Copyright (C) Andrew Tridgell 2003
Copyright (C) Jelmer Vernooij 2004
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
+ Copyright (C) Rafal Szczesniak 2006
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
-#include "system/network.h"
-#include "librpc/gen_ndr/ndr_epmapper.h"
+#include "lib/events/events.h"
+#include "libcli/composite/composite.h"
+#include "librpc/gen_ndr/ndr_epmapper_c.h"
#include "librpc/gen_ndr/ndr_dcerpc.h"
#include "librpc/gen_ndr/ndr_misc.h"
-#include "libcli/raw/libcliraw.h"
-#include "libcli/composite/composite.h"
-#include "libcli/smb_composite/smb_composite.h"
-
-/*
- find the pipe name for a local IDL interface
-*/
-const char *idl_pipe_name(const char *uuid, uint32_t if_version)
-{
- const struct dcerpc_interface_list *l;
- for (l=librpc_dcerpc_pipes();l;l=l->next) {
- if (strcasecmp(l->table->uuid, uuid) == 0 &&
- l->table->if_version == if_version) {
- return l->table->name;
- }
- }
- return "UNKNOWN";
-}
-
-/*
- find the number of calls defined by local IDL
-*/
-int idl_num_calls(const char *uuid, uint32_t if_version)
-{
- const struct dcerpc_interface_list *l;
- for (l=librpc_dcerpc_pipes();l;l=l->next){
- if (strcasecmp(l->table->uuid, uuid) == 0 &&
- l->table->if_version == if_version) {
- return l->table->num_calls;
- }
- }
- return -1;
-}
-
-
-/*
- find a dcerpc interface by name
-*/
-const struct dcerpc_interface_table *idl_iface_by_name(const char *name)
-{
- const struct dcerpc_interface_list *l;
- for (l=librpc_dcerpc_pipes();l;l=l->next) {
- if (strcasecmp(l->table->name, name) == 0) {
- return l->table;
- }
- }
- return NULL;
-}
-
-/*
- find a dcerpc interface by uuid
-*/
-const struct dcerpc_interface_table *idl_iface_by_uuid(const char *uuid)
-{
- const struct dcerpc_interface_list *l;
- for (l=librpc_dcerpc_pipes();l;l=l->next) {
- if (strcasecmp(l->table->uuid, uuid) == 0) {
- return l->table;
- }
- }
- return NULL;
-}
+#include "auth/credentials/credentials.h"
/*
find a dcerpc call on an interface by name
ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
}
- if (pkt->pfc_flags & DCERPC_PFC_FLAG_ORPC) {
+ if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
}
{"seal", DCERPC_SEAL},
{"connect", DCERPC_CONNECT},
{"spnego", DCERPC_AUTH_SPNEGO},
+ {"ntlm", DCERPC_AUTH_NTLM},
{"krb5", DCERPC_AUTH_KRB5},
{"validate", DCERPC_DEBUG_VALIDATE_BOTH},
{"print", DCERPC_DEBUG_PRINT_BOTH},
const char *epm_floor_string(TALLOC_CTX *mem_ctx, struct epm_floor *epm_floor)
{
- struct GUID uuid;
- uint16_t if_version;
+ struct dcerpc_syntax_id syntax;
NTSTATUS status;
switch(epm_floor->lhs.protocol) {
case EPM_PROTOCOL_UUID:
- status = dcerpc_floor_get_lhs_data(epm_floor, &uuid, &if_version);
+ status = dcerpc_floor_get_lhs_data(epm_floor, &syntax);
if (NT_STATUS_IS_OK(status)) {
/* lhs is used: UUID */
char *uuidstr;
- uuidstr = GUID_string(mem_ctx, &uuid);
-
- if (strcasecmp(uuidstr, NDR_GUID) == 0) {
+ if (GUID_equal(&syntax.uuid, &ndr_transfer_syntax.uuid)) {
return "NDR";
}
- return talloc_asprintf(mem_ctx, " uuid %s/0x%02x", uuidstr, if_version);
+ if (GUID_equal(&syntax.uuid, &ndr64_transfer_syntax.uuid)) {
+ return "NDR64";
+ }
+
+ uuidstr = GUID_string(mem_ctx, &syntax.uuid);
+
+ return talloc_asprintf(mem_ctx, " uuid %s/0x%02x", uuidstr, syntax.if_version);
} else { /* IPX */
return talloc_asprintf(mem_ctx, "IPX:%s",
data_blob_hex_string(mem_ctx, &epm_floor->rhs.uuid.unknown));
/*
form a binding string from a binding structure
*/
-const char *dcerpc_binding_string(TALLOC_CTX *mem_ctx, const struct dcerpc_binding *b)
+char *dcerpc_binding_string(TALLOC_CTX *mem_ctx, const struct dcerpc_binding *b)
{
char *s = talloc_strdup(mem_ctx, "");
int i;
return NULL;
}
- if (!GUID_all_zero(&b->object)) {
+ if (!GUID_all_zero(&b->object.uuid)) {
s = talloc_asprintf(s, "%s@",
- GUID_string(mem_ctx, &b->object));
+ GUID_string(mem_ctx, &b->object.uuid));
}
s = talloc_asprintf_append(s, "%s:", t_name);
return NT_STATUS_NO_MEMORY;
}
- b->authservice = NULL;
-
p = strchr(s, '@');
if (p && PTR_DIFF(p, s) == 36) { /* 36 is the length of a UUID */
NTSTATUS status;
- status = GUID_from_string(s, &b->object);
+ status = GUID_from_string(s, &b->object.uuid);
if (NT_STATUS_IS_ERR(status)) {
DEBUG(0, ("Failed parsing UUID\n"));
ZERO_STRUCT(b->object);
}
- b->object_version = 0;
+ b->object.if_version = 0;
p = strchr(s, ':');
if (!p) {
b->host = talloc_strdup(b, s);
options = NULL;
}
-
if (!b->host) {
return NT_STATUS_NO_MEMORY;
}
+ b->target_hostname = b->host;
+
b->options = NULL;
b->flags = 0;
+ b->assoc_group_id = 0;
b->endpoint = NULL;
if (!options) {
return NT_STATUS_OK;
}
-NTSTATUS dcerpc_floor_get_lhs_data(struct epm_floor *epm_floor, struct GUID *uuid, uint16_t *if_version)
+NTSTATUS dcerpc_floor_get_lhs_data(struct epm_floor *epm_floor, struct dcerpc_syntax_id *syntax)
{
TALLOC_CTX *mem_ctx = talloc_init("floor_get_lhs_data");
struct ndr_pull *ndr = ndr_pull_init_blob(&epm_floor->lhs.lhs_data, mem_ctx);
NTSTATUS status;
-
+ uint16_t if_version=0;
+
ndr->flags |= LIBNDR_FLAG_NOALIGN;
- status = ndr_pull_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, uuid);
+ status = ndr_pull_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, &syntax->uuid);
if (NT_STATUS_IS_ERR(status)) {
talloc_free(mem_ctx);
return status;
}
- status = ndr_pull_uint16(ndr, NDR_SCALARS, if_version);
+ status = ndr_pull_uint16(ndr, NDR_SCALARS, &if_version);
+ syntax->if_version = if_version;
talloc_free(mem_ctx);
return status;
}
-static DATA_BLOB dcerpc_floor_pack_lhs_data(TALLOC_CTX *mem_ctx, struct GUID *uuid, uint32_t if_version)
+static DATA_BLOB dcerpc_floor_pack_lhs_data(TALLOC_CTX *mem_ctx, const struct dcerpc_syntax_id *syntax)
{
struct ndr_push *ndr = ndr_push_init_ctx(mem_ctx);
ndr->flags |= LIBNDR_FLAG_NOALIGN;
- ndr_push_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, uuid);
- ndr_push_uint16(ndr, NDR_SCALARS, if_version);
+ ndr_push_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, &syntax->uuid);
+ ndr_push_uint16(ndr, NDR_SCALARS, syntax->if_version);
return ndr_push_blob(ndr);
}
}
/* Unknown transport */
- return -1;
+ return (unsigned int)-1;
}
enum dcerpc_transport_t dcerpc_transport_by_tower(struct epm_tower *tower)
}
/* Unknown transport */
- return -1;
+ return (unsigned int)-1;
}
NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx, struct epm_tower *tower, struct dcerpc_binding **b_out)
ZERO_STRUCT(binding->object);
binding->options = NULL;
binding->host = NULL;
+ binding->target_hostname = NULL;
binding->flags = 0;
+ binding->assoc_group_id = 0;
binding->transport = dcerpc_transport_by_tower(tower);
- if (binding->transport == -1) {
+ if (binding->transport == (unsigned int)-1) {
return NT_STATUS_NOT_SUPPORTED;
}
}
/* Set object uuid */
- status = dcerpc_floor_get_lhs_data(&tower->floors[0], &binding->object, &binding->object_version);
+ status = dcerpc_floor_get_lhs_data(&tower->floors[0], &binding->object);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Error pulling object uuid and version: %s", nt_errstr(status)));
/* Set network address */
if (tower->num_floors >= 5) {
binding->host = dcerpc_floor_get_rhs_data(mem_ctx, &tower->floors[4]);
+ NT_STATUS_HAVE_NO_MEMORY(binding->host);
+ binding->target_hostname = binding->host;
}
*b_out = binding;
return NT_STATUS_OK;
{
const enum epm_protocol *protseq = NULL;
int num_protocols = -1, i;
- struct GUID ndr_guid;
NTSTATUS status;
/* Find transport */
/* Floor 0 */
tower->floors[0].lhs.protocol = EPM_PROTOCOL_UUID;
- tower->floors[0].lhs.lhs_data = dcerpc_floor_pack_lhs_data(mem_ctx, &binding->object, binding->object_version);
+ tower->floors[0].lhs.lhs_data = dcerpc_floor_pack_lhs_data(mem_ctx, &binding->object);
tower->floors[0].rhs.uuid.unknown = data_blob_talloc_zero(mem_ctx, 2);
/* Floor 1 */
tower->floors[1].lhs.protocol = EPM_PROTOCOL_UUID;
- status = GUID_from_string(NDR_GUID, &ndr_guid);
- if (NT_STATUS_IS_ERR(status)) {
- return status;
- }
-
- tower->floors[1].lhs.lhs_data = dcerpc_floor_pack_lhs_data(mem_ctx, &ndr_guid, NDR_GUID_VERSION);
+ tower->floors[1].lhs.lhs_data = dcerpc_floor_pack_lhs_data(mem_ctx,
+ &ndr_transfer_syntax);
tower->floors[1].rhs.uuid.unknown = data_blob_talloc_zero(mem_ctx, 2);
return NT_STATUS_OK;
}
-NTSTATUS dcerpc_epm_map_binding(TALLOC_CTX *mem_ctx, struct dcerpc_binding *binding,
- const struct dcerpc_interface_table *table, struct event_context *ev)
-{
- struct dcerpc_pipe *p;
- NTSTATUS status;
- struct epm_Map r;
+
+struct epm_map_binding_state {
+ struct dcerpc_binding *binding;
+ const struct dcerpc_interface_table *table;
+ struct dcerpc_pipe *pipe;
struct policy_handle handle;
struct GUID guid;
- struct epm_twr_t twr, *twr_r;
+ struct epm_twr_t twr;
+ struct epm_twr_t *twr_r;
+ struct epm_Map r;
+};
+
+
+static void continue_epm_recv_binding(struct composite_context *ctx);
+static void continue_epm_map(struct rpc_request *req);
+
+
+/*
+ Stage 2 of epm_map_binding: Receive connected rpc pipe and send endpoint
+ mapping rpc request
+*/
+static void continue_epm_recv_binding(struct composite_context *ctx)
+{
+ struct rpc_request *map_req;
+
+ struct composite_context *c = talloc_get_type(ctx->async.private_data,
+ struct composite_context);
+ struct epm_map_binding_state *s = talloc_get_type(c->private_data,
+ struct epm_map_binding_state);
+
+ /* receive result of rpc pipe connect request */
+ c->status = dcerpc_pipe_connect_b_recv(ctx, c, &s->pipe);
+ if (!composite_is_ok(c)) return;
+
+ s->pipe->conn->flags |= DCERPC_NDR_REF_ALLOC;
+
+ /* prepare requested binding parameters */
+ s->binding->object = s->table->syntax_id;
+
+ c->status = dcerpc_binding_build_tower(s->pipe, s->binding, &s->twr.tower);
+ if (!composite_is_ok(c)) return;
+
+ /* with some nice pretty paper around it of course */
+ s->r.in.object = &s->guid;
+ s->r.in.map_tower = &s->twr;
+ s->r.in.entry_handle = &s->handle;
+ s->r.in.max_towers = 1;
+ s->r.out.entry_handle = &s->handle;
+
+ /* send request for an endpoint mapping - a rpc request on connected pipe */
+ map_req = dcerpc_epm_Map_send(s->pipe, c, &s->r);
+ if (composite_nomem(map_req, c)) return;
+
+ composite_continue_rpc(c, map_req, continue_epm_map, c);
+}
+
+
+/*
+ Stage 3 of epm_map_binding: Receive endpoint mapping and provide binding details
+*/
+static void continue_epm_map(struct rpc_request *req)
+{
+ struct composite_context *c = talloc_get_type(req->async.private_data,
+ struct composite_context);
+ struct epm_map_binding_state *s = talloc_get_type(c->private_data,
+ struct epm_map_binding_state);
+
+ /* receive result of a rpc request */
+ c->status = dcerpc_ndr_request_recv(req);
+ if (!composite_is_ok(c)) return;
+
+ /* check the details */
+ if (s->r.out.result != 0 || *s->r.out.num_towers != 1) {
+ composite_error(c, NT_STATUS_PORT_UNREACHABLE);
+ return;
+ }
+
+ s->twr_r = s->r.out.towers[0].twr;
+ if (s->twr_r == NULL) {
+ composite_error(c, NT_STATUS_PORT_UNREACHABLE);
+ return;
+ }
+
+ if (s->twr_r->tower.num_floors != s->twr.tower.num_floors ||
+ s->twr_r->tower.floors[3].lhs.protocol != s->twr.tower.floors[3].lhs.protocol) {
+ composite_error(c, NT_STATUS_PORT_UNREACHABLE);
+ return;
+ }
+
+ /* get received endpoint */
+ s->binding->endpoint = talloc_reference(s->binding,
+ dcerpc_floor_get_rhs_data(c, &s->twr_r->tower.floors[3]));
+ if (composite_nomem(s->binding->endpoint, c)) return;
+
+ composite_done(c);
+}
+
+
+/*
+ Request for endpoint mapping of dcerpc binding - try to request for endpoint
+ unless there is default one.
+*/
+struct composite_context *dcerpc_epm_map_binding_send(TALLOC_CTX *mem_ctx,
+ struct dcerpc_binding *binding,
+ const struct dcerpc_interface_table *table,
+ struct event_context *ev)
+{
+ struct composite_context *c;
+ struct epm_map_binding_state *s;
+ struct composite_context *pipe_connect_req;
+ struct cli_credentials *anon_creds;
+ struct event_context *new_ev = NULL;
+
+ NTSTATUS status;
struct dcerpc_binding *epmapper_binding;
int i;
- struct cli_credentials *anon_creds
- = cli_credentials_init(mem_ctx);
+ /* Try to find event context in memory context in case passed
+ * event_context (argument) was NULL. If there's none, just
+ * create a new one.
+ */
+ if (ev == NULL) {
+ ev = event_context_find(mem_ctx);
+ if (ev == NULL) {
+ new_ev = event_context_init(mem_ctx);
+ if (new_ev == NULL) return NULL;
+ ev = new_ev;
+ }
+ }
+
+ /* composite context allocation and setup */
+ c = composite_create(mem_ctx, ev);
+ if (c == NULL) {
+ talloc_free(new_ev);
+ return NULL;
+ }
+ talloc_steal(c, new_ev);
+
+ s = talloc_zero(c, struct epm_map_binding_state);
+ if (composite_nomem(s, c)) return c;
+ c->private_data = s;
+
+ s->binding = binding;
+ s->table = table;
+
+ /* anonymous credentials for rpc connection used to get endpoint mapping */
+ anon_creds = cli_credentials_init(mem_ctx);
+ cli_credentials_set_event_context(anon_creds, ev);
cli_credentials_set_conf(anon_creds);
cli_credentials_set_anonymous(anon_creds);
- /* First, check if there is a default endpoint specified in the IDL */
-
+ /*
+ First, check if there is a default endpoint specified in the IDL
+ */
if (table) {
struct dcerpc_binding *default_binding;
- binding->authservice = talloc_strdup(binding, table->authservices->names[0]);
-
/* Find one of the default pipes for this interface */
for (i = 0; i < table->endpoints->count; i++) {
status = dcerpc_parse_binding(mem_ctx, table->endpoints->names[i], &default_binding);
if (default_binding->transport == binding->transport && default_binding->endpoint) {
binding->endpoint = talloc_reference(binding, default_binding->endpoint);
talloc_free(default_binding);
- return NT_STATUS_OK;
+
+ composite_done(c);
+ return c;
+
} else {
talloc_free(default_binding);
}
}
}
- epmapper_binding = talloc_zero(mem_ctx, struct dcerpc_binding);
- if (!epmapper_binding) {
- return NT_STATUS_NO_MEMORY;
- }
+ epmapper_binding = talloc_zero(c, struct dcerpc_binding);
+ if (composite_nomem(epmapper_binding, c)) return c;
+
+ /* basic endpoint mapping data */
+ epmapper_binding->transport = binding->transport;
+ epmapper_binding->host = talloc_reference(epmapper_binding, binding->host);
+ epmapper_binding->target_hostname = epmapper_binding->host;
+ epmapper_binding->options = NULL;
+ epmapper_binding->flags = 0;
+ epmapper_binding->assoc_group_id = 0;
+ epmapper_binding->endpoint = NULL;
- epmapper_binding->transport = binding->transport;
- epmapper_binding->host = talloc_reference(epmapper_binding,
- binding->host);
- epmapper_binding->options = NULL;
- epmapper_binding->flags = 0;
- epmapper_binding->endpoint = NULL;
- epmapper_binding->authservice = NULL;
+ /* initiate rpc pipe connection */
+ pipe_connect_req = dcerpc_pipe_connect_b_send(c, epmapper_binding, &dcerpc_table_epmapper,
+ anon_creds, c->event_ctx);
+ if (composite_nomem(pipe_connect_req, c)) return c;
- status = dcerpc_pipe_connect_b(mem_ctx,
- &p,
- epmapper_binding,
- &dcerpc_table_epmapper,
- anon_creds, ev);
+ composite_continue(c, pipe_connect_req, continue_epm_recv_binding, c);
+ return c;
+}
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
- ZERO_STRUCT(handle);
- ZERO_STRUCT(guid);
+/*
+ Receive result of endpoint mapping request
+ */
+NTSTATUS dcerpc_epm_map_binding_recv(struct composite_context *c)
+{
+ NTSTATUS status = composite_wait(c);
+
+ talloc_free(c);
+ return status;
+}
- status = GUID_from_string(table->uuid, &binding->object);
- if (NT_STATUS_IS_ERR(status)) {
- return status;
- }
- binding->object_version = table->if_version;
+/*
+ Get endpoint mapping for rpc connection
+*/
+NTSTATUS dcerpc_epm_map_binding(TALLOC_CTX *mem_ctx, struct dcerpc_binding *binding,
+ const struct dcerpc_interface_table *table, struct event_context *ev)
+{
+ struct composite_context *c;
- status = dcerpc_binding_build_tower(p, binding, &twr.tower);
- if (NT_STATUS_IS_ERR(status)) {
- return status;
- }
+ c = dcerpc_epm_map_binding_send(mem_ctx, binding, table, ev);
+ return dcerpc_epm_map_binding_recv(c);
+}
- /* with some nice pretty paper around it of course */
- r.in.object = &guid;
- r.in.map_tower = &twr;
- r.in.entry_handle = &handle;
- r.in.max_towers = 1;
- r.out.entry_handle = &handle;
- status = dcerpc_epm_Map(p, p, &r);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p);
- return status;
- }
- if (r.out.result != 0 || r.out.num_towers != 1) {
- talloc_free(p);
- return NT_STATUS_PORT_UNREACHABLE;
- }
+struct pipe_auth_state {
+ struct dcerpc_pipe *pipe;
+ struct dcerpc_binding *binding;
+ const struct dcerpc_interface_table *table;
+ struct cli_credentials *credentials;
+};
- twr_r = r.out.towers[0].twr;
- if (!twr_r) {
- talloc_free(p);
- return NT_STATUS_PORT_UNREACHABLE;
- }
- if (twr_r->tower.num_floors != twr.tower.num_floors ||
- twr_r->tower.floors[3].lhs.protocol != twr.tower.floors[3].lhs.protocol) {
- talloc_free(p);
- return NT_STATUS_PORT_UNREACHABLE;
- }
+static void continue_auth_schannel(struct composite_context *ctx);
+static void continue_auth(struct composite_context *ctx);
+static void continue_auth_none(struct composite_context *ctx);
+static void continue_ntlmssp_connection(struct composite_context *ctx);
+static void continue_spnego_after_wrong_pass(struct composite_context *ctx);
- binding->endpoint = talloc_reference(binding, dcerpc_floor_get_rhs_data(mem_ctx, &twr_r->tower.floors[3]));
- talloc_free(p);
+/*
+ Stage 2 of pipe_auth: Receive result of schannel bind request
+*/
+static void continue_auth_schannel(struct composite_context *ctx)
+{
+ struct composite_context *c = talloc_get_type(ctx->async.private_data,
+ struct composite_context);
- return NT_STATUS_OK;
+ c->status = dcerpc_bind_auth_schannel_recv(ctx);
+ if (!composite_is_ok(c)) return;
+
+ composite_done(c);
}
-/*
- perform an authenticated bind if needed
+/*
+ Stage 2 of pipe_auth: Receive result of authenticated bind request
*/
-NTSTATUS dcerpc_pipe_auth(struct dcerpc_pipe *p,
- struct dcerpc_binding *binding,
- const struct dcerpc_interface_table *table,
- struct cli_credentials *credentials)
+static void continue_auth(struct composite_context *ctx)
{
- NTSTATUS status;
- TALLOC_CTX *tmp_ctx;
- tmp_ctx = talloc_new(p);
+ struct composite_context *c = talloc_get_type(ctx->async.private_data,
+ struct composite_context);
- p->conn->flags = binding->flags;
-
- /* remember the binding string for possible secondary connections */
- p->conn->binding_string = dcerpc_binding_string(p, binding);
-
- if (!cli_credentials_is_anonymous(credentials) &&
- (binding->flags & DCERPC_SCHANNEL) &&
- !cli_credentials_get_netlogon_creds(credentials)) {
-
- /* If we don't already have netlogon credentials for
- * the schannel bind, then we have to get these
- * first */
- status = dcerpc_bind_auth_schannel(tmp_ctx, p, table, credentials);
- } else if (!cli_credentials_is_anonymous(credentials) &&
- !(binding->transport == NCACN_NP &&
- !(binding->flags & DCERPC_SIGN) &&
- !(binding->flags & DCERPC_SEAL))) {
+ c->status = dcerpc_bind_auth_recv(ctx);
+ if (!composite_is_ok(c)) return;
- /* Perform an authenticated DCE-RPC bind, except where
- * we ask for a connection on NCACN_NP, and that
- * connection is not signed or sealed. For that case
- * we rely on the already authenicated CIFS connection
+ composite_done(c);
+}
+/*
+ Stage 2 of pipe_auth: Receive result of authenticated bind request, but handle fallbacks:
+ SPNEGO -> NTLMSSP
+*/
+static void continue_auth_auto(struct composite_context *ctx)
+{
+ struct composite_context *c = talloc_get_type(ctx->async.private_data,
+ struct composite_context);
+ struct pipe_auth_state *s = talloc_get_type(c->private_data, struct pipe_auth_state);
+ struct composite_context *sec_conn_req;
+
+ c->status = dcerpc_bind_auth_recv(ctx);
+ if (NT_STATUS_EQUAL(c->status, NT_STATUS_INVALID_PARAMETER)) {
+ /*
+ * Retry with NTLMSSP auth as fallback
+ * send a request for secondary rpc connection
*/
-
- uint8_t auth_type;
-
- if ((p->conn->flags & (DCERPC_SIGN|DCERPC_SEAL)) == 0) {
+ sec_conn_req = dcerpc_secondary_connection_send(s->pipe,
+ s->binding);
+ composite_continue(c, sec_conn_req, continue_ntlmssp_connection, c);
+ return;
+ } else if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
+ if (cli_credentials_wrong_password(s->credentials)) {
/*
- we are doing an authenticated connection,
- but not using sign or seal. We must force
- the CONNECT dcerpc auth type as a NONE auth
- type doesn't allow authentication
- information to be passed.
- */
- p->conn->flags |= DCERPC_CONNECT;
- }
-
- if (binding->flags & DCERPC_AUTH_SPNEGO) {
- auth_type = DCERPC_AUTH_TYPE_SPNEGO;
- } else if (binding->flags & DCERPC_AUTH_KRB5) {
- auth_type = DCERPC_AUTH_TYPE_KRB5;
- } else if (binding->flags & DCERPC_SCHANNEL) {
- auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
- } else {
- auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
+ * Retry SPNEGO with a better password
+ * send a request for secondary rpc connection
+ */
+ sec_conn_req = dcerpc_secondary_connection_send(s->pipe,
+ s->binding);
+ composite_continue(c, sec_conn_req, continue_spnego_after_wrong_pass, c);
+ return;
}
-
- status = dcerpc_bind_auth(p, table,
- credentials, auth_type,
- binding->authservice);
- } else {
- status = dcerpc_bind_auth_none(p, table);
- }
-
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to bind to uuid %s - %s\n", table->uuid, nt_errstr(status)));
}
- talloc_free(tmp_ctx);
- return status;
-}
+ if (!composite_is_ok(c)) return;
-/* open a rpc connection to a rpc pipe on SMB using the binding
- structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncacn_np(TALLOC_CTX *tmp_ctx,
- struct dcerpc_pipe_connect *io)
-{
- if (io->binding->flags & DCERPC_SMB2) {
- return dcerpc_pipe_connect_ncacn_np_smb2(tmp_ctx, io);
-
- }
- return dcerpc_pipe_connect_ncacn_np_smb(tmp_ctx, io);
+ composite_done(c);
}
-
-/* open a rpc connection to a rpc pipe on SMP using the binding
- structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncalrpc(TALLOC_CTX *tmp_ctx,
- struct dcerpc_pipe *p,
- struct dcerpc_binding *binding,
- const struct dcerpc_interface_table *table)
+/*
+ Stage 3 of pipe_auth (fallback to NTLMSSP case): Receive secondary
+ rpc connection (the first one can't be used any more, due to the
+ bind nak) and perform authenticated bind request
+*/
+static void continue_ntlmssp_connection(struct composite_context *ctx)
{
- NTSTATUS status;
+ struct composite_context *c;
+ struct pipe_auth_state *s;
+ struct composite_context *auth_req;
+ struct dcerpc_pipe *p2;
- status = dcerpc_pipe_open_pipe(p->conn, binding->endpoint);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to open ncalrpc pipe '%s' - %s\n",
- binding->endpoint, nt_errstr(status)));
- return status;
- }
+ c = talloc_get_type(ctx->async.private_data, struct composite_context);
+ s = talloc_get_type(c->private_data, struct pipe_auth_state);
- return status;
-}
+ /* receive secondary rpc connection */
+ c->status = dcerpc_secondary_connection_recv(ctx, &p2);
+ if (!composite_is_ok(c)) return;
+ talloc_steal(s, p2);
+ talloc_steal(p2, s->pipe);
+ s->pipe = p2;
+ /* initiate a authenticated bind */
+ auth_req = dcerpc_bind_auth_send(c, s->pipe, s->table,
+ s->credentials, DCERPC_AUTH_TYPE_NTLMSSP,
+ dcerpc_auth_level(s->pipe->conn),
+ s->table->authservices->names[0]);
+ composite_continue(c, auth_req, continue_auth, c);
+}
-/* open a rpc connection to a rpc pipe on SMP using the binding
- structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncacn_unix_stream(TALLOC_CTX *tmp_ctx,
- struct dcerpc_pipe *p,
- struct dcerpc_binding *binding,
- const struct dcerpc_interface_table *table)
+/*
+ Stage 3 of pipe_auth (retry on wrong password): Receive secondary
+ rpc connection (the first one can't be used any more, due to the
+ bind nak) and perform authenticated bind request
+*/
+static void continue_spnego_after_wrong_pass(struct composite_context *ctx)
{
- NTSTATUS status;
+ struct composite_context *c;
+ struct pipe_auth_state *s;
+ struct composite_context *auth_req;
+ struct dcerpc_pipe *p2;
- if (!binding->endpoint) {
- DEBUG(0, ("Path to unix socket not specified\n"));
- return NT_STATUS_INVALID_PARAMETER;
- }
+ c = talloc_get_type(ctx->async.private_data, struct composite_context);
+ s = talloc_get_type(c->private_data, struct pipe_auth_state);
- status = dcerpc_pipe_open_unix_stream(p->conn, binding->endpoint);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to open unix socket %s - %s\n",
- binding->endpoint, nt_errstr(status)));
- talloc_free(p);
- return status;
- }
+ /* receive secondary rpc connection */
+ c->status = dcerpc_secondary_connection_recv(ctx, &p2);
+ if (!composite_is_ok(c)) return;
- return status;
-}
+ talloc_steal(s, p2);
+ talloc_steal(p2, s->pipe);
+ s->pipe = p2;
-/* open a rpc connection to a rpc pipe on TCP/IP sockets using the binding
- structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncacn_ip_tcp(TALLOC_CTX *tmp_ctx,
- struct dcerpc_pipe *p,
- struct dcerpc_binding *binding,
- const struct dcerpc_interface_table *table)
-{
- NTSTATUS status;
- uint32_t port = 0;
+ /* initiate a authenticated bind */
+ auth_req = dcerpc_bind_auth_send(c, s->pipe, s->table,
+ s->credentials, DCERPC_AUTH_TYPE_SPNEGO,
+ dcerpc_auth_level(s->pipe->conn),
+ s->table->authservices->names[0]);
+ composite_continue(c, auth_req, continue_auth, c);
+}
- port = atoi(binding->endpoint);
- status = dcerpc_pipe_open_tcp(p->conn, binding->host, port);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to connect to %s:%d - %s\n",
- binding->host, port, nt_errstr(status)));
- return status;
- }
+/*
+ Stage 2 of pipe_auth: Receive result of non-authenticated bind request
+*/
+static void continue_auth_none(struct composite_context *ctx)
+{
+ struct composite_context *c = talloc_get_type(ctx->async.private_data,
+ struct composite_context);
- return status;
+ c->status = dcerpc_bind_auth_none_recv(ctx);
+ if (!composite_is_ok(c)) return;
+
+ composite_done(c);
}
-/* open a rpc connection to a rpc pipe, using the specified
- binding structure to determine the endpoint and options */
-NTSTATUS dcerpc_pipe_connect_b(TALLOC_CTX *parent_ctx,
- struct dcerpc_pipe **pp,
- struct dcerpc_binding *binding,
- const struct dcerpc_interface_table *table,
- struct cli_credentials *credentials,
- struct event_context *ev)
+/*
+ Request to perform an authenticated bind if required. Authentication
+ is determined using credentials passed and binding flags.
+*/
+struct composite_context *dcerpc_pipe_auth_send(struct dcerpc_pipe *p,
+ struct dcerpc_binding *binding,
+ const struct dcerpc_interface_table *table,
+ struct cli_credentials *credentials)
{
- NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
- struct dcerpc_pipe *p;
- struct dcerpc_pipe_connect pc;
+ struct composite_context *c;
+ struct pipe_auth_state *s;
+ struct composite_context *auth_schannel_req;
+ struct composite_context *auth_req;
+ struct composite_context *auth_none_req;
+ struct dcerpc_connection *conn;
+ uint8_t auth_type;
+
+ /* composite context allocation and setup */
+ c = composite_create(p, p->conn->event_ctx);
+ if (c == NULL) return NULL;
+
+ s = talloc_zero(c, struct pipe_auth_state);
+ if (composite_nomem(s, c)) return c;
+ c->private_data = s;
+
+ /* store parameters in state structure */
+ s->binding = binding;
+ s->table = table;
+ s->credentials = credentials;
+ s->pipe = p;
+
+ conn = s->pipe->conn;
+ conn->flags = binding->flags;
- TALLOC_CTX *tmp_ctx;
-
- (*pp) = NULL;
-
- p = dcerpc_pipe_init(parent_ctx, ev);
- if (p == NULL) {
- return NT_STATUS_NO_MEMORY;
- }
- tmp_ctx = talloc_named(p, 0, "dcerpc_pipe_connect_b tmp_ctx");
-
- switch (binding->transport) {
- case NCACN_NP:
- case NCACN_IP_TCP:
- case NCALRPC:
- if (!binding->endpoint) {
- status = dcerpc_epm_map_binding(tmp_ctx, binding, table,
- p->conn->event_ctx);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to map DCERPC endpoint for '%s' - %s\n",
- table->uuid, nt_errstr(status)));
- return status;
- }
- DEBUG(2,("Mapped to DCERPC endpoint %s\n", binding->endpoint));
- }
- break;
-
- /* Fall through to next switch statement */
-
- default:
- break;
- }
-
- pc.pipe = p;
- pc.binding = binding;
- pc.interface = table;
- pc.creds = credentials;
-
- switch (binding->transport) {
- case NCACN_NP:
- status = dcerpc_pipe_connect_ncacn_np(tmp_ctx, &pc);
- break;
+ /* remember the binding string for possible secondary connections */
+ conn->binding_string = dcerpc_binding_string(p, binding);
- case NCACN_IP_TCP:
- status = dcerpc_pipe_connect_ncacn_ip_tcp(tmp_ctx,
- p, binding, table);
- break;
- case NCACN_UNIX_STREAM:
- status = dcerpc_pipe_connect_ncacn_unix_stream(tmp_ctx,
- p, binding, table);
- break;
- case NCALRPC:
- status = dcerpc_pipe_connect_ncalrpc(tmp_ctx,
- p, binding, table);
- break;
- default:
- return NT_STATUS_NOT_SUPPORTED;
+ if (cli_credentials_is_anonymous(s->credentials)) {
+ auth_none_req = dcerpc_bind_auth_none_send(c, s->pipe, s->table);
+ composite_continue(c, auth_none_req, continue_auth_none, c);
+ return c;
}
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p);
- return status;
+ if ((binding->flags & DCERPC_SCHANNEL) &&
+ !cli_credentials_get_netlogon_creds(s->credentials)) {
+ /* If we don't already have netlogon credentials for
+ * the schannel bind, then we have to get these
+ * first */
+ auth_schannel_req = dcerpc_bind_auth_schannel_send(c, s->pipe, s->table,
+ s->credentials,
+ dcerpc_auth_level(conn));
+ composite_continue(c, auth_schannel_req, continue_auth_schannel, c);
+ return c;
}
- status = dcerpc_pipe_auth(p, binding, table, credentials);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p);
- return status;
+ /*
+ * we rely on the already authenticated CIFS connection
+ * if not doing sign or seal
+ */
+ if (conn->transport.transport == NCACN_NP &&
+ !(s->binding->flags & (DCERPC_SIGN|DCERPC_SEAL))) {
+ auth_none_req = dcerpc_bind_auth_none_send(c, s->pipe, s->table);
+ composite_continue(c, auth_none_req, continue_auth_none, c);
+ return c;
}
- *pp = p;
- talloc_free(tmp_ctx);
- return status;
-}
-
-/* open a rpc connection to a rpc pipe, using the specified string
- binding to determine the endpoint and options */
-NTSTATUS dcerpc_pipe_connect(TALLOC_CTX *parent_ctx,
- struct dcerpc_pipe **pp,
- const char *binding,
- const struct dcerpc_interface_table *table,
- struct cli_credentials *credentials,
- struct event_context *ev)
-{
- struct dcerpc_binding *b;
- NTSTATUS status;
- TALLOC_CTX *tmp_ctx;
-
- tmp_ctx = talloc_named(parent_ctx, 0, "dcerpc_pipe_connect tmp_ctx");
- if (!tmp_ctx) {
- return NT_STATUS_NO_MEMORY;
+ /* Perform an authenticated DCE-RPC bind
+ */
+ if (!(conn->flags & (DCERPC_SIGN|DCERPC_SEAL))) {
+ /*
+ we are doing an authenticated connection,
+ but not using sign or seal. We must force
+ the CONNECT dcerpc auth type as a NONE auth
+ type doesn't allow authentication
+ information to be passed.
+ */
+ conn->flags |= DCERPC_CONNECT;
}
- status = dcerpc_parse_binding(tmp_ctx, binding, &b);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to parse dcerpc binding '%s'\n", binding));
- talloc_free(tmp_ctx);
- return status;
- }
+ if (s->binding->flags & DCERPC_AUTH_SPNEGO) {
+ auth_type = DCERPC_AUTH_TYPE_SPNEGO;
- DEBUG(3,("Using binding %s\n", dcerpc_binding_string(tmp_ctx, b)));
+ } else if (s->binding->flags & DCERPC_AUTH_KRB5) {
+ auth_type = DCERPC_AUTH_TYPE_KRB5;
- status = dcerpc_pipe_connect_b(tmp_ctx, pp, b, table, credentials, ev);
+ } else if (s->binding->flags & DCERPC_SCHANNEL) {
+ auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
- if (NT_STATUS_IS_OK(status)) {
- *pp = talloc_steal(parent_ctx, *pp);
- }
- talloc_free(tmp_ctx);
+ } else if (s->binding->flags & DCERPC_AUTH_NTLM) {
+ auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
- return status;
+ } else {
+ /* try SPNEGO with fallback to NTLMSSP */
+ auth_req = dcerpc_bind_auth_send(c, s->pipe, s->table,
+ s->credentials, DCERPC_AUTH_TYPE_SPNEGO,
+ dcerpc_auth_level(conn),
+ s->table->authservices->names[0]);
+ composite_continue(c, auth_req, continue_auth_auto, c);
+ return c;
+ }
+
+ auth_req = dcerpc_bind_auth_send(c, s->pipe, s->table,
+ s->credentials, auth_type,
+ dcerpc_auth_level(conn),
+ s->table->authservices->names[0]);
+ composite_continue(c, auth_req, continue_auth, c);
+ return c;
}
/*
- create a secondary dcerpc connection from a primary connection
-
- if the primary is a SMB connection then the secondary connection
- will be on the same SMB connection, but use a new fnum
-*/
-NTSTATUS dcerpc_secondary_connection(struct dcerpc_pipe *p, struct dcerpc_pipe **p2,
- struct dcerpc_binding *b)
+ Receive result of authenticated bind request on dcerpc pipe
+ This returns *p, which may be different to the one originally
+ supllied, as it rebinds to a new pipe due to authentication fallback
+*/
+NTSTATUS dcerpc_pipe_auth_recv(struct composite_context *c, TALLOC_CTX *mem_ctx,
+ struct dcerpc_pipe **p)
{
- struct smbcli_tree *tree;
- NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
+ NTSTATUS status;
- (*p2) = dcerpc_pipe_init(p, p->conn->event_ctx);
- if (*p2 == NULL) {
- return NT_STATUS_NO_MEMORY;
+ struct pipe_auth_state *s = talloc_get_type(c->private_data,
+ struct pipe_auth_state);
+ status = composite_wait(c);
+ if (!NT_STATUS_IS_OK(status)) {
+ char *uuid_str = GUID_string(s->pipe, &s->table->syntax_id.uuid);
+ DEBUG(0, ("Failed to bind to uuid %s - %s\n", uuid_str, nt_errstr(status)));
+ talloc_free(uuid_str);
+ } else {
+ talloc_steal(mem_ctx, s->pipe);
+ *p = s->pipe;
}
-
- switch (p->conn->transport.transport) {
- case NCACN_NP:
- tree = dcerpc_smb_tree(p->conn);
- if (!tree) {
- return NT_STATUS_INVALID_PARAMETER;
- }
- status = dcerpc_pipe_open_smb((*p2)->conn, tree, b->endpoint);
- break;
-
- case NCACN_IP_TCP:
- status = dcerpc_pipe_open_tcp((*p2)->conn, b->host, atoi(b->endpoint));
- break;
- case NCALRPC:
- status = dcerpc_pipe_open_pipe((*p2)->conn, b->endpoint);
- break;
+ talloc_free(c);
+ return status;
+}
- default:
- return NT_STATUS_NOT_SUPPORTED;
- }
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(*p2);
- return status;
- }
+/*
+ Perform an authenticated bind if needed - sync version
- (*p2)->conn->flags = p->conn->flags;
+ This may change *p, as it rebinds to a new pipe due to authentication fallback
+*/
+NTSTATUS dcerpc_pipe_auth(TALLOC_CTX *mem_ctx,
+ struct dcerpc_pipe **p,
+ struct dcerpc_binding *binding,
+ const struct dcerpc_interface_table *table,
+ struct cli_credentials *credentials)
+{
+ struct composite_context *c;
- return NT_STATUS_OK;
+ c = dcerpc_pipe_auth_send(*p, binding, table, credentials);
+ return dcerpc_pipe_auth_recv(c, mem_ctx, p);
}
+
NTSTATUS dcerpc_generic_session_key(struct dcerpc_connection *c,
DATA_BLOB *session_key)
{
p2->context_id = ++p->conn->next_context_id;
- status = GUID_from_string(table->uuid, &p2->syntax.uuid);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p2);
- return status;
- }
- p2->syntax.if_version = table->if_version;
+ p2->syntax = table->syntax_id;
- status = GUID_from_string(NDR_GUID, &p2->transfer_syntax.uuid);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p2);
- return status;
- }
- p2->transfer_syntax.if_version = NDR_GUID_VERSION;
+ p2->transfer_syntax = ndr_transfer_syntax;
+
+ p2->binding = talloc_reference(p2, p->binding);
status = dcerpc_alter_context(p2, p2, &p2->syntax, &p2->transfer_syntax);
if (!NT_STATUS_IS_OK(status)) {
git.samba.org / samba.git / blobdiff