2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client routines
4 * Largely rewritten by Jeremy Allison 2005.
5 * Heavily modified by Simo Sorce 2010.
7 * This program is free software; you can redistribute it and/or modify
8 * it under the terms of the GNU General Public License as published by
9 * the Free Software Foundation; either version 3 of the License, or
10 * (at your option) any later version.
12 * This program is distributed in the hope that it will be useful,
13 * but WITHOUT ANY WARRANTY; without even the implied warranty of
14 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
15 * GNU General Public License for more details.
17 * You should have received a copy of the GNU General Public License
18 * along with this program; if not, see <http://www.gnu.org/licenses/>.
22 #include "../lib/util/tevent_ntstatus.h"
23 #include "librpc/gen_ndr/ndr_epmapper_c.h"
24 #include "../librpc/gen_ndr/ndr_schannel.h"
25 #include "../librpc/gen_ndr/ndr_dssetup.h"
26 #include "../libcli/auth/schannel.h"
27 #include "../libcli/auth/spnego.h"
28 #include "../auth/ntlmssp/ntlmssp.h"
29 #include "ntlmssp_wrap.h"
30 #include "librpc/gen_ndr/ndr_dcerpc.h"
31 #include "librpc/rpc/dcerpc.h"
32 #include "librpc/crypto/gse.h"
33 #include "librpc/crypto/spnego.h"
36 #include "libsmb/libsmb.h"
39 #define DBGC_CLASS DBGC_RPC_CLI
41 /********************************************************************
42 Pipe description for a DEBUG
43 ********************************************************************/
44 static const char *rpccli_pipe_txt(TALLOC_CTX *mem_ctx,
45 struct rpc_pipe_client *cli)
47 char *result = talloc_asprintf(mem_ctx, "host %s", cli->desthost);
54 /********************************************************************
56 ********************************************************************/
58 static uint32 get_rpc_call_id(void)
60 static uint32 call_id = 0;
64 /*******************************************************************
65 Use SMBreadX to get rest of one fragment's worth of rpc data.
66 Reads the whole size or give an error message
67 ********************************************************************/
69 struct rpc_read_state {
70 struct event_context *ev;
71 struct rpc_cli_transport *transport;
77 static void rpc_read_done(struct tevent_req *subreq);
79 static struct tevent_req *rpc_read_send(TALLOC_CTX *mem_ctx,
80 struct event_context *ev,
81 struct rpc_cli_transport *transport,
82 uint8_t *data, size_t size)
84 struct tevent_req *req, *subreq;
85 struct rpc_read_state *state;
87 req = tevent_req_create(mem_ctx, &state, struct rpc_read_state);
92 state->transport = transport;
97 DEBUG(5, ("rpc_read_send: data_to_read: %u\n", (unsigned int)size));
99 subreq = transport->read_send(state, ev, (uint8_t *)data, size,
101 if (subreq == NULL) {
104 tevent_req_set_callback(subreq, rpc_read_done, req);
112 static void rpc_read_done(struct tevent_req *subreq)
114 struct tevent_req *req = tevent_req_callback_data(
115 subreq, struct tevent_req);
116 struct rpc_read_state *state = tevent_req_data(
117 req, struct rpc_read_state);
121 status = state->transport->read_recv(subreq, &received);
123 if (!NT_STATUS_IS_OK(status)) {
124 tevent_req_nterror(req, status);
128 state->num_read += received;
129 if (state->num_read == state->size) {
130 tevent_req_done(req);
134 subreq = state->transport->read_send(state, state->ev,
135 state->data + state->num_read,
136 state->size - state->num_read,
137 state->transport->priv);
138 if (tevent_req_nomem(subreq, req)) {
141 tevent_req_set_callback(subreq, rpc_read_done, req);
144 static NTSTATUS rpc_read_recv(struct tevent_req *req)
146 return tevent_req_simple_recv_ntstatus(req);
149 struct rpc_write_state {
150 struct event_context *ev;
151 struct rpc_cli_transport *transport;
157 static void rpc_write_done(struct tevent_req *subreq);
159 static struct tevent_req *rpc_write_send(TALLOC_CTX *mem_ctx,
160 struct event_context *ev,
161 struct rpc_cli_transport *transport,
162 const uint8_t *data, size_t size)
164 struct tevent_req *req, *subreq;
165 struct rpc_write_state *state;
167 req = tevent_req_create(mem_ctx, &state, struct rpc_write_state);
172 state->transport = transport;
175 state->num_written = 0;
177 DEBUG(5, ("rpc_write_send: data_to_write: %u\n", (unsigned int)size));
179 subreq = transport->write_send(state, ev, data, size, transport->priv);
180 if (subreq == NULL) {
183 tevent_req_set_callback(subreq, rpc_write_done, req);
190 static void rpc_write_done(struct tevent_req *subreq)
192 struct tevent_req *req = tevent_req_callback_data(
193 subreq, struct tevent_req);
194 struct rpc_write_state *state = tevent_req_data(
195 req, struct rpc_write_state);
199 status = state->transport->write_recv(subreq, &written);
201 if (!NT_STATUS_IS_OK(status)) {
202 tevent_req_nterror(req, status);
206 state->num_written += written;
208 if (state->num_written == state->size) {
209 tevent_req_done(req);
213 subreq = state->transport->write_send(state, state->ev,
214 state->data + state->num_written,
215 state->size - state->num_written,
216 state->transport->priv);
217 if (tevent_req_nomem(subreq, req)) {
220 tevent_req_set_callback(subreq, rpc_write_done, req);
223 static NTSTATUS rpc_write_recv(struct tevent_req *req)
225 return tevent_req_simple_recv_ntstatus(req);
229 /****************************************************************************
230 Try and get a PDU's worth of data from current_pdu. If not, then read more
232 ****************************************************************************/
234 struct get_complete_frag_state {
235 struct event_context *ev;
236 struct rpc_pipe_client *cli;
241 static void get_complete_frag_got_header(struct tevent_req *subreq);
242 static void get_complete_frag_got_rest(struct tevent_req *subreq);
244 static struct tevent_req *get_complete_frag_send(TALLOC_CTX *mem_ctx,
245 struct event_context *ev,
246 struct rpc_pipe_client *cli,
249 struct tevent_req *req, *subreq;
250 struct get_complete_frag_state *state;
254 req = tevent_req_create(mem_ctx, &state,
255 struct get_complete_frag_state);
261 state->frag_len = RPC_HEADER_LEN;
264 received = pdu->length;
265 if (received < RPC_HEADER_LEN) {
266 if (!data_blob_realloc(mem_ctx, pdu, RPC_HEADER_LEN)) {
267 status = NT_STATUS_NO_MEMORY;
270 subreq = rpc_read_send(state, state->ev,
271 state->cli->transport,
272 pdu->data + received,
273 RPC_HEADER_LEN - received);
274 if (subreq == NULL) {
275 status = NT_STATUS_NO_MEMORY;
278 tevent_req_set_callback(subreq, get_complete_frag_got_header,
283 state->frag_len = dcerpc_get_frag_length(pdu);
286 * Ensure we have frag_len bytes of data.
288 if (received < state->frag_len) {
289 if (!data_blob_realloc(NULL, pdu, state->frag_len)) {
290 status = NT_STATUS_NO_MEMORY;
293 subreq = rpc_read_send(state, state->ev,
294 state->cli->transport,
295 pdu->data + received,
296 state->frag_len - received);
297 if (subreq == NULL) {
298 status = NT_STATUS_NO_MEMORY;
301 tevent_req_set_callback(subreq, get_complete_frag_got_rest,
306 status = NT_STATUS_OK;
308 if (NT_STATUS_IS_OK(status)) {
309 tevent_req_done(req);
311 tevent_req_nterror(req, status);
313 return tevent_req_post(req, ev);
316 static void get_complete_frag_got_header(struct tevent_req *subreq)
318 struct tevent_req *req = tevent_req_callback_data(
319 subreq, struct tevent_req);
320 struct get_complete_frag_state *state = tevent_req_data(
321 req, struct get_complete_frag_state);
324 status = rpc_read_recv(subreq);
326 if (!NT_STATUS_IS_OK(status)) {
327 tevent_req_nterror(req, status);
331 state->frag_len = dcerpc_get_frag_length(state->pdu);
333 if (!data_blob_realloc(NULL, state->pdu, state->frag_len)) {
334 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
339 * We're here in this piece of code because we've read exactly
340 * RPC_HEADER_LEN bytes into state->pdu.
343 subreq = rpc_read_send(state, state->ev, state->cli->transport,
344 state->pdu->data + RPC_HEADER_LEN,
345 state->frag_len - RPC_HEADER_LEN);
346 if (tevent_req_nomem(subreq, req)) {
349 tevent_req_set_callback(subreq, get_complete_frag_got_rest, req);
352 static void get_complete_frag_got_rest(struct tevent_req *subreq)
354 struct tevent_req *req = tevent_req_callback_data(
355 subreq, struct tevent_req);
358 status = rpc_read_recv(subreq);
360 if (!NT_STATUS_IS_OK(status)) {
361 tevent_req_nterror(req, status);
364 tevent_req_done(req);
367 static NTSTATUS get_complete_frag_recv(struct tevent_req *req)
369 return tevent_req_simple_recv_ntstatus(req);
372 /****************************************************************************
373 Do basic authentication checks on an incoming pdu.
374 ****************************************************************************/
376 static NTSTATUS cli_pipe_validate_current_pdu(TALLOC_CTX *mem_ctx,
377 struct rpc_pipe_client *cli,
378 struct ncacn_packet *pkt,
380 uint8_t expected_pkt_type,
382 DATA_BLOB *reply_pdu)
384 struct dcerpc_response *r;
385 NTSTATUS ret = NT_STATUS_OK;
389 * Point the return values at the real data including the RPC
390 * header. Just in case the caller wants it.
394 /* Ensure we have the correct type. */
395 switch (pkt->ptype) {
396 case DCERPC_PKT_ALTER_RESP:
397 case DCERPC_PKT_BIND_ACK:
399 /* Client code never receives this kind of packets */
403 case DCERPC_PKT_RESPONSE:
405 r = &pkt->u.response;
407 /* Here's where we deal with incoming sign/seal. */
408 ret = dcerpc_check_auth(cli->auth, pkt,
409 &r->stub_and_verifier,
410 DCERPC_RESPONSE_LENGTH,
412 if (!NT_STATUS_IS_OK(ret)) {
416 if (pkt->frag_length < DCERPC_RESPONSE_LENGTH + pad_len) {
417 return NT_STATUS_BUFFER_TOO_SMALL;
420 /* Point the return values at the NDR data. */
421 rdata->data = r->stub_and_verifier.data;
423 if (pkt->auth_length) {
424 /* We've already done integer wrap tests in
425 * dcerpc_check_auth(). */
426 rdata->length = r->stub_and_verifier.length
428 - DCERPC_AUTH_TRAILER_LENGTH
431 rdata->length = r->stub_and_verifier.length;
434 DEBUG(10, ("Got pdu len %lu, data_len %lu, ss_len %u\n",
435 (long unsigned int)pdu->length,
436 (long unsigned int)rdata->length,
437 (unsigned int)pad_len));
440 * If this is the first reply, and the allocation hint is
441 * reasonable, try and set up the reply_pdu DATA_BLOB to the
445 if ((reply_pdu->length == 0) &&
446 r->alloc_hint && (r->alloc_hint < 15*1024*1024)) {
447 if (!data_blob_realloc(mem_ctx, reply_pdu,
449 DEBUG(0, ("reply alloc hint %d too "
450 "large to allocate\n",
451 (int)r->alloc_hint));
452 return NT_STATUS_NO_MEMORY;
458 case DCERPC_PKT_BIND_NAK:
459 DEBUG(1, (__location__ ": Bind NACK received from %s!\n",
460 rpccli_pipe_txt(talloc_tos(), cli)));
461 /* Use this for now... */
462 return NT_STATUS_NETWORK_ACCESS_DENIED;
464 case DCERPC_PKT_FAULT:
466 DEBUG(1, (__location__ ": RPC fault code %s received "
468 dcerpc_errstr(talloc_tos(),
469 pkt->u.fault.status),
470 rpccli_pipe_txt(talloc_tos(), cli)));
472 return dcerpc_fault_to_nt_status(pkt->u.fault.status);
475 DEBUG(0, (__location__ "Unknown packet type %u received "
477 (unsigned int)pkt->ptype,
478 rpccli_pipe_txt(talloc_tos(), cli)));
479 return NT_STATUS_INVALID_INFO_CLASS;
482 if (pkt->ptype != expected_pkt_type) {
483 DEBUG(3, (__location__ ": Connection to %s got an unexpected "
484 "RPC packet type - %u, not %u\n",
485 rpccli_pipe_txt(talloc_tos(), cli),
486 pkt->ptype, expected_pkt_type));
487 return NT_STATUS_INVALID_INFO_CLASS;
490 /* Do this just before return - we don't want to modify any rpc header
491 data before now as we may have needed to do cryptographic actions on
494 if ((pkt->ptype == DCERPC_PKT_BIND_ACK) &&
495 !(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
496 DEBUG(5, (__location__ ": bug in server (AS/U?), setting "
497 "fragment first/last ON.\n"));
498 pkt->pfc_flags |= DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
504 /****************************************************************************
505 Call a remote api on an arbitrary pipe. takes param, data and setup buffers.
506 ****************************************************************************/
508 struct cli_api_pipe_state {
509 struct event_context *ev;
510 struct rpc_cli_transport *transport;
515 static void cli_api_pipe_trans_done(struct tevent_req *subreq);
516 static void cli_api_pipe_write_done(struct tevent_req *subreq);
517 static void cli_api_pipe_read_done(struct tevent_req *subreq);
519 static struct tevent_req *cli_api_pipe_send(TALLOC_CTX *mem_ctx,
520 struct event_context *ev,
521 struct rpc_cli_transport *transport,
522 uint8_t *data, size_t data_len,
523 uint32_t max_rdata_len)
525 struct tevent_req *req, *subreq;
526 struct cli_api_pipe_state *state;
529 req = tevent_req_create(mem_ctx, &state, struct cli_api_pipe_state);
534 state->transport = transport;
536 if (max_rdata_len < RPC_HEADER_LEN) {
538 * For a RPC reply we always need at least RPC_HEADER_LEN
539 * bytes. We check this here because we will receive
540 * RPC_HEADER_LEN bytes in cli_trans_sock_send_done.
542 status = NT_STATUS_INVALID_PARAMETER;
546 if (transport->trans_send != NULL) {
547 subreq = transport->trans_send(state, ev, data, data_len,
548 max_rdata_len, transport->priv);
549 if (subreq == NULL) {
552 tevent_req_set_callback(subreq, cli_api_pipe_trans_done, req);
557 * If the transport does not provide a "trans" routine, i.e. for
558 * example the ncacn_ip_tcp transport, do the write/read step here.
561 subreq = rpc_write_send(state, ev, transport, data, data_len);
562 if (subreq == NULL) {
565 tevent_req_set_callback(subreq, cli_api_pipe_write_done, req);
569 tevent_req_nterror(req, status);
570 return tevent_req_post(req, ev);
576 static void cli_api_pipe_trans_done(struct tevent_req *subreq)
578 struct tevent_req *req = tevent_req_callback_data(
579 subreq, struct tevent_req);
580 struct cli_api_pipe_state *state = tevent_req_data(
581 req, struct cli_api_pipe_state);
584 status = state->transport->trans_recv(subreq, state, &state->rdata,
587 if (!NT_STATUS_IS_OK(status)) {
588 tevent_req_nterror(req, status);
591 tevent_req_done(req);
594 static void cli_api_pipe_write_done(struct tevent_req *subreq)
596 struct tevent_req *req = tevent_req_callback_data(
597 subreq, struct tevent_req);
598 struct cli_api_pipe_state *state = tevent_req_data(
599 req, struct cli_api_pipe_state);
602 status = rpc_write_recv(subreq);
604 if (!NT_STATUS_IS_OK(status)) {
605 tevent_req_nterror(req, status);
609 state->rdata = talloc_array(state, uint8_t, RPC_HEADER_LEN);
610 if (tevent_req_nomem(state->rdata, req)) {
615 * We don't need to use rpc_read_send here, the upper layer will cope
616 * with a short read, transport->trans_send could also return less
617 * than state->max_rdata_len.
619 subreq = state->transport->read_send(state, state->ev, state->rdata,
621 state->transport->priv);
622 if (tevent_req_nomem(subreq, req)) {
625 tevent_req_set_callback(subreq, cli_api_pipe_read_done, req);
628 static void cli_api_pipe_read_done(struct tevent_req *subreq)
630 struct tevent_req *req = tevent_req_callback_data(
631 subreq, struct tevent_req);
632 struct cli_api_pipe_state *state = tevent_req_data(
633 req, struct cli_api_pipe_state);
637 status = state->transport->read_recv(subreq, &received);
639 if (!NT_STATUS_IS_OK(status)) {
640 tevent_req_nterror(req, status);
643 state->rdata_len = received;
644 tevent_req_done(req);
647 static NTSTATUS cli_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
648 uint8_t **prdata, uint32_t *prdata_len)
650 struct cli_api_pipe_state *state = tevent_req_data(
651 req, struct cli_api_pipe_state);
654 if (tevent_req_is_nterror(req, &status)) {
658 *prdata = talloc_move(mem_ctx, &state->rdata);
659 *prdata_len = state->rdata_len;
663 /****************************************************************************
664 Send data on an rpc pipe via trans. The data must be the last
665 pdu fragment of an NDR data stream.
667 Receive response data from an rpc pipe, which may be large...
669 Read the first fragment: unfortunately have to use SMBtrans for the first
670 bit, then SMBreadX for subsequent bits.
672 If first fragment received also wasn't the last fragment, continue
673 getting fragments until we _do_ receive the last fragment.
675 Request/Response PDU's look like the following...
677 |<------------------PDU len----------------------------------------------->|
678 |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
680 +------------+-----------------+-------------+---------------+-------------+
681 | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR | AUTH DATA |
682 +------------+-----------------+-------------+---------------+-------------+
684 Where the presence of the AUTH_HDR and AUTH DATA are dependent on the
685 signing & sealing being negotiated.
687 ****************************************************************************/
689 struct rpc_api_pipe_state {
690 struct event_context *ev;
691 struct rpc_pipe_client *cli;
692 uint8_t expected_pkt_type;
694 DATA_BLOB incoming_frag;
695 struct ncacn_packet *pkt;
699 size_t reply_pdu_offset;
703 static void rpc_api_pipe_trans_done(struct tevent_req *subreq);
704 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq);
705 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq);
707 static struct tevent_req *rpc_api_pipe_send(TALLOC_CTX *mem_ctx,
708 struct event_context *ev,
709 struct rpc_pipe_client *cli,
710 DATA_BLOB *data, /* Outgoing PDU */
711 uint8_t expected_pkt_type)
713 struct tevent_req *req, *subreq;
714 struct rpc_api_pipe_state *state;
715 uint16_t max_recv_frag;
718 req = tevent_req_create(mem_ctx, &state, struct rpc_api_pipe_state);
724 state->expected_pkt_type = expected_pkt_type;
725 state->incoming_frag = data_blob_null;
726 state->reply_pdu = data_blob_null;
727 state->reply_pdu_offset = 0;
728 state->endianess = DCERPC_DREP_LE;
731 * Ensure we're not sending too much.
733 if (data->length > cli->max_xmit_frag) {
734 status = NT_STATUS_INVALID_PARAMETER;
738 DEBUG(5,("rpc_api_pipe: %s\n", rpccli_pipe_txt(talloc_tos(), cli)));
740 if (state->expected_pkt_type == DCERPC_PKT_AUTH3) {
741 subreq = rpc_write_send(state, ev, cli->transport,
742 data->data, data->length);
743 if (subreq == NULL) {
746 tevent_req_set_callback(subreq, rpc_api_pipe_auth3_done, req);
750 /* get the header first, then fetch the rest once we have
751 * the frag_length available */
752 max_recv_frag = RPC_HEADER_LEN;
754 subreq = cli_api_pipe_send(state, ev, cli->transport,
755 data->data, data->length, max_recv_frag);
756 if (subreq == NULL) {
759 tevent_req_set_callback(subreq, rpc_api_pipe_trans_done, req);
763 tevent_req_nterror(req, status);
764 return tevent_req_post(req, ev);
770 static void rpc_api_pipe_auth3_done(struct tevent_req *subreq)
772 struct tevent_req *req =
773 tevent_req_callback_data(subreq,
777 status = rpc_write_recv(subreq);
779 if (!NT_STATUS_IS_OK(status)) {
780 tevent_req_nterror(req, status);
784 tevent_req_done(req);
787 static void rpc_api_pipe_trans_done(struct tevent_req *subreq)
789 struct tevent_req *req = tevent_req_callback_data(
790 subreq, struct tevent_req);
791 struct rpc_api_pipe_state *state = tevent_req_data(
792 req, struct rpc_api_pipe_state);
794 uint8_t *rdata = NULL;
795 uint32_t rdata_len = 0;
797 status = cli_api_pipe_recv(subreq, state, &rdata, &rdata_len);
799 if (!NT_STATUS_IS_OK(status)) {
800 DEBUG(5, ("cli_api_pipe failed: %s\n", nt_errstr(status)));
801 tevent_req_nterror(req, status);
806 DEBUG(3,("rpc_api_pipe: %s failed to return data.\n",
807 rpccli_pipe_txt(talloc_tos(), state->cli)));
808 tevent_req_done(req);
813 * Move data on state->incoming_frag.
815 state->incoming_frag.data = talloc_move(state, &rdata);
816 state->incoming_frag.length = rdata_len;
817 if (!state->incoming_frag.data) {
818 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
822 /* Ensure we have enough data for a pdu. */
823 subreq = get_complete_frag_send(state, state->ev, state->cli,
824 &state->incoming_frag);
825 if (tevent_req_nomem(subreq, req)) {
828 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
831 static void rpc_api_pipe_got_pdu(struct tevent_req *subreq)
833 struct tevent_req *req = tevent_req_callback_data(
834 subreq, struct tevent_req);
835 struct rpc_api_pipe_state *state = tevent_req_data(
836 req, struct rpc_api_pipe_state);
838 DATA_BLOB rdata = data_blob_null;
840 status = get_complete_frag_recv(subreq);
842 if (!NT_STATUS_IS_OK(status)) {
843 DEBUG(5, ("get_complete_frag failed: %s\n",
845 tevent_req_nterror(req, status);
849 state->pkt = talloc(state, struct ncacn_packet);
851 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
855 status = dcerpc_pull_ncacn_packet(state->pkt,
856 &state->incoming_frag,
859 if (!NT_STATUS_IS_OK(status)) {
860 tevent_req_nterror(req, status);
864 if (state->incoming_frag.length != state->pkt->frag_length) {
865 DEBUG(5, ("Incorrect pdu length %u, expected %u\n",
866 (unsigned int)state->incoming_frag.length,
867 (unsigned int)state->pkt->frag_length));
868 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
872 status = cli_pipe_validate_current_pdu(state,
873 state->cli, state->pkt,
874 &state->incoming_frag,
875 state->expected_pkt_type,
879 DEBUG(10,("rpc_api_pipe: got frag len of %u at offset %u: %s\n",
880 (unsigned)state->incoming_frag.length,
881 (unsigned)state->reply_pdu_offset,
884 if (!NT_STATUS_IS_OK(status)) {
885 tevent_req_nterror(req, status);
889 if ((state->pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST)
890 && (state->pkt->drep[0] != DCERPC_DREP_LE)) {
892 * Set the data type correctly for big-endian data on the
895 DEBUG(10,("rpc_api_pipe: On %s PDU data format is "
897 rpccli_pipe_txt(talloc_tos(), state->cli)));
898 state->endianess = 0x00; /* BIG ENDIAN */
901 * Check endianness on subsequent packets.
903 if (state->endianess != state->pkt->drep[0]) {
904 DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to "
906 state->endianess?"little":"big",
907 state->pkt->drep[0]?"little":"big"));
908 tevent_req_nterror(req, NT_STATUS_INVALID_PARAMETER);
912 /* Now copy the data portion out of the pdu into rbuf. */
913 if (state->reply_pdu.length < state->reply_pdu_offset + rdata.length) {
914 if (!data_blob_realloc(NULL, &state->reply_pdu,
915 state->reply_pdu_offset + rdata.length)) {
916 tevent_req_nterror(req, NT_STATUS_NO_MEMORY);
921 memcpy(state->reply_pdu.data + state->reply_pdu_offset,
922 rdata.data, rdata.length);
923 state->reply_pdu_offset += rdata.length;
925 /* reset state->incoming_frag, there is no need to free it,
926 * it will be reallocated to the right size the next time
928 state->incoming_frag.length = 0;
930 if (state->pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
931 /* make sure the pdu length is right now that we
932 * have all the data available (alloc hint may
933 * have allocated more than was actually used) */
934 state->reply_pdu.length = state->reply_pdu_offset;
935 DEBUG(10,("rpc_api_pipe: %s returned %u bytes.\n",
936 rpccli_pipe_txt(talloc_tos(), state->cli),
937 (unsigned)state->reply_pdu.length));
938 tevent_req_done(req);
942 subreq = get_complete_frag_send(state, state->ev, state->cli,
943 &state->incoming_frag);
944 if (tevent_req_nomem(subreq, req)) {
947 tevent_req_set_callback(subreq, rpc_api_pipe_got_pdu, req);
950 static NTSTATUS rpc_api_pipe_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
951 struct ncacn_packet **pkt,
952 DATA_BLOB *reply_pdu)
954 struct rpc_api_pipe_state *state = tevent_req_data(
955 req, struct rpc_api_pipe_state);
958 if (tevent_req_is_nterror(req, &status)) {
962 /* return data to caller and assign it ownership of memory */
964 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
965 reply_pdu->length = state->reply_pdu.length;
966 state->reply_pdu.length = 0;
968 data_blob_free(&state->reply_pdu);
972 *pkt = talloc_steal(mem_ctx, state->pkt);
978 /*******************************************************************
979 Creates spnego auth bind.
980 ********************************************************************/
982 static NTSTATUS create_spnego_auth_bind_req(TALLOC_CTX *mem_ctx,
983 struct pipe_auth_data *auth,
984 DATA_BLOB *auth_token)
986 struct spnego_context *spnego_ctx;
987 DATA_BLOB in_token = data_blob_null;
990 spnego_ctx = talloc_get_type_abort(auth->auth_ctx,
991 struct spnego_context);
993 /* Negotiate the initial auth token */
994 status = spnego_get_client_auth_token(mem_ctx, spnego_ctx,
995 &in_token, auth_token);
996 if (!NT_STATUS_IS_OK(status)) {
1000 DEBUG(5, ("Created GSS Authentication Token:\n"));
1001 dump_data(5, auth_token->data, auth_token->length);
1003 return NT_STATUS_OK;
1006 /*******************************************************************
1007 Creates krb5 auth bind.
1008 ********************************************************************/
1010 static NTSTATUS create_gssapi_auth_bind_req(TALLOC_CTX *mem_ctx,
1011 struct pipe_auth_data *auth,
1012 DATA_BLOB *auth_token)
1014 struct gse_context *gse_ctx;
1015 DATA_BLOB in_token = data_blob_null;
1018 gse_ctx = talloc_get_type_abort(auth->auth_ctx,
1019 struct gse_context);
1021 /* Negotiate the initial auth token */
1022 status = gse_get_client_auth_token(mem_ctx, gse_ctx,
1025 if (!NT_STATUS_IS_OK(status)) {
1029 DEBUG(5, ("Created GSS Authentication Token:\n"));
1030 dump_data(5, auth_token->data, auth_token->length);
1032 return NT_STATUS_OK;
1035 /*******************************************************************
1036 Creates NTLMSSP auth bind.
1037 ********************************************************************/
1039 static NTSTATUS create_ntlmssp_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1040 TALLOC_CTX *mem_ctx,
1041 DATA_BLOB *auth_token)
1043 struct auth_ntlmssp_state *ntlmssp_ctx;
1044 DATA_BLOB null_blob = data_blob_null;
1047 ntlmssp_ctx = talloc_get_type_abort(cli->auth->auth_ctx,
1048 struct auth_ntlmssp_state);
1050 DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: Processing NTLMSSP Negotiate\n"));
1051 status = auth_ntlmssp_update(ntlmssp_ctx, mem_ctx, null_blob, auth_token);
1053 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1054 data_blob_free(auth_token);
1058 DEBUG(5, ("create_ntlmssp_auth_rpc_bind_req: NTLMSSP Negotiate:\n"));
1059 dump_data(5, auth_token->data, auth_token->length);
1061 return NT_STATUS_OK;
1064 /*******************************************************************
1065 Creates schannel auth bind.
1066 ********************************************************************/
1068 static NTSTATUS create_schannel_auth_rpc_bind_req(struct rpc_pipe_client *cli,
1069 DATA_BLOB *auth_token)
1072 struct NL_AUTH_MESSAGE r;
1074 /* Use lp_workgroup() if domain not specified */
1076 if (!cli->auth->domain || !cli->auth->domain[0]) {
1077 cli->auth->domain = talloc_strdup(cli, lp_workgroup());
1078 if (cli->auth->domain == NULL) {
1079 return NT_STATUS_NO_MEMORY;
1084 * Now marshall the data into the auth parse_struct.
1087 r.MessageType = NL_NEGOTIATE_REQUEST;
1088 r.Flags = NL_FLAG_OEM_NETBIOS_DOMAIN_NAME |
1089 NL_FLAG_OEM_NETBIOS_COMPUTER_NAME;
1090 r.oem_netbios_domain.a = cli->auth->domain;
1091 r.oem_netbios_computer.a = lp_netbios_name();
1093 status = dcerpc_push_schannel_bind(cli, &r, auth_token);
1094 if (!NT_STATUS_IS_OK(status)) {
1098 return NT_STATUS_OK;
1101 /*******************************************************************
1102 Creates the internals of a DCE/RPC bind request or alter context PDU.
1103 ********************************************************************/
1105 static NTSTATUS create_bind_or_alt_ctx_internal(TALLOC_CTX *mem_ctx,
1106 enum dcerpc_pkt_type ptype,
1108 const struct ndr_syntax_id *abstract,
1109 const struct ndr_syntax_id *transfer,
1110 const DATA_BLOB *auth_info,
1113 uint16 auth_len = auth_info->length;
1115 union dcerpc_payload u;
1116 struct dcerpc_ctx_list ctx_list;
1119 auth_len -= DCERPC_AUTH_TRAILER_LENGTH;
1122 ctx_list.context_id = 0;
1123 ctx_list.num_transfer_syntaxes = 1;
1124 ctx_list.abstract_syntax = *abstract;
1125 ctx_list.transfer_syntaxes = (struct ndr_syntax_id *)discard_const(transfer);
1127 u.bind.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1128 u.bind.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1129 u.bind.assoc_group_id = 0x0;
1130 u.bind.num_contexts = 1;
1131 u.bind.ctx_list = &ctx_list;
1132 u.bind.auth_info = *auth_info;
1134 status = dcerpc_push_ncacn_packet(mem_ctx,
1136 DCERPC_PFC_FLAG_FIRST |
1137 DCERPC_PFC_FLAG_LAST,
1142 if (!NT_STATUS_IS_OK(status)) {
1143 DEBUG(0, ("Failed to marshall bind/alter ncacn_packet.\n"));
1147 return NT_STATUS_OK;
1150 /*******************************************************************
1151 Creates a DCE/RPC bind request.
1152 ********************************************************************/
1154 static NTSTATUS create_rpc_bind_req(TALLOC_CTX *mem_ctx,
1155 struct rpc_pipe_client *cli,
1156 struct pipe_auth_data *auth,
1158 const struct ndr_syntax_id *abstract,
1159 const struct ndr_syntax_id *transfer,
1162 DATA_BLOB auth_token = data_blob_null;
1163 DATA_BLOB auth_info = data_blob_null;
1164 NTSTATUS ret = NT_STATUS_OK;
1166 switch (auth->auth_type) {
1167 case DCERPC_AUTH_TYPE_SCHANNEL:
1168 ret = create_schannel_auth_rpc_bind_req(cli, &auth_token);
1169 if (!NT_STATUS_IS_OK(ret)) {
1174 case DCERPC_AUTH_TYPE_NTLMSSP:
1175 ret = create_ntlmssp_auth_rpc_bind_req(cli, mem_ctx, &auth_token);
1176 if (!NT_STATUS_IS_OK(ret)) {
1181 case DCERPC_AUTH_TYPE_SPNEGO:
1182 ret = create_spnego_auth_bind_req(cli, auth, &auth_token);
1183 if (!NT_STATUS_IS_OK(ret)) {
1188 case DCERPC_AUTH_TYPE_KRB5:
1189 ret = create_gssapi_auth_bind_req(mem_ctx, auth, &auth_token);
1190 if (!NT_STATUS_IS_OK(ret)) {
1195 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1196 auth_token = data_blob_talloc(mem_ctx,
1197 "NCALRPC_AUTH_TOKEN",
1201 case DCERPC_AUTH_TYPE_NONE:
1205 /* "Can't" happen. */
1206 return NT_STATUS_INVALID_INFO_CLASS;
1209 if (auth_token.length != 0) {
1210 ret = dcerpc_push_dcerpc_auth(cli,
1213 0, /* auth_pad_length */
1214 1, /* auth_context_id */
1217 if (!NT_STATUS_IS_OK(ret)) {
1220 data_blob_free(&auth_token);
1223 ret = create_bind_or_alt_ctx_internal(mem_ctx,
1233 /*******************************************************************
1235 Does an rpc request on a pipe. Incoming data is NDR encoded in in_data.
1236 Reply is NDR encoded in out_data. Splits the data stream into RPC PDU's
1237 and deals with signing/sealing details.
1238 ********************************************************************/
1240 struct rpc_api_pipe_req_state {
1241 struct event_context *ev;
1242 struct rpc_pipe_client *cli;
1245 DATA_BLOB *req_data;
1246 uint32_t req_data_sent;
1248 DATA_BLOB reply_pdu;
1251 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq);
1252 static void rpc_api_pipe_req_done(struct tevent_req *subreq);
1253 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1254 bool *is_last_frag);
1256 struct tevent_req *rpc_api_pipe_req_send(TALLOC_CTX *mem_ctx,
1257 struct event_context *ev,
1258 struct rpc_pipe_client *cli,
1260 DATA_BLOB *req_data)
1262 struct tevent_req *req, *subreq;
1263 struct rpc_api_pipe_req_state *state;
1267 req = tevent_req_create(mem_ctx, &state,
1268 struct rpc_api_pipe_req_state);
1274 state->op_num = op_num;
1275 state->req_data = req_data;
1276 state->req_data_sent = 0;
1277 state->call_id = get_rpc_call_id();
1278 state->reply_pdu = data_blob_null;
1279 state->rpc_out = data_blob_null;
1281 if (cli->max_xmit_frag < DCERPC_REQUEST_LENGTH
1282 + RPC_MAX_SIGN_SIZE) {
1283 /* Server is screwed up ! */
1284 status = NT_STATUS_INVALID_PARAMETER;
1288 status = prepare_next_frag(state, &is_last_frag);
1289 if (!NT_STATUS_IS_OK(status)) {
1294 subreq = rpc_api_pipe_send(state, ev, state->cli,
1296 DCERPC_PKT_RESPONSE);
1297 if (subreq == NULL) {
1300 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1302 subreq = rpc_write_send(state, ev, cli->transport,
1303 state->rpc_out.data,
1304 state->rpc_out.length);
1305 if (subreq == NULL) {
1308 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1314 tevent_req_nterror(req, status);
1315 return tevent_req_post(req, ev);
1321 static NTSTATUS prepare_next_frag(struct rpc_api_pipe_req_state *state,
1324 size_t data_sent_thistime;
1331 union dcerpc_payload u;
1333 data_left = state->req_data->length - state->req_data_sent;
1335 status = dcerpc_guess_sizes(state->cli->auth,
1336 DCERPC_REQUEST_LENGTH, data_left,
1337 state->cli->max_xmit_frag,
1338 CLIENT_NDR_PADDING_SIZE,
1339 &data_sent_thistime,
1340 &frag_len, &auth_len, &pad_len);
1341 if (!NT_STATUS_IS_OK(status)) {
1345 if (state->req_data_sent == 0) {
1346 flags = DCERPC_PFC_FLAG_FIRST;
1349 if (data_sent_thistime == data_left) {
1350 flags |= DCERPC_PFC_FLAG_LAST;
1353 data_blob_free(&state->rpc_out);
1355 ZERO_STRUCT(u.request);
1357 u.request.alloc_hint = state->req_data->length;
1358 u.request.context_id = 0;
1359 u.request.opnum = state->op_num;
1361 status = dcerpc_push_ncacn_packet(state,
1368 if (!NT_STATUS_IS_OK(status)) {
1372 /* explicitly set frag_len here as dcerpc_push_ncacn_packet() can't
1373 * compute it right for requests because the auth trailer is missing
1375 dcerpc_set_frag_length(&state->rpc_out, frag_len);
1377 /* Copy in the data. */
1378 if (!data_blob_append(NULL, &state->rpc_out,
1379 state->req_data->data + state->req_data_sent,
1380 data_sent_thistime)) {
1381 return NT_STATUS_NO_MEMORY;
1384 switch (state->cli->auth->auth_level) {
1385 case DCERPC_AUTH_LEVEL_NONE:
1386 case DCERPC_AUTH_LEVEL_CONNECT:
1387 case DCERPC_AUTH_LEVEL_PACKET:
1389 case DCERPC_AUTH_LEVEL_INTEGRITY:
1390 case DCERPC_AUTH_LEVEL_PRIVACY:
1391 status = dcerpc_add_auth_footer(state->cli->auth, pad_len,
1393 if (!NT_STATUS_IS_OK(status)) {
1398 return NT_STATUS_INVALID_PARAMETER;
1401 state->req_data_sent += data_sent_thistime;
1402 *is_last_frag = ((flags & DCERPC_PFC_FLAG_LAST) != 0);
1407 static void rpc_api_pipe_req_write_done(struct tevent_req *subreq)
1409 struct tevent_req *req = tevent_req_callback_data(
1410 subreq, struct tevent_req);
1411 struct rpc_api_pipe_req_state *state = tevent_req_data(
1412 req, struct rpc_api_pipe_req_state);
1416 status = rpc_write_recv(subreq);
1417 TALLOC_FREE(subreq);
1418 if (!NT_STATUS_IS_OK(status)) {
1419 tevent_req_nterror(req, status);
1423 status = prepare_next_frag(state, &is_last_frag);
1424 if (!NT_STATUS_IS_OK(status)) {
1425 tevent_req_nterror(req, status);
1430 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1432 DCERPC_PKT_RESPONSE);
1433 if (tevent_req_nomem(subreq, req)) {
1436 tevent_req_set_callback(subreq, rpc_api_pipe_req_done, req);
1438 subreq = rpc_write_send(state, state->ev,
1439 state->cli->transport,
1440 state->rpc_out.data,
1441 state->rpc_out.length);
1442 if (tevent_req_nomem(subreq, req)) {
1445 tevent_req_set_callback(subreq, rpc_api_pipe_req_write_done,
1450 static void rpc_api_pipe_req_done(struct tevent_req *subreq)
1452 struct tevent_req *req = tevent_req_callback_data(
1453 subreq, struct tevent_req);
1454 struct rpc_api_pipe_req_state *state = tevent_req_data(
1455 req, struct rpc_api_pipe_req_state);
1458 status = rpc_api_pipe_recv(subreq, state, NULL, &state->reply_pdu);
1459 TALLOC_FREE(subreq);
1460 if (!NT_STATUS_IS_OK(status)) {
1461 tevent_req_nterror(req, status);
1464 tevent_req_done(req);
1467 NTSTATUS rpc_api_pipe_req_recv(struct tevent_req *req, TALLOC_CTX *mem_ctx,
1468 DATA_BLOB *reply_pdu)
1470 struct rpc_api_pipe_req_state *state = tevent_req_data(
1471 req, struct rpc_api_pipe_req_state);
1474 if (tevent_req_is_nterror(req, &status)) {
1476 * We always have to initialize to reply pdu, even if there is
1477 * none. The rpccli_* caller routines expect this.
1479 *reply_pdu = data_blob_null;
1483 /* return data to caller and assign it ownership of memory */
1484 reply_pdu->data = talloc_move(mem_ctx, &state->reply_pdu.data);
1485 reply_pdu->length = state->reply_pdu.length;
1486 state->reply_pdu.length = 0;
1488 return NT_STATUS_OK;
1491 /****************************************************************************
1492 Check the rpc bind acknowledge response.
1493 ****************************************************************************/
1495 static bool check_bind_response(const struct dcerpc_bind_ack *r,
1496 const struct ndr_syntax_id *transfer)
1498 struct dcerpc_ack_ctx ctx;
1500 if (r->secondary_address_size == 0) {
1501 DEBUG(4,("Ignoring length check -- ASU bug (server didn't fill in the pipe name correctly)"));
1504 if (r->num_results < 1 || !r->ctx_list) {
1508 ctx = r->ctx_list[0];
1510 /* check the transfer syntax */
1511 if ((ctx.syntax.if_version != transfer->if_version) ||
1512 (memcmp(&ctx.syntax.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1513 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1517 if (r->num_results != 0x1 || ctx.result != 0) {
1518 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1519 r->num_results, ctx.reason));
1522 DEBUG(5,("check_bind_response: accepted!\n"));
1526 /*******************************************************************
1527 Creates a DCE/RPC bind authentication response.
1528 This is the packet that is sent back to the server once we
1529 have received a BIND-ACK, to finish the third leg of
1530 the authentication handshake.
1531 ********************************************************************/
1533 static NTSTATUS create_rpc_bind_auth3(TALLOC_CTX *mem_ctx,
1534 struct rpc_pipe_client *cli,
1536 enum dcerpc_AuthType auth_type,
1537 enum dcerpc_AuthLevel auth_level,
1538 DATA_BLOB *pauth_blob,
1542 union dcerpc_payload u;
1546 status = dcerpc_push_dcerpc_auth(mem_ctx,
1549 0, /* auth_pad_length */
1550 1, /* auth_context_id */
1552 &u.auth3.auth_info);
1553 if (!NT_STATUS_IS_OK(status)) {
1557 status = dcerpc_push_ncacn_packet(mem_ctx,
1559 DCERPC_PFC_FLAG_FIRST |
1560 DCERPC_PFC_FLAG_LAST,
1565 data_blob_free(&u.auth3.auth_info);
1566 if (!NT_STATUS_IS_OK(status)) {
1567 DEBUG(0,("create_bind_or_alt_ctx_internal: failed to marshall RPC_HDR_RB.\n"));
1571 return NT_STATUS_OK;
1574 /*******************************************************************
1575 Creates a DCE/RPC bind alter context authentication request which
1576 may contain a spnego auth blobl
1577 ********************************************************************/
1579 static NTSTATUS create_rpc_alter_context(TALLOC_CTX *mem_ctx,
1580 enum dcerpc_AuthType auth_type,
1581 enum dcerpc_AuthLevel auth_level,
1583 const struct ndr_syntax_id *abstract,
1584 const struct ndr_syntax_id *transfer,
1585 const DATA_BLOB *pauth_blob, /* spnego auth blob already created. */
1588 DATA_BLOB auth_info;
1591 status = dcerpc_push_dcerpc_auth(mem_ctx,
1594 0, /* auth_pad_length */
1595 1, /* auth_context_id */
1598 if (!NT_STATUS_IS_OK(status)) {
1602 status = create_bind_or_alt_ctx_internal(mem_ctx,
1609 data_blob_free(&auth_info);
1613 /****************************************************************************
1615 ****************************************************************************/
1617 struct rpc_pipe_bind_state {
1618 struct event_context *ev;
1619 struct rpc_pipe_client *cli;
1622 uint32_t rpc_call_id;
1625 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq);
1626 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1627 struct rpc_pipe_bind_state *state,
1628 DATA_BLOB *credentials);
1629 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1630 struct rpc_pipe_bind_state *state,
1631 DATA_BLOB *credentials);
1633 struct tevent_req *rpc_pipe_bind_send(TALLOC_CTX *mem_ctx,
1634 struct event_context *ev,
1635 struct rpc_pipe_client *cli,
1636 struct pipe_auth_data *auth)
1638 struct tevent_req *req, *subreq;
1639 struct rpc_pipe_bind_state *state;
1642 req = tevent_req_create(mem_ctx, &state, struct rpc_pipe_bind_state);
1647 DEBUG(5,("Bind RPC Pipe: %s auth_type %u, auth_level %u\n",
1648 rpccli_pipe_txt(talloc_tos(), cli),
1649 (unsigned int)auth->auth_type,
1650 (unsigned int)auth->auth_level ));
1654 state->rpc_call_id = get_rpc_call_id();
1656 cli->auth = talloc_move(cli, &auth);
1658 /* Marshall the outgoing data. */
1659 status = create_rpc_bind_req(state, cli,
1662 &cli->abstract_syntax,
1663 &cli->transfer_syntax,
1666 if (!NT_STATUS_IS_OK(status)) {
1670 subreq = rpc_api_pipe_send(state, ev, cli, &state->rpc_out,
1671 DCERPC_PKT_BIND_ACK);
1672 if (subreq == NULL) {
1675 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1679 tevent_req_nterror(req, status);
1680 return tevent_req_post(req, ev);
1686 static void rpc_pipe_bind_step_one_done(struct tevent_req *subreq)
1688 struct tevent_req *req = tevent_req_callback_data(
1689 subreq, struct tevent_req);
1690 struct rpc_pipe_bind_state *state = tevent_req_data(
1691 req, struct rpc_pipe_bind_state);
1692 struct pipe_auth_data *pauth = state->cli->auth;
1693 struct auth_ntlmssp_state *ntlmssp_ctx;
1694 struct spnego_context *spnego_ctx;
1695 struct gse_context *gse_ctx;
1696 struct ncacn_packet *pkt = NULL;
1697 struct dcerpc_auth auth;
1698 DATA_BLOB auth_token = data_blob_null;
1701 status = rpc_api_pipe_recv(subreq, talloc_tos(), &pkt, NULL);
1702 TALLOC_FREE(subreq);
1703 if (!NT_STATUS_IS_OK(status)) {
1704 DEBUG(3, ("rpc_pipe_bind: %s bind request returned %s\n",
1705 rpccli_pipe_txt(talloc_tos(), state->cli),
1706 nt_errstr(status)));
1707 tevent_req_nterror(req, status);
1712 tevent_req_done(req);
1716 if (!check_bind_response(&pkt->u.bind_ack, &state->cli->transfer_syntax)) {
1717 DEBUG(2, ("rpc_pipe_bind: check_bind_response failed.\n"));
1718 tevent_req_nterror(req, NT_STATUS_BUFFER_TOO_SMALL);
1722 state->cli->max_xmit_frag = pkt->u.bind_ack.max_xmit_frag;
1723 state->cli->max_recv_frag = pkt->u.bind_ack.max_recv_frag;
1725 switch(pauth->auth_type) {
1727 case DCERPC_AUTH_TYPE_NONE:
1728 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1729 case DCERPC_AUTH_TYPE_SCHANNEL:
1730 /* Bind complete. */
1731 tevent_req_done(req);
1734 case DCERPC_AUTH_TYPE_NTLMSSP:
1735 case DCERPC_AUTH_TYPE_SPNEGO:
1736 case DCERPC_AUTH_TYPE_KRB5:
1737 /* Paranoid lenght checks */
1738 if (pkt->frag_length < DCERPC_AUTH_TRAILER_LENGTH
1739 + pkt->auth_length) {
1740 tevent_req_nterror(req,
1741 NT_STATUS_INFO_LENGTH_MISMATCH);
1744 /* get auth credentials */
1745 status = dcerpc_pull_dcerpc_auth(talloc_tos(),
1746 &pkt->u.bind_ack.auth_info,
1748 if (!NT_STATUS_IS_OK(status)) {
1749 DEBUG(0, ("Failed to pull dcerpc auth: %s.\n",
1750 nt_errstr(status)));
1751 tevent_req_nterror(req, status);
1761 * For authenticated binds we may need to do 3 or 4 leg binds.
1764 switch(pauth->auth_type) {
1766 case DCERPC_AUTH_TYPE_NONE:
1767 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1768 case DCERPC_AUTH_TYPE_SCHANNEL:
1769 /* Bind complete. */
1770 tevent_req_done(req);
1773 case DCERPC_AUTH_TYPE_NTLMSSP:
1774 ntlmssp_ctx = talloc_get_type_abort(pauth->auth_ctx,
1775 struct auth_ntlmssp_state);
1776 status = auth_ntlmssp_update(ntlmssp_ctx, state,
1777 auth.credentials, &auth_token);
1778 if (NT_STATUS_EQUAL(status,
1779 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1780 status = rpc_bind_next_send(req, state,
1782 } else if (NT_STATUS_IS_OK(status)) {
1783 status = rpc_bind_finish_send(req, state,
1788 case DCERPC_AUTH_TYPE_SPNEGO:
1789 spnego_ctx = talloc_get_type_abort(pauth->auth_ctx,
1790 struct spnego_context);
1791 status = spnego_get_client_auth_token(state,
1795 if (!NT_STATUS_IS_OK(status)) {
1798 if (auth_token.length == 0) {
1799 /* Bind complete. */
1800 tevent_req_done(req);
1803 if (spnego_require_more_processing(spnego_ctx)) {
1804 status = rpc_bind_next_send(req, state,
1807 status = rpc_bind_finish_send(req, state,
1812 case DCERPC_AUTH_TYPE_KRB5:
1813 gse_ctx = talloc_get_type_abort(pauth->auth_ctx,
1814 struct gse_context);
1815 status = gse_get_client_auth_token(state,
1819 if (!NT_STATUS_IS_OK(status)) {
1823 if (gse_require_more_processing(gse_ctx)) {
1824 status = rpc_bind_next_send(req, state, &auth_token);
1826 status = rpc_bind_finish_send(req, state, &auth_token);
1834 if (!NT_STATUS_IS_OK(status)) {
1835 tevent_req_nterror(req, status);
1840 DEBUG(0,("cli_finish_bind_auth: unknown auth type %u\n",
1841 (unsigned int)state->cli->auth->auth_type));
1842 tevent_req_nterror(req, NT_STATUS_INTERNAL_ERROR);
1845 static NTSTATUS rpc_bind_next_send(struct tevent_req *req,
1846 struct rpc_pipe_bind_state *state,
1847 DATA_BLOB *auth_token)
1849 struct pipe_auth_data *auth = state->cli->auth;
1850 struct tevent_req *subreq;
1853 /* Now prepare the alter context pdu. */
1854 data_blob_free(&state->rpc_out);
1856 status = create_rpc_alter_context(state,
1860 &state->cli->abstract_syntax,
1861 &state->cli->transfer_syntax,
1864 if (!NT_STATUS_IS_OK(status)) {
1868 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1869 &state->rpc_out, DCERPC_PKT_ALTER_RESP);
1870 if (subreq == NULL) {
1871 return NT_STATUS_NO_MEMORY;
1873 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1874 return NT_STATUS_OK;
1877 static NTSTATUS rpc_bind_finish_send(struct tevent_req *req,
1878 struct rpc_pipe_bind_state *state,
1879 DATA_BLOB *auth_token)
1881 struct pipe_auth_data *auth = state->cli->auth;
1882 struct tevent_req *subreq;
1885 state->auth3 = true;
1887 /* Now prepare the auth3 context pdu. */
1888 data_blob_free(&state->rpc_out);
1890 status = create_rpc_bind_auth3(state, state->cli,
1896 if (!NT_STATUS_IS_OK(status)) {
1900 subreq = rpc_api_pipe_send(state, state->ev, state->cli,
1901 &state->rpc_out, DCERPC_PKT_AUTH3);
1902 if (subreq == NULL) {
1903 return NT_STATUS_NO_MEMORY;
1905 tevent_req_set_callback(subreq, rpc_pipe_bind_step_one_done, req);
1906 return NT_STATUS_OK;
1909 NTSTATUS rpc_pipe_bind_recv(struct tevent_req *req)
1911 return tevent_req_simple_recv_ntstatus(req);
1914 NTSTATUS rpc_pipe_bind(struct rpc_pipe_client *cli,
1915 struct pipe_auth_data *auth)
1917 TALLOC_CTX *frame = talloc_stackframe();
1918 struct event_context *ev;
1919 struct tevent_req *req;
1920 NTSTATUS status = NT_STATUS_OK;
1922 ev = event_context_init(frame);
1924 status = NT_STATUS_NO_MEMORY;
1928 req = rpc_pipe_bind_send(frame, ev, cli, auth);
1930 status = NT_STATUS_NO_MEMORY;
1934 if (!tevent_req_poll(req, ev)) {
1935 status = map_nt_error_from_unix(errno);
1939 status = rpc_pipe_bind_recv(req);
1945 #define RPCCLI_DEFAULT_TIMEOUT 10000 /* 10 seconds. */
1947 unsigned int rpccli_set_timeout(struct rpc_pipe_client *rpc_cli,
1948 unsigned int timeout)
1952 if (rpc_cli->transport == NULL) {
1953 return RPCCLI_DEFAULT_TIMEOUT;
1956 if (rpc_cli->transport->set_timeout == NULL) {
1957 return RPCCLI_DEFAULT_TIMEOUT;
1960 old = rpc_cli->transport->set_timeout(rpc_cli->transport->priv, timeout);
1962 return RPCCLI_DEFAULT_TIMEOUT;
1968 bool rpccli_is_connected(struct rpc_pipe_client *rpc_cli)
1970 if (rpc_cli == NULL) {
1974 if (rpc_cli->transport == NULL) {
1978 return rpc_cli->transport->is_connected(rpc_cli->transport->priv);
1981 struct rpccli_bh_state {
1982 struct rpc_pipe_client *rpc_cli;
1985 static bool rpccli_bh_is_connected(struct dcerpc_binding_handle *h)
1987 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1988 struct rpccli_bh_state);
1990 return rpccli_is_connected(hs->rpc_cli);
1993 static uint32_t rpccli_bh_set_timeout(struct dcerpc_binding_handle *h,
1996 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
1997 struct rpccli_bh_state);
1999 return rpccli_set_timeout(hs->rpc_cli, timeout);
2002 struct rpccli_bh_raw_call_state {
2008 static void rpccli_bh_raw_call_done(struct tevent_req *subreq);
2010 static struct tevent_req *rpccli_bh_raw_call_send(TALLOC_CTX *mem_ctx,
2011 struct tevent_context *ev,
2012 struct dcerpc_binding_handle *h,
2013 const struct GUID *object,
2016 const uint8_t *in_data,
2019 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2020 struct rpccli_bh_state);
2021 struct tevent_req *req;
2022 struct rpccli_bh_raw_call_state *state;
2024 struct tevent_req *subreq;
2026 req = tevent_req_create(mem_ctx, &state,
2027 struct rpccli_bh_raw_call_state);
2031 state->in_data.data = discard_const_p(uint8_t, in_data);
2032 state->in_data.length = in_length;
2034 ok = rpccli_bh_is_connected(h);
2036 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2037 return tevent_req_post(req, ev);
2040 subreq = rpc_api_pipe_req_send(state, ev, hs->rpc_cli,
2041 opnum, &state->in_data);
2042 if (tevent_req_nomem(subreq, req)) {
2043 return tevent_req_post(req, ev);
2045 tevent_req_set_callback(subreq, rpccli_bh_raw_call_done, req);
2050 static void rpccli_bh_raw_call_done(struct tevent_req *subreq)
2052 struct tevent_req *req =
2053 tevent_req_callback_data(subreq,
2055 struct rpccli_bh_raw_call_state *state =
2056 tevent_req_data(req,
2057 struct rpccli_bh_raw_call_state);
2060 state->out_flags = 0;
2062 /* TODO: support bigendian responses */
2064 status = rpc_api_pipe_req_recv(subreq, state, &state->out_data);
2065 TALLOC_FREE(subreq);
2066 if (!NT_STATUS_IS_OK(status)) {
2067 tevent_req_nterror(req, status);
2071 tevent_req_done(req);
2074 static NTSTATUS rpccli_bh_raw_call_recv(struct tevent_req *req,
2075 TALLOC_CTX *mem_ctx,
2078 uint32_t *out_flags)
2080 struct rpccli_bh_raw_call_state *state =
2081 tevent_req_data(req,
2082 struct rpccli_bh_raw_call_state);
2085 if (tevent_req_is_nterror(req, &status)) {
2086 tevent_req_received(req);
2090 *out_data = talloc_move(mem_ctx, &state->out_data.data);
2091 *out_length = state->out_data.length;
2092 *out_flags = state->out_flags;
2093 tevent_req_received(req);
2094 return NT_STATUS_OK;
2097 struct rpccli_bh_disconnect_state {
2101 static struct tevent_req *rpccli_bh_disconnect_send(TALLOC_CTX *mem_ctx,
2102 struct tevent_context *ev,
2103 struct dcerpc_binding_handle *h)
2105 struct rpccli_bh_state *hs = dcerpc_binding_handle_data(h,
2106 struct rpccli_bh_state);
2107 struct tevent_req *req;
2108 struct rpccli_bh_disconnect_state *state;
2111 req = tevent_req_create(mem_ctx, &state,
2112 struct rpccli_bh_disconnect_state);
2117 ok = rpccli_bh_is_connected(h);
2119 tevent_req_nterror(req, NT_STATUS_CONNECTION_DISCONNECTED);
2120 return tevent_req_post(req, ev);
2124 * TODO: do a real async disconnect ...
2126 * For now the caller needs to free rpc_cli
2130 tevent_req_done(req);
2131 return tevent_req_post(req, ev);
2134 static NTSTATUS rpccli_bh_disconnect_recv(struct tevent_req *req)
2138 if (tevent_req_is_nterror(req, &status)) {
2139 tevent_req_received(req);
2143 tevent_req_received(req);
2144 return NT_STATUS_OK;
2147 static bool rpccli_bh_ref_alloc(struct dcerpc_binding_handle *h)
2152 static void rpccli_bh_do_ndr_print(struct dcerpc_binding_handle *h,
2154 const void *_struct_ptr,
2155 const struct ndr_interface_call *call)
2157 void *struct_ptr = discard_const(_struct_ptr);
2159 if (DEBUGLEVEL < 10) {
2163 if (ndr_flags & NDR_IN) {
2164 ndr_print_function_debug(call->ndr_print,
2169 if (ndr_flags & NDR_OUT) {
2170 ndr_print_function_debug(call->ndr_print,
2177 static const struct dcerpc_binding_handle_ops rpccli_bh_ops = {
2179 .is_connected = rpccli_bh_is_connected,
2180 .set_timeout = rpccli_bh_set_timeout,
2181 .raw_call_send = rpccli_bh_raw_call_send,
2182 .raw_call_recv = rpccli_bh_raw_call_recv,
2183 .disconnect_send = rpccli_bh_disconnect_send,
2184 .disconnect_recv = rpccli_bh_disconnect_recv,
2186 .ref_alloc = rpccli_bh_ref_alloc,
2187 .do_ndr_print = rpccli_bh_do_ndr_print,
2190 /* initialise a rpc_pipe_client binding handle */
2191 struct dcerpc_binding_handle *rpccli_bh_create(struct rpc_pipe_client *c)
2193 struct dcerpc_binding_handle *h;
2194 struct rpccli_bh_state *hs;
2196 h = dcerpc_binding_handle_create(c,
2201 struct rpccli_bh_state,
2211 NTSTATUS rpccli_ncalrpc_bind_data(TALLOC_CTX *mem_ctx,
2212 struct pipe_auth_data **presult)
2214 struct pipe_auth_data *result;
2216 result = talloc(mem_ctx, struct pipe_auth_data);
2217 if (result == NULL) {
2218 return NT_STATUS_NO_MEMORY;
2221 result->auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
2222 result->auth_level = DCERPC_AUTH_LEVEL_CONNECT;
2224 result->user_name = talloc_strdup(result, "");
2225 result->domain = talloc_strdup(result, "");
2226 if ((result->user_name == NULL) || (result->domain == NULL)) {
2227 TALLOC_FREE(result);
2228 return NT_STATUS_NO_MEMORY;
2232 return NT_STATUS_OK;
2235 NTSTATUS rpccli_anon_bind_data(TALLOC_CTX *mem_ctx,
2236 struct pipe_auth_data **presult)
2238 struct pipe_auth_data *result;
2240 result = talloc(mem_ctx, struct pipe_auth_data);
2241 if (result == NULL) {
2242 return NT_STATUS_NO_MEMORY;
2245 result->auth_type = DCERPC_AUTH_TYPE_NONE;
2246 result->auth_level = DCERPC_AUTH_LEVEL_NONE;
2248 result->user_name = talloc_strdup(result, "");
2249 result->domain = talloc_strdup(result, "");
2250 if ((result->user_name == NULL) || (result->domain == NULL)) {
2251 TALLOC_FREE(result);
2252 return NT_STATUS_NO_MEMORY;
2256 return NT_STATUS_OK;
2259 static NTSTATUS rpccli_ntlmssp_bind_data(TALLOC_CTX *mem_ctx,
2260 enum dcerpc_AuthType auth_type,
2261 enum dcerpc_AuthLevel auth_level,
2263 const char *username,
2264 const char *password,
2265 struct pipe_auth_data **presult)
2267 struct auth_ntlmssp_state *ntlmssp_ctx;
2268 struct pipe_auth_data *result;
2271 result = talloc(mem_ctx, struct pipe_auth_data);
2272 if (result == NULL) {
2273 return NT_STATUS_NO_MEMORY;
2276 result->auth_type = auth_type;
2277 result->auth_level = auth_level;
2279 result->user_name = talloc_strdup(result, username);
2280 result->domain = talloc_strdup(result, domain);
2281 if ((result->user_name == NULL) || (result->domain == NULL)) {
2282 status = NT_STATUS_NO_MEMORY;
2286 status = auth_ntlmssp_client_start(result,
2289 lp_client_ntlmv2_auth(),
2291 if (!NT_STATUS_IS_OK(status)) {
2295 status = auth_ntlmssp_set_username(ntlmssp_ctx, username);
2296 if (!NT_STATUS_IS_OK(status)) {
2300 status = auth_ntlmssp_set_domain(ntlmssp_ctx, domain);
2301 if (!NT_STATUS_IS_OK(status)) {
2305 status = auth_ntlmssp_set_password(ntlmssp_ctx, password);
2306 if (!NT_STATUS_IS_OK(status)) {
2310 if (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
2311 auth_ntlmssp_want_feature(ntlmssp_ctx, NTLMSSP_FEATURE_SIGN);
2312 } else if (auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
2313 auth_ntlmssp_want_feature(ntlmssp_ctx, NTLMSSP_FEATURE_SEAL);
2316 result->auth_ctx = ntlmssp_ctx;
2318 return NT_STATUS_OK;
2321 TALLOC_FREE(result);
2325 NTSTATUS rpccli_schannel_bind_data(TALLOC_CTX *mem_ctx, const char *domain,
2326 enum dcerpc_AuthLevel auth_level,
2327 struct netlogon_creds_CredentialState *creds,
2328 struct pipe_auth_data **presult)
2330 struct schannel_state *schannel_auth;
2331 struct pipe_auth_data *result;
2333 result = talloc(mem_ctx, struct pipe_auth_data);
2334 if (result == NULL) {
2335 return NT_STATUS_NO_MEMORY;
2338 result->auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
2339 result->auth_level = auth_level;
2341 result->user_name = talloc_strdup(result, "");
2342 result->domain = talloc_strdup(result, domain);
2343 if ((result->user_name == NULL) || (result->domain == NULL)) {
2347 schannel_auth = talloc(result, struct schannel_state);
2348 if (schannel_auth == NULL) {
2352 schannel_auth->state = SCHANNEL_STATE_START;
2353 schannel_auth->seq_num = 0;
2354 schannel_auth->initiator = true;
2355 schannel_auth->creds = netlogon_creds_copy(result, creds);
2357 result->auth_ctx = schannel_auth;
2359 return NT_STATUS_OK;
2362 TALLOC_FREE(result);
2363 return NT_STATUS_NO_MEMORY;
2367 * Create an rpc pipe client struct, connecting to a tcp port.
2369 static NTSTATUS rpc_pipe_open_tcp_port(TALLOC_CTX *mem_ctx, const char *host,
2371 const struct ndr_syntax_id *abstract_syntax,
2372 struct rpc_pipe_client **presult)
2374 struct rpc_pipe_client *result;
2375 struct sockaddr_storage addr;
2379 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2380 if (result == NULL) {
2381 return NT_STATUS_NO_MEMORY;
2384 result->abstract_syntax = *abstract_syntax;
2385 result->transfer_syntax = ndr_transfer_syntax;
2387 result->desthost = talloc_strdup(result, host);
2388 result->srv_name_slash = talloc_asprintf_strupper_m(
2389 result, "\\\\%s", result->desthost);
2390 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2391 status = NT_STATUS_NO_MEMORY;
2395 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2396 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2398 if (!resolve_name(host, &addr, 0, false)) {
2399 status = NT_STATUS_NOT_FOUND;
2403 status = open_socket_out(&addr, port, 60*1000, &fd);
2404 if (!NT_STATUS_IS_OK(status)) {
2407 set_socket_options(fd, lp_socket_options());
2409 status = rpc_transport_sock_init(result, fd, &result->transport);
2410 if (!NT_STATUS_IS_OK(status)) {
2415 result->transport->transport = NCACN_IP_TCP;
2417 result->binding_handle = rpccli_bh_create(result);
2418 if (result->binding_handle == NULL) {
2419 TALLOC_FREE(result);
2420 return NT_STATUS_NO_MEMORY;
2424 return NT_STATUS_OK;
2427 TALLOC_FREE(result);
2432 * Determine the tcp port on which a dcerpc interface is listening
2433 * for the ncacn_ip_tcp transport via the endpoint mapper of the
2436 static NTSTATUS rpc_pipe_get_tcp_port(const char *host,
2437 const struct ndr_syntax_id *abstract_syntax,
2441 struct rpc_pipe_client *epm_pipe = NULL;
2442 struct dcerpc_binding_handle *epm_handle = NULL;
2443 struct pipe_auth_data *auth = NULL;
2444 struct dcerpc_binding *map_binding = NULL;
2445 struct dcerpc_binding *res_binding = NULL;
2446 struct epm_twr_t *map_tower = NULL;
2447 struct epm_twr_t *res_towers = NULL;
2448 struct policy_handle *entry_handle = NULL;
2449 uint32_t num_towers = 0;
2450 uint32_t max_towers = 1;
2451 struct epm_twr_p_t towers;
2452 TALLOC_CTX *tmp_ctx = talloc_stackframe();
2453 uint32_t result = 0;
2455 if (pport == NULL) {
2456 status = NT_STATUS_INVALID_PARAMETER;
2460 if (ndr_syntax_id_equal(abstract_syntax,
2461 &ndr_table_epmapper.syntax_id)) {
2463 return NT_STATUS_OK;
2466 /* open the connection to the endpoint mapper */
2467 status = rpc_pipe_open_tcp_port(tmp_ctx, host, 135,
2468 &ndr_table_epmapper.syntax_id,
2471 if (!NT_STATUS_IS_OK(status)) {
2474 epm_handle = epm_pipe->binding_handle;
2476 status = rpccli_anon_bind_data(tmp_ctx, &auth);
2477 if (!NT_STATUS_IS_OK(status)) {
2481 status = rpc_pipe_bind(epm_pipe, auth);
2482 if (!NT_STATUS_IS_OK(status)) {
2486 /* create tower for asking the epmapper */
2488 map_binding = talloc_zero(tmp_ctx, struct dcerpc_binding);
2489 if (map_binding == NULL) {
2490 status = NT_STATUS_NO_MEMORY;
2494 map_binding->transport = NCACN_IP_TCP;
2495 map_binding->object = *abstract_syntax;
2496 map_binding->host = host; /* needed? */
2497 map_binding->endpoint = "0"; /* correct? needed? */
2499 map_tower = talloc_zero(tmp_ctx, struct epm_twr_t);
2500 if (map_tower == NULL) {
2501 status = NT_STATUS_NO_MEMORY;
2505 status = dcerpc_binding_build_tower(tmp_ctx, map_binding,
2506 &(map_tower->tower));
2507 if (!NT_STATUS_IS_OK(status)) {
2511 /* allocate further parameters for the epm_Map call */
2513 res_towers = talloc_array(tmp_ctx, struct epm_twr_t, max_towers);
2514 if (res_towers == NULL) {
2515 status = NT_STATUS_NO_MEMORY;
2518 towers.twr = res_towers;
2520 entry_handle = talloc_zero(tmp_ctx, struct policy_handle);
2521 if (entry_handle == NULL) {
2522 status = NT_STATUS_NO_MEMORY;
2526 /* ask the endpoint mapper for the port */
2528 status = dcerpc_epm_Map(epm_handle,
2530 discard_const_p(struct GUID,
2531 &(abstract_syntax->uuid)),
2539 if (!NT_STATUS_IS_OK(status)) {
2543 if (result != EPMAPPER_STATUS_OK) {
2544 status = NT_STATUS_UNSUCCESSFUL;
2548 if (num_towers != 1) {
2549 status = NT_STATUS_UNSUCCESSFUL;
2553 /* extract the port from the answer */
2555 status = dcerpc_binding_from_tower(tmp_ctx,
2556 &(towers.twr->tower),
2558 if (!NT_STATUS_IS_OK(status)) {
2562 /* are further checks here necessary? */
2563 if (res_binding->transport != NCACN_IP_TCP) {
2564 status = NT_STATUS_UNSUCCESSFUL;
2568 *pport = (uint16_t)atoi(res_binding->endpoint);
2571 TALLOC_FREE(tmp_ctx);
2576 * Create a rpc pipe client struct, connecting to a host via tcp.
2577 * The port is determined by asking the endpoint mapper on the given
2580 NTSTATUS rpc_pipe_open_tcp(TALLOC_CTX *mem_ctx, const char *host,
2581 const struct ndr_syntax_id *abstract_syntax,
2582 struct rpc_pipe_client **presult)
2587 status = rpc_pipe_get_tcp_port(host, abstract_syntax, &port);
2588 if (!NT_STATUS_IS_OK(status)) {
2592 return rpc_pipe_open_tcp_port(mem_ctx, host, port,
2593 abstract_syntax, presult);
2596 /********************************************************************
2597 Create a rpc pipe client struct, connecting to a unix domain socket
2598 ********************************************************************/
2599 NTSTATUS rpc_pipe_open_ncalrpc(TALLOC_CTX *mem_ctx, const char *socket_path,
2600 const struct ndr_syntax_id *abstract_syntax,
2601 struct rpc_pipe_client **presult)
2603 struct rpc_pipe_client *result;
2604 struct sockaddr_un addr;
2608 result = talloc_zero(mem_ctx, struct rpc_pipe_client);
2609 if (result == NULL) {
2610 return NT_STATUS_NO_MEMORY;
2613 result->abstract_syntax = *abstract_syntax;
2614 result->transfer_syntax = ndr_transfer_syntax;
2616 result->desthost = get_myname(result);
2617 result->srv_name_slash = talloc_asprintf_strupper_m(
2618 result, "\\\\%s", result->desthost);
2619 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2620 status = NT_STATUS_NO_MEMORY;
2624 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2625 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2627 fd = socket(AF_UNIX, SOCK_STREAM, 0);
2629 status = map_nt_error_from_unix(errno);
2634 addr.sun_family = AF_UNIX;
2635 strlcpy(addr.sun_path, socket_path, sizeof(addr.sun_path));
2637 if (sys_connect(fd, (struct sockaddr *)(void *)&addr) == -1) {
2638 DEBUG(0, ("connect(%s) failed: %s\n", socket_path,
2641 return map_nt_error_from_unix(errno);
2644 status = rpc_transport_sock_init(result, fd, &result->transport);
2645 if (!NT_STATUS_IS_OK(status)) {
2650 result->transport->transport = NCALRPC;
2652 result->binding_handle = rpccli_bh_create(result);
2653 if (result->binding_handle == NULL) {
2654 TALLOC_FREE(result);
2655 return NT_STATUS_NO_MEMORY;
2659 return NT_STATUS_OK;
2662 TALLOC_FREE(result);
2666 struct rpc_pipe_client_np_ref {
2667 struct cli_state *cli;
2668 struct rpc_pipe_client *pipe;
2671 static int rpc_pipe_client_np_ref_destructor(struct rpc_pipe_client_np_ref *np_ref)
2673 DLIST_REMOVE(np_ref->cli->pipe_list, np_ref->pipe);
2677 /****************************************************************************
2678 Open a named pipe over SMB to a remote server.
2680 * CAVEAT CALLER OF THIS FUNCTION:
2681 * The returned rpc_pipe_client saves a copy of the cli_state cli pointer,
2682 * so be sure that this function is called AFTER any structure (vs pointer)
2683 * assignment of the cli. In particular, libsmbclient does structure
2684 * assignments of cli, which invalidates the data in the returned
2685 * rpc_pipe_client if this function is called before the structure assignment
2688 ****************************************************************************/
2690 static NTSTATUS rpc_pipe_open_np(struct cli_state *cli,
2691 const struct ndr_syntax_id *abstract_syntax,
2692 struct rpc_pipe_client **presult)
2694 struct rpc_pipe_client *result;
2696 struct rpc_pipe_client_np_ref *np_ref;
2698 /* sanity check to protect against crashes */
2701 return NT_STATUS_INVALID_HANDLE;
2704 result = talloc_zero(NULL, struct rpc_pipe_client);
2705 if (result == NULL) {
2706 return NT_STATUS_NO_MEMORY;
2709 result->abstract_syntax = *abstract_syntax;
2710 result->transfer_syntax = ndr_transfer_syntax;
2711 result->desthost = talloc_strdup(result, cli_state_remote_name(cli));
2712 result->srv_name_slash = talloc_asprintf_strupper_m(
2713 result, "\\\\%s", result->desthost);
2715 result->max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
2716 result->max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
2718 if ((result->desthost == NULL) || (result->srv_name_slash == NULL)) {
2719 TALLOC_FREE(result);
2720 return NT_STATUS_NO_MEMORY;
2723 status = rpc_transport_np_init(result, cli, abstract_syntax,
2724 &result->transport);
2725 if (!NT_STATUS_IS_OK(status)) {
2726 TALLOC_FREE(result);
2730 result->transport->transport = NCACN_NP;
2732 np_ref = talloc(result->transport, struct rpc_pipe_client_np_ref);
2733 if (np_ref == NULL) {
2734 TALLOC_FREE(result);
2735 return NT_STATUS_NO_MEMORY;
2738 np_ref->pipe = result;
2740 DLIST_ADD(np_ref->cli->pipe_list, np_ref->pipe);
2741 talloc_set_destructor(np_ref, rpc_pipe_client_np_ref_destructor);
2743 result->binding_handle = rpccli_bh_create(result);
2744 if (result->binding_handle == NULL) {
2745 TALLOC_FREE(result);
2746 return NT_STATUS_NO_MEMORY;
2750 return NT_STATUS_OK;
2753 /****************************************************************************
2754 Open a pipe to a remote server.
2755 ****************************************************************************/
2757 static NTSTATUS cli_rpc_pipe_open(struct cli_state *cli,
2758 enum dcerpc_transport_t transport,
2759 const struct ndr_syntax_id *interface,
2760 struct rpc_pipe_client **presult)
2762 switch (transport) {
2764 return rpc_pipe_open_tcp(NULL, cli_state_remote_name(cli),
2765 interface, presult);
2767 return rpc_pipe_open_np(cli, interface, presult);
2769 return NT_STATUS_NOT_IMPLEMENTED;
2773 /****************************************************************************
2774 Open a named pipe to an SMB server and bind anonymously.
2775 ****************************************************************************/
2777 NTSTATUS cli_rpc_pipe_open_noauth_transport(struct cli_state *cli,
2778 enum dcerpc_transport_t transport,
2779 const struct ndr_syntax_id *interface,
2780 struct rpc_pipe_client **presult)
2782 struct rpc_pipe_client *result;
2783 struct pipe_auth_data *auth;
2786 status = cli_rpc_pipe_open(cli, transport, interface, &result);
2787 if (!NT_STATUS_IS_OK(status)) {
2791 status = rpccli_anon_bind_data(result, &auth);
2792 if (!NT_STATUS_IS_OK(status)) {
2793 DEBUG(0, ("rpccli_anon_bind_data returned %s\n",
2794 nt_errstr(status)));
2795 TALLOC_FREE(result);
2800 * This is a bit of an abstraction violation due to the fact that an
2801 * anonymous bind on an authenticated SMB inherits the user/domain
2802 * from the enclosing SMB creds
2805 TALLOC_FREE(auth->user_name);
2806 TALLOC_FREE(auth->domain);
2808 auth->user_name = talloc_strdup(auth, cli->user_name);
2809 auth->domain = talloc_strdup(auth, cli->domain);
2810 auth->user_session_key = data_blob_talloc(auth,
2811 cli->user_session_key.data,
2812 cli->user_session_key.length);
2814 if ((auth->user_name == NULL) || (auth->domain == NULL)) {
2815 TALLOC_FREE(result);
2816 return NT_STATUS_NO_MEMORY;
2819 status = rpc_pipe_bind(result, auth);
2820 if (!NT_STATUS_IS_OK(status)) {
2822 if (ndr_syntax_id_equal(interface,
2823 &ndr_table_dssetup.syntax_id)) {
2824 /* non AD domains just don't have this pipe, avoid
2825 * level 0 statement in that case - gd */
2828 DEBUG(lvl, ("cli_rpc_pipe_open_noauth: rpc_pipe_bind for pipe "
2829 "%s failed with error %s\n",
2830 get_pipe_name_from_syntax(talloc_tos(), interface),
2831 nt_errstr(status) ));
2832 TALLOC_FREE(result);
2836 DEBUG(10,("cli_rpc_pipe_open_noauth: opened pipe %s to machine "
2837 "%s and bound anonymously.\n",
2838 get_pipe_name_from_syntax(talloc_tos(), interface),
2842 return NT_STATUS_OK;
2845 /****************************************************************************
2846 ****************************************************************************/
2848 NTSTATUS cli_rpc_pipe_open_noauth(struct cli_state *cli,
2849 const struct ndr_syntax_id *interface,
2850 struct rpc_pipe_client **presult)
2852 return cli_rpc_pipe_open_noauth_transport(cli, NCACN_NP,
2853 interface, presult);
2856 /****************************************************************************
2857 Open a named pipe to an SMB server and bind using NTLMSSP or SPNEGO NTLMSSP
2858 ****************************************************************************/
2860 NTSTATUS cli_rpc_pipe_open_ntlmssp(struct cli_state *cli,
2861 const struct ndr_syntax_id *interface,
2862 enum dcerpc_transport_t transport,
2863 enum dcerpc_AuthLevel auth_level,
2865 const char *username,
2866 const char *password,
2867 struct rpc_pipe_client **presult)
2869 struct rpc_pipe_client *result;
2870 struct pipe_auth_data *auth = NULL;
2871 enum dcerpc_AuthType auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
2874 status = cli_rpc_pipe_open(cli, transport, interface, &result);
2875 if (!NT_STATUS_IS_OK(status)) {
2879 status = rpccli_ntlmssp_bind_data(result,
2880 auth_type, auth_level,
2881 domain, username, password,
2883 if (!NT_STATUS_IS_OK(status)) {
2884 DEBUG(0, ("rpccli_ntlmssp_bind_data returned %s\n",
2885 nt_errstr(status)));
2889 status = rpc_pipe_bind(result, auth);
2890 if (!NT_STATUS_IS_OK(status)) {
2891 DEBUG(0, ("cli_rpc_pipe_open_ntlmssp_internal: cli_rpc_pipe_bind failed with error %s\n",
2892 nt_errstr(status) ));
2896 DEBUG(10,("cli_rpc_pipe_open_ntlmssp_internal: opened pipe %s to "
2897 "machine %s and bound NTLMSSP as user %s\\%s.\n",
2898 get_pipe_name_from_syntax(talloc_tos(), interface),
2899 result->desthost, domain, username));
2902 return NT_STATUS_OK;
2906 TALLOC_FREE(result);
2910 /****************************************************************************
2912 Open a named pipe to an SMB server and bind using schannel (bind type 68)
2913 using session_key. sign and seal.
2915 The *pdc will be stolen onto this new pipe
2916 ****************************************************************************/
2918 NTSTATUS cli_rpc_pipe_open_schannel_with_key(struct cli_state *cli,
2919 const struct ndr_syntax_id *interface,
2920 enum dcerpc_transport_t transport,
2921 enum dcerpc_AuthLevel auth_level,
2923 struct netlogon_creds_CredentialState **pdc,
2924 struct rpc_pipe_client **presult)
2926 struct rpc_pipe_client *result;
2927 struct pipe_auth_data *auth;
2930 status = cli_rpc_pipe_open(cli, transport, interface, &result);
2931 if (!NT_STATUS_IS_OK(status)) {
2935 status = rpccli_schannel_bind_data(result, domain, auth_level,
2937 if (!NT_STATUS_IS_OK(status)) {
2938 DEBUG(0, ("rpccli_schannel_bind_data returned %s\n",
2939 nt_errstr(status)));
2940 TALLOC_FREE(result);
2944 status = rpc_pipe_bind(result, auth);
2945 if (!NT_STATUS_IS_OK(status)) {
2946 DEBUG(0, ("cli_rpc_pipe_open_schannel_with_key: "
2947 "cli_rpc_pipe_bind failed with error %s\n",
2948 nt_errstr(status) ));
2949 TALLOC_FREE(result);
2954 * The credentials on a new netlogon pipe are the ones we are passed
2955 * in - copy them over
2957 result->dc = netlogon_creds_copy(result, *pdc);
2958 if (result->dc == NULL) {
2959 TALLOC_FREE(result);
2960 return NT_STATUS_NO_MEMORY;
2963 DEBUG(10,("cli_rpc_pipe_open_schannel_with_key: opened pipe %s to machine %s "
2964 "for domain %s and bound using schannel.\n",
2965 get_pipe_name_from_syntax(talloc_tos(), interface),
2966 result->desthost, domain));
2969 return NT_STATUS_OK;
2972 /****************************************************************************
2973 Open a named pipe to an SMB server and bind using krb5 (bind type 16).
2974 The idea is this can be called with service_princ, username and password all
2975 NULL so long as the caller has a TGT.
2976 ****************************************************************************/
2978 NTSTATUS cli_rpc_pipe_open_krb5(struct cli_state *cli,
2979 const struct ndr_syntax_id *interface,
2980 enum dcerpc_transport_t transport,
2981 enum dcerpc_AuthLevel auth_level,
2983 const char *username,
2984 const char *password,
2985 struct rpc_pipe_client **presult)
2987 struct rpc_pipe_client *result;
2988 struct pipe_auth_data *auth;
2989 struct gse_context *gse_ctx;
2992 status = cli_rpc_pipe_open(cli, transport, interface, &result);
2993 if (!NT_STATUS_IS_OK(status)) {
2997 auth = talloc(result, struct pipe_auth_data);
2999 status = NT_STATUS_NO_MEMORY;
3002 auth->auth_type = DCERPC_AUTH_TYPE_KRB5;
3003 auth->auth_level = auth_level;
3008 auth->user_name = talloc_strdup(auth, username);
3009 if (!auth->user_name) {
3010 status = NT_STATUS_NO_MEMORY;
3014 /* Fixme, should we fetch/set the Realm ? */
3015 auth->domain = talloc_strdup(auth, "");
3016 if (!auth->domain) {
3017 status = NT_STATUS_NO_MEMORY;
3021 status = gse_init_client(auth,
3022 (auth_level == DCERPC_AUTH_LEVEL_INTEGRITY),
3023 (auth_level == DCERPC_AUTH_LEVEL_PRIVACY),
3024 NULL, server, "cifs", username, password,
3025 GSS_C_DCE_STYLE, &gse_ctx);
3026 if (!NT_STATUS_IS_OK(status)) {
3027 DEBUG(0, ("gse_init_client returned %s\n",
3028 nt_errstr(status)));
3031 auth->auth_ctx = gse_ctx;
3033 status = rpc_pipe_bind(result, auth);
3034 if (!NT_STATUS_IS_OK(status)) {
3035 DEBUG(0, ("cli_rpc_pipe_bind failed with error %s\n",
3036 nt_errstr(status)));
3041 return NT_STATUS_OK;
3044 TALLOC_FREE(result);
3048 NTSTATUS cli_rpc_pipe_open_spnego_krb5(struct cli_state *cli,
3049 const struct ndr_syntax_id *interface,
3050 enum dcerpc_transport_t transport,
3051 enum dcerpc_AuthLevel auth_level,
3053 const char *username,
3054 const char *password,
3055 struct rpc_pipe_client **presult)
3057 struct rpc_pipe_client *result;
3058 struct pipe_auth_data *auth;
3059 struct spnego_context *spnego_ctx;
3062 status = cli_rpc_pipe_open(cli, transport, interface, &result);
3063 if (!NT_STATUS_IS_OK(status)) {
3067 auth = talloc(result, struct pipe_auth_data);
3069 status = NT_STATUS_NO_MEMORY;
3072 auth->auth_type = DCERPC_AUTH_TYPE_SPNEGO;
3073 auth->auth_level = auth_level;
3078 auth->user_name = talloc_strdup(auth, username);
3079 if (!auth->user_name) {
3080 status = NT_STATUS_NO_MEMORY;
3084 /* Fixme, should we fetch/set the Realm ? */
3085 auth->domain = talloc_strdup(auth, "");
3086 if (!auth->domain) {
3087 status = NT_STATUS_NO_MEMORY;
3091 status = spnego_gssapi_init_client(auth,
3092 (auth->auth_level ==
3093 DCERPC_AUTH_LEVEL_INTEGRITY),
3094 (auth->auth_level ==
3095 DCERPC_AUTH_LEVEL_PRIVACY),
3097 NULL, server, "cifs",
3100 if (!NT_STATUS_IS_OK(status)) {
3101 DEBUG(0, ("spnego_init_client returned %s\n",
3102 nt_errstr(status)));
3105 auth->auth_ctx = spnego_ctx;
3107 status = rpc_pipe_bind(result, auth);
3108 if (!NT_STATUS_IS_OK(status)) {
3109 DEBUG(0, ("cli_rpc_pipe_bind failed with error %s\n",
3110 nt_errstr(status)));
3115 return NT_STATUS_OK;
3118 TALLOC_FREE(result);
3122 NTSTATUS cli_rpc_pipe_open_spnego_ntlmssp(struct cli_state *cli,
3123 const struct ndr_syntax_id *interface,
3124 enum dcerpc_transport_t transport,
3125 enum dcerpc_AuthLevel auth_level,
3127 const char *username,
3128 const char *password,
3129 struct rpc_pipe_client **presult)
3131 struct rpc_pipe_client *result;
3132 struct pipe_auth_data *auth;
3133 struct spnego_context *spnego_ctx;
3136 status = cli_rpc_pipe_open(cli, transport, interface, &result);
3137 if (!NT_STATUS_IS_OK(status)) {
3141 auth = talloc(result, struct pipe_auth_data);
3143 status = NT_STATUS_NO_MEMORY;
3146 auth->auth_type = DCERPC_AUTH_TYPE_SPNEGO;
3147 auth->auth_level = auth_level;
3152 auth->user_name = talloc_strdup(auth, username);
3153 if (!auth->user_name) {
3154 status = NT_STATUS_NO_MEMORY;
3161 auth->domain = talloc_strdup(auth, domain);
3162 if (!auth->domain) {
3163 status = NT_STATUS_NO_MEMORY;
3167 status = spnego_ntlmssp_init_client(auth,
3168 (auth->auth_level ==
3169 DCERPC_AUTH_LEVEL_INTEGRITY),
3170 (auth->auth_level ==
3171 DCERPC_AUTH_LEVEL_PRIVACY),
3173 domain, username, password,
3175 if (!NT_STATUS_IS_OK(status)) {
3176 DEBUG(0, ("spnego_init_client returned %s\n",
3177 nt_errstr(status)));
3180 auth->auth_ctx = spnego_ctx;
3182 status = rpc_pipe_bind(result, auth);
3183 if (!NT_STATUS_IS_OK(status)) {
3184 DEBUG(0, ("cli_rpc_pipe_bind failed with error %s\n",
3185 nt_errstr(status)));
3190 return NT_STATUS_OK;
3193 TALLOC_FREE(result);
3197 NTSTATUS cli_get_session_key(TALLOC_CTX *mem_ctx,
3198 struct rpc_pipe_client *cli,
3199 DATA_BLOB *session_key)
3201 struct pipe_auth_data *a;
3202 struct schannel_state *schannel_auth;
3203 struct auth_ntlmssp_state *ntlmssp_ctx;
3204 struct spnego_context *spnego_ctx;
3205 struct gse_context *gse_ctx;
3206 DATA_BLOB sk = data_blob_null;
3207 bool make_dup = false;
3209 if (!session_key || !cli) {
3210 return NT_STATUS_INVALID_PARAMETER;
3216 return NT_STATUS_INVALID_PARAMETER;
3219 switch (cli->auth->auth_type) {
3220 case DCERPC_AUTH_TYPE_SCHANNEL:
3221 schannel_auth = talloc_get_type_abort(a->auth_ctx,
3222 struct schannel_state);
3223 sk = data_blob_const(schannel_auth->creds->session_key, 16);
3226 case DCERPC_AUTH_TYPE_SPNEGO:
3227 spnego_ctx = talloc_get_type_abort(a->auth_ctx,
3228 struct spnego_context);
3229 sk = spnego_get_session_key(mem_ctx, spnego_ctx);
3232 case DCERPC_AUTH_TYPE_NTLMSSP:
3233 ntlmssp_ctx = talloc_get_type_abort(a->auth_ctx,
3234 struct auth_ntlmssp_state);
3235 sk = auth_ntlmssp_get_session_key(ntlmssp_ctx, mem_ctx);
3238 case DCERPC_AUTH_TYPE_KRB5:
3239 gse_ctx = talloc_get_type_abort(a->auth_ctx,
3240 struct gse_context);
3241 sk = gse_get_session_key(mem_ctx, gse_ctx);
3244 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
3245 case DCERPC_AUTH_TYPE_NONE:
3246 sk = data_blob_const(a->user_session_key.data,
3247 a->user_session_key.length);
3255 return NT_STATUS_NO_USER_SESSION_KEY;
3259 *session_key = data_blob_dup_talloc(mem_ctx, sk);
3264 return NT_STATUS_OK;