************************/
2506
2507 static bool check_bind_response(RPC_HDR_BA *hdr_ba, const RPC_IFACE *transfer)
2508 {
2509 if ( hdr_ba->addr.len == 0) {
2510 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
2511 }
2512
2513 /* check the transfer syntax */
2514 if ((hdr_ba->transfer.if_version != transfer->if_version) ||
2515 (memcmp(&hdr_ba->transfer.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
2516 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
2517 return False;
2518 }
2519
2520 if (hdr_ba->res.num_results != 0x1 || hdr_ba->res.result != 0) {
2521 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
2522 hdr_ba->res.num_results, hdr_ba->res.reason));
2523 }
2524
2525 DEBUG(5,("check_bind_response: accepted!\n"));
2526 return True;
2527 }
2528
2529 /*******************************************************************
2530 Creates a DCE/RPC bind authentication response.
2531 This is the packet that is sent back to the server once we
2532 have received a BIND-ACK, to finish the third leg of
2533 the authentication handshake.
2534 ********************************************************************/
2535
2536 static NTSTATUS create_rpc_bind_auth3(struct rpc_pipe_client *cli,
2537 uint32 rpc_call_id,
2538 enum pipe_auth_type auth_type,
2539 enum pipe_auth_level auth_level,
2540 DATA_BLOB *pauth_blob,
2541 prs_struct *rpc_out)
2542 {
2543 RPC_HDR hdr;
2544 RPC_HDR_AUTH hdr_auth;
2545 uint32 pad = 0;
2546
2547 /* Create the request RPC_HDR */
2548 init_rpc_hdr(&hdr, RPC_AUTH3, RPC_FLG_FIRST|RPC_FLG_LAST, rpc_call_id,
2549 RPC_HEADER_LEN + 4 /* pad */ + RPC_HDR_AUTH_LEN + pauth_blob->length,
2550 pauth_blob->length );
2551
2552 /* Marshall it. */
2553 if(!smb_io_rpc_hdr("hdr", &hdr, rpc_out, 0)) {
2554 DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR.\n"));
2555 return NT_STATUS_NO_MEMORY;
2556 }
2557
2558 /*
2559 I'm puzzled about this - seems to violate the DCE RPC auth rules,
2560 about padding - shouldn't this pad to length 8 ? JRA.
2561 */
2562
2563 /* 4 bytes padding. */
2564 if (!prs_uint32("pad", rpc_out, 0, &pad)) {
2565 DEBUG(0,("create_rpc_bind_auth3: failed to marshall 4 byte pad.\n"));
2566 return NT_STATUS_NO_MEMORY;
2567 }
2568
2569 /* Create the request RPC_HDR_AUTHA */
2570 init_rpc_hdr_auth(&hdr_auth,
2571 map_pipe_auth_type_to_rpc_auth_type(auth_type),
2572 auth_level, 0, 1);
2573
2574 if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, rpc_out, 0)) {
2575 DEBUG(0,("create_rpc_bind_auth3: failed to marshall RPC_HDR_AUTHA.\n"));
2576 return NT_STATUS_NO_MEMORY;
2577 }
2578
2579 /*
2580 * Append the auth data to the outgoing buffer.
2581 */
2582
2583 if(!prs_copy_data_in(rpc_out, (char *)pauth_blob->data, pauth_blob->length)) {
2584 DEBUG(0,("create_rpc_bind_auth3: failed to marshall auth blob.\n"));
2585 return NT_STATUS_NO_MEMORY;
2586 }
2587
2588 return NT_STATUS_OK;
2589 }
2590
2591 /*******************************************************************
2592 Creates a DCE/RPC bind alter context authentication request which
2593 may contain a spnego auth blobl
2594 ********************************************************************/
2595
2596 static NTSTATUS create_rpc_alter_context(uint32 rpc_call_id,
2597 const RPC_IFACE *abstract,
2598 const RPC_IFACE *transfer,
2599 enum pipe_auth_level auth_level,
2600 const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
2601 prs_struct *rpc_out)
2602 {
2603 RPC_HDR_AUTH hdr_auth;
2604 prs_struct auth_info;
2605 NTSTATUS ret = NT_STATUS_OK;
2606
2607 ZERO_STRUCT(hdr_auth);
2608 if (!prs_init(&auth_info, RPC_HDR_AUTH_LEN, prs_get_mem_context(rpc_out), MARSHALL))
2609 return NT_STATUS_NO_MEMORY;
2610
2611 /* We may change the pad length before marshalling. */
2612 init_rpc_hdr_auth(&hdr_auth, RPC_SPNEGO_AUTH_TYPE, (int)auth_level, 0, 1);
2613
2614 if (pauth_blob->length) {
2615 if (!prs_copy_data_in(&auth_info, (const char *)pauth_blob->data, pauth_blob->length)) {
2616 prs_mem_free(&auth_info);
2617 return NT_STATUS_NO_MEMORY;
2618 }
2619 }
2620
2621 ret = create_bind_or_alt_ctx_internal(RPC_ALTCONT,
2622 rpc_out,
2623 rpc_call_id,
2624 abstract,
2625 transfer,
2626 &hdr_auth,
2627 &auth_info);
2628 prs_mem_free(&auth_info);
2629 return ret;
2630 }
2631
2632 /****************************************************************************
2633 Do an rpc bind.
2634 ****************************************************************************/
2635
2636 struct rpc_pipe_bind_state {
2637 struct event_context *ev;
2638 struct rpc_pipe_client *cli;
2639 prs_struct rpc_out;
2640 uint32_t rpc_call_id;
2641 };
2642
2643 static int rpc_pipe_bind_state_destructor(struct rpc_pipe_bind_state *state)
2644 {
2645 prs_mem_free(&state->rpc_out);
2646 return 0;
2647 }
2648
2649 static void rpc_pipe_bind_step_one_done(struct async_req *subreq);
2650 static NTSTATUS rpc_finish_auth3_bind_send(struct async_req *req,
2651 struct rpc_pipe_bind_state *state,
2652 struct rpc_hdr_info *phdr,
2653 prs_struct *reply_pdu);
2654 static void rpc_bind_auth3_write_done(struct async_req *subreq);
2655 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct async_req *req,
2656 struct rpc_pipe_bind_state *state,
2657 struct rpc_hdr_info *phdr,
2658 prs_struct *reply_pdu);
2659 static void rpc_bind_ntlmssp_api_done(struct async_req *subreq);
2660
2661 struct async_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
2662 struct event_context *ev,
2663 struct rpc_pipe_client *cli,
2664 struct cli_pipe_auth_data *auth)
2665 {
2666 struct async_req *result, *subreq;
2667 struct rpc_pipe_bind_state *state;
2668 NTSTATUS status;
2669
2670 result = async_req_new(mem_ctx);
2671 if (result == NULL) {
2672 return NULL;
2673 }
2674 state = talloc(result, struct rpc_pipe_bind_state);
2675 if (state == NULL) {
2676 goto fail;
2677 }
2678 result->private_data = state;
2679
2680 DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
2681 rpccli_pipe_txt(debug_ctx(), cli),
2682 (unsigned int)auth->auth_type,
2683 (unsigned int)auth->auth_level ));
2684
2685 state->ev = ev;
2686 state->cli = cli;
2687 state->rpc_call_id = get_rpc_call_id();
2688
2689 prs_init_empty(&state->rpc_out, state, MARSHALL);
2690 talloc_set_destructor(state, rpc_pipe_bind_state_destructor);
2691
2692 cli->auth = talloc_move(cli, &auth);
2693
2694 /* Marshall the outgoing data. */
2695 status = create_rpc_bind_req(cli, &state->rpc_out,
2696 state->rpc_call_id,
2697 &cli->abstract_syntax,
2698 &cli->transfer_syntax,
2699 cli->auth->auth_type,
2700 cli->auth->auth_level);
2701
2702 if (!NT_STATUS_IS_OK(status)) {
2703 goto post_status;
2704 }
2705
2706 subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
2707 RPC_BINDACK);
2708 if (subreq == NULL) {
2709 status = NT_STATUS_NO_MEMORY;
2710 goto post_status;
2711 }
2712 subreq->async.fn = rpc_pipe_bind_step_one_done;
2713 subreq->async.priv = result;
2714 return result;
2715
2716 post_status:
2717 if (async_post_status(result, ev, status)) {
2718 return result;
2719 }
2720 fail:
2721 TALLOC_FREE(result);
2722 return NULL;
2723 }
2724
2725 static void rpc_pipe_bind_step_one_done(struct async_req *subreq)
2726 {
2727 struct async_req *req = talloc_get_type_abort(
2728 subreq->async.priv, struct async_req);
2729 struct rpc_pipe_bind_state *state = talloc_get_type_abort(
2730 req->private_data, struct rpc_pipe_bind_state);
2731 prs_struct reply_pdu;
2732 struct rpc_hdr_info hdr;
2733 struct rpc_hdr_ba_info hdr_ba;
2734 NTSTATUS status;
2735
2736 status = rpc_api_pipe_recv(subreq, talloc_tos(), &reply_pdu);
2737 TALLOC_FREE(subreq);
2738 if (!NT_STATUS_IS_OK(status)) {
2739 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
2740 rpccli_pipe_txt(debug_ctx(), state->cli),
2741 nt_errstr(status)));
2742 async_req_error(req, status);
2743 return;
2744 }
2745
2746 /* Unmarshall the RPC header */
2747 if (!smb_io_rpc_hdr("hdr", &hdr, &reply_pdu, 0)) {
2748 DEBUG(0, ("rpc_pipe_bind: failed to unmarshall RPC_HDR.\n"));
2749 async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
2750 return;
2751 }
2752
2753 if (!smb_io_rpc_hdr_ba("", &hdr_ba, &reply_pdu, 0)) {
2754 DEBUG(0, ("rpc_pipe_bind: Failed to unmarshall "
2755 "RPC_HDR_BA.\n"));
2756 async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
2757 return;
2758 }
2759
2760 if (!check_bind_response(&hdr_ba, &state->cli->transfer_syntax)) {
2761 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
2762 async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
2763 return;
2764 }
2765
2766 state->cli->max_xmit_frag = hdr_ba.bba.max_tsize;
2767 state->cli->max_recv_frag = hdr_ba.bba.max_rsize;
2768
2769 /*
2770 * For authenticated binds we may need to do 3 or 4 leg binds.
2771 */
2772
2773 switch(state->cli->auth->auth_type) {
2774
2775 case PIPE_AUTH_TYPE_NONE:
2776 case PIPE_AUTH_TYPE_SCHANNEL:
2777 /* Bind complete. */
2778 async_req_done(req);
2779 break;
2780
2781 case PIPE_AUTH_TYPE_NTLMSSP:
2782 /* Need to send AUTH3 packet - no reply. */
2783 status = rpc_finish_auth3_bind_send(req, state, &hdr,
2784 &reply_pdu);
2785 if (!NT_STATUS_IS_OK(status)) {
2786 async_req_error(req, status);
2787 }
2788 break;
2789
2790 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
2791 /* Need to send alter context request and reply. */
2792 status = rpc_finish_spnego_ntlmssp_bind_send(req, state, &hdr,
2793 &reply_pdu);
2794 if (!NT_STATUS_IS_OK(status)) {
2795 async_req_error(req, status);
2796 }
2797 break;
2798
2799 case PIPE_AUTH_TYPE_KRB5:
2800 /* */
2801
2802 default:
2803 DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
2804 (unsigned int)state->cli->auth->auth_type));
2805 async_req_error(req, NT_STATUS_INTERNAL_ERROR);
2806 }
2807 }
2808
2809 static NTSTATUS rpc_finish_auth3_bind_send(struct async_req *req,
2810 struct rpc_pipe_bind_state *state,
2811 struct rpc_hdr_info *phdr,
2812 prs_struct *reply_pdu)
2813 {
2814 DATA_BLOB server_response = data_blob_null;
2815 DATA_BLOB client_reply = data_blob_null;
2816 struct rpc_hdr_auth_info hdr_auth;
2817 struct async_req *subreq;
2818 NTSTATUS status;
2819
2820 if ((phdr->auth_len == 0)
2821 || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
2822 return NT_STATUS_INVALID_PARAMETER;
2823 }
2824
2825 if (!prs_set_offset(
2826 reply_pdu,
2827 phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
2828 return NT_STATUS_INVALID_PARAMETER;
2829 }
2830
2831 if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, reply_pdu, 0)) {
2832 return NT_STATUS_INVALID_PARAMETER;
2833 }
2834
2835 /* TODO - check auth_type/auth_level match. */
2836
2837 server_response = data_blob_talloc(talloc_tos(), NULL, phdr->auth_len);
2838 prs_copy_data_out((char *)server_response.data, reply_pdu,
2839 phdr->auth_len);
2840
2841 status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
2842 server_response, &client_reply);
2843
2844 if (!NT_STATUS_IS_OK(status)) {
2845 DEBUG(0, ("rpc_finish_auth3_bind: NTLMSSP update using server "
2846 "blob failed: %s.\n", nt_errstr(status)));
2847 return status;
2848 }
2849
2850 prs_init_empty(&state->rpc_out, talloc_tos(), MARSHALL);
2851
2852 status = create_rpc_bind_auth3(state->cli, state->rpc_call_id,
2853 state->cli->auth->auth_type,
2854 state->cli->auth->auth_level,
2855 &client_reply, &state->rpc_out);
2856 data_blob_free(&client_reply);
2857
2858 if (!NT_STATUS_IS_OK(status)) {
2859 return status;
2860 }
2861
2862 subreq = rpc_write_send(state, state->ev, state->cli,
2863 prs_data_p(&state->rpc_out),
2864 prs_offset(&state->rpc_out));
2865 if (subreq == NULL) {
2866 return NT_STATUS_NO_MEMORY;
2867 }
2868 subreq->async.fn = rpc_bind_auth3_write_done;
2869 subreq->async.priv = req;
2870 return NT_STATUS_OK;
2871 }
2872
2873 static void rpc_bind_auth3_write_done(struct async_req *subreq)
2874 {
2875 struct async_req *req = talloc_get_type_abort(
2876 subreq->async.priv, struct async_req);
2877 NTSTATUS status;
2878
2879 status = rpc_write_recv(subreq);
2880 TALLOC_FREE(subreq);
2881 if (!NT_STATUS_IS_OK(status)) {
2882 async_req_error(req, status);
2883 return;
2884 }
2885 async_req_done(req);
2886 }
2887
2888 static NTSTATUS rpc_finish_spnego_ntlmssp_bind_send(struct async_req *req,
2889 struct rpc_pipe_bind_state *state,
2890 struct rpc_hdr_info *phdr,
2891 prs_struct *reply_pdu)
2892 {
2893 DATA_BLOB server_spnego_response = data_blob_null;
2894 DATA_BLOB server_ntlm_response = data_blob_null;
2895 DATA_BLOB client_reply = data_blob_null;
2896 DATA_BLOB tmp_blob = data_blob_null;
2897 RPC_HDR_AUTH hdr_auth;
2898 struct async_req *subreq;
2899 NTSTATUS status;
2900
2901 if ((phdr->auth_len == 0)
2902 || (phdr->frag_len < phdr->auth_len + RPC_HDR_AUTH_LEN)) {
2903 return NT_STATUS_INVALID_PARAMETER;
2904 }
2905
2906 /* Process the returned NTLMSSP blob first. */
2907 if (!prs_set_offset(
2908 reply_pdu,
2909 phdr->frag_len - phdr->auth_len - RPC_HDR_AUTH_LEN)) {
2910 return NT_STATUS_INVALID_PARAMETER;
2911 }
2912
2913 if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, reply_pdu, 0)) {
2914 return NT_STATUS_INVALID_PARAMETER;
2915 }
2916
2917 server_spnego_response = data_blob(NULL, phdr->auth_len);
2918 prs_copy_data_out((char *)server_spnego_response.data,
2919 reply_pdu, phdr->auth_len);
2920
2921 /*
2922 * The server might give us back two challenges - tmp_blob is for the
2923 * second.
2924 */
2925 if (!spnego_parse_challenge(server_spnego_response,
2926 &server_ntlm_response, &tmp_blob)) {
2927 data_blob_free(&server_spnego_response);
2928 data_blob_free(&server_ntlm_response);
2929 data_blob_free(&tmp_blob);
2930 return NT_STATUS_INVALID_PARAMETER;
2931 }
2932
2933 /* We're finished with the server spnego response and the tmp_blob. */
2934 data_blob_free(&server_spnego_response);
2935 data_blob_free(&tmp_blob);
2936
2937 status = ntlmssp_update(state->cli->auth->a_u.ntlmssp_state,
2938 server_ntlm_response, &client_reply);
2939
2940 /* Finished with the server_ntlm response */
2941 data_blob_free(&server_ntlm_response);
2942
2943 if (!NT_STATUS_IS_OK(status)) {
2944 DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: NTLMSSP update "
2945 "using server blob failed.\n"));
2946 data_blob_free(&client_reply);
2947 return status;
2948 }
2949
2950 /* SPNEGO wrap the client reply. */
2951 tmp_blob = spnego_gen_auth(client_reply);
2952 data_blob_free(&client_reply);
2953 client_reply = tmp_blob;
2954 tmp_blob = data_blob_null;
2955
2956 /* Now prepare the alter context pdu. */
2957 prs_init_empty(&state->rpc_out, state, MARSHALL);
2958
2959 status = create_rpc_alter_context(state->rpc_call_id,
2960 &state->cli->abstract_syntax,
2961 &state->cli->transfer_syntax,
2962 state->cli->auth->auth_level,
2963 &client_reply,
2964 &state->rpc_out);
2965 data_blob_free(&client_reply);
2966
2967 if (!NT_STATUS_IS_OK(status)) {
2968 return status;
2969 }
2970
2971 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
2972 &state->rpc_out, RPC_ALTCONTRESP);
2973 if (subreq == NULL) {
2974 return NT_STATUS_NO_MEMORY;
2975 }
2976 subreq->async.fn = rpc_bind_ntlmssp_api_done;
2977 subreq->async.priv = req;
2978 return NT_STATUS_OK;
2979 }
2980
2981 static void rpc_bind_ntlmssp_api_done(struct async_req *subreq)
2982 {
2983 struct async_req *req = talloc_get_type_abort(
2984 subreq->async.priv, struct async_req);
2985 struct rpc_pipe_bind_state *state = talloc_get_type_abort(
2986 req->private_data, struct rpc_pipe_bind_state);
2987 DATA_BLOB server_spnego_response = data_blob_null;
2988 DATA_BLOB tmp_blob = data_blob_null;
2989 prs_struct reply_pdu;
2990 struct rpc_hdr_info hdr;
2991 struct rpc_hdr_auth_info hdr_auth;
2992 NTSTATUS status;
2993
2994 status = rpc_api_pipe_recv(subreq, talloc_tos(), &reply_pdu);
2995 TALLOC_FREE(subreq);
2996 if (!NT_STATUS_IS_OK(status)) {
2997 async_req_error(req, status);
2998 return;
2999 }
3000
3001 /* Get the auth blob from the reply. */
3002 if (!smb_io_rpc_hdr("rpc_hdr ", &hdr, &reply_pdu, 0)) {
3003 DEBUG(0, ("rpc_finish_spnego_ntlmssp_bind: Failed to "
3004 "unmarshall RPC_HDR.\n"));
3005 async_req_error(req, NT_STATUS_BUFFER_TOO_SMALL);
3006 return;
3007 }
3008
3009 if (!prs_set_offset(
3010 &reply_pdu,
3011 hdr.frag_len - hdr.auth_len - RPC_HDR_AUTH_LEN)) {
3012 async_req_error(req, NT_STATUS_INVALID_PARAMETER);
3013 return;
3014 }
3015
3016 if (!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &reply_pdu, 0)) {
3017 async_req_error(req, NT_STATUS_INVALID_PARAMETER);
3018 return;
3019 }
3020
3021 server_spnego_response = data_blob(NULL, hdr.auth_len);
3022 prs_copy_data_out((char *)server_spnego_response.data, &reply_pdu,
3023 hdr.auth_len);
3024
3025 /* Check we got a valid auth response. */
3026 if (!spnego_parse_auth_response(server_spnego_response, NT_STATUS_OK,
3027 OID_NTLMSSP, &tmp_blob)) {
3028 data_blob_free(&server_spnego_response);
3029 data_blob_free(&tmp_blob);
3030 async_req_error(req, NT_STATUS_INVALID_PARAMETER);
3031 return;
3032 }
3033
3034 data_blob_free(&server_spnego_response);
3035 data_blob_free(&tmp_blob);
3036
3037 DEBUG(5,("rpc_finish_spnego_ntlmssp_bind: alter context request to "
3038 "%s.\n", rpccli_pipe_txt(debug_ctx(), state->cli)));
3039 async_req_done(req);
3040 }
3041
3042 NTSTATUS rpc_pipe_bind_recv(struct async_req *req)
3043 {
3044 return async_req_simple_recv(req);
3045 }
3046
3047 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
3048 struct cli_pipe_auth_data *auth)
3049 {
3050 TALLOC_CTX *frame = talloc_stackframe();
3051 struct event_context *ev;
3052 struct async_req *req;
3053 NTSTATUS status = NT_STATUS_NO_MEMORY;
3054
3055 ev = event_context_init(frame);
3056 if (ev == NULL) {
3057 goto fail;
3058 }
3059
3060 req = rpc_pipe_bind_send(frame, ev, cli, auth);
3061 if (req == NULL) {
3062 goto fail;
3063 }
3064
3065 while (req->state < ASYNC_REQ_DONE) {
3066 event_loop_once(ev);
3067 }
3068
3069 status = rpc_pipe_bind_recv(req);
3070 fail:
3071 TALLOC_FREE(frame);
3072 return status;
3073 }
3074
3075 unsigned int rpccli_set_timeout(struct rpc_pipe_client *cli,
3076 unsigned int timeout)
3077 {
3078 return cli_set_timeout(cli->trans.np.cli, timeout);
3079 }
3080
3081 bool rpccli_get_pwd_hash(struct rpc_pipe_client *cli, uint8_t nt_hash[16])
3082 {
3083 if ((cli->auth->auth_type == PIPE_AUTH_TYPE_NTLMSSP)
3084 || (cli->auth->auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP)) {
3085 memcpy(nt_hash, cli->auth->a_u.ntlmssp_state->nt_hash, 16);
3086 return true;
3087 }
3088
3089 if (cli->transport_type == NCACN_NP) {
3090 E_md4hash(cli->trans.np.cli->pwd.password, nt_hash);
3091 return true;
3092 }
3093
3094 return false;
3095 }
3096
3097 struct cli_state *rpc_pipe_np_smb_conn(struct rpc_pipe_client *p)
3098 {
3099 if (p->transport_type == NCACN_NP) {
3100 return p->trans.np.cli;
3101 }
3102 return NULL;
3103 }
3104
3105 static int rpc_pipe_destructor(struct rpc_pipe_client *p)
3106 {
3107 if (p->transport_type == NCACN_NP) {
3108 bool ret;
3109 ret = cli_close(p->trans.np.cli, p->trans.np.fnum);
3110 if (!ret) {
3111 DEBUG(1, ("rpc_pipe_destructor: cli_close failed on "
3112 "pipe %s. Error was %s\n",
3113 rpccli_pipe_txt(debug_ctx(), p),
3114 cli_errstr(p->trans.np.cli)));
3115 }
3116
3117 DEBUG(10, ("rpc_pipe_destructor: closed %s\n",
3118 rpccli_pipe_txt(debug_ctx(), p)));
3119
3120 DLIST_REMOVE(p->trans.np.cli->pipe_list, p);
3121 return ret ? -1 : 0;
3122 }
3123
3124 return -1;
3125 }
3126
3127 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
3128 struct cli_pipe_auth_data **presult)
3129 {
3130 struct cli_pipe_auth_data *result;
3131
3132 result = talloc(mem_ctx, struct cli_pipe_auth_data);
3133 if (result == NULL) {
3134 return NT_STATUS_NO_MEMORY;
3135 }
3136
3137 result->auth_type = PIPE_AUTH_TYPE_NONE;
3138 result->auth_level = PIPE_AUTH_LEVEL_NONE;
3139
3140 result->user_name = talloc_strdup(result, "");
3141 result->domain = talloc_strdup(result, "");
3142 if ((result->user_name == NULL) || (result->domain == NULL)) {
3143 TALLOC_FREE(result);
3144 return NT_STATUS_NO_MEMORY;
3145 }
3146
3147 *presult = result;
3148 return NT_STATUS_OK;
3149 }
3150
3151 static int cli_auth_ntlmssp_data_destructor(struct cli_pipe_auth_data *auth)
3152 {
3153 ntlmssp_end(&auth->a_u.ntlmssp_state);
3154 return 0;
3155 }
3156
3157 NTSTATUS rpccli_ntlmssp_bind_data(TALLOC_CTX *mem_ctx,
3158 enum pipe_auth_type auth_type,
3159 enum pipe_auth_level auth_level,
3160 const char *domain,
3161 const char *username,
3162 const char *password,
3163 struct cli_pipe_auth_data **presult)
3164 {
3165 struct cli_pipe_auth_data *result;
3166 NTSTATUS status;
3167
3168 result = talloc(mem_ctx, struct cli_pipe_auth_data);
3169 if (result == NULL) {
3170 return NT_STATUS_NO_MEMORY;
3171 }
3172
3173 result->auth_type = auth_type;
3174 result->auth_level = auth_level;
3175
3176 result->user_name = talloc_strdup(result, username);
3177 result->domain = talloc_strdup(result, domain);
3178 if ((result->user_name == NULL) || (result->domain == NULL)) {
3179 status = NT_STATUS_NO_MEMORY;
3180 goto fail;
3181 }
3182
3183 status = ntlmssp_client_start(&result->a_u.ntlmssp_state);
3184 if (!NT_STATUS_IS_OK(status)) {
3185 goto fail;
3186 }
3187
3188 talloc_set_destructor(result, cli_auth_ntlmssp_data_destructor);
3189
3190 status = ntlmssp_set_username(result->a_u.ntlmssp_state, username);
3191 if (!NT_STATUS_IS_OK(status)) {
3192 goto fail;
3193 }
3194
3195 status = ntlmssp_set_domain(result->a_u.ntlmssp_state, domain);
3196 if (!NT_STATUS_IS_OK(status)) {
3197 goto fail;
3198 }
3199
3200 status = ntlmssp_set_password(result->a_u.ntlmssp_state, password);
3201 if (!NT_STATUS_IS_OK(status)) {
3202 goto fail;
3203 }
3204
3205 /*
3206 * Turn off sign+seal to allow selected auth level to turn it back on.
3207 */
3208 result->a_u.ntlmssp_state->neg_flags &=
3209 ~(NTLMSSP_NEGOTIATE_SIGN | NTLMSSP_NEGOTIATE_SEAL);
3210
3211 if (auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
3212 result->a_u.ntlmssp_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
3213 } else if (auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
3214 result->a_u.ntlmssp_state->neg_flags
3215 |= NTLMSSP_NEGOTIATE_SEAL | NTLMSSP_NEGOTIATE_SIGN;
3216 }
3217
3218 *presult = result;
3219 return NT_STATUS_OK;
3220
3221 fail:
3222 TALLOC_FREE(result);
3223 return status;
3224 }
3225
3226 NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
3227 enum pipe_auth_level auth_level,
3228 const uint8_t sess_key[16],
3229 struct cli_pipe_auth_data **presult)
3230 {
3231 struct cli_pipe_auth_data *result;
3232
3233 result = talloc(mem_ctx, struct cli_pipe_auth_data);
3234 if (result == NULL) {
3235 return NT_STATUS_NO_MEMORY;
3236 }
3237
3238 result->auth_type = PIPE_AUTH_TYPE_SCHANNEL;
3239 result->auth_level = auth_level;
3240
3241 result->user_name = talloc_strdup(result, "");
3242 result->domain = talloc_strdup(result, domain);
3243 if ((result->user_name == NULL) || (result->domain == NULL)) {
3244 goto fail;
3245 }
3246
3247 result->a_u.schannel_auth = talloc(result,
3248 struct schannel_auth_struct);
3249 if (result->a_u.schannel_auth == NULL) {
3250 goto fail;
3251 }
3252
3253 memcpy(result->a_u.schannel_auth->sess_key, sess_key,
3254 sizeof(result->a_u.schannel_auth->sess_key));
3255 result->a_u.schannel_auth->seq_num = 0;
3256
3257 *presult = result;
3258 return NT_STATUS_OK;
3259
3260 fail:
3261 TALLOC_FREE(result);
3262 return NT_STATUS_NO_MEMORY;
3263 }
3264
3265 #ifdef HAVE_KRB5
3266 static int cli_auth_kerberos_data_destructor(struct kerberos_auth_struct *auth)
3267 {
3268 data_blob_free(&auth->session_key);
3269 return 0;
3270 }
3271 #endif
3272
3273 NTSTATUS rpccli_kerberos_bind_data(TALLOC_CTX *mem_ctx,
3274 enum pipe_auth_level auth_level,
3275 const char *service_princ,
3276 const char *username,
3277 const char *password,
3278 struct cli_pipe_auth_data **presult)
3279 {
3280 #ifdef HAVE_KRB5
3281 struct cli_pipe_auth_data *result;
3282
3283 if ((username != NULL) && (password != NULL)) {
3284 int ret = kerberos_kinit_password(username, password, 0, NULL);
3285 if (ret != 0) {
3286 return NT_STATUS_ACCESS_DENIED;
3287 }
3288 }
3289
3290 result = talloc(mem_ctx, struct cli_pipe_auth_data);
3291 if (result == NULL) {
3292 return NT_STATUS_NO_MEMORY;
3293 }
3294
3295 result->auth_type = PIPE_AUTH_TYPE_KRB5;
3296 result->auth_level = auth_level;
3297
3298 /*
3299 * Username / domain need fixing!
3300 */
3301 result->user_name = talloc_strdup(result, "");
3302 result->domain = talloc_strdup(result, "");
3303 if ((result->user_name == NULL) || (result->domain == NULL)) {
3304 goto fail;
3305 }
3306
3307 result->a_u.kerberos_auth = TALLOC_ZERO_P(
3308 result, struct kerberos_auth_struct);
3309 if (result->a_u.kerberos_auth == NULL) {
3310 goto fail;
3311 }
3312 talloc_set_destructor(result->a_u.kerberos_auth,
3313 cli_auth_kerberos_data_destructor);
3314
3315 result->a_u.kerberos_auth->service_principal = talloc_strdup(
3316 result, service_princ);
3317 if (result->a_u.kerberos_auth->service_principal == NULL) {
3318 goto fail;
3319 }
3320
3321 *presult = result;
3322 return NT_STATUS_OK;
3323
3324 fail:
3325 TALLOC_FREE(result);
3326 return NT_STATUS_NO_MEMORY;
3327 #else
3328 return NT_STATUS_NOT_SUPPORTED;
3329 #endif
3330 }
3331
3332 static int rpc_pipe_sock_destructor(struct rpc_pipe_client *p)
3333 {
3334 close(p->trans.sock.fd);
3335 return 0;
3336 }
3337
3338 /**
3339 * Create an rpc pipe client struct, connecting to a tcp port.
3340 */
3341 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
3342 uint16_t port,
3343 const struct ndr_syntax_id *abstract_syntax,
3344 struct rpc_pipe_client **presult)
3345 {
3346 struct rpc_pipe_client *result;
3347 struct sockaddr_storage addr;
3348 NTSTATUS status;
3349
3350 result = TALLOC_ZERO_P(mem_ctx, struct rpc_pipe_client);
3351 if (result == NULL) {
3352 return NT_STATUS_NO_MEMORY;
3353 }
3354
3355 result->transport_type = NCACN_IP_TCP;
3356
3357 result->abstract_syntax = *abstract_syntax;
3358 result->transfer_syntax = ndr_transfer_syntax;
3359
3360 result->desthost = talloc_strdup(result, host);
3361 result->srv_name_slash = talloc_asprintf_strupper_m(
3362 result, "\\\\%s", result->desthost);
3363 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3364 status = NT_STATUS_NO_MEMORY;
3365 goto fail;
3366 }
3367
3368 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3369 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3370
3371 if (!resolve_name(host, &addr, 0)) {
3372 status = NT_STATUS_NOT_FOUND;
3373 goto fail;
3374 }
3375
3376 status = open_socket_out(&addr, port, 60, &result->trans.sock.fd);
3377 if (!NT_STATUS_IS_OK(status)) {
3378 goto fail;
3379 }
3380
3381 talloc_set_destructor(result, rpc_pipe_sock_destructor);
3382
3383 *presult = result;
3384 return NT_STATUS_OK;
3385
3386 fail:
3387 TALLOC_FREE(result);
3388 return status;
3389 }
3390
3391 /**
3392 * Determine the tcp port on which a dcerpc interface is listening
3393 * for the ncacn_ip_tcp transport via the endpoint mapper of the
3394 * target host.
3395 */
3396 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
3397 const struct ndr_syntax_id *abstract_syntax,
3398 uint16_t *pport)
3399 {
3400 NTSTATUS status;
3401 struct rpc_pipe_client *epm_pipe = NULL;
3402 struct cli_pipe_auth_data *auth = NULL;
3403 struct dcerpc_binding *map_binding = NULL;
3404 struct dcerpc_binding *res_binding = NULL;
3405 struct epm_twr_t *map_tower = NULL;
3406 struct epm_twr_t *res_towers = NULL;
3407 struct policy_handle *entry_handle = NULL;
3408 uint32_t num_towers = 0;
3409 uint32_t max_towers = 1;
3410 struct epm_twr_p_t towers;
3411 TALLOC_CTX *tmp_ctx = talloc_stackframe();
3412
3413 if (pport == NULL) {
3414 status = NT_STATUS_INVALID_PARAMETER;
3415 goto done;
3416 }
3417
3418 /* open the connection to the endpoint mapper */
3419 status = rpc_pipe_open_tcp_port(tmp_ctx, host, 135,
3420 &ndr_table_epmapper.syntax_id,
3421 &epm_pipe);
3422
3423 if (!NT_STATUS_IS_OK(status)) {
3424 goto done;
3425 }
3426
3427 status = rpccli_anon_bind_data(tmp_ctx, &auth);
3428 if (!NT_STATUS_IS_OK(status)) {
3429 goto done;
3430 }
3431
3432 status = rpc_pipe_bind(epm_pipe, auth);
3433 if (!NT_STATUS_IS_OK(status)) {
3434 goto done;
3435 }
3436
3437 /* create tower for asking the epmapper */
3438
3439 map_binding = TALLOC_ZERO_P(tmp_ctx, struct dcerpc_binding);
3440 if (map_binding == NULL) {
3441 status = NT_STATUS_NO_MEMORY;
3442 goto done;
3443 }
3444
3445 map_binding->transport = NCACN_IP_TCP;
3446 map_binding->object = *abstract_syntax;
3447 map_binding->host = host; /* needed? */
3448 map_binding->endpoint = "0"; /* correct? needed? */
3449
3450 map_tower = TALLOC_ZERO_P(tmp_ctx, struct epm_twr_t);
3451 if (map_tower == NULL) {
3452 status = NT_STATUS_NO_MEMORY;
3453 goto done;
3454 }
3455
3456 status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
3457 &(map_tower->tower));
3458 if (!NT_STATUS_IS_OK(status)) {
3459 goto done;
3460 }
3461
3462 /* allocate further parameters for the epm_Map call */
3463
3464 res_towers = TALLOC_ARRAY(tmp_ctx, struct epm_twr_t, max_towers);
3465 if (res_towers == NULL) {
3466 status = NT_STATUS_NO_MEMORY;
3467 goto done;
3468 }
3469 towers.twr = res_towers;
3470
3471 entry_handle = TALLOC_ZERO_P(tmp_ctx, struct policy_handle);
3472 if (entry_handle == NULL) {
3473 status = NT_STATUS_NO_MEMORY;
3474 goto done;
3475 }
3476
3477 /* ask the endpoint mapper for the port */
3478
3479 status = rpccli_epm_Map(epm_pipe,
3480 tmp_ctx,
3481 CONST_DISCARD(struct GUID *,
3482 &(abstract_syntax->uuid)),
3483 map_tower,
3484 entry_handle,
3485 max_towers,
3486 &num_towers,
3487 &towers);
3488
3489 if (!NT_STATUS_IS_OK(status)) {
3490 goto done;
3491 }
3492
3493 if (num_towers != 1) {
3494 status = NT_STATUS_UNSUCCESSFUL;
3495 goto done;
3496 }
3497
3498 /* extract the port from the answer */
3499
3500 status = dcerpc_binding_from_tower(tmp_ctx,
3501 &(towers.twr->tower),
3502 &res_binding);
3503 if (!NT_STATUS_IS_OK(status)) {
3504 goto done;
3505 }
3506
3507 /* are further checks here necessary? */
3508 if (res_binding->transport != NCACN_IP_TCP) {
3509 status = NT_STATUS_UNSUCCESSFUL;
3510 goto done;
3511 }
3512
3513 *pport = (uint16_t)atoi(res_binding->endpoint);
3514
3515 done:
3516 TALLOC_FREE(tmp_ctx);
3517 return status;
3518 }
3519
3520 /**
3521 * Create a rpc pipe client struct, connecting to a host via tcp.
3522 * The port is determined by asking the endpoint mapper on the given
3523 * host.
3524 */
3525 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
3526 const struct ndr_syntax_id *abstract_syntax,
3527 struct rpc_pipe_client **presult)
3528 {
3529 NTSTATUS status;
3530 uint16_t port = 0;
3531
3532 *presult = NULL;
3533
3534 status = rpc_pipe_get_tcp_port(host, abstract_syntax, &port);
3535 if (!NT_STATUS_IS_OK(status)) {
3536 goto done;
3537 }
3538
3539 status = rpc_pipe_open_tcp_port(mem_ctx, host, port,
3540 abstract_syntax, presult);
3541
3542 done:
3543 return status;
3544 }
3545
3546 /********************************************************************
3547 Create a rpc pipe client struct, connecting to a unix domain socket
3548 ********************************************************************/
3549 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
3550 const struct ndr_syntax_id *abstract_syntax,
3551 struct rpc_pipe_client **presult)
3552 {
3553 struct rpc_pipe_client *result;
3554 struct sockaddr_un addr;
3555 NTSTATUS status;
3556
3557 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
3558 if (result == NULL) {
3559 return NT_STATUS_NO_MEMORY;
3560 }
3561
3562 result->transport_type = NCACN_UNIX_STREAM;
3563
3564 result->abstract_syntax = *abstract_syntax;
3565 result->transfer_syntax = ndr_transfer_syntax;
3566
3567 result->desthost = talloc_get_myname(result);
3568 result->srv_name_slash = talloc_asprintf_strupper_m(
3569 result, "\\\\%s", result->desthost);
3570 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3571 status = NT_STATUS_NO_MEMORY;
3572 goto fail;
3573 }
3574
3575 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3576 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3577
3578 result->trans.sock.fd = socket(AF_UNIX, SOCK_STREAM, 0);
3579 if (result->trans.sock.fd == -1) {
3580 status = map_nt_error_from_unix(errno);
3581 goto fail;
3582 }
3583
3584 talloc_set_destructor(result, rpc_pipe_sock_destructor);
3585
3586 ZERO_STRUCT(addr);
3587 addr.sun_family = AF_UNIX;
3588 strncpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
3589
3590 if (sys_connect(result->trans.sock.fd,
3591 (struct sockaddr *)&addr) == -1) {
3592 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
3593 strerror(errno)));
3594 close(result->trans.sock.fd);
3595 return map_nt_error_from_unix(errno);
3596 }
3597
3598 *presult = result;
3599 return NT_STATUS_OK;
3600
3601 fail:
3602 TALLOC_FREE(result);
3603 return status;
3604 }
3605
3606
3607 /****************************************************************************
3608 Open a named pipe over SMB to a remote server.
3609 *
3610 * CAVEAT CALLER OF THIS FUNCTION:
3611 * The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
3612 * so be sure that this function is called AFTER any structure (vs pointer)
3613 * assignment of the cli. In particular, libsmbclient does structure
3614 * assignments of cli, which invalidates the data in the returned
3615 * rpc_pipe_client if this function is called before the structure assignment
3616 * of cli.
3617 *
3618 ****************************************************************************/
3619
3620 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
3621 const struct ndr_syntax_id *abstract_syntax,
3622 struct rpc_pipe_client **presult)
3623 {
3624 struct rpc_pipe_client *result;
3625 int fnum;
3626
3627 /* sanity check to protect against crashes */
3628
3629 if ( !cli ) {
3630 return NT_STATUS_INVALID_HANDLE;
3631 }
3632
3633 result = TALLOC_ZERO_P(NULL, struct rpc_pipe_client);
3634 if (result == NULL) {
3635 return NT_STATUS_NO_MEMORY;
3636 }
3637
3638 result->transport_type = NCACN_NP;
3639
3640 result->trans.np.pipe_name = cli_get_pipe_name_from_iface(
3641 result, cli, abstract_syntax);
3642 if (result->trans.np.pipe_name == NULL) {
3643 DEBUG(1, ("Could not find pipe for interface\n"));
3644 TALLOC_FREE(result);
3645 return NT_STATUS_INVALID_PARAMETER;
3646 }
3647
3648 result->trans.np.cli = cli;
3649 result->abstract_syntax = *abstract_syntax;
3650 result->transfer_syntax = ndr_transfer_syntax;
3651 result->desthost = talloc_strdup(result, cli->desthost);
3652 result->srv_name_slash = talloc_asprintf_strupper_m(
3653 result, "\\\\%s", result->desthost);
3654
3655 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
3656 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
3657
3658 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
3659 TALLOC_FREE(result);
3660 return NT_STATUS_NO_MEMORY;
3661 }
3662
3663 fnum = cli_nt_create(cli, result->trans.np.pipe_name,
3664 DESIRED_ACCESS_PIPE);
3665 if (fnum == -1) {
3666 DEBUG(3,("rpc_pipe_open_np: cli_nt_create failed on pipe %s "
3667 "to machine %s. Error was %s\n",
3668 result->trans.np.pipe_name, cli->desthost,
3669 cli_errstr(cli)));
3670 TALLOC_FREE(result);
3671 return cli_get_nt_error(cli);
3672 }
3673
3674 result->trans.np.fnum = fnum;
3675
3676 DLIST_ADD(cli->pipe_list, result);
3677 talloc_set_destructor(result, rpc_pipe_destructor);
3678
3679 *presult = result;
3680 return NT_STATUS_OK;
3681 }
3682
3683 /****************************************************************************
3684 Open a pipe to a remote server.
3685 ****************************************************************************/
3686
3687 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
3688 const struct ndr_syntax_id *interface,
3689 struct rpc_pipe_client **presult)
3690 {
3691 if (ndr_syntax_id_equal(interface, &ndr_table_drsuapi.syntax_id)) {
3692 /*
3693 * We should have a better way to figure out this drsuapi
3694 * speciality...
3695 */
3696 return rpc_pipe_open_tcp(NULL, cli->desthost, interface,
3697 presult);
3698 }
3699
3700 return rpc_pipe_open_np(cli, interface, presult);
3701 }
3702
3703 /****************************************************************************
3704 Open a named pipe to an SMB server and bind anonymously.
3705 ****************************************************************************/
3706
3707 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
3708 const struct ndr_syntax_id *interface,
3709 struct rpc_pipe_client **presult)
3710 {
3711 struct rpc_pipe_client *result;
3712 struct cli_pipe_auth_data *auth;
3713 NTSTATUS status;
3714
3715 status = cli_rpc_pipe_open(cli, interface, &result);
3716 if (!NT_STATUS_IS_OK(status)) {
3717 return status;
3718 }
3719
3720 status = rpccli_anon_bind_data(result, &auth);
3721 if (!NT_STATUS_IS_OK(status)) {
3722 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
3723 nt_errstr(status)));
3724 TALLOC_FREE(result);
3725 return status;
3726 }
3727
3728 /*
3729 * This is a bit of an abstraction violation due to the fact that an
3730 * anonymous bind on an authenticated SMB inherits the user/domain
3731 * from the enclosing SMB creds
3732 */
3733
3734 TALLOC_FREE(auth->user_name);
3735 TALLOC_FREE(auth->domain);
3736
3737 auth->user_name = talloc_strdup(auth, cli->user_name);
3738 auth->domain = talloc_strdup(auth, cli->domain);
3739 auth->user_session_key = data_blob_talloc(auth,
3740 cli->user_session_key.data,
3741 cli->user_session_key.length);
3742
3743 if ((auth->user_name == NULL) || (auth->domain == NULL)) {
3744 TALLOC_FREE(result);
3745 return NT_STATUS_NO_MEMORY;
3746 }
3747
3748 status = rpc_pipe_bind(result, auth);
3749 if (!NT_STATUS_IS_OK(status)) {
3750 int lvl = 0;
3751 if (ndr_syntax_id_equal(interface,
3752 &ndr_table_dssetup.syntax_id)) {
3753 /* non AD domains just don't have this pipe, avoid
3754 * level 0 statement in that case - gd */
3755 lvl = 3;
3756 }
3757 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
3758 "%s failed with error %s\n",
3759 cli_get_pipe_name_from_iface(debug_ctx(), cli,
3760 interface),
3761 nt_errstr(status) ));
3762 TALLOC_FREE(result);
3763 return status;
3764 }
3765
3766 DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
3767 "%s and bound anonymously.\n", result->trans.np.pipe_name,
3768 cli->desthost ));
3769
3770 *presult = result;
3771 return NT_STATUS_OK;
3772 }
3773
3774 /****************************************************************************
3775 Open a named pipe to an SMB server and bind using NTLMSSP or SPNEGO NTLMSSP
3776 ****************************************************************************/
3777
3778 static NTSTATUS cli_rpc_pipe_open_ntlmssp_internal(struct cli_state *cli,
3779 const struct ndr_syntax_id *interface,
3780 enum pipe_auth_type auth_type,
3781 enum pipe_auth_level auth_level,
3782 const char *domain,
3783 const char *username,
3784 const char *password,
3785 struct rpc_pipe_client **presult)
3786 {
3787 struct rpc_pipe_client *result;
3788 struct cli_pipe_auth_data *auth;
3789 NTSTATUS status;
3790
3791 status = cli_rpc_pipe_open(cli, interface, &result);
3792 if (!NT_STATUS_IS_OK(status)) {
3793 return status;
3794 }
3795
3796 status = rpccli_ntlmssp_bind_data(
3797 result, auth_type, auth_level, domain, username,
3798 cli->pwd.null_pwd ? NULL : password, &auth);
3799 if (!NT_STATUS_IS_OK(status)) {
3800 DEBUG(0, ("rpccli_ntlmssp_bind_data returned %s\n",
3801 nt_errstr(status)));
3802 goto err;
3803 }
3804
3805 status = rpc_pipe_bind(result, auth);
3806 if (!NT_STATUS_IS_OK(status)) {
3807 DEBUG(0, ("cli_rpc_pipe_open_ntlmssp_internal: cli_rpc_pipe_bind failed with error %s\n",
3808 nt_errstr(status) ));
3809 goto err;
3810 }
3811
3812 DEBUG(10,("cli_rpc_pipe_open_ntlmssp_internal: opened pipe %s to "
3813 "machine %s and bound NTLMSSP as user %s\\%s.\n",
3814 result->trans.np.pipe_name, cli->desthost,
3815 domain, username ));
3816
3817 *presult = result;
3818 return NT_STATUS_OK;
3819
3820 err:
3821
3822 TALLOC_FREE(result);
3823 return status;
3824 }
3825
3826 /****************************************************************************
3827 External interface.
3828 Open a named pipe to an SMB server and bind using NTLMSSP (bind type 10)
3829 ****************************************************************************/
3830
3831 NTSTATUS cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
3832 const struct ndr_syntax_id *interface,
3833 enum pipe_auth_level auth_level,
3834 const char *domain,
3835 const char *username,
3836 const char *password,
3837 struct rpc_pipe_client **presult)
3838 {
3839 return cli_rpc_pipe_open_ntlmssp_internal(cli,
3840 interface,
3841 PIPE_AUTH_TYPE_NTLMSSP,
3842 auth_level,
3843 domain,
3844 username,
3845 password,
3846 presult);
3847 }
3848
3849 /****************************************************************************
3850 External interface.
3851 Open a named pipe to an SMB server and bind using spnego NTLMSSP (bind type 9)
3852 ****************************************************************************/
3853
3854 NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
3855 const struct ndr_syntax_id *interface,
3856 enum pipe_auth_level auth_level,
3857 const char *domain,
3858 const char *username,
3859 const char *password,
3860 struct rpc_pipe_client **presult)
3861 {
3862 return cli_rpc_pipe_open_ntlmssp_internal(cli,
3863 interface,
3864 PIPE_AUTH_TYPE_SPNEGO_NTLMSSP,
3865 auth_level,
3866 domain,
3867 username,
3868 password,
3869 presult);
3870 }
3871
3872 /****************************************************************************
3873 Get a the schannel session key out of an already opened netlogon pipe.
3874 ****************************************************************************/
3875 static NTSTATUS get_schannel_session_key_common(struct rpc_pipe_client *netlogon_pipe,
3876 struct cli_state *cli,
3877 const char *domain,
3878 uint32 *pneg_flags)
3879 {
3880 uint32 sec_chan_type = 0;
3881 unsigned char machine_pwd[16];
3882 const char *machine_account;
3883 NTSTATUS status;
3884
3885 /* Get the machine account credentials from secrets.tdb. */
3886 if (!get_trust_pw_hash(domain, machine_pwd, &machine_account,
3887 &sec_chan_type))
3888 {
3889 DEBUG(0, ("get_schannel_session_key: could not fetch "
3890 "trust account password for domain '%s'\n",
3891 domain));
3892 return NT_STATUS_CANT_ACCESS_DOMAIN_INFO;
3893 }
3894
3895 status = rpccli_netlogon_setup_creds(netlogon_pipe,
3896 cli->desthost, /* server name */
3897 domain, /* domain */
3898 global_myname(), /* client name */
3899 machine_account, /* machine account name */
3900 machine_pwd,
3901 sec_chan_type,
3902 pneg_flags);
3903
3904 if (!NT_STATUS_IS_OK(status)) {
3905 DEBUG(3, ("get_schannel_session_key_common: "
3906 "rpccli_netlogon_setup_creds failed with result %s "
3907 "to server %s, domain %s, machine account %s.\n",
3908 nt_errstr(status), cli->desthost, domain,
3909 machine_account ));
3910 return status;
3911 }
3912
3913 if (((*pneg_flags) & NETLOGON_NEG_SCHANNEL) == 0) {
3914 DEBUG(3, ("get_schannel_session_key: Server %s did not offer schannel\n",
3915 cli->desthost));
3916 return NT_STATUS_INVALID_NETWORK_RESPONSE;
3917 }
3918
3919 return NT_STATUS_OK;;
3920 }
3921
3922 /****************************************************************************
3923 Open a netlogon pipe and get the schannel session key.
3924 Now exposed to external callers.
3925 ****************************************************************************/
3926
3927
3928 NTSTATUS get_schannel_session_key(struct cli_state *cli,
3929 const char *domain,
3930 uint32 *pneg_flags,
3931 struct rpc_pipe_client **presult)
3932 {
3933 struct rpc_pipe_client *netlogon_pipe = NULL;
3934 NTSTATUS status;
3935
3936 status = cli_rpc_pipe_open_noauth(cli, &ndr_table_netlogon.syntax_id,
3937 &netlogon_pipe);
3938 if (!NT_STATUS_IS_OK(status)) {
3939 return status;
3940 }
3941
3942 status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
3943 pneg_flags);
3944 if (!NT_STATUS_IS_OK(status)) {
3945 TALLOC_FREE(netlogon_pipe);
3946 return status;
3947 }
3948
3949 *presult = netlogon_pipe;
3950 return NT_STATUS_OK;
3951 }
3952
3953 /****************************************************************************
3954 External interface.
3955 Open a named pipe to an SMB server and bind using schannel (bind type 68)
3956 using session_key. sign and seal.
3957 ****************************************************************************/
3958
3959 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
3960 const struct ndr_syntax_id *interface,
3961 enum pipe_auth_level auth_level,
3962 const char *domain,
3963 const struct dcinfo *pdc,
3964 struct rpc_pipe_client **presult)
3965 {
3966 struct rpc_pipe_client *result;
3967 struct cli_pipe_auth_data *auth;
3968 NTSTATUS status;
3969
3970 status = cli_rpc_pipe_open(cli, interface, &result);
3971 if (!NT_STATUS_IS_OK(status)) {
3972 return status;
3973 }
3974
3975 status = rpccli_schannel_bind_data(result, domain, auth_level,
3976 pdc->sess_key, &auth);
3977 if (!NT_STATUS_IS_OK(status)) {
3978 DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
3979 nt_errstr(status)));
3980 TALLOC_FREE(result);
3981 return status;
3982 }
3983
3984 status = rpc_pipe_bind(result, auth);
3985 if (!NT_STATUS_IS_OK(status)) {
3986 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
3987 "cli_rpc_pipe_bind failed with error %s\n",
3988 nt_errstr(status) ));
3989 TALLOC_FREE(result);
3990 return status;
3991 }
3992
3993 /*
3994 * The credentials on a new netlogon pipe are the ones we are passed
3995 * in - copy them over.
3996 */
3997 result->dc = (struct dcinfo *)talloc_memdup(result, pdc, sizeof(*pdc));
3998 if (result->dc == NULL) {
3999 DEBUG(0, ("talloc failed\n"));
4000 TALLOC_FREE(result);
4001 return NT_STATUS_NO_MEMORY;
4002 }
4003
4004 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
4005 "for domain %s "
4006 "and bound using schannel.\n",
4007 result->trans.np.pipe_name, cli->desthost, domain ));
4008
4009 *presult = result;
4010 return NT_STATUS_OK;
4011 }
4012
4013 /****************************************************************************
4014 Open a named pipe to an SMB server and bind using schannel (bind type 68).
4015 Fetch the session key ourselves using a temporary netlogon pipe. This
4016 version uses an ntlmssp auth bound netlogon pipe to get the key.
4017 ****************************************************************************/
4018
4019 static NTSTATUS get_schannel_session_key_auth_ntlmssp(struct cli_state *cli,
4020 const char *domain,
4021 const char *username,
4022 const char *password,
4023 uint32 *pneg_flags,
4024 struct rpc_pipe_client **presult)
4025 {
4026 struct rpc_pipe_client *netlogon_pipe = NULL;
4027 NTSTATUS status;
4028
4029 status = cli_rpc_pipe_open_spnego_ntlmssp(
4030 cli, &ndr_table_netlogon.syntax_id, PIPE_AUTH_LEVEL_PRIVACY,
4031 domain, username, password, &netlogon_pipe);
4032 if (!NT_STATUS_IS_OK(status)) {
4033 return status;
4034 }
4035
4036 status = get_schannel_session_key_common(netlogon_pipe, cli, domain,
4037 pneg_flags);
4038 if (!NT_STATUS_IS_OK(status)) {
4039 TALLOC_FREE(netlogon_pipe);
4040 return status;
4041 }
4042
4043 *presult = netlogon_pipe;
4044 return NT_STATUS_OK;
4045 }
4046
4047 /****************************************************************************
4048 Open a named pipe to an SMB server and bind using schannel (bind type 68).
4049 Fetch the session key ourselves using a temporary netlogon pipe. This version
4050 uses an ntlmssp bind to get the session key.
4051 ****************************************************************************/
4052
4053 NTSTATUS cli_rpc_pipe_open_ntlmssp_auth_schannel(struct cli_state *cli,
4054 const struct ndr_syntax_id *interface,
4055 enum pipe_auth_level auth_level,
4056 const char *domain,
4057 const char *username,
4058 const char *password,
4059 struct rpc_pipe_client **presult)
4060 {
4061 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
4062 struct rpc_pipe_client *netlogon_pipe = NULL;
4063 struct rpc_pipe_client *result = NULL;
4064 NTSTATUS status;
4065
4066 status = get_schannel_session_key_auth_ntlmssp(
4067 cli, domain, username, password, &neg_flags, &netlogon_pipe);
4068 if (!NT_STATUS_IS_OK(status)) {
4069 DEBUG(0,("cli_rpc_pipe_open_ntlmssp_auth_schannel: failed to get schannel session "
4070 "key from server %s for domain %s.\n",
4071 cli->desthost, domain ));
4072 return status;
4073 }
4074
4075 status = cli_rpc_pipe_open_schannel_with_key(
4076 cli, interface, auth_level, domain, netlogon_pipe->dc,
4077 &result);
4078
4079 /* Now we've bound using the session key we can close the netlog pipe. */
4080 TALLOC_FREE(netlogon_pipe);
4081
4082 if (NT_STATUS_IS_OK(status)) {
4083 *presult = result;
4084 }
4085 return status;
4086 }
4087
4088 /****************************************************************************
4089 Open a named pipe to an SMB server and bind using schannel (bind type 68).
4090 Fetch the session key ourselves using a temporary netlogon pipe.
4091 ****************************************************************************/
4092
4093 NTSTATUS cli_rpc_pipe_open_schannel(struct cli_state *cli,
4094 const struct ndr_syntax_id *interface,
4095 enum pipe_auth_level auth_level,
4096 const char *domain,
4097 struct rpc_pipe_client **presult)
4098 {
4099 uint32_t neg_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
4100 struct rpc_pipe_client *netlogon_pipe = NULL;
4101 struct rpc_pipe_client *result = NULL;
4102 NTSTATUS status;
4103
4104 status = get_schannel_session_key(cli, domain, &neg_flags,
4105 &netlogon_pipe);
4106 if (!NT_STATUS_IS_OK(status)) {
4107 DEBUG(0,("cli_rpc_pipe_open_schannel: failed to get schannel session "
4108 "key from server %s for domain %s.\n",
4109 cli->desthost, domain ));
4110 return status;
4111 }
4112
4113 status = cli_rpc_pipe_open_schannel_with_key(
4114 cli, interface, auth_level, domain, netlogon_pipe->dc,
4115 &result);
4116
4117 /* Now we've bound using the session key we can close the netlog pipe. */
4118 TALLOC_FREE(netlogon_pipe);
4119
4120 if (NT_STATUS_IS_OK(status)) {
4121 *presult = result;
4122 }
4123
4124 return NT_STATUS_OK;
4125 }
4126
4127 /****************************************************************************
4128 Open a named pipe to an SMB server and bind using krb5 (bind type 16).
4129 The idea is this can be called with service_princ, username and password all
4130 NULL so long as the caller has a TGT.
4131 ****************************************************************************/
4132
4133 NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
4134 const struct ndr_syntax_id *interface,
4135 enum pipe_auth_level auth_level,
4136 const char *service_princ,
4137 const char *username,
4138 const char *password,
4139 struct rpc_pipe_client **presult)
4140 {
4141 #ifdef HAVE_KRB5
4142 struct rpc_pipe_client *result;
4143 struct cli_pipe_auth_data *auth;
4144 NTSTATUS status;
4145
4146 status = cli_rpc_pipe_open(cli, interface, &result);
4147 if (!NT_STATUS_IS_OK(status)) {
4148 return status;
4149 }
4150
4151 status = rpccli_kerberos_bind_data(result, auth_level, service_princ,
4152 username, password, &auth);
4153 if (!NT_STATUS_IS_OK(status)) {
4154 DEBUG(0, ("rpccli_kerberos_bind_data returned %s\n",
4155 nt_errstr(status)));
4156 TALLOC_FREE(result);
4157 return status;
4158 }
4159
4160 status = rpc_pipe_bind(result, auth);
4161 if (!NT_STATUS_IS_OK(status)) {
4162 DEBUG(0, ("cli_rpc_pipe_open_krb5: cli_rpc_pipe_bind failed "
4163 "with error %s\n", nt_errstr(status)));
4164 TALLOC_FREE(result);
4165 return status;
4166 }
4167
4168 *presult = result;
4169 return NT_STATUS_OK;
4170 #else
4171 DEBUG(0,("cli_rpc_pipe_open_krb5: kerberos not found at compile time.\n"));
4172 return NT_STATUS_NOT_IMPLEMENTED;
4173 #endif
4174 }
4175
4176 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
4177 struct rpc_pipe_client *cli,
4178 DATA_BLOB *session_key)
4179 {
4180 if (!session_key || !cli) {
4181 return NT_STATUS_INVALID_PARAMETER;
4182 }
4183
4184 if (!cli->auth) {
4185 return NT_STATUS_INVALID_PARAMETER;
4186 }
4187
4188 switch (cli->auth->auth_type) {
4189 case PIPE_AUTH_TYPE_SCHANNEL:
4190 *session_key = data_blob_talloc(mem_ctx,
4191 cli->auth->a_u.schannel_auth->sess_key, 16);
4192 break;
4193 case PIPE_AUTH_TYPE_NTLMSSP:
4194 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
4195 *session_key = data_blob_talloc(mem_ctx,
4196 cli->auth->a_u.ntlmssp_state->session_key.data,
4197 cli->auth->a_u.ntlmssp_state->session_key.length);
4198 break;
4199 case PIPE_AUTH_TYPE_KRB5:
4200 case PIPE_AUTH_TYPE_SPNEGO_KRB5:
4201 *session_key = data_blob_talloc(mem_ctx,
4202 cli->auth->a_u.kerberos_auth->session_key.data,
4203 cli->auth->a_u.kerberos_auth->session_key.length);
4204 break;
4205 case PIPE_AUTH_TYPE_NONE:
4206 *session_key = data_blob_talloc(mem_ctx,
4207 cli->auth->user_session_key.data,
4208 cli->auth->user_session_key.length);
4209 break;
4210 default:
4211 return NT_STATUS_NO_USER_SESSION_KEY;
4212 }
4213
4214 return NT_STATUS_OK;
4215 }
Samba GIT mirror