tevent: call epoll_panic() if EPOLL_CTL_DEL failed
[Samba/gebeck_regimport.git] / source3 / rpc_client / cli_pipe.c
blob2e978efb8d9ff2d676097f3925358fcc994d3c78
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client routines
4 * Largely rewritten by Jeremy Allison 2005.
5 * Heavily modified by Simo Sorce 2010.
6 * Copyright Andrew Bartlett 2011.
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 #include "includes.h"
23 #include "../lib/util/tevent_ntstatus.h"
24 #include "librpc/gen_ndr/ndr_epmapper_c.h"
25 #include "../librpc/gen_ndr/ndr_schannel.h"
26 #include "../librpc/gen_ndr/ndr_dssetup.h"
27 #include "../libcli/auth/schannel.h"
28 #include "../libcli/auth/spnego.h"
29 #include "../auth/ntlmssp/ntlmssp.h"
30 #include "auth_generic.h"
31 #include "librpc/gen_ndr/ndr_dcerpc.h"
32 #include "librpc/gen_ndr/ndr_netlogon_c.h"
33 #include "librpc/rpc/dcerpc.h"
34 #include "rpc_dce.h"
35 #include "cli_pipe.h"
36 #include "libsmb/libsmb.h"
37 #include "auth/gensec/gensec.h"
38 #include "auth/credentials/credentials.h"
39 #include "../libcli/smb/smbXcli_base.h"
41 #undef DBGC_CLASS
42 #define DBGC_CLASS DBGC_RPC_CLI
44 /********************************************************************
45 Pipe description for a DEBUG
46 ********************************************************************/
47 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
48 struct rpc_pipe_client *cli)
50 char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
51 if (result == NULL) {
52 return "pipe";
54 return result;
57 /********************************************************************
58 Rpc pipe call id.
59 ********************************************************************/
61 static uint32 get_rpc_call_id(void)
63 static uint32 call_id = 0;
64 return ++call_id;
67 /*******************************************************************
68 Use SMBreadX to get rest of one fragment's worth of rpc data.
69 Reads the whole size or give an error message
70 ********************************************************************/
72 struct rpc_read_state {
73 struct tevent_context *ev;
74 struct rpc_cli_transport *transport;
75 uint8_t *data;
76 size_t size;
77 size_t num_read;
80 static void rpc_read_done(struct tevent_req *subreq);
82 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
83 struct tevent_context *ev,
84 struct rpc_cli_transport *transport,
85 uint8_t *data, size_t size)
87 struct tevent_req *req, *subreq;
88 struct rpc_read_state *state;
90 req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
91 if (req == NULL) {
92 return NULL;
94 state->ev = ev;
95 state->transport = transport;
96 state->data = data;
97 state->size = size;
98 state->num_read = 0;
100 DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
102 subreq = transport->read_send(state, ev, (uint8_t *)data, size,
103 transport->priv);
104 if (subreq == NULL) {
105 goto fail;
107 tevent_req_set_callback(subreq, rpc_read_done, req);
108 return req;
110 fail:
111 TALLOC_FREE(req);
112 return NULL;
115 static void rpc_read_done(struct tevent_req *subreq)
117 struct tevent_req *req = tevent_req_callback_data(
118 subreq, struct tevent_req);
119 struct rpc_read_state *state = tevent_req_data(
120 req, struct rpc_read_state);
121 NTSTATUS status;
122 ssize_t received;
124 status = state->transport->read_recv(subreq, &received);
125 TALLOC_FREE(subreq);
126 if (!NT_STATUS_IS_OK(status)) {
127 tevent_req_nterror(req, status);
128 return;
131 state->num_read += received;
132 if (state->num_read == state->size) {
133 tevent_req_done(req);
134 return;
137 subreq = state->transport->read_send(state, state->ev,
138 state->data + state->num_read,
139 state->size - state->num_read,
140 state->transport->priv);
141 if (tevent_req_nomem(subreq, req)) {
142 return;
144 tevent_req_set_callback(subreq, rpc_read_done, req);
147 static NTSTATUS rpc_read_recv(struct tevent_req *req)
149 return tevent_req_simple_recv_ntstatus(req);
152 struct rpc_write_state {
153 struct tevent_context *ev;
154 struct rpc_cli_transport *transport;
155 const uint8_t *data;
156 size_t size;
157 size_t num_written;
160 static void rpc_write_done(struct tevent_req *subreq);
162 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
163 struct tevent_context *ev,
164 struct rpc_cli_transport *transport,
165 const uint8_t *data, size_t size)
167 struct tevent_req *req, *subreq;
168 struct rpc_write_state *state;
170 req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
171 if (req == NULL) {
172 return NULL;
174 state->ev = ev;
175 state->transport = transport;
176 state->data = data;
177 state->size = size;
178 state->num_written = 0;
180 DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
182 subreq = transport->write_send(state, ev, data, size, transport->priv);
183 if (subreq == NULL) {
184 goto fail;
186 tevent_req_set_callback(subreq, rpc_write_done, req);
187 return req;
188 fail:
189 TALLOC_FREE(req);
190 return NULL;
193 static void rpc_write_done(struct tevent_req *subreq)
195 struct tevent_req *req = tevent_req_callback_data(
196 subreq, struct tevent_req);
197 struct rpc_write_state *state = tevent_req_data(
198 req, struct rpc_write_state);
199 NTSTATUS status;
200 ssize_t written;
202 status = state->transport->write_recv(subreq, &written);
203 TALLOC_FREE(subreq);
204 if (!NT_STATUS_IS_OK(status)) {
205 tevent_req_nterror(req, status);
206 return;
209 state->num_written += written;
211 if (state->num_written == state->size) {
212 tevent_req_done(req);
213 return;
216 subreq = state->transport->write_send(state, state->ev,
217 state->data + state->num_written,
218 state->size - state->num_written,
219 state->transport->priv);
220 if (tevent_req_nomem(subreq, req)) {
221 return;
223 tevent_req_set_callback(subreq, rpc_write_done, req);
226 static NTSTATUS rpc_write_recv(struct tevent_req *req)
228 return tevent_req_simple_recv_ntstatus(req);
232 /****************************************************************************
233 Try and get a PDU's worth of data from current_pdu. If not, then read more
234 from the wire.
235 ****************************************************************************/
237 struct get_complete_frag_state {
238 struct tevent_context *ev;
239 struct rpc_pipe_client *cli;
240 uint16_t frag_len;
241 DATA_BLOB *pdu;
244 static void get_complete_frag_got_header(struct tevent_req *subreq);
245 static void get_complete_frag_got_rest(struct tevent_req *subreq);
247 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
248 struct tevent_context *ev,
249 struct rpc_pipe_client *cli,
250 DATA_BLOB *pdu)
252 struct tevent_req *req, *subreq;
253 struct get_complete_frag_state *state;
254 size_t received;
255 NTSTATUS status;
257 req = tevent_req_create(mem_ctx, &state,
258 struct get_complete_frag_state);
259 if (req == NULL) {
260 return NULL;
262 state->ev = ev;
263 state->cli = cli;
264 state->frag_len = RPC_HEADER_LEN;
265 state->pdu = pdu;
267 received = pdu->length;
268 if (received < RPC_HEADER_LEN) {
269 if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
270 status = NT_STATUS_NO_MEMORY;
271 goto post_status;
273 subreq = rpc_read_send(state, state->ev,
274 state->cli->transport,
275 pdu->data + received,
276 RPC_HEADER_LEN - received);
277 if (subreq == NULL) {
278 status = NT_STATUS_NO_MEMORY;
279 goto post_status;
281 tevent_req_set_callback(subreq, get_complete_frag_got_header,
282 req);
283 return req;
286 state->frag_len = dcerpc_get_frag_length(pdu);
289 * Ensure we have frag_len bytes of data.
291 if (received < state->frag_len) {
292 if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
293 status = NT_STATUS_NO_MEMORY;
294 goto post_status;
296 subreq = rpc_read_send(state, state->ev,
297 state->cli->transport,
298 pdu->data + received,
299 state->frag_len - received);
300 if (subreq == NULL) {
301 status = NT_STATUS_NO_MEMORY;
302 goto post_status;
304 tevent_req_set_callback(subreq, get_complete_frag_got_rest,
305 req);
306 return req;
309 status = NT_STATUS_OK;
310 post_status:
311 if (NT_STATUS_IS_OK(status)) {
312 tevent_req_done(req);
313 } else {
314 tevent_req_nterror(req, status);
316 return tevent_req_post(req, ev);
319 static void get_complete_frag_got_header(struct tevent_req *subreq)
321 struct tevent_req *req = tevent_req_callback_data(
322 subreq, struct tevent_req);
323 struct get_complete_frag_state *state = tevent_req_data(
324 req, struct get_complete_frag_state);
325 NTSTATUS status;
327 status = rpc_read_recv(subreq);
328 TALLOC_FREE(subreq);
329 if (!NT_STATUS_IS_OK(status)) {
330 tevent_req_nterror(req, status);
331 return;
334 state->frag_len = dcerpc_get_frag_length(state->pdu);
336 if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
337 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
338 return;
342 * We're here in this piece of code because we've read exactly
343 * RPC_HEADER_LEN bytes into state->pdu.
346 subreq = rpc_read_send(state, state->ev, state->cli->transport,
347 state->pdu->data + RPC_HEADER_LEN,
348 state->frag_len - RPC_HEADER_LEN);
349 if (tevent_req_nomem(subreq, req)) {
350 return;
352 tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
355 static void get_complete_frag_got_rest(struct tevent_req *subreq)
357 struct tevent_req *req = tevent_req_callback_data(
358 subreq, struct tevent_req);
359 NTSTATUS status;
361 status = rpc_read_recv(subreq);
362 TALLOC_FREE(subreq);
363 if (!NT_STATUS_IS_OK(status)) {
364 tevent_req_nterror(req, status);
365 return;
367 tevent_req_done(req);
370 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
372 return tevent_req_simple_recv_ntstatus(req);
375 /****************************************************************************
376 Do basic authentication checks on an incoming pdu.
377 ****************************************************************************/
379 static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
380 struct rpc_pipe_client *cli,
381 struct ncacn_packet *pkt,
382 DATA_BLOB *pdu,
383 uint8_t expected_pkt_type,
384 DATA_BLOB *rdata,
385 DATA_BLOB *reply_pdu)
387 struct dcerpc_response *r;
388 NTSTATUS ret = NT_STATUS_OK;
389 size_t pad_len = 0;
392 * Point the return values at the real data including the RPC
393 * header. Just in case the caller wants it.
395 *rdata = *pdu;
397 /* Ensure we have the correct type. */
398 switch (pkt->ptype) {
399 case DCERPC_PKT_ALTER_RESP:
400 case DCERPC_PKT_BIND_ACK:
402 /* Client code never receives this kind of packets */
403 break;
406 case DCERPC_PKT_RESPONSE:
408 r = &pkt->u.response;
410 /* Here's where we deal with incoming sign/seal. */
411 ret = dcerpc_check_auth(cli->auth, pkt,
412 &r->stub_and_verifier,
413 DCERPC_RESPONSE_LENGTH,
414 pdu, &pad_len);
415 if (!NT_STATUS_IS_OK(ret)) {
416 return ret;
419 if (pkt->frag_length < DCERPC_RESPONSE_LENGTH + pad_len) {
420 return NT_STATUS_BUFFER_TOO_SMALL;
423 /* Point the return values at the NDR data. */
424 rdata->data = r->stub_and_verifier.data;
426 if (pkt->auth_length) {
427 /* We've already done integer wrap tests in
428 * dcerpc_check_auth(). */
429 rdata->length = r->stub_and_verifier.length
430 - pad_len
431 - DCERPC_AUTH_TRAILER_LENGTH
432 - pkt->auth_length;
433 } else {
434 rdata->length = r->stub_and_verifier.length;
437 DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
438 (long unsigned int)pdu->length,
439 (long unsigned int)rdata->length,
440 (unsigned int)pad_len));
443 * If this is the first reply, and the allocation hint is
444 * reasonable, try and set up the reply_pdu DATA_BLOB to the
445 * correct size.
448 if ((reply_pdu->length == 0) &&
449 r->alloc_hint && (r->alloc_hint < 15*1024*1024)) {
450 if (!data_blob_realloc(mem_ctx, reply_pdu,
451 r->alloc_hint)) {
452 DEBUG(0, ("reply alloc hint %d too "
453 "large to allocate\n",
454 (int)r->alloc_hint));
455 return NT_STATUS_NO_MEMORY;
459 break;
461 case DCERPC_PKT_BIND_NAK:
462 DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
463 rpccli_pipe_txt(talloc_tos(), cli)));
464 /* Use this for now... */
465 return NT_STATUS_NETWORK_ACCESS_DENIED;
467 case DCERPC_PKT_FAULT:
469 DEBUG(1, (__location__ ": RPC fault code %s received "
470 "from %s!\n",
471 dcerpc_errstr(talloc_tos(),
472 pkt->u.fault.status),
473 rpccli_pipe_txt(talloc_tos(), cli)));
475 return dcerpc_fault_to_nt_status(pkt->u.fault.status);
477 default:
478 DEBUG(0, (__location__ "Unknown packet type %u received "
479 "from %s!\n",
480 (unsigned int)pkt->ptype,
481 rpccli_pipe_txt(talloc_tos(), cli)));
482 return NT_STATUS_INVALID_INFO_CLASS;
485 if (pkt->ptype != expected_pkt_type) {
486 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
487 "RPC packet type - %u, not %u\n",
488 rpccli_pipe_txt(talloc_tos(), cli),
489 pkt->ptype, expected_pkt_type));
490 return NT_STATUS_INVALID_INFO_CLASS;
493 /* Do this just before return - we don't want to modify any rpc header
494 data before now as we may have needed to do cryptographic actions on
495 it before. */
497 if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
498 !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
499 DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
500 "fragment first/last ON.\n"));
501 pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
504 return NT_STATUS_OK;
507 /****************************************************************************
508 Call a remote api on an arbitrary pipe. takes param, data and setup buffers.
509 ****************************************************************************/
511 struct cli_api_pipe_state {
512 struct tevent_context *ev;
513 struct rpc_cli_transport *transport;
514 uint8_t *rdata;
515 uint32_t rdata_len;
518 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
519 static void cli_api_pipe_write_done(struct tevent_req *subreq);
520 static void cli_api_pipe_read_done(struct tevent_req *subreq);
522 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
523 struct tevent_context *ev,
524 struct rpc_cli_transport *transport,
525 uint8_t *data, size_t data_len,
526 uint32_t max_rdata_len)
528 struct tevent_req *req, *subreq;
529 struct cli_api_pipe_state *state;
530 NTSTATUS status;
532 req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
533 if (req == NULL) {
534 return NULL;
536 state->ev = ev;
537 state->transport = transport;
539 if (max_rdata_len < RPC_HEADER_LEN) {
541 * For a RPC reply we always need at least RPC_HEADER_LEN
542 * bytes. We check this here because we will receive
543 * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
545 status = NT_STATUS_INVALID_PARAMETER;
546 goto post_status;
549 if (transport->trans_send != NULL) {
550 subreq = transport->trans_send(state, ev, data, data_len,
551 max_rdata_len, transport->priv);
552 if (subreq == NULL) {
553 goto fail;
555 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
556 return req;
560 * If the transport does not provide a "trans" routine, i.e. for
561 * example the ncacn_ip_tcp transport, do the write/read step here.
564 subreq = rpc_write_send(state, ev, transport, data, data_len);
565 if (subreq == NULL) {
566 goto fail;
568 tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
569 return req;
571 post_status:
572 tevent_req_nterror(req, status);
573 return tevent_req_post(req, ev);
574 fail:
575 TALLOC_FREE(req);
576 return NULL;
579 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
581 struct tevent_req *req = tevent_req_callback_data(
582 subreq, struct tevent_req);
583 struct cli_api_pipe_state *state = tevent_req_data(
584 req, struct cli_api_pipe_state);
585 NTSTATUS status;
587 status = state->transport->trans_recv(subreq, state, &state->rdata,
588 &state->rdata_len);
589 TALLOC_FREE(subreq);
590 if (!NT_STATUS_IS_OK(status)) {
591 tevent_req_nterror(req, status);
592 return;
594 tevent_req_done(req);
597 static void cli_api_pipe_write_done(struct tevent_req *subreq)
599 struct tevent_req *req = tevent_req_callback_data(
600 subreq, struct tevent_req);
601 struct cli_api_pipe_state *state = tevent_req_data(
602 req, struct cli_api_pipe_state);
603 NTSTATUS status;
605 status = rpc_write_recv(subreq);
606 TALLOC_FREE(subreq);
607 if (!NT_STATUS_IS_OK(status)) {
608 tevent_req_nterror(req, status);
609 return;
612 state->rdata = talloc_array(state, uint8_t, RPC_HEADER_LEN);
613 if (tevent_req_nomem(state->rdata, req)) {
614 return;
618 * We don't need to use rpc_read_send here, the upper layer will cope
619 * with a short read, transport->trans_send could also return less
620 * than state->max_rdata_len.
622 subreq = state->transport->read_send(state, state->ev, state->rdata,
623 RPC_HEADER_LEN,
624 state->transport->priv);
625 if (tevent_req_nomem(subreq, req)) {
626 return;
628 tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
631 static void cli_api_pipe_read_done(struct tevent_req *subreq)
633 struct tevent_req *req = tevent_req_callback_data(
634 subreq, struct tevent_req);
635 struct cli_api_pipe_state *state = tevent_req_data(
636 req, struct cli_api_pipe_state);
637 NTSTATUS status;
638 ssize_t received;
640 status = state->transport->read_recv(subreq, &received);
641 TALLOC_FREE(subreq);
642 if (!NT_STATUS_IS_OK(status)) {
643 tevent_req_nterror(req, status);
644 return;
646 state->rdata_len = received;
647 tevent_req_done(req);
650 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
651 uint8_t **prdata, uint32_t *prdata_len)
653 struct cli_api_pipe_state *state = tevent_req_data(
654 req, struct cli_api_pipe_state);
655 NTSTATUS status;
657 if (tevent_req_is_nterror(req, &status)) {
658 return status;
661 *prdata = talloc_move(mem_ctx, &state->rdata);
662 *prdata_len = state->rdata_len;
663 return NT_STATUS_OK;
666 /****************************************************************************
667 Send data on an rpc pipe via trans. The data must be the last
668 pdu fragment of an NDR data stream.
670 Receive response data from an rpc pipe, which may be large...
672 Read the first fragment: unfortunately have to use SMBtrans for the first
673 bit, then SMBreadX for subsequent bits.
675 If first fragment received also wasn't the last fragment, continue
676 getting fragments until we _do_ receive the last fragment.
678 Request/Response PDU's look like the following...
680 |<------------------PDU len----------------------------------------------->|
681 |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
683 +------------+-----------------+-------------+---------------+-------------+
684 | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR | AUTH DATA |
685 +------------+-----------------+-------------+---------------+-------------+
687 Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
688 signing & sealing being negotiated.
690 ****************************************************************************/
692 struct rpc_api_pipe_state {
693 struct tevent_context *ev;
694 struct rpc_pipe_client *cli;
695 uint8_t expected_pkt_type;
697 DATA_BLOB incoming_frag;
698 struct ncacn_packet *pkt;
700 /* Incoming reply */
701 DATA_BLOB reply_pdu;
702 size_t reply_pdu_offset;
703 uint8_t endianess;
706 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
707 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
708 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq);
710 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
711 struct tevent_context *ev,
712 struct rpc_pipe_client *cli,
713 DATA_BLOB *data, /* Outgoing PDU */
714 uint8_t expected_pkt_type)
716 struct tevent_req *req, *subreq;
717 struct rpc_api_pipe_state *state;
718 uint16_t max_recv_frag;
719 NTSTATUS status;
721 req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
722 if (req == NULL) {
723 return NULL;
725 state->ev = ev;
726 state->cli = cli;
727 state->expected_pkt_type = expected_pkt_type;
728 state->incoming_frag = data_blob_null;
729 state->reply_pdu = data_blob_null;
730 state->reply_pdu_offset = 0;
731 state->endianess = DCERPC_DREP_LE;
734 * Ensure we're not sending too much.
736 if (data->length > cli->max_xmit_frag) {
737 status = NT_STATUS_INVALID_PARAMETER;
738 goto post_status;
741 DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
743 if (state->expected_pkt_type == DCERPC_PKT_AUTH3) {
744 subreq = rpc_write_send(state, ev, cli->transport,
745 data->data, data->length);
746 if (subreq == NULL) {
747 goto fail;
749 tevent_req_set_callback(subreq, rpc_api_pipe_auth3_done, req);
750 return req;
753 /* get the header first, then fetch the rest once we have
754 * the frag_length available */
755 max_recv_frag = RPC_HEADER_LEN;
757 subreq = cli_api_pipe_send(state, ev, cli->transport,
758 data->data, data->length, max_recv_frag);
759 if (subreq == NULL) {
760 goto fail;
762 tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
763 return req;
765 post_status:
766 tevent_req_nterror(req, status);
767 return tevent_req_post(req, ev);
768 fail:
769 TALLOC_FREE(req);
770 return NULL;
773 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq)
775 struct tevent_req *req =
776 tevent_req_callback_data(subreq,
777 struct tevent_req);
778 NTSTATUS status;
780 status = rpc_write_recv(subreq);
781 TALLOC_FREE(subreq);
782 if (!NT_STATUS_IS_OK(status)) {
783 tevent_req_nterror(req, status);
784 return;
787 tevent_req_done(req);
790 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
792 struct tevent_req *req = tevent_req_callback_data(
793 subreq, struct tevent_req);
794 struct rpc_api_pipe_state *state = tevent_req_data(
795 req, struct rpc_api_pipe_state);
796 NTSTATUS status;
797 uint8_t *rdata = NULL;
798 uint32_t rdata_len = 0;
800 status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
801 TALLOC_FREE(subreq);
802 if (!NT_STATUS_IS_OK(status)) {
803 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
804 tevent_req_nterror(req, status);
805 return;
808 if (rdata == NULL) {
809 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
810 rpccli_pipe_txt(talloc_tos(), state->cli)));
811 tevent_req_done(req);
812 return;
816 * Move data on state->incoming_frag.
818 state->incoming_frag.data = talloc_move(state, &rdata);
819 state->incoming_frag.length = rdata_len;
820 if (!state->incoming_frag.data) {
821 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
822 return;
825 /* Ensure we have enough data for a pdu. */
826 subreq = get_complete_frag_send(state, state->ev, state->cli,
827 &state->incoming_frag);
828 if (tevent_req_nomem(subreq, req)) {
829 return;
831 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
834 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
836 struct tevent_req *req = tevent_req_callback_data(
837 subreq, struct tevent_req);
838 struct rpc_api_pipe_state *state = tevent_req_data(
839 req, struct rpc_api_pipe_state);
840 NTSTATUS status;
841 DATA_BLOB rdata = data_blob_null;
843 status = get_complete_frag_recv(subreq);
844 TALLOC_FREE(subreq);
845 if (!NT_STATUS_IS_OK(status)) {
846 DEBUG(5, ("get_complete_frag failed: %s\n",
847 nt_errstr(status)));
848 tevent_req_nterror(req, status);
849 return;
852 state->pkt = talloc(state, struct ncacn_packet);
853 if (!state->pkt) {
854 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
855 return;
858 status = dcerpc_pull_ncacn_packet(state->pkt,
859 &state->incoming_frag,
860 state->pkt,
861 !state->endianess);
862 if (!NT_STATUS_IS_OK(status)) {
863 tevent_req_nterror(req, status);
864 return;
867 if (state->incoming_frag.length != state->pkt->frag_length) {
868 DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
869 (unsigned int)state->incoming_frag.length,
870 (unsigned int)state->pkt->frag_length));
871 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
872 return;
875 status = cli_pipe_validate_current_pdu(state,
876 state->cli, state->pkt,
877 &state->incoming_frag,
878 state->expected_pkt_type,
879 &rdata,
880 &state->reply_pdu);
882 DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
883 (unsigned)state->incoming_frag.length,
884 (unsigned)state->reply_pdu_offset,
885 nt_errstr(status)));
887 if (!NT_STATUS_IS_OK(status)) {
888 tevent_req_nterror(req, status);
889 return;
892 if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
893 && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
895 * Set the data type correctly for big-endian data on the
896 * first packet.
898 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
899 "big-endian.\n",
900 rpccli_pipe_txt(talloc_tos(), state->cli)));
901 state->endianess = 0x00; /* BIG ENDIAN */
904 * Check endianness on subsequent packets.
906 if (state->endianess != state->pkt->drep[0]) {
907 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
908 "%s\n",
909 state->endianess?"little":"big",
910 state->pkt->drep[0]?"little":"big"));
911 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
912 return;
915 /* Now copy the data portion out of the pdu into rbuf. */
916 if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
917 if (!data_blob_realloc(NULL, &state->reply_pdu,
918 state->reply_pdu_offset + rdata.length)) {
919 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
920 return;
924 memcpy(state->reply_pdu.data + state->reply_pdu_offset,
925 rdata.data, rdata.length);
926 state->reply_pdu_offset += rdata.length;
928 /* reset state->incoming_frag, there is no need to free it,
929 * it will be reallocated to the right size the next time
930 * it is used */
931 state->incoming_frag.length = 0;
933 if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
934 /* make sure the pdu length is right now that we
935 * have all the data available (alloc hint may
936 * have allocated more than was actually used) */
937 state->reply_pdu.length = state->reply_pdu_offset;
938 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
939 rpccli_pipe_txt(talloc_tos(), state->cli),
940 (unsigned)state->reply_pdu.length));
941 tevent_req_done(req);
942 return;
945 subreq = get_complete_frag_send(state, state->ev, state->cli,
946 &state->incoming_frag);
947 if (tevent_req_nomem(subreq, req)) {
948 return;
950 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
953 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
954 struct ncacn_packet **pkt,
955 DATA_BLOB *reply_pdu)
957 struct rpc_api_pipe_state *state = tevent_req_data(
958 req, struct rpc_api_pipe_state);
959 NTSTATUS status;
961 if (tevent_req_is_nterror(req, &status)) {
962 return status;
965 /* return data to caller and assign it ownership of memory */
966 if (reply_pdu) {
967 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
968 reply_pdu->length = state->reply_pdu.length;
969 state->reply_pdu.length = 0;
970 } else {
971 data_blob_free(&state->reply_pdu);
974 if (pkt) {
975 *pkt = talloc_steal(mem_ctx, state->pkt);
978 return NT_STATUS_OK;
981 /*******************************************************************
982 Creates NTLMSSP auth bind.
983 ********************************************************************/
985 static NTSTATUS create_generic_auth_rpc_bind_req(struct rpc_pipe_client *cli,
986 TALLOC_CTX *mem_ctx,
987 DATA_BLOB *auth_token)
989 struct gensec_security *gensec_security;
990 DATA_BLOB null_blob = data_blob_null;
992 gensec_security = talloc_get_type_abort(cli->auth->auth_ctx,
993 struct gensec_security);
995 DEBUG(5, ("create_generic_auth_rpc_bind_req: generate first token\n"));
996 return gensec_update(gensec_security, mem_ctx, NULL, null_blob, auth_token);
999 /*******************************************************************
1000 Creates schannel auth bind.
1001 ********************************************************************/
1003 static NTSTATUS create_schannel_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1004 DATA_BLOB *auth_token)
1006 NTSTATUS status;
1007 struct NL_AUTH_MESSAGE r;
1009 /* Use lp_workgroup() if domain not specified */
1011 if (!cli->auth->domain || !cli->auth->domain[0]) {
1012 cli->auth->domain = talloc_strdup(cli, lp_workgroup());
1013 if (cli->auth->domain == NULL) {
1014 return NT_STATUS_NO_MEMORY;
1019 * Now marshall the data into the auth parse_struct.
1022 r.MessageType = NL_NEGOTIATE_REQUEST;
1023 r.Flags = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
1024 NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
1025 r.oem_netbios_domain.a = cli->auth->domain;
1026 r.oem_netbios_computer.a = lp_netbios_name();
1028 status = dcerpc_push_schannel_bind(cli, &r, auth_token);
1029 if (!NT_STATUS_IS_OK(status)) {
1030 return status;
1033 return NT_STATUS_OK;
1036 /*******************************************************************
1037 Creates the internals of a DCE/RPC bind request or alter context PDU.
1038 ********************************************************************/
1040 static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
1041 enum dcerpc_pkt_type ptype,
1042 uint32 rpc_call_id,
1043 const struct ndr_syntax_id *abstract,
1044 const struct ndr_syntax_id *transfer,
1045 const DATA_BLOB *auth_info,
1046 DATA_BLOB *blob)
1048 uint16 auth_len = auth_info->length;
1049 NTSTATUS status;
1050 union dcerpc_payload u;
1051 struct dcerpc_ctx_list ctx_list;
1053 if (auth_len) {
1054 auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
1057 ctx_list.context_id = 0;
1058 ctx_list.num_transfer_syntaxes = 1;
1059 ctx_list.abstract_syntax = *abstract;
1060 ctx_list.transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer);
1062 u.bind.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1063 u.bind.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1064 u.bind.assoc_group_id = 0x0;
1065 u.bind.num_contexts = 1;
1066 u.bind.ctx_list = &ctx_list;
1067 u.bind.auth_info = *auth_info;
1069 status = dcerpc_push_ncacn_packet(mem_ctx,
1070 ptype,
1071 DCERPC_PFC_FLAG_FIRST |
1072 DCERPC_PFC_FLAG_LAST,
1073 auth_len,
1074 rpc_call_id,
1076 blob);
1077 if (!NT_STATUS_IS_OK(status)) {
1078 DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
1079 return status;
1082 return NT_STATUS_OK;
1085 /*******************************************************************
1086 Creates a DCE/RPC bind request.
1087 ********************************************************************/
1089 static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
1090 struct rpc_pipe_client *cli,
1091 struct pipe_auth_data *auth,
1092 uint32 rpc_call_id,
1093 const struct ndr_syntax_id *abstract,
1094 const struct ndr_syntax_id *transfer,
1095 DATA_BLOB *rpc_out)
1097 DATA_BLOB auth_token = data_blob_null;
1098 DATA_BLOB auth_info = data_blob_null;
1099 NTSTATUS ret = NT_STATUS_OK;
1101 switch (auth->auth_type) {
1102 case DCERPC_AUTH_TYPE_SCHANNEL:
1103 ret = create_schannel_auth_rpc_bind_req(cli, &auth_token);
1104 if (!NT_STATUS_IS_OK(ret)) {
1105 return ret;
1107 break;
1109 case DCERPC_AUTH_TYPE_NTLMSSP:
1110 case DCERPC_AUTH_TYPE_KRB5:
1111 case DCERPC_AUTH_TYPE_SPNEGO:
1112 ret = create_generic_auth_rpc_bind_req(cli, mem_ctx, &auth_token);
1114 if (!NT_STATUS_IS_OK(ret) &&
1115 !NT_STATUS_EQUAL(ret, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1116 return ret;
1118 break;
1120 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1121 auth_token = data_blob_talloc(mem_ctx,
1122 "NCALRPC_AUTH_TOKEN",
1123 18);
1124 break;
1126 case DCERPC_AUTH_TYPE_NONE:
1127 break;
1129 default:
1130 /* "Can't" happen. */
1131 return NT_STATUS_INVALID_INFO_CLASS;
1134 if (auth_token.length != 0) {
1135 ret = dcerpc_push_dcerpc_auth(cli,
1136 auth->auth_type,
1137 auth->auth_level,
1138 0, /* auth_pad_length */
1139 1, /* auth_context_id */
1140 &auth_token,
1141 &auth_info);
1142 if (!NT_STATUS_IS_OK(ret)) {
1143 return ret;
1145 data_blob_free(&auth_token);
1148 ret = create_bind_or_alt_ctx_internal(mem_ctx,
1149 DCERPC_PKT_BIND,
1150 rpc_call_id,
1151 abstract,
1152 transfer,
1153 &auth_info,
1154 rpc_out);
1155 return ret;
1158 /*******************************************************************
1159 External interface.
1160 Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
1161 Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
1162 and deals with signing/sealing details.
1163 ********************************************************************/
1165 struct rpc_api_pipe_req_state {
1166 struct tevent_context *ev;
1167 struct rpc_pipe_client *cli;
1168 uint8_t op_num;
1169 uint32_t call_id;
1170 DATA_BLOB *req_data;
1171 uint32_t req_data_sent;
1172 DATA_BLOB rpc_out;
1173 DATA_BLOB reply_pdu;
1176 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
1177 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
1178 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1179 bool *is_last_frag);
1181 struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
1182 struct tevent_context *ev,
1183 struct rpc_pipe_client *cli,
1184 uint8_t op_num,
1185 DATA_BLOB *req_data)
1187 struct tevent_req *req, *subreq;
1188 struct rpc_api_pipe_req_state *state;
1189 NTSTATUS status;
1190 bool is_last_frag;
1192 req = tevent_req_create(mem_ctx, &state,
1193 struct rpc_api_pipe_req_state);
1194 if (req == NULL) {
1195 return NULL;
1197 state->ev = ev;
1198 state->cli = cli;
1199 state->op_num = op_num;
1200 state->req_data = req_data;
1201 state->req_data_sent = 0;
1202 state->call_id = get_rpc_call_id();
1203 state->reply_pdu = data_blob_null;
1204 state->rpc_out = data_blob_null;
1206 if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
1207 + RPC_MAX_SIGN_SIZE) {
1208 /* Server is screwed up ! */
1209 status = NT_STATUS_INVALID_PARAMETER;
1210 goto post_status;
1213 status = prepare_next_frag(state, &is_last_frag);
1214 if (!NT_STATUS_IS_OK(status)) {
1215 goto post_status;
1218 if (is_last_frag) {
1219 subreq = rpc_api_pipe_send(state, ev, state->cli,
1220 &state->rpc_out,
1221 DCERPC_PKT_RESPONSE);
1222 if (subreq == NULL) {
1223 goto fail;
1225 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1226 } else {
1227 subreq = rpc_write_send(state, ev, cli->transport,
1228 state->rpc_out.data,
1229 state->rpc_out.length);
1230 if (subreq == NULL) {
1231 goto fail;
1233 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1234 req);
1236 return req;
1238 post_status:
1239 tevent_req_nterror(req, status);
1240 return tevent_req_post(req, ev);
1241 fail:
1242 TALLOC_FREE(req);
1243 return NULL;
1246 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1247 bool *is_last_frag)
1249 size_t data_sent_thistime;
1250 size_t auth_len;
1251 size_t frag_len;
1252 uint8_t flags = 0;
1253 size_t pad_len;
1254 size_t data_left;
1255 NTSTATUS status;
1256 union dcerpc_payload u;
1258 data_left = state->req_data->length - state->req_data_sent;
1260 status = dcerpc_guess_sizes(state->cli->auth,
1261 DCERPC_REQUEST_LENGTH, data_left,
1262 state->cli->max_xmit_frag,
1263 CLIENT_NDR_PADDING_SIZE,
1264 &data_sent_thistime,
1265 &frag_len, &auth_len, &pad_len);
1266 if (!NT_STATUS_IS_OK(status)) {
1267 return status;
1270 if (state->req_data_sent == 0) {
1271 flags = DCERPC_PFC_FLAG_FIRST;
1274 if (data_sent_thistime == data_left) {
1275 flags |= DCERPC_PFC_FLAG_LAST;
1278 data_blob_free(&state->rpc_out);
1280 ZERO_STRUCT(u.request);
1282 u.request.alloc_hint = state->req_data->length;
1283 u.request.context_id = 0;
1284 u.request.opnum = state->op_num;
1286 status = dcerpc_push_ncacn_packet(state,
1287 DCERPC_PKT_REQUEST,
1288 flags,
1289 auth_len,
1290 state->call_id,
1292 &state->rpc_out);
1293 if (!NT_STATUS_IS_OK(status)) {
1294 return status;
1297 /* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
1298 * compute it right for requests because the auth trailer is missing
1299 * at this stage */
1300 dcerpc_set_frag_length(&state->rpc_out, frag_len);
1302 /* Copy in the data. */
1303 if (!data_blob_append(NULL, &state->rpc_out,
1304 state->req_data->data + state->req_data_sent,
1305 data_sent_thistime)) {
1306 return NT_STATUS_NO_MEMORY;
1309 switch (state->cli->auth->auth_level) {
1310 case DCERPC_AUTH_LEVEL_NONE:
1311 case DCERPC_AUTH_LEVEL_CONNECT:
1312 case DCERPC_AUTH_LEVEL_PACKET:
1313 break;
1314 case DCERPC_AUTH_LEVEL_INTEGRITY:
1315 case DCERPC_AUTH_LEVEL_PRIVACY:
1316 status = dcerpc_add_auth_footer(state->cli->auth, pad_len,
1317 &state->rpc_out);
1318 if (!NT_STATUS_IS_OK(status)) {
1319 return status;
1321 break;
1322 default:
1323 return NT_STATUS_INVALID_PARAMETER;
1326 state->req_data_sent += data_sent_thistime;
1327 *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
1329 return status;
1332 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
1334 struct tevent_req *req = tevent_req_callback_data(
1335 subreq, struct tevent_req);
1336 struct rpc_api_pipe_req_state *state = tevent_req_data(
1337 req, struct rpc_api_pipe_req_state);
1338 NTSTATUS status;
1339 bool is_last_frag;
1341 status = rpc_write_recv(subreq);
1342 TALLOC_FREE(subreq);
1343 if (!NT_STATUS_IS_OK(status)) {
1344 tevent_req_nterror(req, status);
1345 return;
1348 status = prepare_next_frag(state, &is_last_frag);
1349 if (!NT_STATUS_IS_OK(status)) {
1350 tevent_req_nterror(req, status);
1351 return;
1354 if (is_last_frag) {
1355 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1356 &state->rpc_out,
1357 DCERPC_PKT_RESPONSE);
1358 if (tevent_req_nomem(subreq, req)) {
1359 return;
1361 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1362 } else {
1363 subreq = rpc_write_send(state, state->ev,
1364 state->cli->transport,
1365 state->rpc_out.data,
1366 state->rpc_out.length);
1367 if (tevent_req_nomem(subreq, req)) {
1368 return;
1370 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1371 req);
1375 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
1377 struct tevent_req *req = tevent_req_callback_data(
1378 subreq, struct tevent_req);
1379 struct rpc_api_pipe_req_state *state = tevent_req_data(
1380 req, struct rpc_api_pipe_req_state);
1381 NTSTATUS status;
1383 status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
1384 TALLOC_FREE(subreq);
1385 if (!NT_STATUS_IS_OK(status)) {
1386 tevent_req_nterror(req, status);
1387 return;
1389 tevent_req_done(req);
1392 NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1393 DATA_BLOB *reply_pdu)
1395 struct rpc_api_pipe_req_state *state = tevent_req_data(
1396 req, struct rpc_api_pipe_req_state);
1397 NTSTATUS status;
1399 if (tevent_req_is_nterror(req, &status)) {
1401 * We always have to initialize to reply pdu, even if there is
1402 * none. The rpccli_* caller routines expect this.
1404 *reply_pdu = data_blob_null;
1405 return status;
1408 /* return data to caller and assign it ownership of memory */
1409 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1410 reply_pdu->length = state->reply_pdu.length;
1411 state->reply_pdu.length = 0;
1413 return NT_STATUS_OK;
1416 /****************************************************************************
1417 Check the rpc bind acknowledge response.
1418 ****************************************************************************/
1420 static bool check_bind_response(const struct dcerpc_bind_ack *r,
1421 const struct ndr_syntax_id *transfer)
1423 struct dcerpc_ack_ctx ctx;
1425 if (r->secondary_address_size == 0) {
1426 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
1429 if (r->num_results < 1 || !r->ctx_list) {
1430 return false;
1433 ctx = r->ctx_list[0];
1435 /* check the transfer syntax */
1436 if ((ctx.syntax.if_version != transfer->if_version) ||
1437 (memcmp(&ctx.syntax.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1438 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1439 return False;
1442 if (r->num_results != 0x1 || ctx.result != 0) {
1443 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1444 r->num_results, ctx.reason));
1447 DEBUG(5,("check_bind_response: accepted!\n"));
1448 return True;
1451 /*******************************************************************
1452 Creates a DCE/RPC bind authentication response.
1453 This is the packet that is sent back to the server once we
1454 have received a BIND-ACK, to finish the third leg of
1455 the authentication handshake.
1456 ********************************************************************/
1458 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
1459 struct rpc_pipe_client *cli,
1460 uint32 rpc_call_id,
1461 enum dcerpc_AuthType auth_type,
1462 enum dcerpc_AuthLevel auth_level,
1463 DATA_BLOB *pauth_blob,
1464 DATA_BLOB *rpc_out)
1466 NTSTATUS status;
1467 union dcerpc_payload u;
1469 u.auth3._pad = 0;
1471 status = dcerpc_push_dcerpc_auth(mem_ctx,
1472 auth_type,
1473 auth_level,
1474 0, /* auth_pad_length */
1475 1, /* auth_context_id */
1476 pauth_blob,
1477 &u.auth3.auth_info);
1478 if (!NT_STATUS_IS_OK(status)) {
1479 return status;
1482 status = dcerpc_push_ncacn_packet(mem_ctx,
1483 DCERPC_PKT_AUTH3,
1484 DCERPC_PFC_FLAG_FIRST |
1485 DCERPC_PFC_FLAG_LAST,
1486 pauth_blob->length,
1487 rpc_call_id,
1489 rpc_out);
1490 data_blob_free(&u.auth3.auth_info);
1491 if (!NT_STATUS_IS_OK(status)) {
1492 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1493 return status;
1496 return NT_STATUS_OK;
1499 /*******************************************************************
1500 Creates a DCE/RPC bind alter context authentication request which
1501 may contain a spnego auth blobl
1502 ********************************************************************/
1504 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
1505 enum dcerpc_AuthType auth_type,
1506 enum dcerpc_AuthLevel auth_level,
1507 uint32 rpc_call_id,
1508 const struct ndr_syntax_id *abstract,
1509 const struct ndr_syntax_id *transfer,
1510 const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
1511 DATA_BLOB *rpc_out)
1513 DATA_BLOB auth_info;
1514 NTSTATUS status;
1516 status = dcerpc_push_dcerpc_auth(mem_ctx,
1517 auth_type,
1518 auth_level,
1519 0, /* auth_pad_length */
1520 1, /* auth_context_id */
1521 pauth_blob,
1522 &auth_info);
1523 if (!NT_STATUS_IS_OK(status)) {
1524 return status;
1527 status = create_bind_or_alt_ctx_internal(mem_ctx,
1528 DCERPC_PKT_ALTER,
1529 rpc_call_id,
1530 abstract,
1531 transfer,
1532 &auth_info,
1533 rpc_out);
1534 data_blob_free(&auth_info);
1535 return status;
1538 /****************************************************************************
1539 Do an rpc bind.
1540 ****************************************************************************/
1542 struct rpc_pipe_bind_state {
1543 struct tevent_context *ev;
1544 struct rpc_pipe_client *cli;
1545 DATA_BLOB rpc_out;
1546 bool auth3;
1547 uint32_t rpc_call_id;
1548 struct netr_Authenticator auth;
1549 struct netr_Authenticator return_auth;
1550 struct netlogon_creds_CredentialState *creds;
1551 union netr_Capabilities capabilities;
1552 struct netr_LogonGetCapabilities r;
1555 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
1556 static void rpc_pipe_bind_step_two_trigger(struct tevent_req *req);
1557 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1558 struct rpc_pipe_bind_state *state,
1559 DATA_BLOB *credentials);
1560 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1561 struct rpc_pipe_bind_state *state,
1562 DATA_BLOB *credentials);
1564 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
1565 struct tevent_context *ev,
1566 struct rpc_pipe_client *cli,
1567 struct pipe_auth_data *auth)
1569 struct tevent_req *req, *subreq;
1570 struct rpc_pipe_bind_state *state;
1571 NTSTATUS status;
1573 req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
1574 if (req == NULL) {
1575 return NULL;
1578 DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
1579 rpccli_pipe_txt(talloc_tos(), cli),
1580 (unsigned int)auth->auth_type,
1581 (unsigned int)auth->auth_level ));
1583 state->ev = ev;
1584 state->cli = cli;
1585 state->rpc_call_id = get_rpc_call_id();
1587 cli->auth = talloc_move(cli, &auth);
1589 /* Marshall the outgoing data. */
1590 status = create_rpc_bind_req(state, cli,
1591 cli->auth,
1592 state->rpc_call_id,
1593 &cli->abstract_syntax,
1594 &cli->transfer_syntax,
1595 &state->rpc_out);
1597 if (!NT_STATUS_IS_OK(status) &&
1598 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1599 goto post_status;
1602 subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
1603 DCERPC_PKT_BIND_ACK);
1604 if (subreq == NULL) {
1605 goto fail;
1607 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1608 return req;
1610 post_status:
1611 tevent_req_nterror(req, status);
1612 return tevent_req_post(req, ev);
1613 fail:
1614 TALLOC_FREE(req);
1615 return NULL;
1618 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
1620 struct tevent_req *req = tevent_req_callback_data(
1621 subreq, struct tevent_req);
1622 struct rpc_pipe_bind_state *state = tevent_req_data(
1623 req, struct rpc_pipe_bind_state);
1624 struct pipe_auth_data *pauth = state->cli->auth;
1625 struct gensec_security *gensec_security;
1626 struct ncacn_packet *pkt = NULL;
1627 struct dcerpc_auth auth;
1628 DATA_BLOB auth_token = data_blob_null;
1629 NTSTATUS status;
1631 status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
1632 TALLOC_FREE(subreq);
1633 if (!NT_STATUS_IS_OK(status)) {
1634 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
1635 rpccli_pipe_txt(talloc_tos(), state->cli),
1636 nt_errstr(status)));
1637 tevent_req_nterror(req, status);
1638 return;
1641 if (state->auth3) {
1642 tevent_req_done(req);
1643 return;
1646 if (!check_bind_response(&pkt->u.bind_ack, &state->cli->transfer_syntax)) {
1647 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
1648 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1649 return;
1652 state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
1653 state->cli->max_recv_frag = pkt->u.bind_ack.max_recv_frag;
1655 switch(pauth->auth_type) {
1657 case DCERPC_AUTH_TYPE_NONE:
1658 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1659 /* Bind complete. */
1660 tevent_req_done(req);
1661 return;
1663 case DCERPC_AUTH_TYPE_SCHANNEL:
1664 rpc_pipe_bind_step_two_trigger(req);
1665 return;
1667 case DCERPC_AUTH_TYPE_NTLMSSP:
1668 case DCERPC_AUTH_TYPE_SPNEGO:
1669 case DCERPC_AUTH_TYPE_KRB5:
1670 /* Paranoid lenght checks */
1671 if (pkt->frag_length < DCERPC_AUTH_TRAILER_LENGTH
1672 + pkt->auth_length) {
1673 tevent_req_nterror(req,
1674 NT_STATUS_INFO_LENGTH_MISMATCH);
1675 return;
1677 /* get auth credentials */
1678 status = dcerpc_pull_dcerpc_auth(talloc_tos(),
1679 &pkt->u.bind_ack.auth_info,
1680 &auth, false);
1681 if (!NT_STATUS_IS_OK(status)) {
1682 DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
1683 nt_errstr(status)));
1684 tevent_req_nterror(req, status);
1685 return;
1687 break;
1689 default:
1690 goto err_out;
1694 * For authenticated binds we may need to do 3 or 4 leg binds.
1697 switch(pauth->auth_type) {
1699 case DCERPC_AUTH_TYPE_NONE:
1700 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1701 case DCERPC_AUTH_TYPE_SCHANNEL:
1702 /* Bind complete. */
1703 tevent_req_done(req);
1704 return;
1706 case DCERPC_AUTH_TYPE_NTLMSSP:
1707 case DCERPC_AUTH_TYPE_KRB5:
1708 case DCERPC_AUTH_TYPE_SPNEGO:
1709 gensec_security = talloc_get_type_abort(pauth->auth_ctx,
1710 struct gensec_security);
1711 status = gensec_update(gensec_security, state, NULL,
1712 auth.credentials, &auth_token);
1713 if (NT_STATUS_EQUAL(status,
1714 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1715 status = rpc_bind_next_send(req, state,
1716 &auth_token);
1717 } else if (NT_STATUS_IS_OK(status)) {
1718 if (auth_token.length == 0) {
1719 /* Bind complete. */
1720 tevent_req_done(req);
1721 return;
1723 status = rpc_bind_finish_send(req, state,
1724 &auth_token);
1726 break;
1728 default:
1729 goto err_out;
1732 if (!NT_STATUS_IS_OK(status)) {
1733 tevent_req_nterror(req, status);
1735 return;
1737 err_out:
1738 DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
1739 (unsigned int)state->cli->auth->auth_type));
1740 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
1743 static void rpc_pipe_bind_step_two_done(struct tevent_req *subreq);
1745 static void rpc_pipe_bind_step_two_trigger(struct tevent_req *req)
1747 struct rpc_pipe_bind_state *state =
1748 tevent_req_data(req,
1749 struct rpc_pipe_bind_state);
1750 struct dcerpc_binding_handle *b = state->cli->binding_handle;
1751 struct schannel_state *schannel_auth =
1752 talloc_get_type_abort(state->cli->auth->auth_ctx,
1753 struct schannel_state);
1754 struct tevent_req *subreq;
1756 if (schannel_auth == NULL ||
1757 !ndr_syntax_id_equal(&state->cli->abstract_syntax,
1758 &ndr_table_netlogon.syntax_id)) {
1759 tevent_req_done(req);
1760 return;
1763 ZERO_STRUCT(state->return_auth);
1765 state->creds = netlogon_creds_copy(state, schannel_auth->creds);
1766 if (state->creds == NULL) {
1767 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1768 return;
1771 netlogon_creds_client_authenticator(state->creds, &state->auth);
1773 state->r.in.server_name = state->cli->srv_name_slash;
1774 state->r.in.computer_name = state->creds->computer_name;
1775 state->r.in.credential = &state->auth;
1776 state->r.in.query_level = 1;
1777 state->r.in.return_authenticator = &state->return_auth;
1779 state->r.out.capabilities = &state->capabilities;
1780 state->r.out.return_authenticator = &state->return_auth;
1782 subreq = dcerpc_netr_LogonGetCapabilities_r_send(talloc_tos(),
1783 state->ev,
1785 &state->r);
1786 if (subreq == NULL) {
1787 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
1788 return;
1791 tevent_req_set_callback(subreq, rpc_pipe_bind_step_two_done, req);
1792 return;
1795 static void rpc_pipe_bind_step_two_done(struct tevent_req *subreq)
1797 struct tevent_req *req =
1798 tevent_req_callback_data(subreq,
1799 struct tevent_req);
1800 struct rpc_pipe_bind_state *state =
1801 tevent_req_data(req,
1802 struct rpc_pipe_bind_state);
1803 NTSTATUS status;
1805 status = dcerpc_netr_LogonGetCapabilities_r_recv(subreq, talloc_tos());
1806 TALLOC_FREE(subreq);
1807 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
1808 if (state->cli->dc && state->cli->dc->negotiate_flags &
1809 NETLOGON_NEG_SUPPORTS_AES) {
1810 DEBUG(5, ("AES is not supported and the error was %s\n",
1811 nt_errstr(status)));
1812 tevent_req_nterror(req,
1813 NT_STATUS_INVALID_NETWORK_RESPONSE);
1814 return;
1817 /* This is probably NT */
1818 DEBUG(5, ("We are checking against an NT - %s\n",
1819 nt_errstr(status)));
1820 tevent_req_done(req);
1821 return;
1822 } else if (!NT_STATUS_IS_OK(status)) {
1823 DEBUG(0, ("dcerpc_netr_LogonGetCapabilities_r_recv failed with %s\n",
1824 nt_errstr(status)));
1825 tevent_req_nterror(req, status);
1826 return;
1829 if (NT_STATUS_EQUAL(state->r.out.result, NT_STATUS_NOT_IMPLEMENTED)) {
1830 if (state->creds->negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
1831 /* This means AES isn't supported. */
1832 DEBUG(5, ("AES is not supported and the error was %s\n",
1833 nt_errstr(state->r.out.result)));
1834 tevent_req_nterror(req,
1835 NT_STATUS_INVALID_NETWORK_RESPONSE);
1836 return;
1839 /* This is probably an old Samba version */
1840 DEBUG(5, ("We are checking against an old Samba version - %s\n",
1841 nt_errstr(state->r.out.result)));
1842 tevent_req_done(req);
1843 return;
1846 /* We need to check the credential state here, cause win2k3 and earlier
1847 * returns NT_STATUS_NOT_IMPLEMENTED */
1848 if (!netlogon_creds_client_check(state->creds,
1849 &state->r.out.return_authenticator->cred)) {
1851 * Server replied with bad credential. Fail.
1853 DEBUG(0,("rpc_pipe_bind_step_two_done: server %s "
1854 "replied with bad credential\n",
1855 state->cli->desthost));
1856 tevent_req_nterror(req, NT_STATUS_UNSUCCESSFUL);
1857 return;
1860 TALLOC_FREE(state->cli->dc);
1861 state->cli->dc = talloc_steal(state->cli, state->creds);
1863 if (!NT_STATUS_IS_OK(state->r.out.result)) {
1864 DEBUG(0, ("dcerpc_netr_LogonGetCapabilities_r_recv failed with %s\n",
1865 nt_errstr(state->r.out.result)));
1866 tevent_req_nterror(req, state->r.out.result);
1867 return;
1870 if (state->creds->negotiate_flags !=
1871 state->r.out.capabilities->server_capabilities) {
1872 DEBUG(0, ("The client capabilities don't match the server "
1873 "capabilities: local[0x%08X] remote[0x%08X]\n",
1874 state->creds->negotiate_flags,
1875 state->capabilities.server_capabilities));
1876 tevent_req_nterror(req,
1877 NT_STATUS_INVALID_NETWORK_RESPONSE);
1878 return;
1881 /* TODO: Add downgrade dectection. */
1883 tevent_req_done(req);
1884 return;
1887 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1888 struct rpc_pipe_bind_state *state,
1889 DATA_BLOB *auth_token)
1891 struct pipe_auth_data *auth = state->cli->auth;
1892 struct tevent_req *subreq;
1893 NTSTATUS status;
1895 /* Now prepare the alter context pdu. */
1896 data_blob_free(&state->rpc_out);
1898 status = create_rpc_alter_context(state,
1899 auth->auth_type,
1900 auth->auth_level,
1901 state->rpc_call_id,
1902 &state->cli->abstract_syntax,
1903 &state->cli->transfer_syntax,
1904 auth_token,
1905 &state->rpc_out);
1906 if (!NT_STATUS_IS_OK(status)) {
1907 return status;
1910 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1911 &state->rpc_out, DCERPC_PKT_ALTER_RESP);
1912 if (subreq == NULL) {
1913 return NT_STATUS_NO_MEMORY;
1915 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1916 return NT_STATUS_OK;
1919 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1920 struct rpc_pipe_bind_state *state,
1921 DATA_BLOB *auth_token)
1923 struct pipe_auth_data *auth = state->cli->auth;
1924 struct tevent_req *subreq;
1925 NTSTATUS status;
1927 state->auth3 = true;
1929 /* Now prepare the auth3 context pdu. */
1930 data_blob_free(&state->rpc_out);
1932 status = create_rpc_bind_auth3(state, state->cli,
1933 state->rpc_call_id,
1934 auth->auth_type,
1935 auth->auth_level,
1936 auth_token,
1937 &state->rpc_out);
1938 if (!NT_STATUS_IS_OK(status)) {
1939 return status;
1942 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1943 &state->rpc_out, DCERPC_PKT_AUTH3);
1944 if (subreq == NULL) {
1945 return NT_STATUS_NO_MEMORY;
1947 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1948 return NT_STATUS_OK;
1951 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
1953 return tevent_req_simple_recv_ntstatus(req);
1956 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
1957 struct pipe_auth_data *auth)
1959 TALLOC_CTX *frame = talloc_stackframe();
1960 struct tevent_context *ev;
1961 struct tevent_req *req;
1962 NTSTATUS status = NT_STATUS_OK;
1964 ev = samba_tevent_context_init(frame);
1965 if (ev == NULL) {
1966 status = NT_STATUS_NO_MEMORY;
1967 goto fail;
1970 req = rpc_pipe_bind_send(frame, ev, cli, auth);
1971 if (req == NULL) {
1972 status = NT_STATUS_NO_MEMORY;
1973 goto fail;
1976 if (!tevent_req_poll(req, ev)) {
1977 status = map_nt_error_from_unix(errno);
1978 goto fail;
1981 status = rpc_pipe_bind_recv(req);
1982 fail:
1983 TALLOC_FREE(frame);
1984 return status;
1987 #define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */
1989 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
1990 unsigned int timeout)
1992 unsigned int old;
1994 if (rpc_cli->transport == NULL) {
1995 return RPCCLI_DEFAULT_TIMEOUT;
1998 if (rpc_cli->transport->set_timeout == NULL) {
1999 return RPCCLI_DEFAULT_TIMEOUT;
2002 old = rpc_cli->transport->set_timeout(rpc_cli->transport->priv, timeout);
2003 if (old == 0) {
2004 return RPCCLI_DEFAULT_TIMEOUT;
2007 return old;
2010 bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
2012 if (rpc_cli == NULL) {
2013 return false;
2016 if (rpc_cli->transport == NULL) {
2017 return false;
2020 return rpc_cli->transport->is_connected(rpc_cli->transport->priv);
2023 struct rpccli_bh_state {
2024 struct rpc_pipe_client *rpc_cli;
2027 static bool rpccli_bh_is_connected(struct dcerpc_binding_handle *h)
2029 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2030 struct rpccli_bh_state);
2032 return rpccli_is_connected(hs->rpc_cli);
2035 static uint32_t rpccli_bh_set_timeout(struct dcerpc_binding_handle *h,
2036 uint32_t timeout)
2038 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2039 struct rpccli_bh_state);
2041 return rpccli_set_timeout(hs->rpc_cli, timeout);
2044 struct rpccli_bh_raw_call_state {
2045 DATA_BLOB in_data;
2046 DATA_BLOB out_data;
2047 uint32_t out_flags;
2050 static void rpccli_bh_raw_call_done(struct tevent_req *subreq);
2052 static struct tevent_req *rpccli_bh_raw_call_send(TALLOC_CTX *mem_ctx,
2053 struct tevent_context *ev,
2054 struct dcerpc_binding_handle *h,
2055 const struct GUID *object,
2056 uint32_t opnum,
2057 uint32_t in_flags,
2058 const uint8_t *in_data,
2059 size_t in_length)
2061 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2062 struct rpccli_bh_state);
2063 struct tevent_req *req;
2064 struct rpccli_bh_raw_call_state *state;
2065 bool ok;
2066 struct tevent_req *subreq;
2068 req = tevent_req_create(mem_ctx, &state,
2069 struct rpccli_bh_raw_call_state);
2070 if (req == NULL) {
2071 return NULL;
2073 state->in_data.data = discard_const_p(uint8_t, in_data);
2074 state->in_data.length = in_length;
2076 ok = rpccli_bh_is_connected(h);
2077 if (!ok) {
2078 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2079 return tevent_req_post(req, ev);
2082 subreq = rpc_api_pipe_req_send(state, ev, hs->rpc_cli,
2083 opnum, &state->in_data);
2084 if (tevent_req_nomem(subreq, req)) {
2085 return tevent_req_post(req, ev);
2087 tevent_req_set_callback(subreq, rpccli_bh_raw_call_done, req);
2089 return req;
2092 static void rpccli_bh_raw_call_done(struct tevent_req *subreq)
2094 struct tevent_req *req =
2095 tevent_req_callback_data(subreq,
2096 struct tevent_req);
2097 struct rpccli_bh_raw_call_state *state =
2098 tevent_req_data(req,
2099 struct rpccli_bh_raw_call_state);
2100 NTSTATUS status;
2102 state->out_flags = 0;
2104 /* TODO: support bigendian responses */
2106 status = rpc_api_pipe_req_recv(subreq, state, &state->out_data);
2107 TALLOC_FREE(subreq);
2108 if (!NT_STATUS_IS_OK(status)) {
2109 tevent_req_nterror(req, status);
2110 return;
2113 tevent_req_done(req);
2116 static NTSTATUS rpccli_bh_raw_call_recv(struct tevent_req *req,
2117 TALLOC_CTX *mem_ctx,
2118 uint8_t **out_data,
2119 size_t *out_length,
2120 uint32_t *out_flags)
2122 struct rpccli_bh_raw_call_state *state =
2123 tevent_req_data(req,
2124 struct rpccli_bh_raw_call_state);
2125 NTSTATUS status;
2127 if (tevent_req_is_nterror(req, &status)) {
2128 tevent_req_received(req);
2129 return status;
2132 *out_data = talloc_move(mem_ctx, &state->out_data.data);
2133 *out_length = state->out_data.length;
2134 *out_flags = state->out_flags;
2135 tevent_req_received(req);
2136 return NT_STATUS_OK;
2139 struct rpccli_bh_disconnect_state {
2140 uint8_t _dummy;
2143 static struct tevent_req *rpccli_bh_disconnect_send(TALLOC_CTX *mem_ctx,
2144 struct tevent_context *ev,
2145 struct dcerpc_binding_handle *h)
2147 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2148 struct rpccli_bh_state);
2149 struct tevent_req *req;
2150 struct rpccli_bh_disconnect_state *state;
2151 bool ok;
2153 req = tevent_req_create(mem_ctx, &state,
2154 struct rpccli_bh_disconnect_state);
2155 if (req == NULL) {
2156 return NULL;
2159 ok = rpccli_bh_is_connected(h);
2160 if (!ok) {
2161 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2162 return tevent_req_post(req, ev);
2166 * TODO: do a real async disconnect ...
2168 * For now the caller needs to free rpc_cli
2170 hs->rpc_cli = NULL;
2172 tevent_req_done(req);
2173 return tevent_req_post(req, ev);
2176 static NTSTATUS rpccli_bh_disconnect_recv(struct tevent_req *req)
2178 NTSTATUS status;
2180 if (tevent_req_is_nterror(req, &status)) {
2181 tevent_req_received(req);
2182 return status;
2185 tevent_req_received(req);
2186 return NT_STATUS_OK;
2189 static bool rpccli_bh_ref_alloc(struct dcerpc_binding_handle *h)
2191 return true;
2194 static void rpccli_bh_do_ndr_print(struct dcerpc_binding_handle *h,
2195 int ndr_flags,
2196 const void *_struct_ptr,
2197 const struct ndr_interface_call *call)
2199 void *struct_ptr = discard_const(_struct_ptr);
2201 if (DEBUGLEVEL < 10) {
2202 return;
2205 if (ndr_flags & NDR_IN) {
2206 ndr_print_function_debug(call->ndr_print,
2207 call->name,
2208 ndr_flags,
2209 struct_ptr);
2211 if (ndr_flags & NDR_OUT) {
2212 ndr_print_function_debug(call->ndr_print,
2213 call->name,
2214 ndr_flags,
2215 struct_ptr);
2219 static const struct dcerpc_binding_handle_ops rpccli_bh_ops = {
2220 .name = "rpccli",
2221 .is_connected = rpccli_bh_is_connected,
2222 .set_timeout = rpccli_bh_set_timeout,
2223 .raw_call_send = rpccli_bh_raw_call_send,
2224 .raw_call_recv = rpccli_bh_raw_call_recv,
2225 .disconnect_send = rpccli_bh_disconnect_send,
2226 .disconnect_recv = rpccli_bh_disconnect_recv,
2228 .ref_alloc = rpccli_bh_ref_alloc,
2229 .do_ndr_print = rpccli_bh_do_ndr_print,
2232 /* initialise a rpc_pipe_client binding handle */
2233 struct dcerpc_binding_handle *rpccli_bh_create(struct rpc_pipe_client *c)
2235 struct dcerpc_binding_handle *h;
2236 struct rpccli_bh_state *hs;
2238 h = dcerpc_binding_handle_create(c,
2239 &rpccli_bh_ops,
2240 NULL,
2241 NULL, /* TODO */
2242 &hs,
2243 struct rpccli_bh_state,
2244 __location__);
2245 if (h == NULL) {
2246 return NULL;
2248 hs->rpc_cli = c;
2250 return h;
2253 NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx,
2254 struct pipe_auth_data **presult)
2256 struct pipe_auth_data *result;
2258 result = talloc(mem_ctx, struct pipe_auth_data);
2259 if (result == NULL) {
2260 return NT_STATUS_NO_MEMORY;
2263 result->auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
2264 result->auth_level = DCERPC_AUTH_LEVEL_CONNECT;
2266 result->user_name = talloc_strdup(result, "");
2267 result->domain = talloc_strdup(result, "");
2268 if ((result->user_name == NULL) || (result->domain == NULL)) {
2269 TALLOC_FREE(result);
2270 return NT_STATUS_NO_MEMORY;
2273 *presult = result;
2274 return NT_STATUS_OK;
2277 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2278 struct pipe_auth_data **presult)
2280 struct pipe_auth_data *result;
2282 result = talloc(mem_ctx, struct pipe_auth_data);
2283 if (result == NULL) {
2284 return NT_STATUS_NO_MEMORY;
2287 result->auth_type = DCERPC_AUTH_TYPE_NONE;
2288 result->auth_level = DCERPC_AUTH_LEVEL_NONE;
2290 result->user_name = talloc_strdup(result, "");
2291 result->domain = talloc_strdup(result, "");
2292 if ((result->user_name == NULL) || (result->domain == NULL)) {
2293 TALLOC_FREE(result);
2294 return NT_STATUS_NO_MEMORY;
2297 *presult = result;
2298 return NT_STATUS_OK;
2301 static NTSTATUS rpccli_generic_bind_data(TALLOC_CTX *mem_ctx,
2302 enum dcerpc_AuthType auth_type,
2303 enum dcerpc_AuthLevel auth_level,
2304 const char *server,
2305 const char *target_service,
2306 const char *domain,
2307 const char *username,
2308 const char *password,
2309 enum credentials_use_kerberos use_kerberos,
2310 struct pipe_auth_data **presult)
2312 struct auth_generic_state *auth_generic_ctx;
2313 struct pipe_auth_data *result;
2314 NTSTATUS status;
2316 result = talloc(mem_ctx, struct pipe_auth_data);
2317 if (result == NULL) {
2318 return NT_STATUS_NO_MEMORY;
2321 result->auth_type = auth_type;
2322 result->auth_level = auth_level;
2324 result->user_name = talloc_strdup(result, username);
2325 result->domain = talloc_strdup(result, domain);
2326 if ((result->user_name == NULL) || (result->domain == NULL)) {
2327 status = NT_STATUS_NO_MEMORY;
2328 goto fail;
2331 status = auth_generic_client_prepare(result,
2332 &auth_generic_ctx);
2333 if (!NT_STATUS_IS_OK(status)) {
2334 goto fail;
2337 status = auth_generic_set_username(auth_generic_ctx, username);
2338 if (!NT_STATUS_IS_OK(status)) {
2339 goto fail;
2342 status = auth_generic_set_domain(auth_generic_ctx, domain);
2343 if (!NT_STATUS_IS_OK(status)) {
2344 goto fail;
2347 status = auth_generic_set_password(auth_generic_ctx, password);
2348 if (!NT_STATUS_IS_OK(status)) {
2349 goto fail;
2352 status = gensec_set_target_service(auth_generic_ctx->gensec_security, target_service);
2353 if (!NT_STATUS_IS_OK(status)) {
2354 goto fail;
2357 status = gensec_set_target_hostname(auth_generic_ctx->gensec_security, server);
2358 if (!NT_STATUS_IS_OK(status)) {
2359 goto fail;
2362 cli_credentials_set_kerberos_state(auth_generic_ctx->credentials, use_kerberos);
2364 status = auth_generic_client_start_by_authtype(auth_generic_ctx, auth_type, auth_level);
2365 if (!NT_STATUS_IS_OK(status)) {
2366 goto fail;
2369 result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2370 talloc_free(auth_generic_ctx);
2371 *presult = result;
2372 return NT_STATUS_OK;
2374 fail:
2375 TALLOC_FREE(result);
2376 return status;
2379 NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
2380 enum dcerpc_AuthLevel auth_level,
2381 struct netlogon_creds_CredentialState *creds,
2382 struct pipe_auth_data **presult)
2384 struct schannel_state *schannel_auth;
2385 struct pipe_auth_data *result;
2387 result = talloc(mem_ctx, struct pipe_auth_data);
2388 if (result == NULL) {
2389 return NT_STATUS_NO_MEMORY;
2392 result->auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
2393 result->auth_level = auth_level;
2395 result->user_name = talloc_strdup(result, "");
2396 result->domain = talloc_strdup(result, domain);
2397 if ((result->user_name == NULL) || (result->domain == NULL)) {
2398 goto fail;
2401 schannel_auth = talloc_zero(result, struct schannel_state);
2402 if (schannel_auth == NULL) {
2403 goto fail;
2406 schannel_auth->state = SCHANNEL_STATE_START;
2407 schannel_auth->initiator = true;
2408 schannel_auth->creds = netlogon_creds_copy(result, creds);
2410 result->auth_ctx = schannel_auth;
2411 *presult = result;
2412 return NT_STATUS_OK;
2414 fail:
2415 TALLOC_FREE(result);
2416 return NT_STATUS_NO_MEMORY;
2420 * Create an rpc pipe client struct, connecting to a tcp port.
2422 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
2423 const struct sockaddr_storage *ss_addr,
2424 uint16_t port,
2425 const struct ndr_syntax_id *abstract_syntax,
2426 struct rpc_pipe_client **presult)
2428 struct rpc_pipe_client *result;
2429 struct sockaddr_storage addr;
2430 NTSTATUS status;
2431 int fd;
2433 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2434 if (result == NULL) {
2435 return NT_STATUS_NO_MEMORY;
2438 result->abstract_syntax = *abstract_syntax;
2439 result->transfer_syntax = ndr_transfer_syntax_ndr;
2441 result->desthost = talloc_strdup(result, host);
2442 result->srv_name_slash = talloc_asprintf_strupper_m(
2443 result, "\\\\%s", result->desthost);
2444 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2445 status = NT_STATUS_NO_MEMORY;
2446 goto fail;
2449 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2450 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2452 if (ss_addr == NULL) {
2453 if (!resolve_name(host, &addr, NBT_NAME_SERVER, false)) {
2454 status = NT_STATUS_NOT_FOUND;
2455 goto fail;
2457 } else {
2458 addr = *ss_addr;
2461 status = open_socket_out(&addr, port, 60*1000, &fd);
2462 if (!NT_STATUS_IS_OK(status)) {
2463 goto fail;
2465 set_socket_options(fd, lp_socket_options());
2467 status = rpc_transport_sock_init(result, fd, &result->transport);
2468 if (!NT_STATUS_IS_OK(status)) {
2469 close(fd);
2470 goto fail;
2473 result->transport->transport = NCACN_IP_TCP;
2475 result->binding_handle = rpccli_bh_create(result);
2476 if (result->binding_handle == NULL) {
2477 TALLOC_FREE(result);
2478 return NT_STATUS_NO_MEMORY;
2481 *presult = result;
2482 return NT_STATUS_OK;
2484 fail:
2485 TALLOC_FREE(result);
2486 return status;
2490 * Determine the tcp port on which a dcerpc interface is listening
2491 * for the ncacn_ip_tcp transport via the endpoint mapper of the
2492 * target host.
2494 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
2495 const struct sockaddr_storage *addr,
2496 const struct ndr_syntax_id *abstract_syntax,
2497 uint16_t *pport)
2499 NTSTATUS status;
2500 struct rpc_pipe_client *epm_pipe = NULL;
2501 struct dcerpc_binding_handle *epm_handle = NULL;
2502 struct pipe_auth_data *auth = NULL;
2503 struct dcerpc_binding *map_binding = NULL;
2504 struct dcerpc_binding *res_binding = NULL;
2505 struct epm_twr_t *map_tower = NULL;
2506 struct epm_twr_t *res_towers = NULL;
2507 struct policy_handle *entry_handle = NULL;
2508 uint32_t num_towers = 0;
2509 uint32_t max_towers = 1;
2510 struct epm_twr_p_t towers;
2511 TALLOC_CTX *tmp_ctx = talloc_stackframe();
2512 uint32_t result = 0;
2514 if (pport == NULL) {
2515 status = NT_STATUS_INVALID_PARAMETER;
2516 goto done;
2519 if (ndr_syntax_id_equal(abstract_syntax,
2520 &ndr_table_epmapper.syntax_id)) {
2521 *pport = 135;
2522 return NT_STATUS_OK;
2525 /* open the connection to the endpoint mapper */
2526 status = rpc_pipe_open_tcp_port(tmp_ctx, host, addr, 135,
2527 &ndr_table_epmapper.syntax_id,
2528 &epm_pipe);
2530 if (!NT_STATUS_IS_OK(status)) {
2531 goto done;
2533 epm_handle = epm_pipe->binding_handle;
2535 status = rpccli_anon_bind_data(tmp_ctx, &auth);
2536 if (!NT_STATUS_IS_OK(status)) {
2537 goto done;
2540 status = rpc_pipe_bind(epm_pipe, auth);
2541 if (!NT_STATUS_IS_OK(status)) {
2542 goto done;
2545 /* create tower for asking the epmapper */
2547 map_binding = talloc_zero(tmp_ctx, struct dcerpc_binding);
2548 if (map_binding == NULL) {
2549 status = NT_STATUS_NO_MEMORY;
2550 goto done;
2553 map_binding->transport = NCACN_IP_TCP;
2554 map_binding->object = *abstract_syntax;
2555 map_binding->host = host; /* needed? */
2556 map_binding->endpoint = "0"; /* correct? needed? */
2558 map_tower = talloc_zero(tmp_ctx, struct epm_twr_t);
2559 if (map_tower == NULL) {
2560 status = NT_STATUS_NO_MEMORY;
2561 goto done;
2564 status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
2565 &(map_tower->tower));
2566 if (!NT_STATUS_IS_OK(status)) {
2567 goto done;
2570 /* allocate further parameters for the epm_Map call */
2572 res_towers = talloc_array(tmp_ctx, struct epm_twr_t, max_towers);
2573 if (res_towers == NULL) {
2574 status = NT_STATUS_NO_MEMORY;
2575 goto done;
2577 towers.twr = res_towers;
2579 entry_handle = talloc_zero(tmp_ctx, struct policy_handle);
2580 if (entry_handle == NULL) {
2581 status = NT_STATUS_NO_MEMORY;
2582 goto done;
2585 /* ask the endpoint mapper for the port */
2587 status = dcerpc_epm_Map(epm_handle,
2588 tmp_ctx,
2589 discard_const_p(struct GUID,
2590 &(abstract_syntax->uuid)),
2591 map_tower,
2592 entry_handle,
2593 max_towers,
2594 &num_towers,
2595 &towers,
2596 &result);
2598 if (!NT_STATUS_IS_OK(status)) {
2599 goto done;
2602 if (result != EPMAPPER_STATUS_OK) {
2603 status = NT_STATUS_UNSUCCESSFUL;
2604 goto done;
2607 if (num_towers != 1) {
2608 status = NT_STATUS_UNSUCCESSFUL;
2609 goto done;
2612 /* extract the port from the answer */
2614 status = dcerpc_binding_from_tower(tmp_ctx,
2615 &(towers.twr->tower),
2616 &res_binding);
2617 if (!NT_STATUS_IS_OK(status)) {
2618 goto done;
2621 /* are further checks here necessary? */
2622 if (res_binding->transport != NCACN_IP_TCP) {
2623 status = NT_STATUS_UNSUCCESSFUL;
2624 goto done;
2627 *pport = (uint16_t)atoi(res_binding->endpoint);
2629 done:
2630 TALLOC_FREE(tmp_ctx);
2631 return status;
2635 * Create a rpc pipe client struct, connecting to a host via tcp.
2636 * The port is determined by asking the endpoint mapper on the given
2637 * host.
2639 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
2640 const struct sockaddr_storage *addr,
2641 const struct ndr_syntax_id *abstract_syntax,
2642 struct rpc_pipe_client **presult)
2644 NTSTATUS status;
2645 uint16_t port = 0;
2647 status = rpc_pipe_get_tcp_port(host, addr, abstract_syntax, &port);
2648 if (!NT_STATUS_IS_OK(status)) {
2649 return status;
2652 return rpc_pipe_open_tcp_port(mem_ctx, host, addr, port,
2653 abstract_syntax, presult);
2656 /********************************************************************
2657 Create a rpc pipe client struct, connecting to a unix domain socket
2658 ********************************************************************/
2659 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
2660 const struct ndr_syntax_id *abstract_syntax,
2661 struct rpc_pipe_client **presult)
2663 struct rpc_pipe_client *result;
2664 struct sockaddr_un addr;
2665 NTSTATUS status;
2666 int fd;
2667 socklen_t salen;
2669 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2670 if (result == NULL) {
2671 return NT_STATUS_NO_MEMORY;
2674 result->abstract_syntax = *abstract_syntax;
2675 result->transfer_syntax = ndr_transfer_syntax_ndr;
2677 result->desthost = get_myname(result);
2678 result->srv_name_slash = talloc_asprintf_strupper_m(
2679 result, "\\\\%s", result->desthost);
2680 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2681 status = NT_STATUS_NO_MEMORY;
2682 goto fail;
2685 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2686 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2688 fd = socket(AF_UNIX, SOCK_STREAM, 0);
2689 if (fd == -1) {
2690 status = map_nt_error_from_unix(errno);
2691 goto fail;
2694 ZERO_STRUCT(addr);
2695 addr.sun_family = AF_UNIX;
2696 strlcpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
2697 salen = sizeof(struct sockaddr_un);
2699 if (connect(fd, (struct sockaddr *)(void *)&addr, salen) == -1) {
2700 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
2701 strerror(errno)));
2702 close(fd);
2703 return map_nt_error_from_unix(errno);
2706 status = rpc_transport_sock_init(result, fd, &result->transport);
2707 if (!NT_STATUS_IS_OK(status)) {
2708 close(fd);
2709 goto fail;
2712 result->transport->transport = NCALRPC;
2714 result->binding_handle = rpccli_bh_create(result);
2715 if (result->binding_handle == NULL) {
2716 TALLOC_FREE(result);
2717 return NT_STATUS_NO_MEMORY;
2720 *presult = result;
2721 return NT_STATUS_OK;
2723 fail:
2724 TALLOC_FREE(result);
2725 return status;
2728 struct rpc_pipe_client_np_ref {
2729 struct cli_state *cli;
2730 struct rpc_pipe_client *pipe;
2733 static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
2735 DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
2736 return 0;
2739 /****************************************************************************
2740 Open a named pipe over SMB to a remote server.
2742 * CAVEAT CALLER OF THIS FUNCTION:
2743 * The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
2744 * so be sure that this function is called AFTER any structure (vs pointer)
2745 * assignment of the cli. In particular, libsmbclient does structure
2746 * assignments of cli, which invalidates the data in the returned
2747 * rpc_pipe_client if this function is called before the structure assignment
2748 * of cli.
2750 ****************************************************************************/
2752 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
2753 const struct ndr_syntax_id *abstract_syntax,
2754 struct rpc_pipe_client **presult)
2756 struct rpc_pipe_client *result;
2757 NTSTATUS status;
2758 struct rpc_pipe_client_np_ref *np_ref;
2760 /* sanity check to protect against crashes */
2762 if ( !cli ) {
2763 return NT_STATUS_INVALID_HANDLE;
2766 result = talloc_zero(NULL, struct rpc_pipe_client);
2767 if (result == NULL) {
2768 return NT_STATUS_NO_MEMORY;
2771 result->abstract_syntax = *abstract_syntax;
2772 result->transfer_syntax = ndr_transfer_syntax_ndr;
2773 result->desthost = talloc_strdup(result, smbXcli_conn_remote_name(cli->conn));
2774 result->srv_name_slash = talloc_asprintf_strupper_m(
2775 result, "\\\\%s", result->desthost);
2777 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2778 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2780 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2781 TALLOC_FREE(result);
2782 return NT_STATUS_NO_MEMORY;
2785 status = rpc_transport_np_init(result, cli, abstract_syntax,
2786 &result->transport);
2787 if (!NT_STATUS_IS_OK(status)) {
2788 TALLOC_FREE(result);
2789 return status;
2792 result->transport->transport = NCACN_NP;
2794 np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
2795 if (np_ref == NULL) {
2796 TALLOC_FREE(result);
2797 return NT_STATUS_NO_MEMORY;
2799 np_ref->cli = cli;
2800 np_ref->pipe = result;
2802 DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
2803 talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
2805 result->binding_handle = rpccli_bh_create(result);
2806 if (result->binding_handle == NULL) {
2807 TALLOC_FREE(result);
2808 return NT_STATUS_NO_MEMORY;
2811 *presult = result;
2812 return NT_STATUS_OK;
2815 /****************************************************************************
2816 Open a pipe to a remote server.
2817 ****************************************************************************/
2819 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
2820 enum dcerpc_transport_t transport,
2821 const struct ndr_syntax_id *interface,
2822 struct rpc_pipe_client **presult)
2824 switch (transport) {
2825 case NCACN_IP_TCP:
2826 return rpc_pipe_open_tcp(NULL,
2827 smbXcli_conn_remote_name(cli->conn),
2828 smbXcli_conn_remote_sockaddr(cli->conn),
2829 interface, presult);
2830 case NCACN_NP:
2831 return rpc_pipe_open_np(cli, interface, presult);
2832 default:
2833 return NT_STATUS_NOT_IMPLEMENTED;
2837 /****************************************************************************
2838 Open a named pipe to an SMB server and bind anonymously.
2839 ****************************************************************************/
2841 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
2842 enum dcerpc_transport_t transport,
2843 const struct ndr_syntax_id *interface,
2844 struct rpc_pipe_client **presult)
2846 struct rpc_pipe_client *result;
2847 struct pipe_auth_data *auth;
2848 NTSTATUS status;
2850 status = cli_rpc_pipe_open(cli, transport, interface, &result);
2851 if (!NT_STATUS_IS_OK(status)) {
2852 return status;
2855 status = rpccli_anon_bind_data(result, &auth);
2856 if (!NT_STATUS_IS_OK(status)) {
2857 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
2858 nt_errstr(status)));
2859 TALLOC_FREE(result);
2860 return status;
2864 * This is a bit of an abstraction violation due to the fact that an
2865 * anonymous bind on an authenticated SMB inherits the user/domain
2866 * from the enclosing SMB creds
2869 TALLOC_FREE(auth->user_name);
2870 TALLOC_FREE(auth->domain);
2872 auth->user_name = talloc_strdup(auth, cli->user_name);
2873 auth->domain = talloc_strdup(auth, cli->domain);
2875 if (transport == NCACN_NP) {
2876 struct smbXcli_session *session;
2878 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
2879 session = cli->smb2.session;
2880 } else {
2881 session = cli->smb1.session;
2884 status = smbXcli_session_application_key(session, auth,
2885 &auth->transport_session_key);
2886 if (!NT_STATUS_IS_OK(status)) {
2887 auth->transport_session_key = data_blob_null;
2891 if ((auth->user_name == NULL) || (auth->domain == NULL)) {
2892 TALLOC_FREE(result);
2893 return NT_STATUS_NO_MEMORY;
2896 status = rpc_pipe_bind(result, auth);
2897 if (!NT_STATUS_IS_OK(status)) {
2898 int lvl = 0;
2899 if (ndr_syntax_id_equal(interface,
2900 &ndr_table_dssetup.syntax_id)) {
2901 /* non AD domains just don't have this pipe, avoid
2902 * level 0 statement in that case - gd */
2903 lvl = 3;
2905 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
2906 "%s failed with error %s\n",
2907 get_pipe_name_from_syntax(talloc_tos(), interface),
2908 nt_errstr(status) ));
2909 TALLOC_FREE(result);
2910 return status;
2913 DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
2914 "%s and bound anonymously.\n",
2915 get_pipe_name_from_syntax(talloc_tos(), interface),
2916 result->desthost));
2918 *presult = result;
2919 return NT_STATUS_OK;
2922 /****************************************************************************
2923 ****************************************************************************/
2925 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
2926 const struct ndr_syntax_id *interface,
2927 struct rpc_pipe_client **presult)
2929 return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
2930 interface, presult);
2933 /****************************************************************************
2934 Open a named pipe to an SMB server and bind using the mech specified
2935 ****************************************************************************/
2937 NTSTATUS cli_rpc_pipe_open_generic_auth(struct cli_state *cli,
2938 const struct ndr_interface_table *table,
2939 enum dcerpc_transport_t transport,
2940 enum dcerpc_AuthType auth_type,
2941 enum dcerpc_AuthLevel auth_level,
2942 const char *server,
2943 const char *domain,
2944 const char *username,
2945 const char *password,
2946 struct rpc_pipe_client **presult)
2948 struct rpc_pipe_client *result;
2949 struct pipe_auth_data *auth = NULL;
2950 const char *target_service = table->authservices->names[0];
2952 NTSTATUS status;
2954 status = cli_rpc_pipe_open(cli, transport, &table->syntax_id, &result);
2955 if (!NT_STATUS_IS_OK(status)) {
2956 return status;
2959 status = rpccli_generic_bind_data(result,
2960 auth_type, auth_level,
2961 server, target_service,
2962 domain, username, password,
2963 CRED_AUTO_USE_KERBEROS,
2964 &auth);
2965 if (!NT_STATUS_IS_OK(status)) {
2966 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
2967 nt_errstr(status)));
2968 goto err;
2971 status = rpc_pipe_bind(result, auth);
2972 if (!NT_STATUS_IS_OK(status)) {
2973 DEBUG(0, ("cli_rpc_pipe_open_generic_auth: cli_rpc_pipe_bind failed with error %s\n",
2974 nt_errstr(status) ));
2975 goto err;
2978 DEBUG(10,("cli_rpc_pipe_open_generic_auth: opened pipe %s to "
2979 "machine %s and bound as user %s\\%s.\n", table->name,
2980 result->desthost, domain, username));
2982 *presult = result;
2983 return NT_STATUS_OK;
2985 err:
2987 TALLOC_FREE(result);
2988 return status;
2991 /****************************************************************************
2992 External interface.
2993 Open a named pipe to an SMB server and bind using schannel (bind type 68)
2994 using session_key. sign and seal.
2996 The *pdc will be stolen onto this new pipe
2997 ****************************************************************************/
2999 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
3000 const struct ndr_syntax_id *interface,
3001 enum dcerpc_transport_t transport,
3002 enum dcerpc_AuthLevel auth_level,
3003 const char *domain,
3004 struct netlogon_creds_CredentialState **pdc,
3005 struct rpc_pipe_client **presult)
3007 struct rpc_pipe_client *result;
3008 struct pipe_auth_data *auth;
3009 NTSTATUS status;
3011 status = cli_rpc_pipe_open(cli, transport, interface, &result);
3012 if (!NT_STATUS_IS_OK(status)) {
3013 return status;
3016 status = rpccli_schannel_bind_data(result, domain, auth_level,
3017 *pdc, &auth);
3018 if (!NT_STATUS_IS_OK(status)) {
3019 DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
3020 nt_errstr(status)));
3021 TALLOC_FREE(result);
3022 return status;
3025 status = rpc_pipe_bind(result, auth);
3026 if (!NT_STATUS_IS_OK(status)) {
3027 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
3028 "cli_rpc_pipe_bind failed with error %s\n",
3029 nt_errstr(status) ));
3030 TALLOC_FREE(result);
3031 return status;
3035 * The credentials on a new netlogon pipe are the ones we are passed
3036 * in - copy them over
3038 if (result->dc == NULL) {
3039 result->dc = netlogon_creds_copy(result, *pdc);
3040 if (result->dc == NULL) {
3041 TALLOC_FREE(result);
3042 return NT_STATUS_NO_MEMORY;
3046 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
3047 "for domain %s and bound using schannel.\n",
3048 get_pipe_name_from_syntax(talloc_tos(), interface),
3049 result->desthost, domain));
3051 *presult = result;
3052 return NT_STATUS_OK;
3055 NTSTATUS cli_rpc_pipe_open_spnego(struct cli_state *cli,
3056 const struct ndr_interface_table *table,
3057 enum dcerpc_transport_t transport,
3058 const char *oid,
3059 enum dcerpc_AuthLevel auth_level,
3060 const char *server,
3061 const char *domain,
3062 const char *username,
3063 const char *password,
3064 struct rpc_pipe_client **presult)
3066 struct rpc_pipe_client *result;
3067 struct pipe_auth_data *auth = NULL;
3068 const char *target_service = table->authservices->names[0];
3070 NTSTATUS status;
3071 enum credentials_use_kerberos use_kerberos;
3073 if (strcmp(oid, GENSEC_OID_KERBEROS5) == 0) {
3074 use_kerberos = CRED_MUST_USE_KERBEROS;
3075 } else if (strcmp(oid, GENSEC_OID_NTLMSSP) == 0) {
3076 use_kerberos = CRED_DONT_USE_KERBEROS;
3077 } else {
3078 return NT_STATUS_INVALID_PARAMETER;
3081 status = cli_rpc_pipe_open(cli, transport, &table->syntax_id, &result);
3082 if (!NT_STATUS_IS_OK(status)) {
3083 return status;
3086 status = rpccli_generic_bind_data(result,
3087 DCERPC_AUTH_TYPE_SPNEGO, auth_level,
3088 server, target_service,
3089 domain, username, password,
3090 use_kerberos,
3091 &auth);
3092 if (!NT_STATUS_IS_OK(status)) {
3093 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
3094 nt_errstr(status)));
3095 goto err;
3098 status = rpc_pipe_bind(result, auth);
3099 if (!NT_STATUS_IS_OK(status)) {
3100 DEBUG(0, ("cli_rpc_pipe_open_spnego: cli_rpc_pipe_bind failed with error %s\n",
3101 nt_errstr(status) ));
3102 goto err;
3105 DEBUG(10,("cli_rpc_pipe_open_spnego: opened pipe %s to "
3106 "machine %s.\n", table->name,
3107 result->desthost));
3109 *presult = result;
3110 return NT_STATUS_OK;
3112 err:
3114 TALLOC_FREE(result);
3115 return status;
3118 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
3119 struct rpc_pipe_client *cli,
3120 DATA_BLOB *session_key)
3122 NTSTATUS status;
3123 struct pipe_auth_data *a;
3124 struct schannel_state *schannel_auth;
3125 struct gensec_security *gensec_security;
3126 DATA_BLOB sk = data_blob_null;
3127 bool make_dup = false;
3129 if (!session_key || !cli) {
3130 return NT_STATUS_INVALID_PARAMETER;
3133 a = cli->auth;
3135 if (a == NULL) {
3136 return NT_STATUS_INVALID_PARAMETER;
3139 switch (cli->auth->auth_type) {
3140 case DCERPC_AUTH_TYPE_SCHANNEL:
3141 schannel_auth = talloc_get_type_abort(a->auth_ctx,
3142 struct schannel_state);
3143 sk = data_blob_const(schannel_auth->creds->session_key, 16);
3144 make_dup = true;
3145 break;
3146 case DCERPC_AUTH_TYPE_SPNEGO:
3147 case DCERPC_AUTH_TYPE_NTLMSSP:
3148 case DCERPC_AUTH_TYPE_KRB5:
3149 gensec_security = talloc_get_type_abort(a->auth_ctx,
3150 struct gensec_security);
3151 status = gensec_session_key(gensec_security, mem_ctx, &sk);
3152 if (!NT_STATUS_IS_OK(status)) {
3153 return status;
3155 make_dup = false;
3156 break;
3157 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
3158 case DCERPC_AUTH_TYPE_NONE:
3159 sk = data_blob_const(a->transport_session_key.data,
3160 a->transport_session_key.length);
3161 make_dup = true;
3162 break;
3163 default:
3164 break;
3167 if (!sk.data) {
3168 return NT_STATUS_NO_USER_SESSION_KEY;
3171 if (make_dup) {
3172 *session_key = data_blob_dup_talloc(mem_ctx, sk);
3173 } else {
3174 *session_key = sk;
3177 return NT_STATUS_OK;