?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-pysmbd: Fix error message
[Samba/bb.git] / source3 / rpc_client / cli_pipe.c
blobedb3876b70e9d8e1b64e1469aa01b968dcb28073
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client routines
4 * Largely rewritten by Jeremy Allison 2005.
5 * Heavily modified by Simo Sorce 2010.
6 * Copyright Andrew Bartlett 2011.
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "../lib/util/tevent_ntstatus.h"
24 #include "librpc/gen_ndr/ndr_epmapper_c.h"
25 #include "../librpc/gen_ndr/ndr_schannel.h"
26 #include "../librpc/gen_ndr/ndr_dssetup.h"
27 #include "../libcli/auth/schannel.h"
28 #include "../libcli/auth/spnego.h"
29 #include "../auth/ntlmssp/ntlmssp.h"
30 #include "auth_generic.h"
31 #include "librpc/gen_ndr/ndr_dcerpc.h"
32 #include "librpc/gen_ndr/ndr_netlogon_c.h"
33 #include "librpc/rpc/dcerpc.h"
34 #include "rpc_dce.h"
35 #include "cli_pipe.h"
36 #include "libsmb/libsmb.h"
37 #include "auth/gensec/gensec.h"
38 #include "auth/credentials/credentials.h"
39 #include "../libcli/smb/smbXcli_base.h"
40
41 #undef DBGC_CLASS
42 #define DBGC_CLASS DBGC_RPC_CLI
43
44 /********************************************************************
45 Pipe description for a DEBUG
46 ********************************************************************/
47 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
48 struct rpc_pipe_client *cli)
49 {
50 char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
51 if (result == NULL) {
52 return "pipe";
53 }
54 return result;
55 }
56
57 /********************************************************************
58 Rpc pipe call id.
59 ********************************************************************/
60
61 static uint32 get_rpc_call_id(void)
62 {
63 static uint32 call_id = 0;
64 return ++call_id;
65 }
66
67 /*******************************************************************
68 Use SMBreadX to get rest of one fragment's worth of rpc data.
69 Reads the whole size or give an error message
70 ********************************************************************/
71
72 struct rpc_read_state {
73 struct event_context *ev;
74 struct rpc_cli_transport *transport;
75 uint8_t *data;
76 size_t size;
77 size_t num_read;
78 };
79
80 static void rpc_read_done(struct tevent_req *subreq);
81
82 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
83 struct event_context *ev,
84 struct rpc_cli_transport *transport,
85 uint8_t *data, size_t size)
86 {
87 struct tevent_req *req, *subreq;
88 struct rpc_read_state *state;
89
90 req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
91 if (req == NULL) {
92 return NULL;
93 }
94 state->ev = ev;
95 state->transport = transport;
96 state->data = data;
97 state->size = size;
98 state->num_read = 0;
99
100 DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
101
102 subreq = transport->read_send(state, ev, (uint8_t *)data, size,
103 transport->priv);
104 if (subreq == NULL) {
105 goto fail;
106 }
107 tevent_req_set_callback(subreq, rpc_read_done, req);
108 return req;
109
110 fail:
111 TALLOC_FREE(req);
112 return NULL;
113 }
114
115 static void rpc_read_done(struct tevent_req *subreq)
116 {
117 struct tevent_req *req = tevent_req_callback_data(
118 subreq, struct tevent_req);
119 struct rpc_read_state *state = tevent_req_data(
120 req, struct rpc_read_state);
121 NTSTATUS status;
122 ssize_t received;
123
124 status = state->transport->read_recv(subreq, &received);
125 TALLOC_FREE(subreq);
126 if (!NT_STATUS_IS_OK(status)) {
127 tevent_req_nterror(req, status);
128 return;
129 }
130
131 state->num_read += received;
132 if (state->num_read == state->size) {
133 tevent_req_done(req);
134 return;
135 }
136
137 subreq = state->transport->read_send(state, state->ev,
138 state->data + state->num_read,
139 state->size - state->num_read,
140 state->transport->priv);
141 if (tevent_req_nomem(subreq, req)) {
142 return;
143 }
144 tevent_req_set_callback(subreq, rpc_read_done, req);
145 }
146
147 static NTSTATUS rpc_read_recv(struct tevent_req *req)
148 {
149 return tevent_req_simple_recv_ntstatus(req);
150 }
151
152 struct rpc_write_state {
153 struct event_context *ev;
154 struct rpc_cli_transport *transport;
155 const uint8_t *data;
156 size_t size;
157 size_t num_written;
158 };
159
160 static void rpc_write_done(struct tevent_req *subreq);
161
162 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
163 struct event_context *ev,
164 struct rpc_cli_transport *transport,
165 const uint8_t *data, size_t size)
166 {
167 struct tevent_req *req, *subreq;
168 struct rpc_write_state *state;
169
170 req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
171 if (req == NULL) {
172 return NULL;
173 }
174 state->ev = ev;
175 state->transport = transport;
176 state->data = data;
177 state->size = size;
178 state->num_written = 0;
179
180 DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
181
182 subreq = transport->write_send(state, ev, data, size, transport->priv);
183 if (subreq == NULL) {
184 goto fail;
185 }
186 tevent_req_set_callback(subreq, rpc_write_done, req);
187 return req;
188 fail:
189 TALLOC_FREE(req);
190 return NULL;
191 }
192
193 static void rpc_write_done(struct tevent_req *subreq)
194 {
195 struct tevent_req *req = tevent_req_callback_data(
196 subreq, struct tevent_req);
197 struct rpc_write_state *state = tevent_req_data(
198 req, struct rpc_write_state);
199 NTSTATUS status;
200 ssize_t written;
201
202 status = state->transport->write_recv(subreq, &written);
203 TALLOC_FREE(subreq);
204 if (!NT_STATUS_IS_OK(status)) {
205 tevent_req_nterror(req, status);
206 return;
207 }
208
209 state->num_written += written;
210
211 if (state->num_written == state->size) {
212 tevent_req_done(req);
213 return;
214 }
215
216 subreq = state->transport->write_send(state, state->ev,
217 state->data + state->num_written,
218 state->size - state->num_written,
219 state->transport->priv);
220 if (tevent_req_nomem(subreq, req)) {
221 return;
222 }
223 tevent_req_set_callback(subreq, rpc_write_done, req);
224 }
225
226 static NTSTATUS rpc_write_recv(struct tevent_req *req)
227 {
228 return tevent_req_simple_recv_ntstatus(req);
229 }
230
231
232 /****************************************************************************
233 Try and get a PDU's worth of data from current_pdu. If not, then read more
234 from the wire.
235 ****************************************************************************/
236
237 struct get_complete_frag_state {
238 struct event_context *ev;
239 struct rpc_pipe_client *cli;
240 uint16_t frag_len;
241 DATA_BLOB *pdu;
242 };
243
244 static void get_complete_frag_got_header(struct tevent_req *subreq);
245 static void get_complete_frag_got_rest(struct tevent_req *subreq);
246
247 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
248 struct event_context *ev,
249 struct rpc_pipe_client *cli,
250 DATA_BLOB *pdu)
251 {
252 struct tevent_req *req, *subreq;
253 struct get_complete_frag_state *state;
254 size_t received;
255 NTSTATUS status;
256
257 req = tevent_req_create(mem_ctx, &state,
258 struct get_complete_frag_state);
259 if (req == NULL) {
260 return NULL;
261 }
262 state->ev = ev;
263 state->cli = cli;
264 state->frag_len = RPC_HEADER_LEN;
265 state->pdu = pdu;
266
267 received = pdu->length;
268 if (received < RPC_HEADER_LEN) {
269 if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
270 status = NT_STATUS_NO_MEMORY;
271 goto post_status;
272 }
273 subreq = rpc_read_send(state, state->ev,
274 state->cli->transport,
275 pdu->data + received,
276 RPC_HEADER_LEN - received);
277 if (subreq == NULL) {
278 status = NT_STATUS_NO_MEMORY;
279 goto post_status;
280 }
281 tevent_req_set_callback(subreq, get_complete_frag_got_header,
282 req);
283 return req;
284 }
285
286 state->frag_len = dcerpc_get_frag_length(pdu);
287
288 /*
289 * Ensure we have frag_len bytes of data.
290 */
291 if (received < state->frag_len) {
292 if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
293 status = NT_STATUS_NO_MEMORY;
294 goto post_status;
295 }
296 subreq = rpc_read_send(state, state->ev,
297 state->cli->transport,
298 pdu->data + received,
299 state->frag_len - received);
300 if (subreq == NULL) {
301 status = NT_STATUS_NO_MEMORY;
302 goto post_status;
303 }
304 tevent_req_set_callback(subreq, get_complete_frag_got_rest,
305 req);
306 return req;
307 }
308
309 status = NT_STATUS_OK;
310 post_status:
311 if (NT_STATUS_IS_OK(status)) {
312 tevent_req_done(req);
313 } else {
314 tevent_req_nterror(req, status);
315 }
316 return tevent_req_post(req, ev);
317 }
318
319 static void get_complete_frag_got_header(struct tevent_req *subreq)
320 {
321 struct tevent_req *req = tevent_req_callback_data(
322 subreq, struct tevent_req);
323 struct get_complete_frag_state *state = tevent_req_data(
324 req, struct get_complete_frag_state);
325 NTSTATUS status;
326
327 status = rpc_read_recv(subreq);
328 TALLOC_FREE(subreq);
329 if (!NT_STATUS_IS_OK(status)) {
330 tevent_req_nterror(req, status);
331 return;
332 }
333
334 state->frag_len = dcerpc_get_frag_length(state->pdu);
335
336 if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
337 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
338 return;
339 }
340
341 /*
342 * We're here in this piece of code because we've read exactly
343 * RPC_HEADER_LEN bytes into state->pdu.
344 */
345
346 subreq = rpc_read_send(state, state->ev, state->cli->transport,
347 state->pdu->data + RPC_HEADER_LEN,
348 state->frag_len - RPC_HEADER_LEN);
349 if (tevent_req_nomem(subreq, req)) {
350 return;
351 }
352 tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
353 }
354
355 static void get_complete_frag_got_rest(struct tevent_req *subreq)
356 {
357 struct tevent_req *req = tevent_req_callback_data(
358 subreq, struct tevent_req);
359 NTSTATUS status;
360
361 status = rpc_read_recv(subreq);
362 TALLOC_FREE(subreq);
363 if (!NT_STATUS_IS_OK(status)) {
364 tevent_req_nterror(req, status);
365 return;
366 }
367 tevent_req_done(req);
368 }
369
370 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
371 {
372 return tevent_req_simple_recv_ntstatus(req);
373 }
374
375 /****************************************************************************
376 Do basic authentication checks on an incoming pdu.
377 ****************************************************************************/
378
379 static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
380 struct rpc_pipe_client *cli,
381 struct ncacn_packet *pkt,
382 DATA_BLOB *pdu,
383 uint8_t expected_pkt_type,
384 DATA_BLOB *rdata,
385 DATA_BLOB *reply_pdu)
386 {
387 struct dcerpc_response *r;
388 NTSTATUS ret = NT_STATUS_OK;
389 size_t pad_len = 0;
390
391 /*
392 * Point the return values at the real data including the RPC
393 * header. Just in case the caller wants it.
394 */
395 *rdata = *pdu;
396
397 /* Ensure we have the correct type. */
398 switch (pkt->ptype) {
399 case DCERPC_PKT_ALTER_RESP:
400 case DCERPC_PKT_BIND_ACK:
401
402 /* Client code never receives this kind of packets */
403 break;
404
405
406 case DCERPC_PKT_RESPONSE:
407
408 r = &pkt->u.response;
409
410 /* Here's where we deal with incoming sign/seal. */
411 ret = dcerpc_check_auth(cli->auth, pkt,
412 &r->stub_and_verifier,
413 DCERPC_RESPONSE_LENGTH,
414 pdu, &pad_len);
415 if (!NT_STATUS_IS_OK(ret)) {
416 return ret;
417 }
418
419 if (pkt->frag_length < DCERPC_RESPONSE_LENGTH + pad_len) {
420 return NT_STATUS_BUFFER_TOO_SMALL;
421 }
422
423 /* Point the return values at the NDR data. */
424 rdata->data = r->stub_and_verifier.data;
425
426 if (pkt->auth_length) {
427 /* We've already done integer wrap tests in
428 * dcerpc_check_auth(). */
429 rdata->length = r->stub_and_verifier.length
430 - pad_len
431 - DCERPC_AUTH_TRAILER_LENGTH
432 - pkt->auth_length;
433 } else {
434 rdata->length = r->stub_and_verifier.length;
435 }
436
437 DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
438 (long unsigned int)pdu->length,
439 (long unsigned int)rdata->length,
440 (unsigned int)pad_len));
441
442 /*
443 * If this is the first reply, and the allocation hint is
444 * reasonable, try and set up the reply_pdu DATA_BLOB to the
445 * correct size.
446 */
447
448 if ((reply_pdu->length == 0) &&
449 r->alloc_hint && (r->alloc_hint < 15*1024*1024)) {
450 if (!data_blob_realloc(mem_ctx, reply_pdu,
451 r->alloc_hint)) {
452 DEBUG(0, ("reply alloc hint %d too "
453 "large to allocate\n",
454 (int)r->alloc_hint));
455 return NT_STATUS_NO_MEMORY;
456 }
457 }
458
459 break;
460
461 case DCERPC_PKT_BIND_NAK:
462 DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
463 rpccli_pipe_txt(talloc_tos(), cli)));
464 /* Use this for now... */
465 return NT_STATUS_NETWORK_ACCESS_DENIED;
466
467 case DCERPC_PKT_FAULT:
468
469 DEBUG(1, (__location__ ": RPC fault code %s received "
470 "from %s!\n",
471 dcerpc_errstr(talloc_tos(),
472 pkt->u.fault.status),
473 rpccli_pipe_txt(talloc_tos(), cli)));
474
475 return dcerpc_fault_to_nt_status(pkt->u.fault.status);
476
477 default:
478 DEBUG(0, (__location__ "Unknown packet type %u received "
479 "from %s!\n",
480 (unsigned int)pkt->ptype,
481 rpccli_pipe_txt(talloc_tos(), cli)));
482 return NT_STATUS_INVALID_INFO_CLASS;
483 }
484
485 if (pkt->ptype != expected_pkt_type) {
486 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
487 "RPC packet type - %u, not %u\n",
488 rpccli_pipe_txt(talloc_tos(), cli),
489 pkt->ptype, expected_pkt_type));
490 return NT_STATUS_INVALID_INFO_CLASS;
491 }
492
493 /* Do this just before return - we don't want to modify any rpc header
494 data before now as we may have needed to do cryptographic actions on
495 it before. */
496
497 if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
498 !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
499 DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
500 "fragment first/last ON.\n"));
501 pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
502 }
503
504 return NT_STATUS_OK;
505 }
506
507 /****************************************************************************
508 Call a remote api on an arbitrary pipe. takes param, data and setup buffers.
509 ****************************************************************************/
510
511 struct cli_api_pipe_state {
512 struct event_context *ev;
513 struct rpc_cli_transport *transport;
514 uint8_t *rdata;
515 uint32_t rdata_len;
516 };
517
518 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
519 static void cli_api_pipe_write_done(struct tevent_req *subreq);
520 static void cli_api_pipe_read_done(struct tevent_req *subreq);
521
522 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
523 struct event_context *ev,
524 struct rpc_cli_transport *transport,
525 uint8_t *data, size_t data_len,
526 uint32_t max_rdata_len)
527 {
528 struct tevent_req *req, *subreq;
529 struct cli_api_pipe_state *state;
530 NTSTATUS status;
531
532 req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
533 if (req == NULL) {
534 return NULL;
535 }
536 state->ev = ev;
537 state->transport = transport;
538
539 if (max_rdata_len < RPC_HEADER_LEN) {
540 /*
541 * For a RPC reply we always need at least RPC_HEADER_LEN
542 * bytes. We check this here because we will receive
543 * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
544 */
545 status = NT_STATUS_INVALID_PARAMETER;
546 goto post_status;
547 }
548
549 if (transport->trans_send != NULL) {
550 subreq = transport->trans_send(state, ev, data, data_len,
551 max_rdata_len, transport->priv);
552 if (subreq == NULL) {
553 goto fail;
554 }
555 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
556 return req;
557 }
558
559 /*
560 * If the transport does not provide a "trans" routine, i.e. for
561 * example the ncacn_ip_tcp transport, do the write/read step here.
562 */
563
564 subreq = rpc_write_send(state, ev, transport, data, data_len);
565 if (subreq == NULL) {
566 goto fail;
567 }
568 tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
569 return req;
570
571 post_status:
572 tevent_req_nterror(req, status);
573 return tevent_req_post(req, ev);
574 fail:
575 TALLOC_FREE(req);
576 return NULL;
577 }
578
579 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
580 {
581 struct tevent_req *req = tevent_req_callback_data(
582 subreq, struct tevent_req);
583 struct cli_api_pipe_state *state = tevent_req_data(
584 req, struct cli_api_pipe_state);
585 NTSTATUS status;
586
587 status = state->transport->trans_recv(subreq, state, &state->rdata,
588 &state->rdata_len);
589 TALLOC_FREE(subreq);
590 if (!NT_STATUS_IS_OK(status)) {
591 tevent_req_nterror(req, status);
592 return;
593 }
594 tevent_req_done(req);
595 }
596
597 static void cli_api_pipe_write_done(struct tevent_req *subreq)
598 {
599 struct tevent_req *req = tevent_req_callback_data(
600 subreq, struct tevent_req);
601 struct cli_api_pipe_state *state = tevent_req_data(
602 req, struct cli_api_pipe_state);
603 NTSTATUS status;
604
605 status = rpc_write_recv(subreq);
606 TALLOC_FREE(subreq);
607 if (!NT_STATUS_IS_OK(status)) {
608 tevent_req_nterror(req, status);
609 return;
610 }
611
612 state->rdata = talloc_array(state, uint8_t, RPC_HEADER_LEN);
613 if (tevent_req_nomem(state->rdata, req)) {
614 return;
615 }
616
617 /*
618 * We don't need to use rpc_read_send here, the upper layer will cope
619 * with a short read, transport->trans_send could also return less
620 * than state->max_rdata_len.
621 */
622 subreq = state->transport->read_send(state, state->ev, state->rdata,
623 RPC_HEADER_LEN,
624 state->transport->priv);
625 if (tevent_req_nomem(subreq, req)) {
626 return;
627 }
628 tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
629 }
630
631 static void cli_api_pipe_read_done(struct tevent_req *subreq)
632 {
633 struct tevent_req *req = tevent_req_callback_data(
634 subreq, struct tevent_req);
635 struct cli_api_pipe_state *state = tevent_req_data(
636 req, struct cli_api_pipe_state);
637 NTSTATUS status;
638 ssize_t received;
639
640 status = state->transport->read_recv(subreq, &received);
641 TALLOC_FREE(subreq);
642 if (!NT_STATUS_IS_OK(status)) {
643 tevent_req_nterror(req, status);
644 return;
645 }
646 state->rdata_len = received;
647 tevent_req_done(req);
648 }
649
650 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
651 uint8_t **prdata, uint32_t *prdata_len)
652 {
653 struct cli_api_pipe_state *state = tevent_req_data(
654 req, struct cli_api_pipe_state);
655 NTSTATUS status;
656
657 if (tevent_req_is_nterror(req, &status)) {
658 return status;
659 }
660
661 *prdata = talloc_move(mem_ctx, &state->rdata);
662 *prdata_len = state->rdata_len;
663 return NT_STATUS_OK;
664 }
665
666 /****************************************************************************
667 Send data on an rpc pipe via trans. The data must be the last
668 pdu fragment of an NDR data stream.
669
670 Receive response data from an rpc pipe, which may be large...
671
672 Read the first fragment: unfortunately have to use SMBtrans for the first
673 bit, then SMBreadX for subsequent bits.
674
675 If first fragment received also wasn't the last fragment, continue
676 getting fragments until we _do_ receive the last fragment.
677
678 Request/Response PDU's look like the following...
679
680 |<------------------PDU len----------------------------------------------->|
681 |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
682
683 +------------+-----------------+-------------+---------------+-------------+
684 | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR | AUTH DATA |
685 +------------+-----------------+-------------+---------------+-------------+
686
687 Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
688 signing & sealing being negotiated.
689
690 ****************************************************************************/
691
692 struct rpc_api_pipe_state {
693 struct event_context *ev;
694 struct rpc_pipe_client *cli;
695 uint8_t expected_pkt_type;
696
697 DATA_BLOB incoming_frag;
698 struct ncacn_packet *pkt;
699
700 /* Incoming reply */
701 DATA_BLOB reply_pdu;
702 size_t reply_pdu_offset;
703 uint8_t endianess;
704 };
705
706 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
707 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
708 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq);
709
710 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
711 struct event_context *ev,
712 struct rpc_pipe_client *cli,
713 DATA_BLOB *data, /* Outgoing PDU */
714 uint8_t expected_pkt_type)
715 {
716 struct tevent_req *req, *subreq;
717 struct rpc_api_pipe_state *state;
718 uint16_t max_recv_frag;
719 NTSTATUS status;
720
721 req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
722 if (req == NULL) {
723 return NULL;
724 }
725 state->ev = ev;
726 state->cli = cli;
727 state->expected_pkt_type = expected_pkt_type;
728 state->incoming_frag = data_blob_null;
729 state->reply_pdu = data_blob_null;
730 state->reply_pdu_offset = 0;
731 state->endianess = DCERPC_DREP_LE;
732
733 /*
734 * Ensure we're not sending too much.
735 */
736 if (data->length > cli->max_xmit_frag) {
737 status = NT_STATUS_INVALID_PARAMETER;
738 goto post_status;
739 }
740
741 DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
742
743 if (state->expected_pkt_type == DCERPC_PKT_AUTH3) {
744 subreq = rpc_write_send(state, ev, cli->transport,
745 data->data, data->length);
746 if (subreq == NULL) {
747 goto fail;
748 }
749 tevent_req_set_callback(subreq, rpc_api_pipe_auth3_done, req);
750 return req;
751 }
752
753 /* get the header first, then fetch the rest once we have
754 * the frag_length available */
755 max_recv_frag = RPC_HEADER_LEN;
756
757 subreq = cli_api_pipe_send(state, ev, cli->transport,
758 data->data, data->length, max_recv_frag);
759 if (subreq == NULL) {
760 goto fail;
761 }
762 tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
763 return req;
764
765 post_status:
766 tevent_req_nterror(req, status);
767 return tevent_req_post(req, ev);
768 fail:
769 TALLOC_FREE(req);
770 return NULL;
771 }
772
773 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq)
774 {
775 struct tevent_req *req =
776 tevent_req_callback_data(subreq,
777 struct tevent_req);
778 NTSTATUS status;
779
780 status = rpc_write_recv(subreq);
781 TALLOC_FREE(subreq);
782 if (!NT_STATUS_IS_OK(status)) {
783 tevent_req_nterror(req, status);
784 return;
785 }
786
787 tevent_req_done(req);
788 }
789
790 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
791 {
792 struct tevent_req *req = tevent_req_callback_data(
793 subreq, struct tevent_req);
794 struct rpc_api_pipe_state *state = tevent_req_data(
795 req, struct rpc_api_pipe_state);
796 NTSTATUS status;
797 uint8_t *rdata = NULL;
798 uint32_t rdata_len = 0;
799
800 status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
801 TALLOC_FREE(subreq);
802 if (!NT_STATUS_IS_OK(status)) {
803 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
804 tevent_req_nterror(req, status);
805 return;
806 }
807
808 if (rdata == NULL) {
809 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
810 rpccli_pipe_txt(talloc_tos(), state->cli)));
811 tevent_req_done(req);
812 return;
813 }
814
815 /*
816 * Move data on state->incoming_frag.
817 */
818 state->incoming_frag.data = talloc_move(state, &rdata);
819 state->incoming_frag.length = rdata_len;
820 if (!state->incoming_frag.data) {
821 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
822 return;
823 }
824
825 /* Ensure we have enough data for a pdu. */
826 subreq = get_complete_frag_send(state, state->ev, state->cli,
827 &state->incoming_frag);
828 if (tevent_req_nomem(subreq, req)) {
829 return;
830 }
831 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
832 }
833
834 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
835 {
836 struct tevent_req *req = tevent_req_callback_data(
837 subreq, struct tevent_req);
838 struct rpc_api_pipe_state *state = tevent_req_data(
839 req, struct rpc_api_pipe_state);
840 NTSTATUS status;
841 DATA_BLOB rdata = data_blob_null;
842
843 status = get_complete_frag_recv(subreq);
844 TALLOC_FREE(subreq);
845 if (!NT_STATUS_IS_OK(status)) {
846 DEBUG(5, ("get_complete_frag failed: %s\n",
847 nt_errstr(status)));
848 tevent_req_nterror(req, status);
849 return;
850 }
851
852 state->pkt = talloc(state, struct ncacn_packet);
853 if (!state->pkt) {
854 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
855 return;
856 }
857
858 status = dcerpc_pull_ncacn_packet(state->pkt,
859 &state->incoming_frag,
860 state->pkt,
861 !state->endianess);
862 if (!NT_STATUS_IS_OK(status)) {
863 tevent_req_nterror(req, status);
864 return;
865 }
866
867 if (state->incoming_frag.length != state->pkt->frag_length) {
868 DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
869 (unsigned int)state->incoming_frag.length,
870 (unsigned int)state->pkt->frag_length));
871 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
872 return;
873 }
874
875 status = cli_pipe_validate_current_pdu(state,
876 state->cli, state->pkt,
877 &state->incoming_frag,
878 state->expected_pkt_type,
879 &rdata,
880 &state->reply_pdu);
881
882 DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
883 (unsigned)state->incoming_frag.length,
884 (unsigned)state->reply_pdu_offset,
885 nt_errstr(status)));
886
887 if (!NT_STATUS_IS_OK(status)) {
888 tevent_req_nterror(req, status);
889 return;
890 }
891
892 if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
893 && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
894 /*
895 * Set the data type correctly for big-endian data on the
896 * first packet.
897 */
898 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
899 "big-endian.\n",
900 rpccli_pipe_txt(talloc_tos(), state->cli)));
901 state->endianess = 0x00; /* BIG ENDIAN */
902 }
903 /*
904 * Check endianness on subsequent packets.
905 */
906 if (state->endianess != state->pkt->drep[0]) {
907 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
908 "%s\n",
909 state->endianess?"little":"big",
910 state->pkt->drep[0]?"little":"big"));
911 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
912 return;
913 }
914
915 /* Now copy the data portion out of the pdu into rbuf. */
916 if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
917 if (!data_blob_realloc(NULL, &state->reply_pdu,
918 state->reply_pdu_offset + rdata.length)) {
919 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
920 return;
921 }
922 }
923
924 memcpy(state->reply_pdu.data + state->reply_pdu_offset,
925 rdata.data, rdata.length);
926 state->reply_pdu_offset += rdata.length;
927
928 /* reset state->incoming_frag, there is no need to free it,
929 * it will be reallocated to the right size the next time
930 * it is used */
931 state->incoming_frag.length = 0;
932
933 if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
934 /* make sure the pdu length is right now that we
935 * have all the data available (alloc hint may
936 * have allocated more than was actually used) */
937 state->reply_pdu.length = state->reply_pdu_offset;
938 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
939 rpccli_pipe_txt(talloc_tos(), state->cli),
940 (unsigned)state->reply_pdu.length));
941 tevent_req_done(req);
942 return;
943 }
944
945 subreq = get_complete_frag_send(state, state->ev, state->cli,
946 &state->incoming_frag);
947 if (tevent_req_nomem(subreq, req)) {
948 return;
949 }
950 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
951 }
952
953 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
954 struct ncacn_packet **pkt,
955 DATA_BLOB *reply_pdu)
956 {
957 struct rpc_api_pipe_state *state = tevent_req_data(
958 req, struct rpc_api_pipe_state);
959 NTSTATUS status;
960
961 if (tevent_req_is_nterror(req, &status)) {
962 return status;
963 }
964
965 /* return data to caller and assign it ownership of memory */
966 if (reply_pdu) {
967 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
968 reply_pdu->length = state->reply_pdu.length;
969 state->reply_pdu.length = 0;
970 } else {
971 data_blob_free(&state->reply_pdu);
972 }
973
974 if (pkt) {
975 *pkt = talloc_steal(mem_ctx, state->pkt);
976 }
977
978 return NT_STATUS_OK;
979 }
980
981 /*******************************************************************
982 Creates NTLMSSP auth bind.
983 ********************************************************************/
984
985 static NTSTATUS create_generic_auth_rpc_bind_req(struct rpc_pipe_client *cli,
986 TALLOC_CTX *mem_ctx,
987 DATA_BLOB *auth_token)
988 {
989 struct gensec_security *gensec_security;
990 DATA_BLOB null_blob = data_blob_null;
991
992 gensec_security = talloc_get_type_abort(cli->auth->auth_ctx,
993 struct gensec_security);
994
995 DEBUG(5, ("create_generic_auth_rpc_bind_req: generate first token\n"));
996 return gensec_update(gensec_security, mem_ctx, NULL, null_blob, auth_token);
997 }
998
999 /*******************************************************************
1000 Creates schannel auth bind.
1001 ********************************************************************/
1002
1003 static NTSTATUS create_schannel_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1004 DATA_BLOB *auth_token)
1005 {
1006 NTSTATUS status;
1007 struct NL_AUTH_MESSAGE r;
1008
1009 /* Use lp_workgroup() if domain not specified */
1010
1011 if (!cli->auth->domain || !cli->auth->domain[0]) {
1012 cli->auth->domain = talloc_strdup(cli, lp_workgroup());
1013 if (cli->auth->domain == NULL) {
1014 return NT_STATUS_NO_MEMORY;
1015 }
1016 }
1017
1018 /*
1019 * Now marshall the data into the auth parse_struct.
1020 */
1021
1022 r.MessageType = NL_NEGOTIATE_REQUEST;
1023 r.Flags = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
1024 NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
1025 r.oem_netbios_domain.a = cli->auth->domain;
1026 r.oem_netbios_computer.a = lp_netbios_name();
1027
1028 status = dcerpc_push_schannel_bind(cli, &r, auth_token);
1029 if (!NT_STATUS_IS_OK(status)) {
1030 return status;
1031 }
1032
1033 return NT_STATUS_OK;
1034 }
1035
1036 /*******************************************************************
1037 Creates the internals of a DCE/RPC bind request or alter context PDU.
1038 ********************************************************************/
1039
1040 static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
1041 enum dcerpc_pkt_type ptype,
1042 uint32 rpc_call_id,
1043 const struct ndr_syntax_id *abstract,
1044 const struct ndr_syntax_id *transfer,
1045 const DATA_BLOB *auth_info,
1046 DATA_BLOB *blob)
1047 {
1048 uint16 auth_len = auth_info->length;
1049 NTSTATUS status;
1050 union dcerpc_payload u;
1051 struct dcerpc_ctx_list ctx_list;
1052
1053 if (auth_len) {
1054 auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
1055 }
1056
1057 ctx_list.context_id = 0;
1058 ctx_list.num_transfer_syntaxes = 1;
1059 ctx_list.abstract_syntax = *abstract;
1060 ctx_list.transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer);
1061
1062 u.bind.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1063 u.bind.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1064 u.bind.assoc_group_id = 0x0;
1065 u.bind.num_contexts = 1;
1066 u.bind.ctx_list = &ctx_list;
1067 u.bind.auth_info = *auth_info;
1068
1069 status = dcerpc_push_ncacn_packet(mem_ctx,
1070 ptype,
1071 DCERPC_PFC_FLAG_FIRST |
1072 DCERPC_PFC_FLAG_LAST,
1073 auth_len,
1074 rpc_call_id,
1075 &u,
1076 blob);
1077 if (!NT_STATUS_IS_OK(status)) {
1078 DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
1079 return status;
1080 }
1081
1082 return NT_STATUS_OK;
1083 }
1084
1085 /*******************************************************************
1086 Creates a DCE/RPC bind request.
1087 ********************************************************************/
1088
1089 static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
1090 struct rpc_pipe_client *cli,
1091 struct pipe_auth_data *auth,
1092 uint32 rpc_call_id,
1093 const struct ndr_syntax_id *abstract,
1094 const struct ndr_syntax_id *transfer,
1095 DATA_BLOB *rpc_out)
1096 {
1097 DATA_BLOB auth_token = data_blob_null;
1098 DATA_BLOB auth_info = data_blob_null;
1099 NTSTATUS ret = NT_STATUS_OK;
1100
1101 switch (auth->auth_type) {
1102 case DCERPC_AUTH_TYPE_SCHANNEL:
1103 ret = create_schannel_auth_rpc_bind_req(cli, &auth_token);
1104 if (!NT_STATUS_IS_OK(ret)) {
1105 return ret;
1106 }
1107 break;
1108
1109 case DCERPC_AUTH_TYPE_NTLMSSP:
1110 case DCERPC_AUTH_TYPE_KRB5:
1111 case DCERPC_AUTH_TYPE_SPNEGO:
1112 ret = create_generic_auth_rpc_bind_req(cli, mem_ctx, &auth_token);
1113
1114 if (!NT_STATUS_IS_OK(ret) &&
1115 !NT_STATUS_EQUAL(ret, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1116 return ret;
1117 }
1118 break;
1119
1120 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1121 auth_token = data_blob_talloc(mem_ctx,
1122 "NCALRPC_AUTH_TOKEN",
1123 18);
1124 break;
1125
1126 case DCERPC_AUTH_TYPE_NONE:
1127 break;
1128
1129 default:
1130 /* "Can't" happen. */
1131 return NT_STATUS_INVALID_INFO_CLASS;
1132 }
1133
1134 if (auth_token.length != 0) {
1135 ret = dcerpc_push_dcerpc_auth(cli,
1136 auth->auth_type,
1137 auth->auth_level,
1138 0, /* auth_pad_length */
1139 1, /* auth_context_id */
1140 &auth_token,
1141 &auth_info);
1142 if (!NT_STATUS_IS_OK(ret)) {
1143 return ret;
1144 }
1145 data_blob_free(&auth_token);
1146 }
1147
1148 ret = create_bind_or_alt_ctx_internal(mem_ctx,
1149 DCERPC_PKT_BIND,
1150 rpc_call_id,
1151 abstract,
1152 transfer,
1153 &auth_info,
1154 rpc_out);
1155 return ret;
1156 }
1157
1158 /*******************************************************************
1159 External interface.
1160 Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
1161 Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
1162 and deals with signing/sealing details.
1163 ********************************************************************/
1164
1165 struct rpc_api_pipe_req_state {
1166 struct event_context *ev;
1167 struct rpc_pipe_client *cli;
1168 uint8_t op_num;
1169 uint32_t call_id;
1170 DATA_BLOB *req_data;
1171 uint32_t req_data_sent;
1172 DATA_BLOB rpc_out;
1173 DATA_BLOB reply_pdu;
1174 };
1175
1176 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
1177 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
1178 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1179 bool *is_last_frag);
1180
1181 struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
1182 struct event_context *ev,
1183 struct rpc_pipe_client *cli,
1184 uint8_t op_num,
1185 DATA_BLOB *req_data)
1186 {
1187 struct tevent_req *req, *subreq;
1188 struct rpc_api_pipe_req_state *state;
1189 NTSTATUS status;
1190 bool is_last_frag;
1191
1192 req = tevent_req_create(mem_ctx, &state,
1193 struct rpc_api_pipe_req_state);
1194 if (req == NULL) {
1195 return NULL;
1196 }
1197 state->ev = ev;
1198 state->cli = cli;
1199 state->op_num = op_num;
1200 state->req_data = req_data;
1201 state->req_data_sent = 0;
1202 state->call_id = get_rpc_call_id();
1203 state->reply_pdu = data_blob_null;
1204 state->rpc_out = data_blob_null;
1205
1206 if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
1207 + RPC_MAX_SIGN_SIZE) {
1208 /* Server is screwed up ! */
1209 status = NT_STATUS_INVALID_PARAMETER;
1210 goto post_status;
1211 }
1212
1213 status = prepare_next_frag(state, &is_last_frag);
1214 if (!NT_STATUS_IS_OK(status)) {
1215 goto post_status;
1216 }
1217
1218 if (is_last_frag) {
1219 subreq = rpc_api_pipe_send(state, ev, state->cli,
1220 &state->rpc_out,
1221 DCERPC_PKT_RESPONSE);
1222 if (subreq == NULL) {
1223 goto fail;
1224 }
1225 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1226 } else {
1227 subreq = rpc_write_send(state, ev, cli->transport,
1228 state->rpc_out.data,
1229 state->rpc_out.length);
1230 if (subreq == NULL) {
1231 goto fail;
1232 }
1233 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1234 req);
1235 }
1236 return req;
1237
1238 post_status:
1239 tevent_req_nterror(req, status);
1240 return tevent_req_post(req, ev);
1241 fail:
1242 TALLOC_FREE(req);
1243 return NULL;
1244 }
1245
1246 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1247 bool *is_last_frag)
1248 {
1249 size_t data_sent_thistime;
1250 size_t auth_len;
1251 size_t frag_len;
1252 uint8_t flags = 0;
1253 size_t pad_len;
1254 size_t data_left;
1255 NTSTATUS status;
1256 union dcerpc_payload u;
1257
1258 data_left = state->req_data->length - state->req_data_sent;
1259
1260 status = dcerpc_guess_sizes(state->cli->auth,
1261 DCERPC_REQUEST_LENGTH, data_left,
1262 state->cli->max_xmit_frag,
1263 CLIENT_NDR_PADDING_SIZE,
1264 &data_sent_thistime,
1265 &frag_len, &auth_len, &pad_len);
1266 if (!NT_STATUS_IS_OK(status)) {
1267 return status;
1268 }
1269
1270 if (state->req_data_sent == 0) {
1271 flags = DCERPC_PFC_FLAG_FIRST;
1272 }
1273
1274 if (data_sent_thistime == data_left) {
1275 flags |= DCERPC_PFC_FLAG_LAST;
1276 }
1277
1278 data_blob_free(&state->rpc_out);
1279
1280 ZERO_STRUCT(u.request);
1281
1282 u.request.alloc_hint = state->req_data->length;
1283 u.request.context_id = 0;
1284 u.request.opnum = state->op_num;
1285
1286 status = dcerpc_push_ncacn_packet(state,
1287 DCERPC_PKT_REQUEST,
1288 flags,
1289 auth_len,
1290 state->call_id,
1291 &u,
1292 &state->rpc_out);
1293 if (!NT_STATUS_IS_OK(status)) {
1294 return status;
1295 }
1296
1297 /* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
1298 * compute it right for requests because the auth trailer is missing
1299 * at this stage */
1300 dcerpc_set_frag_length(&state->rpc_out, frag_len);
1301
1302 /* Copy in the data. */
1303 if (!data_blob_append(NULL, &state->rpc_out,
1304 state->req_data->data + state->req_data_sent,
1305 data_sent_thistime)) {
1306 return NT_STATUS_NO_MEMORY;
1307 }
1308
1309 switch (state->cli->auth->auth_level) {
1310 case DCERPC_AUTH_LEVEL_NONE:
1311 case DCERPC_AUTH_LEVEL_CONNECT:
1312 case DCERPC_AUTH_LEVEL_PACKET:
1313 break;
1314 case DCERPC_AUTH_LEVEL_INTEGRITY:
1315 case DCERPC_AUTH_LEVEL_PRIVACY:
1316 status = dcerpc_add_auth_footer(state->cli->auth, pad_len,
1317 &state->rpc_out);
1318 if (!NT_STATUS_IS_OK(status)) {
1319 return status;
1320 }
1321 break;
1322 default:
1323 return NT_STATUS_INVALID_PARAMETER;
1324 }
1325
1326 state->req_data_sent += data_sent_thistime;
1327 *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
1328
1329 return status;
1330 }
1331
1332 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
1333 {
1334 struct tevent_req *req = tevent_req_callback_data(
1335 subreq, struct tevent_req);
1336 struct rpc_api_pipe_req_state *state = tevent_req_data(
1337 req, struct rpc_api_pipe_req_state);
1338 NTSTATUS status;
1339 bool is_last_frag;
1340
1341 status = rpc_write_recv(subreq);
1342 TALLOC_FREE(subreq);
1343 if (!NT_STATUS_IS_OK(status)) {
1344 tevent_req_nterror(req, status);
1345 return;
1346 }
1347
1348 status = prepare_next_frag(state, &is_last_frag);
1349 if (!NT_STATUS_IS_OK(status)) {
1350 tevent_req_nterror(req, status);
1351 return;
1352 }
1353
1354 if (is_last_frag) {
1355 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1356 &state->rpc_out,
1357 DCERPC_PKT_RESPONSE);
1358 if (tevent_req_nomem(subreq, req)) {
1359 return;
1360 }
1361 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1362 } else {
1363 subreq = rpc_write_send(state, state->ev,
1364 state->cli->transport,
1365 state->rpc_out.data,
1366 state->rpc_out.length);
1367 if (tevent_req_nomem(subreq, req)) {
1368 return;
1369 }
1370 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1371 req);
1372 }
1373 }
1374
1375 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
1376 {
1377 struct tevent_req *req = tevent_req_callback_data(
1378 subreq, struct tevent_req);
1379 struct rpc_api_pipe_req_state *state = tevent_req_data(
1380 req, struct rpc_api_pipe_req_state);
1381 NTSTATUS status;
1382
1383 status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
1384 TALLOC_FREE(subreq);
1385 if (!NT_STATUS_IS_OK(status)) {
1386 tevent_req_nterror(req, status);
1387 return;
1388 }
1389 tevent_req_done(req);
1390 }
1391
1392 NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1393 DATA_BLOB *reply_pdu)
1394 {
1395 struct rpc_api_pipe_req_state *state = tevent_req_data(
1396 req, struct rpc_api_pipe_req_state);
1397 NTSTATUS status;
1398
1399 if (tevent_req_is_nterror(req, &status)) {
1400 /*
1401 * We always have to initialize to reply pdu, even if there is
1402 * none. The rpccli_* caller routines expect this.
1403 */
1404 *reply_pdu = data_blob_null;
1405 return status;
1406 }
1407
1408 /* return data to caller and assign it ownership of memory */
1409 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1410 reply_pdu->length = state->reply_pdu.length;
1411 state->reply_pdu.length = 0;
1412
1413 return NT_STATUS_OK;
1414 }
1415
1416 /****************************************************************************
1417 Check the rpc bind acknowledge response.
1418 ****************************************************************************/
1419
1420 static bool check_bind_response(const struct dcerpc_bind_ack *r,
1421 const struct ndr_syntax_id *transfer)
1422 {
1423 struct dcerpc_ack_ctx ctx;
1424
1425 if (r->secondary_address_size == 0) {
1426 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
1427 }
1428
1429 if (r->num_results < 1 || !r->ctx_list) {
1430 return false;
1431 }
1432
1433 ctx = r->ctx_list[0];
1434
1435 /* check the transfer syntax */
1436 if ((ctx.syntax.if_version != transfer->if_version) ||
1437 (memcmp(&ctx.syntax.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1438 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1439 return False;
1440 }
1441
1442 if (r->num_results != 0x1 || ctx.result != 0) {
1443 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1444 r->num_results, ctx.reason));
1445 }
1446
1447 DEBUG(5,("check_bind_response: accepted!\n"));
1448 return True;
1449 }
1450
1451 /*******************************************************************
1452 Creates a DCE/RPC bind authentication response.
1453 This is the packet that is sent back to the server once we
1454 have received a BIND-ACK, to finish the third leg of
1455 the authentication handshake.
1456 ********************************************************************/
1457
1458 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
1459 struct rpc_pipe_client *cli,
1460 uint32 rpc_call_id,
1461 enum dcerpc_AuthType auth_type,
1462 enum dcerpc_AuthLevel auth_level,
1463 DATA_BLOB *pauth_blob,
1464 DATA_BLOB *rpc_out)
1465 {
1466 NTSTATUS status;
1467 union dcerpc_payload u;
1468
1469 u.auth3._pad = 0;
1470
1471 status = dcerpc_push_dcerpc_auth(mem_ctx,
1472 auth_type,
1473 auth_level,
1474 0, /* auth_pad_length */
1475 1, /* auth_context_id */
1476 pauth_blob,
1477 &u.auth3.auth_info);
1478 if (!NT_STATUS_IS_OK(status)) {
1479 return status;
1480 }
1481
1482 status = dcerpc_push_ncacn_packet(mem_ctx,
1483 DCERPC_PKT_AUTH3,
1484 DCERPC_PFC_FLAG_FIRST |
1485 DCERPC_PFC_FLAG_LAST,
1486 pauth_blob->length,
1487 rpc_call_id,
1488 &u,
1489 rpc_out);
1490 data_blob_free(&u.auth3.auth_info);
1491 if (!NT_STATUS_IS_OK(status)) {
1492 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1493 return status;
1494 }
1495
1496 return NT_STATUS_OK;
1497 }
1498
1499 /*******************************************************************
1500 Creates a DCE/RPC bind alter context authentication request which
1501 may contain a spnego auth blobl
1502 ********************************************************************/
1503
1504 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
1505 enum dcerpc_AuthType auth_type,
1506 enum dcerpc_AuthLevel auth_level,
1507 uint32 rpc_call_id,
1508 const struct ndr_syntax_id *abstract,
1509 const struct ndr_syntax_id *transfer,
1510 const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
1511 DATA_BLOB *rpc_out)
1512 {
1513 DATA_BLOB auth_info;
1514 NTSTATUS status;
1515
1516 status = dcerpc_push_dcerpc_auth(mem_ctx,
1517 auth_type,
1518 auth_level,
1519 0, /* auth_pad_length */
1520 1, /* auth_context_id */
1521 pauth_blob,
1522 &auth_info);
1523 if (!NT_STATUS_IS_OK(status)) {
1524 return status;
1525 }
1526
1527 status = create_bind_or_alt_ctx_internal(mem_ctx,
1528 DCERPC_PKT_ALTER,
1529 rpc_call_id,
1530 abstract,
1531 transfer,
1532 &auth_info,
1533 rpc_out);
1534 data_blob_free(&auth_info);
1535 return status;
1536 }
1537
1538 /****************************************************************************
1539 Do an rpc bind.
1540 ****************************************************************************/
1541
1542 struct rpc_pipe_bind_state {
1543 struct event_context *ev;
1544 struct rpc_pipe_client *cli;
1545 DATA_BLOB rpc_out;
1546 bool auth3;
1547 uint32_t rpc_call_id;
1548 struct netr_Authenticator auth;
1549 struct netr_Authenticator return_auth;
1550 struct netlogon_creds_CredentialState *creds;
1551 union netr_Capabilities capabilities;
1552 struct netr_LogonGetCapabilities r;
1553 };
1554
1555 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
1556 static void rpc_pipe_bind_step_two_trigger(struct tevent_req *req);
1557 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1558 struct rpc_pipe_bind_state *state,
1559 DATA_BLOB *credentials);
1560 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1561 struct rpc_pipe_bind_state *state,
1562 DATA_BLOB *credentials);
1563
1564 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
1565 struct event_context *ev,
1566 struct rpc_pipe_client *cli,
1567 struct pipe_auth_data *auth)
1568 {
1569 struct tevent_req *req, *subreq;
1570 struct rpc_pipe_bind_state *state;
1571 NTSTATUS status;
1572
1573 req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
1574 if (req == NULL) {
1575 return NULL;
1576 }
1577
1578 DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
1579 rpccli_pipe_txt(talloc_tos(), cli),
1580 (unsigned int)auth->auth_type,
1581 (unsigned int)auth->auth_level ));
1582
1583 state->ev = ev;
1584 state->cli = cli;
1585 state->rpc_call_id = get_rpc_call_id();
1586
1587 cli->auth = talloc_move(cli, &auth);
1588
1589 /* Marshall the outgoing data. */
1590 status = create_rpc_bind_req(state, cli,
1591 cli->auth,
1592 state->rpc_call_id,
1593 &cli->abstract_syntax,
1594 &cli->transfer_syntax,
1595 &state->rpc_out);
1596
1597 if (!NT_STATUS_IS_OK(status) &&
1598 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1599 goto post_status;
1600 }
1601
1602 subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
1603 DCERPC_PKT_BIND_ACK);
1604 if (subreq == NULL) {
1605 goto fail;
1606 }
1607 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1608 return req;
1609
1610 post_status:
1611 tevent_req_nterror(req, status);
1612 return tevent_req_post(req, ev);
1613 fail:
1614 TALLOC_FREE(req);
1615 return NULL;
1616 }
1617
1618 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
1619 {
1620 struct tevent_req *req = tevent_req_callback_data(
1621 subreq, struct tevent_req);
1622 struct rpc_pipe_bind_state *state = tevent_req_data(
1623 req, struct rpc_pipe_bind_state);
1624 struct pipe_auth_data *pauth = state->cli->auth;
1625 struct gensec_security *gensec_security;
1626 struct ncacn_packet *pkt = NULL;
1627 struct dcerpc_auth auth;
1628 DATA_BLOB auth_token = data_blob_null;
1629 NTSTATUS status;
1630
1631 status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
1632 TALLOC_FREE(subreq);
1633 if (!NT_STATUS_IS_OK(status)) {
1634 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
1635 rpccli_pipe_txt(talloc_tos(), state->cli),
1636 nt_errstr(status)));
1637 tevent_req_nterror(req, status);
1638 return;
1639 }
1640
1641 if (state->auth3) {
1642 tevent_req_done(req);
1643 return;
1644 }
1645
1646 if (!check_bind_response(&pkt->u.bind_ack, &state->cli->transfer_syntax)) {
1647 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
1648 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1649 return;
1650 }
1651
1652 state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
1653 state->cli->max_recv_frag = pkt->u.bind_ack.max_recv_frag;
1654
1655 switch(pauth->auth_type) {
1656
1657 case DCERPC_AUTH_TYPE_NONE:
1658 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1659 /* Bind complete. */
1660 tevent_req_done(req);
1661 return;
1662
1663 case DCERPC_AUTH_TYPE_SCHANNEL:
1664 rpc_pipe_bind_step_two_trigger(req);
1665 return;
1666
1667 case DCERPC_AUTH_TYPE_NTLMSSP:
1668 case DCERPC_AUTH_TYPE_SPNEGO:
1669 case DCERPC_AUTH_TYPE_KRB5:
1670 /* Paranoid lenght checks */
1671 if (pkt->frag_length < DCERPC_AUTH_TRAILER_LENGTH
1672 + pkt->auth_length) {
1673 tevent_req_nterror(req,
1674 NT_STATUS_INFO_LENGTH_MISMATCH);
1675 return;
1676 }
1677 /* get auth credentials */
1678 status = dcerpc_pull_dcerpc_auth(talloc_tos(),
1679 &pkt->u.bind_ack.auth_info,
1680 &auth, false);
1681 if (!NT_STATUS_IS_OK(status)) {
1682 DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
1683 nt_errstr(status)));
1684 tevent_req_nterror(req, status);
1685 return;
1686 }
1687 break;
1688
1689 default:
1690 goto err_out;
1691 }
1692
1693 /*
1694 * For authenticated binds we may need to do 3 or 4 leg binds.
1695 */
1696
1697 switch(pauth->auth_type) {
1698
1699 case DCERPC_AUTH_TYPE_NONE:
1700 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1701 case DCERPC_AUTH_TYPE_SCHANNEL:
1702 /* Bind complete. */
1703 tevent_req_done(req);
1704 return;
1705
1706 case DCERPC_AUTH_TYPE_NTLMSSP:
1707 case DCERPC_AUTH_TYPE_KRB5:
1708 case DCERPC_AUTH_TYPE_SPNEGO:
1709 gensec_security = talloc_get_type_abort(pauth->auth_ctx,
1710 struct gensec_security);
1711 status = gensec_update(gensec_security, state, NULL,
1712 auth.credentials, &auth_token);
1713 if (NT_STATUS_EQUAL(status,
1714 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1715 status = rpc_bind_next_send(req, state,
1716 &auth_token);
1717 } else if (NT_STATUS_IS_OK(status)) {
1718 if (auth_token.length == 0) {
1719 /* Bind complete. */
1720 tevent_req_done(req);
1721 return;
1722 }
1723 status = rpc_bind_finish_send(req, state,
1724 &auth_token);
1725 }
1726 break;
1727
1728 default:
1729 goto err_out;
1730 }
1731
1732 if (!NT_STATUS_IS_OK(status)) {
1733 tevent_req_nterror(req, status);
1734 }
1735 return;
1736
1737 err_out:
1738 DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
1739 (unsigned int)state->cli->auth->auth_type));
1740 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
1741 }
1742
1743 static void rpc_pipe_bind_step_two_done(struct tevent_req *subreq);
1744
1745 static void rpc_pipe_bind_step_two_trigger(struct tevent_req *req)
1746 {
1747 struct rpc_pipe_bind_state *state =
1748 tevent_req_data(req,
1749 struct rpc_pipe_bind_state);
1750 struct dcerpc_binding_handle *b = state->cli->binding_handle;
1751 struct schannel_state *schannel_auth =
1752 talloc_get_type_abort(state->cli->auth->auth_ctx,
1753 struct schannel_state);
1754 struct tevent_req *subreq;
1755
1756 if (schannel_auth == NULL ||
1757 !ndr_syntax_id_equal(&state->cli->abstract_syntax,
1758 &ndr_table_netlogon.syntax_id)) {
1759 tevent_req_done(req);
1760 return;
1761 }
1762
1763 ZERO_STRUCT(state->return_auth);
1764
1765 state->creds = netlogon_creds_copy(state, schannel_auth->creds);
1766 if (state->creds == NULL) {
1767 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1768 return;
1769 }
1770
1771 netlogon_creds_client_authenticator(state->creds, &state->auth);
1772
1773 state->r.in.server_name = state->cli->srv_name_slash;
1774 state->r.in.computer_name = state->creds->computer_name;
1775 state->r.in.credential = &state->auth;
1776 state->r.in.query_level = 1;
1777 state->r.in.return_authenticator = &state->return_auth;
1778
1779 state->r.out.capabilities = &state->capabilities;
1780 state->r.out.return_authenticator = &state->return_auth;
1781
1782 subreq = dcerpc_netr_LogonGetCapabilities_r_send(talloc_tos(),
1783 state->ev,
1784 b,
1785 &state->r);
1786 if (subreq == NULL) {
1787 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1788 return;
1789 }
1790
1791 tevent_req_set_callback(subreq, rpc_pipe_bind_step_two_done, req);
1792 return;
1793 }
1794
1795 static void rpc_pipe_bind_step_two_done(struct tevent_req *subreq)
1796 {
1797 struct tevent_req *req =
1798 tevent_req_callback_data(subreq,
1799 struct tevent_req);
1800 struct rpc_pipe_bind_state *state =
1801 tevent_req_data(req,
1802 struct rpc_pipe_bind_state);
1803 NTSTATUS status;
1804
1805 status = dcerpc_netr_LogonGetCapabilities_r_recv(subreq, talloc_tos());
1806 TALLOC_FREE(subreq);
1807 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
1808 if (state->cli->dc->negotiate_flags &
1809 NETLOGON_NEG_SUPPORTS_AES) {
1810 DEBUG(5, ("AES is not supported and the error was %s\n",
1811 nt_errstr(status)));
1812 tevent_req_nterror(req,
1813 NT_STATUS_INVALID_NETWORK_RESPONSE);
1814 return;
1815 }
1816
1817 /* This is probably NT */
1818 DEBUG(5, ("We are checking against an NT - %s\n",
1819 nt_errstr(status)));
1820 tevent_req_done(req);
1821 return;
1822 } else if (!NT_STATUS_IS_OK(status)) {
1823 DEBUG(0, ("dcerpc_netr_LogonGetCapabilities_r_recv failed with %s\n",
1824 nt_errstr(status)));
1825 tevent_req_nterror(req, status);
1826 return;
1827 }
1828
1829 if (NT_STATUS_EQUAL(state->r.out.result, NT_STATUS_NOT_IMPLEMENTED)) {
1830 if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
1831 /* This means AES isn't supported. */
1832 DEBUG(5, ("AES is not supported and the error was %s\n",
1833 nt_errstr(state->r.out.result)));
1834 tevent_req_nterror(req,
1835 NT_STATUS_INVALID_NETWORK_RESPONSE);
1836 return;
1837 }
1838
1839 /* This is probably an old Samba version */
1840 DEBUG(5, ("We are checking against an old Samba version - %s\n",
1841 nt_errstr(state->r.out.result)));
1842 tevent_req_done(req);
1843 return;
1844 }
1845
1846 /* We need to check the credential state here, cause win2k3 and earlier
1847 * returns NT_STATUS_NOT_IMPLEMENTED */
1848 if (!netlogon_creds_client_check(state->creds,
1849 &state->r.out.return_authenticator->cred)) {
1850 /*
1851 * Server replied with bad credential. Fail.
1852 */
1853 DEBUG(0,("rpc_pipe_bind_step_two_done: server %s "
1854 "replied with bad credential\n",
1855 state->cli->desthost));
1856 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1857 return;
1858 }
1859
1860 TALLOC_FREE(state->cli->dc);
1861 state->cli->dc = talloc_steal(state->cli, state->creds);
1862
1863 if (!NT_STATUS_IS_OK(state->r.out.result)) {
1864 DEBUG(0, ("dcerpc_netr_LogonGetCapabilities_r_recv failed with %s\n",
1865 nt_errstr(state->r.out.result)));
1866 tevent_req_nterror(req, state->r.out.result);
1867 return;
1868 }
1869
1870 if (state->creds->negotiate_flags !=
1871 state->r.out.capabilities->server_capabilities) {
1872 DEBUG(0, ("The client capabilities don't match the server "
1873 "capabilities: local[0x%08X] remote[0x%08X]\n",
1874 state->creds->negotiate_flags,
1875 state->capabilities.server_capabilities));
1876 tevent_req_nterror(req,
1877 NT_STATUS_INVALID_NETWORK_RESPONSE);
1878 return;
1879 }
1880
1881 /* TODO: Add downgrade dectection. */
1882
1883 tevent_req_done(req);
1884 return;
1885 }
1886
1887 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1888 struct rpc_pipe_bind_state *state,
1889 DATA_BLOB *auth_token)
1890 {
1891 struct pipe_auth_data *auth = state->cli->auth;
1892 struct tevent_req *subreq;
1893 NTSTATUS status;
1894
1895 /* Now prepare the alter context pdu. */
1896 data_blob_free(&state->rpc_out);
1897
1898 status = create_rpc_alter_context(state,
1899 auth->auth_type,
1900 auth->auth_level,
1901 state->rpc_call_id,
1902 &state->cli->abstract_syntax,
1903 &state->cli->transfer_syntax,
1904 auth_token,
1905 &state->rpc_out);
1906 if (!NT_STATUS_IS_OK(status)) {
1907 return status;
1908 }
1909
1910 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1911 &state->rpc_out, DCERPC_PKT_ALTER_RESP);
1912 if (subreq == NULL) {
1913 return NT_STATUS_NO_MEMORY;
1914 }
1915 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1916 return NT_STATUS_OK;
1917 }
1918
1919 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1920 struct rpc_pipe_bind_state *state,
1921 DATA_BLOB *auth_token)
1922 {
1923 struct pipe_auth_data *auth = state->cli->auth;
1924 struct tevent_req *subreq;
1925 NTSTATUS status;
1926
1927 state->auth3 = true;
1928
1929 /* Now prepare the auth3 context pdu. */
1930 data_blob_free(&state->rpc_out);
1931
1932 status = create_rpc_bind_auth3(state, state->cli,
1933 state->rpc_call_id,
1934 auth->auth_type,
1935 auth->auth_level,
1936 auth_token,
1937 &state->rpc_out);
1938 if (!NT_STATUS_IS_OK(status)) {
1939 return status;
1940 }
1941
1942 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1943 &state->rpc_out, DCERPC_PKT_AUTH3);
1944 if (subreq == NULL) {
1945 return NT_STATUS_NO_MEMORY;
1946 }
1947 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1948 return NT_STATUS_OK;
1949 }
1950
1951 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
1952 {
1953 return tevent_req_simple_recv_ntstatus(req);
1954 }
1955
1956 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
1957 struct pipe_auth_data *auth)
1958 {
1959 TALLOC_CTX *frame = talloc_stackframe();
1960 struct event_context *ev;
1961 struct tevent_req *req;
1962 NTSTATUS status = NT_STATUS_OK;
1963
1964 ev = event_context_init(frame);
1965 if (ev == NULL) {
1966 status = NT_STATUS_NO_MEMORY;
1967 goto fail;
1968 }
1969
1970 req = rpc_pipe_bind_send(frame, ev, cli, auth);
1971 if (req == NULL) {
1972 status = NT_STATUS_NO_MEMORY;
1973 goto fail;
1974 }
1975
1976 if (!tevent_req_poll(req, ev)) {
1977 status = map_nt_error_from_unix(errno);
1978 goto fail;
1979 }
1980
1981 status = rpc_pipe_bind_recv(req);
1982 fail:
1983 TALLOC_FREE(frame);
1984 return status;
1985 }
1986
1987 #define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */
1988
1989 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
1990 unsigned int timeout)
1991 {
1992 unsigned int old;
1993
1994 if (rpc_cli->transport == NULL) {
1995 return RPCCLI_DEFAULT_TIMEOUT;
1996 }
1997
1998 if (rpc_cli->transport->set_timeout == NULL) {
1999 return RPCCLI_DEFAULT_TIMEOUT;
2000 }
2001
2002 old = rpc_cli->transport->set_timeout(rpc_cli->transport->priv, timeout);
2003 if (old == 0) {
2004 return RPCCLI_DEFAULT_TIMEOUT;
2005 }
2006
2007 return old;
2008 }
2009
2010 bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
2011 {
2012 if (rpc_cli == NULL) {
2013 return false;
2014 }
2015
2016 if (rpc_cli->transport == NULL) {
2017 return false;
2018 }
2019
2020 return rpc_cli->transport->is_connected(rpc_cli->transport->priv);
2021 }
2022
2023 struct rpccli_bh_state {
2024 struct rpc_pipe_client *rpc_cli;
2025 };
2026
2027 static bool rpccli_bh_is_connected(struct dcerpc_binding_handle *h)
2028 {
2029 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2030 struct rpccli_bh_state);
2031
2032 return rpccli_is_connected(hs->rpc_cli);
2033 }
2034
2035 static uint32_t rpccli_bh_set_timeout(struct dcerpc_binding_handle *h,
2036 uint32_t timeout)
2037 {
2038 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2039 struct rpccli_bh_state);
2040
2041 return rpccli_set_timeout(hs->rpc_cli, timeout);
2042 }
2043
2044 struct rpccli_bh_raw_call_state {
2045 DATA_BLOB in_data;
2046 DATA_BLOB out_data;
2047 uint32_t out_flags;
2048 };
2049
2050 static void rpccli_bh_raw_call_done(struct tevent_req *subreq);
2051
2052 static struct tevent_req *rpccli_bh_raw_call_send(TALLOC_CTX *mem_ctx,
2053 struct tevent_context *ev,
2054 struct dcerpc_binding_handle *h,
2055 const struct GUID *object,
2056 uint32_t opnum,
2057 uint32_t in_flags,
2058 const uint8_t *in_data,
2059 size_t in_length)
2060 {
2061 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2062 struct rpccli_bh_state);
2063 struct tevent_req *req;
2064 struct rpccli_bh_raw_call_state *state;
2065 bool ok;
2066 struct tevent_req *subreq;
2067
2068 req = tevent_req_create(mem_ctx, &state,
2069 struct rpccli_bh_raw_call_state);
2070 if (req == NULL) {
2071 return NULL;
2072 }
2073 state->in_data.data = discard_const_p(uint8_t, in_data);
2074 state->in_data.length = in_length;
2075
2076 ok = rpccli_bh_is_connected(h);
2077 if (!ok) {
2078 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2079 return tevent_req_post(req, ev);
2080 }
2081
2082 subreq = rpc_api_pipe_req_send(state, ev, hs->rpc_cli,
2083 opnum, &state->in_data);
2084 if (tevent_req_nomem(subreq, req)) {
2085 return tevent_req_post(req, ev);
2086 }
2087 tevent_req_set_callback(subreq, rpccli_bh_raw_call_done, req);
2088
2089 return req;
2090 }
2091
2092 static void rpccli_bh_raw_call_done(struct tevent_req *subreq)
2093 {
2094 struct tevent_req *req =
2095 tevent_req_callback_data(subreq,
2096 struct tevent_req);
2097 struct rpccli_bh_raw_call_state *state =
2098 tevent_req_data(req,
2099 struct rpccli_bh_raw_call_state);
2100 NTSTATUS status;
2101
2102 state->out_flags = 0;
2103
2104 /* TODO: support bigendian responses */
2105
2106 status = rpc_api_pipe_req_recv(subreq, state, &state->out_data);
2107 TALLOC_FREE(subreq);
2108 if (!NT_STATUS_IS_OK(status)) {
2109 tevent_req_nterror(req, status);
2110 return;
2111 }
2112
2113 tevent_req_done(req);
2114 }
2115
2116 static NTSTATUS rpccli_bh_raw_call_recv(struct tevent_req *req,
2117 TALLOC_CTX *mem_ctx,
2118 uint8_t **out_data,
2119 size_t *out_length,
2120 uint32_t *out_flags)
2121 {
2122 struct rpccli_bh_raw_call_state *state =
2123 tevent_req_data(req,
2124 struct rpccli_bh_raw_call_state);
2125 NTSTATUS status;
2126
2127 if (tevent_req_is_nterror(req, &status)) {
2128 tevent_req_received(req);
2129 return status;
2130 }
2131
2132 *out_data = talloc_move(mem_ctx, &state->out_data.data);
2133 *out_length = state->out_data.length;
2134 *out_flags = state->out_flags;
2135 tevent_req_received(req);
2136 return NT_STATUS_OK;
2137 }
2138
2139 struct rpccli_bh_disconnect_state {
2140 uint8_t _dummy;
2141 };
2142
2143 static struct tevent_req *rpccli_bh_disconnect_send(TALLOC_CTX *mem_ctx,
2144 struct tevent_context *ev,
2145 struct dcerpc_binding_handle *h)
2146 {
2147 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2148 struct rpccli_bh_state);
2149 struct tevent_req *req;
2150 struct rpccli_bh_disconnect_state *state;
2151 bool ok;
2152
2153 req = tevent_req_create(mem_ctx, &state,
2154 struct rpccli_bh_disconnect_state);
2155 if (req == NULL) {
2156 return NULL;
2157 }
2158
2159 ok = rpccli_bh_is_connected(h);
2160 if (!ok) {
2161 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2162 return tevent_req_post(req, ev);
2163 }
2164
2165 /*
2166 * TODO: do a real async disconnect ...
2167 *
2168 * For now the caller needs to free rpc_cli
2169 */
2170 hs->rpc_cli = NULL;
2171
2172 tevent_req_done(req);
2173 return tevent_req_post(req, ev);
2174 }
2175
2176 static NTSTATUS rpccli_bh_disconnect_recv(struct tevent_req *req)
2177 {
2178 NTSTATUS status;
2179
2180 if (tevent_req_is_nterror(req, &status)) {
2181 tevent_req_received(req);
2182 return status;
2183 }
2184
2185 tevent_req_received(req);
2186 return NT_STATUS_OK;
2187 }
2188
2189 static bool rpccli_bh_ref_alloc(struct dcerpc_binding_handle *h)
2190 {
2191 return true;
2192 }
2193
2194 static void rpccli_bh_do_ndr_print(struct dcerpc_binding_handle *h,
2195 int ndr_flags,
2196 const void *_struct_ptr,
2197 const struct ndr_interface_call *call)
2198 {
2199 void *struct_ptr = discard_const(_struct_ptr);
2200
2201 if (DEBUGLEVEL < 10) {
2202 return;
2203 }
2204
2205 if (ndr_flags & NDR_IN) {
2206 ndr_print_function_debug(call->ndr_print,
2207 call->name,
2208 ndr_flags,
2209 struct_ptr);
2210 }
2211 if (ndr_flags & NDR_OUT) {
2212 ndr_print_function_debug(call->ndr_print,
2213 call->name,
2214 ndr_flags,
2215 struct_ptr);
2216 }
2217 }
2218
2219 static const struct dcerpc_binding_handle_ops rpccli_bh_ops = {
2220 .name = "rpccli",
2221 .is_connected = rpccli_bh_is_connected,
2222 .set_timeout = rpccli_bh_set_timeout,
2223 .raw_call_send = rpccli_bh_raw_call_send,
2224 .raw_call_recv = rpccli_bh_raw_call_recv,
2225 .disconnect_send = rpccli_bh_disconnect_send,
2226 .disconnect_recv = rpccli_bh_disconnect_recv,
2227
2228 .ref_alloc = rpccli_bh_ref_alloc,
2229 .do_ndr_print = rpccli_bh_do_ndr_print,
2230 };
2231
2232 /* initialise a rpc_pipe_client binding handle */
2233 struct dcerpc_binding_handle *rpccli_bh_create(struct rpc_pipe_client *c)
2234 {
2235 struct dcerpc_binding_handle *h;
2236 struct rpccli_bh_state *hs;
2237
2238 h = dcerpc_binding_handle_create(c,
2239 &rpccli_bh_ops,
2240 NULL,
2241 NULL, /* TODO */
2242 &hs,
2243 struct rpccli_bh_state,
2244 __location__);
2245 if (h == NULL) {
2246 return NULL;
2247 }
2248 hs->rpc_cli = c;
2249
2250 return h;
2251 }
2252
2253 NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx,
2254 struct pipe_auth_data **presult)
2255 {
2256 struct pipe_auth_data *result;
2257
2258 result = talloc(mem_ctx, struct pipe_auth_data);
2259 if (result == NULL) {
2260 return NT_STATUS_NO_MEMORY;
2261 }
2262
2263 result->auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
2264 result->auth_level = DCERPC_AUTH_LEVEL_CONNECT;
2265
2266 result->user_name = talloc_strdup(result, "");
2267 result->domain = talloc_strdup(result, "");
2268 if ((result->user_name == NULL) || (result->domain == NULL)) {
2269 TALLOC_FREE(result);
2270 return NT_STATUS_NO_MEMORY;
2271 }
2272
2273 *presult = result;
2274 return NT_STATUS_OK;
2275 }
2276
2277 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2278 struct pipe_auth_data **presult)
2279 {
2280 struct pipe_auth_data *result;
2281
2282 result = talloc(mem_ctx, struct pipe_auth_data);
2283 if (result == NULL) {
2284 return NT_STATUS_NO_MEMORY;
2285 }
2286
2287 result->auth_type = DCERPC_AUTH_TYPE_NONE;
2288 result->auth_level = DCERPC_AUTH_LEVEL_NONE;
2289
2290 result->user_name = talloc_strdup(result, "");
2291 result->domain = talloc_strdup(result, "");
2292 if ((result->user_name == NULL) || (result->domain == NULL)) {
2293 TALLOC_FREE(result);
2294 return NT_STATUS_NO_MEMORY;
2295 }
2296
2297 *presult = result;
2298 return NT_STATUS_OK;
2299 }
2300
2301 static NTSTATUS rpccli_generic_bind_data(TALLOC_CTX *mem_ctx,
2302 enum dcerpc_AuthType auth_type,
2303 enum dcerpc_AuthLevel auth_level,
2304 const char *server,
2305 const char *target_service,
2306 const char *domain,
2307 const char *username,
2308 const char *password,
2309 enum credentials_use_kerberos use_kerberos,
2310 struct pipe_auth_data **presult)
2311 {
2312 struct auth_generic_state *auth_generic_ctx;
2313 struct pipe_auth_data *result;
2314 NTSTATUS status;
2315
2316 result = talloc(mem_ctx, struct pipe_auth_data);
2317 if (result == NULL) {
2318 return NT_STATUS_NO_MEMORY;
2319 }
2320
2321 result->auth_type = auth_type;
2322 result->auth_level = auth_level;
2323
2324 result->user_name = talloc_strdup(result, username);
2325 result->domain = talloc_strdup(result, domain);
2326 if ((result->user_name == NULL) || (result->domain == NULL)) {
2327 status = NT_STATUS_NO_MEMORY;
2328 goto fail;
2329 }
2330
2331 status = auth_generic_client_prepare(result,
2332 &auth_generic_ctx);
2333 if (!NT_STATUS_IS_OK(status)) {
2334 goto fail;
2335 }
2336
2337 status = auth_generic_set_username(auth_generic_ctx, username);
2338 if (!NT_STATUS_IS_OK(status)) {
2339 goto fail;
2340 }
2341
2342 status = auth_generic_set_domain(auth_generic_ctx, domain);
2343 if (!NT_STATUS_IS_OK(status)) {
2344 goto fail;
2345 }
2346
2347 status = auth_generic_set_password(auth_generic_ctx, password);
2348 if (!NT_STATUS_IS_OK(status)) {
2349 goto fail;
2350 }
2351
2352 status = gensec_set_target_service(auth_generic_ctx->gensec_security, target_service);
2353 if (!NT_STATUS_IS_OK(status)) {
2354 goto fail;
2355 }
2356
2357 status = gensec_set_target_hostname(auth_generic_ctx->gensec_security, server);
2358 if (!NT_STATUS_IS_OK(status)) {
2359 goto fail;
2360 }
2361
2362 cli_credentials_set_kerberos_state(auth_generic_ctx->credentials, use_kerberos);
2363
2364 status = auth_generic_client_start_by_authtype(auth_generic_ctx, auth_type, auth_level);
2365 if (!NT_STATUS_IS_OK(status)) {
2366 goto fail;
2367 }
2368
2369 result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2370 talloc_free(auth_generic_ctx);
2371 *presult = result;
2372 return NT_STATUS_OK;
2373
2374 fail:
2375 TALLOC_FREE(result);
2376 return status;
2377 }
2378
2379 NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
2380 enum dcerpc_AuthLevel auth_level,
2381 struct netlogon_creds_CredentialState *creds,
2382 struct pipe_auth_data **presult)
2383 {
2384 struct schannel_state *schannel_auth;
2385 struct pipe_auth_data *result;
2386
2387 result = talloc(mem_ctx, struct pipe_auth_data);
2388 if (result == NULL) {
2389 return NT_STATUS_NO_MEMORY;
2390 }
2391
2392 result->auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
2393 result->auth_level = auth_level;
2394
2395 result->user_name = talloc_strdup(result, "");
2396 result->domain = talloc_strdup(result, domain);
2397 if ((result->user_name == NULL) || (result->domain == NULL)) {
2398 goto fail;
2399 }
2400
2401 schannel_auth = talloc_zero(result, struct schannel_state);
2402 if (schannel_auth == NULL) {
2403 goto fail;
2404 }
2405
2406 schannel_auth->state = SCHANNEL_STATE_START;
2407 schannel_auth->initiator = true;
2408 schannel_auth->creds = netlogon_creds_copy(result, creds);
2409
2410 result->auth_ctx = schannel_auth;
2411 *presult = result;
2412 return NT_STATUS_OK;
2413
2414 fail:
2415 TALLOC_FREE(result);
2416 return NT_STATUS_NO_MEMORY;
2417 }
2418
2419 /**
2420 * Create an rpc pipe client struct, connecting to a tcp port.
2421 */
2422 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
2423 uint16_t port,
2424 const struct ndr_syntax_id *abstract_syntax,
2425 struct rpc_pipe_client **presult)
2426 {
2427 struct rpc_pipe_client *result;
2428 struct sockaddr_storage addr;
2429 NTSTATUS status;
2430 int fd;
2431
2432 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2433 if (result == NULL) {
2434 return NT_STATUS_NO_MEMORY;
2435 }
2436
2437 result->abstract_syntax = *abstract_syntax;
2438 result->transfer_syntax = ndr_transfer_syntax_ndr;
2439
2440 result->desthost = talloc_strdup(result, host);
2441 result->srv_name_slash = talloc_asprintf_strupper_m(
2442 result, "\\\\%s", result->desthost);
2443 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2444 status = NT_STATUS_NO_MEMORY;
2445 goto fail;
2446 }
2447
2448 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2449 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2450
2451 if (!resolve_name(host, &addr, 0, false)) {
2452 status = NT_STATUS_NOT_FOUND;
2453 goto fail;
2454 }
2455
2456 status = open_socket_out(&addr, port, 60*1000, &fd);
2457 if (!NT_STATUS_IS_OK(status)) {
2458 goto fail;
2459 }
2460 set_socket_options(fd, lp_socket_options());
2461
2462 status = rpc_transport_sock_init(result, fd, &result->transport);
2463 if (!NT_STATUS_IS_OK(status)) {
2464 close(fd);
2465 goto fail;
2466 }
2467
2468 result->transport->transport = NCACN_IP_TCP;
2469
2470 result->binding_handle = rpccli_bh_create(result);
2471 if (result->binding_handle == NULL) {
2472 TALLOC_FREE(result);
2473 return NT_STATUS_NO_MEMORY;
2474 }
2475
2476 *presult = result;
2477 return NT_STATUS_OK;
2478
2479 fail:
2480 TALLOC_FREE(result);
2481 return status;
2482 }
2483
2484 /**
2485 * Determine the tcp port on which a dcerpc interface is listening
2486 * for the ncacn_ip_tcp transport via the endpoint mapper of the
2487 * target host.
2488 */
2489 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
2490 const struct ndr_syntax_id *abstract_syntax,
2491 uint16_t *pport)
2492 {
2493 NTSTATUS status;
2494 struct rpc_pipe_client *epm_pipe = NULL;
2495 struct dcerpc_binding_handle *epm_handle = NULL;
2496 struct pipe_auth_data *auth = NULL;
2497 struct dcerpc_binding *map_binding = NULL;
2498 struct dcerpc_binding *res_binding = NULL;
2499 struct epm_twr_t *map_tower = NULL;
2500 struct epm_twr_t *res_towers = NULL;
2501 struct policy_handle *entry_handle = NULL;
2502 uint32_t num_towers = 0;
2503 uint32_t max_towers = 1;
2504 struct epm_twr_p_t towers;
2505 TALLOC_CTX *tmp_ctx = talloc_stackframe();
2506 uint32_t result = 0;
2507
2508 if (pport == NULL) {
2509 status = NT_STATUS_INVALID_PARAMETER;
2510 goto done;
2511 }
2512
2513 if (ndr_syntax_id_equal(abstract_syntax,
2514 &ndr_table_epmapper.syntax_id)) {
2515 *pport = 135;
2516 return NT_STATUS_OK;
2517 }
2518
2519 /* open the connection to the endpoint mapper */
2520 status = rpc_pipe_open_tcp_port(tmp_ctx, host, 135,
2521 &ndr_table_epmapper.syntax_id,
2522 &epm_pipe);
2523
2524 if (!NT_STATUS_IS_OK(status)) {
2525 goto done;
2526 }
2527 epm_handle = epm_pipe->binding_handle;
2528
2529 status = rpccli_anon_bind_data(tmp_ctx, &auth);
2530 if (!NT_STATUS_IS_OK(status)) {
2531 goto done;
2532 }
2533
2534 status = rpc_pipe_bind(epm_pipe, auth);
2535 if (!NT_STATUS_IS_OK(status)) {
2536 goto done;
2537 }
2538
2539 /* create tower for asking the epmapper */
2540
2541 map_binding = talloc_zero(tmp_ctx, struct dcerpc_binding);
2542 if (map_binding == NULL) {
2543 status = NT_STATUS_NO_MEMORY;
2544 goto done;
2545 }
2546
2547 map_binding->transport = NCACN_IP_TCP;
2548 map_binding->object = *abstract_syntax;
2549 map_binding->host = host; /* needed? */
2550 map_binding->endpoint = "0"; /* correct? needed? */
2551
2552 map_tower = talloc_zero(tmp_ctx, struct epm_twr_t);
2553 if (map_tower == NULL) {
2554 status = NT_STATUS_NO_MEMORY;
2555 goto done;
2556 }
2557
2558 status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
2559 &(map_tower->tower));
2560 if (!NT_STATUS_IS_OK(status)) {
2561 goto done;
2562 }
2563
2564 /* allocate further parameters for the epm_Map call */
2565
2566 res_towers = talloc_array(tmp_ctx, struct epm_twr_t, max_towers);
2567 if (res_towers == NULL) {
2568 status = NT_STATUS_NO_MEMORY;
2569 goto done;
2570 }
2571 towers.twr = res_towers;
2572
2573 entry_handle = talloc_zero(tmp_ctx, struct policy_handle);
2574 if (entry_handle == NULL) {
2575 status = NT_STATUS_NO_MEMORY;
2576 goto done;
2577 }
2578
2579 /* ask the endpoint mapper for the port */
2580
2581 status = dcerpc_epm_Map(epm_handle,
2582 tmp_ctx,
2583 discard_const_p(struct GUID,
2584 &(abstract_syntax->uuid)),
2585 map_tower,
2586 entry_handle,
2587 max_towers,
2588 &num_towers,
2589 &towers,
2590 &result);
2591
2592 if (!NT_STATUS_IS_OK(status)) {
2593 goto done;
2594 }
2595
2596 if (result != EPMAPPER_STATUS_OK) {
2597 status = NT_STATUS_UNSUCCESSFUL;
2598 goto done;
2599 }
2600
2601 if (num_towers != 1) {
2602 status = NT_STATUS_UNSUCCESSFUL;
2603 goto done;
2604 }
2605
2606 /* extract the port from the answer */
2607
2608 status = dcerpc_binding_from_tower(tmp_ctx,
2609 &(towers.twr->tower),
2610 &res_binding);
2611 if (!NT_STATUS_IS_OK(status)) {
2612 goto done;
2613 }
2614
2615 /* are further checks here necessary? */
2616 if (res_binding->transport != NCACN_IP_TCP) {
2617 status = NT_STATUS_UNSUCCESSFUL;
2618 goto done;
2619 }
2620
2621 *pport = (uint16_t)atoi(res_binding->endpoint);
2622
2623 done:
2624 TALLOC_FREE(tmp_ctx);
2625 return status;
2626 }
2627
2628 /**
2629 * Create a rpc pipe client struct, connecting to a host via tcp.
2630 * The port is determined by asking the endpoint mapper on the given
2631 * host.
2632 */
2633 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
2634 const struct ndr_syntax_id *abstract_syntax,
2635 struct rpc_pipe_client **presult)
2636 {
2637 NTSTATUS status;
2638 uint16_t port = 0;
2639
2640 status = rpc_pipe_get_tcp_port(host, abstract_syntax, &port);
2641 if (!NT_STATUS_IS_OK(status)) {
2642 return status;
2643 }
2644
2645 return rpc_pipe_open_tcp_port(mem_ctx, host, port,
2646 abstract_syntax, presult);
2647 }
2648
2649 /********************************************************************
2650 Create a rpc pipe client struct, connecting to a unix domain socket
2651 ********************************************************************/
2652 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
2653 const struct ndr_syntax_id *abstract_syntax,
2654 struct rpc_pipe_client **presult)
2655 {
2656 struct rpc_pipe_client *result;
2657 struct sockaddr_un addr;
2658 NTSTATUS status;
2659 int fd;
2660 socklen_t salen;
2661
2662 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2663 if (result == NULL) {
2664 return NT_STATUS_NO_MEMORY;
2665 }
2666
2667 result->abstract_syntax = *abstract_syntax;
2668 result->transfer_syntax = ndr_transfer_syntax_ndr;
2669
2670 result->desthost = get_myname(result);
2671 result->srv_name_slash = talloc_asprintf_strupper_m(
2672 result, "\\\\%s", result->desthost);
2673 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2674 status = NT_STATUS_NO_MEMORY;
2675 goto fail;
2676 }
2677
2678 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2679 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2680
2681 fd = socket(AF_UNIX, SOCK_STREAM, 0);
2682 if (fd == -1) {
2683 status = map_nt_error_from_unix(errno);
2684 goto fail;
2685 }
2686
2687 ZERO_STRUCT(addr);
2688 addr.sun_family = AF_UNIX;
2689 strlcpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
2690 salen = sizeof(struct sockaddr_un);
2691
2692 if (connect(fd, (struct sockaddr *)(void *)&addr, salen) == -1) {
2693 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
2694 strerror(errno)));
2695 close(fd);
2696 return map_nt_error_from_unix(errno);
2697 }
2698
2699 status = rpc_transport_sock_init(result, fd, &result->transport);
2700 if (!NT_STATUS_IS_OK(status)) {
2701 close(fd);
2702 goto fail;
2703 }
2704
2705 result->transport->transport = NCALRPC;
2706
2707 result->binding_handle = rpccli_bh_create(result);
2708 if (result->binding_handle == NULL) {
2709 TALLOC_FREE(result);
2710 return NT_STATUS_NO_MEMORY;
2711 }
2712
2713 *presult = result;
2714 return NT_STATUS_OK;
2715
2716 fail:
2717 TALLOC_FREE(result);
2718 return status;
2719 }
2720
2721 struct rpc_pipe_client_np_ref {
2722 struct cli_state *cli;
2723 struct rpc_pipe_client *pipe;
2724 };
2725
2726 static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
2727 {
2728 DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
2729 return 0;
2730 }
2731
2732 /****************************************************************************
2733 Open a named pipe over SMB to a remote server.
2734 *
2735 * CAVEAT CALLER OF THIS FUNCTION:
2736 * The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
2737 * so be sure that this function is called AFTER any structure (vs pointer)
2738 * assignment of the cli. In particular, libsmbclient does structure
2739 * assignments of cli, which invalidates the data in the returned
2740 * rpc_pipe_client if this function is called before the structure assignment
2741 * of cli.
2742 *
2743 ****************************************************************************/
2744
2745 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
2746 const struct ndr_syntax_id *abstract_syntax,
2747 struct rpc_pipe_client **presult)
2748 {
2749 struct rpc_pipe_client *result;
2750 NTSTATUS status;
2751 struct rpc_pipe_client_np_ref *np_ref;
2752
2753 /* sanity check to protect against crashes */
2754
2755 if ( !cli ) {
2756 return NT_STATUS_INVALID_HANDLE;
2757 }
2758
2759 result = talloc_zero(NULL, struct rpc_pipe_client);
2760 if (result == NULL) {
2761 return NT_STATUS_NO_MEMORY;
2762 }
2763
2764 result->abstract_syntax = *abstract_syntax;
2765 result->transfer_syntax = ndr_transfer_syntax_ndr;
2766 result->desthost = talloc_strdup(result, smbXcli_conn_remote_name(cli->conn));
2767 result->srv_name_slash = talloc_asprintf_strupper_m(
2768 result, "\\\\%s", result->desthost);
2769
2770 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2771 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2772
2773 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2774 TALLOC_FREE(result);
2775 return NT_STATUS_NO_MEMORY;
2776 }
2777
2778 status = rpc_transport_np_init(result, cli, abstract_syntax,
2779 &result->transport);
2780 if (!NT_STATUS_IS_OK(status)) {
2781 TALLOC_FREE(result);
2782 return status;
2783 }
2784
2785 result->transport->transport = NCACN_NP;
2786
2787 np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
2788 if (np_ref == NULL) {
2789 TALLOC_FREE(result);
2790 return NT_STATUS_NO_MEMORY;
2791 }
2792 np_ref->cli = cli;
2793 np_ref->pipe = result;
2794
2795 DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
2796 talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
2797
2798 result->binding_handle = rpccli_bh_create(result);
2799 if (result->binding_handle == NULL) {
2800 TALLOC_FREE(result);
2801 return NT_STATUS_NO_MEMORY;
2802 }
2803
2804 *presult = result;
2805 return NT_STATUS_OK;
2806 }
2807
2808 /****************************************************************************
2809 Open a pipe to a remote server.
2810 ****************************************************************************/
2811
2812 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
2813 enum dcerpc_transport_t transport,
2814 const struct ndr_syntax_id *interface,
2815 struct rpc_pipe_client **presult)
2816 {
2817 switch (transport) {
2818 case NCACN_IP_TCP:
2819 return rpc_pipe_open_tcp(NULL, smbXcli_conn_remote_name(cli->conn),
2820 interface, presult);
2821 case NCACN_NP:
2822 return rpc_pipe_open_np(cli, interface, presult);
2823 default:
2824 return NT_STATUS_NOT_IMPLEMENTED;
2825 }
2826 }
2827
2828 /****************************************************************************
2829 Open a named pipe to an SMB server and bind anonymously.
2830 ****************************************************************************/
2831
2832 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
2833 enum dcerpc_transport_t transport,
2834 const struct ndr_syntax_id *interface,
2835 struct rpc_pipe_client **presult)
2836 {
2837 struct rpc_pipe_client *result;
2838 struct pipe_auth_data *auth;
2839 NTSTATUS status;
2840
2841 status = cli_rpc_pipe_open(cli, transport, interface, &result);
2842 if (!NT_STATUS_IS_OK(status)) {
2843 return status;
2844 }
2845
2846 status = rpccli_anon_bind_data(result, &auth);
2847 if (!NT_STATUS_IS_OK(status)) {
2848 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
2849 nt_errstr(status)));
2850 TALLOC_FREE(result);
2851 return status;
2852 }
2853
2854 /*
2855 * This is a bit of an abstraction violation due to the fact that an
2856 * anonymous bind on an authenticated SMB inherits the user/domain
2857 * from the enclosing SMB creds
2858 */
2859
2860 TALLOC_FREE(auth->user_name);
2861 TALLOC_FREE(auth->domain);
2862
2863 auth->user_name = talloc_strdup(auth, cli->user_name);
2864 auth->domain = talloc_strdup(auth, cli->domain);
2865
2866 if (transport == NCACN_NP) {
2867 struct smbXcli_session *session;
2868
2869 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
2870 session = cli->smb2.session;
2871 } else {
2872 session = cli->smb1.session;
2873 }
2874
2875 status = smbXcli_session_application_key(session, auth,
2876 &auth->transport_session_key);
2877 if (!NT_STATUS_IS_OK(status)) {
2878 auth->transport_session_key = data_blob_null;
2879 }
2880 }
2881
2882 if ((auth->user_name == NULL) || (auth->domain == NULL)) {
2883 TALLOC_FREE(result);
2884 return NT_STATUS_NO_MEMORY;
2885 }
2886
2887 status = rpc_pipe_bind(result, auth);
2888 if (!NT_STATUS_IS_OK(status)) {
2889 int lvl = 0;
2890 if (ndr_syntax_id_equal(interface,
2891 &ndr_table_dssetup.syntax_id)) {
2892 /* non AD domains just don't have this pipe, avoid
2893 * level 0 statement in that case - gd */
2894 lvl = 3;
2895 }
2896 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
2897 "%s failed with error %s\n",
2898 get_pipe_name_from_syntax(talloc_tos(), interface),
2899 nt_errstr(status) ));
2900 TALLOC_FREE(result);
2901 return status;
2902 }
2903
2904 DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
2905 "%s and bound anonymously.\n",
2906 get_pipe_name_from_syntax(talloc_tos(), interface),
2907 result->desthost));
2908
2909 *presult = result;
2910 return NT_STATUS_OK;
2911 }
2912
2913 /****************************************************************************
2914 ****************************************************************************/
2915
2916 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
2917 const struct ndr_syntax_id *interface,
2918 struct rpc_pipe_client **presult)
2919 {
2920 return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
2921 interface, presult);
2922 }
2923
2924 /****************************************************************************
2925 Open a named pipe to an SMB server and bind using the mech specified
2926 ****************************************************************************/
2927
2928 NTSTATUS cli_rpc_pipe_open_generic_auth(struct cli_state *cli,
2929 const struct ndr_interface_table *table,
2930 enum dcerpc_transport_t transport,
2931 enum dcerpc_AuthType auth_type,
2932 enum dcerpc_AuthLevel auth_level,
2933 const char *server,
2934 const char *domain,
2935 const char *username,
2936 const char *password,
2937 struct rpc_pipe_client **presult)
2938 {
2939 struct rpc_pipe_client *result;
2940 struct pipe_auth_data *auth = NULL;
2941 const char *target_service = table->authservices->names[0];
2942
2943 NTSTATUS status;
2944
2945 status = cli_rpc_pipe_open(cli, transport, &table->syntax_id, &result);
2946 if (!NT_STATUS_IS_OK(status)) {
2947 return status;
2948 }
2949
2950 status = rpccli_generic_bind_data(result,
2951 auth_type, auth_level,
2952 server, target_service,
2953 domain, username, password,
2954 CRED_AUTO_USE_KERBEROS,
2955 &auth);
2956 if (!NT_STATUS_IS_OK(status)) {
2957 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
2958 nt_errstr(status)));
2959 goto err;
2960 }
2961
2962 status = rpc_pipe_bind(result, auth);
2963 if (!NT_STATUS_IS_OK(status)) {
2964 DEBUG(0, ("cli_rpc_pipe_open_generic_auth: cli_rpc_pipe_bind failed with error %s\n",
2965 nt_errstr(status) ));
2966 goto err;
2967 }
2968
2969 DEBUG(10,("cli_rpc_pipe_open_generic_auth: opened pipe %s to "
2970 "machine %s and bound as user %s\\%s.\n", table->name,
2971 result->desthost, domain, username));
2972
2973 *presult = result;
2974 return NT_STATUS_OK;
2975
2976 err:
2977
2978 TALLOC_FREE(result);
2979 return status;
2980 }
2981
2982 /****************************************************************************
2983 External interface.
2984 Open a named pipe to an SMB server and bind using schannel (bind type 68)
2985 using session_key. sign and seal.
2986
2987 The *pdc will be stolen onto this new pipe
2988 ****************************************************************************/
2989
2990 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
2991 const struct ndr_syntax_id *interface,
2992 enum dcerpc_transport_t transport,
2993 enum dcerpc_AuthLevel auth_level,
2994 const char *domain,
2995 struct netlogon_creds_CredentialState **pdc,
2996 struct rpc_pipe_client **presult)
2997 {
2998 struct rpc_pipe_client *result;
2999 struct pipe_auth_data *auth;
3000 NTSTATUS status;
3001
3002 status = cli_rpc_pipe_open(cli, transport, interface, &result);
3003 if (!NT_STATUS_IS_OK(status)) {
3004 return status;
3005 }
3006
3007 status = rpccli_schannel_bind_data(result, domain, auth_level,
3008 *pdc, &auth);
3009 if (!NT_STATUS_IS_OK(status)) {
3010 DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
3011 nt_errstr(status)));
3012 TALLOC_FREE(result);
3013 return status;
3014 }
3015
3016 status = rpc_pipe_bind(result, auth);
3017 if (!NT_STATUS_IS_OK(status)) {
3018 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
3019 "cli_rpc_pipe_bind failed with error %s\n",
3020 nt_errstr(status) ));
3021 TALLOC_FREE(result);
3022 return status;
3023 }
3024
3025 /*
3026 * The credentials on a new netlogon pipe are the ones we are passed
3027 * in - copy them over
3028 */
3029 if (result->dc == NULL) {
3030 result->dc = netlogon_creds_copy(result, *pdc);
3031 if (result->dc == NULL) {
3032 TALLOC_FREE(result);
3033 return NT_STATUS_NO_MEMORY;
3034 }
3035 }
3036
3037 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
3038 "for domain %s and bound using schannel.\n",
3039 get_pipe_name_from_syntax(talloc_tos(), interface),
3040 result->desthost, domain));
3041
3042 *presult = result;
3043 return NT_STATUS_OK;
3044 }
3045
3046 NTSTATUS cli_rpc_pipe_open_spnego(struct cli_state *cli,
3047 const struct ndr_interface_table *table,
3048 enum dcerpc_transport_t transport,
3049 const char *oid,
3050 enum dcerpc_AuthLevel auth_level,
3051 const char *server,
3052 const char *domain,
3053 const char *username,
3054 const char *password,
3055 struct rpc_pipe_client **presult)
3056 {
3057 struct rpc_pipe_client *result;
3058 struct pipe_auth_data *auth = NULL;
3059 const char *target_service = table->authservices->names[0];
3060
3061 NTSTATUS status;
3062 enum credentials_use_kerberos use_kerberos;
3063
3064 if (strcmp(oid, GENSEC_OID_KERBEROS5) == 0) {
3065 use_kerberos = CRED_MUST_USE_KERBEROS;
3066 } else if (strcmp(oid, GENSEC_OID_NTLMSSP) == 0) {
3067 use_kerberos = CRED_DONT_USE_KERBEROS;
3068 } else {
3069 return NT_STATUS_INVALID_PARAMETER;
3070 }
3071
3072 status = cli_rpc_pipe_open(cli, transport, &table->syntax_id, &result);
3073 if (!NT_STATUS_IS_OK(status)) {
3074 return status;
3075 }
3076
3077 status = rpccli_generic_bind_data(result,
3078 DCERPC_AUTH_TYPE_SPNEGO, auth_level,
3079 server, target_service,
3080 domain, username, password,
3081 use_kerberos,
3082 &auth);
3083 if (!NT_STATUS_IS_OK(status)) {
3084 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
3085 nt_errstr(status)));
3086 goto err;
3087 }
3088
3089 status = rpc_pipe_bind(result, auth);
3090 if (!NT_STATUS_IS_OK(status)) {
3091 DEBUG(0, ("cli_rpc_pipe_open_spnego: cli_rpc_pipe_bind failed with error %s\n",
3092 nt_errstr(status) ));
3093 goto err;
3094 }
3095
3096 DEBUG(10,("cli_rpc_pipe_open_spnego: opened pipe %s to "
3097 "machine %s.\n", table->name,
3098 result->desthost));
3099
3100 *presult = result;
3101 return NT_STATUS_OK;
3102
3103 err:
3104
3105 TALLOC_FREE(result);
3106 return status;
3107 }
3108
3109 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
3110 struct rpc_pipe_client *cli,
3111 DATA_BLOB *session_key)
3112 {
3113 NTSTATUS status;
3114 struct pipe_auth_data *a;
3115 struct schannel_state *schannel_auth;
3116 struct gensec_security *gensec_security;
3117 DATA_BLOB sk = data_blob_null;
3118 bool make_dup = false;
3119
3120 if (!session_key || !cli) {
3121 return NT_STATUS_INVALID_PARAMETER;
3122 }
3123
3124 a = cli->auth;
3125
3126 if (a == NULL) {
3127 return NT_STATUS_INVALID_PARAMETER;
3128 }
3129
3130 switch (cli->auth->auth_type) {
3131 case DCERPC_AUTH_TYPE_SCHANNEL:
3132 schannel_auth = talloc_get_type_abort(a->auth_ctx,
3133 struct schannel_state);
3134 sk = data_blob_const(schannel_auth->creds->session_key, 16);
3135 make_dup = true;
3136 break;
3137 case DCERPC_AUTH_TYPE_SPNEGO:
3138 case DCERPC_AUTH_TYPE_NTLMSSP:
3139 case DCERPC_AUTH_TYPE_KRB5:
3140 gensec_security = talloc_get_type_abort(a->auth_ctx,
3141 struct gensec_security);
3142 status = gensec_session_key(gensec_security, mem_ctx, &sk);
3143 if (!NT_STATUS_IS_OK(status)) {
3144 return status;
3145 }
3146 make_dup = false;
3147 break;
3148 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
3149 case DCERPC_AUTH_TYPE_NONE:
3150 sk = data_blob_const(a->transport_session_key.data,
3151 a->transport_session_key.length);
3152 make_dup = true;
3153 break;
3154 default:
3155 break;
3156 }
3157
3158 if (!sk.data) {
3159 return NT_STATUS_NO_USER_SESSION_KEY;
3160 }
3161
3162 if (make_dup) {
3163 *session_key = data_blob_dup_talloc(mem_ctx, sk);
3164 } else {
3165 *session_key = sk;
3166 }
3167
3168 return NT_STATUS_OK;
3169 }