?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
CVE-2013-4408:s3:Ensure we always check call_id when validating an RPC reply.
[Samba/wip.git] / source3 / rpc_client / cli_pipe.c
blob87c3e8ff0b2a8cb8dd6ce953f8282fa328b15873
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client routines
4 * Largely rewritten by Jeremy Allison 2005.
5 * Heavily modified by Simo Sorce 2010.
6 * Copyright Andrew Bartlett 2011.
7 *
8 * This program is free software; you can redistribute it and/or modify
9 * it under the terms of the GNU General Public License as published by
10 * the Free Software Foundation; either version 3 of the License, or
11 * (at your option) any later version.
12 *
13 * This program is distributed in the hope that it will be useful,
14 * but WITHOUT ANY WARRANTY; without even the implied warranty of
15 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 * GNU General Public License for more details.
17 *
18 * You should have received a copy of the GNU General Public License
19 * along with this program; if not, see <http://www.gnu.org/licenses/>.
20 */
21
22 #include "includes.h"
23 #include "../lib/util/tevent_ntstatus.h"
24 #include "librpc/gen_ndr/ndr_epmapper_c.h"
25 #include "../librpc/gen_ndr/ndr_dssetup.h"
26 #include "../libcli/auth/schannel.h"
27 #include "auth_generic.h"
28 #include "librpc/gen_ndr/ndr_dcerpc.h"
29 #include "librpc/gen_ndr/ndr_netlogon_c.h"
30 #include "librpc/rpc/dcerpc.h"
31 #include "rpc_dce.h"
32 #include "cli_pipe.h"
33 #include "libsmb/libsmb.h"
34 #include "auth/gensec/gensec.h"
35 #include "auth/credentials/credentials.h"
36 #include "../libcli/smb/smbXcli_base.h"
37
38 #undef DBGC_CLASS
39 #define DBGC_CLASS DBGC_RPC_CLI
40
41 /********************************************************************
42 Pipe description for a DEBUG
43 ********************************************************************/
44 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
45 struct rpc_pipe_client *cli)
46 {
47 char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
48 if (result == NULL) {
49 return "pipe";
50 }
51 return result;
52 }
53
54 /********************************************************************
55 Rpc pipe call id.
56 ********************************************************************/
57
58 static uint32 get_rpc_call_id(void)
59 {
60 static uint32 call_id = 0;
61 return ++call_id;
62 }
63
64 /*******************************************************************
65 Use SMBreadX to get rest of one fragment's worth of rpc data.
66 Reads the whole size or give an error message
67 ********************************************************************/
68
69 struct rpc_read_state {
70 struct tevent_context *ev;
71 struct rpc_cli_transport *transport;
72 uint8_t *data;
73 size_t size;
74 size_t num_read;
75 };
76
77 static void rpc_read_done(struct tevent_req *subreq);
78
79 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
80 struct tevent_context *ev,
81 struct rpc_cli_transport *transport,
82 uint8_t *data, size_t size)
83 {
84 struct tevent_req *req, *subreq;
85 struct rpc_read_state *state;
86
87 req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
88 if (req == NULL) {
89 return NULL;
90 }
91 state->ev = ev;
92 state->transport = transport;
93 state->data = data;
94 state->size = size;
95 state->num_read = 0;
96
97 DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
98
99 subreq = transport->read_send(state, ev, (uint8_t *)data, size,
100 transport->priv);
101 if (subreq == NULL) {
102 goto fail;
103 }
104 tevent_req_set_callback(subreq, rpc_read_done, req);
105 return req;
106
107 fail:
108 TALLOC_FREE(req);
109 return NULL;
110 }
111
112 static void rpc_read_done(struct tevent_req *subreq)
113 {
114 struct tevent_req *req = tevent_req_callback_data(
115 subreq, struct tevent_req);
116 struct rpc_read_state *state = tevent_req_data(
117 req, struct rpc_read_state);
118 NTSTATUS status;
119 ssize_t received;
120
121 status = state->transport->read_recv(subreq, &received);
122 TALLOC_FREE(subreq);
123 if (!NT_STATUS_IS_OK(status)) {
124 tevent_req_nterror(req, status);
125 return;
126 }
127
128 state->num_read += received;
129 if (state->num_read == state->size) {
130 tevent_req_done(req);
131 return;
132 }
133
134 subreq = state->transport->read_send(state, state->ev,
135 state->data + state->num_read,
136 state->size - state->num_read,
137 state->transport->priv);
138 if (tevent_req_nomem(subreq, req)) {
139 return;
140 }
141 tevent_req_set_callback(subreq, rpc_read_done, req);
142 }
143
144 static NTSTATUS rpc_read_recv(struct tevent_req *req)
145 {
146 return tevent_req_simple_recv_ntstatus(req);
147 }
148
149 struct rpc_write_state {
150 struct tevent_context *ev;
151 struct rpc_cli_transport *transport;
152 const uint8_t *data;
153 size_t size;
154 size_t num_written;
155 };
156
157 static void rpc_write_done(struct tevent_req *subreq);
158
159 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
160 struct tevent_context *ev,
161 struct rpc_cli_transport *transport,
162 const uint8_t *data, size_t size)
163 {
164 struct tevent_req *req, *subreq;
165 struct rpc_write_state *state;
166
167 req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
168 if (req == NULL) {
169 return NULL;
170 }
171 state->ev = ev;
172 state->transport = transport;
173 state->data = data;
174 state->size = size;
175 state->num_written = 0;
176
177 DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
178
179 subreq = transport->write_send(state, ev, data, size, transport->priv);
180 if (subreq == NULL) {
181 goto fail;
182 }
183 tevent_req_set_callback(subreq, rpc_write_done, req);
184 return req;
185 fail:
186 TALLOC_FREE(req);
187 return NULL;
188 }
189
190 static void rpc_write_done(struct tevent_req *subreq)
191 {
192 struct tevent_req *req = tevent_req_callback_data(
193 subreq, struct tevent_req);
194 struct rpc_write_state *state = tevent_req_data(
195 req, struct rpc_write_state);
196 NTSTATUS status;
197 ssize_t written;
198
199 status = state->transport->write_recv(subreq, &written);
200 TALLOC_FREE(subreq);
201 if (!NT_STATUS_IS_OK(status)) {
202 tevent_req_nterror(req, status);
203 return;
204 }
205
206 state->num_written += written;
207
208 if (state->num_written == state->size) {
209 tevent_req_done(req);
210 return;
211 }
212
213 subreq = state->transport->write_send(state, state->ev,
214 state->data + state->num_written,
215 state->size - state->num_written,
216 state->transport->priv);
217 if (tevent_req_nomem(subreq, req)) {
218 return;
219 }
220 tevent_req_set_callback(subreq, rpc_write_done, req);
221 }
222
223 static NTSTATUS rpc_write_recv(struct tevent_req *req)
224 {
225 return tevent_req_simple_recv_ntstatus(req);
226 }
227
228
229 /****************************************************************************
230 Try and get a PDU's worth of data from current_pdu. If not, then read more
231 from the wire.
232 ****************************************************************************/
233
234 struct get_complete_frag_state {
235 struct tevent_context *ev;
236 struct rpc_pipe_client *cli;
237 uint16_t frag_len;
238 DATA_BLOB *pdu;
239 };
240
241 static void get_complete_frag_got_header(struct tevent_req *subreq);
242 static void get_complete_frag_got_rest(struct tevent_req *subreq);
243
244 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
245 struct tevent_context *ev,
246 struct rpc_pipe_client *cli,
247 DATA_BLOB *pdu)
248 {
249 struct tevent_req *req, *subreq;
250 struct get_complete_frag_state *state;
251 size_t received;
252 NTSTATUS status;
253
254 req = tevent_req_create(mem_ctx, &state,
255 struct get_complete_frag_state);
256 if (req == NULL) {
257 return NULL;
258 }
259 state->ev = ev;
260 state->cli = cli;
261 state->frag_len = RPC_HEADER_LEN;
262 state->pdu = pdu;
263
264 received = pdu->length;
265 if (received < RPC_HEADER_LEN) {
266 if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
267 status = NT_STATUS_NO_MEMORY;
268 goto post_status;
269 }
270 subreq = rpc_read_send(state, state->ev,
271 state->cli->transport,
272 pdu->data + received,
273 RPC_HEADER_LEN - received);
274 if (subreq == NULL) {
275 status = NT_STATUS_NO_MEMORY;
276 goto post_status;
277 }
278 tevent_req_set_callback(subreq, get_complete_frag_got_header,
279 req);
280 return req;
281 }
282
283 state->frag_len = dcerpc_get_frag_length(pdu);
284 if (state->frag_len < RPC_HEADER_LEN) {
285 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
286 return tevent_req_post(req, ev);
287 }
288
289 /*
290 * Ensure we have frag_len bytes of data.
291 */
292 if (received < state->frag_len) {
293 if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
294 status = NT_STATUS_NO_MEMORY;
295 goto post_status;
296 }
297 subreq = rpc_read_send(state, state->ev,
298 state->cli->transport,
299 pdu->data + received,
300 state->frag_len - received);
301 if (subreq == NULL) {
302 status = NT_STATUS_NO_MEMORY;
303 goto post_status;
304 }
305 tevent_req_set_callback(subreq, get_complete_frag_got_rest,
306 req);
307 return req;
308 }
309
310 status = NT_STATUS_OK;
311 post_status:
312 if (NT_STATUS_IS_OK(status)) {
313 tevent_req_done(req);
314 } else {
315 tevent_req_nterror(req, status);
316 }
317 return tevent_req_post(req, ev);
318 }
319
320 static void get_complete_frag_got_header(struct tevent_req *subreq)
321 {
322 struct tevent_req *req = tevent_req_callback_data(
323 subreq, struct tevent_req);
324 struct get_complete_frag_state *state = tevent_req_data(
325 req, struct get_complete_frag_state);
326 NTSTATUS status;
327
328 status = rpc_read_recv(subreq);
329 TALLOC_FREE(subreq);
330 if (!NT_STATUS_IS_OK(status)) {
331 tevent_req_nterror(req, status);
332 return;
333 }
334
335 state->frag_len = dcerpc_get_frag_length(state->pdu);
336 if (state->frag_len < RPC_HEADER_LEN) {
337 tevent_req_nterror(req, NT_STATUS_RPC_PROTOCOL_ERROR);
338 return;
339 }
340
341 if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
342 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
343 return;
344 }
345
346 /*
347 * We're here in this piece of code because we've read exactly
348 * RPC_HEADER_LEN bytes into state->pdu.
349 */
350
351 subreq = rpc_read_send(state, state->ev, state->cli->transport,
352 state->pdu->data + RPC_HEADER_LEN,
353 state->frag_len - RPC_HEADER_LEN);
354 if (tevent_req_nomem(subreq, req)) {
355 return;
356 }
357 tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
358 }
359
360 static void get_complete_frag_got_rest(struct tevent_req *subreq)
361 {
362 struct tevent_req *req = tevent_req_callback_data(
363 subreq, struct tevent_req);
364 NTSTATUS status;
365
366 status = rpc_read_recv(subreq);
367 TALLOC_FREE(subreq);
368 if (!NT_STATUS_IS_OK(status)) {
369 tevent_req_nterror(req, status);
370 return;
371 }
372 tevent_req_done(req);
373 }
374
375 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
376 {
377 return tevent_req_simple_recv_ntstatus(req);
378 }
379
380 /****************************************************************************
381 Do basic authentication checks on an incoming pdu.
382 ****************************************************************************/
383
384 static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
385 struct rpc_pipe_client *cli,
386 struct ncacn_packet *pkt,
387 DATA_BLOB *pdu,
388 uint8_t expected_pkt_type,
389 uint32_t call_id,
390 DATA_BLOB *rdata,
391 DATA_BLOB *reply_pdu)
392 {
393 struct dcerpc_response *r;
394 NTSTATUS ret = NT_STATUS_OK;
395 size_t pad_len = 0;
396
397 /*
398 * Point the return values at the real data including the RPC
399 * header. Just in case the caller wants it.
400 */
401 *rdata = *pdu;
402
403 /* Ensure we have the correct type. */
404 switch (pkt->ptype) {
405 case DCERPC_PKT_ALTER_RESP:
406 case DCERPC_PKT_BIND_ACK:
407
408 /* Client code never receives this kind of packets */
409 break;
410
411
412 case DCERPC_PKT_RESPONSE:
413
414 r = &pkt->u.response;
415
416 /* Here's where we deal with incoming sign/seal. */
417 ret = dcerpc_check_auth(cli->auth, pkt,
418 &r->stub_and_verifier,
419 DCERPC_RESPONSE_LENGTH,
420 pdu, &pad_len);
421 if (!NT_STATUS_IS_OK(ret)) {
422 return ret;
423 }
424
425 if (pkt->frag_length < DCERPC_RESPONSE_LENGTH + pad_len) {
426 return NT_STATUS_BUFFER_TOO_SMALL;
427 }
428
429 /* Point the return values at the NDR data. */
430 rdata->data = r->stub_and_verifier.data;
431
432 if (pkt->auth_length) {
433 /* We've already done integer wrap tests in
434 * dcerpc_check_auth(). */
435 rdata->length = r->stub_and_verifier.length
436 - pad_len
437 - DCERPC_AUTH_TRAILER_LENGTH
438 - pkt->auth_length;
439 } else {
440 rdata->length = r->stub_and_verifier.length;
441 }
442
443 DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
444 (long unsigned int)pdu->length,
445 (long unsigned int)rdata->length,
446 (unsigned int)pad_len));
447
448 /*
449 * If this is the first reply, and the allocation hint is
450 * reasonable, try and set up the reply_pdu DATA_BLOB to the
451 * correct size.
452 */
453
454 if ((reply_pdu->length == 0) &&
455 r->alloc_hint && (r->alloc_hint < 15*1024*1024)) {
456 if (!data_blob_realloc(mem_ctx, reply_pdu,
457 r->alloc_hint)) {
458 DEBUG(0, ("reply alloc hint %d too "
459 "large to allocate\n",
460 (int)r->alloc_hint));
461 return NT_STATUS_NO_MEMORY;
462 }
463 }
464
465 break;
466
467 case DCERPC_PKT_BIND_NAK:
468 DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
469 rpccli_pipe_txt(talloc_tos(), cli)));
470 /* Use this for now... */
471 return NT_STATUS_NETWORK_ACCESS_DENIED;
472
473 case DCERPC_PKT_FAULT:
474
475 DEBUG(1, (__location__ ": RPC fault code %s received "
476 "from %s!\n",
477 dcerpc_errstr(talloc_tos(),
478 pkt->u.fault.status),
479 rpccli_pipe_txt(talloc_tos(), cli)));
480
481 return dcerpc_fault_to_nt_status(pkt->u.fault.status);
482
483 default:
484 DEBUG(0, (__location__ "Unknown packet type %u received "
485 "from %s!\n",
486 (unsigned int)pkt->ptype,
487 rpccli_pipe_txt(talloc_tos(), cli)));
488 return NT_STATUS_RPC_PROTOCOL_ERROR;
489 }
490
491 if (pkt->ptype != expected_pkt_type) {
492 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
493 "RPC packet type - %u, not %u\n",
494 rpccli_pipe_txt(talloc_tos(), cli),
495 pkt->ptype, expected_pkt_type));
496 return NT_STATUS_RPC_PROTOCOL_ERROR;
497 }
498
499 if (pkt->call_id != call_id) {
500 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
501 "RPC call_id - %u, not %u\n",
502 rpccli_pipe_txt(talloc_tos(), cli),
503 pkt->call_id, call_id));
504 return NT_STATUS_RPC_PROTOCOL_ERROR;
505 }
506
507 /* Do this just before return - we don't want to modify any rpc header
508 data before now as we may have needed to do cryptographic actions on
509 it before. */
510
511 if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
512 !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
513 DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
514 "fragment first/last ON.\n"));
515 pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
516 }
517
518 return NT_STATUS_OK;
519 }
520
521 /****************************************************************************
522 Call a remote api on an arbitrary pipe. takes param, data and setup buffers.
523 ****************************************************************************/
524
525 struct cli_api_pipe_state {
526 struct tevent_context *ev;
527 struct rpc_cli_transport *transport;
528 uint8_t *rdata;
529 uint32_t rdata_len;
530 };
531
532 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
533 static void cli_api_pipe_write_done(struct tevent_req *subreq);
534 static void cli_api_pipe_read_done(struct tevent_req *subreq);
535
536 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
537 struct tevent_context *ev,
538 struct rpc_cli_transport *transport,
539 uint8_t *data, size_t data_len,
540 uint32_t max_rdata_len)
541 {
542 struct tevent_req *req, *subreq;
543 struct cli_api_pipe_state *state;
544 NTSTATUS status;
545
546 req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
547 if (req == NULL) {
548 return NULL;
549 }
550 state->ev = ev;
551 state->transport = transport;
552
553 if (max_rdata_len < RPC_HEADER_LEN) {
554 /*
555 * For a RPC reply we always need at least RPC_HEADER_LEN
556 * bytes. We check this here because we will receive
557 * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
558 */
559 status = NT_STATUS_INVALID_PARAMETER;
560 goto post_status;
561 }
562
563 if (transport->trans_send != NULL) {
564 subreq = transport->trans_send(state, ev, data, data_len,
565 max_rdata_len, transport->priv);
566 if (subreq == NULL) {
567 goto fail;
568 }
569 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
570 return req;
571 }
572
573 /*
574 * If the transport does not provide a "trans" routine, i.e. for
575 * example the ncacn_ip_tcp transport, do the write/read step here.
576 */
577
578 subreq = rpc_write_send(state, ev, transport, data, data_len);
579 if (subreq == NULL) {
580 goto fail;
581 }
582 tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
583 return req;
584
585 post_status:
586 tevent_req_nterror(req, status);
587 return tevent_req_post(req, ev);
588 fail:
589 TALLOC_FREE(req);
590 return NULL;
591 }
592
593 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
594 {
595 struct tevent_req *req = tevent_req_callback_data(
596 subreq, struct tevent_req);
597 struct cli_api_pipe_state *state = tevent_req_data(
598 req, struct cli_api_pipe_state);
599 NTSTATUS status;
600
601 status = state->transport->trans_recv(subreq, state, &state->rdata,
602 &state->rdata_len);
603 TALLOC_FREE(subreq);
604 if (!NT_STATUS_IS_OK(status)) {
605 tevent_req_nterror(req, status);
606 return;
607 }
608 tevent_req_done(req);
609 }
610
611 static void cli_api_pipe_write_done(struct tevent_req *subreq)
612 {
613 struct tevent_req *req = tevent_req_callback_data(
614 subreq, struct tevent_req);
615 struct cli_api_pipe_state *state = tevent_req_data(
616 req, struct cli_api_pipe_state);
617 NTSTATUS status;
618
619 status = rpc_write_recv(subreq);
620 TALLOC_FREE(subreq);
621 if (!NT_STATUS_IS_OK(status)) {
622 tevent_req_nterror(req, status);
623 return;
624 }
625
626 state->rdata = talloc_array(state, uint8_t, RPC_HEADER_LEN);
627 if (tevent_req_nomem(state->rdata, req)) {
628 return;
629 }
630
631 /*
632 * We don't need to use rpc_read_send here, the upper layer will cope
633 * with a short read, transport->trans_send could also return less
634 * than state->max_rdata_len.
635 */
636 subreq = state->transport->read_send(state, state->ev, state->rdata,
637 RPC_HEADER_LEN,
638 state->transport->priv);
639 if (tevent_req_nomem(subreq, req)) {
640 return;
641 }
642 tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
643 }
644
645 static void cli_api_pipe_read_done(struct tevent_req *subreq)
646 {
647 struct tevent_req *req = tevent_req_callback_data(
648 subreq, struct tevent_req);
649 struct cli_api_pipe_state *state = tevent_req_data(
650 req, struct cli_api_pipe_state);
651 NTSTATUS status;
652 ssize_t received;
653
654 status = state->transport->read_recv(subreq, &received);
655 TALLOC_FREE(subreq);
656 if (!NT_STATUS_IS_OK(status)) {
657 tevent_req_nterror(req, status);
658 return;
659 }
660 state->rdata_len = received;
661 tevent_req_done(req);
662 }
663
664 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
665 uint8_t **prdata, uint32_t *prdata_len)
666 {
667 struct cli_api_pipe_state *state = tevent_req_data(
668 req, struct cli_api_pipe_state);
669 NTSTATUS status;
670
671 if (tevent_req_is_nterror(req, &status)) {
672 return status;
673 }
674
675 *prdata = talloc_move(mem_ctx, &state->rdata);
676 *prdata_len = state->rdata_len;
677 return NT_STATUS_OK;
678 }
679
680 /****************************************************************************
681 Send data on an rpc pipe via trans. The data must be the last
682 pdu fragment of an NDR data stream.
683
684 Receive response data from an rpc pipe, which may be large...
685
686 Read the first fragment: unfortunately have to use SMBtrans for the first
687 bit, then SMBreadX for subsequent bits.
688
689 If first fragment received also wasn't the last fragment, continue
690 getting fragments until we _do_ receive the last fragment.
691
692 Request/Response PDU's look like the following...
693
694 |<------------------PDU len----------------------------------------------->|
695 |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
696
697 +------------+-----------------+-------------+---------------+-------------+
698 | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR | AUTH DATA |
699 +------------+-----------------+-------------+---------------+-------------+
700
701 Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
702 signing & sealing being negotiated.
703
704 ****************************************************************************/
705
706 struct rpc_api_pipe_state {
707 struct tevent_context *ev;
708 struct rpc_pipe_client *cli;
709 uint8_t expected_pkt_type;
710 uint32_t call_id;
711
712 DATA_BLOB incoming_frag;
713 struct ncacn_packet *pkt;
714
715 /* Incoming reply */
716 DATA_BLOB reply_pdu;
717 size_t reply_pdu_offset;
718 uint8_t endianess;
719 };
720
721 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
722 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
723 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq);
724
725 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
726 struct tevent_context *ev,
727 struct rpc_pipe_client *cli,
728 DATA_BLOB *data, /* Outgoing PDU */
729 uint8_t expected_pkt_type,
730 uint32_t call_id)
731 {
732 struct tevent_req *req, *subreq;
733 struct rpc_api_pipe_state *state;
734 uint16_t max_recv_frag;
735 NTSTATUS status;
736
737 req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
738 if (req == NULL) {
739 return NULL;
740 }
741 state->ev = ev;
742 state->cli = cli;
743 state->expected_pkt_type = expected_pkt_type;
744 state->call_id = call_id;
745 state->endianess = DCERPC_DREP_LE;
746
747 /*
748 * Ensure we're not sending too much.
749 */
750 if (data->length > cli->max_xmit_frag) {
751 status = NT_STATUS_INVALID_PARAMETER;
752 goto post_status;
753 }
754
755 DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
756
757 if (state->expected_pkt_type == DCERPC_PKT_AUTH3) {
758 subreq = rpc_write_send(state, ev, cli->transport,
759 data->data, data->length);
760 if (subreq == NULL) {
761 goto fail;
762 }
763 tevent_req_set_callback(subreq, rpc_api_pipe_auth3_done, req);
764 return req;
765 }
766
767 /* get the header first, then fetch the rest once we have
768 * the frag_length available */
769 max_recv_frag = RPC_HEADER_LEN;
770
771 subreq = cli_api_pipe_send(state, ev, cli->transport,
772 data->data, data->length, max_recv_frag);
773 if (subreq == NULL) {
774 goto fail;
775 }
776 tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
777 return req;
778
779 post_status:
780 tevent_req_nterror(req, status);
781 return tevent_req_post(req, ev);
782 fail:
783 TALLOC_FREE(req);
784 return NULL;
785 }
786
787 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq)
788 {
789 struct tevent_req *req =
790 tevent_req_callback_data(subreq,
791 struct tevent_req);
792 NTSTATUS status;
793
794 status = rpc_write_recv(subreq);
795 TALLOC_FREE(subreq);
796 if (!NT_STATUS_IS_OK(status)) {
797 tevent_req_nterror(req, status);
798 return;
799 }
800
801 tevent_req_done(req);
802 }
803
804 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
805 {
806 struct tevent_req *req = tevent_req_callback_data(
807 subreq, struct tevent_req);
808 struct rpc_api_pipe_state *state = tevent_req_data(
809 req, struct rpc_api_pipe_state);
810 NTSTATUS status;
811 uint8_t *rdata = NULL;
812 uint32_t rdata_len = 0;
813
814 status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
815 TALLOC_FREE(subreq);
816 if (!NT_STATUS_IS_OK(status)) {
817 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
818 tevent_req_nterror(req, status);
819 return;
820 }
821
822 if (rdata == NULL) {
823 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
824 rpccli_pipe_txt(talloc_tos(), state->cli)));
825 tevent_req_done(req);
826 return;
827 }
828
829 /*
830 * Move data on state->incoming_frag.
831 */
832 state->incoming_frag.data = talloc_move(state, &rdata);
833 state->incoming_frag.length = rdata_len;
834 if (!state->incoming_frag.data) {
835 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
836 return;
837 }
838
839 /* Ensure we have enough data for a pdu. */
840 subreq = get_complete_frag_send(state, state->ev, state->cli,
841 &state->incoming_frag);
842 if (tevent_req_nomem(subreq, req)) {
843 return;
844 }
845 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
846 }
847
848 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
849 {
850 struct tevent_req *req = tevent_req_callback_data(
851 subreq, struct tevent_req);
852 struct rpc_api_pipe_state *state = tevent_req_data(
853 req, struct rpc_api_pipe_state);
854 NTSTATUS status;
855 DATA_BLOB rdata = data_blob_null;
856
857 status = get_complete_frag_recv(subreq);
858 TALLOC_FREE(subreq);
859 if (!NT_STATUS_IS_OK(status)) {
860 DEBUG(5, ("get_complete_frag failed: %s\n",
861 nt_errstr(status)));
862 tevent_req_nterror(req, status);
863 return;
864 }
865
866 state->pkt = talloc(state, struct ncacn_packet);
867 if (!state->pkt) {
868 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
869 return;
870 }
871
872 status = dcerpc_pull_ncacn_packet(state->pkt,
873 &state->incoming_frag,
874 state->pkt,
875 !state->endianess);
876 if (!NT_STATUS_IS_OK(status)) {
877 tevent_req_nterror(req, status);
878 return;
879 }
880
881 if (state->incoming_frag.length != state->pkt->frag_length) {
882 DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
883 (unsigned int)state->incoming_frag.length,
884 (unsigned int)state->pkt->frag_length));
885 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
886 return;
887 }
888
889 status = cli_pipe_validate_current_pdu(state,
890 state->cli, state->pkt,
891 &state->incoming_frag,
892 state->expected_pkt_type,
893 state->call_id,
894 &rdata,
895 &state->reply_pdu);
896
897 DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
898 (unsigned)state->incoming_frag.length,
899 (unsigned)state->reply_pdu_offset,
900 nt_errstr(status)));
901
902 if (!NT_STATUS_IS_OK(status)) {
903 tevent_req_nterror(req, status);
904 return;
905 }
906
907 if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
908 && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
909 /*
910 * Set the data type correctly for big-endian data on the
911 * first packet.
912 */
913 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
914 "big-endian.\n",
915 rpccli_pipe_txt(talloc_tos(), state->cli)));
916 state->endianess = 0x00; /* BIG ENDIAN */
917 }
918 /*
919 * Check endianness on subsequent packets.
920 */
921 if (state->endianess != state->pkt->drep[0]) {
922 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
923 "%s\n",
924 state->endianess?"little":"big",
925 state->pkt->drep[0]?"little":"big"));
926 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
927 return;
928 }
929
930 /* Now copy the data portion out of the pdu into rbuf. */
931 if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
932 if (!data_blob_realloc(NULL, &state->reply_pdu,
933 state->reply_pdu_offset + rdata.length)) {
934 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
935 return;
936 }
937 }
938
939 memcpy(state->reply_pdu.data + state->reply_pdu_offset,
940 rdata.data, rdata.length);
941 state->reply_pdu_offset += rdata.length;
942
943 /* reset state->incoming_frag, there is no need to free it,
944 * it will be reallocated to the right size the next time
945 * it is used */
946 state->incoming_frag.length = 0;
947
948 if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
949 /* make sure the pdu length is right now that we
950 * have all the data available (alloc hint may
951 * have allocated more than was actually used) */
952 state->reply_pdu.length = state->reply_pdu_offset;
953 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
954 rpccli_pipe_txt(talloc_tos(), state->cli),
955 (unsigned)state->reply_pdu.length));
956 tevent_req_done(req);
957 return;
958 }
959
960 subreq = get_complete_frag_send(state, state->ev, state->cli,
961 &state->incoming_frag);
962 if (tevent_req_nomem(subreq, req)) {
963 return;
964 }
965 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
966 }
967
968 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
969 struct ncacn_packet **pkt,
970 DATA_BLOB *reply_pdu)
971 {
972 struct rpc_api_pipe_state *state = tevent_req_data(
973 req, struct rpc_api_pipe_state);
974 NTSTATUS status;
975
976 if (tevent_req_is_nterror(req, &status)) {
977 return status;
978 }
979
980 /* return data to caller and assign it ownership of memory */
981 if (reply_pdu) {
982 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
983 reply_pdu->length = state->reply_pdu.length;
984 state->reply_pdu.length = 0;
985 } else {
986 data_blob_free(&state->reply_pdu);
987 }
988
989 if (pkt) {
990 *pkt = talloc_steal(mem_ctx, state->pkt);
991 }
992
993 return NT_STATUS_OK;
994 }
995
996 /*******************************************************************
997 Creates NTLMSSP auth bind.
998 ********************************************************************/
999
1000 static NTSTATUS create_generic_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1001 TALLOC_CTX *mem_ctx,
1002 DATA_BLOB *auth_token)
1003 {
1004 struct gensec_security *gensec_security;
1005 DATA_BLOB null_blob = data_blob_null;
1006
1007 gensec_security = talloc_get_type_abort(cli->auth->auth_ctx,
1008 struct gensec_security);
1009
1010 DEBUG(5, ("create_generic_auth_rpc_bind_req: generate first token\n"));
1011 return gensec_update(gensec_security, mem_ctx, NULL, null_blob, auth_token);
1012 }
1013
1014 /*******************************************************************
1015 Creates the internals of a DCE/RPC bind request or alter context PDU.
1016 ********************************************************************/
1017
1018 static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
1019 enum dcerpc_pkt_type ptype,
1020 uint32 rpc_call_id,
1021 const struct ndr_syntax_id *abstract,
1022 const struct ndr_syntax_id *transfer,
1023 const DATA_BLOB *auth_info,
1024 DATA_BLOB *blob)
1025 {
1026 uint16 auth_len = auth_info->length;
1027 NTSTATUS status;
1028 union dcerpc_payload u;
1029 struct dcerpc_ctx_list ctx_list;
1030
1031 if (auth_len) {
1032 auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
1033 }
1034
1035 ctx_list.context_id = 0;
1036 ctx_list.num_transfer_syntaxes = 1;
1037 ctx_list.abstract_syntax = *abstract;
1038 ctx_list.transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer);
1039
1040 u.bind.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1041 u.bind.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1042 u.bind.assoc_group_id = 0x0;
1043 u.bind.num_contexts = 1;
1044 u.bind.ctx_list = &ctx_list;
1045 u.bind.auth_info = *auth_info;
1046
1047 status = dcerpc_push_ncacn_packet(mem_ctx,
1048 ptype,
1049 DCERPC_PFC_FLAG_FIRST |
1050 DCERPC_PFC_FLAG_LAST,
1051 auth_len,
1052 rpc_call_id,
1053 &u,
1054 blob);
1055 if (!NT_STATUS_IS_OK(status)) {
1056 DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
1057 return status;
1058 }
1059
1060 return NT_STATUS_OK;
1061 }
1062
1063 /*******************************************************************
1064 Creates a DCE/RPC bind request.
1065 ********************************************************************/
1066
1067 static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
1068 struct rpc_pipe_client *cli,
1069 struct pipe_auth_data *auth,
1070 uint32 rpc_call_id,
1071 const struct ndr_syntax_id *abstract,
1072 const struct ndr_syntax_id *transfer,
1073 DATA_BLOB *rpc_out)
1074 {
1075 DATA_BLOB auth_token = data_blob_null;
1076 DATA_BLOB auth_info = data_blob_null;
1077 NTSTATUS ret = NT_STATUS_OK;
1078
1079 switch (auth->auth_type) {
1080 case DCERPC_AUTH_TYPE_SCHANNEL:
1081 case DCERPC_AUTH_TYPE_NTLMSSP:
1082 case DCERPC_AUTH_TYPE_KRB5:
1083 case DCERPC_AUTH_TYPE_SPNEGO:
1084 ret = create_generic_auth_rpc_bind_req(cli, mem_ctx, &auth_token);
1085
1086 if (!NT_STATUS_IS_OK(ret) &&
1087 !NT_STATUS_EQUAL(ret, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1088 return ret;
1089 }
1090 break;
1091
1092 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1093 auth_token = data_blob_talloc(mem_ctx,
1094 "NCALRPC_AUTH_TOKEN",
1095 18);
1096 break;
1097
1098 case DCERPC_AUTH_TYPE_NONE:
1099 break;
1100
1101 default:
1102 /* "Can't" happen. */
1103 return NT_STATUS_INVALID_INFO_CLASS;
1104 }
1105
1106 if (auth_token.length != 0) {
1107 ret = dcerpc_push_dcerpc_auth(cli,
1108 auth->auth_type,
1109 auth->auth_level,
1110 0, /* auth_pad_length */
1111 1, /* auth_context_id */
1112 &auth_token,
1113 &auth_info);
1114 if (!NT_STATUS_IS_OK(ret)) {
1115 return ret;
1116 }
1117 data_blob_free(&auth_token);
1118 }
1119
1120 ret = create_bind_or_alt_ctx_internal(mem_ctx,
1121 DCERPC_PKT_BIND,
1122 rpc_call_id,
1123 abstract,
1124 transfer,
1125 &auth_info,
1126 rpc_out);
1127 return ret;
1128 }
1129
1130 /*******************************************************************
1131 External interface.
1132 Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
1133 Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
1134 and deals with signing/sealing details.
1135 ********************************************************************/
1136
1137 struct rpc_api_pipe_req_state {
1138 struct tevent_context *ev;
1139 struct rpc_pipe_client *cli;
1140 uint8_t op_num;
1141 uint32_t call_id;
1142 DATA_BLOB *req_data;
1143 uint32_t req_data_sent;
1144 DATA_BLOB rpc_out;
1145 DATA_BLOB reply_pdu;
1146 };
1147
1148 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
1149 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
1150 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1151 bool *is_last_frag);
1152
1153 struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
1154 struct tevent_context *ev,
1155 struct rpc_pipe_client *cli,
1156 uint8_t op_num,
1157 DATA_BLOB *req_data)
1158 {
1159 struct tevent_req *req, *subreq;
1160 struct rpc_api_pipe_req_state *state;
1161 NTSTATUS status;
1162 bool is_last_frag;
1163
1164 req = tevent_req_create(mem_ctx, &state,
1165 struct rpc_api_pipe_req_state);
1166 if (req == NULL) {
1167 return NULL;
1168 }
1169 state->ev = ev;
1170 state->cli = cli;
1171 state->op_num = op_num;
1172 state->req_data = req_data;
1173 state->req_data_sent = 0;
1174 state->call_id = get_rpc_call_id();
1175 state->reply_pdu = data_blob_null;
1176 state->rpc_out = data_blob_null;
1177
1178 if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
1179 + RPC_MAX_SIGN_SIZE) {
1180 /* Server is screwed up ! */
1181 status = NT_STATUS_INVALID_PARAMETER;
1182 goto post_status;
1183 }
1184
1185 status = prepare_next_frag(state, &is_last_frag);
1186 if (!NT_STATUS_IS_OK(status)) {
1187 goto post_status;
1188 }
1189
1190 if (is_last_frag) {
1191 subreq = rpc_api_pipe_send(state, ev, state->cli,
1192 &state->rpc_out,
1193 DCERPC_PKT_RESPONSE,
1194 state->call_id);
1195 if (subreq == NULL) {
1196 goto fail;
1197 }
1198 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1199 } else {
1200 subreq = rpc_write_send(state, ev, cli->transport,
1201 state->rpc_out.data,
1202 state->rpc_out.length);
1203 if (subreq == NULL) {
1204 goto fail;
1205 }
1206 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1207 req);
1208 }
1209 return req;
1210
1211 post_status:
1212 tevent_req_nterror(req, status);
1213 return tevent_req_post(req, ev);
1214 fail:
1215 TALLOC_FREE(req);
1216 return NULL;
1217 }
1218
1219 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1220 bool *is_last_frag)
1221 {
1222 size_t data_sent_thistime;
1223 size_t auth_len;
1224 size_t frag_len;
1225 uint8_t flags = 0;
1226 size_t pad_len;
1227 size_t data_left;
1228 NTSTATUS status;
1229 union dcerpc_payload u;
1230
1231 data_left = state->req_data->length - state->req_data_sent;
1232
1233 status = dcerpc_guess_sizes(state->cli->auth,
1234 DCERPC_REQUEST_LENGTH, data_left,
1235 state->cli->max_xmit_frag,
1236 CLIENT_NDR_PADDING_SIZE,
1237 &data_sent_thistime,
1238 &frag_len, &auth_len, &pad_len);
1239 if (!NT_STATUS_IS_OK(status)) {
1240 return status;
1241 }
1242
1243 if (state->req_data_sent == 0) {
1244 flags = DCERPC_PFC_FLAG_FIRST;
1245 }
1246
1247 if (data_sent_thistime == data_left) {
1248 flags |= DCERPC_PFC_FLAG_LAST;
1249 }
1250
1251 data_blob_free(&state->rpc_out);
1252
1253 ZERO_STRUCT(u.request);
1254
1255 u.request.alloc_hint = state->req_data->length;
1256 u.request.context_id = 0;
1257 u.request.opnum = state->op_num;
1258
1259 status = dcerpc_push_ncacn_packet(state,
1260 DCERPC_PKT_REQUEST,
1261 flags,
1262 auth_len,
1263 state->call_id,
1264 &u,
1265 &state->rpc_out);
1266 if (!NT_STATUS_IS_OK(status)) {
1267 return status;
1268 }
1269
1270 /* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
1271 * compute it right for requests because the auth trailer is missing
1272 * at this stage */
1273 dcerpc_set_frag_length(&state->rpc_out, frag_len);
1274
1275 /* Copy in the data. */
1276 if (!data_blob_append(NULL, &state->rpc_out,
1277 state->req_data->data + state->req_data_sent,
1278 data_sent_thistime)) {
1279 return NT_STATUS_NO_MEMORY;
1280 }
1281
1282 switch (state->cli->auth->auth_level) {
1283 case DCERPC_AUTH_LEVEL_NONE:
1284 case DCERPC_AUTH_LEVEL_CONNECT:
1285 case DCERPC_AUTH_LEVEL_PACKET:
1286 break;
1287 case DCERPC_AUTH_LEVEL_INTEGRITY:
1288 case DCERPC_AUTH_LEVEL_PRIVACY:
1289 status = dcerpc_add_auth_footer(state->cli->auth, pad_len,
1290 &state->rpc_out);
1291 if (!NT_STATUS_IS_OK(status)) {
1292 return status;
1293 }
1294 break;
1295 default:
1296 return NT_STATUS_INVALID_PARAMETER;
1297 }
1298
1299 state->req_data_sent += data_sent_thistime;
1300 *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
1301
1302 return status;
1303 }
1304
1305 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
1306 {
1307 struct tevent_req *req = tevent_req_callback_data(
1308 subreq, struct tevent_req);
1309 struct rpc_api_pipe_req_state *state = tevent_req_data(
1310 req, struct rpc_api_pipe_req_state);
1311 NTSTATUS status;
1312 bool is_last_frag;
1313
1314 status = rpc_write_recv(subreq);
1315 TALLOC_FREE(subreq);
1316 if (!NT_STATUS_IS_OK(status)) {
1317 tevent_req_nterror(req, status);
1318 return;
1319 }
1320
1321 status = prepare_next_frag(state, &is_last_frag);
1322 if (!NT_STATUS_IS_OK(status)) {
1323 tevent_req_nterror(req, status);
1324 return;
1325 }
1326
1327 if (is_last_frag) {
1328 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1329 &state->rpc_out,
1330 DCERPC_PKT_RESPONSE,
1331 state->call_id);
1332 if (tevent_req_nomem(subreq, req)) {
1333 return;
1334 }
1335 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1336 } else {
1337 subreq = rpc_write_send(state, state->ev,
1338 state->cli->transport,
1339 state->rpc_out.data,
1340 state->rpc_out.length);
1341 if (tevent_req_nomem(subreq, req)) {
1342 return;
1343 }
1344 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1345 req);
1346 }
1347 }
1348
1349 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
1350 {
1351 struct tevent_req *req = tevent_req_callback_data(
1352 subreq, struct tevent_req);
1353 struct rpc_api_pipe_req_state *state = tevent_req_data(
1354 req, struct rpc_api_pipe_req_state);
1355 NTSTATUS status;
1356
1357 status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
1358 TALLOC_FREE(subreq);
1359 if (!NT_STATUS_IS_OK(status)) {
1360 tevent_req_nterror(req, status);
1361 return;
1362 }
1363 tevent_req_done(req);
1364 }
1365
1366 NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1367 DATA_BLOB *reply_pdu)
1368 {
1369 struct rpc_api_pipe_req_state *state = tevent_req_data(
1370 req, struct rpc_api_pipe_req_state);
1371 NTSTATUS status;
1372
1373 if (tevent_req_is_nterror(req, &status)) {
1374 /*
1375 * We always have to initialize to reply pdu, even if there is
1376 * none. The rpccli_* caller routines expect this.
1377 */
1378 *reply_pdu = data_blob_null;
1379 return status;
1380 }
1381
1382 /* return data to caller and assign it ownership of memory */
1383 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1384 reply_pdu->length = state->reply_pdu.length;
1385 state->reply_pdu.length = 0;
1386
1387 return NT_STATUS_OK;
1388 }
1389
1390 /****************************************************************************
1391 Check the rpc bind acknowledge response.
1392 ****************************************************************************/
1393
1394 static bool check_bind_response(const struct dcerpc_bind_ack *r,
1395 const struct ndr_syntax_id *transfer)
1396 {
1397 struct dcerpc_ack_ctx ctx;
1398
1399 if (r->secondary_address_size == 0) {
1400 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
1401 }
1402
1403 if (r->num_results < 1 || !r->ctx_list) {
1404 return false;
1405 }
1406
1407 ctx = r->ctx_list[0];
1408
1409 /* check the transfer syntax */
1410 if ((ctx.syntax.if_version != transfer->if_version) ||
1411 (memcmp(&ctx.syntax.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1412 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1413 return False;
1414 }
1415
1416 if (r->num_results != 0x1 || ctx.result != 0) {
1417 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1418 r->num_results, ctx.reason));
1419 }
1420
1421 DEBUG(5,("check_bind_response: accepted!\n"));
1422 return True;
1423 }
1424
1425 /*******************************************************************
1426 Creates a DCE/RPC bind authentication response.
1427 This is the packet that is sent back to the server once we
1428 have received a BIND-ACK, to finish the third leg of
1429 the authentication handshake.
1430 ********************************************************************/
1431
1432 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
1433 struct rpc_pipe_client *cli,
1434 uint32 rpc_call_id,
1435 enum dcerpc_AuthType auth_type,
1436 enum dcerpc_AuthLevel auth_level,
1437 DATA_BLOB *pauth_blob,
1438 DATA_BLOB *rpc_out)
1439 {
1440 NTSTATUS status;
1441 union dcerpc_payload u;
1442
1443 u.auth3._pad = 0;
1444
1445 status = dcerpc_push_dcerpc_auth(mem_ctx,
1446 auth_type,
1447 auth_level,
1448 0, /* auth_pad_length */
1449 1, /* auth_context_id */
1450 pauth_blob,
1451 &u.auth3.auth_info);
1452 if (!NT_STATUS_IS_OK(status)) {
1453 return status;
1454 }
1455
1456 status = dcerpc_push_ncacn_packet(mem_ctx,
1457 DCERPC_PKT_AUTH3,
1458 DCERPC_PFC_FLAG_FIRST |
1459 DCERPC_PFC_FLAG_LAST,
1460 pauth_blob->length,
1461 rpc_call_id,
1462 &u,
1463 rpc_out);
1464 data_blob_free(&u.auth3.auth_info);
1465 if (!NT_STATUS_IS_OK(status)) {
1466 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1467 return status;
1468 }
1469
1470 return NT_STATUS_OK;
1471 }
1472
1473 /*******************************************************************
1474 Creates a DCE/RPC bind alter context authentication request which
1475 may contain a spnego auth blobl
1476 ********************************************************************/
1477
1478 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
1479 enum dcerpc_AuthType auth_type,
1480 enum dcerpc_AuthLevel auth_level,
1481 uint32 rpc_call_id,
1482 const struct ndr_syntax_id *abstract,
1483 const struct ndr_syntax_id *transfer,
1484 const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
1485 DATA_BLOB *rpc_out)
1486 {
1487 DATA_BLOB auth_info;
1488 NTSTATUS status;
1489
1490 status = dcerpc_push_dcerpc_auth(mem_ctx,
1491 auth_type,
1492 auth_level,
1493 0, /* auth_pad_length */
1494 1, /* auth_context_id */
1495 pauth_blob,
1496 &auth_info);
1497 if (!NT_STATUS_IS_OK(status)) {
1498 return status;
1499 }
1500
1501 status = create_bind_or_alt_ctx_internal(mem_ctx,
1502 DCERPC_PKT_ALTER,
1503 rpc_call_id,
1504 abstract,
1505 transfer,
1506 &auth_info,
1507 rpc_out);
1508 data_blob_free(&auth_info);
1509 return status;
1510 }
1511
1512 /****************************************************************************
1513 Do an rpc bind.
1514 ****************************************************************************/
1515
1516 struct rpc_pipe_bind_state {
1517 struct tevent_context *ev;
1518 struct rpc_pipe_client *cli;
1519 DATA_BLOB rpc_out;
1520 bool auth3;
1521 uint32_t rpc_call_id;
1522 };
1523
1524 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
1525 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1526 struct rpc_pipe_bind_state *state,
1527 DATA_BLOB *credentials);
1528 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1529 struct rpc_pipe_bind_state *state,
1530 DATA_BLOB *credentials);
1531
1532 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
1533 struct tevent_context *ev,
1534 struct rpc_pipe_client *cli,
1535 struct pipe_auth_data *auth)
1536 {
1537 struct tevent_req *req, *subreq;
1538 struct rpc_pipe_bind_state *state;
1539 NTSTATUS status;
1540
1541 req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
1542 if (req == NULL) {
1543 return NULL;
1544 }
1545
1546 DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
1547 rpccli_pipe_txt(talloc_tos(), cli),
1548 (unsigned int)auth->auth_type,
1549 (unsigned int)auth->auth_level ));
1550
1551 state->ev = ev;
1552 state->cli = cli;
1553 state->rpc_call_id = get_rpc_call_id();
1554
1555 cli->auth = talloc_move(cli, &auth);
1556
1557 /* Marshall the outgoing data. */
1558 status = create_rpc_bind_req(state, cli,
1559 cli->auth,
1560 state->rpc_call_id,
1561 &cli->abstract_syntax,
1562 &cli->transfer_syntax,
1563 &state->rpc_out);
1564
1565 if (!NT_STATUS_IS_OK(status) &&
1566 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1567 goto post_status;
1568 }
1569
1570 subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
1571 DCERPC_PKT_BIND_ACK, state->rpc_call_id);
1572 if (subreq == NULL) {
1573 goto fail;
1574 }
1575 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1576 return req;
1577
1578 post_status:
1579 tevent_req_nterror(req, status);
1580 return tevent_req_post(req, ev);
1581 fail:
1582 TALLOC_FREE(req);
1583 return NULL;
1584 }
1585
1586 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
1587 {
1588 struct tevent_req *req = tevent_req_callback_data(
1589 subreq, struct tevent_req);
1590 struct rpc_pipe_bind_state *state = tevent_req_data(
1591 req, struct rpc_pipe_bind_state);
1592 struct pipe_auth_data *pauth = state->cli->auth;
1593 struct gensec_security *gensec_security;
1594 struct ncacn_packet *pkt = NULL;
1595 struct dcerpc_auth auth;
1596 DATA_BLOB auth_token = data_blob_null;
1597 NTSTATUS status;
1598
1599 status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
1600 TALLOC_FREE(subreq);
1601 if (!NT_STATUS_IS_OK(status)) {
1602 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
1603 rpccli_pipe_txt(talloc_tos(), state->cli),
1604 nt_errstr(status)));
1605 tevent_req_nterror(req, status);
1606 return;
1607 }
1608
1609 if (state->auth3) {
1610 tevent_req_done(req);
1611 return;
1612 }
1613
1614 if (!check_bind_response(&pkt->u.bind_ack, &state->cli->transfer_syntax)) {
1615 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
1616 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1617 return;
1618 }
1619
1620 state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
1621 state->cli->max_recv_frag = pkt->u.bind_ack.max_recv_frag;
1622
1623 switch(pauth->auth_type) {
1624
1625 case DCERPC_AUTH_TYPE_NONE:
1626 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1627 case DCERPC_AUTH_TYPE_SCHANNEL:
1628 /* Bind complete. */
1629 tevent_req_done(req);
1630 return;
1631
1632 case DCERPC_AUTH_TYPE_NTLMSSP:
1633 case DCERPC_AUTH_TYPE_SPNEGO:
1634 case DCERPC_AUTH_TYPE_KRB5:
1635 /* Paranoid lenght checks */
1636 if (pkt->frag_length < DCERPC_AUTH_TRAILER_LENGTH
1637 + pkt->auth_length) {
1638 tevent_req_nterror(req,
1639 NT_STATUS_INFO_LENGTH_MISMATCH);
1640 return;
1641 }
1642 /* get auth credentials */
1643 status = dcerpc_pull_dcerpc_auth(talloc_tos(),
1644 &pkt->u.bind_ack.auth_info,
1645 &auth, false);
1646 if (!NT_STATUS_IS_OK(status)) {
1647 DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
1648 nt_errstr(status)));
1649 tevent_req_nterror(req, status);
1650 return;
1651 }
1652 break;
1653
1654 default:
1655 goto err_out;
1656 }
1657
1658 /*
1659 * For authenticated binds we may need to do 3 or 4 leg binds.
1660 */
1661
1662 switch(pauth->auth_type) {
1663
1664 case DCERPC_AUTH_TYPE_NONE:
1665 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1666 case DCERPC_AUTH_TYPE_SCHANNEL:
1667 /* Bind complete. */
1668 tevent_req_done(req);
1669 return;
1670
1671 case DCERPC_AUTH_TYPE_NTLMSSP:
1672 case DCERPC_AUTH_TYPE_KRB5:
1673 case DCERPC_AUTH_TYPE_SPNEGO:
1674 gensec_security = talloc_get_type_abort(pauth->auth_ctx,
1675 struct gensec_security);
1676 status = gensec_update(gensec_security, state, NULL,
1677 auth.credentials, &auth_token);
1678 if (NT_STATUS_EQUAL(status,
1679 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1680 status = rpc_bind_next_send(req, state,
1681 &auth_token);
1682 } else if (NT_STATUS_IS_OK(status)) {
1683 if (auth_token.length == 0) {
1684 /* Bind complete. */
1685 tevent_req_done(req);
1686 return;
1687 }
1688 status = rpc_bind_finish_send(req, state,
1689 &auth_token);
1690 }
1691 break;
1692
1693 default:
1694 goto err_out;
1695 }
1696
1697 if (!NT_STATUS_IS_OK(status)) {
1698 tevent_req_nterror(req, status);
1699 }
1700 return;
1701
1702 err_out:
1703 DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
1704 (unsigned int)state->cli->auth->auth_type));
1705 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
1706 }
1707
1708 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1709 struct rpc_pipe_bind_state *state,
1710 DATA_BLOB *auth_token)
1711 {
1712 struct pipe_auth_data *auth = state->cli->auth;
1713 struct tevent_req *subreq;
1714 NTSTATUS status;
1715
1716 /* Now prepare the alter context pdu. */
1717 data_blob_free(&state->rpc_out);
1718
1719 status = create_rpc_alter_context(state,
1720 auth->auth_type,
1721 auth->auth_level,
1722 state->rpc_call_id,
1723 &state->cli->abstract_syntax,
1724 &state->cli->transfer_syntax,
1725 auth_token,
1726 &state->rpc_out);
1727 if (!NT_STATUS_IS_OK(status)) {
1728 return status;
1729 }
1730
1731 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1732 &state->rpc_out, DCERPC_PKT_ALTER_RESP,
1733 state->rpc_call_id);
1734 if (subreq == NULL) {
1735 return NT_STATUS_NO_MEMORY;
1736 }
1737 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1738 return NT_STATUS_OK;
1739 }
1740
1741 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1742 struct rpc_pipe_bind_state *state,
1743 DATA_BLOB *auth_token)
1744 {
1745 struct pipe_auth_data *auth = state->cli->auth;
1746 struct tevent_req *subreq;
1747 NTSTATUS status;
1748
1749 state->auth3 = true;
1750
1751 /* Now prepare the auth3 context pdu. */
1752 data_blob_free(&state->rpc_out);
1753
1754 status = create_rpc_bind_auth3(state, state->cli,
1755 state->rpc_call_id,
1756 auth->auth_type,
1757 auth->auth_level,
1758 auth_token,
1759 &state->rpc_out);
1760 if (!NT_STATUS_IS_OK(status)) {
1761 return status;
1762 }
1763
1764 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1765 &state->rpc_out, DCERPC_PKT_AUTH3,
1766 state->rpc_call_id);
1767 if (subreq == NULL) {
1768 return NT_STATUS_NO_MEMORY;
1769 }
1770 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1771 return NT_STATUS_OK;
1772 }
1773
1774 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
1775 {
1776 return tevent_req_simple_recv_ntstatus(req);
1777 }
1778
1779 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
1780 struct pipe_auth_data *auth)
1781 {
1782 TALLOC_CTX *frame = talloc_stackframe();
1783 struct tevent_context *ev;
1784 struct tevent_req *req;
1785 NTSTATUS status = NT_STATUS_OK;
1786
1787 ev = samba_tevent_context_init(frame);
1788 if (ev == NULL) {
1789 status = NT_STATUS_NO_MEMORY;
1790 goto fail;
1791 }
1792
1793 req = rpc_pipe_bind_send(frame, ev, cli, auth);
1794 if (req == NULL) {
1795 status = NT_STATUS_NO_MEMORY;
1796 goto fail;
1797 }
1798
1799 if (!tevent_req_poll(req, ev)) {
1800 status = map_nt_error_from_unix(errno);
1801 goto fail;
1802 }
1803
1804 status = rpc_pipe_bind_recv(req);
1805 fail:
1806 TALLOC_FREE(frame);
1807 return status;
1808 }
1809
1810 #define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */
1811
1812 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
1813 unsigned int timeout)
1814 {
1815 unsigned int old;
1816
1817 if (rpc_cli->transport == NULL) {
1818 return RPCCLI_DEFAULT_TIMEOUT;
1819 }
1820
1821 if (rpc_cli->transport->set_timeout == NULL) {
1822 return RPCCLI_DEFAULT_TIMEOUT;
1823 }
1824
1825 old = rpc_cli->transport->set_timeout(rpc_cli->transport->priv, timeout);
1826 if (old == 0) {
1827 return RPCCLI_DEFAULT_TIMEOUT;
1828 }
1829
1830 return old;
1831 }
1832
1833 bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
1834 {
1835 if (rpc_cli == NULL) {
1836 return false;
1837 }
1838
1839 if (rpc_cli->transport == NULL) {
1840 return false;
1841 }
1842
1843 return rpc_cli->transport->is_connected(rpc_cli->transport->priv);
1844 }
1845
1846 struct rpccli_bh_state {
1847 struct rpc_pipe_client *rpc_cli;
1848 };
1849
1850 static bool rpccli_bh_is_connected(struct dcerpc_binding_handle *h)
1851 {
1852 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1853 struct rpccli_bh_state);
1854
1855 return rpccli_is_connected(hs->rpc_cli);
1856 }
1857
1858 static uint32_t rpccli_bh_set_timeout(struct dcerpc_binding_handle *h,
1859 uint32_t timeout)
1860 {
1861 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1862 struct rpccli_bh_state);
1863
1864 return rpccli_set_timeout(hs->rpc_cli, timeout);
1865 }
1866
1867 static void rpccli_bh_auth_info(struct dcerpc_binding_handle *h,
1868 enum dcerpc_AuthType *auth_type,
1869 enum dcerpc_AuthLevel *auth_level)
1870 {
1871 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1872 struct rpccli_bh_state);
1873
1874 if (hs->rpc_cli == NULL) {
1875 return;
1876 }
1877
1878 if (hs->rpc_cli->auth == NULL) {
1879 return;
1880 }
1881
1882 *auth_type = hs->rpc_cli->auth->auth_type;
1883 *auth_level = hs->rpc_cli->auth->auth_level;
1884 }
1885
1886 struct rpccli_bh_raw_call_state {
1887 DATA_BLOB in_data;
1888 DATA_BLOB out_data;
1889 uint32_t out_flags;
1890 };
1891
1892 static void rpccli_bh_raw_call_done(struct tevent_req *subreq);
1893
1894 static struct tevent_req *rpccli_bh_raw_call_send(TALLOC_CTX *mem_ctx,
1895 struct tevent_context *ev,
1896 struct dcerpc_binding_handle *h,
1897 const struct GUID *object,
1898 uint32_t opnum,
1899 uint32_t in_flags,
1900 const uint8_t *in_data,
1901 size_t in_length)
1902 {
1903 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1904 struct rpccli_bh_state);
1905 struct tevent_req *req;
1906 struct rpccli_bh_raw_call_state *state;
1907 bool ok;
1908 struct tevent_req *subreq;
1909
1910 req = tevent_req_create(mem_ctx, &state,
1911 struct rpccli_bh_raw_call_state);
1912 if (req == NULL) {
1913 return NULL;
1914 }
1915 state->in_data.data = discard_const_p(uint8_t, in_data);
1916 state->in_data.length = in_length;
1917
1918 ok = rpccli_bh_is_connected(h);
1919 if (!ok) {
1920 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
1921 return tevent_req_post(req, ev);
1922 }
1923
1924 subreq = rpc_api_pipe_req_send(state, ev, hs->rpc_cli,
1925 opnum, &state->in_data);
1926 if (tevent_req_nomem(subreq, req)) {
1927 return tevent_req_post(req, ev);
1928 }
1929 tevent_req_set_callback(subreq, rpccli_bh_raw_call_done, req);
1930
1931 return req;
1932 }
1933
1934 static void rpccli_bh_raw_call_done(struct tevent_req *subreq)
1935 {
1936 struct tevent_req *req =
1937 tevent_req_callback_data(subreq,
1938 struct tevent_req);
1939 struct rpccli_bh_raw_call_state *state =
1940 tevent_req_data(req,
1941 struct rpccli_bh_raw_call_state);
1942 NTSTATUS status;
1943
1944 state->out_flags = 0;
1945
1946 /* TODO: support bigendian responses */
1947
1948 status = rpc_api_pipe_req_recv(subreq, state, &state->out_data);
1949 TALLOC_FREE(subreq);
1950 if (!NT_STATUS_IS_OK(status)) {
1951 tevent_req_nterror(req, status);
1952 return;
1953 }
1954
1955 tevent_req_done(req);
1956 }
1957
1958 static NTSTATUS rpccli_bh_raw_call_recv(struct tevent_req *req,
1959 TALLOC_CTX *mem_ctx,
1960 uint8_t **out_data,
1961 size_t *out_length,
1962 uint32_t *out_flags)
1963 {
1964 struct rpccli_bh_raw_call_state *state =
1965 tevent_req_data(req,
1966 struct rpccli_bh_raw_call_state);
1967 NTSTATUS status;
1968
1969 if (tevent_req_is_nterror(req, &status)) {
1970 tevent_req_received(req);
1971 return status;
1972 }
1973
1974 *out_data = talloc_move(mem_ctx, &state->out_data.data);
1975 *out_length = state->out_data.length;
1976 *out_flags = state->out_flags;
1977 tevent_req_received(req);
1978 return NT_STATUS_OK;
1979 }
1980
1981 struct rpccli_bh_disconnect_state {
1982 uint8_t _dummy;
1983 };
1984
1985 static struct tevent_req *rpccli_bh_disconnect_send(TALLOC_CTX *mem_ctx,
1986 struct tevent_context *ev,
1987 struct dcerpc_binding_handle *h)
1988 {
1989 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1990 struct rpccli_bh_state);
1991 struct tevent_req *req;
1992 struct rpccli_bh_disconnect_state *state;
1993 bool ok;
1994
1995 req = tevent_req_create(mem_ctx, &state,
1996 struct rpccli_bh_disconnect_state);
1997 if (req == NULL) {
1998 return NULL;
1999 }
2000
2001 ok = rpccli_bh_is_connected(h);
2002 if (!ok) {
2003 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2004 return tevent_req_post(req, ev);
2005 }
2006
2007 /*
2008 * TODO: do a real async disconnect ...
2009 *
2010 * For now the caller needs to free rpc_cli
2011 */
2012 hs->rpc_cli = NULL;
2013
2014 tevent_req_done(req);
2015 return tevent_req_post(req, ev);
2016 }
2017
2018 static NTSTATUS rpccli_bh_disconnect_recv(struct tevent_req *req)
2019 {
2020 NTSTATUS status;
2021
2022 if (tevent_req_is_nterror(req, &status)) {
2023 tevent_req_received(req);
2024 return status;
2025 }
2026
2027 tevent_req_received(req);
2028 return NT_STATUS_OK;
2029 }
2030
2031 static bool rpccli_bh_ref_alloc(struct dcerpc_binding_handle *h)
2032 {
2033 return true;
2034 }
2035
2036 static void rpccli_bh_do_ndr_print(struct dcerpc_binding_handle *h,
2037 int ndr_flags,
2038 const void *_struct_ptr,
2039 const struct ndr_interface_call *call)
2040 {
2041 void *struct_ptr = discard_const(_struct_ptr);
2042
2043 if (DEBUGLEVEL < 10) {
2044 return;
2045 }
2046
2047 if (ndr_flags & NDR_IN) {
2048 ndr_print_function_debug(call->ndr_print,
2049 call->name,
2050 ndr_flags,
2051 struct_ptr);
2052 }
2053 if (ndr_flags & NDR_OUT) {
2054 ndr_print_function_debug(call->ndr_print,
2055 call->name,
2056 ndr_flags,
2057 struct_ptr);
2058 }
2059 }
2060
2061 static const struct dcerpc_binding_handle_ops rpccli_bh_ops = {
2062 .name = "rpccli",
2063 .is_connected = rpccli_bh_is_connected,
2064 .set_timeout = rpccli_bh_set_timeout,
2065 .auth_info = rpccli_bh_auth_info,
2066 .raw_call_send = rpccli_bh_raw_call_send,
2067 .raw_call_recv = rpccli_bh_raw_call_recv,
2068 .disconnect_send = rpccli_bh_disconnect_send,
2069 .disconnect_recv = rpccli_bh_disconnect_recv,
2070
2071 .ref_alloc = rpccli_bh_ref_alloc,
2072 .do_ndr_print = rpccli_bh_do_ndr_print,
2073 };
2074
2075 /* initialise a rpc_pipe_client binding handle */
2076 struct dcerpc_binding_handle *rpccli_bh_create(struct rpc_pipe_client *c,
2077 const struct GUID *object,
2078 const struct ndr_interface_table *table)
2079 {
2080 struct dcerpc_binding_handle *h;
2081 struct rpccli_bh_state *hs;
2082
2083 h = dcerpc_binding_handle_create(c,
2084 &rpccli_bh_ops,
2085 object,
2086 table,
2087 &hs,
2088 struct rpccli_bh_state,
2089 __location__);
2090 if (h == NULL) {
2091 return NULL;
2092 }
2093 hs->rpc_cli = c;
2094
2095 return h;
2096 }
2097
2098 NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx,
2099 struct pipe_auth_data **presult)
2100 {
2101 struct pipe_auth_data *result;
2102
2103 result = talloc(mem_ctx, struct pipe_auth_data);
2104 if (result == NULL) {
2105 return NT_STATUS_NO_MEMORY;
2106 }
2107
2108 result->auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
2109 result->auth_level = DCERPC_AUTH_LEVEL_CONNECT;
2110
2111 result->user_name = talloc_strdup(result, "");
2112 result->domain = talloc_strdup(result, "");
2113 if ((result->user_name == NULL) || (result->domain == NULL)) {
2114 TALLOC_FREE(result);
2115 return NT_STATUS_NO_MEMORY;
2116 }
2117
2118 *presult = result;
2119 return NT_STATUS_OK;
2120 }
2121
2122 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2123 struct pipe_auth_data **presult)
2124 {
2125 struct pipe_auth_data *result;
2126
2127 result = talloc(mem_ctx, struct pipe_auth_data);
2128 if (result == NULL) {
2129 return NT_STATUS_NO_MEMORY;
2130 }
2131
2132 result->auth_type = DCERPC_AUTH_TYPE_NONE;
2133 result->auth_level = DCERPC_AUTH_LEVEL_NONE;
2134
2135 result->user_name = talloc_strdup(result, "");
2136 result->domain = talloc_strdup(result, "");
2137 if ((result->user_name == NULL) || (result->domain == NULL)) {
2138 TALLOC_FREE(result);
2139 return NT_STATUS_NO_MEMORY;
2140 }
2141
2142 *presult = result;
2143 return NT_STATUS_OK;
2144 }
2145
2146 static NTSTATUS rpccli_generic_bind_data(TALLOC_CTX *mem_ctx,
2147 enum dcerpc_AuthType auth_type,
2148 enum dcerpc_AuthLevel auth_level,
2149 const char *server,
2150 const char *target_service,
2151 const char *domain,
2152 const char *username,
2153 const char *password,
2154 enum credentials_use_kerberos use_kerberos,
2155 struct netlogon_creds_CredentialState *creds,
2156 struct pipe_auth_data **presult)
2157 {
2158 struct auth_generic_state *auth_generic_ctx;
2159 struct pipe_auth_data *result;
2160 NTSTATUS status;
2161
2162 result = talloc(mem_ctx, struct pipe_auth_data);
2163 if (result == NULL) {
2164 return NT_STATUS_NO_MEMORY;
2165 }
2166
2167 result->auth_type = auth_type;
2168 result->auth_level = auth_level;
2169
2170 result->user_name = talloc_strdup(result, username);
2171 result->domain = talloc_strdup(result, domain);
2172 if ((result->user_name == NULL) || (result->domain == NULL)) {
2173 status = NT_STATUS_NO_MEMORY;
2174 goto fail;
2175 }
2176
2177 status = auth_generic_client_prepare(result,
2178 &auth_generic_ctx);
2179 if (!NT_STATUS_IS_OK(status)) {
2180 goto fail;
2181 }
2182
2183 status = auth_generic_set_username(auth_generic_ctx, username);
2184 if (!NT_STATUS_IS_OK(status)) {
2185 goto fail;
2186 }
2187
2188 status = auth_generic_set_domain(auth_generic_ctx, domain);
2189 if (!NT_STATUS_IS_OK(status)) {
2190 goto fail;
2191 }
2192
2193 status = auth_generic_set_password(auth_generic_ctx, password);
2194 if (!NT_STATUS_IS_OK(status)) {
2195 goto fail;
2196 }
2197
2198 status = gensec_set_target_service(auth_generic_ctx->gensec_security, target_service);
2199 if (!NT_STATUS_IS_OK(status)) {
2200 goto fail;
2201 }
2202
2203 status = gensec_set_target_hostname(auth_generic_ctx->gensec_security, server);
2204 if (!NT_STATUS_IS_OK(status)) {
2205 goto fail;
2206 }
2207
2208 cli_credentials_set_kerberos_state(auth_generic_ctx->credentials, use_kerberos);
2209 cli_credentials_set_netlogon_creds(auth_generic_ctx->credentials, creds);
2210
2211 status = auth_generic_client_start_by_authtype(auth_generic_ctx, auth_type, auth_level);
2212 if (!NT_STATUS_IS_OK(status)) {
2213 goto fail;
2214 }
2215
2216 result->auth_ctx = talloc_move(result, &auth_generic_ctx->gensec_security);
2217 talloc_free(auth_generic_ctx);
2218 *presult = result;
2219 return NT_STATUS_OK;
2220
2221 fail:
2222 TALLOC_FREE(result);
2223 return status;
2224 }
2225
2226 /**
2227 * Create an rpc pipe client struct, connecting to a tcp port.
2228 */
2229 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
2230 const struct sockaddr_storage *ss_addr,
2231 uint16_t port,
2232 const struct ndr_interface_table *table,
2233 struct rpc_pipe_client **presult)
2234 {
2235 struct rpc_pipe_client *result;
2236 struct sockaddr_storage addr;
2237 NTSTATUS status;
2238 int fd;
2239
2240 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2241 if (result == NULL) {
2242 return NT_STATUS_NO_MEMORY;
2243 }
2244
2245 result->abstract_syntax = table->syntax_id;
2246 result->transfer_syntax = ndr_transfer_syntax_ndr;
2247
2248 result->desthost = talloc_strdup(result, host);
2249 result->srv_name_slash = talloc_asprintf_strupper_m(
2250 result, "\\\\%s", result->desthost);
2251 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2252 status = NT_STATUS_NO_MEMORY;
2253 goto fail;
2254 }
2255
2256 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2257 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2258
2259 if (ss_addr == NULL) {
2260 if (!resolve_name(host, &addr, NBT_NAME_SERVER, false)) {
2261 status = NT_STATUS_NOT_FOUND;
2262 goto fail;
2263 }
2264 } else {
2265 addr = *ss_addr;
2266 }
2267
2268 status = open_socket_out(&addr, port, 60*1000, &fd);
2269 if (!NT_STATUS_IS_OK(status)) {
2270 goto fail;
2271 }
2272 set_socket_options(fd, lp_socket_options());
2273
2274 status = rpc_transport_sock_init(result, fd, &result->transport);
2275 if (!NT_STATUS_IS_OK(status)) {
2276 close(fd);
2277 goto fail;
2278 }
2279
2280 result->transport->transport = NCACN_IP_TCP;
2281
2282 result->binding_handle = rpccli_bh_create(result, NULL, table);
2283 if (result->binding_handle == NULL) {
2284 TALLOC_FREE(result);
2285 return NT_STATUS_NO_MEMORY;
2286 }
2287
2288 *presult = result;
2289 return NT_STATUS_OK;
2290
2291 fail:
2292 TALLOC_FREE(result);
2293 return status;
2294 }
2295
2296 /**
2297 * Determine the tcp port on which a dcerpc interface is listening
2298 * for the ncacn_ip_tcp transport via the endpoint mapper of the
2299 * target host.
2300 */
2301 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
2302 const struct sockaddr_storage *addr,
2303 const struct ndr_interface_table *table,
2304 uint16_t *pport)
2305 {
2306 NTSTATUS status;
2307 struct rpc_pipe_client *epm_pipe = NULL;
2308 struct dcerpc_binding_handle *epm_handle = NULL;
2309 struct pipe_auth_data *auth = NULL;
2310 struct dcerpc_binding *map_binding = NULL;
2311 struct dcerpc_binding *res_binding = NULL;
2312 struct epm_twr_t *map_tower = NULL;
2313 struct epm_twr_t *res_towers = NULL;
2314 struct policy_handle *entry_handle = NULL;
2315 uint32_t num_towers = 0;
2316 uint32_t max_towers = 1;
2317 struct epm_twr_p_t towers;
2318 TALLOC_CTX *tmp_ctx = talloc_stackframe();
2319 uint32_t result = 0;
2320
2321 if (pport == NULL) {
2322 status = NT_STATUS_INVALID_PARAMETER;
2323 goto done;
2324 }
2325
2326 if (ndr_syntax_id_equal(&table->syntax_id,
2327 &ndr_table_epmapper.syntax_id)) {
2328 *pport = 135;
2329 status = NT_STATUS_OK;
2330 goto done;
2331 }
2332
2333 /* open the connection to the endpoint mapper */
2334 status = rpc_pipe_open_tcp_port(tmp_ctx, host, addr, 135,
2335 &ndr_table_epmapper,
2336 &epm_pipe);
2337
2338 if (!NT_STATUS_IS_OK(status)) {
2339 goto done;
2340 }
2341 epm_handle = epm_pipe->binding_handle;
2342
2343 status = rpccli_anon_bind_data(tmp_ctx, &auth);
2344 if (!NT_STATUS_IS_OK(status)) {
2345 goto done;
2346 }
2347
2348 status = rpc_pipe_bind(epm_pipe, auth);
2349 if (!NT_STATUS_IS_OK(status)) {
2350 goto done;
2351 }
2352
2353 /* create tower for asking the epmapper */
2354
2355 map_binding = talloc_zero(tmp_ctx, struct dcerpc_binding);
2356 if (map_binding == NULL) {
2357 status = NT_STATUS_NO_MEMORY;
2358 goto done;
2359 }
2360
2361 map_binding->transport = NCACN_IP_TCP;
2362 map_binding->object = table->syntax_id;
2363 map_binding->host = host; /* needed? */
2364 map_binding->endpoint = "0"; /* correct? needed? */
2365
2366 map_tower = talloc_zero(tmp_ctx, struct epm_twr_t);
2367 if (map_tower == NULL) {
2368 status = NT_STATUS_NO_MEMORY;
2369 goto done;
2370 }
2371
2372 status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
2373 &(map_tower->tower));
2374 if (!NT_STATUS_IS_OK(status)) {
2375 goto done;
2376 }
2377
2378 /* allocate further parameters for the epm_Map call */
2379
2380 res_towers = talloc_array(tmp_ctx, struct epm_twr_t, max_towers);
2381 if (res_towers == NULL) {
2382 status = NT_STATUS_NO_MEMORY;
2383 goto done;
2384 }
2385 towers.twr = res_towers;
2386
2387 entry_handle = talloc_zero(tmp_ctx, struct policy_handle);
2388 if (entry_handle == NULL) {
2389 status = NT_STATUS_NO_MEMORY;
2390 goto done;
2391 }
2392
2393 /* ask the endpoint mapper for the port */
2394
2395 status = dcerpc_epm_Map(epm_handle,
2396 tmp_ctx,
2397 discard_const_p(struct GUID,
2398 &(table->syntax_id.uuid)),
2399 map_tower,
2400 entry_handle,
2401 max_towers,
2402 &num_towers,
2403 &towers,
2404 &result);
2405
2406 if (!NT_STATUS_IS_OK(status)) {
2407 goto done;
2408 }
2409
2410 if (result != EPMAPPER_STATUS_OK) {
2411 status = NT_STATUS_UNSUCCESSFUL;
2412 goto done;
2413 }
2414
2415 if (num_towers != 1) {
2416 status = NT_STATUS_UNSUCCESSFUL;
2417 goto done;
2418 }
2419
2420 /* extract the port from the answer */
2421
2422 status = dcerpc_binding_from_tower(tmp_ctx,
2423 &(towers.twr->tower),
2424 &res_binding);
2425 if (!NT_STATUS_IS_OK(status)) {
2426 goto done;
2427 }
2428
2429 /* are further checks here necessary? */
2430 if (res_binding->transport != NCACN_IP_TCP) {
2431 status = NT_STATUS_UNSUCCESSFUL;
2432 goto done;
2433 }
2434
2435 *pport = (uint16_t)atoi(res_binding->endpoint);
2436
2437 done:
2438 TALLOC_FREE(tmp_ctx);
2439 return status;
2440 }
2441
2442 /**
2443 * Create a rpc pipe client struct, connecting to a host via tcp.
2444 * The port is determined by asking the endpoint mapper on the given
2445 * host.
2446 */
2447 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
2448 const struct sockaddr_storage *addr,
2449 const struct ndr_interface_table *table,
2450 struct rpc_pipe_client **presult)
2451 {
2452 NTSTATUS status;
2453 uint16_t port = 0;
2454
2455 status = rpc_pipe_get_tcp_port(host, addr, table, &port);
2456 if (!NT_STATUS_IS_OK(status)) {
2457 return status;
2458 }
2459
2460 return rpc_pipe_open_tcp_port(mem_ctx, host, addr, port,
2461 table, presult);
2462 }
2463
2464 /********************************************************************
2465 Create a rpc pipe client struct, connecting to a unix domain socket
2466 ********************************************************************/
2467 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
2468 const struct ndr_interface_table *table,
2469 struct rpc_pipe_client **presult)
2470 {
2471 struct rpc_pipe_client *result;
2472 struct sockaddr_un addr;
2473 NTSTATUS status;
2474 int fd;
2475 socklen_t salen;
2476
2477 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2478 if (result == NULL) {
2479 return NT_STATUS_NO_MEMORY;
2480 }
2481
2482 result->abstract_syntax = table->syntax_id;
2483 result->transfer_syntax = ndr_transfer_syntax_ndr;
2484
2485 result->desthost = get_myname(result);
2486 result->srv_name_slash = talloc_asprintf_strupper_m(
2487 result, "\\\\%s", result->desthost);
2488 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2489 status = NT_STATUS_NO_MEMORY;
2490 goto fail;
2491 }
2492
2493 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2494 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2495
2496 fd = socket(AF_UNIX, SOCK_STREAM, 0);
2497 if (fd == -1) {
2498 status = map_nt_error_from_unix(errno);
2499 goto fail;
2500 }
2501
2502 ZERO_STRUCT(addr);
2503 addr.sun_family = AF_UNIX;
2504 strlcpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
2505 salen = sizeof(struct sockaddr_un);
2506
2507 if (connect(fd, (struct sockaddr *)(void *)&addr, salen) == -1) {
2508 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
2509 strerror(errno)));
2510 close(fd);
2511 return map_nt_error_from_unix(errno);
2512 }
2513
2514 status = rpc_transport_sock_init(result, fd, &result->transport);
2515 if (!NT_STATUS_IS_OK(status)) {
2516 close(fd);
2517 goto fail;
2518 }
2519
2520 result->transport->transport = NCALRPC;
2521
2522 result->binding_handle = rpccli_bh_create(result, NULL, table);
2523 if (result->binding_handle == NULL) {
2524 TALLOC_FREE(result);
2525 return NT_STATUS_NO_MEMORY;
2526 }
2527
2528 *presult = result;
2529 return NT_STATUS_OK;
2530
2531 fail:
2532 TALLOC_FREE(result);
2533 return status;
2534 }
2535
2536 struct rpc_pipe_client_np_ref {
2537 struct cli_state *cli;
2538 struct rpc_pipe_client *pipe;
2539 };
2540
2541 static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
2542 {
2543 DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
2544 return 0;
2545 }
2546
2547 /****************************************************************************
2548 Open a named pipe over SMB to a remote server.
2549 *
2550 * CAVEAT CALLER OF THIS FUNCTION:
2551 * The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
2552 * so be sure that this function is called AFTER any structure (vs pointer)
2553 * assignment of the cli. In particular, libsmbclient does structure
2554 * assignments of cli, which invalidates the data in the returned
2555 * rpc_pipe_client if this function is called before the structure assignment
2556 * of cli.
2557 *
2558 ****************************************************************************/
2559
2560 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
2561 const struct ndr_interface_table *table,
2562 struct rpc_pipe_client **presult)
2563 {
2564 struct rpc_pipe_client *result;
2565 NTSTATUS status;
2566 struct rpc_pipe_client_np_ref *np_ref;
2567
2568 /* sanity check to protect against crashes */
2569
2570 if ( !cli ) {
2571 return NT_STATUS_INVALID_HANDLE;
2572 }
2573
2574 result = talloc_zero(NULL, struct rpc_pipe_client);
2575 if (result == NULL) {
2576 return NT_STATUS_NO_MEMORY;
2577 }
2578
2579 result->abstract_syntax = table->syntax_id;
2580 result->transfer_syntax = ndr_transfer_syntax_ndr;
2581 result->desthost = talloc_strdup(result, smbXcli_conn_remote_name(cli->conn));
2582 result->srv_name_slash = talloc_asprintf_strupper_m(
2583 result, "\\\\%s", result->desthost);
2584
2585 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2586 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2587
2588 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2589 TALLOC_FREE(result);
2590 return NT_STATUS_NO_MEMORY;
2591 }
2592
2593 status = rpc_transport_np_init(result, cli, table,
2594 &result->transport);
2595 if (!NT_STATUS_IS_OK(status)) {
2596 TALLOC_FREE(result);
2597 return status;
2598 }
2599
2600 result->transport->transport = NCACN_NP;
2601
2602 np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
2603 if (np_ref == NULL) {
2604 TALLOC_FREE(result);
2605 return NT_STATUS_NO_MEMORY;
2606 }
2607 np_ref->cli = cli;
2608 np_ref->pipe = result;
2609
2610 DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
2611 talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
2612
2613 result->binding_handle = rpccli_bh_create(result, NULL, table);
2614 if (result->binding_handle == NULL) {
2615 TALLOC_FREE(result);
2616 return NT_STATUS_NO_MEMORY;
2617 }
2618
2619 *presult = result;
2620 return NT_STATUS_OK;
2621 }
2622
2623 /****************************************************************************
2624 Open a pipe to a remote server.
2625 ****************************************************************************/
2626
2627 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
2628 enum dcerpc_transport_t transport,
2629 const struct ndr_interface_table *table,
2630 struct rpc_pipe_client **presult)
2631 {
2632 switch (transport) {
2633 case NCACN_IP_TCP:
2634 return rpc_pipe_open_tcp(NULL,
2635 smbXcli_conn_remote_name(cli->conn),
2636 smbXcli_conn_remote_sockaddr(cli->conn),
2637 table, presult);
2638 case NCACN_NP:
2639 return rpc_pipe_open_np(cli, table, presult);
2640 default:
2641 return NT_STATUS_NOT_IMPLEMENTED;
2642 }
2643 }
2644
2645 /****************************************************************************
2646 Open a named pipe to an SMB server and bind anonymously.
2647 ****************************************************************************/
2648
2649 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
2650 enum dcerpc_transport_t transport,
2651 const struct ndr_interface_table *table,
2652 struct rpc_pipe_client **presult)
2653 {
2654 struct rpc_pipe_client *result;
2655 struct pipe_auth_data *auth;
2656 NTSTATUS status;
2657
2658 status = cli_rpc_pipe_open(cli, transport, table, &result);
2659 if (!NT_STATUS_IS_OK(status)) {
2660 return status;
2661 }
2662
2663 status = rpccli_anon_bind_data(result, &auth);
2664 if (!NT_STATUS_IS_OK(status)) {
2665 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
2666 nt_errstr(status)));
2667 TALLOC_FREE(result);
2668 return status;
2669 }
2670
2671 /*
2672 * This is a bit of an abstraction violation due to the fact that an
2673 * anonymous bind on an authenticated SMB inherits the user/domain
2674 * from the enclosing SMB creds
2675 */
2676
2677 TALLOC_FREE(auth->user_name);
2678 TALLOC_FREE(auth->domain);
2679
2680 auth->user_name = talloc_strdup(auth, cli->user_name);
2681 auth->domain = talloc_strdup(auth, cli->domain);
2682
2683 if (transport == NCACN_NP) {
2684 struct smbXcli_session *session;
2685
2686 if (smbXcli_conn_protocol(cli->conn) >= PROTOCOL_SMB2_02) {
2687 session = cli->smb2.session;
2688 } else {
2689 session = cli->smb1.session;
2690 }
2691
2692 status = smbXcli_session_application_key(session, auth,
2693 &auth->transport_session_key);
2694 if (!NT_STATUS_IS_OK(status)) {
2695 auth->transport_session_key = data_blob_null;
2696 }
2697 }
2698
2699 if ((auth->user_name == NULL) || (auth->domain == NULL)) {
2700 TALLOC_FREE(result);
2701 return NT_STATUS_NO_MEMORY;
2702 }
2703
2704 status = rpc_pipe_bind(result, auth);
2705 if (!NT_STATUS_IS_OK(status)) {
2706 int lvl = 0;
2707 if (ndr_syntax_id_equal(&table->syntax_id,
2708 &ndr_table_dssetup.syntax_id)) {
2709 /* non AD domains just don't have this pipe, avoid
2710 * level 0 statement in that case - gd */
2711 lvl = 3;
2712 }
2713 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
2714 "%s failed with error %s\n",
2715 table->name,
2716 nt_errstr(status) ));
2717 TALLOC_FREE(result);
2718 return status;
2719 }
2720
2721 DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
2722 "%s and bound anonymously.\n",
2723 table->name,
2724 result->desthost));
2725
2726 *presult = result;
2727 return NT_STATUS_OK;
2728 }
2729
2730 /****************************************************************************
2731 ****************************************************************************/
2732
2733 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
2734 const struct ndr_interface_table *table,
2735 struct rpc_pipe_client **presult)
2736 {
2737 return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
2738 table, presult);
2739 }
2740
2741 /****************************************************************************
2742 Open a named pipe to an SMB server and bind using the mech specified
2743 ****************************************************************************/
2744
2745 NTSTATUS cli_rpc_pipe_open_generic_auth(struct cli_state *cli,
2746 const struct ndr_interface_table *table,
2747 enum dcerpc_transport_t transport,
2748 enum dcerpc_AuthType auth_type,
2749 enum dcerpc_AuthLevel auth_level,
2750 const char *server,
2751 const char *domain,
2752 const char *username,
2753 const char *password,
2754 struct rpc_pipe_client **presult)
2755 {
2756 struct rpc_pipe_client *result;
2757 struct pipe_auth_data *auth = NULL;
2758 const char *target_service = table->authservices->names[0];
2759
2760 NTSTATUS status;
2761
2762 status = cli_rpc_pipe_open(cli, transport, table, &result);
2763 if (!NT_STATUS_IS_OK(status)) {
2764 return status;
2765 }
2766
2767 status = rpccli_generic_bind_data(result,
2768 auth_type, auth_level,
2769 server, target_service,
2770 domain, username, password,
2771 CRED_AUTO_USE_KERBEROS,
2772 NULL,
2773 &auth);
2774 if (!NT_STATUS_IS_OK(status)) {
2775 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
2776 nt_errstr(status)));
2777 goto err;
2778 }
2779
2780 status = rpc_pipe_bind(result, auth);
2781 if (!NT_STATUS_IS_OK(status)) {
2782 DEBUG(0, ("cli_rpc_pipe_open_generic_auth: cli_rpc_pipe_bind failed with error %s\n",
2783 nt_errstr(status) ));
2784 goto err;
2785 }
2786
2787 DEBUG(10,("cli_rpc_pipe_open_generic_auth: opened pipe %s to "
2788 "machine %s and bound as user %s\\%s.\n", table->name,
2789 result->desthost, domain, username));
2790
2791 *presult = result;
2792 return NT_STATUS_OK;
2793
2794 err:
2795
2796 TALLOC_FREE(result);
2797 return status;
2798 }
2799
2800 /****************************************************************************
2801 External interface.
2802 Open a named pipe to an SMB server and bind using schannel (bind type 68)
2803 using session_key. sign and seal.
2804
2805 The *pdc will be stolen onto this new pipe
2806 ****************************************************************************/
2807
2808 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
2809 const struct ndr_interface_table *table,
2810 enum dcerpc_transport_t transport,
2811 enum dcerpc_AuthLevel auth_level,
2812 const char *domain,
2813 struct netlogon_creds_CredentialState **pdc,
2814 struct rpc_pipe_client **_rpccli)
2815 {
2816 struct rpc_pipe_client *rpccli;
2817 struct pipe_auth_data *rpcauth;
2818 NTSTATUS status;
2819 NTSTATUS result;
2820 struct netlogon_creds_CredentialState save_creds;
2821 struct netr_Authenticator auth;
2822 struct netr_Authenticator return_auth;
2823 union netr_Capabilities capabilities;
2824 const char *target_service = table->authservices->names[0];
2825
2826 status = cli_rpc_pipe_open(cli, transport, table, &rpccli);
2827 if (!NT_STATUS_IS_OK(status)) {
2828 return status;
2829 }
2830
2831 status = rpccli_generic_bind_data(rpccli,
2832 DCERPC_AUTH_TYPE_SCHANNEL,
2833 auth_level,
2834 NULL,
2835 target_service,
2836 domain,
2837 (*pdc)->computer_name,
2838 NULL,
2839 CRED_AUTO_USE_KERBEROS,
2840 *pdc,
2841 &rpcauth);
2842 if (!NT_STATUS_IS_OK(status)) {
2843 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
2844 nt_errstr(status)));
2845 TALLOC_FREE(rpccli);
2846 return status;
2847 }
2848
2849 /*
2850 * The credentials on a new netlogon pipe are the ones we are passed
2851 * in - copy them over
2852 *
2853 * This may get overwritten... in rpc_pipe_bind()...
2854 */
2855 rpccli->dc = netlogon_creds_copy(rpccli, *pdc);
2856 if (rpccli->dc == NULL) {
2857 TALLOC_FREE(rpccli);
2858 return NT_STATUS_NO_MEMORY;
2859 }
2860
2861 status = rpc_pipe_bind(rpccli, rpcauth);
2862 if (!NT_STATUS_IS_OK(status)) {
2863 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
2864 "cli_rpc_pipe_bind failed with error %s\n",
2865 nt_errstr(status) ));
2866 TALLOC_FREE(rpccli);
2867 return status;
2868 }
2869
2870 if (!ndr_syntax_id_equal(&table->syntax_id, &ndr_table_netlogon.syntax_id)) {
2871 goto done;
2872 }
2873
2874 save_creds = *rpccli->dc;
2875 ZERO_STRUCT(return_auth);
2876 ZERO_STRUCT(capabilities);
2877
2878 netlogon_creds_client_authenticator(&save_creds, &auth);
2879
2880 status = dcerpc_netr_LogonGetCapabilities(rpccli->binding_handle,
2881 talloc_tos(),
2882 rpccli->srv_name_slash,
2883 save_creds.computer_name,
2884 &auth, &return_auth,
2885 1, &capabilities,
2886 &result);
2887 if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROCNUM_OUT_OF_RANGE)) {
2888 if (save_creds.negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
2889 DEBUG(5, ("AES was negotiated and the error was %s - "
2890 "downgrade detected\n",
2891 nt_errstr(status)));
2892 TALLOC_FREE(rpccli);
2893 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2894 }
2895
2896 /* This is probably an old Samba Version */
2897 DEBUG(5, ("We are checking against an NT or old Samba - %s\n",
2898 nt_errstr(status)));
2899 goto done;
2900 }
2901
2902 if (!NT_STATUS_IS_OK(status)) {
2903 DEBUG(0, ("dcerpc_netr_LogonGetCapabilities failed with %s\n",
2904 nt_errstr(status)));
2905 TALLOC_FREE(rpccli);
2906 return status;
2907 }
2908
2909 if (NT_STATUS_EQUAL(result, NT_STATUS_NOT_IMPLEMENTED)) {
2910 if (save_creds.negotiate_flags & NETLOGON_NEG_SUPPORTS_AES) {
2911 /* This means AES isn't supported. */
2912 DEBUG(5, ("AES was negotiated and the result was %s - "
2913 "downgrade detected\n",
2914 nt_errstr(result)));
2915 TALLOC_FREE(rpccli);
2916 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2917 }
2918
2919 /* This is probably an old Windows version */
2920 DEBUG(5, ("We are checking against an win2k3 or Samba - %s\n",
2921 nt_errstr(result)));
2922 goto done;
2923 }
2924
2925 /*
2926 * We need to check the credential state here, cause win2k3 and earlier
2927 * returns NT_STATUS_NOT_IMPLEMENTED
2928 */
2929 if (!netlogon_creds_client_check(&save_creds, &return_auth.cred)) {
2930 /*
2931 * Server replied with bad credential. Fail.
2932 */
2933 DEBUG(0,("cli_rpc_pipe_open_schannel_with_key: server %s "
2934 "replied with bad credential\n",
2935 rpccli->desthost));
2936 TALLOC_FREE(rpccli);
2937 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2938 }
2939 *rpccli->dc = save_creds;
2940
2941 if (!NT_STATUS_IS_OK(result)) {
2942 DEBUG(0, ("dcerpc_netr_LogonGetCapabilities failed with %s\n",
2943 nt_errstr(result)));
2944 TALLOC_FREE(rpccli);
2945 return result;
2946 }
2947
2948 if (!(save_creds.negotiate_flags & NETLOGON_NEG_SUPPORTS_AES)) {
2949 /* This means AES isn't supported. */
2950 DEBUG(5, ("AES is not negotiated, but netr_LogonGetCapabilities "
2951 "was OK - downgrade detected\n"));
2952 TALLOC_FREE(rpccli);
2953 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2954 }
2955
2956 if (save_creds.negotiate_flags != capabilities.server_capabilities) {
2957 DEBUG(0, ("The client capabilities don't match the server "
2958 "capabilities: local[0x%08X] remote[0x%08X]\n",
2959 save_creds.negotiate_flags,
2960 capabilities.server_capabilities));
2961 TALLOC_FREE(rpccli);
2962 return NT_STATUS_INVALID_NETWORK_RESPONSE;
2963 }
2964
2965 done:
2966 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
2967 "for domain %s and bound using schannel.\n",
2968 table->name,
2969 rpccli->desthost, domain));
2970
2971 *_rpccli = rpccli;
2972 return NT_STATUS_OK;
2973 }
2974
2975 NTSTATUS cli_rpc_pipe_open_spnego(struct cli_state *cli,
2976 const struct ndr_interface_table *table,
2977 enum dcerpc_transport_t transport,
2978 const char *oid,
2979 enum dcerpc_AuthLevel auth_level,
2980 const char *server,
2981 const char *domain,
2982 const char *username,
2983 const char *password,
2984 struct rpc_pipe_client **presult)
2985 {
2986 struct rpc_pipe_client *result;
2987 struct pipe_auth_data *auth = NULL;
2988 const char *target_service = table->authservices->names[0];
2989
2990 NTSTATUS status;
2991 enum credentials_use_kerberos use_kerberos;
2992
2993 if (strcmp(oid, GENSEC_OID_KERBEROS5) == 0) {
2994 use_kerberos = CRED_MUST_USE_KERBEROS;
2995 } else if (strcmp(oid, GENSEC_OID_NTLMSSP) == 0) {
2996 use_kerberos = CRED_DONT_USE_KERBEROS;
2997 } else {
2998 return NT_STATUS_INVALID_PARAMETER;
2999 }
3000
3001 status = cli_rpc_pipe_open(cli, transport, table, &result);
3002 if (!NT_STATUS_IS_OK(status)) {
3003 return status;
3004 }
3005
3006 status = rpccli_generic_bind_data(result,
3007 DCERPC_AUTH_TYPE_SPNEGO, auth_level,
3008 server, target_service,
3009 domain, username, password,
3010 use_kerberos, NULL,
3011 &auth);
3012 if (!NT_STATUS_IS_OK(status)) {
3013 DEBUG(0, ("rpccli_generic_bind_data returned %s\n",
3014 nt_errstr(status)));
3015 goto err;
3016 }
3017
3018 status = rpc_pipe_bind(result, auth);
3019 if (!NT_STATUS_IS_OK(status)) {
3020 DEBUG(0, ("cli_rpc_pipe_open_spnego: cli_rpc_pipe_bind failed with error %s\n",
3021 nt_errstr(status) ));
3022 goto err;
3023 }
3024
3025 DEBUG(10,("cli_rpc_pipe_open_spnego: opened pipe %s to "
3026 "machine %s.\n", table->name,
3027 result->desthost));
3028
3029 *presult = result;
3030 return NT_STATUS_OK;
3031
3032 err:
3033
3034 TALLOC_FREE(result);
3035 return status;
3036 }
3037
3038 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
3039 struct rpc_pipe_client *cli,
3040 DATA_BLOB *session_key)
3041 {
3042 NTSTATUS status;
3043 struct pipe_auth_data *a;
3044 struct gensec_security *gensec_security;
3045 DATA_BLOB sk = data_blob_null;
3046 bool make_dup = false;
3047
3048 if (!session_key || !cli) {
3049 return NT_STATUS_INVALID_PARAMETER;
3050 }
3051
3052 a = cli->auth;
3053
3054 if (a == NULL) {
3055 return NT_STATUS_INVALID_PARAMETER;
3056 }
3057
3058 switch (cli->auth->auth_type) {
3059 case DCERPC_AUTH_TYPE_SPNEGO:
3060 case DCERPC_AUTH_TYPE_NTLMSSP:
3061 case DCERPC_AUTH_TYPE_KRB5:
3062 gensec_security = talloc_get_type_abort(a->auth_ctx,
3063 struct gensec_security);
3064 status = gensec_session_key(gensec_security, mem_ctx, &sk);
3065 if (!NT_STATUS_IS_OK(status)) {
3066 return status;
3067 }
3068 make_dup = false;
3069 break;
3070 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
3071 case DCERPC_AUTH_TYPE_NONE:
3072 sk = data_blob_const(a->transport_session_key.data,
3073 a->transport_session_key.length);
3074 make_dup = true;
3075 break;
3076 default:
3077 break;
3078 }
3079
3080 if (!sk.data) {
3081 return NT_STATUS_NO_USER_SESSION_KEY;
3082 }
3083
3084 if (make_dup) {
3085 *session_key = data_blob_dup_talloc(mem_ctx, sk);
3086 } else {
3087 *session_key = sk;
3088 }
3089
3090 return NT_STATUS_OK;
3091 }
Anubhav's Work In Progress branches