2 Unix SMB/CIFS implementation.
4 dcerpc utility functions
6 Copyright (C) Andrew Tridgell 2003
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 this ndr_size_* stuff should really be auto-generated ....
29 static size_t ndr_size_epm_floor(struct epm_floor *fl)
32 if (fl->lhs.protocol == EPM_PROTOCOL_UUID) {
35 ret += fl->lhs.info.lhs_data.length;
37 ret += fl->rhs.rhs_data.length;
41 size_t ndr_size_epm_towers(struct epm_towers *towers)
45 for (i=0;i<towers->num_floors;i++) {
46 ret += ndr_size_epm_floor(&towers->floors[i]);
52 work out what TCP port to use for a given interface on a given host
54 NTSTATUS dcerpc_epm_map_tcp_port(const char *server,
55 const char *uuid, uint_t version,
58 struct dcerpc_pipe *p;
61 struct policy_handle handle;
63 struct epm_twr_t twr, *twr_r;
65 if (strcasecmp(uuid, DCERPC_EPMAPPER_UUID) == 0 ||
66 strcasecmp(uuid, DCERPC_MGMT_UUID) == 0) {
67 /* don't lookup epmapper via epmapper! */
68 *port = EPMAPPER_PORT;
72 status = dcerpc_pipe_open_tcp(&p, server, EPMAPPER_PORT, AF_UNSPEC );
73 if (!NT_STATUS_IS_OK(status)) {
77 /* we can use the pipes memory context here as we will have a short
79 status = dcerpc_bind_byuuid(p, p,
81 DCERPC_EPMAPPER_VERSION);
82 if (!NT_STATUS_IS_OK(status)) {
90 twr.towers.num_floors = 5;
91 twr.towers.floors = talloc(p, sizeof(twr.towers.floors[0]) * 5);
93 /* what I'd like for christmas ... */
95 /* an RPC interface ... */
96 twr.towers.floors[0].lhs.protocol = EPM_PROTOCOL_UUID;
97 GUID_from_string(uuid, &twr.towers.floors[0].lhs.info.uuid.uuid);
98 twr.towers.floors[0].lhs.info.uuid.version = version;
99 twr.towers.floors[0].rhs.rhs_data = data_blob_talloc_zero(p, 2);
101 /* encoded with NDR ... */
102 twr.towers.floors[1].lhs.protocol = EPM_PROTOCOL_UUID;
103 GUID_from_string(NDR_GUID, &twr.towers.floors[1].lhs.info.uuid.uuid);
104 twr.towers.floors[1].lhs.info.uuid.version = NDR_GUID_VERSION;
105 twr.towers.floors[1].rhs.rhs_data = data_blob_talloc_zero(p, 2);
107 /* on an RPC connection ... */
108 twr.towers.floors[2].lhs.protocol = EPM_PROTOCOL_NCACN_RPC_C;
109 twr.towers.floors[2].lhs.info.lhs_data = data_blob(NULL, 0);
110 twr.towers.floors[2].rhs.rhs_data = data_blob_talloc_zero(p, 2);
112 /* on a TCP port ... */
113 twr.towers.floors[3].lhs.protocol = EPM_PROTOCOL_NCACN_TCP;
114 twr.towers.floors[3].lhs.info.lhs_data = data_blob(NULL, 0);
115 twr.towers.floors[3].rhs.rhs_data = data_blob_talloc_zero(p, 2);
117 /* on an IP link ... */
118 twr.towers.floors[4].lhs.protocol = EPM_PROTOCOL_NCACN_IP;
119 twr.towers.floors[4].lhs.info.lhs_data = data_blob(NULL, 0);
120 twr.towers.floors[4].rhs.rhs_data = data_blob_talloc_zero(p, 4);
122 /* with some nice pretty paper around it of course */
124 r.in.map_tower = &twr;
125 r.in.entry_handle = &handle;
127 r.out.entry_handle = &handle;
129 status = dcerpc_epm_Map(p, p, &r);
130 if (!NT_STATUS_IS_OK(status)) {
131 dcerpc_pipe_close(p);
134 if (r.out.result != 0 || r.out.num_towers != 1) {
135 dcerpc_pipe_close(p);
136 return NT_STATUS_PORT_UNREACHABLE;
139 twr_r = r.out.towers[0].twr;
141 dcerpc_pipe_close(p);
142 return NT_STATUS_PORT_UNREACHABLE;
145 if (twr_r->towers.num_floors != 5 ||
146 twr_r->towers.floors[3].lhs.protocol != twr.towers.floors[3].lhs.protocol ||
147 twr_r->towers.floors[3].rhs.rhs_data.length != 2) {
148 dcerpc_pipe_close(p);
149 return NT_STATUS_PORT_UNREACHABLE;
152 *port = RSVAL(twr_r->towers.floors[3].rhs.rhs_data.data, 0);
154 dcerpc_pipe_close(p);
161 find the pipe name for a local IDL interface
163 const char *idl_pipe_name(const char *uuid, uint32_t if_version)
166 for (i=0;dcerpc_pipes[i];i++) {
167 if (strcasecmp(dcerpc_pipes[i]->uuid, uuid) == 0 &&
168 dcerpc_pipes[i]->if_version == if_version) {
169 return dcerpc_pipes[i]->name;
176 find the number of calls defined by local IDL
178 int idl_num_calls(const char *uuid, uint32_t if_version)
181 for (i=0;dcerpc_pipes[i];i++) {
182 if (strcasecmp(dcerpc_pipes[i]->uuid, uuid) == 0 &&
183 dcerpc_pipes[i]->if_version == if_version) {
184 return dcerpc_pipes[i]->num_calls;
192 find a dcerpc interface by name
194 const struct dcerpc_interface_table *idl_iface_by_name(const char *name)
197 for (i=0;dcerpc_pipes[i];i++) {
198 if (strcasecmp(dcerpc_pipes[i]->name, name) == 0) {
199 return dcerpc_pipes[i];
206 find a dcerpc interface by uuid
208 const struct dcerpc_interface_table *idl_iface_by_uuid(const char *uuid)
211 for (i=0;dcerpc_pipes[i];i++) {
212 if (strcasecmp(dcerpc_pipes[i]->uuid, uuid) == 0) {
213 return dcerpc_pipes[i];
222 push a dcerpc_packet into a blob, potentially with auth info
224 NTSTATUS dcerpc_push_auth(DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
225 struct dcerpc_packet *pkt,
226 struct dcerpc_auth *auth_info)
229 struct ndr_push *ndr;
231 ndr = ndr_push_init_ctx(mem_ctx);
233 return NT_STATUS_NO_MEMORY;
236 if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
237 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
241 pkt->auth_length = auth_info->credentials.length;
243 pkt->auth_length = 0;
246 status = ndr_push_dcerpc_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
247 if (!NT_STATUS_IS_OK(status)) {
252 status = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, auth_info);
255 *blob = ndr_push_blob(ndr);
257 /* fill in the frag length */
258 dcerpc_set_frag_length(blob, blob->length);
264 static const struct {
266 enum dcerpc_transport_t transport;
267 } ncacn_transports[] = {
268 {"ncacn_np", NCACN_NP},
269 {"ncacn_ip_tcp", NCACN_IP_TCP}
272 static const struct {
275 } ncacn_options[] = {
276 {"sign", DCERPC_SIGN},
277 {"seal", DCERPC_SEAL},
278 {"connect", DCERPC_CONNECT},
279 {"validate", DCERPC_DEBUG_VALIDATE_BOTH},
280 {"print", DCERPC_DEBUG_PRINT_BOTH},
281 {"padcheck", DCERPC_DEBUG_PAD_CHECK},
282 {"bigendian", DCERPC_PUSH_BIGENDIAN}
286 form a binding string from a binding structure
288 const char *dcerpc_binding_string(TALLOC_CTX *mem_ctx, const struct dcerpc_binding *b)
292 const char *t_name=NULL;
294 for (i=0;i<ARRAY_SIZE(ncacn_transports);i++) {
295 if (ncacn_transports[i].transport == b->transport) {
296 t_name = ncacn_transports[i].name;
303 s = talloc_asprintf(mem_ctx, "%s:%s:[", t_name, b->host);
306 /* this is a *really* inefficent way of dealing with strings,
307 but this is rarely called and the strings are always short,
309 for (i=0;b->options && b->options[i];i++) {
310 s = talloc_asprintf(mem_ctx, "%s%s,", s, b->options[i]);
313 for (i=0;i<ARRAY_SIZE(ncacn_options);i++) {
314 if (b->flags & ncacn_options[i].flag) {
315 s = talloc_asprintf(mem_ctx, "%s%s,", s, ncacn_options[i].name);
319 if (s[strlen(s)-1] == ',') {
322 s = talloc_asprintf(mem_ctx, "%s]", s);
328 parse a binding string into a dcerpc_binding structure
330 NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struct dcerpc_binding *b)
332 char *part1, *part2, *part3;
334 int i, j, comma_count;
338 return NT_STATUS_INVALID_PARAMETER;
340 part1 = talloc_strndup(mem_ctx, s, PTR_DIFF(p, s));
342 return NT_STATUS_NO_MEMORY;
350 part2 = talloc_strndup(mem_ctx, s, PTR_DIFF(p, s));
351 part3 = talloc_strdup(mem_ctx, p+1);
352 if (part3[strlen(part3)-1] != ']') {
353 return NT_STATUS_INVALID_PARAMETER;
355 part3[strlen(part3)-1] = 0;
357 part2 = talloc_strdup(mem_ctx, s);
361 part2 = talloc_strndup(mem_ctx, s, PTR_DIFF(p, s));
362 part3 = talloc_strdup(mem_ctx, p+1);
365 return NT_STATUS_NO_MEMORY;
368 for (i=0;i<ARRAY_SIZE(ncacn_transports);i++) {
369 if (strcasecmp(part1, ncacn_transports[i].name) == 0) {
370 b->transport = ncacn_transports[i].transport;
374 if (i==ARRAY_SIZE(ncacn_transports)) {
375 DEBUG(0,("Unknown dcerpc transport '%s'\n", part1));
376 return NT_STATUS_INVALID_PARAMETER;
387 /* the [] brackets are optional */
388 if (*part3 == '[' && part3[strlen(part3)-1] == ']') {
390 part3[strlen(part3)-1] = 0;
393 comma_count = count_chars(part3, ',');
394 b->options = talloc_array_p(mem_ctx, const char *, comma_count+2);
396 return NT_STATUS_NO_MEMORY;
399 for (i=0; (p = strchr(part3, ',')); i++) {
400 b->options[i] = talloc_strndup(mem_ctx, part3, PTR_DIFF(p, part3));
401 if (!b->options[i]) {
402 return NT_STATUS_NO_MEMORY;
406 b->options[i] = part3;
407 b->options[i+1] = NULL;
409 /* some options are pre-parsed for convenience */
410 for (i=0;b->options[i];i++) {
411 for (j=0;j<ARRAY_SIZE(ncacn_options);j++) {
412 if (strcasecmp(ncacn_options[j].name, b->options[i]) == 0) {
414 b->flags |= ncacn_options[j].flag;
415 for (k=i;b->options[k];k++) {
416 b->options[k] = b->options[k+1];
428 /* open a rpc connection to a rpc pipe on SMB using the binding
429 structure to determine the endpoint and options */
430 static NTSTATUS dcerpc_pipe_connect_ncacn_np(struct dcerpc_pipe **p,
431 struct dcerpc_binding *binding,
432 const char *pipe_uuid,
433 uint32_t pipe_version,
435 const char *username,
436 const char *password)
440 struct smbcli_state *cli;
441 const char *pipe_name;
443 if (!binding->options || !binding->options[0]) {
444 const struct dcerpc_interface_table *table = idl_iface_by_uuid(pipe_uuid);
446 DEBUG(0,("Unknown interface endpoint '%s'\n", pipe_uuid));
447 return NT_STATUS_INVALID_PARAMETER;
449 /* only try the first endpoint for now */
450 pipe_name = table->endpoints->names[0];
452 pipe_name = binding->options[0];
455 if (strncasecmp(pipe_name, "\\pipe\\", 6) == 0) {
458 if (strncasecmp(pipe_name, "/pipe/", 6) == 0) {
462 if (!username || !username[0]) {
463 status = smbcli_full_connection(NULL, &cli, lp_netbios_name(),
466 "", "", NULL, 0, &retry);
468 status = smbcli_full_connection(NULL, &cli, lp_netbios_name(),
472 password, 0, &retry);
474 if (!NT_STATUS_IS_OK(status)) {
475 DEBUG(0,("Failed to connect to %s - %s\n", binding->host, nt_errstr(status)));
479 status = dcerpc_pipe_open_smb(p, cli->tree, pipe_name);
480 if (!NT_STATUS_IS_OK(status)) {
481 DEBUG(0,("Failed to open pipe %s - %s\n", pipe_name, nt_errstr(status)));
483 smbcli_shutdown(cli);
487 /* this ensures that the reference count is decremented so
488 a pipe close will really close the link */
489 talloc_steal(*p, cli);
491 (*p)->flags = binding->flags;
493 /* remember the binding string for possible secondary connections */
494 (*p)->binding_string = dcerpc_binding_string((*p), binding);
496 if (username && username[0] && (binding->flags & DCERPC_SCHANNEL_ANY)) {
497 status = dcerpc_bind_auth_schannel(*p, pipe_uuid, pipe_version,
498 domain, username, password);
499 } else if (username && username[0] &&
500 (binding->flags & (DCERPC_CONNECT|DCERPC_SIGN|DCERPC_SEAL))) {
501 status = dcerpc_bind_auth_ntlm(*p, pipe_uuid, pipe_version, domain, username, password);
503 status = dcerpc_bind_auth_none(*p, pipe_uuid, pipe_version);
507 if (!NT_STATUS_IS_OK(status)) {
508 DEBUG(0,("Failed to bind to uuid %s - %s\n", pipe_uuid, nt_errstr(status)));
509 dcerpc_pipe_close(*p);
518 /* open a rpc connection to a rpc pipe on SMP using the binding
519 structure to determine the endpoint and options */
520 static NTSTATUS dcerpc_pipe_connect_ncacn_ip_tcp(struct dcerpc_pipe **p,
521 struct dcerpc_binding *binding,
522 const char *pipe_uuid,
523 uint32_t pipe_version,
525 const char *username,
526 const char *password)
531 if (binding->options && binding->options[0]) {
532 port = atoi(binding->options[0]);
536 status = dcerpc_epm_map_tcp_port(binding->host,
537 pipe_uuid, pipe_version,
539 if (!NT_STATUS_IS_OK(status)) {
540 DEBUG(0,("Failed to map DCERPC/TCP port for '%s' - %s\n",
541 pipe_uuid, nt_errstr(status)));
544 DEBUG(1,("Mapped to DCERPC/TCP port %u\n", port));
547 status = dcerpc_pipe_open_tcp(p, binding->host, port, AF_UNSPEC);
548 if (!NT_STATUS_IS_OK(status)) {
549 DEBUG(0,("Failed to connect to %s:%d\n", binding->host, port));
553 (*p)->flags = binding->flags;
555 /* remember the binding string for possible secondary connections */
556 (*p)->binding_string = dcerpc_binding_string((*p), binding);
558 if (username && username[0] && (binding->flags & DCERPC_SCHANNEL_ANY)) {
559 status = dcerpc_bind_auth_schannel(*p, pipe_uuid, pipe_version,
560 domain, username, password);
561 } else if (username && username[0]) {
562 status = dcerpc_bind_auth_ntlm(*p, pipe_uuid, pipe_version, domain, username, password);
564 status = dcerpc_bind_auth_none(*p, pipe_uuid, pipe_version);
567 if (!NT_STATUS_IS_OK(status)) {
568 DEBUG(0,("Failed to bind to uuid %s - %s\n",
569 pipe_uuid, nt_errstr(status)));
570 dcerpc_pipe_close(*p);
579 /* open a rpc connection to a rpc pipe, using the specified
580 binding structure to determine the endpoint and options */
581 NTSTATUS dcerpc_pipe_connect_b(struct dcerpc_pipe **p,
582 struct dcerpc_binding *binding,
583 const char *pipe_uuid,
584 uint32_t pipe_version,
586 const char *username,
587 const char *password)
589 NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
591 switch (binding->transport) {
593 status = dcerpc_pipe_connect_ncacn_np(p, binding, pipe_uuid, pipe_version,
594 domain, username, password);
597 status = dcerpc_pipe_connect_ncacn_ip_tcp(p, binding, pipe_uuid, pipe_version,
598 domain, username, password);
606 /* open a rpc connection to a rpc pipe, using the specified string
607 binding to determine the endpoint and options */
608 NTSTATUS dcerpc_pipe_connect(struct dcerpc_pipe **p,
610 const char *pipe_uuid,
611 uint32_t pipe_version,
613 const char *username,
614 const char *password)
616 struct dcerpc_binding b;
620 mem_ctx = talloc_init("dcerpc_pipe_connect");
621 if (!mem_ctx) return NT_STATUS_NO_MEMORY;
623 status = dcerpc_parse_binding(mem_ctx, binding, &b);
624 if (!NT_STATUS_IS_OK(status)) {
625 DEBUG(0,("Failed to parse dcerpc binding '%s'\n", binding));
626 talloc_destroy(mem_ctx);
630 DEBUG(3,("Using binding %s\n", dcerpc_binding_string(mem_ctx, &b)));
632 status = dcerpc_pipe_connect_b(p, &b, pipe_uuid, pipe_version, domain, username, password);
634 talloc_destroy(mem_ctx);
640 create a secondary dcerpc connection from a primary connection
642 if the primary is a SMB connection then the secondary connection
643 will be on the same SMB connection, but use a new fnum
645 NTSTATUS dcerpc_secondary_connection(struct dcerpc_pipe *p, struct dcerpc_pipe **p2,
646 const char *pipe_name,
647 const char *pipe_uuid,
648 uint32_t pipe_version)
650 struct smbcli_tree *tree;
651 NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
652 struct dcerpc_binding b;
654 switch (p->transport.transport) {
656 tree = dcerpc_smb_tree(p);
658 return NT_STATUS_INVALID_PARAMETER;
661 status = dcerpc_pipe_open_smb(p2, tree, pipe_name);
665 status = dcerpc_parse_binding(p, p->binding_string, &b);
666 if (!NT_STATUS_IS_OK(status)) {
669 b.flags &= ~DCERPC_AUTH_OPTIONS;
670 status = dcerpc_pipe_connect_ncacn_ip_tcp(p2, &b, pipe_uuid,
676 if (!NT_STATUS_IS_OK(status)) {
680 (*p2)->flags = p->flags;
682 status = dcerpc_bind_auth_none(*p2, pipe_uuid, pipe_version);
683 if (!NT_STATUS_IS_OK(status)) {
690 NTSTATUS dcerpc_generic_session_key(struct dcerpc_pipe *p,
691 DATA_BLOB *session_key)
693 /* this took quite a few CPU cycles to find ... */
694 session_key->data = discard_const_p(char, "SystemLibraryDTC");
695 session_key->length = 16;
700 fetch the user session key - may be default (above) or the SMB session key
702 NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p,
703 DATA_BLOB *session_key)
705 return p->security_state.session_key(p, session_key);
710 log a rpc packet in a format suitable for ndrdump. This is especially useful
711 for sealed packets, where ethereal cannot easily see the contents
713 this triggers on a debug level of >= 10
715 void dcerpc_log_packet(const struct dcerpc_interface_table *ndr,
716 uint32_t opnum, uint32_t flags, DATA_BLOB *pkt)
718 const int num_examples = 20;
721 if (DEBUGLEVEL < 10) return;
723 for (i=0;i<num_examples;i++) {
725 asprintf(&name, "%s/rpclog/%s-%u.%d.%s",
726 lp_lockdir(), ndr->name, opnum, i,
727 (flags&NDR_IN)?"in":"out");
731 if (!file_exist(name, NULL)) {
732 if (file_save(name, pkt->data, pkt->length)) {
733 DEBUG(10,("Logged rpc packet to %s\n", name));