?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Add samba.tests.source, which checks Python files for copyright lines, license header...
[Samba/gebeck_regimport.git] / source3 / rpc_client / cli_pipe.c
blobe352c8630095ef469c5d7b3a2c8a83f576878759
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client routines
4 * Largely rewritten by Jeremy Allison 2005.
5 * Heavily modified by Simo Sorce 2010.
6 *
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
11 *
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
16 *
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
19 */
20
21 #include "includes.h"
22 #include "../lib/util/tevent_ntstatus.h"
23 #include "librpc/gen_ndr/ndr_epmapper_c.h"
24 #include "../librpc/gen_ndr/ndr_schannel.h"
25 #include "../librpc/gen_ndr/ndr_dssetup.h"
26 #include "../libcli/auth/schannel.h"
27 #include "../libcli/auth/spnego.h"
28 #include "../libcli/auth/ntlmssp.h"
29 #include "ntlmssp_wrap.h"
30 #include "librpc/gen_ndr/ndr_dcerpc.h"
31 #include "librpc/rpc/dcerpc.h"
32 #include "librpc/crypto/gse.h"
33 #include "librpc/crypto/spnego.h"
34 #include "rpc_dce.h"
35 #include "cli_pipe.h"
36 #include "libsmb/libsmb.h"
37
38 #undef DBGC_CLASS
39 #define DBGC_CLASS DBGC_RPC_CLI
40
41 /********************************************************************
42 Pipe description for a DEBUG
43 ********************************************************************/
44 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
45 struct rpc_pipe_client *cli)
46 {
47 char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
48 if (result == NULL) {
49 return "pipe";
50 }
51 return result;
52 }
53
54 /********************************************************************
55 Rpc pipe call id.
56 ********************************************************************/
57
58 static uint32 get_rpc_call_id(void)
59 {
60 static uint32 call_id = 0;
61 return ++call_id;
62 }
63
64 /*******************************************************************
65 Use SMBreadX to get rest of one fragment's worth of rpc data.
66 Reads the whole size or give an error message
67 ********************************************************************/
68
69 struct rpc_read_state {
70 struct event_context *ev;
71 struct rpc_cli_transport *transport;
72 uint8_t *data;
73 size_t size;
74 size_t num_read;
75 };
76
77 static void rpc_read_done(struct tevent_req *subreq);
78
79 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
80 struct event_context *ev,
81 struct rpc_cli_transport *transport,
82 uint8_t *data, size_t size)
83 {
84 struct tevent_req *req, *subreq;
85 struct rpc_read_state *state;
86
87 req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
88 if (req == NULL) {
89 return NULL;
90 }
91 state->ev = ev;
92 state->transport = transport;
93 state->data = data;
94 state->size = size;
95 state->num_read = 0;
96
97 DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
98
99 subreq = transport->read_send(state, ev, (uint8_t *)data, size,
100 transport->priv);
101 if (subreq == NULL) {
102 goto fail;
103 }
104 tevent_req_set_callback(subreq, rpc_read_done, req);
105 return req;
106
107 fail:
108 TALLOC_FREE(req);
109 return NULL;
110 }
111
112 static void rpc_read_done(struct tevent_req *subreq)
113 {
114 struct tevent_req *req = tevent_req_callback_data(
115 subreq, struct tevent_req);
116 struct rpc_read_state *state = tevent_req_data(
117 req, struct rpc_read_state);
118 NTSTATUS status;
119 ssize_t received;
120
121 status = state->transport->read_recv(subreq, &received);
122 TALLOC_FREE(subreq);
123 if (!NT_STATUS_IS_OK(status)) {
124 tevent_req_nterror(req, status);
125 return;
126 }
127
128 state->num_read += received;
129 if (state->num_read == state->size) {
130 tevent_req_done(req);
131 return;
132 }
133
134 subreq = state->transport->read_send(state, state->ev,
135 state->data + state->num_read,
136 state->size - state->num_read,
137 state->transport->priv);
138 if (tevent_req_nomem(subreq, req)) {
139 return;
140 }
141 tevent_req_set_callback(subreq, rpc_read_done, req);
142 }
143
144 static NTSTATUS rpc_read_recv(struct tevent_req *req)
145 {
146 return tevent_req_simple_recv_ntstatus(req);
147 }
148
149 struct rpc_write_state {
150 struct event_context *ev;
151 struct rpc_cli_transport *transport;
152 const uint8_t *data;
153 size_t size;
154 size_t num_written;
155 };
156
157 static void rpc_write_done(struct tevent_req *subreq);
158
159 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
160 struct event_context *ev,
161 struct rpc_cli_transport *transport,
162 const uint8_t *data, size_t size)
163 {
164 struct tevent_req *req, *subreq;
165 struct rpc_write_state *state;
166
167 req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
168 if (req == NULL) {
169 return NULL;
170 }
171 state->ev = ev;
172 state->transport = transport;
173 state->data = data;
174 state->size = size;
175 state->num_written = 0;
176
177 DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
178
179 subreq = transport->write_send(state, ev, data, size, transport->priv);
180 if (subreq == NULL) {
181 goto fail;
182 }
183 tevent_req_set_callback(subreq, rpc_write_done, req);
184 return req;
185 fail:
186 TALLOC_FREE(req);
187 return NULL;
188 }
189
190 static void rpc_write_done(struct tevent_req *subreq)
191 {
192 struct tevent_req *req = tevent_req_callback_data(
193 subreq, struct tevent_req);
194 struct rpc_write_state *state = tevent_req_data(
195 req, struct rpc_write_state);
196 NTSTATUS status;
197 ssize_t written;
198
199 status = state->transport->write_recv(subreq, &written);
200 TALLOC_FREE(subreq);
201 if (!NT_STATUS_IS_OK(status)) {
202 tevent_req_nterror(req, status);
203 return;
204 }
205
206 state->num_written += written;
207
208 if (state->num_written == state->size) {
209 tevent_req_done(req);
210 return;
211 }
212
213 subreq = state->transport->write_send(state, state->ev,
214 state->data + state->num_written,
215 state->size - state->num_written,
216 state->transport->priv);
217 if (tevent_req_nomem(subreq, req)) {
218 return;
219 }
220 tevent_req_set_callback(subreq, rpc_write_done, req);
221 }
222
223 static NTSTATUS rpc_write_recv(struct tevent_req *req)
224 {
225 return tevent_req_simple_recv_ntstatus(req);
226 }
227
228
229 /****************************************************************************
230 Try and get a PDU's worth of data from current_pdu. If not, then read more
231 from the wire.
232 ****************************************************************************/
233
234 struct get_complete_frag_state {
235 struct event_context *ev;
236 struct rpc_pipe_client *cli;
237 uint16_t frag_len;
238 DATA_BLOB *pdu;
239 };
240
241 static void get_complete_frag_got_header(struct tevent_req *subreq);
242 static void get_complete_frag_got_rest(struct tevent_req *subreq);
243
244 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
245 struct event_context *ev,
246 struct rpc_pipe_client *cli,
247 DATA_BLOB *pdu)
248 {
249 struct tevent_req *req, *subreq;
250 struct get_complete_frag_state *state;
251 size_t received;
252 NTSTATUS status;
253
254 req = tevent_req_create(mem_ctx, &state,
255 struct get_complete_frag_state);
256 if (req == NULL) {
257 return NULL;
258 }
259 state->ev = ev;
260 state->cli = cli;
261 state->frag_len = RPC_HEADER_LEN;
262 state->pdu = pdu;
263
264 received = pdu->length;
265 if (received < RPC_HEADER_LEN) {
266 if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
267 status = NT_STATUS_NO_MEMORY;
268 goto post_status;
269 }
270 subreq = rpc_read_send(state, state->ev,
271 state->cli->transport,
272 pdu->data + received,
273 RPC_HEADER_LEN - received);
274 if (subreq == NULL) {
275 status = NT_STATUS_NO_MEMORY;
276 goto post_status;
277 }
278 tevent_req_set_callback(subreq, get_complete_frag_got_header,
279 req);
280 return req;
281 }
282
283 state->frag_len = dcerpc_get_frag_length(pdu);
284
285 /*
286 * Ensure we have frag_len bytes of data.
287 */
288 if (received < state->frag_len) {
289 if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
290 status = NT_STATUS_NO_MEMORY;
291 goto post_status;
292 }
293 subreq = rpc_read_send(state, state->ev,
294 state->cli->transport,
295 pdu->data + received,
296 state->frag_len - received);
297 if (subreq == NULL) {
298 status = NT_STATUS_NO_MEMORY;
299 goto post_status;
300 }
301 tevent_req_set_callback(subreq, get_complete_frag_got_rest,
302 req);
303 return req;
304 }
305
306 status = NT_STATUS_OK;
307 post_status:
308 if (NT_STATUS_IS_OK(status)) {
309 tevent_req_done(req);
310 } else {
311 tevent_req_nterror(req, status);
312 }
313 return tevent_req_post(req, ev);
314 }
315
316 static void get_complete_frag_got_header(struct tevent_req *subreq)
317 {
318 struct tevent_req *req = tevent_req_callback_data(
319 subreq, struct tevent_req);
320 struct get_complete_frag_state *state = tevent_req_data(
321 req, struct get_complete_frag_state);
322 NTSTATUS status;
323
324 status = rpc_read_recv(subreq);
325 TALLOC_FREE(subreq);
326 if (!NT_STATUS_IS_OK(status)) {
327 tevent_req_nterror(req, status);
328 return;
329 }
330
331 state->frag_len = dcerpc_get_frag_length(state->pdu);
332
333 if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
334 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
335 return;
336 }
337
338 /*
339 * We're here in this piece of code because we've read exactly
340 * RPC_HEADER_LEN bytes into state->pdu.
341 */
342
343 subreq = rpc_read_send(state, state->ev, state->cli->transport,
344 state->pdu->data + RPC_HEADER_LEN,
345 state->frag_len - RPC_HEADER_LEN);
346 if (tevent_req_nomem(subreq, req)) {
347 return;
348 }
349 tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
350 }
351
352 static void get_complete_frag_got_rest(struct tevent_req *subreq)
353 {
354 struct tevent_req *req = tevent_req_callback_data(
355 subreq, struct tevent_req);
356 NTSTATUS status;
357
358 status = rpc_read_recv(subreq);
359 TALLOC_FREE(subreq);
360 if (!NT_STATUS_IS_OK(status)) {
361 tevent_req_nterror(req, status);
362 return;
363 }
364 tevent_req_done(req);
365 }
366
367 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
368 {
369 return tevent_req_simple_recv_ntstatus(req);
370 }
371
372 /****************************************************************************
373 Do basic authentication checks on an incoming pdu.
374 ****************************************************************************/
375
376 static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
377 struct rpc_pipe_client *cli,
378 struct ncacn_packet *pkt,
379 DATA_BLOB *pdu,
380 uint8_t expected_pkt_type,
381 DATA_BLOB *rdata,
382 DATA_BLOB *reply_pdu)
383 {
384 struct dcerpc_response *r;
385 NTSTATUS ret = NT_STATUS_OK;
386 size_t pad_len = 0;
387
388 /*
389 * Point the return values at the real data including the RPC
390 * header. Just in case the caller wants it.
391 */
392 *rdata = *pdu;
393
394 /* Ensure we have the correct type. */
395 switch (pkt->ptype) {
396 case DCERPC_PKT_ALTER_RESP:
397 case DCERPC_PKT_BIND_ACK:
398
399 /* Client code never receives this kind of packets */
400 break;
401
402
403 case DCERPC_PKT_RESPONSE:
404
405 r = &pkt->u.response;
406
407 /* Here's where we deal with incoming sign/seal. */
408 ret = dcerpc_check_auth(cli->auth, pkt,
409 &r->stub_and_verifier,
410 DCERPC_RESPONSE_LENGTH,
411 pdu, &pad_len);
412 if (!NT_STATUS_IS_OK(ret)) {
413 return ret;
414 }
415
416 if (pkt->frag_length < DCERPC_RESPONSE_LENGTH + pad_len) {
417 return NT_STATUS_BUFFER_TOO_SMALL;
418 }
419
420 /* Point the return values at the NDR data. */
421 rdata->data = r->stub_and_verifier.data;
422
423 if (pkt->auth_length) {
424 /* We've already done integer wrap tests in
425 * dcerpc_check_auth(). */
426 rdata->length = r->stub_and_verifier.length
427 - pad_len
428 - DCERPC_AUTH_TRAILER_LENGTH
429 - pkt->auth_length;
430 } else {
431 rdata->length = r->stub_and_verifier.length;
432 }
433
434 DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
435 (long unsigned int)pdu->length,
436 (long unsigned int)rdata->length,
437 (unsigned int)pad_len));
438
439 /*
440 * If this is the first reply, and the allocation hint is
441 * reasonable, try and set up the reply_pdu DATA_BLOB to the
442 * correct size.
443 */
444
445 if ((reply_pdu->length == 0) &&
446 r->alloc_hint && (r->alloc_hint < 15*1024*1024)) {
447 if (!data_blob_realloc(mem_ctx, reply_pdu,
448 r->alloc_hint)) {
449 DEBUG(0, ("reply alloc hint %d too "
450 "large to allocate\n",
451 (int)r->alloc_hint));
452 return NT_STATUS_NO_MEMORY;
453 }
454 }
455
456 break;
457
458 case DCERPC_PKT_BIND_NAK:
459 DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
460 rpccli_pipe_txt(talloc_tos(), cli)));
461 /* Use this for now... */
462 return NT_STATUS_NETWORK_ACCESS_DENIED;
463
464 case DCERPC_PKT_FAULT:
465
466 DEBUG(1, (__location__ ": RPC fault code %s received "
467 "from %s!\n",
468 dcerpc_errstr(talloc_tos(),
469 pkt->u.fault.status),
470 rpccli_pipe_txt(talloc_tos(), cli)));
471
472 return dcerpc_fault_to_nt_status(pkt->u.fault.status);
473
474 default:
475 DEBUG(0, (__location__ "Unknown packet type %u received "
476 "from %s!\n",
477 (unsigned int)pkt->ptype,
478 rpccli_pipe_txt(talloc_tos(), cli)));
479 return NT_STATUS_INVALID_INFO_CLASS;
480 }
481
482 if (pkt->ptype != expected_pkt_type) {
483 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
484 "RPC packet type - %u, not %u\n",
485 rpccli_pipe_txt(talloc_tos(), cli),
486 pkt->ptype, expected_pkt_type));
487 return NT_STATUS_INVALID_INFO_CLASS;
488 }
489
490 /* Do this just before return - we don't want to modify any rpc header
491 data before now as we may have needed to do cryptographic actions on
492 it before. */
493
494 if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
495 !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
496 DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
497 "fragment first/last ON.\n"));
498 pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
499 }
500
501 return NT_STATUS_OK;
502 }
503
504 /****************************************************************************
505 Call a remote api on an arbitrary pipe. takes param, data and setup buffers.
506 ****************************************************************************/
507
508 struct cli_api_pipe_state {
509 struct event_context *ev;
510 struct rpc_cli_transport *transport;
511 uint8_t *rdata;
512 uint32_t rdata_len;
513 };
514
515 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
516 static void cli_api_pipe_write_done(struct tevent_req *subreq);
517 static void cli_api_pipe_read_done(struct tevent_req *subreq);
518
519 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
520 struct event_context *ev,
521 struct rpc_cli_transport *transport,
522 uint8_t *data, size_t data_len,
523 uint32_t max_rdata_len)
524 {
525 struct tevent_req *req, *subreq;
526 struct cli_api_pipe_state *state;
527 NTSTATUS status;
528
529 req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
530 if (req == NULL) {
531 return NULL;
532 }
533 state->ev = ev;
534 state->transport = transport;
535
536 if (max_rdata_len < RPC_HEADER_LEN) {
537 /*
538 * For a RPC reply we always need at least RPC_HEADER_LEN
539 * bytes. We check this here because we will receive
540 * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
541 */
542 status = NT_STATUS_INVALID_PARAMETER;
543 goto post_status;
544 }
545
546 if (transport->trans_send != NULL) {
547 subreq = transport->trans_send(state, ev, data, data_len,
548 max_rdata_len, transport->priv);
549 if (subreq == NULL) {
550 goto fail;
551 }
552 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
553 return req;
554 }
555
556 /*
557 * If the transport does not provide a "trans" routine, i.e. for
558 * example the ncacn_ip_tcp transport, do the write/read step here.
559 */
560
561 subreq = rpc_write_send(state, ev, transport, data, data_len);
562 if (subreq == NULL) {
563 goto fail;
564 }
565 tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
566 return req;
567
568 post_status:
569 tevent_req_nterror(req, status);
570 return tevent_req_post(req, ev);
571 fail:
572 TALLOC_FREE(req);
573 return NULL;
574 }
575
576 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
577 {
578 struct tevent_req *req = tevent_req_callback_data(
579 subreq, struct tevent_req);
580 struct cli_api_pipe_state *state = tevent_req_data(
581 req, struct cli_api_pipe_state);
582 NTSTATUS status;
583
584 status = state->transport->trans_recv(subreq, state, &state->rdata,
585 &state->rdata_len);
586 TALLOC_FREE(subreq);
587 if (!NT_STATUS_IS_OK(status)) {
588 tevent_req_nterror(req, status);
589 return;
590 }
591 tevent_req_done(req);
592 }
593
594 static void cli_api_pipe_write_done(struct tevent_req *subreq)
595 {
596 struct tevent_req *req = tevent_req_callback_data(
597 subreq, struct tevent_req);
598 struct cli_api_pipe_state *state = tevent_req_data(
599 req, struct cli_api_pipe_state);
600 NTSTATUS status;
601
602 status = rpc_write_recv(subreq);
603 TALLOC_FREE(subreq);
604 if (!NT_STATUS_IS_OK(status)) {
605 tevent_req_nterror(req, status);
606 return;
607 }
608
609 state->rdata = talloc_array(state, uint8_t, RPC_HEADER_LEN);
610 if (tevent_req_nomem(state->rdata, req)) {
611 return;
612 }
613
614 /*
615 * We don't need to use rpc_read_send here, the upper layer will cope
616 * with a short read, transport->trans_send could also return less
617 * than state->max_rdata_len.
618 */
619 subreq = state->transport->read_send(state, state->ev, state->rdata,
620 RPC_HEADER_LEN,
621 state->transport->priv);
622 if (tevent_req_nomem(subreq, req)) {
623 return;
624 }
625 tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
626 }
627
628 static void cli_api_pipe_read_done(struct tevent_req *subreq)
629 {
630 struct tevent_req *req = tevent_req_callback_data(
631 subreq, struct tevent_req);
632 struct cli_api_pipe_state *state = tevent_req_data(
633 req, struct cli_api_pipe_state);
634 NTSTATUS status;
635 ssize_t received;
636
637 status = state->transport->read_recv(subreq, &received);
638 TALLOC_FREE(subreq);
639 if (!NT_STATUS_IS_OK(status)) {
640 tevent_req_nterror(req, status);
641 return;
642 }
643 state->rdata_len = received;
644 tevent_req_done(req);
645 }
646
647 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
648 uint8_t **prdata, uint32_t *prdata_len)
649 {
650 struct cli_api_pipe_state *state = tevent_req_data(
651 req, struct cli_api_pipe_state);
652 NTSTATUS status;
653
654 if (tevent_req_is_nterror(req, &status)) {
655 return status;
656 }
657
658 *prdata = talloc_move(mem_ctx, &state->rdata);
659 *prdata_len = state->rdata_len;
660 return NT_STATUS_OK;
661 }
662
663 /****************************************************************************
664 Send data on an rpc pipe via trans. The data must be the last
665 pdu fragment of an NDR data stream.
666
667 Receive response data from an rpc pipe, which may be large...
668
669 Read the first fragment: unfortunately have to use SMBtrans for the first
670 bit, then SMBreadX for subsequent bits.
671
672 If first fragment received also wasn't the last fragment, continue
673 getting fragments until we _do_ receive the last fragment.
674
675 Request/Response PDU's look like the following...
676
677 |<------------------PDU len----------------------------------------------->|
678 |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
679
680 +------------+-----------------+-------------+---------------+-------------+
681 | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR | AUTH DATA |
682 +------------+-----------------+-------------+---------------+-------------+
683
684 Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
685 signing & sealing being negotiated.
686
687 ****************************************************************************/
688
689 struct rpc_api_pipe_state {
690 struct event_context *ev;
691 struct rpc_pipe_client *cli;
692 uint8_t expected_pkt_type;
693
694 DATA_BLOB incoming_frag;
695 struct ncacn_packet *pkt;
696
697 /* Incoming reply */
698 DATA_BLOB reply_pdu;
699 size_t reply_pdu_offset;
700 uint8_t endianess;
701 };
702
703 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
704 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
705 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq);
706
707 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
708 struct event_context *ev,
709 struct rpc_pipe_client *cli,
710 DATA_BLOB *data, /* Outgoing PDU */
711 uint8_t expected_pkt_type)
712 {
713 struct tevent_req *req, *subreq;
714 struct rpc_api_pipe_state *state;
715 uint16_t max_recv_frag;
716 NTSTATUS status;
717
718 req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
719 if (req == NULL) {
720 return NULL;
721 }
722 state->ev = ev;
723 state->cli = cli;
724 state->expected_pkt_type = expected_pkt_type;
725 state->incoming_frag = data_blob_null;
726 state->reply_pdu = data_blob_null;
727 state->reply_pdu_offset = 0;
728 state->endianess = DCERPC_DREP_LE;
729
730 /*
731 * Ensure we're not sending too much.
732 */
733 if (data->length > cli->max_xmit_frag) {
734 status = NT_STATUS_INVALID_PARAMETER;
735 goto post_status;
736 }
737
738 DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
739
740 if (state->expected_pkt_type == DCERPC_PKT_AUTH3) {
741 subreq = rpc_write_send(state, ev, cli->transport,
742 data->data, data->length);
743 if (subreq == NULL) {
744 goto fail;
745 }
746 tevent_req_set_callback(subreq, rpc_api_pipe_auth3_done, req);
747 return req;
748 }
749
750 /* get the header first, then fetch the rest once we have
751 * the frag_length available */
752 max_recv_frag = RPC_HEADER_LEN;
753
754 subreq = cli_api_pipe_send(state, ev, cli->transport,
755 data->data, data->length, max_recv_frag);
756 if (subreq == NULL) {
757 goto fail;
758 }
759 tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
760 return req;
761
762 post_status:
763 tevent_req_nterror(req, status);
764 return tevent_req_post(req, ev);
765 fail:
766 TALLOC_FREE(req);
767 return NULL;
768 }
769
770 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq)
771 {
772 struct tevent_req *req =
773 tevent_req_callback_data(subreq,
774 struct tevent_req);
775 NTSTATUS status;
776
777 status = rpc_write_recv(subreq);
778 TALLOC_FREE(subreq);
779 if (!NT_STATUS_IS_OK(status)) {
780 tevent_req_nterror(req, status);
781 return;
782 }
783
784 tevent_req_done(req);
785 }
786
787 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
788 {
789 struct tevent_req *req = tevent_req_callback_data(
790 subreq, struct tevent_req);
791 struct rpc_api_pipe_state *state = tevent_req_data(
792 req, struct rpc_api_pipe_state);
793 NTSTATUS status;
794 uint8_t *rdata = NULL;
795 uint32_t rdata_len = 0;
796
797 status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
798 TALLOC_FREE(subreq);
799 if (!NT_STATUS_IS_OK(status)) {
800 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
801 tevent_req_nterror(req, status);
802 return;
803 }
804
805 if (rdata == NULL) {
806 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
807 rpccli_pipe_txt(talloc_tos(), state->cli)));
808 tevent_req_done(req);
809 return;
810 }
811
812 /*
813 * Move data on state->incoming_frag.
814 */
815 state->incoming_frag.data = talloc_move(state, &rdata);
816 state->incoming_frag.length = rdata_len;
817 if (!state->incoming_frag.data) {
818 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
819 return;
820 }
821
822 /* Ensure we have enough data for a pdu. */
823 subreq = get_complete_frag_send(state, state->ev, state->cli,
824 &state->incoming_frag);
825 if (tevent_req_nomem(subreq, req)) {
826 return;
827 }
828 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
829 }
830
831 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
832 {
833 struct tevent_req *req = tevent_req_callback_data(
834 subreq, struct tevent_req);
835 struct rpc_api_pipe_state *state = tevent_req_data(
836 req, struct rpc_api_pipe_state);
837 NTSTATUS status;
838 DATA_BLOB rdata = data_blob_null;
839
840 status = get_complete_frag_recv(subreq);
841 TALLOC_FREE(subreq);
842 if (!NT_STATUS_IS_OK(status)) {
843 DEBUG(5, ("get_complete_frag failed: %s\n",
844 nt_errstr(status)));
845 tevent_req_nterror(req, status);
846 return;
847 }
848
849 state->pkt = talloc(state, struct ncacn_packet);
850 if (!state->pkt) {
851 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
852 return;
853 }
854
855 status = dcerpc_pull_ncacn_packet(state->pkt,
856 &state->incoming_frag,
857 state->pkt,
858 !state->endianess);
859 if (!NT_STATUS_IS_OK(status)) {
860 tevent_req_nterror(req, status);
861 return;
862 }
863
864 if (state->incoming_frag.length != state->pkt->frag_length) {
865 DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
866 (unsigned int)state->incoming_frag.length,
867 (unsigned int)state->pkt->frag_length));
868 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
869 return;
870 }
871
872 status = cli_pipe_validate_current_pdu(state,
873 state->cli, state->pkt,
874 &state->incoming_frag,
875 state->expected_pkt_type,
876 &rdata,
877 &state->reply_pdu);
878
879 DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
880 (unsigned)state->incoming_frag.length,
881 (unsigned)state->reply_pdu_offset,
882 nt_errstr(status)));
883
884 if (!NT_STATUS_IS_OK(status)) {
885 tevent_req_nterror(req, status);
886 return;
887 }
888
889 if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
890 && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
891 /*
892 * Set the data type correctly for big-endian data on the
893 * first packet.
894 */
895 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
896 "big-endian.\n",
897 rpccli_pipe_txt(talloc_tos(), state->cli)));
898 state->endianess = 0x00; /* BIG ENDIAN */
899 }
900 /*
901 * Check endianness on subsequent packets.
902 */
903 if (state->endianess != state->pkt->drep[0]) {
904 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
905 "%s\n",
906 state->endianess?"little":"big",
907 state->pkt->drep[0]?"little":"big"));
908 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
909 return;
910 }
911
912 /* Now copy the data portion out of the pdu into rbuf. */
913 if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
914 if (!data_blob_realloc(NULL, &state->reply_pdu,
915 state->reply_pdu_offset + rdata.length)) {
916 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
917 return;
918 }
919 }
920
921 memcpy(state->reply_pdu.data + state->reply_pdu_offset,
922 rdata.data, rdata.length);
923 state->reply_pdu_offset += rdata.length;
924
925 /* reset state->incoming_frag, there is no need to free it,
926 * it will be reallocated to the right size the next time
927 * it is used */
928 state->incoming_frag.length = 0;
929
930 if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
931 /* make sure the pdu length is right now that we
932 * have all the data available (alloc hint may
933 * have allocated more than was actually used) */
934 state->reply_pdu.length = state->reply_pdu_offset;
935 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
936 rpccli_pipe_txt(talloc_tos(), state->cli),
937 (unsigned)state->reply_pdu.length));
938 tevent_req_done(req);
939 return;
940 }
941
942 subreq = get_complete_frag_send(state, state->ev, state->cli,
943 &state->incoming_frag);
944 if (tevent_req_nomem(subreq, req)) {
945 return;
946 }
947 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
948 }
949
950 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
951 struct ncacn_packet **pkt,
952 DATA_BLOB *reply_pdu)
953 {
954 struct rpc_api_pipe_state *state = tevent_req_data(
955 req, struct rpc_api_pipe_state);
956 NTSTATUS status;
957
958 if (tevent_req_is_nterror(req, &status)) {
959 return status;
960 }
961
962 /* return data to caller and assign it ownership of memory */
963 if (reply_pdu) {
964 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
965 reply_pdu->length = state->reply_pdu.length;
966 state->reply_pdu.length = 0;
967 } else {
968 data_blob_free(&state->reply_pdu);
969 }
970
971 if (pkt) {
972 *pkt = talloc_steal(mem_ctx, state->pkt);
973 }
974
975 return NT_STATUS_OK;
976 }
977
978 /*******************************************************************
979 Creates spnego auth bind.
980 ********************************************************************/
981
982 static NTSTATUS create_spnego_auth_bind_req(TALLOC_CTX *mem_ctx,
983 struct pipe_auth_data *auth,
984 DATA_BLOB *auth_token)
985 {
986 struct spnego_context *spnego_ctx;
987 DATA_BLOB in_token = data_blob_null;
988 NTSTATUS status;
989
990 spnego_ctx = talloc_get_type_abort(auth->auth_ctx,
991 struct spnego_context);
992
993 /* Negotiate the initial auth token */
994 status = spnego_get_client_auth_token(mem_ctx, spnego_ctx,
995 &in_token, auth_token);
996 if (!NT_STATUS_IS_OK(status)) {
997 return status;
998 }
999
1000 DEBUG(5, ("Created GSS Authentication Token:\n"));
1001 dump_data(5, auth_token->data, auth_token->length);
1002
1003 return NT_STATUS_OK;
1004 }
1005
1006 /*******************************************************************
1007 Creates krb5 auth bind.
1008 ********************************************************************/
1009
1010 static NTSTATUS create_gssapi_auth_bind_req(TALLOC_CTX *mem_ctx,
1011 struct pipe_auth_data *auth,
1012 DATA_BLOB *auth_token)
1013 {
1014 struct gse_context *gse_ctx;
1015 DATA_BLOB in_token = data_blob_null;
1016 NTSTATUS status;
1017
1018 gse_ctx = talloc_get_type_abort(auth->auth_ctx,
1019 struct gse_context);
1020
1021 /* Negotiate the initial auth token */
1022 status = gse_get_client_auth_token(mem_ctx, gse_ctx,
1023 &in_token,
1024 auth_token);
1025 if (!NT_STATUS_IS_OK(status)) {
1026 return status;
1027 }
1028
1029 DEBUG(5, ("Created GSS Authentication Token:\n"));
1030 dump_data(5, auth_token->data, auth_token->length);
1031
1032 return NT_STATUS_OK;
1033 }
1034
1035 /*******************************************************************
1036 Creates NTLMSSP auth bind.
1037 ********************************************************************/
1038
1039 static NTSTATUS create_ntlmssp_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1040 TALLOC_CTX *mem_ctx,
1041 DATA_BLOB *auth_token)
1042 {
1043 struct auth_ntlmssp_state *ntlmssp_ctx;
1044 DATA_BLOB null_blob = data_blob_null;
1045 NTSTATUS status;
1046
1047 ntlmssp_ctx = talloc_get_type_abort(cli->auth->auth_ctx,
1048 struct auth_ntlmssp_state);
1049
1050 DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1051 status = auth_ntlmssp_update(ntlmssp_ctx, mem_ctx, null_blob, auth_token);
1052
1053 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1054 data_blob_free(auth_token);
1055 return status;
1056 }
1057
1058 DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1059 dump_data(5, auth_token->data, auth_token->length);
1060
1061 return NT_STATUS_OK;
1062 }
1063
1064 /*******************************************************************
1065 Creates schannel auth bind.
1066 ********************************************************************/
1067
1068 static NTSTATUS create_schannel_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1069 DATA_BLOB *auth_token)
1070 {
1071 NTSTATUS status;
1072 struct NL_AUTH_MESSAGE r;
1073
1074 /* Use lp_workgroup() if domain not specified */
1075
1076 if (!cli->auth->domain || !cli->auth->domain[0]) {
1077 cli->auth->domain = talloc_strdup(cli, lp_workgroup());
1078 if (cli->auth->domain == NULL) {
1079 return NT_STATUS_NO_MEMORY;
1080 }
1081 }
1082
1083 /*
1084 * Now marshall the data into the auth parse_struct.
1085 */
1086
1087 r.MessageType = NL_NEGOTIATE_REQUEST;
1088 r.Flags = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
1089 NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
1090 r.oem_netbios_domain.a = cli->auth->domain;
1091 r.oem_netbios_computer.a = lp_netbios_name();
1092
1093 status = dcerpc_push_schannel_bind(cli, &r, auth_token);
1094 if (!NT_STATUS_IS_OK(status)) {
1095 return status;
1096 }
1097
1098 return NT_STATUS_OK;
1099 }
1100
1101 /*******************************************************************
1102 Creates the internals of a DCE/RPC bind request or alter context PDU.
1103 ********************************************************************/
1104
1105 static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
1106 enum dcerpc_pkt_type ptype,
1107 uint32 rpc_call_id,
1108 const struct ndr_syntax_id *abstract,
1109 const struct ndr_syntax_id *transfer,
1110 const DATA_BLOB *auth_info,
1111 DATA_BLOB *blob)
1112 {
1113 uint16 auth_len = auth_info->length;
1114 NTSTATUS status;
1115 union dcerpc_payload u;
1116 struct dcerpc_ctx_list ctx_list;
1117
1118 if (auth_len) {
1119 auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
1120 }
1121
1122 ctx_list.context_id = 0;
1123 ctx_list.num_transfer_syntaxes = 1;
1124 ctx_list.abstract_syntax = *abstract;
1125 ctx_list.transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer);
1126
1127 u.bind.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1128 u.bind.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1129 u.bind.assoc_group_id = 0x0;
1130 u.bind.num_contexts = 1;
1131 u.bind.ctx_list = &ctx_list;
1132 u.bind.auth_info = *auth_info;
1133
1134 status = dcerpc_push_ncacn_packet(mem_ctx,
1135 ptype,
1136 DCERPC_PFC_FLAG_FIRST |
1137 DCERPC_PFC_FLAG_LAST,
1138 auth_len,
1139 rpc_call_id,
1140 &u,
1141 blob);
1142 if (!NT_STATUS_IS_OK(status)) {
1143 DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
1144 return status;
1145 }
1146
1147 return NT_STATUS_OK;
1148 }
1149
1150 /*******************************************************************
1151 Creates a DCE/RPC bind request.
1152 ********************************************************************/
1153
1154 static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
1155 struct rpc_pipe_client *cli,
1156 struct pipe_auth_data *auth,
1157 uint32 rpc_call_id,
1158 const struct ndr_syntax_id *abstract,
1159 const struct ndr_syntax_id *transfer,
1160 DATA_BLOB *rpc_out)
1161 {
1162 DATA_BLOB auth_token = data_blob_null;
1163 DATA_BLOB auth_info = data_blob_null;
1164 NTSTATUS ret = NT_STATUS_OK;
1165
1166 switch (auth->auth_type) {
1167 case DCERPC_AUTH_TYPE_SCHANNEL:
1168 ret = create_schannel_auth_rpc_bind_req(cli, &auth_token);
1169 if (!NT_STATUS_IS_OK(ret)) {
1170 return ret;
1171 }
1172 break;
1173
1174 case DCERPC_AUTH_TYPE_NTLMSSP:
1175 ret = create_ntlmssp_auth_rpc_bind_req(cli, mem_ctx, &auth_token);
1176 if (!NT_STATUS_IS_OK(ret)) {
1177 return ret;
1178 }
1179 break;
1180
1181 case DCERPC_AUTH_TYPE_SPNEGO:
1182 ret = create_spnego_auth_bind_req(cli, auth, &auth_token);
1183 if (!NT_STATUS_IS_OK(ret)) {
1184 return ret;
1185 }
1186 break;
1187
1188 case DCERPC_AUTH_TYPE_KRB5:
1189 ret = create_gssapi_auth_bind_req(mem_ctx, auth, &auth_token);
1190 if (!NT_STATUS_IS_OK(ret)) {
1191 return ret;
1192 }
1193 break;
1194
1195 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1196 auth_token = data_blob_talloc(mem_ctx,
1197 "NCALRPC_AUTH_TOKEN",
1198 18);
1199 break;
1200
1201 case DCERPC_AUTH_TYPE_NONE:
1202 break;
1203
1204 default:
1205 /* "Can't" happen. */
1206 return NT_STATUS_INVALID_INFO_CLASS;
1207 }
1208
1209 if (auth_token.length != 0) {
1210 ret = dcerpc_push_dcerpc_auth(cli,
1211 auth->auth_type,
1212 auth->auth_level,
1213 0, /* auth_pad_length */
1214 1, /* auth_context_id */
1215 &auth_token,
1216 &auth_info);
1217 if (!NT_STATUS_IS_OK(ret)) {
1218 return ret;
1219 }
1220 data_blob_free(&auth_token);
1221 }
1222
1223 ret = create_bind_or_alt_ctx_internal(mem_ctx,
1224 DCERPC_PKT_BIND,
1225 rpc_call_id,
1226 abstract,
1227 transfer,
1228 &auth_info,
1229 rpc_out);
1230 return ret;
1231 }
1232
1233 /*******************************************************************
1234 External interface.
1235 Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
1236 Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
1237 and deals with signing/sealing details.
1238 ********************************************************************/
1239
1240 struct rpc_api_pipe_req_state {
1241 struct event_context *ev;
1242 struct rpc_pipe_client *cli;
1243 uint8_t op_num;
1244 uint32_t call_id;
1245 DATA_BLOB *req_data;
1246 uint32_t req_data_sent;
1247 DATA_BLOB rpc_out;
1248 DATA_BLOB reply_pdu;
1249 };
1250
1251 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
1252 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
1253 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1254 bool *is_last_frag);
1255
1256 struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
1257 struct event_context *ev,
1258 struct rpc_pipe_client *cli,
1259 uint8_t op_num,
1260 DATA_BLOB *req_data)
1261 {
1262 struct tevent_req *req, *subreq;
1263 struct rpc_api_pipe_req_state *state;
1264 NTSTATUS status;
1265 bool is_last_frag;
1266
1267 req = tevent_req_create(mem_ctx, &state,
1268 struct rpc_api_pipe_req_state);
1269 if (req == NULL) {
1270 return NULL;
1271 }
1272 state->ev = ev;
1273 state->cli = cli;
1274 state->op_num = op_num;
1275 state->req_data = req_data;
1276 state->req_data_sent = 0;
1277 state->call_id = get_rpc_call_id();
1278 state->reply_pdu = data_blob_null;
1279 state->rpc_out = data_blob_null;
1280
1281 if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
1282 + RPC_MAX_SIGN_SIZE) {
1283 /* Server is screwed up ! */
1284 status = NT_STATUS_INVALID_PARAMETER;
1285 goto post_status;
1286 }
1287
1288 status = prepare_next_frag(state, &is_last_frag);
1289 if (!NT_STATUS_IS_OK(status)) {
1290 goto post_status;
1291 }
1292
1293 if (is_last_frag) {
1294 subreq = rpc_api_pipe_send(state, ev, state->cli,
1295 &state->rpc_out,
1296 DCERPC_PKT_RESPONSE);
1297 if (subreq == NULL) {
1298 goto fail;
1299 }
1300 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1301 } else {
1302 subreq = rpc_write_send(state, ev, cli->transport,
1303 state->rpc_out.data,
1304 state->rpc_out.length);
1305 if (subreq == NULL) {
1306 goto fail;
1307 }
1308 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1309 req);
1310 }
1311 return req;
1312
1313 post_status:
1314 tevent_req_nterror(req, status);
1315 return tevent_req_post(req, ev);
1316 fail:
1317 TALLOC_FREE(req);
1318 return NULL;
1319 }
1320
1321 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1322 bool *is_last_frag)
1323 {
1324 size_t data_sent_thistime;
1325 size_t auth_len;
1326 size_t frag_len;
1327 uint8_t flags = 0;
1328 size_t pad_len;
1329 size_t data_left;
1330 NTSTATUS status;
1331 union dcerpc_payload u;
1332
1333 data_left = state->req_data->length - state->req_data_sent;
1334
1335 status = dcerpc_guess_sizes(state->cli->auth,
1336 DCERPC_REQUEST_LENGTH, data_left,
1337 state->cli->max_xmit_frag,
1338 CLIENT_NDR_PADDING_SIZE,
1339 &data_sent_thistime,
1340 &frag_len, &auth_len, &pad_len);
1341 if (!NT_STATUS_IS_OK(status)) {
1342 return status;
1343 }
1344
1345 if (state->req_data_sent == 0) {
1346 flags = DCERPC_PFC_FLAG_FIRST;
1347 }
1348
1349 if (data_sent_thistime == data_left) {
1350 flags |= DCERPC_PFC_FLAG_LAST;
1351 }
1352
1353 data_blob_free(&state->rpc_out);
1354
1355 ZERO_STRUCT(u.request);
1356
1357 u.request.alloc_hint = state->req_data->length;
1358 u.request.context_id = 0;
1359 u.request.opnum = state->op_num;
1360
1361 status = dcerpc_push_ncacn_packet(state,
1362 DCERPC_PKT_REQUEST,
1363 flags,
1364 auth_len,
1365 state->call_id,
1366 &u,
1367 &state->rpc_out);
1368 if (!NT_STATUS_IS_OK(status)) {
1369 return status;
1370 }
1371
1372 /* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
1373 * compute it right for requests because the auth trailer is missing
1374 * at this stage */
1375 dcerpc_set_frag_length(&state->rpc_out, frag_len);
1376
1377 /* Copy in the data. */
1378 if (!data_blob_append(NULL, &state->rpc_out,
1379 state->req_data->data + state->req_data_sent,
1380 data_sent_thistime)) {
1381 return NT_STATUS_NO_MEMORY;
1382 }
1383
1384 switch (state->cli->auth->auth_level) {
1385 case DCERPC_AUTH_LEVEL_NONE:
1386 case DCERPC_AUTH_LEVEL_CONNECT:
1387 case DCERPC_AUTH_LEVEL_PACKET:
1388 break;
1389 case DCERPC_AUTH_LEVEL_INTEGRITY:
1390 case DCERPC_AUTH_LEVEL_PRIVACY:
1391 status = dcerpc_add_auth_footer(state->cli->auth, pad_len,
1392 &state->rpc_out);
1393 if (!NT_STATUS_IS_OK(status)) {
1394 return status;
1395 }
1396 break;
1397 default:
1398 return NT_STATUS_INVALID_PARAMETER;
1399 }
1400
1401 state->req_data_sent += data_sent_thistime;
1402 *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
1403
1404 return status;
1405 }
1406
1407 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
1408 {
1409 struct tevent_req *req = tevent_req_callback_data(
1410 subreq, struct tevent_req);
1411 struct rpc_api_pipe_req_state *state = tevent_req_data(
1412 req, struct rpc_api_pipe_req_state);
1413 NTSTATUS status;
1414 bool is_last_frag;
1415
1416 status = rpc_write_recv(subreq);
1417 TALLOC_FREE(subreq);
1418 if (!NT_STATUS_IS_OK(status)) {
1419 tevent_req_nterror(req, status);
1420 return;
1421 }
1422
1423 status = prepare_next_frag(state, &is_last_frag);
1424 if (!NT_STATUS_IS_OK(status)) {
1425 tevent_req_nterror(req, status);
1426 return;
1427 }
1428
1429 if (is_last_frag) {
1430 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1431 &state->rpc_out,
1432 DCERPC_PKT_RESPONSE);
1433 if (tevent_req_nomem(subreq, req)) {
1434 return;
1435 }
1436 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1437 } else {
1438 subreq = rpc_write_send(state, state->ev,
1439 state->cli->transport,
1440 state->rpc_out.data,
1441 state->rpc_out.length);
1442 if (tevent_req_nomem(subreq, req)) {
1443 return;
1444 }
1445 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1446 req);
1447 }
1448 }
1449
1450 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
1451 {
1452 struct tevent_req *req = tevent_req_callback_data(
1453 subreq, struct tevent_req);
1454 struct rpc_api_pipe_req_state *state = tevent_req_data(
1455 req, struct rpc_api_pipe_req_state);
1456 NTSTATUS status;
1457
1458 status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
1459 TALLOC_FREE(subreq);
1460 if (!NT_STATUS_IS_OK(status)) {
1461 tevent_req_nterror(req, status);
1462 return;
1463 }
1464 tevent_req_done(req);
1465 }
1466
1467 NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1468 DATA_BLOB *reply_pdu)
1469 {
1470 struct rpc_api_pipe_req_state *state = tevent_req_data(
1471 req, struct rpc_api_pipe_req_state);
1472 NTSTATUS status;
1473
1474 if (tevent_req_is_nterror(req, &status)) {
1475 /*
1476 * We always have to initialize to reply pdu, even if there is
1477 * none. The rpccli_* caller routines expect this.
1478 */
1479 *reply_pdu = data_blob_null;
1480 return status;
1481 }
1482
1483 /* return data to caller and assign it ownership of memory */
1484 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1485 reply_pdu->length = state->reply_pdu.length;
1486 state->reply_pdu.length = 0;
1487
1488 return NT_STATUS_OK;
1489 }
1490
1491 /****************************************************************************
1492 Check the rpc bind acknowledge response.
1493 ****************************************************************************/
1494
1495 static bool check_bind_response(const struct dcerpc_bind_ack *r,
1496 const struct ndr_syntax_id *transfer)
1497 {
1498 struct dcerpc_ack_ctx ctx;
1499
1500 if (r->secondary_address_size == 0) {
1501 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
1502 }
1503
1504 if (r->num_results < 1 || !r->ctx_list) {
1505 return false;
1506 }
1507
1508 ctx = r->ctx_list[0];
1509
1510 /* check the transfer syntax */
1511 if ((ctx.syntax.if_version != transfer->if_version) ||
1512 (memcmp(&ctx.syntax.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1513 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1514 return False;
1515 }
1516
1517 if (r->num_results != 0x1 || ctx.result != 0) {
1518 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1519 r->num_results, ctx.reason));
1520 }
1521
1522 DEBUG(5,("check_bind_response: accepted!\n"));
1523 return True;
1524 }
1525
1526 /*******************************************************************
1527 Creates a DCE/RPC bind authentication response.
1528 This is the packet that is sent back to the server once we
1529 have received a BIND-ACK, to finish the third leg of
1530 the authentication handshake.
1531 ********************************************************************/
1532
1533 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
1534 struct rpc_pipe_client *cli,
1535 uint32 rpc_call_id,
1536 enum dcerpc_AuthType auth_type,
1537 enum dcerpc_AuthLevel auth_level,
1538 DATA_BLOB *pauth_blob,
1539 DATA_BLOB *rpc_out)
1540 {
1541 NTSTATUS status;
1542 union dcerpc_payload u;
1543
1544 u.auth3._pad = 0;
1545
1546 status = dcerpc_push_dcerpc_auth(mem_ctx,
1547 auth_type,
1548 auth_level,
1549 0, /* auth_pad_length */
1550 1, /* auth_context_id */
1551 pauth_blob,
1552 &u.auth3.auth_info);
1553 if (!NT_STATUS_IS_OK(status)) {
1554 return status;
1555 }
1556
1557 status = dcerpc_push_ncacn_packet(mem_ctx,
1558 DCERPC_PKT_AUTH3,
1559 DCERPC_PFC_FLAG_FIRST |
1560 DCERPC_PFC_FLAG_LAST,
1561 pauth_blob->length,
1562 rpc_call_id,
1563 &u,
1564 rpc_out);
1565 data_blob_free(&u.auth3.auth_info);
1566 if (!NT_STATUS_IS_OK(status)) {
1567 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1568 return status;
1569 }
1570
1571 return NT_STATUS_OK;
1572 }
1573
1574 /*******************************************************************
1575 Creates a DCE/RPC bind alter context authentication request which
1576 may contain a spnego auth blobl
1577 ********************************************************************/
1578
1579 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
1580 enum dcerpc_AuthType auth_type,
1581 enum dcerpc_AuthLevel auth_level,
1582 uint32 rpc_call_id,
1583 const struct ndr_syntax_id *abstract,
1584 const struct ndr_syntax_id *transfer,
1585 const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
1586 DATA_BLOB *rpc_out)
1587 {
1588 DATA_BLOB auth_info;
1589 NTSTATUS status;
1590
1591 status = dcerpc_push_dcerpc_auth(mem_ctx,
1592 auth_type,
1593 auth_level,
1594 0, /* auth_pad_length */
1595 1, /* auth_context_id */
1596 pauth_blob,
1597 &auth_info);
1598 if (!NT_STATUS_IS_OK(status)) {
1599 return status;
1600 }
1601
1602 status = create_bind_or_alt_ctx_internal(mem_ctx,
1603 DCERPC_PKT_ALTER,
1604 rpc_call_id,
1605 abstract,
1606 transfer,
1607 &auth_info,
1608 rpc_out);
1609 data_blob_free(&auth_info);
1610 return status;
1611 }
1612
1613 /****************************************************************************
1614 Do an rpc bind.
1615 ****************************************************************************/
1616
1617 struct rpc_pipe_bind_state {
1618 struct event_context *ev;
1619 struct rpc_pipe_client *cli;
1620 DATA_BLOB rpc_out;
1621 bool auth3;
1622 uint32_t rpc_call_id;
1623 };
1624
1625 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
1626 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1627 struct rpc_pipe_bind_state *state,
1628 DATA_BLOB *credentials);
1629 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1630 struct rpc_pipe_bind_state *state,
1631 DATA_BLOB *credentials);
1632
1633 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
1634 struct event_context *ev,
1635 struct rpc_pipe_client *cli,
1636 struct pipe_auth_data *auth)
1637 {
1638 struct tevent_req *req, *subreq;
1639 struct rpc_pipe_bind_state *state;
1640 NTSTATUS status;
1641
1642 req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
1643 if (req == NULL) {
1644 return NULL;
1645 }
1646
1647 DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
1648 rpccli_pipe_txt(talloc_tos(), cli),
1649 (unsigned int)auth->auth_type,
1650 (unsigned int)auth->auth_level ));
1651
1652 state->ev = ev;
1653 state->cli = cli;
1654 state->rpc_call_id = get_rpc_call_id();
1655
1656 cli->auth = talloc_move(cli, &auth);
1657
1658 /* Marshall the outgoing data. */
1659 status = create_rpc_bind_req(state, cli,
1660 cli->auth,
1661 state->rpc_call_id,
1662 &cli->abstract_syntax,
1663 &cli->transfer_syntax,
1664 &state->rpc_out);
1665
1666 if (!NT_STATUS_IS_OK(status)) {
1667 goto post_status;
1668 }
1669
1670 subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
1671 DCERPC_PKT_BIND_ACK);
1672 if (subreq == NULL) {
1673 goto fail;
1674 }
1675 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1676 return req;
1677
1678 post_status:
1679 tevent_req_nterror(req, status);
1680 return tevent_req_post(req, ev);
1681 fail:
1682 TALLOC_FREE(req);
1683 return NULL;
1684 }
1685
1686 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
1687 {
1688 struct tevent_req *req = tevent_req_callback_data(
1689 subreq, struct tevent_req);
1690 struct rpc_pipe_bind_state *state = tevent_req_data(
1691 req, struct rpc_pipe_bind_state);
1692 struct pipe_auth_data *pauth = state->cli->auth;
1693 struct auth_ntlmssp_state *ntlmssp_ctx;
1694 struct spnego_context *spnego_ctx;
1695 struct gse_context *gse_ctx;
1696 struct ncacn_packet *pkt = NULL;
1697 struct dcerpc_auth auth;
1698 DATA_BLOB auth_token = data_blob_null;
1699 NTSTATUS status;
1700
1701 status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
1702 TALLOC_FREE(subreq);
1703 if (!NT_STATUS_IS_OK(status)) {
1704 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
1705 rpccli_pipe_txt(talloc_tos(), state->cli),
1706 nt_errstr(status)));
1707 tevent_req_nterror(req, status);
1708 return;
1709 }
1710
1711 if (state->auth3) {
1712 tevent_req_done(req);
1713 return;
1714 }
1715
1716 if (!check_bind_response(&pkt->u.bind_ack, &state->cli->transfer_syntax)) {
1717 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
1718 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1719 return;
1720 }
1721
1722 state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
1723 state->cli->max_recv_frag = pkt->u.bind_ack.max_recv_frag;
1724
1725 switch(pauth->auth_type) {
1726
1727 case DCERPC_AUTH_TYPE_NONE:
1728 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1729 case DCERPC_AUTH_TYPE_SCHANNEL:
1730 /* Bind complete. */
1731 tevent_req_done(req);
1732 return;
1733
1734 case DCERPC_AUTH_TYPE_NTLMSSP:
1735 case DCERPC_AUTH_TYPE_SPNEGO:
1736 case DCERPC_AUTH_TYPE_KRB5:
1737 /* Paranoid lenght checks */
1738 if (pkt->frag_length < DCERPC_AUTH_TRAILER_LENGTH
1739 + pkt->auth_length) {
1740 tevent_req_nterror(req,
1741 NT_STATUS_INFO_LENGTH_MISMATCH);
1742 return;
1743 }
1744 /* get auth credentials */
1745 status = dcerpc_pull_dcerpc_auth(talloc_tos(),
1746 &pkt->u.bind_ack.auth_info,
1747 &auth, false);
1748 if (!NT_STATUS_IS_OK(status)) {
1749 DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
1750 nt_errstr(status)));
1751 tevent_req_nterror(req, status);
1752 return;
1753 }
1754 break;
1755
1756 default:
1757 goto err_out;
1758 }
1759
1760 /*
1761 * For authenticated binds we may need to do 3 or 4 leg binds.
1762 */
1763
1764 switch(pauth->auth_type) {
1765
1766 case DCERPC_AUTH_TYPE_NONE:
1767 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1768 case DCERPC_AUTH_TYPE_SCHANNEL:
1769 /* Bind complete. */
1770 tevent_req_done(req);
1771 return;
1772
1773 case DCERPC_AUTH_TYPE_NTLMSSP:
1774 ntlmssp_ctx = talloc_get_type_abort(pauth->auth_ctx,
1775 struct auth_ntlmssp_state);
1776 status = auth_ntlmssp_update(ntlmssp_ctx, state,
1777 auth.credentials, &auth_token);
1778 if (NT_STATUS_EQUAL(status,
1779 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1780 status = rpc_bind_next_send(req, state,
1781 &auth_token);
1782 } else if (NT_STATUS_IS_OK(status)) {
1783 status = rpc_bind_finish_send(req, state,
1784 &auth_token);
1785 }
1786 break;
1787
1788 case DCERPC_AUTH_TYPE_SPNEGO:
1789 spnego_ctx = talloc_get_type_abort(pauth->auth_ctx,
1790 struct spnego_context);
1791 status = spnego_get_client_auth_token(state,
1792 spnego_ctx,
1793 &auth.credentials,
1794 &auth_token);
1795 if (!NT_STATUS_IS_OK(status)) {
1796 break;
1797 }
1798 if (auth_token.length == 0) {
1799 /* Bind complete. */
1800 tevent_req_done(req);
1801 return;
1802 }
1803 if (spnego_require_more_processing(spnego_ctx)) {
1804 status = rpc_bind_next_send(req, state,
1805 &auth_token);
1806 } else {
1807 status = rpc_bind_finish_send(req, state,
1808 &auth_token);
1809 }
1810 break;
1811
1812 case DCERPC_AUTH_TYPE_KRB5:
1813 gse_ctx = talloc_get_type_abort(pauth->auth_ctx,
1814 struct gse_context);
1815 status = gse_get_client_auth_token(state,
1816 gse_ctx,
1817 &auth.credentials,
1818 &auth_token);
1819 if (!NT_STATUS_IS_OK(status)) {
1820 break;
1821 }
1822
1823 if (gse_require_more_processing(gse_ctx)) {
1824 status = rpc_bind_next_send(req, state, &auth_token);
1825 } else {
1826 status = rpc_bind_finish_send(req, state, &auth_token);
1827 }
1828 break;
1829
1830 default:
1831 goto err_out;
1832 }
1833
1834 if (!NT_STATUS_IS_OK(status)) {
1835 tevent_req_nterror(req, status);
1836 }
1837 return;
1838
1839 err_out:
1840 DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
1841 (unsigned int)state->cli->auth->auth_type));
1842 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
1843 }
1844
1845 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1846 struct rpc_pipe_bind_state *state,
1847 DATA_BLOB *auth_token)
1848 {
1849 struct pipe_auth_data *auth = state->cli->auth;
1850 struct tevent_req *subreq;
1851 NTSTATUS status;
1852
1853 /* Now prepare the alter context pdu. */
1854 data_blob_free(&state->rpc_out);
1855
1856 status = create_rpc_alter_context(state,
1857 auth->auth_type,
1858 auth->auth_level,
1859 state->rpc_call_id,
1860 &state->cli->abstract_syntax,
1861 &state->cli->transfer_syntax,
1862 auth_token,
1863 &state->rpc_out);
1864 if (!NT_STATUS_IS_OK(status)) {
1865 return status;
1866 }
1867
1868 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1869 &state->rpc_out, DCERPC_PKT_ALTER_RESP);
1870 if (subreq == NULL) {
1871 return NT_STATUS_NO_MEMORY;
1872 }
1873 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1874 return NT_STATUS_OK;
1875 }
1876
1877 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1878 struct rpc_pipe_bind_state *state,
1879 DATA_BLOB *auth_token)
1880 {
1881 struct pipe_auth_data *auth = state->cli->auth;
1882 struct tevent_req *subreq;
1883 NTSTATUS status;
1884
1885 state->auth3 = true;
1886
1887 /* Now prepare the auth3 context pdu. */
1888 data_blob_free(&state->rpc_out);
1889
1890 status = create_rpc_bind_auth3(state, state->cli,
1891 state->rpc_call_id,
1892 auth->auth_type,
1893 auth->auth_level,
1894 auth_token,
1895 &state->rpc_out);
1896 if (!NT_STATUS_IS_OK(status)) {
1897 return status;
1898 }
1899
1900 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1901 &state->rpc_out, DCERPC_PKT_AUTH3);
1902 if (subreq == NULL) {
1903 return NT_STATUS_NO_MEMORY;
1904 }
1905 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1906 return NT_STATUS_OK;
1907 }
1908
1909 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
1910 {
1911 return tevent_req_simple_recv_ntstatus(req);
1912 }
1913
1914 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
1915 struct pipe_auth_data *auth)
1916 {
1917 TALLOC_CTX *frame = talloc_stackframe();
1918 struct event_context *ev;
1919 struct tevent_req *req;
1920 NTSTATUS status = NT_STATUS_OK;
1921
1922 ev = event_context_init(frame);
1923 if (ev == NULL) {
1924 status = NT_STATUS_NO_MEMORY;
1925 goto fail;
1926 }
1927
1928 req = rpc_pipe_bind_send(frame, ev, cli, auth);
1929 if (req == NULL) {
1930 status = NT_STATUS_NO_MEMORY;
1931 goto fail;
1932 }
1933
1934 if (!tevent_req_poll(req, ev)) {
1935 status = map_nt_error_from_unix(errno);
1936 goto fail;
1937 }
1938
1939 status = rpc_pipe_bind_recv(req);
1940 fail:
1941 TALLOC_FREE(frame);
1942 return status;
1943 }
1944
1945 #define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */
1946
1947 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
1948 unsigned int timeout)
1949 {
1950 unsigned int old;
1951
1952 if (rpc_cli->transport == NULL) {
1953 return RPCCLI_DEFAULT_TIMEOUT;
1954 }
1955
1956 if (rpc_cli->transport->set_timeout == NULL) {
1957 return RPCCLI_DEFAULT_TIMEOUT;
1958 }
1959
1960 old = rpc_cli->transport->set_timeout(rpc_cli->transport->priv, timeout);
1961 if (old == 0) {
1962 return RPCCLI_DEFAULT_TIMEOUT;
1963 }
1964
1965 return old;
1966 }
1967
1968 bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
1969 {
1970 if (rpc_cli == NULL) {
1971 return false;
1972 }
1973
1974 if (rpc_cli->transport == NULL) {
1975 return false;
1976 }
1977
1978 return rpc_cli->transport->is_connected(rpc_cli->transport->priv);
1979 }
1980
1981 struct rpccli_bh_state {
1982 struct rpc_pipe_client *rpc_cli;
1983 };
1984
1985 static bool rpccli_bh_is_connected(struct dcerpc_binding_handle *h)
1986 {
1987 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1988 struct rpccli_bh_state);
1989
1990 return rpccli_is_connected(hs->rpc_cli);
1991 }
1992
1993 static uint32_t rpccli_bh_set_timeout(struct dcerpc_binding_handle *h,
1994 uint32_t timeout)
1995 {
1996 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1997 struct rpccli_bh_state);
1998
1999 return rpccli_set_timeout(hs->rpc_cli, timeout);
2000 }
2001
2002 struct rpccli_bh_raw_call_state {
2003 DATA_BLOB in_data;
2004 DATA_BLOB out_data;
2005 uint32_t out_flags;
2006 };
2007
2008 static void rpccli_bh_raw_call_done(struct tevent_req *subreq);
2009
2010 static struct tevent_req *rpccli_bh_raw_call_send(TALLOC_CTX *mem_ctx,
2011 struct tevent_context *ev,
2012 struct dcerpc_binding_handle *h,
2013 const struct GUID *object,
2014 uint32_t opnum,
2015 uint32_t in_flags,
2016 const uint8_t *in_data,
2017 size_t in_length)
2018 {
2019 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2020 struct rpccli_bh_state);
2021 struct tevent_req *req;
2022 struct rpccli_bh_raw_call_state *state;
2023 bool ok;
2024 struct tevent_req *subreq;
2025
2026 req = tevent_req_create(mem_ctx, &state,
2027 struct rpccli_bh_raw_call_state);
2028 if (req == NULL) {
2029 return NULL;
2030 }
2031 state->in_data.data = discard_const_p(uint8_t, in_data);
2032 state->in_data.length = in_length;
2033
2034 ok = rpccli_bh_is_connected(h);
2035 if (!ok) {
2036 tevent_req_nterror(req, NT_STATUS_INVALID_CONNECTION);
2037 return tevent_req_post(req, ev);
2038 }
2039
2040 subreq = rpc_api_pipe_req_send(state, ev, hs->rpc_cli,
2041 opnum, &state->in_data);
2042 if (tevent_req_nomem(subreq, req)) {
2043 return tevent_req_post(req, ev);
2044 }
2045 tevent_req_set_callback(subreq, rpccli_bh_raw_call_done, req);
2046
2047 return req;
2048 }
2049
2050 static void rpccli_bh_raw_call_done(struct tevent_req *subreq)
2051 {
2052 struct tevent_req *req =
2053 tevent_req_callback_data(subreq,
2054 struct tevent_req);
2055 struct rpccli_bh_raw_call_state *state =
2056 tevent_req_data(req,
2057 struct rpccli_bh_raw_call_state);
2058 NTSTATUS status;
2059
2060 state->out_flags = 0;
2061
2062 /* TODO: support bigendian responses */
2063
2064 status = rpc_api_pipe_req_recv(subreq, state, &state->out_data);
2065 TALLOC_FREE(subreq);
2066 if (!NT_STATUS_IS_OK(status)) {
2067 tevent_req_nterror(req, status);
2068 return;
2069 }
2070
2071 tevent_req_done(req);
2072 }
2073
2074 static NTSTATUS rpccli_bh_raw_call_recv(struct tevent_req *req,
2075 TALLOC_CTX *mem_ctx,
2076 uint8_t **out_data,
2077 size_t *out_length,
2078 uint32_t *out_flags)
2079 {
2080 struct rpccli_bh_raw_call_state *state =
2081 tevent_req_data(req,
2082 struct rpccli_bh_raw_call_state);
2083 NTSTATUS status;
2084
2085 if (tevent_req_is_nterror(req, &status)) {
2086 tevent_req_received(req);
2087 return status;
2088 }
2089
2090 *out_data = talloc_move(mem_ctx, &state->out_data.data);
2091 *out_length = state->out_data.length;
2092 *out_flags = state->out_flags;
2093 tevent_req_received(req);
2094 return NT_STATUS_OK;
2095 }
2096
2097 struct rpccli_bh_disconnect_state {
2098 uint8_t _dummy;
2099 };
2100
2101 static struct tevent_req *rpccli_bh_disconnect_send(TALLOC_CTX *mem_ctx,
2102 struct tevent_context *ev,
2103 struct dcerpc_binding_handle *h)
2104 {
2105 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2106 struct rpccli_bh_state);
2107 struct tevent_req *req;
2108 struct rpccli_bh_disconnect_state *state;
2109 bool ok;
2110
2111 req = tevent_req_create(mem_ctx, &state,
2112 struct rpccli_bh_disconnect_state);
2113 if (req == NULL) {
2114 return NULL;
2115 }
2116
2117 ok = rpccli_bh_is_connected(h);
2118 if (!ok) {
2119 tevent_req_nterror(req, NT_STATUS_INVALID_CONNECTION);
2120 return tevent_req_post(req, ev);
2121 }
2122
2123 /*
2124 * TODO: do a real async disconnect ...
2125 *
2126 * For now the caller needs to free rpc_cli
2127 */
2128 hs->rpc_cli = NULL;
2129
2130 tevent_req_done(req);
2131 return tevent_req_post(req, ev);
2132 }
2133
2134 static NTSTATUS rpccli_bh_disconnect_recv(struct tevent_req *req)
2135 {
2136 NTSTATUS status;
2137
2138 if (tevent_req_is_nterror(req, &status)) {
2139 tevent_req_received(req);
2140 return status;
2141 }
2142
2143 tevent_req_received(req);
2144 return NT_STATUS_OK;
2145 }
2146
2147 static bool rpccli_bh_ref_alloc(struct dcerpc_binding_handle *h)
2148 {
2149 return true;
2150 }
2151
2152 static void rpccli_bh_do_ndr_print(struct dcerpc_binding_handle *h,
2153 int ndr_flags,
2154 const void *_struct_ptr,
2155 const struct ndr_interface_call *call)
2156 {
2157 void *struct_ptr = discard_const(_struct_ptr);
2158
2159 if (DEBUGLEVEL < 10) {
2160 return;
2161 }
2162
2163 if (ndr_flags & NDR_IN) {
2164 ndr_print_function_debug(call->ndr_print,
2165 call->name,
2166 ndr_flags,
2167 struct_ptr);
2168 }
2169 if (ndr_flags & NDR_OUT) {
2170 ndr_print_function_debug(call->ndr_print,
2171 call->name,
2172 ndr_flags,
2173 struct_ptr);
2174 }
2175 }
2176
2177 static const struct dcerpc_binding_handle_ops rpccli_bh_ops = {
2178 .name = "rpccli",
2179 .is_connected = rpccli_bh_is_connected,
2180 .set_timeout = rpccli_bh_set_timeout,
2181 .raw_call_send = rpccli_bh_raw_call_send,
2182 .raw_call_recv = rpccli_bh_raw_call_recv,
2183 .disconnect_send = rpccli_bh_disconnect_send,
2184 .disconnect_recv = rpccli_bh_disconnect_recv,
2185
2186 .ref_alloc = rpccli_bh_ref_alloc,
2187 .do_ndr_print = rpccli_bh_do_ndr_print,
2188 };
2189
2190 /* initialise a rpc_pipe_client binding handle */
2191 struct dcerpc_binding_handle *rpccli_bh_create(struct rpc_pipe_client *c)
2192 {
2193 struct dcerpc_binding_handle *h;
2194 struct rpccli_bh_state *hs;
2195
2196 h = dcerpc_binding_handle_create(c,
2197 &rpccli_bh_ops,
2198 NULL,
2199 NULL, /* TODO */
2200 &hs,
2201 struct rpccli_bh_state,
2202 __location__);
2203 if (h == NULL) {
2204 return NULL;
2205 }
2206 hs->rpc_cli = c;
2207
2208 return h;
2209 }
2210
2211 NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx,
2212 struct pipe_auth_data **presult)
2213 {
2214 struct pipe_auth_data *result;
2215
2216 result = talloc(mem_ctx, struct pipe_auth_data);
2217 if (result == NULL) {
2218 return NT_STATUS_NO_MEMORY;
2219 }
2220
2221 result->auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
2222 result->auth_level = DCERPC_AUTH_LEVEL_CONNECT;
2223
2224 result->user_name = talloc_strdup(result, "");
2225 result->domain = talloc_strdup(result, "");
2226 if ((result->user_name == NULL) || (result->domain == NULL)) {
2227 TALLOC_FREE(result);
2228 return NT_STATUS_NO_MEMORY;
2229 }
2230
2231 *presult = result;
2232 return NT_STATUS_OK;
2233 }
2234
2235 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2236 struct pipe_auth_data **presult)
2237 {
2238 struct pipe_auth_data *result;
2239
2240 result = talloc(mem_ctx, struct pipe_auth_data);
2241 if (result == NULL) {
2242 return NT_STATUS_NO_MEMORY;
2243 }
2244
2245 result->auth_type = DCERPC_AUTH_TYPE_NONE;
2246 result->auth_level = DCERPC_AUTH_LEVEL_NONE;
2247
2248 result->user_name = talloc_strdup(result, "");
2249 result->domain = talloc_strdup(result, "");
2250 if ((result->user_name == NULL) || (result->domain == NULL)) {
2251 TALLOC_FREE(result);
2252 return NT_STATUS_NO_MEMORY;
2253 }
2254
2255 *presult = result;
2256 return NT_STATUS_OK;
2257 }
2258
2259 static int cli_auth_ntlmssp_data_destructor(struct pipe_auth_data *auth)
2260 {
2261 TALLOC_FREE(auth->auth_ctx);
2262 return 0;
2263 }
2264
2265 static NTSTATUS rpccli_ntlmssp_bind_data(TALLOC_CTX *mem_ctx,
2266 enum dcerpc_AuthType auth_type,
2267 enum dcerpc_AuthLevel auth_level,
2268 const char *domain,
2269 const char *username,
2270 const char *password,
2271 struct pipe_auth_data **presult)
2272 {
2273 struct auth_ntlmssp_state *ntlmssp_ctx;
2274 struct pipe_auth_data *result;
2275 NTSTATUS status;
2276
2277 result = talloc(mem_ctx, struct pipe_auth_data);
2278 if (result == NULL) {
2279 return NT_STATUS_NO_MEMORY;
2280 }
2281
2282 result->auth_type = auth_type;
2283 result->auth_level = auth_level;
2284
2285 result->user_name = talloc_strdup(result, username);
2286 result->domain = talloc_strdup(result, domain);
2287 if ((result->user_name == NULL) || (result->domain == NULL)) {
2288 status = NT_STATUS_NO_MEMORY;
2289 goto fail;
2290 }
2291
2292 status = auth_ntlmssp_client_start(NULL,
2293 lp_netbios_name(),
2294 lp_workgroup(),
2295 lp_client_ntlmv2_auth(),
2296 &ntlmssp_ctx);
2297 if (!NT_STATUS_IS_OK(status)) {
2298 goto fail;
2299 }
2300
2301 talloc_set_destructor(result, cli_auth_ntlmssp_data_destructor);
2302
2303 status = auth_ntlmssp_set_username(ntlmssp_ctx, username);
2304 if (!NT_STATUS_IS_OK(status)) {
2305 goto fail;
2306 }
2307
2308 status = auth_ntlmssp_set_domain(ntlmssp_ctx, domain);
2309 if (!NT_STATUS_IS_OK(status)) {
2310 goto fail;
2311 }
2312
2313 status = auth_ntlmssp_set_password(ntlmssp_ctx, password);
2314 if (!NT_STATUS_IS_OK(status)) {
2315 goto fail;
2316 }
2317
2318 if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
2319 auth_ntlmssp_want_feature(ntlmssp_ctx, NTLMSSP_FEATURE_SIGN);
2320 } else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
2321 auth_ntlmssp_want_feature(ntlmssp_ctx, NTLMSSP_FEATURE_SEAL);
2322 }
2323
2324 result->auth_ctx = ntlmssp_ctx;
2325 *presult = result;
2326 return NT_STATUS_OK;
2327
2328 fail:
2329 TALLOC_FREE(result);
2330 return status;
2331 }
2332
2333 NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
2334 enum dcerpc_AuthLevel auth_level,
2335 struct netlogon_creds_CredentialState *creds,
2336 struct pipe_auth_data **presult)
2337 {
2338 struct schannel_state *schannel_auth;
2339 struct pipe_auth_data *result;
2340
2341 result = talloc(mem_ctx, struct pipe_auth_data);
2342 if (result == NULL) {
2343 return NT_STATUS_NO_MEMORY;
2344 }
2345
2346 result->auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
2347 result->auth_level = auth_level;
2348
2349 result->user_name = talloc_strdup(result, "");
2350 result->domain = talloc_strdup(result, domain);
2351 if ((result->user_name == NULL) || (result->domain == NULL)) {
2352 goto fail;
2353 }
2354
2355 schannel_auth = talloc(result, struct schannel_state);
2356 if (schannel_auth == NULL) {
2357 goto fail;
2358 }
2359
2360 schannel_auth->state = SCHANNEL_STATE_START;
2361 schannel_auth->seq_num = 0;
2362 schannel_auth->initiator = true;
2363 schannel_auth->creds = netlogon_creds_copy(result, creds);
2364
2365 result->auth_ctx = schannel_auth;
2366 *presult = result;
2367 return NT_STATUS_OK;
2368
2369 fail:
2370 TALLOC_FREE(result);
2371 return NT_STATUS_NO_MEMORY;
2372 }
2373
2374 /**
2375 * Create an rpc pipe client struct, connecting to a tcp port.
2376 */
2377 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
2378 uint16_t port,
2379 const struct ndr_syntax_id *abstract_syntax,
2380 struct rpc_pipe_client **presult)
2381 {
2382 struct rpc_pipe_client *result;
2383 struct sockaddr_storage addr;
2384 NTSTATUS status;
2385 int fd;
2386
2387 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2388 if (result == NULL) {
2389 return NT_STATUS_NO_MEMORY;
2390 }
2391
2392 result->abstract_syntax = *abstract_syntax;
2393 result->transfer_syntax = ndr_transfer_syntax;
2394
2395 result->desthost = talloc_strdup(result, host);
2396 result->srv_name_slash = talloc_asprintf_strupper_m(
2397 result, "\\\\%s", result->desthost);
2398 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2399 status = NT_STATUS_NO_MEMORY;
2400 goto fail;
2401 }
2402
2403 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2404 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2405
2406 if (!resolve_name(host, &addr, 0, false)) {
2407 status = NT_STATUS_NOT_FOUND;
2408 goto fail;
2409 }
2410
2411 status = open_socket_out(&addr, port, 60*1000, &fd);
2412 if (!NT_STATUS_IS_OK(status)) {
2413 goto fail;
2414 }
2415 set_socket_options(fd, lp_socket_options());
2416
2417 status = rpc_transport_sock_init(result, fd, &result->transport);
2418 if (!NT_STATUS_IS_OK(status)) {
2419 close(fd);
2420 goto fail;
2421 }
2422
2423 result->transport->transport = NCACN_IP_TCP;
2424
2425 result->binding_handle = rpccli_bh_create(result);
2426 if (result->binding_handle == NULL) {
2427 TALLOC_FREE(result);
2428 return NT_STATUS_NO_MEMORY;
2429 }
2430
2431 *presult = result;
2432 return NT_STATUS_OK;
2433
2434 fail:
2435 TALLOC_FREE(result);
2436 return status;
2437 }
2438
2439 /**
2440 * Determine the tcp port on which a dcerpc interface is listening
2441 * for the ncacn_ip_tcp transport via the endpoint mapper of the
2442 * target host.
2443 */
2444 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
2445 const struct ndr_syntax_id *abstract_syntax,
2446 uint16_t *pport)
2447 {
2448 NTSTATUS status;
2449 struct rpc_pipe_client *epm_pipe = NULL;
2450 struct dcerpc_binding_handle *epm_handle = NULL;
2451 struct pipe_auth_data *auth = NULL;
2452 struct dcerpc_binding *map_binding = NULL;
2453 struct dcerpc_binding *res_binding = NULL;
2454 struct epm_twr_t *map_tower = NULL;
2455 struct epm_twr_t *res_towers = NULL;
2456 struct policy_handle *entry_handle = NULL;
2457 uint32_t num_towers = 0;
2458 uint32_t max_towers = 1;
2459 struct epm_twr_p_t towers;
2460 TALLOC_CTX *tmp_ctx = talloc_stackframe();
2461 uint32_t result = 0;
2462
2463 if (pport == NULL) {
2464 status = NT_STATUS_INVALID_PARAMETER;
2465 goto done;
2466 }
2467
2468 if (ndr_syntax_id_equal(abstract_syntax,
2469 &ndr_table_epmapper.syntax_id)) {
2470 *pport = 135;
2471 return NT_STATUS_OK;
2472 }
2473
2474 /* open the connection to the endpoint mapper */
2475 status = rpc_pipe_open_tcp_port(tmp_ctx, host, 135,
2476 &ndr_table_epmapper.syntax_id,
2477 &epm_pipe);
2478
2479 if (!NT_STATUS_IS_OK(status)) {
2480 goto done;
2481 }
2482 epm_handle = epm_pipe->binding_handle;
2483
2484 status = rpccli_anon_bind_data(tmp_ctx, &auth);
2485 if (!NT_STATUS_IS_OK(status)) {
2486 goto done;
2487 }
2488
2489 status = rpc_pipe_bind(epm_pipe, auth);
2490 if (!NT_STATUS_IS_OK(status)) {
2491 goto done;
2492 }
2493
2494 /* create tower for asking the epmapper */
2495
2496 map_binding = talloc_zero(tmp_ctx, struct dcerpc_binding);
2497 if (map_binding == NULL) {
2498 status = NT_STATUS_NO_MEMORY;
2499 goto done;
2500 }
2501
2502 map_binding->transport = NCACN_IP_TCP;
2503 map_binding->object = *abstract_syntax;
2504 map_binding->host = host; /* needed? */
2505 map_binding->endpoint = "0"; /* correct? needed? */
2506
2507 map_tower = talloc_zero(tmp_ctx, struct epm_twr_t);
2508 if (map_tower == NULL) {
2509 status = NT_STATUS_NO_MEMORY;
2510 goto done;
2511 }
2512
2513 status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
2514 &(map_tower->tower));
2515 if (!NT_STATUS_IS_OK(status)) {
2516 goto done;
2517 }
2518
2519 /* allocate further parameters for the epm_Map call */
2520
2521 res_towers = talloc_array(tmp_ctx, struct epm_twr_t, max_towers);
2522 if (res_towers == NULL) {
2523 status = NT_STATUS_NO_MEMORY;
2524 goto done;
2525 }
2526 towers.twr = res_towers;
2527
2528 entry_handle = talloc_zero(tmp_ctx, struct policy_handle);
2529 if (entry_handle == NULL) {
2530 status = NT_STATUS_NO_MEMORY;
2531 goto done;
2532 }
2533
2534 /* ask the endpoint mapper for the port */
2535
2536 status = dcerpc_epm_Map(epm_handle,
2537 tmp_ctx,
2538 discard_const_p(struct GUID,
2539 &(abstract_syntax->uuid)),
2540 map_tower,
2541 entry_handle,
2542 max_towers,
2543 &num_towers,
2544 &towers,
2545 &result);
2546
2547 if (!NT_STATUS_IS_OK(status)) {
2548 goto done;
2549 }
2550
2551 if (result != EPMAPPER_STATUS_OK) {
2552 status = NT_STATUS_UNSUCCESSFUL;
2553 goto done;
2554 }
2555
2556 if (num_towers != 1) {
2557 status = NT_STATUS_UNSUCCESSFUL;
2558 goto done;
2559 }
2560
2561 /* extract the port from the answer */
2562
2563 status = dcerpc_binding_from_tower(tmp_ctx,
2564 &(towers.twr->tower),
2565 &res_binding);
2566 if (!NT_STATUS_IS_OK(status)) {
2567 goto done;
2568 }
2569
2570 /* are further checks here necessary? */
2571 if (res_binding->transport != NCACN_IP_TCP) {
2572 status = NT_STATUS_UNSUCCESSFUL;
2573 goto done;
2574 }
2575
2576 *pport = (uint16_t)atoi(res_binding->endpoint);
2577
2578 done:
2579 TALLOC_FREE(tmp_ctx);
2580 return status;
2581 }
2582
2583 /**
2584 * Create a rpc pipe client struct, connecting to a host via tcp.
2585 * The port is determined by asking the endpoint mapper on the given
2586 * host.
2587 */
2588 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
2589 const struct ndr_syntax_id *abstract_syntax,
2590 struct rpc_pipe_client **presult)
2591 {
2592 NTSTATUS status;
2593 uint16_t port = 0;
2594
2595 status = rpc_pipe_get_tcp_port(host, abstract_syntax, &port);
2596 if (!NT_STATUS_IS_OK(status)) {
2597 return status;
2598 }
2599
2600 return rpc_pipe_open_tcp_port(mem_ctx, host, port,
2601 abstract_syntax, presult);
2602 }
2603
2604 /********************************************************************
2605 Create a rpc pipe client struct, connecting to a unix domain socket
2606 ********************************************************************/
2607 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
2608 const struct ndr_syntax_id *abstract_syntax,
2609 struct rpc_pipe_client **presult)
2610 {
2611 struct rpc_pipe_client *result;
2612 struct sockaddr_un addr;
2613 NTSTATUS status;
2614 int fd;
2615
2616 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2617 if (result == NULL) {
2618 return NT_STATUS_NO_MEMORY;
2619 }
2620
2621 result->abstract_syntax = *abstract_syntax;
2622 result->transfer_syntax = ndr_transfer_syntax;
2623
2624 result->desthost = get_myname(result);
2625 result->srv_name_slash = talloc_asprintf_strupper_m(
2626 result, "\\\\%s", result->desthost);
2627 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2628 status = NT_STATUS_NO_MEMORY;
2629 goto fail;
2630 }
2631
2632 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2633 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2634
2635 fd = socket(AF_UNIX, SOCK_STREAM, 0);
2636 if (fd == -1) {
2637 status = map_nt_error_from_unix(errno);
2638 goto fail;
2639 }
2640
2641 ZERO_STRUCT(addr);
2642 addr.sun_family = AF_UNIX;
2643 strlcpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
2644
2645 if (sys_connect(fd, (struct sockaddr *)(void *)&addr) == -1) {
2646 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
2647 strerror(errno)));
2648 close(fd);
2649 return map_nt_error_from_unix(errno);
2650 }
2651
2652 status = rpc_transport_sock_init(result, fd, &result->transport);
2653 if (!NT_STATUS_IS_OK(status)) {
2654 close(fd);
2655 goto fail;
2656 }
2657
2658 result->transport->transport = NCALRPC;
2659
2660 result->binding_handle = rpccli_bh_create(result);
2661 if (result->binding_handle == NULL) {
2662 TALLOC_FREE(result);
2663 return NT_STATUS_NO_MEMORY;
2664 }
2665
2666 *presult = result;
2667 return NT_STATUS_OK;
2668
2669 fail:
2670 TALLOC_FREE(result);
2671 return status;
2672 }
2673
2674 struct rpc_pipe_client_np_ref {
2675 struct cli_state *cli;
2676 struct rpc_pipe_client *pipe;
2677 };
2678
2679 static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
2680 {
2681 DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
2682 return 0;
2683 }
2684
2685 /****************************************************************************
2686 Open a named pipe over SMB to a remote server.
2687 *
2688 * CAVEAT CALLER OF THIS FUNCTION:
2689 * The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
2690 * so be sure that this function is called AFTER any structure (vs pointer)
2691 * assignment of the cli. In particular, libsmbclient does structure
2692 * assignments of cli, which invalidates the data in the returned
2693 * rpc_pipe_client if this function is called before the structure assignment
2694 * of cli.
2695 *
2696 ****************************************************************************/
2697
2698 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
2699 const struct ndr_syntax_id *abstract_syntax,
2700 struct rpc_pipe_client **presult)
2701 {
2702 struct rpc_pipe_client *result;
2703 NTSTATUS status;
2704 struct rpc_pipe_client_np_ref *np_ref;
2705
2706 /* sanity check to protect against crashes */
2707
2708 if ( !cli ) {
2709 return NT_STATUS_INVALID_HANDLE;
2710 }
2711
2712 result = talloc_zero(NULL, struct rpc_pipe_client);
2713 if (result == NULL) {
2714 return NT_STATUS_NO_MEMORY;
2715 }
2716
2717 result->abstract_syntax = *abstract_syntax;
2718 result->transfer_syntax = ndr_transfer_syntax;
2719 result->desthost = talloc_strdup(result, cli_state_remote_name(cli));
2720 result->srv_name_slash = talloc_asprintf_strupper_m(
2721 result, "\\\\%s", result->desthost);
2722
2723 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2724 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2725
2726 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2727 TALLOC_FREE(result);
2728 return NT_STATUS_NO_MEMORY;
2729 }
2730
2731 status = rpc_transport_np_init(result, cli, abstract_syntax,
2732 &result->transport);
2733 if (!NT_STATUS_IS_OK(status)) {
2734 TALLOC_FREE(result);
2735 return status;
2736 }
2737
2738 result->transport->transport = NCACN_NP;
2739
2740 np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
2741 if (np_ref == NULL) {
2742 TALLOC_FREE(result);
2743 return NT_STATUS_NO_MEMORY;
2744 }
2745 np_ref->cli = cli;
2746 np_ref->pipe = result;
2747
2748 DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
2749 talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
2750
2751 result->binding_handle = rpccli_bh_create(result);
2752 if (result->binding_handle == NULL) {
2753 TALLOC_FREE(result);
2754 return NT_STATUS_NO_MEMORY;
2755 }
2756
2757 *presult = result;
2758 return NT_STATUS_OK;
2759 }
2760
2761 /****************************************************************************
2762 Open a pipe to a remote server.
2763 ****************************************************************************/
2764
2765 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
2766 enum dcerpc_transport_t transport,
2767 const struct ndr_syntax_id *interface,
2768 struct rpc_pipe_client **presult)
2769 {
2770 switch (transport) {
2771 case NCACN_IP_TCP:
2772 return rpc_pipe_open_tcp(NULL, cli_state_remote_name(cli),
2773 interface, presult);
2774 case NCACN_NP:
2775 return rpc_pipe_open_np(cli, interface, presult);
2776 default:
2777 return NT_STATUS_NOT_IMPLEMENTED;
2778 }
2779 }
2780
2781 /****************************************************************************
2782 Open a named pipe to an SMB server and bind anonymously.
2783 ****************************************************************************/
2784
2785 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
2786 enum dcerpc_transport_t transport,
2787 const struct ndr_syntax_id *interface,
2788 struct rpc_pipe_client **presult)
2789 {
2790 struct rpc_pipe_client *result;
2791 struct pipe_auth_data *auth;
2792 NTSTATUS status;
2793
2794 status = cli_rpc_pipe_open(cli, transport, interface, &result);
2795 if (!NT_STATUS_IS_OK(status)) {
2796 return status;
2797 }
2798
2799 status = rpccli_anon_bind_data(result, &auth);
2800 if (!NT_STATUS_IS_OK(status)) {
2801 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
2802 nt_errstr(status)));
2803 TALLOC_FREE(result);
2804 return status;
2805 }
2806
2807 /*
2808 * This is a bit of an abstraction violation due to the fact that an
2809 * anonymous bind on an authenticated SMB inherits the user/domain
2810 * from the enclosing SMB creds
2811 */
2812
2813 TALLOC_FREE(auth->user_name);
2814 TALLOC_FREE(auth->domain);
2815
2816 auth->user_name = talloc_strdup(auth, cli->user_name);
2817 auth->domain = talloc_strdup(auth, cli->domain);
2818 auth->user_session_key = data_blob_talloc(auth,
2819 cli->user_session_key.data,
2820 cli->user_session_key.length);
2821
2822 if ((auth->user_name == NULL) || (auth->domain == NULL)) {
2823 TALLOC_FREE(result);
2824 return NT_STATUS_NO_MEMORY;
2825 }
2826
2827 status = rpc_pipe_bind(result, auth);
2828 if (!NT_STATUS_IS_OK(status)) {
2829 int lvl = 0;
2830 if (ndr_syntax_id_equal(interface,
2831 &ndr_table_dssetup.syntax_id)) {
2832 /* non AD domains just don't have this pipe, avoid
2833 * level 0 statement in that case - gd */
2834 lvl = 3;
2835 }
2836 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
2837 "%s failed with error %s\n",
2838 get_pipe_name_from_syntax(talloc_tos(), interface),
2839 nt_errstr(status) ));
2840 TALLOC_FREE(result);
2841 return status;
2842 }
2843
2844 DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
2845 "%s and bound anonymously.\n",
2846 get_pipe_name_from_syntax(talloc_tos(), interface),
2847 result->desthost));
2848
2849 *presult = result;
2850 return NT_STATUS_OK;
2851 }
2852
2853 /****************************************************************************
2854 ****************************************************************************/
2855
2856 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
2857 const struct ndr_syntax_id *interface,
2858 struct rpc_pipe_client **presult)
2859 {
2860 return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
2861 interface, presult);
2862 }
2863
2864 /****************************************************************************
2865 Open a named pipe to an SMB server and bind using NTLMSSP or SPNEGO NTLMSSP
2866 ****************************************************************************/
2867
2868 NTSTATUS cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
2869 const struct ndr_syntax_id *interface,
2870 enum dcerpc_transport_t transport,
2871 enum dcerpc_AuthLevel auth_level,
2872 const char *domain,
2873 const char *username,
2874 const char *password,
2875 struct rpc_pipe_client **presult)
2876 {
2877 struct rpc_pipe_client *result;
2878 struct pipe_auth_data *auth = NULL;
2879 enum dcerpc_AuthType auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
2880 NTSTATUS status;
2881
2882 status = cli_rpc_pipe_open(cli, transport, interface, &result);
2883 if (!NT_STATUS_IS_OK(status)) {
2884 return status;
2885 }
2886
2887 status = rpccli_ntlmssp_bind_data(result,
2888 auth_type, auth_level,
2889 domain, username, password,
2890 &auth);
2891 if (!NT_STATUS_IS_OK(status)) {
2892 DEBUG(0, ("rpccli_ntlmssp_bind_data returned %s\n",
2893 nt_errstr(status)));
2894 goto err;
2895 }
2896
2897 status = rpc_pipe_bind(result, auth);
2898 if (!NT_STATUS_IS_OK(status)) {
2899 DEBUG(0, ("cli_rpc_pipe_open_ntlmssp_internal: cli_rpc_pipe_bind failed with error %s\n",
2900 nt_errstr(status) ));
2901 goto err;
2902 }
2903
2904 DEBUG(10,("cli_rpc_pipe_open_ntlmssp_internal: opened pipe %s to "
2905 "machine %s and bound NTLMSSP as user %s\\%s.\n",
2906 get_pipe_name_from_syntax(talloc_tos(), interface),
2907 result->desthost, domain, username));
2908
2909 *presult = result;
2910 return NT_STATUS_OK;
2911
2912 err:
2913
2914 TALLOC_FREE(result);
2915 return status;
2916 }
2917
2918 /****************************************************************************
2919 External interface.
2920 Open a named pipe to an SMB server and bind using schannel (bind type 68)
2921 using session_key. sign and seal.
2922
2923 The *pdc will be stolen onto this new pipe
2924 ****************************************************************************/
2925
2926 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
2927 const struct ndr_syntax_id *interface,
2928 enum dcerpc_transport_t transport,
2929 enum dcerpc_AuthLevel auth_level,
2930 const char *domain,
2931 struct netlogon_creds_CredentialState **pdc,
2932 struct rpc_pipe_client **presult)
2933 {
2934 struct rpc_pipe_client *result;
2935 struct pipe_auth_data *auth;
2936 NTSTATUS status;
2937
2938 status = cli_rpc_pipe_open(cli, transport, interface, &result);
2939 if (!NT_STATUS_IS_OK(status)) {
2940 return status;
2941 }
2942
2943 status = rpccli_schannel_bind_data(result, domain, auth_level,
2944 *pdc, &auth);
2945 if (!NT_STATUS_IS_OK(status)) {
2946 DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
2947 nt_errstr(status)));
2948 TALLOC_FREE(result);
2949 return status;
2950 }
2951
2952 status = rpc_pipe_bind(result, auth);
2953 if (!NT_STATUS_IS_OK(status)) {
2954 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
2955 "cli_rpc_pipe_bind failed with error %s\n",
2956 nt_errstr(status) ));
2957 TALLOC_FREE(result);
2958 return status;
2959 }
2960
2961 /*
2962 * The credentials on a new netlogon pipe are the ones we are passed
2963 * in - copy them over
2964 */
2965 result->dc = netlogon_creds_copy(result, *pdc);
2966 if (result->dc == NULL) {
2967 TALLOC_FREE(result);
2968 return NT_STATUS_NO_MEMORY;
2969 }
2970
2971 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
2972 "for domain %s and bound using schannel.\n",
2973 get_pipe_name_from_syntax(talloc_tos(), interface),
2974 result->desthost, domain));
2975
2976 *presult = result;
2977 return NT_STATUS_OK;
2978 }
2979
2980 /****************************************************************************
2981 Open a named pipe to an SMB server and bind using krb5 (bind type 16).
2982 The idea is this can be called with service_princ, username and password all
2983 NULL so long as the caller has a TGT.
2984 ****************************************************************************/
2985
2986 NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
2987 const struct ndr_syntax_id *interface,
2988 enum dcerpc_transport_t transport,
2989 enum dcerpc_AuthLevel auth_level,
2990 const char *server,
2991 const char *username,
2992 const char *password,
2993 struct rpc_pipe_client **presult)
2994 {
2995 struct rpc_pipe_client *result;
2996 struct pipe_auth_data *auth;
2997 struct gse_context *gse_ctx;
2998 NTSTATUS status;
2999
3000 status = cli_rpc_pipe_open(cli, transport, interface, &result);
3001 if (!NT_STATUS_IS_OK(status)) {
3002 return status;
3003 }
3004
3005 auth = talloc(result, struct pipe_auth_data);
3006 if (auth == NULL) {
3007 status = NT_STATUS_NO_MEMORY;
3008 goto err_out;
3009 }
3010 auth->auth_type = DCERPC_AUTH_TYPE_KRB5;
3011 auth->auth_level = auth_level;
3012
3013 if (!username) {
3014 username = "";
3015 }
3016 auth->user_name = talloc_strdup(auth, username);
3017 if (!auth->user_name) {
3018 status = NT_STATUS_NO_MEMORY;
3019 goto err_out;
3020 }
3021
3022 /* Fixme, should we fetch/set the Realm ? */
3023 auth->domain = talloc_strdup(auth, "");
3024 if (!auth->domain) {
3025 status = NT_STATUS_NO_MEMORY;
3026 goto err_out;
3027 }
3028
3029 status = gse_init_client(auth,
3030 (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY),
3031 (auth_level == DCERPC_AUTH_LEVEL_PRIVACY),
3032 NULL, server, "cifs", username, password,
3033 GSS_C_DCE_STYLE, &gse_ctx);
3034 if (!NT_STATUS_IS_OK(status)) {
3035 DEBUG(0, ("gse_init_client returned %s\n",
3036 nt_errstr(status)));
3037 goto err_out;
3038 }
3039 auth->auth_ctx = gse_ctx;
3040
3041 status = rpc_pipe_bind(result, auth);
3042 if (!NT_STATUS_IS_OK(status)) {
3043 DEBUG(0, ("cli_rpc_pipe_bind failed with error %s\n",
3044 nt_errstr(status)));
3045 goto err_out;
3046 }
3047
3048 *presult = result;
3049 return NT_STATUS_OK;
3050
3051 err_out:
3052 TALLOC_FREE(result);
3053 return status;
3054 }
3055
3056 NTSTATUS cli_rpc_pipe_open_spnego_krb5(struct cli_state *cli,
3057 const struct ndr_syntax_id *interface,
3058 enum dcerpc_transport_t transport,
3059 enum dcerpc_AuthLevel auth_level,
3060 const char *server,
3061 const char *username,
3062 const char *password,
3063 struct rpc_pipe_client **presult)
3064 {
3065 struct rpc_pipe_client *result;
3066 struct pipe_auth_data *auth;
3067 struct spnego_context *spnego_ctx;
3068 NTSTATUS status;
3069
3070 status = cli_rpc_pipe_open(cli, transport, interface, &result);
3071 if (!NT_STATUS_IS_OK(status)) {
3072 return status;
3073 }
3074
3075 auth = talloc(result, struct pipe_auth_data);
3076 if (auth == NULL) {
3077 status = NT_STATUS_NO_MEMORY;
3078 goto err_out;
3079 }
3080 auth->auth_type = DCERPC_AUTH_TYPE_SPNEGO;
3081 auth->auth_level = auth_level;
3082
3083 if (!username) {
3084 username = "";
3085 }
3086 auth->user_name = talloc_strdup(auth, username);
3087 if (!auth->user_name) {
3088 status = NT_STATUS_NO_MEMORY;
3089 goto err_out;
3090 }
3091
3092 /* Fixme, should we fetch/set the Realm ? */
3093 auth->domain = talloc_strdup(auth, "");
3094 if (!auth->domain) {
3095 status = NT_STATUS_NO_MEMORY;
3096 goto err_out;
3097 }
3098
3099 status = spnego_gssapi_init_client(auth,
3100 (auth->auth_level ==
3101 DCERPC_AUTH_LEVEL_INTEGRITY),
3102 (auth->auth_level ==
3103 DCERPC_AUTH_LEVEL_PRIVACY),
3104 true,
3105 NULL, server, "cifs",
3106 username, password,
3107 &spnego_ctx);
3108 if (!NT_STATUS_IS_OK(status)) {
3109 DEBUG(0, ("spnego_init_client returned %s\n",
3110 nt_errstr(status)));
3111 goto err_out;
3112 }
3113 auth->auth_ctx = spnego_ctx;
3114
3115 status = rpc_pipe_bind(result, auth);
3116 if (!NT_STATUS_IS_OK(status)) {
3117 DEBUG(0, ("cli_rpc_pipe_bind failed with error %s\n",
3118 nt_errstr(status)));
3119 goto err_out;
3120 }
3121
3122 *presult = result;
3123 return NT_STATUS_OK;
3124
3125 err_out:
3126 TALLOC_FREE(result);
3127 return status;
3128 }
3129
3130 NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
3131 const struct ndr_syntax_id *interface,
3132 enum dcerpc_transport_t transport,
3133 enum dcerpc_AuthLevel auth_level,
3134 const char *domain,
3135 const char *username,
3136 const char *password,
3137 struct rpc_pipe_client **presult)
3138 {
3139 struct rpc_pipe_client *result;
3140 struct pipe_auth_data *auth;
3141 struct spnego_context *spnego_ctx;
3142 NTSTATUS status;
3143
3144 status = cli_rpc_pipe_open(cli, transport, interface, &result);
3145 if (!NT_STATUS_IS_OK(status)) {
3146 return status;
3147 }
3148
3149 auth = talloc(result, struct pipe_auth_data);
3150 if (auth == NULL) {
3151 status = NT_STATUS_NO_MEMORY;
3152 goto err_out;
3153 }
3154 auth->auth_type = DCERPC_AUTH_TYPE_SPNEGO;
3155 auth->auth_level = auth_level;
3156
3157 if (!username) {
3158 username = "";
3159 }
3160 auth->user_name = talloc_strdup(auth, username);
3161 if (!auth->user_name) {
3162 status = NT_STATUS_NO_MEMORY;
3163 goto err_out;
3164 }
3165
3166 if (!domain) {
3167 domain = "";
3168 }
3169 auth->domain = talloc_strdup(auth, domain);
3170 if (!auth->domain) {
3171 status = NT_STATUS_NO_MEMORY;
3172 goto err_out;
3173 }
3174
3175 status = spnego_ntlmssp_init_client(auth,
3176 (auth->auth_level ==
3177 DCERPC_AUTH_LEVEL_INTEGRITY),
3178 (auth->auth_level ==
3179 DCERPC_AUTH_LEVEL_PRIVACY),
3180 true,
3181 domain, username, password,
3182 &spnego_ctx);
3183 if (!NT_STATUS_IS_OK(status)) {
3184 DEBUG(0, ("spnego_init_client returned %s\n",
3185 nt_errstr(status)));
3186 goto err_out;
3187 }
3188 auth->auth_ctx = spnego_ctx;
3189
3190 status = rpc_pipe_bind(result, auth);
3191 if (!NT_STATUS_IS_OK(status)) {
3192 DEBUG(0, ("cli_rpc_pipe_bind failed with error %s\n",
3193 nt_errstr(status)));
3194 goto err_out;
3195 }
3196
3197 *presult = result;
3198 return NT_STATUS_OK;
3199
3200 err_out:
3201 TALLOC_FREE(result);
3202 return status;
3203 }
3204
3205 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
3206 struct rpc_pipe_client *cli,
3207 DATA_BLOB *session_key)
3208 {
3209 struct pipe_auth_data *a;
3210 struct schannel_state *schannel_auth;
3211 struct auth_ntlmssp_state *ntlmssp_ctx;
3212 struct spnego_context *spnego_ctx;
3213 struct gse_context *gse_ctx;
3214 DATA_BLOB sk = data_blob_null;
3215 bool make_dup = false;
3216
3217 if (!session_key || !cli) {
3218 return NT_STATUS_INVALID_PARAMETER;
3219 }
3220
3221 a = cli->auth;
3222
3223 if (a == NULL) {
3224 return NT_STATUS_INVALID_PARAMETER;
3225 }
3226
3227 switch (cli->auth->auth_type) {
3228 case DCERPC_AUTH_TYPE_SCHANNEL:
3229 schannel_auth = talloc_get_type_abort(a->auth_ctx,
3230 struct schannel_state);
3231 sk = data_blob_const(schannel_auth->creds->session_key, 16);
3232 make_dup = true;
3233 break;
3234 case DCERPC_AUTH_TYPE_SPNEGO:
3235 spnego_ctx = talloc_get_type_abort(a->auth_ctx,
3236 struct spnego_context);
3237 sk = spnego_get_session_key(mem_ctx, spnego_ctx);
3238 make_dup = false;
3239 break;
3240 case DCERPC_AUTH_TYPE_NTLMSSP:
3241 ntlmssp_ctx = talloc_get_type_abort(a->auth_ctx,
3242 struct auth_ntlmssp_state);
3243 sk = auth_ntlmssp_get_session_key(ntlmssp_ctx, mem_ctx);
3244 make_dup = false;
3245 break;
3246 case DCERPC_AUTH_TYPE_KRB5:
3247 gse_ctx = talloc_get_type_abort(a->auth_ctx,
3248 struct gse_context);
3249 sk = gse_get_session_key(mem_ctx, gse_ctx);
3250 make_dup = false;
3251 break;
3252 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
3253 case DCERPC_AUTH_TYPE_NONE:
3254 sk = data_blob_const(a->user_session_key.data,
3255 a->user_session_key.length);
3256 make_dup = true;
3257 break;
3258 default:
3259 break;
3260 }
3261
3262 if (!sk.data) {
3263 return NT_STATUS_NO_USER_SESSION_KEY;
3264 }
3265
3266 if (make_dup) {
3267 *session_key = data_blob_dup_talloc(mem_ctx, &sk);
3268 } else {
3269 *session_key = sk;
3270 }
3271
3272 return NT_STATUS_OK;
3273 }
reg import