?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:librpc/rpc: use the correct ndr flags in dcerpc_ndr_validate_in()
[Samba/gebeck_regimport.git] / source4 / librpc / rpc / dcerpc.c
bloba04dbb1ea9e05ce607a4e6e1f5e8c62822875f01
1 /*
2 Unix SMB/CIFS implementation.
3 raw dcerpc operations
4
5 Copyright (C) Tim Potter 2003
6 Copyright (C) Andrew Tridgell 2003-2005
7 Copyright (C) Jelmer Vernooij 2004-2005
8
9 This program is free software; you can redistribute it and/or modify
10 it under the terms of the GNU General Public License as published by
11 the Free Software Foundation; either version 3 of the License, or
12 (at your option) any later version.
13
14 This program is distributed in the hope that it will be useful,
15 but WITHOUT ANY WARRANTY; without even the implied warranty of
16 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 GNU General Public License for more details.
18
19 You should have received a copy of the GNU General Public License
20 along with this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "includes.h"
24 #include "../lib/util/dlinklist.h"
25 #include "lib/events/events.h"
26 #include "librpc/rpc/dcerpc.h"
27 #include "librpc/rpc/dcerpc_proto.h"
28 #include "librpc/gen_ndr/ndr_misc.h"
29 #include "librpc/gen_ndr/ndr_dcerpc.h"
30 #include "libcli/composite/composite.h"
31 #include "auth/gensec/gensec.h"
32 #include "param/param.h"
33
34 _PUBLIC_ NTSTATUS dcerpc_init(struct loadparm_context *lp_ctx)
35 {
36 return gensec_init(lp_ctx);
37 }
38
39 static void dcerpc_connection_dead(struct dcerpc_connection *conn, NTSTATUS status);
40 static void dcerpc_ship_next_request(struct dcerpc_connection *c);
41
42 /* destroy a dcerpc connection */
43 static int dcerpc_connection_destructor(struct dcerpc_connection *conn)
44 {
45 if (conn->dead) {
46 conn->free_skipped = true;
47 return -1;
48 }
49 dcerpc_connection_dead(conn, NT_STATUS_LOCAL_DISCONNECT);
50 return 0;
51 }
52
53
54 /* initialise a dcerpc connection.
55 the event context is optional
56 */
57 static struct dcerpc_connection *dcerpc_connection_init(TALLOC_CTX *mem_ctx,
58 struct tevent_context *ev)
59 {
60 struct dcerpc_connection *c;
61
62 c = talloc_zero(mem_ctx, struct dcerpc_connection);
63 if (!c) {
64 return NULL;
65 }
66
67 c->event_ctx = ev;
68
69 if (c->event_ctx == NULL) {
70 talloc_free(c);
71 return NULL;
72 }
73
74 c->call_id = 1;
75 c->security_state.auth_info = NULL;
76 c->security_state.session_key = dcerpc_generic_session_key;
77 c->security_state.generic_state = NULL;
78 c->binding_string = NULL;
79 c->flags = 0;
80 c->srv_max_xmit_frag = 0;
81 c->srv_max_recv_frag = 0;
82 c->pending = NULL;
83
84 talloc_set_destructor(c, dcerpc_connection_destructor);
85
86 return c;
87 }
88
89 /* initialise a dcerpc pipe. */
90 _PUBLIC_ struct dcerpc_pipe *dcerpc_pipe_init(TALLOC_CTX *mem_ctx, struct tevent_context *ev)
91 {
92 struct dcerpc_pipe *p;
93
94 p = talloc(mem_ctx, struct dcerpc_pipe);
95 if (!p) {
96 return NULL;
97 }
98
99 p->conn = dcerpc_connection_init(p, ev);
100 if (p->conn == NULL) {
101 talloc_free(p);
102 return NULL;
103 }
104
105 p->last_fault_code = 0;
106 p->context_id = 0;
107 p->request_timeout = DCERPC_REQUEST_TIMEOUT;
108 p->binding = NULL;
109
110 ZERO_STRUCT(p->syntax);
111 ZERO_STRUCT(p->transfer_syntax);
112
113 if (DEBUGLVL(100)) {
114 p->conn->flags |= DCERPC_DEBUG_PRINT_BOTH;
115 }
116
117 p->binding_handle = talloc(p, struct dcerpc_binding_handle);
118 if (p->binding_handle == NULL) {
119 talloc_free(p);
120 return NULL;
121 }
122 p->binding_handle->private_data = p;
123
124 return p;
125 }
126
127
128 /*
129 choose the next call id to use
130 */
131 static uint32_t next_call_id(struct dcerpc_connection *c)
132 {
133 c->call_id++;
134 if (c->call_id == 0) {
135 c->call_id++;
136 }
137 return c->call_id;
138 }
139
140 /**
141 setup for a ndr pull, also setting up any flags from the binding string
142 */
143 static struct ndr_pull *ndr_pull_init_flags(struct dcerpc_connection *c,
144 DATA_BLOB *blob, TALLOC_CTX *mem_ctx)
145 {
146 struct ndr_pull *ndr = ndr_pull_init_blob(blob, mem_ctx);
147
148 if (ndr == NULL) return ndr;
149
150 if (c->flags & DCERPC_DEBUG_PAD_CHECK) {
151 ndr->flags |= LIBNDR_FLAG_PAD_CHECK;
152 }
153
154 if (c->flags & DCERPC_NDR_REF_ALLOC) {
155 ndr->flags |= LIBNDR_FLAG_REF_ALLOC;
156 }
157
158 if (c->flags & DCERPC_NDR64) {
159 ndr->flags |= LIBNDR_FLAG_NDR64;
160 }
161
162 return ndr;
163 }
164
165 /*
166 parse a data blob into a ncacn_packet structure. This handles both
167 input and output packets
168 */
169 static NTSTATUS ncacn_pull(struct dcerpc_connection *c, DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
170 struct ncacn_packet *pkt)
171 {
172 struct ndr_pull *ndr;
173 enum ndr_err_code ndr_err;
174
175 ndr = ndr_pull_init_flags(c, blob, mem_ctx);
176 if (!ndr) {
177 return NT_STATUS_NO_MEMORY;
178 }
179
180 if (! (CVAL(blob->data, DCERPC_DREP_OFFSET) & DCERPC_DREP_LE)) {
181 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
182 }
183
184 ndr_err = ndr_pull_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
185 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
186 return ndr_map_error2ntstatus(ndr_err);
187 }
188
189 return NT_STATUS_OK;
190 }
191
192 /*
193 parse the authentication information on a dcerpc response packet
194 */
195 static NTSTATUS ncacn_pull_request_auth(struct dcerpc_connection *c, TALLOC_CTX *mem_ctx,
196 DATA_BLOB *raw_packet,
197 struct ncacn_packet *pkt)
198 {
199 NTSTATUS status;
200 struct dcerpc_auth auth;
201 uint32_t auth_length;
202
203 if (!c->security_state.auth_info ||
204 !c->security_state.generic_state) {
205 return NT_STATUS_OK;
206 }
207
208 switch (c->security_state.auth_info->auth_level) {
209 case DCERPC_AUTH_LEVEL_PRIVACY:
210 case DCERPC_AUTH_LEVEL_INTEGRITY:
211 break;
212
213 case DCERPC_AUTH_LEVEL_CONNECT:
214 if (pkt->auth_length != 0) {
215 break;
216 }
217 return NT_STATUS_OK;
218 case DCERPC_AUTH_LEVEL_NONE:
219 if (pkt->auth_length != 0) {
220 return NT_STATUS_INVALID_NETWORK_RESPONSE;
221 }
222 return NT_STATUS_OK;
223
224 default:
225 return NT_STATUS_INVALID_LEVEL;
226 }
227
228 status = dcerpc_pull_auth_trailer(pkt, mem_ctx,
229 &pkt->u.response.stub_and_verifier,
230 &auth, &auth_length, false);
231 NT_STATUS_NOT_OK_RETURN(status);
232
233 pkt->u.response.stub_and_verifier.length -= auth_length;
234
235 /* check signature or unseal the packet */
236 switch (c->security_state.auth_info->auth_level) {
237 case DCERPC_AUTH_LEVEL_PRIVACY:
238 status = gensec_unseal_packet(c->security_state.generic_state,
239 mem_ctx,
240 raw_packet->data + DCERPC_REQUEST_LENGTH,
241 pkt->u.response.stub_and_verifier.length,
242 raw_packet->data,
243 raw_packet->length - auth.credentials.length,
244 &auth.credentials);
245 memcpy(pkt->u.response.stub_and_verifier.data,
246 raw_packet->data + DCERPC_REQUEST_LENGTH,
247 pkt->u.response.stub_and_verifier.length);
248 break;
249
250 case DCERPC_AUTH_LEVEL_INTEGRITY:
251 status = gensec_check_packet(c->security_state.generic_state,
252 mem_ctx,
253 pkt->u.response.stub_and_verifier.data,
254 pkt->u.response.stub_and_verifier.length,
255 raw_packet->data,
256 raw_packet->length - auth.credentials.length,
257 &auth.credentials);
258 break;
259
260 case DCERPC_AUTH_LEVEL_CONNECT:
261 /* for now we ignore possible signatures here */
262 status = NT_STATUS_OK;
263 break;
264
265 default:
266 status = NT_STATUS_INVALID_LEVEL;
267 break;
268 }
269
270 /* remove the indicated amount of padding */
271 if (pkt->u.response.stub_and_verifier.length < auth.auth_pad_length) {
272 return NT_STATUS_INFO_LENGTH_MISMATCH;
273 }
274 pkt->u.response.stub_and_verifier.length -= auth.auth_pad_length;
275
276 return status;
277 }
278
279
280 /*
281 push a dcerpc request packet into a blob, possibly signing it.
282 */
283 static NTSTATUS ncacn_push_request_sign(struct dcerpc_connection *c,
284 DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
285 size_t sig_size,
286 struct ncacn_packet *pkt)
287 {
288 NTSTATUS status;
289 struct ndr_push *ndr;
290 DATA_BLOB creds2;
291 size_t payload_length;
292 enum ndr_err_code ndr_err;
293 size_t hdr_size = DCERPC_REQUEST_LENGTH;
294
295 /* non-signed packets are simpler */
296 if (sig_size == 0) {
297 return ncacn_push_auth(blob, mem_ctx, pkt, NULL);
298 }
299
300 switch (c->security_state.auth_info->auth_level) {
301 case DCERPC_AUTH_LEVEL_PRIVACY:
302 case DCERPC_AUTH_LEVEL_INTEGRITY:
303 break;
304
305 case DCERPC_AUTH_LEVEL_CONNECT:
306 /* TODO: let the gensec mech decide if it wants to generate a signature */
307 return ncacn_push_auth(blob, mem_ctx, pkt, NULL);
308
309 case DCERPC_AUTH_LEVEL_NONE:
310 return ncacn_push_auth(blob, mem_ctx, pkt, NULL);
311
312 default:
313 return NT_STATUS_INVALID_LEVEL;
314 }
315
316 ndr = ndr_push_init_ctx(mem_ctx);
317 if (!ndr) {
318 return NT_STATUS_NO_MEMORY;
319 }
320
321 if (c->flags & DCERPC_PUSH_BIGENDIAN) {
322 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
323 }
324
325 if (c->flags & DCERPC_NDR64) {
326 ndr->flags |= LIBNDR_FLAG_NDR64;
327 }
328
329 if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
330 ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
331 hdr_size += 16;
332 }
333
334 ndr_err = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
335 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
336 return ndr_map_error2ntstatus(ndr_err);
337 }
338
339 /* pad to 16 byte multiple in the payload portion of the
340 packet. This matches what w2k3 does. Note that we can't use
341 ndr_push_align() as that is relative to the start of the
342 whole packet, whereas w2k8 wants it relative to the start
343 of the stub */
344 c->security_state.auth_info->auth_pad_length =
345 (16 - (pkt->u.request.stub_and_verifier.length & 15)) & 15;
346 ndr_err = ndr_push_zero(ndr, c->security_state.auth_info->auth_pad_length);
347 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
348 return ndr_map_error2ntstatus(ndr_err);
349 }
350
351 payload_length = pkt->u.request.stub_and_verifier.length +
352 c->security_state.auth_info->auth_pad_length;
353
354 /* we start without signature, it will appended later */
355 c->security_state.auth_info->credentials = data_blob(NULL,0);
356
357 /* add the auth verifier */
358 ndr_err = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, c->security_state.auth_info);
359 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
360 return ndr_map_error2ntstatus(ndr_err);
361 }
362
363 /* extract the whole packet as a blob */
364 *blob = ndr_push_blob(ndr);
365
366 /*
367 * Setup the frag and auth length in the packet buffer.
368 * This is needed if the GENSEC mech does AEAD signing
369 * of the packet headers. The signature itself will be
370 * appended later.
371 */
372 dcerpc_set_frag_length(blob, blob->length + sig_size);
373 dcerpc_set_auth_length(blob, sig_size);
374
375 /* sign or seal the packet */
376 switch (c->security_state.auth_info->auth_level) {
377 case DCERPC_AUTH_LEVEL_PRIVACY:
378 status = gensec_seal_packet(c->security_state.generic_state,
379 mem_ctx,
380 blob->data + hdr_size,
381 payload_length,
382 blob->data,
383 blob->length,
384 &creds2);
385 if (!NT_STATUS_IS_OK(status)) {
386 return status;
387 }
388 break;
389
390 case DCERPC_AUTH_LEVEL_INTEGRITY:
391 status = gensec_sign_packet(c->security_state.generic_state,
392 mem_ctx,
393 blob->data + hdr_size,
394 payload_length,
395 blob->data,
396 blob->length,
397 &creds2);
398 if (!NT_STATUS_IS_OK(status)) {
399 return status;
400 }
401 break;
402
403 default:
404 status = NT_STATUS_INVALID_LEVEL;
405 break;
406 }
407
408 if (creds2.length != sig_size) {
409 /* this means the sig_size estimate for the signature
410 was incorrect. We have to correct the packet
411 sizes. That means we could go over the max fragment
412 length */
413 DEBUG(3,("ncacn_push_request_sign: creds2.length[%u] != sig_size[%u] pad[%u] stub[%u]\n",
414 (unsigned) creds2.length,
415 (unsigned) sig_size,
416 (unsigned) c->security_state.auth_info->auth_pad_length,
417 (unsigned) pkt->u.request.stub_and_verifier.length));
418 dcerpc_set_frag_length(blob, blob->length + creds2.length);
419 dcerpc_set_auth_length(blob, creds2.length);
420 }
421
422 if (!data_blob_append(mem_ctx, blob, creds2.data, creds2.length)) {
423 return NT_STATUS_NO_MEMORY;
424 }
425
426 return NT_STATUS_OK;
427 }
428
429
430 /*
431 fill in the fixed values in a dcerpc header
432 */
433 static void init_ncacn_hdr(struct dcerpc_connection *c, struct ncacn_packet *pkt)
434 {
435 pkt->rpc_vers = 5;
436 pkt->rpc_vers_minor = 0;
437 if (c->flags & DCERPC_PUSH_BIGENDIAN) {
438 pkt->drep[0] = 0;
439 } else {
440 pkt->drep[0] = DCERPC_DREP_LE;
441 }
442 pkt->drep[1] = 0;
443 pkt->drep[2] = 0;
444 pkt->drep[3] = 0;
445 }
446
447 /*
448 map a bind nak reason to a NTSTATUS
449 */
450 static NTSTATUS dcerpc_map_reason(uint16_t reason)
451 {
452 switch (reason) {
453 case DCERPC_BIND_REASON_ASYNTAX:
454 return NT_STATUS_RPC_UNSUPPORTED_NAME_SYNTAX;
455 case DCERPC_BIND_REASON_INVALID_AUTH_TYPE:
456 return NT_STATUS_INVALID_PARAMETER;
457 }
458 return NT_STATUS_UNSUCCESSFUL;
459 }
460
461 /*
462 a bind or alter context has failed
463 */
464 static void dcerpc_composite_fail(struct rpc_request *req)
465 {
466 struct composite_context *c = talloc_get_type(req->async.private_data,
467 struct composite_context);
468 composite_error(c, req->status);
469 }
470
471 /*
472 remove requests from the pending or queued queues
473 */
474 static int dcerpc_req_dequeue(struct rpc_request *req)
475 {
476 switch (req->state) {
477 case RPC_REQUEST_QUEUED:
478 DLIST_REMOVE(req->p->conn->request_queue, req);
479 break;
480 case RPC_REQUEST_PENDING:
481 DLIST_REMOVE(req->p->conn->pending, req);
482 break;
483 case RPC_REQUEST_DONE:
484 break;
485 }
486 return 0;
487 }
488
489
490 /*
491 mark the dcerpc connection dead. All outstanding requests get an error
492 */
493 static void dcerpc_connection_dead(struct dcerpc_connection *conn, NTSTATUS status)
494 {
495 if (conn->dead) return;
496
497 conn->dead = true;
498
499 if (conn->transport.shutdown_pipe) {
500 conn->transport.shutdown_pipe(conn, status);
501 }
502
503 /* all pending requests get the error */
504 while (conn->pending) {
505 struct rpc_request *req = conn->pending;
506 dcerpc_req_dequeue(req);
507 req->state = RPC_REQUEST_DONE;
508 req->status = status;
509 if (req->async.callback) {
510 req->async.callback(req);
511 }
512 }
513
514 talloc_set_destructor(conn, NULL);
515 if (conn->free_skipped) {
516 talloc_free(conn);
517 }
518 }
519
520 /*
521 forward declarations of the recv_data handlers for the types of
522 packets we need to handle
523 */
524 static void dcerpc_request_recv_data(struct dcerpc_connection *c,
525 DATA_BLOB *raw_packet, struct ncacn_packet *pkt);
526
527 /*
528 receive a dcerpc reply from the transport. Here we work out what
529 type of reply it is (normal request, bind or alter context) and
530 dispatch to the appropriate handler
531 */
532 static void dcerpc_recv_data(struct dcerpc_connection *conn, DATA_BLOB *blob, NTSTATUS status)
533 {
534 struct ncacn_packet pkt;
535
536 if (NT_STATUS_IS_OK(status) && blob->length == 0) {
537 status = NT_STATUS_UNEXPECTED_NETWORK_ERROR;
538 }
539
540 /* the transport may be telling us of a severe error, such as
541 a dropped socket */
542 if (!NT_STATUS_IS_OK(status)) {
543 data_blob_free(blob);
544 dcerpc_connection_dead(conn, status);
545 return;
546 }
547
548 /* parse the basic packet to work out what type of response this is */
549 status = ncacn_pull(conn, blob, blob->data, &pkt);
550 if (!NT_STATUS_IS_OK(status)) {
551 data_blob_free(blob);
552 dcerpc_connection_dead(conn, status);
553 }
554
555 dcerpc_request_recv_data(conn, blob, &pkt);
556 }
557
558 /*
559 Receive a bind reply from the transport
560 */
561 static void dcerpc_bind_recv_handler(struct rpc_request *req,
562 DATA_BLOB *raw_packet, struct ncacn_packet *pkt)
563 {
564 struct composite_context *c;
565 struct dcerpc_connection *conn;
566
567 c = talloc_get_type(req->async.private_data, struct composite_context);
568
569 if (pkt->ptype == DCERPC_PKT_BIND_NAK) {
570 DEBUG(2,("dcerpc: bind_nak reason %d\n",
571 pkt->u.bind_nak.reject_reason));
572 composite_error(c, dcerpc_map_reason(pkt->u.bind_nak.
573 reject_reason));
574 return;
575 }
576
577 if ((pkt->ptype != DCERPC_PKT_BIND_ACK) ||
578 (pkt->u.bind_ack.num_results == 0) ||
579 (pkt->u.bind_ack.ctx_list[0].result != 0)) {
580 req->p->last_fault_code = DCERPC_NCA_S_PROTO_ERROR;
581 composite_error(c, NT_STATUS_NET_WRITE_FAULT);
582 return;
583 }
584
585 conn = req->p->conn;
586
587 conn->srv_max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
588 conn->srv_max_recv_frag = pkt->u.bind_ack.max_recv_frag;
589
590 if ((req->p->binding->flags & DCERPC_CONCURRENT_MULTIPLEX) &&
591 (pkt->pfc_flags & DCERPC_PFC_FLAG_CONC_MPX)) {
592 conn->flags |= DCERPC_CONCURRENT_MULTIPLEX;
593 }
594
595 if ((req->p->binding->flags & DCERPC_HEADER_SIGNING) &&
596 (pkt->pfc_flags & DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN)) {
597 conn->flags |= DCERPC_HEADER_SIGNING;
598 }
599
600 /* the bind_ack might contain a reply set of credentials */
601 if (conn->security_state.auth_info && pkt->u.bind_ack.auth_info.length) {
602 NTSTATUS status;
603 uint32_t auth_length;
604 status = dcerpc_pull_auth_trailer(pkt, conn, &pkt->u.bind_ack.auth_info,
605 conn->security_state.auth_info, &auth_length, true);
606 if (!NT_STATUS_IS_OK(status)) {
607 composite_error(c, status);
608 return;
609 }
610 }
611
612 req->p->assoc_group_id = pkt->u.bind_ack.assoc_group_id;
613
614 composite_done(c);
615 }
616
617 /*
618 handle timeouts of individual dcerpc requests
619 */
620 static void dcerpc_timeout_handler(struct tevent_context *ev, struct tevent_timer *te,
621 struct timeval t, void *private_data)
622 {
623 struct rpc_request *req = talloc_get_type(private_data, struct rpc_request);
624
625 if (req->ignore_timeout) {
626 dcerpc_req_dequeue(req);
627 req->state = RPC_REQUEST_DONE;
628 req->status = NT_STATUS_IO_TIMEOUT;
629 if (req->async.callback) {
630 req->async.callback(req);
631 }
632 return;
633 }
634
635 dcerpc_connection_dead(req->p->conn, NT_STATUS_IO_TIMEOUT);
636 }
637
638 /*
639 send a async dcerpc bind request
640 */
641 struct composite_context *dcerpc_bind_send(struct dcerpc_pipe *p,
642 TALLOC_CTX *mem_ctx,
643 const struct ndr_syntax_id *syntax,
644 const struct ndr_syntax_id *transfer_syntax)
645 {
646 struct composite_context *c;
647 struct ncacn_packet pkt;
648 DATA_BLOB blob;
649 struct rpc_request *req;
650
651 c = composite_create(mem_ctx,p->conn->event_ctx);
652 if (c == NULL) return NULL;
653
654 c->private_data = p;
655
656 p->syntax = *syntax;
657 p->transfer_syntax = *transfer_syntax;
658
659 init_ncacn_hdr(p->conn, &pkt);
660
661 pkt.ptype = DCERPC_PKT_BIND;
662 pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
663 pkt.call_id = p->conn->call_id;
664 pkt.auth_length = 0;
665
666 if (p->binding->flags & DCERPC_CONCURRENT_MULTIPLEX) {
667 pkt.pfc_flags |= DCERPC_PFC_FLAG_CONC_MPX;
668 }
669
670 if (p->binding->flags & DCERPC_HEADER_SIGNING) {
671 pkt.pfc_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
672 }
673
674 pkt.u.bind.max_xmit_frag = 5840;
675 pkt.u.bind.max_recv_frag = 5840;
676 pkt.u.bind.assoc_group_id = p->binding->assoc_group_id;
677 pkt.u.bind.num_contexts = 1;
678 pkt.u.bind.ctx_list = talloc_array(mem_ctx, struct dcerpc_ctx_list, 1);
679 if (composite_nomem(pkt.u.bind.ctx_list, c)) return c;
680 pkt.u.bind.ctx_list[0].context_id = p->context_id;
681 pkt.u.bind.ctx_list[0].num_transfer_syntaxes = 1;
682 pkt.u.bind.ctx_list[0].abstract_syntax = p->syntax;
683 pkt.u.bind.ctx_list[0].transfer_syntaxes = &p->transfer_syntax;
684 pkt.u.bind.auth_info = data_blob(NULL, 0);
685
686 /* construct the NDR form of the packet */
687 c->status = ncacn_push_auth(&blob, c, &pkt,
688 p->conn->security_state.auth_info);
689 if (!composite_is_ok(c)) return c;
690
691 p->conn->transport.recv_data = dcerpc_recv_data;
692
693 /*
694 * we allocate a dcerpc_request so we can be in the same
695 * request queue as normal requests
696 */
697 req = talloc_zero(c, struct rpc_request);
698 if (composite_nomem(req, c)) return c;
699
700 req->state = RPC_REQUEST_PENDING;
701 req->call_id = pkt.call_id;
702 req->async.private_data = c;
703 req->async.callback = dcerpc_composite_fail;
704 req->p = p;
705 req->recv_handler = dcerpc_bind_recv_handler;
706 DLIST_ADD_END(p->conn->pending, req, struct rpc_request *);
707 talloc_set_destructor(req, dcerpc_req_dequeue);
708
709 c->status = p->conn->transport.send_request(p->conn, &blob,
710 true);
711 if (!composite_is_ok(c)) return c;
712
713 event_add_timed(c->event_ctx, req,
714 timeval_current_ofs(DCERPC_REQUEST_TIMEOUT, 0),
715 dcerpc_timeout_handler, req);
716
717 return c;
718 }
719
720 /*
721 recv side of async dcerpc bind request
722 */
723 NTSTATUS dcerpc_bind_recv(struct composite_context *ctx)
724 {
725 NTSTATUS result = composite_wait(ctx);
726 talloc_free(ctx);
727 return result;
728 }
729
730 /*
731 perform a continued bind (and auth3)
732 */
733 NTSTATUS dcerpc_auth3(struct dcerpc_pipe *p,
734 TALLOC_CTX *mem_ctx)
735 {
736 struct ncacn_packet pkt;
737 NTSTATUS status;
738 DATA_BLOB blob;
739
740 init_ncacn_hdr(p->conn, &pkt);
741
742 pkt.ptype = DCERPC_PKT_AUTH3;
743 pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
744 pkt.call_id = next_call_id(p->conn);
745 pkt.auth_length = 0;
746 pkt.u.auth3.auth_info = data_blob(NULL, 0);
747
748 if (p->binding->flags & DCERPC_CONCURRENT_MULTIPLEX) {
749 pkt.pfc_flags |= DCERPC_PFC_FLAG_CONC_MPX;
750 }
751
752 if (p->binding->flags & DCERPC_HEADER_SIGNING) {
753 pkt.pfc_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
754 }
755
756 /* construct the NDR form of the packet */
757 status = ncacn_push_auth(&blob, mem_ctx,
758 &pkt,
759 p->conn->security_state.auth_info);
760 if (!NT_STATUS_IS_OK(status)) {
761 return status;
762 }
763
764 /* send it on its way */
765 status = p->conn->transport.send_request(p->conn, &blob, false);
766 if (!NT_STATUS_IS_OK(status)) {
767 return status;
768 }
769
770 return NT_STATUS_OK;
771 }
772
773
774 /*
775 process a fragment received from the transport layer during a
776 request
777
778 This function frees the data
779 */
780 static void dcerpc_request_recv_data(struct dcerpc_connection *c,
781 DATA_BLOB *raw_packet, struct ncacn_packet *pkt)
782 {
783 struct rpc_request *req;
784 unsigned int length;
785 NTSTATUS status = NT_STATUS_OK;
786
787 /*
788 if this is an authenticated connection then parse and check
789 the auth info. We have to do this before finding the
790 matching packet, as the request structure might have been
791 removed due to a timeout, but if it has been we still need
792 to run the auth routines so that we don't get the sign/seal
793 info out of step with the server
794 */
795 if (c->security_state.auth_info && c->security_state.generic_state &&
796 pkt->ptype == DCERPC_PKT_RESPONSE) {
797 status = ncacn_pull_request_auth(c, raw_packet->data, raw_packet, pkt);
798 }
799
800 /* find the matching request */
801 for (req=c->pending;req;req=req->next) {
802 if (pkt->call_id == req->call_id) break;
803 }
804
805 #if 0
806 /* useful for testing certain vendors RPC servers */
807 if (req == NULL && c->pending && pkt->call_id == 0) {
808 DEBUG(0,("HACK FOR INCORRECT CALL ID\n"));
809 req = c->pending;
810 }
811 #endif
812
813 if (req == NULL) {
814 DEBUG(2,("dcerpc_request: unmatched call_id %u in response packet\n", pkt->call_id));
815 data_blob_free(raw_packet);
816 return;
817 }
818
819 talloc_steal(req, raw_packet->data);
820
821 if (req->recv_handler != NULL) {
822 dcerpc_req_dequeue(req);
823 req->state = RPC_REQUEST_DONE;
824 req->recv_handler(req, raw_packet, pkt);
825 return;
826 }
827
828 if (pkt->ptype == DCERPC_PKT_FAULT) {
829 DEBUG(5,("rpc fault: %s\n", dcerpc_errstr(c, pkt->u.fault.status)));
830 req->fault_code = pkt->u.fault.status;
831 req->status = NT_STATUS_NET_WRITE_FAULT;
832 goto req_done;
833 }
834
835 if (pkt->ptype != DCERPC_PKT_RESPONSE) {
836 DEBUG(2,("Unexpected packet type %d in dcerpc response\n",
837 (int)pkt->ptype));
838 req->fault_code = DCERPC_FAULT_OTHER;
839 req->status = NT_STATUS_NET_WRITE_FAULT;
840 goto req_done;
841 }
842
843 /* now check the status from the auth routines, and if it failed then fail
844 this request accordingly */
845 if (!NT_STATUS_IS_OK(status)) {
846 req->status = status;
847 goto req_done;
848 }
849
850 length = pkt->u.response.stub_and_verifier.length;
851
852 if (length > 0) {
853 req->payload.data = talloc_realloc(req,
854 req->payload.data,
855 uint8_t,
856 req->payload.length + length);
857 if (!req->payload.data) {
858 req->status = NT_STATUS_NO_MEMORY;
859 goto req_done;
860 }
861 memcpy(req->payload.data+req->payload.length,
862 pkt->u.response.stub_and_verifier.data, length);
863 req->payload.length += length;
864 }
865
866 if (!(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
867 c->transport.send_read(c);
868 return;
869 }
870
871 if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
872 req->flags |= DCERPC_PULL_BIGENDIAN;
873 } else {
874 req->flags &= ~DCERPC_PULL_BIGENDIAN;
875 }
876
877
878 req_done:
879 /* we've got the full payload */
880 req->state = RPC_REQUEST_DONE;
881 DLIST_REMOVE(c->pending, req);
882
883 if (c->request_queue != NULL) {
884 /* We have to look at shipping further requests before calling
885 * the async function, that one might close the pipe */
886 dcerpc_ship_next_request(c);
887 }
888
889 if (req->async.callback) {
890 req->async.callback(req);
891 }
892 }
893
894 /*
895 perform the send side of a async dcerpc request
896 */
897 static struct rpc_request *dcerpc_request_send(struct dcerpc_pipe *p,
898 const struct GUID *object,
899 uint16_t opnum,
900 bool async,
901 DATA_BLOB *stub_data)
902 {
903 struct rpc_request *req;
904
905 p->conn->transport.recv_data = dcerpc_recv_data;
906
907 req = talloc(p, struct rpc_request);
908 if (req == NULL) {
909 return NULL;
910 }
911
912 req->p = p;
913 req->call_id = next_call_id(p->conn);
914 req->status = NT_STATUS_OK;
915 req->state = RPC_REQUEST_QUEUED;
916 req->payload = data_blob(NULL, 0);
917 req->flags = 0;
918 req->fault_code = 0;
919 req->async_call = async;
920 req->ignore_timeout = false;
921 req->async.callback = NULL;
922 req->async.private_data = NULL;
923 req->recv_handler = NULL;
924
925 if (object != NULL) {
926 req->object = (struct GUID *)talloc_memdup(req, (const void *)object, sizeof(*object));
927 if (req->object == NULL) {
928 talloc_free(req);
929 return NULL;
930 }
931 } else {
932 req->object = NULL;
933 }
934
935 req->opnum = opnum;
936 req->request_data.length = stub_data->length;
937 req->request_data.data = talloc_reference(req, stub_data->data);
938 if (req->request_data.length && req->request_data.data == NULL) {
939 return NULL;
940 }
941
942 DLIST_ADD_END(p->conn->request_queue, req, struct rpc_request *);
943 talloc_set_destructor(req, dcerpc_req_dequeue);
944
945 dcerpc_ship_next_request(p->conn);
946
947 if (p->request_timeout) {
948 event_add_timed(dcerpc_event_context(p), req,
949 timeval_current_ofs(p->request_timeout, 0),
950 dcerpc_timeout_handler, req);
951 }
952
953 return req;
954 }
955
956 /*
957 Send a request using the transport
958 */
959
960 static void dcerpc_ship_next_request(struct dcerpc_connection *c)
961 {
962 struct rpc_request *req;
963 struct dcerpc_pipe *p;
964 DATA_BLOB *stub_data;
965 struct ncacn_packet pkt;
966 DATA_BLOB blob;
967 uint32_t remaining, chunk_size;
968 bool first_packet = true;
969 size_t sig_size = 0;
970
971 req = c->request_queue;
972 if (req == NULL) {
973 return;
974 }
975
976 p = req->p;
977 stub_data = &req->request_data;
978
979 if (!req->async_call && (c->pending != NULL)) {
980 return;
981 }
982
983 DLIST_REMOVE(c->request_queue, req);
984 DLIST_ADD(c->pending, req);
985 req->state = RPC_REQUEST_PENDING;
986
987 init_ncacn_hdr(p->conn, &pkt);
988
989 remaining = stub_data->length;
990
991 /* we can write a full max_recv_frag size, minus the dcerpc
992 request header size */
993 chunk_size = p->conn->srv_max_recv_frag;
994 chunk_size -= DCERPC_REQUEST_LENGTH;
995 if (c->security_state.auth_info &&
996 c->security_state.generic_state) {
997 sig_size = gensec_sig_size(c->security_state.generic_state,
998 p->conn->srv_max_recv_frag);
999 if (sig_size) {
1000 chunk_size -= DCERPC_AUTH_TRAILER_LENGTH;
1001 chunk_size -= sig_size;
1002 }
1003 }
1004 chunk_size -= (chunk_size % 16);
1005
1006 pkt.ptype = DCERPC_PKT_REQUEST;
1007 pkt.call_id = req->call_id;
1008 pkt.auth_length = 0;
1009 pkt.pfc_flags = 0;
1010 pkt.u.request.alloc_hint = remaining;
1011 pkt.u.request.context_id = p->context_id;
1012 pkt.u.request.opnum = req->opnum;
1013
1014 if (req->object) {
1015 pkt.u.request.object.object = *req->object;
1016 pkt.pfc_flags |= DCERPC_PFC_FLAG_OBJECT_UUID;
1017 chunk_size -= ndr_size_GUID(req->object,0);
1018 }
1019
1020 /* we send a series of pdus without waiting for a reply */
1021 while (remaining > 0 || first_packet) {
1022 uint32_t chunk = MIN(chunk_size, remaining);
1023 bool last_frag = false;
1024 bool do_trans = false;
1025
1026 first_packet = false;
1027 pkt.pfc_flags &= ~(DCERPC_PFC_FLAG_FIRST |DCERPC_PFC_FLAG_LAST);
1028
1029 if (remaining == stub_data->length) {
1030 pkt.pfc_flags |= DCERPC_PFC_FLAG_FIRST;
1031 }
1032 if (chunk == remaining) {
1033 pkt.pfc_flags |= DCERPC_PFC_FLAG_LAST;
1034 last_frag = true;
1035 }
1036
1037 pkt.u.request.stub_and_verifier.data = stub_data->data +
1038 (stub_data->length - remaining);
1039 pkt.u.request.stub_and_verifier.length = chunk;
1040
1041 req->status = ncacn_push_request_sign(p->conn, &blob, req, sig_size, &pkt);
1042 if (!NT_STATUS_IS_OK(req->status)) {
1043 req->state = RPC_REQUEST_DONE;
1044 DLIST_REMOVE(p->conn->pending, req);
1045 return;
1046 }
1047
1048 if (last_frag && !req->async_call) {
1049 do_trans = true;
1050 }
1051
1052 req->status = p->conn->transport.send_request(p->conn, &blob, do_trans);
1053 if (!NT_STATUS_IS_OK(req->status)) {
1054 req->state = RPC_REQUEST_DONE;
1055 DLIST_REMOVE(p->conn->pending, req);
1056 return;
1057 }
1058
1059 if (last_frag && !do_trans) {
1060 req->status = p->conn->transport.send_read(p->conn);
1061 if (!NT_STATUS_IS_OK(req->status)) {
1062 req->state = RPC_REQUEST_DONE;
1063 DLIST_REMOVE(p->conn->pending, req);
1064 return;
1065 }
1066 }
1067
1068 remaining -= chunk;
1069 }
1070 }
1071
1072 /*
1073 return the event context for a dcerpc pipe
1074 used by callers who wish to operate asynchronously
1075 */
1076 _PUBLIC_ struct tevent_context *dcerpc_event_context(struct dcerpc_pipe *p)
1077 {
1078 return p->conn->event_ctx;
1079 }
1080
1081
1082
1083 /*
1084 perform the receive side of a async dcerpc request
1085 */
1086 NTSTATUS dcerpc_request_recv(struct rpc_request *req,
1087 TALLOC_CTX *mem_ctx,
1088 DATA_BLOB *stub_data)
1089 {
1090 NTSTATUS status;
1091
1092 while (req->state != RPC_REQUEST_DONE) {
1093 struct tevent_context *ctx = dcerpc_event_context(req->p);
1094 if (event_loop_once(ctx) != 0) {
1095 return NT_STATUS_CONNECTION_DISCONNECTED;
1096 }
1097 }
1098 *stub_data = req->payload;
1099 status = req->status;
1100 if (stub_data->data) {
1101 stub_data->data = talloc_steal(mem_ctx, stub_data->data);
1102 }
1103 if (NT_STATUS_EQUAL(status, NT_STATUS_NET_WRITE_FAULT)) {
1104 req->p->last_fault_code = req->fault_code;
1105 }
1106 talloc_unlink(talloc_parent(req), req);
1107 return status;
1108 }
1109
1110 /*
1111 perform a full request/response pair on a dcerpc pipe
1112 */
1113 NTSTATUS dcerpc_request(struct dcerpc_pipe *p,
1114 struct GUID *object,
1115 uint16_t opnum,
1116 TALLOC_CTX *mem_ctx,
1117 DATA_BLOB *stub_data_in,
1118 DATA_BLOB *stub_data_out)
1119 {
1120 struct rpc_request *req;
1121
1122 req = dcerpc_request_send(p, object, opnum, false, stub_data_in);
1123 if (req == NULL) {
1124 return NT_STATUS_NO_MEMORY;
1125 }
1126
1127 return dcerpc_request_recv(req, mem_ctx, stub_data_out);
1128 }
1129
1130
1131 /*
1132 this is a paranoid NDR validator. For every packet we push onto the wire
1133 we pull it back again, then push it again. Then we compare the raw NDR data
1134 for that to the NDR we initially generated. If they don't match then we know
1135 we must have a bug in either the pull or push side of our code
1136 */
1137 static NTSTATUS dcerpc_ndr_validate_in(struct dcerpc_connection *c,
1138 TALLOC_CTX *mem_ctx,
1139 DATA_BLOB blob,
1140 size_t struct_size,
1141 ndr_push_flags_fn_t ndr_push,
1142 ndr_pull_flags_fn_t ndr_pull)
1143 {
1144 void *st;
1145 struct ndr_pull *pull;
1146 struct ndr_push *push;
1147 DATA_BLOB blob2;
1148 enum ndr_err_code ndr_err;
1149
1150 st = talloc_size(mem_ctx, struct_size);
1151 if (!st) {
1152 return NT_STATUS_NO_MEMORY;
1153 }
1154
1155 pull = ndr_pull_init_flags(c, &blob, mem_ctx);
1156 if (!pull) {
1157 return NT_STATUS_NO_MEMORY;
1158 }
1159 pull->flags |= LIBNDR_FLAG_REF_ALLOC;
1160
1161 if (c->flags & DCERPC_PUSH_BIGENDIAN) {
1162 pull->flags |= LIBNDR_FLAG_BIGENDIAN;
1163 }
1164
1165 if (c->flags & DCERPC_NDR64) {
1166 pull->flags |= LIBNDR_FLAG_NDR64;
1167 }
1168
1169 ndr_err = ndr_pull(pull, NDR_IN, st);
1170 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1171 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1172 ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
1173 "failed input validation pull - %s",
1174 nt_errstr(status));
1175 return ndr_map_error2ntstatus(ndr_err);
1176 }
1177
1178 push = ndr_push_init_ctx(mem_ctx);
1179 if (!push) {
1180 return NT_STATUS_NO_MEMORY;
1181 }
1182
1183 if (c->flags & DCERPC_PUSH_BIGENDIAN) {
1184 push->flags |= LIBNDR_FLAG_BIGENDIAN;
1185 }
1186
1187 if (c->flags & DCERPC_NDR64) {
1188 push->flags |= LIBNDR_FLAG_NDR64;
1189 }
1190
1191 ndr_err = ndr_push(push, NDR_IN, st);
1192 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1193 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1194 ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
1195 "failed input validation push - %s",
1196 nt_errstr(status));
1197 return ndr_map_error2ntstatus(ndr_err);
1198 }
1199
1200 blob2 = ndr_push_blob(push);
1201
1202 if (data_blob_cmp(&blob, &blob2) != 0) {
1203 DEBUG(3,("original:\n"));
1204 dump_data(3, blob.data, blob.length);
1205 DEBUG(3,("secondary:\n"));
1206 dump_data(3, blob2.data, blob2.length);
1207 ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
1208 "failed input validation blobs doesn't match");
1209 return ndr_map_error2ntstatus(ndr_err);
1210 }
1211
1212 return NT_STATUS_OK;
1213 }
1214
1215 /*
1216 this is a paranoid NDR input validator. For every packet we pull
1217 from the wire we push it back again then pull and push it
1218 again. Then we compare the raw NDR data for that to the NDR we
1219 initially generated. If they don't match then we know we must have a
1220 bug in either the pull or push side of our code
1221 */
1222 static NTSTATUS dcerpc_ndr_validate_out(struct dcerpc_connection *c,
1223 struct ndr_pull *pull_in,
1224 void *struct_ptr,
1225 size_t struct_size,
1226 ndr_push_flags_fn_t ndr_push,
1227 ndr_pull_flags_fn_t ndr_pull,
1228 ndr_print_function_t ndr_print)
1229 {
1230 void *st;
1231 struct ndr_pull *pull;
1232 struct ndr_push *push;
1233 DATA_BLOB blob, blob2;
1234 TALLOC_CTX *mem_ctx = pull_in;
1235 char *s1, *s2;
1236 enum ndr_err_code ndr_err;
1237
1238 st = talloc_size(mem_ctx, struct_size);
1239 if (!st) {
1240 return NT_STATUS_NO_MEMORY;
1241 }
1242 memcpy(st, struct_ptr, struct_size);
1243
1244 push = ndr_push_init_ctx(mem_ctx);
1245 if (!push) {
1246 return NT_STATUS_NO_MEMORY;
1247 }
1248
1249 ndr_err = ndr_push(push, NDR_OUT, struct_ptr);
1250 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1251 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1252 ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
1253 "failed output validation push - %s",
1254 nt_errstr(status));
1255 return ndr_map_error2ntstatus(ndr_err);
1256 }
1257
1258 blob = ndr_push_blob(push);
1259
1260 pull = ndr_pull_init_flags(c, &blob, mem_ctx);
1261 if (!pull) {
1262 return NT_STATUS_NO_MEMORY;
1263 }
1264
1265 pull->flags |= LIBNDR_FLAG_REF_ALLOC;
1266 ndr_err = ndr_pull(pull, NDR_OUT, st);
1267 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1268 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1269 ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
1270 "failed output validation pull - %s",
1271 nt_errstr(status));
1272 return ndr_map_error2ntstatus(ndr_err);
1273 }
1274
1275 push = ndr_push_init_ctx(mem_ctx);
1276 if (!push) {
1277 return NT_STATUS_NO_MEMORY;
1278 }
1279
1280 ndr_err = ndr_push(push, NDR_OUT, st);
1281 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1282 NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
1283 ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
1284 "failed output validation push2 - %s",
1285 nt_errstr(status));
1286 return ndr_map_error2ntstatus(ndr_err);
1287 }
1288
1289 blob2 = ndr_push_blob(push);
1290
1291 if (data_blob_cmp(&blob, &blob2) != 0) {
1292 DEBUG(3,("original:\n"));
1293 dump_data(3, blob.data, blob.length);
1294 DEBUG(3,("secondary:\n"));
1295 dump_data(3, blob2.data, blob2.length);
1296 ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
1297 "failed output validation blobs doesn't match");
1298 return ndr_map_error2ntstatus(ndr_err);
1299 }
1300
1301 /* this checks the printed forms of the two structures, which effectively
1302 tests all of the value() attributes */
1303 s1 = ndr_print_function_string(mem_ctx, ndr_print, "VALIDATE",
1304 NDR_OUT, struct_ptr);
1305 s2 = ndr_print_function_string(mem_ctx, ndr_print, "VALIDATE",
1306 NDR_OUT, st);
1307 if (strcmp(s1, s2) != 0) {
1308 #if 1
1309 DEBUG(3,("VALIDATE ERROR:\nWIRE:\n%s\n GEN:\n%s\n", s1, s2));
1310 #else
1311 /* this is sometimes useful */
1312 printf("VALIDATE ERROR\n");
1313 file_save("wire.dat", s1, strlen(s1));
1314 file_save("gen.dat", s2, strlen(s2));
1315 system("diff -u wire.dat gen.dat");
1316 #endif
1317 ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
1318 "failed output validation strings doesn't match");
1319 return ndr_map_error2ntstatus(ndr_err);
1320 }
1321
1322 return NT_STATUS_OK;
1323 }
1324
1325
1326 /**
1327 send a rpc request given a dcerpc_call structure
1328 */
1329 struct rpc_request *dcerpc_ndr_request_send(struct dcerpc_pipe *p,
1330 const struct GUID *object,
1331 const struct ndr_interface_table *table,
1332 uint32_t opnum,
1333 bool async,
1334 TALLOC_CTX *mem_ctx,
1335 void *r)
1336 {
1337 const struct ndr_interface_call *call;
1338 struct ndr_push *push;
1339 NTSTATUS status;
1340 DATA_BLOB request;
1341 struct rpc_request *req;
1342 enum ndr_err_code ndr_err;
1343
1344 call = &table->calls[opnum];
1345
1346 /* setup for a ndr_push_* call */
1347 push = ndr_push_init_ctx(mem_ctx);
1348 if (!push) {
1349 return NULL;
1350 }
1351
1352 if (p->conn->flags & DCERPC_PUSH_BIGENDIAN) {
1353 push->flags |= LIBNDR_FLAG_BIGENDIAN;
1354 }
1355
1356 if (p->conn->flags & DCERPC_NDR64) {
1357 push->flags |= LIBNDR_FLAG_NDR64;
1358 }
1359
1360 /* push the structure into a blob */
1361 ndr_err = call->ndr_push(push, NDR_IN, r);
1362 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1363 status = ndr_map_error2ntstatus(ndr_err);
1364 DEBUG(2,("Unable to ndr_push structure in dcerpc_ndr_request_send - %s\n",
1365 nt_errstr(status)));
1366 talloc_free(push);
1367 return NULL;
1368 }
1369
1370 /* retrieve the blob */
1371 request = ndr_push_blob(push);
1372
1373 if (p->conn->flags & DCERPC_DEBUG_VALIDATE_IN) {
1374 status = dcerpc_ndr_validate_in(p->conn, push, request, call->struct_size,
1375 call->ndr_push, call->ndr_pull);
1376 if (!NT_STATUS_IS_OK(status)) {
1377 DEBUG(2,("Validation failed in dcerpc_ndr_request_send - %s\n",
1378 nt_errstr(status)));
1379 talloc_free(push);
1380 return NULL;
1381 }
1382 }
1383
1384 DEBUG(10,("rpc request data:\n"));
1385 dump_data(10, request.data, request.length);
1386
1387 /* make the actual dcerpc request */
1388 req = dcerpc_request_send(p, object, opnum, async, &request);
1389
1390 if (req != NULL) {
1391 req->ndr.table = table;
1392 req->ndr.opnum = opnum;
1393 req->ndr.struct_ptr = r;
1394 req->ndr.mem_ctx = mem_ctx;
1395 }
1396
1397 talloc_free(push);
1398
1399 return req;
1400 }
1401
1402 /*
1403 receive the answer from a dcerpc_ndr_request_send()
1404 */
1405 _PUBLIC_ NTSTATUS dcerpc_ndr_request_recv(struct rpc_request *req)
1406 {
1407 struct dcerpc_pipe *p = req->p;
1408 NTSTATUS status;
1409 DATA_BLOB response;
1410 struct ndr_pull *pull;
1411 unsigned int flags;
1412 TALLOC_CTX *mem_ctx = req->ndr.mem_ctx;
1413 void *r = req->ndr.struct_ptr;
1414 uint32_t opnum = req->ndr.opnum;
1415 const struct ndr_interface_table *table = req->ndr.table;
1416 const struct ndr_interface_call *call = &table->calls[opnum];
1417 enum ndr_err_code ndr_err;
1418
1419 /* make sure the recv code doesn't free the request, as we
1420 need to grab the flags element before it is freed */
1421 if (talloc_reference(p, req) == NULL) {
1422 return NT_STATUS_NO_MEMORY;
1423 }
1424
1425 status = dcerpc_request_recv(req, mem_ctx, &response);
1426 if (!NT_STATUS_IS_OK(status)) {
1427 talloc_unlink(p, req);
1428 return status;
1429 }
1430
1431 flags = req->flags;
1432
1433 /* prepare for ndr_pull_* */
1434 pull = ndr_pull_init_flags(p->conn, &response, mem_ctx);
1435 if (!pull) {
1436 talloc_unlink(p, req);
1437 return NT_STATUS_NO_MEMORY;
1438 }
1439
1440 if (pull->data) {
1441 pull->data = talloc_steal(pull, pull->data);
1442 }
1443 talloc_unlink(p, req);
1444
1445 if (flags & DCERPC_PULL_BIGENDIAN) {
1446 pull->flags |= LIBNDR_FLAG_BIGENDIAN;
1447 }
1448
1449 DEBUG(10,("rpc reply data:\n"));
1450 dump_data(10, pull->data, pull->data_size);
1451
1452 /* pull the structure from the blob */
1453 ndr_err = call->ndr_pull(pull, NDR_OUT, r);
1454 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1455 status = ndr_map_error2ntstatus(ndr_err);
1456 dcerpc_log_packet(p->conn->packet_log_dir,
1457 table, opnum, NDR_OUT,
1458 &response);
1459 return status;
1460 }
1461
1462 if (p->conn->flags & DCERPC_DEBUG_VALIDATE_OUT) {
1463 status = dcerpc_ndr_validate_out(p->conn, pull, r, call->struct_size,
1464 call->ndr_push, call->ndr_pull,
1465 call->ndr_print);
1466 if (!NT_STATUS_IS_OK(status)) {
1467 dcerpc_log_packet(p->conn->packet_log_dir,
1468 table, opnum, NDR_OUT,
1469 &response);
1470 return status;
1471 }
1472 }
1473
1474 if (pull->offset != pull->data_size) {
1475 DEBUG(0,("Warning! ignoring %d unread bytes in rpc packet!\n",
1476 pull->data_size - pull->offset));
1477 /* we used to return NT_STATUS_INFO_LENGTH_MISMATCH here,
1478 but it turns out that early versions of NT
1479 (specifically NT3.1) add junk onto the end of rpc
1480 packets, so if we want to interoperate at all with
1481 those versions then we need to ignore this error */
1482 }
1483
1484 /* TODO: make pull context independent from the output mem_ctx and free the pull context */
1485
1486 return NT_STATUS_OK;
1487 }
1488
1489
1490 /*
1491 a useful helper function for synchronous rpc requests
1492
1493 this can be used when you have ndr push/pull functions in the
1494 standard format
1495 */
1496 _PUBLIC_ NTSTATUS dcerpc_ndr_request(struct dcerpc_pipe *p,
1497 const struct GUID *object,
1498 const struct ndr_interface_table *table,
1499 uint32_t opnum,
1500 TALLOC_CTX *mem_ctx,
1501 void *r)
1502 {
1503 struct rpc_request *req;
1504
1505 req = dcerpc_ndr_request_send(p, object, table, opnum, false, mem_ctx, r);
1506 if (req == NULL) {
1507 return NT_STATUS_NO_MEMORY;
1508 }
1509
1510 return dcerpc_ndr_request_recv(req);
1511 }
1512
1513
1514 /*
1515 a useful function for retrieving the server name we connected to
1516 */
1517 _PUBLIC_ const char *dcerpc_server_name(struct dcerpc_pipe *p)
1518 {
1519 if (!p->conn->transport.target_hostname) {
1520 if (!p->conn->transport.peer_name) {
1521 return "";
1522 }
1523 return p->conn->transport.peer_name(p->conn);
1524 }
1525 return p->conn->transport.target_hostname(p->conn);
1526 }
1527
1528
1529 /*
1530 get the dcerpc auth_level for a open connection
1531 */
1532 uint32_t dcerpc_auth_level(struct dcerpc_connection *c)
1533 {
1534 uint8_t auth_level;
1535
1536 if (c->flags & DCERPC_SEAL) {
1537 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1538 } else if (c->flags & DCERPC_SIGN) {
1539 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1540 } else if (c->flags & DCERPC_CONNECT) {
1541 auth_level = DCERPC_AUTH_LEVEL_CONNECT;
1542 } else {
1543 auth_level = DCERPC_AUTH_LEVEL_NONE;
1544 }
1545 return auth_level;
1546 }
1547
1548 /*
1549 Receive an alter reply from the transport
1550 */
1551 static void dcerpc_alter_recv_handler(struct rpc_request *req,
1552 DATA_BLOB *raw_packet, struct ncacn_packet *pkt)
1553 {
1554 struct composite_context *c;
1555 struct dcerpc_pipe *recv_pipe;
1556
1557 c = talloc_get_type(req->async.private_data, struct composite_context);
1558 recv_pipe = talloc_get_type(c->private_data, struct dcerpc_pipe);
1559
1560 if (pkt->ptype == DCERPC_PKT_ALTER_RESP &&
1561 pkt->u.alter_resp.num_results == 1 &&
1562 pkt->u.alter_resp.ctx_list[0].result != 0) {
1563 DEBUG(2,("dcerpc: alter_resp failed - reason %d\n",
1564 pkt->u.alter_resp.ctx_list[0].reason));
1565 composite_error(c, dcerpc_map_reason(pkt->u.alter_resp.ctx_list[0].reason));
1566 return;
1567 }
1568
1569 if (pkt->ptype == DCERPC_PKT_FAULT) {
1570 DEBUG(5,("rpc fault: %s\n", dcerpc_errstr(c, pkt->u.fault.status)));
1571 recv_pipe->last_fault_code = pkt->u.fault.status;
1572 composite_error(c, NT_STATUS_NET_WRITE_FAULT);
1573 return;
1574 }
1575
1576 if (pkt->ptype != DCERPC_PKT_ALTER_RESP ||
1577 pkt->u.alter_resp.num_results == 0 ||
1578 pkt->u.alter_resp.ctx_list[0].result != 0) {
1579 recv_pipe->last_fault_code = DCERPC_NCA_S_PROTO_ERROR;
1580 composite_error(c, NT_STATUS_NET_WRITE_FAULT);
1581 return;
1582 }
1583
1584 /* the alter_resp might contain a reply set of credentials */
1585 if (recv_pipe->conn->security_state.auth_info &&
1586 pkt->u.alter_resp.auth_info.length) {
1587 struct dcerpc_connection *conn = recv_pipe->conn;
1588 NTSTATUS status;
1589 uint32_t auth_length;
1590 status = dcerpc_pull_auth_trailer(pkt, conn, &pkt->u.alter_resp.auth_info,
1591 conn->security_state.auth_info, &auth_length, true);
1592 if (!NT_STATUS_IS_OK(status)) {
1593 composite_error(c, status);
1594 return;
1595 }
1596 }
1597
1598 composite_done(c);
1599 }
1600
1601 /*
1602 send a dcerpc alter_context request
1603 */
1604 struct composite_context *dcerpc_alter_context_send(struct dcerpc_pipe *p,
1605 TALLOC_CTX *mem_ctx,
1606 const struct ndr_syntax_id *syntax,
1607 const struct ndr_syntax_id *transfer_syntax)
1608 {
1609 struct composite_context *c;
1610 struct ncacn_packet pkt;
1611 DATA_BLOB blob;
1612 struct rpc_request *req;
1613
1614 c = composite_create(mem_ctx, p->conn->event_ctx);
1615 if (c == NULL) return NULL;
1616
1617 c->private_data = p;
1618
1619 p->syntax = *syntax;
1620 p->transfer_syntax = *transfer_syntax;
1621
1622 init_ncacn_hdr(p->conn, &pkt);
1623
1624 pkt.ptype = DCERPC_PKT_ALTER;
1625 pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
1626 pkt.call_id = p->conn->call_id;
1627 pkt.auth_length = 0;
1628
1629 if (p->binding->flags & DCERPC_CONCURRENT_MULTIPLEX) {
1630 pkt.pfc_flags |= DCERPC_PFC_FLAG_CONC_MPX;
1631 }
1632
1633 if (p->binding->flags & DCERPC_HEADER_SIGNING) {
1634 pkt.pfc_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
1635 }
1636
1637 pkt.u.alter.max_xmit_frag = 5840;
1638 pkt.u.alter.max_recv_frag = 5840;
1639 pkt.u.alter.assoc_group_id = p->binding->assoc_group_id;
1640 pkt.u.alter.num_contexts = 1;
1641 pkt.u.alter.ctx_list = talloc_array(c, struct dcerpc_ctx_list, 1);
1642 if (composite_nomem(pkt.u.alter.ctx_list, c)) return c;
1643 pkt.u.alter.ctx_list[0].context_id = p->context_id;
1644 pkt.u.alter.ctx_list[0].num_transfer_syntaxes = 1;
1645 pkt.u.alter.ctx_list[0].abstract_syntax = p->syntax;
1646 pkt.u.alter.ctx_list[0].transfer_syntaxes = &p->transfer_syntax;
1647 pkt.u.alter.auth_info = data_blob(NULL, 0);
1648
1649 /* construct the NDR form of the packet */
1650 c->status = ncacn_push_auth(&blob, mem_ctx, &pkt,
1651 p->conn->security_state.auth_info);
1652 if (!composite_is_ok(c)) return c;
1653
1654 p->conn->transport.recv_data = dcerpc_recv_data;
1655
1656 /*
1657 * we allocate a dcerpc_request so we can be in the same
1658 * request queue as normal requests
1659 */
1660 req = talloc_zero(c, struct rpc_request);
1661 if (composite_nomem(req, c)) return c;
1662
1663 req->state = RPC_REQUEST_PENDING;
1664 req->call_id = pkt.call_id;
1665 req->async.private_data = c;
1666 req->async.callback = dcerpc_composite_fail;
1667 req->p = p;
1668 req->recv_handler = dcerpc_alter_recv_handler;
1669 DLIST_ADD_END(p->conn->pending, req, struct rpc_request *);
1670 talloc_set_destructor(req, dcerpc_req_dequeue);
1671
1672 c->status = p->conn->transport.send_request(p->conn, &blob, true);
1673 if (!composite_is_ok(c)) return c;
1674
1675 event_add_timed(c->event_ctx, req,
1676 timeval_current_ofs(DCERPC_REQUEST_TIMEOUT, 0),
1677 dcerpc_timeout_handler, req);
1678
1679 return c;
1680 }
1681
1682 NTSTATUS dcerpc_alter_context_recv(struct composite_context *ctx)
1683 {
1684 NTSTATUS result = composite_wait(ctx);
1685 talloc_free(ctx);
1686 return result;
1687 }
1688
1689 /*
1690 send a dcerpc alter_context request
1691 */
1692 _PUBLIC_ NTSTATUS dcerpc_alter_context(struct dcerpc_pipe *p,
1693 TALLOC_CTX *mem_ctx,
1694 const struct ndr_syntax_id *syntax,
1695 const struct ndr_syntax_id *transfer_syntax)
1696 {
1697 struct composite_context *creq;
1698 creq = dcerpc_alter_context_send(p, mem_ctx, syntax, transfer_syntax);
1699 return dcerpc_alter_context_recv(creq);
1700 }
1701
reg import