Copyright (C) Andrew Tridgell 2003
Copyright (C) Jelmer Vernooij 2004
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
+ Copyright (C) Rafal Szczesniak 2006
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
-#include "system/network.h"
-#include "librpc/gen_ndr/ndr_epmapper.h"
+#include "lib/events/events.h"
+#include "libcli/composite/composite.h"
+#include "librpc/gen_ndr/ndr_epmapper_c.h"
+#include "librpc/gen_ndr/ndr_dcerpc.h"
+#include "librpc/gen_ndr/ndr_misc.h"
+#include "auth/credentials/credentials.h"
/*
- find the pipe name for a local IDL interface
+ find a dcerpc call on an interface by name
*/
-const char *idl_pipe_name(const char *uuid, uint32_t if_version)
+const struct dcerpc_interface_call *dcerpc_iface_find_call(const struct dcerpc_interface_table *iface,
+ const char *name)
{
- const struct dcerpc_interface_list *l;
- for (l=librpc_dcerpc_pipes();l;l=l->next) {
- if (strcasecmp(l->table->uuid, uuid) == 0 &&
- l->table->if_version == if_version) {
- return l->table->name;
- }
- }
- return "UNKNOWN";
-}
-
-/*
- find the number of calls defined by local IDL
-*/
-int idl_num_calls(const char *uuid, uint32_t if_version)
-{
- const struct dcerpc_interface_list *l;
- for (l=librpc_dcerpc_pipes();l;l=l->next){
- if (strcasecmp(l->table->uuid, uuid) == 0 &&
- l->table->if_version == if_version) {
- return l->table->num_calls;
- }
- }
- return -1;
-}
-
-
-/*
- find a dcerpc interface by name
-*/
-const struct dcerpc_interface_table *idl_iface_by_name(const char *name)
-{
- const struct dcerpc_interface_list *l;
- for (l=librpc_dcerpc_pipes();l;l=l->next) {
- if (strcasecmp(l->table->name, name) == 0) {
- return l->table;
- }
- }
- return NULL;
-}
-
-/*
- find a dcerpc interface by uuid
-*/
-const struct dcerpc_interface_table *idl_iface_by_uuid(const char *uuid)
-{
- const struct dcerpc_interface_list *l;
- for (l=librpc_dcerpc_pipes();l;l=l->next) {
- if (strcasecmp(l->table->uuid, uuid) == 0) {
- return l->table;
+ int i;
+ for (i=0;i<iface->num_calls;i++) {
+ if (strcmp(iface->calls[i].name, name) == 0) {
+ return &iface->calls[i];
}
}
return NULL;
}
-
/*
- push a dcerpc_packet into a blob, potentially with auth info
+ push a ncacn_packet into a blob, potentially with auth info
*/
-NTSTATUS dcerpc_push_auth(DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
- struct dcerpc_packet *pkt,
+NTSTATUS ncacn_push_auth(DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
+ struct ncacn_packet *pkt,
struct dcerpc_auth *auth_info)
{
NTSTATUS status;
ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
}
- if (pkt->pfc_flags & DCERPC_PFC_FLAG_ORPC) {
+ if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
}
pkt->auth_length = 0;
}
- status = ndr_push_dcerpc_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
+ status = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
{"seal", DCERPC_SEAL},
{"connect", DCERPC_CONNECT},
{"spnego", DCERPC_AUTH_SPNEGO},
+ {"ntlm", DCERPC_AUTH_NTLM},
{"krb5", DCERPC_AUTH_KRB5},
{"validate", DCERPC_DEBUG_VALIDATE_BOTH},
{"print", DCERPC_DEBUG_PRINT_BOTH},
{"padcheck", DCERPC_DEBUG_PAD_CHECK},
- {"bigendian", DCERPC_PUSH_BIGENDIAN}
+ {"bigendian", DCERPC_PUSH_BIGENDIAN},
+ {"smb2", DCERPC_SMB2}
};
-const char *epm_floor_string(TALLOC_CTX *mem_ctx, struct epm_floor *fl)
+const char *epm_floor_string(TALLOC_CTX *mem_ctx, struct epm_floor *epm_floor)
{
- struct GUID uuid;
- uint16_t if_version;
+ struct dcerpc_syntax_id syntax;
NTSTATUS status;
- switch(fl->lhs.protocol) {
+ switch(epm_floor->lhs.protocol) {
case EPM_PROTOCOL_UUID:
- status = dcerpc_floor_get_lhs_data(fl, &uuid, &if_version);
+ status = dcerpc_floor_get_lhs_data(epm_floor, &syntax);
if (NT_STATUS_IS_OK(status)) {
/* lhs is used: UUID */
char *uuidstr;
- uuidstr = GUID_string(mem_ctx, &uuid);
-
- if (strcasecmp(uuidstr, NDR_GUID) == 0) {
+ if (GUID_equal(&syntax.uuid, &ndr_transfer_syntax.uuid)) {
return "NDR";
}
- return talloc_asprintf(mem_ctx, " uuid %s/0x%02x", uuidstr, if_version);
+ if (GUID_equal(&syntax.uuid, &ndr64_transfer_syntax.uuid)) {
+ return "NDR64";
+ }
+
+ uuidstr = GUID_string(mem_ctx, &syntax.uuid);
+
+ return talloc_asprintf(mem_ctx, " uuid %s/0x%02x", uuidstr, syntax.if_version);
} else { /* IPX */
return talloc_asprintf(mem_ctx, "IPX:%s",
- data_blob_hex_string(mem_ctx, &fl->rhs.uuid.unknown));
+ data_blob_hex_string(mem_ctx, &epm_floor->rhs.uuid.unknown));
}
case EPM_PROTOCOL_NCACN:
return "DNET/NSP";
case EPM_PROTOCOL_IP:
- return talloc_asprintf(mem_ctx, "IP:%s", fl->rhs.ip.ipaddr);
+ return talloc_asprintf(mem_ctx, "IP:%s", epm_floor->rhs.ip.ipaddr);
case EPM_PROTOCOL_PIPE:
- return talloc_asprintf(mem_ctx, "PIPE:%s", fl->rhs.pipe.path);
+ return talloc_asprintf(mem_ctx, "PIPE:%s", epm_floor->rhs.pipe.path);
case EPM_PROTOCOL_SMB:
- return talloc_asprintf(mem_ctx, "SMB:%s", fl->rhs.smb.unc);
+ return talloc_asprintf(mem_ctx, "SMB:%s", epm_floor->rhs.smb.unc);
case EPM_PROTOCOL_UNIX_DS:
- return talloc_asprintf(mem_ctx, "Unix:%s", fl->rhs.unix_ds.path);
+ return talloc_asprintf(mem_ctx, "Unix:%s", epm_floor->rhs.unix_ds.path);
case EPM_PROTOCOL_NETBIOS:
- return talloc_asprintf(mem_ctx, "NetBIOS:%s", fl->rhs.netbios.name);
+ return talloc_asprintf(mem_ctx, "NetBIOS:%s", epm_floor->rhs.netbios.name);
case EPM_PROTOCOL_NETBEUI:
return "NETBeui";
return "NB_IPX";
case EPM_PROTOCOL_HTTP:
- return talloc_asprintf(mem_ctx, "HTTP:%d", fl->rhs.http.port);
+ return talloc_asprintf(mem_ctx, "HTTP:%d", epm_floor->rhs.http.port);
case EPM_PROTOCOL_TCP:
- return talloc_asprintf(mem_ctx, "TCP:%d", fl->rhs.tcp.port);
+ return talloc_asprintf(mem_ctx, "TCP:%d", epm_floor->rhs.tcp.port);
case EPM_PROTOCOL_UDP:
- return talloc_asprintf(mem_ctx, "UDP:%d", fl->rhs.udp.port);
+ return talloc_asprintf(mem_ctx, "UDP:%d", epm_floor->rhs.udp.port);
default:
- return talloc_asprintf(mem_ctx, "UNK(%02x):", fl->lhs.protocol);
+ return talloc_asprintf(mem_ctx, "UNK(%02x):", epm_floor->lhs.protocol);
}
}
/*
form a binding string from a binding structure
*/
-const char *dcerpc_binding_string(TALLOC_CTX *mem_ctx, const struct dcerpc_binding *b)
+char *dcerpc_binding_string(TALLOC_CTX *mem_ctx, const struct dcerpc_binding *b)
{
char *s = talloc_strdup(mem_ctx, "");
int i;
return NULL;
}
- if (!GUID_all_zero(&b->object)) {
+ if (!GUID_all_zero(&b->object.uuid)) {
s = talloc_asprintf(s, "%s@",
- GUID_string(mem_ctx, &b->object));
+ GUID_string(mem_ctx, &b->object.uuid));
}
s = talloc_asprintf_append(s, "%s:", t_name);
return NT_STATUS_NO_MEMORY;
}
- b->authservice = NULL;
-
p = strchr(s, '@');
if (p && PTR_DIFF(p, s) == 36) { /* 36 is the length of a UUID */
NTSTATUS status;
- status = GUID_from_string(s, &b->object);
+ status = GUID_from_string(s, &b->object.uuid);
if (NT_STATUS_IS_ERR(status)) {
DEBUG(0, ("Failed parsing UUID\n"));
ZERO_STRUCT(b->object);
}
- b->object_version = 0;
+ b->object.if_version = 0;
p = strchr(s, ':');
if (!p) {
b->host = talloc_strdup(b, s);
options = NULL;
}
-
if (!b->host) {
return NT_STATUS_NO_MEMORY;
}
+ b->target_hostname = b->host;
+
b->options = NULL;
b->flags = 0;
+ b->assoc_group_id = 0;
b->endpoint = NULL;
if (!options) {
return NT_STATUS_OK;
}
-NTSTATUS dcerpc_floor_get_lhs_data(struct epm_floor *floor, struct GUID *uuid, uint16_t *if_version)
+NTSTATUS dcerpc_floor_get_lhs_data(struct epm_floor *epm_floor, struct dcerpc_syntax_id *syntax)
{
TALLOC_CTX *mem_ctx = talloc_init("floor_get_lhs_data");
- struct ndr_pull *ndr = ndr_pull_init_blob(&floor->lhs.lhs_data, mem_ctx);
+ struct ndr_pull *ndr = ndr_pull_init_blob(&epm_floor->lhs.lhs_data, mem_ctx);
NTSTATUS status;
-
+ uint16_t if_version=0;
+
ndr->flags |= LIBNDR_FLAG_NOALIGN;
- status = ndr_pull_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, uuid);
+ status = ndr_pull_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, &syntax->uuid);
if (NT_STATUS_IS_ERR(status)) {
talloc_free(mem_ctx);
return status;
}
- status = ndr_pull_uint16(ndr, NDR_SCALARS, if_version);
+ status = ndr_pull_uint16(ndr, NDR_SCALARS, &if_version);
+ syntax->if_version = if_version;
talloc_free(mem_ctx);
return status;
}
-DATA_BLOB dcerpc_floor_pack_lhs_data(TALLOC_CTX *mem_ctx, struct GUID *uuid, uint32_t if_version)
+static DATA_BLOB dcerpc_floor_pack_lhs_data(TALLOC_CTX *mem_ctx, const struct dcerpc_syntax_id *syntax)
{
struct ndr_push *ndr = ndr_push_init_ctx(mem_ctx);
ndr->flags |= LIBNDR_FLAG_NOALIGN;
- ndr_push_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, uuid);
- ndr_push_uint16(ndr, NDR_SCALARS, if_version);
+ ndr_push_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, &syntax->uuid);
+ ndr_push_uint16(ndr, NDR_SCALARS, syntax->if_version);
return ndr_push_blob(ndr);
}
-const char *dcerpc_floor_get_rhs_data(TALLOC_CTX *mem_ctx, struct epm_floor *floor)
+const char *dcerpc_floor_get_rhs_data(TALLOC_CTX *mem_ctx, struct epm_floor *epm_floor)
{
- switch (floor->lhs.protocol) {
+ switch (epm_floor->lhs.protocol) {
case EPM_PROTOCOL_TCP:
- if (floor->rhs.tcp.port == 0) return NULL;
- return talloc_asprintf(mem_ctx, "%d", floor->rhs.tcp.port);
+ if (epm_floor->rhs.tcp.port == 0) return NULL;
+ return talloc_asprintf(mem_ctx, "%d", epm_floor->rhs.tcp.port);
case EPM_PROTOCOL_UDP:
- if (floor->rhs.udp.port == 0) return NULL;
- return talloc_asprintf(mem_ctx, "%d", floor->rhs.udp.port);
+ if (epm_floor->rhs.udp.port == 0) return NULL;
+ return talloc_asprintf(mem_ctx, "%d", epm_floor->rhs.udp.port);
case EPM_PROTOCOL_HTTP:
- if (floor->rhs.http.port == 0) return NULL;
- return talloc_asprintf(mem_ctx, "%d", floor->rhs.http.port);
+ if (epm_floor->rhs.http.port == 0) return NULL;
+ return talloc_asprintf(mem_ctx, "%d", epm_floor->rhs.http.port);
case EPM_PROTOCOL_IP:
- return talloc_strdup(mem_ctx, floor->rhs.ip.ipaddr);
+ return talloc_strdup(mem_ctx, epm_floor->rhs.ip.ipaddr);
case EPM_PROTOCOL_NCACN:
return NULL;
return NULL;
case EPM_PROTOCOL_SMB:
- if (strlen(floor->rhs.smb.unc) == 0) return NULL;
- return talloc_strdup(mem_ctx, floor->rhs.smb.unc);
+ if (strlen(epm_floor->rhs.smb.unc) == 0) return NULL;
+ return talloc_strdup(mem_ctx, epm_floor->rhs.smb.unc);
case EPM_PROTOCOL_PIPE:
- if (strlen(floor->rhs.pipe.path) == 0) return NULL;
- return talloc_strdup(mem_ctx, floor->rhs.pipe.path);
+ if (strlen(epm_floor->rhs.pipe.path) == 0) return NULL;
+ return talloc_strdup(mem_ctx, epm_floor->rhs.pipe.path);
case EPM_PROTOCOL_NETBIOS:
- if (strlen(floor->rhs.netbios.name) == 0) return NULL;
- return talloc_strdup(mem_ctx, floor->rhs.netbios.name);
+ if (strlen(epm_floor->rhs.netbios.name) == 0) return NULL;
+ return talloc_strdup(mem_ctx, epm_floor->rhs.netbios.name);
case EPM_PROTOCOL_NCALRPC:
return NULL;
case EPM_PROTOCOL_VINES_SPP:
- return talloc_asprintf(mem_ctx, "%d", floor->rhs.vines_spp.port);
+ return talloc_asprintf(mem_ctx, "%d", epm_floor->rhs.vines_spp.port);
case EPM_PROTOCOL_VINES_IPC:
- return talloc_asprintf(mem_ctx, "%d", floor->rhs.vines_ipc.port);
+ return talloc_asprintf(mem_ctx, "%d", epm_floor->rhs.vines_ipc.port);
case EPM_PROTOCOL_STREETTALK:
- return talloc_strdup(mem_ctx, floor->rhs.streettalk.streettalk);
+ return talloc_strdup(mem_ctx, epm_floor->rhs.streettalk.streettalk);
case EPM_PROTOCOL_UNIX_DS:
- if (strlen(floor->rhs.unix_ds.path) == 0) return NULL;
- return talloc_strdup(mem_ctx, floor->rhs.unix_ds.path);
+ if (strlen(epm_floor->rhs.unix_ds.path) == 0) return NULL;
+ return talloc_strdup(mem_ctx, epm_floor->rhs.unix_ds.path);
case EPM_PROTOCOL_NULL:
return NULL;
default:
- DEBUG(0,("Unsupported lhs protocol %d\n", floor->lhs.protocol));
+ DEBUG(0,("Unsupported lhs protocol %d\n", epm_floor->lhs.protocol));
break;
}
return NULL;
}
-static NTSTATUS dcerpc_floor_set_rhs_data(TALLOC_CTX *mem_ctx, struct epm_floor *floor, const char *data)
+static NTSTATUS dcerpc_floor_set_rhs_data(TALLOC_CTX *mem_ctx, struct epm_floor *epm_floor, const char *data)
{
- switch (floor->lhs.protocol) {
+ switch (epm_floor->lhs.protocol) {
case EPM_PROTOCOL_TCP:
- floor->rhs.tcp.port = atoi(data);
+ epm_floor->rhs.tcp.port = atoi(data);
return NT_STATUS_OK;
case EPM_PROTOCOL_UDP:
- floor->rhs.udp.port = atoi(data);
+ epm_floor->rhs.udp.port = atoi(data);
return NT_STATUS_OK;
case EPM_PROTOCOL_HTTP:
- floor->rhs.http.port = atoi(data);
+ epm_floor->rhs.http.port = atoi(data);
return NT_STATUS_OK;
case EPM_PROTOCOL_IP:
- floor->rhs.ip.ipaddr = talloc_strdup(mem_ctx, data);
- NT_STATUS_HAVE_NO_MEMORY(floor->rhs.ip.ipaddr);
+ epm_floor->rhs.ip.ipaddr = talloc_strdup(mem_ctx, data);
+ NT_STATUS_HAVE_NO_MEMORY(epm_floor->rhs.ip.ipaddr);
return NT_STATUS_OK;
case EPM_PROTOCOL_NCACN:
- floor->rhs.ncacn.minor_version = 0;
+ epm_floor->rhs.ncacn.minor_version = 0;
return NT_STATUS_OK;
case EPM_PROTOCOL_NCADG:
- floor->rhs.ncadg.minor_version = 0;
+ epm_floor->rhs.ncadg.minor_version = 0;
return NT_STATUS_OK;
case EPM_PROTOCOL_SMB:
- floor->rhs.smb.unc = talloc_strdup(mem_ctx, data);
- NT_STATUS_HAVE_NO_MEMORY(floor->rhs.smb.unc);
+ epm_floor->rhs.smb.unc = talloc_strdup(mem_ctx, data);
+ NT_STATUS_HAVE_NO_MEMORY(epm_floor->rhs.smb.unc);
return NT_STATUS_OK;
case EPM_PROTOCOL_PIPE:
- floor->rhs.pipe.path = talloc_strdup(mem_ctx, data);
- NT_STATUS_HAVE_NO_MEMORY(floor->rhs.pipe.path);
+ epm_floor->rhs.pipe.path = talloc_strdup(mem_ctx, data);
+ NT_STATUS_HAVE_NO_MEMORY(epm_floor->rhs.pipe.path);
return NT_STATUS_OK;
case EPM_PROTOCOL_NETBIOS:
- floor->rhs.netbios.name = talloc_strdup(mem_ctx, data);
- NT_STATUS_HAVE_NO_MEMORY(floor->rhs.netbios.name);
+ epm_floor->rhs.netbios.name = talloc_strdup(mem_ctx, data);
+ NT_STATUS_HAVE_NO_MEMORY(epm_floor->rhs.netbios.name);
return NT_STATUS_OK;
case EPM_PROTOCOL_NCALRPC:
return NT_STATUS_OK;
case EPM_PROTOCOL_VINES_SPP:
- floor->rhs.vines_spp.port = atoi(data);
+ epm_floor->rhs.vines_spp.port = atoi(data);
return NT_STATUS_OK;
case EPM_PROTOCOL_VINES_IPC:
- floor->rhs.vines_ipc.port = atoi(data);
+ epm_floor->rhs.vines_ipc.port = atoi(data);
return NT_STATUS_OK;
case EPM_PROTOCOL_STREETTALK:
- floor->rhs.streettalk.streettalk = talloc_strdup(mem_ctx, data);
- NT_STATUS_HAVE_NO_MEMORY(floor->rhs.streettalk.streettalk);
+ epm_floor->rhs.streettalk.streettalk = talloc_strdup(mem_ctx, data);
+ NT_STATUS_HAVE_NO_MEMORY(epm_floor->rhs.streettalk.streettalk);
return NT_STATUS_OK;
case EPM_PROTOCOL_UNIX_DS:
- floor->rhs.unix_ds.path = talloc_strdup(mem_ctx, data);
- NT_STATUS_HAVE_NO_MEMORY(floor->rhs.unix_ds.path);
+ epm_floor->rhs.unix_ds.path = talloc_strdup(mem_ctx, data);
+ NT_STATUS_HAVE_NO_MEMORY(epm_floor->rhs.unix_ds.path);
return NT_STATUS_OK;
case EPM_PROTOCOL_NULL:
return NT_STATUS_OK;
default:
- DEBUG(0,("Unsupported lhs protocol %d\n", floor->lhs.protocol));
+ DEBUG(0,("Unsupported lhs protocol %d\n", epm_floor->lhs.protocol));
break;
}
}
/* Unknown transport */
- return -1;
+ return (unsigned int)-1;
}
enum dcerpc_transport_t dcerpc_transport_by_tower(struct epm_tower *tower)
}
/* Unknown transport */
- return -1;
+ return (unsigned int)-1;
}
NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx, struct epm_tower *tower, struct dcerpc_binding **b_out)
ZERO_STRUCT(binding->object);
binding->options = NULL;
binding->host = NULL;
+ binding->target_hostname = NULL;
binding->flags = 0;
+ binding->assoc_group_id = 0;
binding->transport = dcerpc_transport_by_tower(tower);
- if (binding->transport == -1) {
+ if (binding->transport == (unsigned int)-1) {
return NT_STATUS_NOT_SUPPORTED;
}
}
/* Set object uuid */
- status = dcerpc_floor_get_lhs_data(&tower->floors[0], &binding->object, &binding->object_version);
+ status = dcerpc_floor_get_lhs_data(&tower->floors[0], &binding->object);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(1, ("Error pulling object uuid and version: %s", nt_errstr(status)));
/* Set network address */
if (tower->num_floors >= 5) {
binding->host = dcerpc_floor_get_rhs_data(mem_ctx, &tower->floors[4]);
+ NT_STATUS_HAVE_NO_MEMORY(binding->host);
+ binding->target_hostname = binding->host;
}
*b_out = binding;
return NT_STATUS_OK;
{
const enum epm_protocol *protseq = NULL;
int num_protocols = -1, i;
- struct GUID ndr_guid;
NTSTATUS status;
/* Find transport */
/* Floor 0 */
tower->floors[0].lhs.protocol = EPM_PROTOCOL_UUID;
- tower->floors[0].lhs.lhs_data = dcerpc_floor_pack_lhs_data(mem_ctx, &binding->object, binding->object_version);
+ tower->floors[0].lhs.lhs_data = dcerpc_floor_pack_lhs_data(mem_ctx, &binding->object);
tower->floors[0].rhs.uuid.unknown = data_blob_talloc_zero(mem_ctx, 2);
/* Floor 1 */
tower->floors[1].lhs.protocol = EPM_PROTOCOL_UUID;
- status = GUID_from_string(NDR_GUID, &ndr_guid);
- if (NT_STATUS_IS_ERR(status)) {
- return status;
- }
-
- tower->floors[1].lhs.lhs_data = dcerpc_floor_pack_lhs_data(mem_ctx, &ndr_guid, NDR_GUID_VERSION);
+ tower->floors[1].lhs.lhs_data = dcerpc_floor_pack_lhs_data(mem_ctx,
+ &ndr_transfer_syntax);
tower->floors[1].rhs.uuid.unknown = data_blob_talloc_zero(mem_ctx, 2);
/* The 5th contains the network address */
if (num_protocols >= 3 && binding->host) {
- status = dcerpc_floor_set_rhs_data(mem_ctx, &tower->floors[4], binding->host);
+ if (is_ipaddress(binding->host)) {
+ status = dcerpc_floor_set_rhs_data(mem_ctx, &tower->floors[4],
+ binding->host);
+ } else {
+ /* note that we don't attempt to resolve the
+ name here - when we get a hostname here we
+ are in the client code, and want to put in
+ a wildcard all-zeros IP for the server to
+ fill in */
+ status = dcerpc_floor_set_rhs_data(mem_ctx, &tower->floors[4],
+ "0.0.0.0");
+ }
if (NT_STATUS_IS_ERR(status)) {
return status;
}
return NT_STATUS_OK;
}
-NTSTATUS dcerpc_epm_map_binding(TALLOC_CTX *mem_ctx, struct dcerpc_binding *binding,
- const char *uuid, uint_t version)
-{
- struct dcerpc_pipe *p;
- NTSTATUS status;
- struct epm_Map r;
+
+struct epm_map_binding_state {
+ struct dcerpc_binding *binding;
+ const struct dcerpc_interface_table *table;
+ struct dcerpc_pipe *pipe;
struct policy_handle handle;
struct GUID guid;
- struct epm_twr_t twr, *twr_r;
+ struct epm_twr_t twr;
+ struct epm_twr_t *twr_r;
+ struct epm_Map r;
+};
+
+
+static void continue_epm_recv_binding(struct composite_context *ctx);
+static void continue_epm_map(struct rpc_request *req);
+
+
+/*
+ Stage 2 of epm_map_binding: Receive connected rpc pipe and send endpoint
+ mapping rpc request
+*/
+static void continue_epm_recv_binding(struct composite_context *ctx)
+{
+ struct rpc_request *map_req;
+
+ struct composite_context *c = talloc_get_type(ctx->async.private_data,
+ struct composite_context);
+ struct epm_map_binding_state *s = talloc_get_type(c->private_data,
+ struct epm_map_binding_state);
+
+ /* receive result of rpc pipe connect request */
+ c->status = dcerpc_pipe_connect_b_recv(ctx, c, &s->pipe);
+ if (!composite_is_ok(c)) return;
+
+ s->pipe->conn->flags |= DCERPC_NDR_REF_ALLOC;
+
+ /* prepare requested binding parameters */
+ s->binding->object = s->table->syntax_id;
+
+ c->status = dcerpc_binding_build_tower(s->pipe, s->binding, &s->twr.tower);
+ if (!composite_is_ok(c)) return;
+
+ /* with some nice pretty paper around it of course */
+ s->r.in.object = &s->guid;
+ s->r.in.map_tower = &s->twr;
+ s->r.in.entry_handle = &s->handle;
+ s->r.in.max_towers = 1;
+ s->r.out.entry_handle = &s->handle;
+
+ /* send request for an endpoint mapping - a rpc request on connected pipe */
+ map_req = dcerpc_epm_Map_send(s->pipe, c, &s->r);
+ if (composite_nomem(map_req, c)) return;
+
+ composite_continue_rpc(c, map_req, continue_epm_map, c);
+}
+
+
+/*
+ Stage 3 of epm_map_binding: Receive endpoint mapping and provide binding details
+*/
+static void continue_epm_map(struct rpc_request *req)
+{
+ struct composite_context *c = talloc_get_type(req->async.private_data,
+ struct composite_context);
+ struct epm_map_binding_state *s = talloc_get_type(c->private_data,
+ struct epm_map_binding_state);
+
+ /* receive result of a rpc request */
+ c->status = dcerpc_ndr_request_recv(req);
+ if (!composite_is_ok(c)) return;
+
+ /* check the details */
+ if (s->r.out.result != 0 || *s->r.out.num_towers != 1) {
+ composite_error(c, NT_STATUS_PORT_UNREACHABLE);
+ return;
+ }
+
+ s->twr_r = s->r.out.towers[0].twr;
+ if (s->twr_r == NULL) {
+ composite_error(c, NT_STATUS_PORT_UNREACHABLE);
+ return;
+ }
+
+ if (s->twr_r->tower.num_floors != s->twr.tower.num_floors ||
+ s->twr_r->tower.floors[3].lhs.protocol != s->twr.tower.floors[3].lhs.protocol) {
+ composite_error(c, NT_STATUS_PORT_UNREACHABLE);
+ return;
+ }
+
+ /* get received endpoint */
+ s->binding->endpoint = talloc_reference(s->binding,
+ dcerpc_floor_get_rhs_data(c, &s->twr_r->tower.floors[3]));
+ if (composite_nomem(s->binding->endpoint, c)) return;
+
+ composite_done(c);
+}
+
+
+/*
+ Request for endpoint mapping of dcerpc binding - try to request for endpoint
+ unless there is default one.
+*/
+struct composite_context *dcerpc_epm_map_binding_send(TALLOC_CTX *mem_ctx,
+ struct dcerpc_binding *binding,
+ const struct dcerpc_interface_table *table,
+ struct event_context *ev)
+{
+ struct composite_context *c;
+ struct epm_map_binding_state *s;
+ struct composite_context *pipe_connect_req;
+ struct cli_credentials *anon_creds;
+ struct event_context *new_ev = NULL;
+
+ NTSTATUS status;
struct dcerpc_binding *epmapper_binding;
- const struct dcerpc_interface_table *table = idl_iface_by_uuid(uuid);
int i;
- struct cli_credentials *anon_creds
- = cli_credentials_init(mem_ctx);
- cli_credentials_set_anonymous(anon_creds);
- cli_credentials_guess(anon_creds);
+ /* Try to find event context in memory context in case passed
+ * event_context (argument) was NULL. If there's none, just
+ * create a new one.
+ */
+ if (ev == NULL) {
+ ev = event_context_find(mem_ctx);
+ if (ev == NULL) {
+ new_ev = event_context_init(mem_ctx);
+ if (new_ev == NULL) return NULL;
+ ev = new_ev;
+ }
+ }
+
+ /* composite context allocation and setup */
+ c = composite_create(mem_ctx, ev);
+ if (c == NULL) {
+ talloc_free(new_ev);
+ return NULL;
+ }
+ talloc_steal(c, new_ev);
+
+ s = talloc_zero(c, struct epm_map_binding_state);
+ if (composite_nomem(s, c)) return c;
+ c->private_data = s;
- /* First, check if there is a default endpoint specified in the IDL */
+ s->binding = binding;
+ s->table = table;
+ /* anonymous credentials for rpc connection used to get endpoint mapping */
+ anon_creds = cli_credentials_init(mem_ctx);
+ cli_credentials_set_event_context(anon_creds, ev);
+ cli_credentials_set_conf(anon_creds);
+ cli_credentials_set_anonymous(anon_creds);
+
+ /*
+ First, check if there is a default endpoint specified in the IDL
+ */
if (table) {
struct dcerpc_binding *default_binding;
- binding->authservice = talloc_strdup(binding, table->authservices->names[0]);
-
/* Find one of the default pipes for this interface */
for (i = 0; i < table->endpoints->count; i++) {
status = dcerpc_parse_binding(mem_ctx, table->endpoints->names[i], &default_binding);
if (default_binding->transport == binding->transport && default_binding->endpoint) {
binding->endpoint = talloc_reference(binding, default_binding->endpoint);
talloc_free(default_binding);
- return NT_STATUS_OK;
+
+ composite_done(c);
+ return c;
+
} else {
talloc_free(default_binding);
}
}
}
- epmapper_binding = talloc_zero(mem_ctx, struct dcerpc_binding);
- if (!epmapper_binding) {
- return NT_STATUS_NO_MEMORY;
- }
-
- epmapper_binding->transport = binding->transport;
- epmapper_binding->host = talloc_reference(epmapper_binding,
- binding->host);
- epmapper_binding->options = NULL;
- epmapper_binding->flags = 0;
- epmapper_binding->endpoint = NULL;
- epmapper_binding->authservice = NULL;
-
- status = dcerpc_pipe_connect_b(mem_ctx,
- &p,
- epmapper_binding,
- DCERPC_EPMAPPER_UUID,
- DCERPC_EPMAPPER_VERSION,
- anon_creds);
-
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
+ epmapper_binding = talloc_zero(c, struct dcerpc_binding);
+ if (composite_nomem(epmapper_binding, c)) return c;
- ZERO_STRUCT(handle);
- ZERO_STRUCT(guid);
+ /* basic endpoint mapping data */
+ epmapper_binding->transport = binding->transport;
+ epmapper_binding->host = talloc_reference(epmapper_binding, binding->host);
+ epmapper_binding->target_hostname = epmapper_binding->host;
+ epmapper_binding->options = NULL;
+ epmapper_binding->flags = 0;
+ epmapper_binding->assoc_group_id = 0;
+ epmapper_binding->endpoint = NULL;
- status = GUID_from_string(uuid, &binding->object);
- if (NT_STATUS_IS_ERR(status)) {
- return status;
- }
+ /* initiate rpc pipe connection */
+ pipe_connect_req = dcerpc_pipe_connect_b_send(c, epmapper_binding, &dcerpc_table_epmapper,
+ anon_creds, c->event_ctx);
+ if (composite_nomem(pipe_connect_req, c)) return c;
+
+ composite_continue(c, pipe_connect_req, continue_epm_recv_binding, c);
+ return c;
+}
- binding->object_version = version;
- status = dcerpc_binding_build_tower(p, binding, &twr.tower);
- if (NT_STATUS_IS_ERR(status)) {
- return status;
- }
+/*
+ Receive result of endpoint mapping request
+ */
+NTSTATUS dcerpc_epm_map_binding_recv(struct composite_context *c)
+{
+ NTSTATUS status = composite_wait(c);
+
+ talloc_free(c);
+ return status;
+}
- /* with some nice pretty paper around it of course */
- r.in.object = &guid;
- r.in.map_tower = &twr;
- r.in.entry_handle = &handle;
- r.in.max_towers = 1;
- r.out.entry_handle = &handle;
- status = dcerpc_epm_Map(p, p, &r);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p);
- return status;
- }
- if (r.out.result != 0 || r.out.num_towers != 1) {
- talloc_free(p);
- return NT_STATUS_PORT_UNREACHABLE;
- }
+/*
+ Get endpoint mapping for rpc connection
+*/
+NTSTATUS dcerpc_epm_map_binding(TALLOC_CTX *mem_ctx, struct dcerpc_binding *binding,
+ const struct dcerpc_interface_table *table, struct event_context *ev)
+{
+ struct composite_context *c;
- twr_r = r.out.towers[0].twr;
- if (!twr_r) {
- talloc_free(p);
- return NT_STATUS_PORT_UNREACHABLE;
- }
+ c = dcerpc_epm_map_binding_send(mem_ctx, binding, table, ev);
+ return dcerpc_epm_map_binding_recv(c);
+}
- if (twr_r->tower.num_floors != twr.tower.num_floors ||
- twr_r->tower.floors[3].lhs.protocol != twr.tower.floors[3].lhs.protocol) {
- talloc_free(p);
- return NT_STATUS_PORT_UNREACHABLE;
- }
- binding->endpoint = talloc_reference(binding, dcerpc_floor_get_rhs_data(mem_ctx, &twr_r->tower.floors[3]));
+struct pipe_auth_state {
+ struct dcerpc_pipe *pipe;
+ struct dcerpc_binding *binding;
+ const struct dcerpc_interface_table *table;
+ struct cli_credentials *credentials;
+};
- talloc_free(p);
- return NT_STATUS_OK;
-}
+static void continue_auth_schannel(struct composite_context *ctx);
+static void continue_auth(struct composite_context *ctx);
+static void continue_auth_none(struct composite_context *ctx);
+static void continue_ntlmssp_connection(struct composite_context *ctx);
+static void continue_spnego_after_wrong_pass(struct composite_context *ctx);
-/*
- perform an authenticated bind if needed
+/*
+ Stage 2 of pipe_auth: Receive result of schannel bind request
*/
-NTSTATUS dcerpc_pipe_auth(struct dcerpc_pipe *p,
- struct dcerpc_binding *binding,
- const char *pipe_uuid,
- uint32_t pipe_version,
- struct cli_credentials *credentials)
+static void continue_auth_schannel(struct composite_context *ctx)
{
- NTSTATUS status;
- TALLOC_CTX *tmp_ctx;
- tmp_ctx = talloc_new(p);
+ struct composite_context *c = talloc_get_type(ctx->async.private_data,
+ struct composite_context);
- p->conn->flags = binding->flags;
+ c->status = dcerpc_bind_auth_schannel_recv(ctx);
+ if (!composite_is_ok(c)) return;
- /* remember the binding string for possible secondary connections */
- p->conn->binding_string = dcerpc_binding_string(p, binding);
-
- if (!cli_credentials_is_anonymous(credentials) &&
- (binding->flags & DCERPC_SCHANNEL_ANY) &&
- !cli_credentials_get_netlogon_creds(credentials)) {
-
- /* If we don't already have netlogon credentials for
- * the schannel bind, then we have to get these
- * first */
- status = dcerpc_bind_auth_schannel(tmp_ctx,
- p, pipe_uuid, pipe_version,
- credentials);
- } else if (!cli_credentials_is_anonymous(credentials)) {
- uint8_t auth_type;
- if (binding->flags & DCERPC_AUTH_SPNEGO) {
- auth_type = DCERPC_AUTH_TYPE_SPNEGO;
- } else if (binding->flags & DCERPC_AUTH_KRB5) {
- auth_type = DCERPC_AUTH_TYPE_KRB5;
- } else if (binding->flags & DCERPC_SCHANNEL_ANY) {
- auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
- } else {
- auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
- }
-
- status = dcerpc_bind_auth_password(p, pipe_uuid, pipe_version,
- credentials, auth_type,
- binding->authservice);
- } else {
- status = dcerpc_bind_auth_none(p, pipe_uuid, pipe_version);
- }
-
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to bind to uuid %s - %s\n", pipe_uuid, nt_errstr(status)));
- }
- talloc_free(tmp_ctx);
- return status;
+ composite_done(c);
}
-/* open a rpc connection to a rpc pipe on SMB using the binding
- structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncacn_np(TALLOC_CTX *tmp_ctx,
- struct dcerpc_pipe *p,
- struct dcerpc_binding *binding,
- const char *pipe_uuid,
- uint32_t pipe_version,
- struct cli_credentials *credentials)
+/*
+ Stage 2 of pipe_auth: Receive result of authenticated bind request
+*/
+static void continue_auth(struct composite_context *ctx)
{
- NTSTATUS status;
- struct smbcli_state *cli;
- const char *pipe_name = NULL;
-
- if (binding->flags & DCERPC_SCHANNEL_ANY) {
- struct cli_credentials *anon_creds
- = cli_credentials_init(tmp_ctx);
- cli_credentials_set_anonymous(anon_creds);
- cli_credentials_guess(anon_creds);
- status = smbcli_full_connection(p->conn, &cli,
- binding->host,
- "IPC$", NULL,
- anon_creds);
- } else {
- status = smbcli_full_connection(p->conn, &cli,
- binding->host,
- "IPC$", NULL,
- credentials);
- }
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to connect to %s - %s\n", binding->host, nt_errstr(status)));
- return status;
- }
-
- /* Look up identifier using the epmapper */
- if (!binding->endpoint) {
- status = dcerpc_epm_map_binding(tmp_ctx, binding, pipe_uuid, pipe_version);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to map DCERPC/TCP NCACN_NP pipe for '%s' - %s\n",
- pipe_uuid, nt_errstr(status)));
- return status;
- }
- DEBUG(1,("Mapped to DCERPC/NP pipe %s\n", binding->endpoint));
- }
-
- pipe_name = binding->endpoint;
+ struct composite_context *c = talloc_get_type(ctx->async.private_data,
+ struct composite_context);
- status = dcerpc_pipe_open_smb(p->conn, cli->tree, pipe_name);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to open pipe %s - %s\n", pipe_name, nt_errstr(status)));
- return status;
- }
-
- return NT_STATUS_OK;
+ c->status = dcerpc_bind_auth_recv(ctx);
+ if (!composite_is_ok(c)) return;
+
+ composite_done(c);
}
-
-/* open a rpc connection to a rpc pipe on SMP using the binding
- structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncalrpc(TALLOC_CTX *tmp_ctx,
- struct dcerpc_pipe *p,
- struct dcerpc_binding *binding,
- const char *pipe_uuid,
- uint32_t pipe_version)
+/*
+ Stage 2 of pipe_auth: Receive result of authenticated bind request, but handle fallbacks:
+ SPNEGO -> NTLMSSP
+*/
+static void continue_auth_auto(struct composite_context *ctx)
{
- NTSTATUS status;
-
- /* Look up identifier using the epmapper */
- if (!binding->endpoint) {
- status = dcerpc_epm_map_binding(tmp_ctx, binding, pipe_uuid, pipe_version);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to map DCERPC/TCP NCALRPC identifier for '%s' - %s\n",
- pipe_uuid, nt_errstr(status)));
- return status;
+ struct composite_context *c = talloc_get_type(ctx->async.private_data,
+ struct composite_context);
+ struct pipe_auth_state *s = talloc_get_type(c->private_data, struct pipe_auth_state);
+ struct composite_context *sec_conn_req;
+
+ c->status = dcerpc_bind_auth_recv(ctx);
+ if (NT_STATUS_EQUAL(c->status, NT_STATUS_INVALID_PARAMETER)) {
+ /*
+ * Retry with NTLMSSP auth as fallback
+ * send a request for secondary rpc connection
+ */
+ sec_conn_req = dcerpc_secondary_connection_send(s->pipe,
+ s->binding);
+ composite_continue(c, sec_conn_req, continue_ntlmssp_connection, c);
+ return;
+ } else if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
+ if (cli_credentials_wrong_password(s->credentials)) {
+ /*
+ * Retry SPNEGO with a better password
+ * send a request for secondary rpc connection
+ */
+ sec_conn_req = dcerpc_secondary_connection_send(s->pipe,
+ s->binding);
+ composite_continue(c, sec_conn_req, continue_spnego_after_wrong_pass, c);
+ return;
}
- DEBUG(1,("Mapped to DCERPC/LRPC identifier %s\n", binding->endpoint));
}
- status = dcerpc_pipe_open_pipe(p->conn, binding->endpoint);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to open ncalrpc pipe '%s' - %s\n",
- binding->endpoint, nt_errstr(status)));
- return status;
- }
+ if (!composite_is_ok(c)) return;
- return status;
+ composite_done(c);
}
-
-
-/* open a rpc connection to a rpc pipe on SMP using the binding
- structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncacn_unix_stream(TALLOC_CTX *tmp_ctx,
- struct dcerpc_pipe *p,
- struct dcerpc_binding *binding,
- const char *pipe_uuid,
- uint32_t pipe_version)
+/*
+ Stage 3 of pipe_auth (fallback to NTLMSSP case): Receive secondary
+ rpc connection (the first one can't be used any more, due to the
+ bind nak) and perform authenticated bind request
+*/
+static void continue_ntlmssp_connection(struct composite_context *ctx)
{
- NTSTATUS status;
+ struct composite_context *c;
+ struct pipe_auth_state *s;
+ struct composite_context *auth_req;
+ struct dcerpc_pipe *p2;
- if (!binding->endpoint) {
- DEBUG(0, ("Path to unix socket not specified\n"));
- return NT_STATUS_INVALID_PARAMETER;
- }
+ c = talloc_get_type(ctx->async.private_data, struct composite_context);
+ s = talloc_get_type(c->private_data, struct pipe_auth_state);
- status = dcerpc_pipe_open_unix_stream(p->conn, binding->endpoint);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to open unix socket %s - %s\n",
- binding->endpoint, nt_errstr(status)));
- talloc_free(p);
- return status;
- }
+ /* receive secondary rpc connection */
+ c->status = dcerpc_secondary_connection_recv(ctx, &p2);
+ if (!composite_is_ok(c)) return;
- return status;
+ talloc_steal(s, p2);
+ talloc_steal(p2, s->pipe);
+ s->pipe = p2;
+
+ /* initiate a authenticated bind */
+ auth_req = dcerpc_bind_auth_send(c, s->pipe, s->table,
+ s->credentials, DCERPC_AUTH_TYPE_NTLMSSP,
+ dcerpc_auth_level(s->pipe->conn),
+ s->table->authservices->names[0]);
+ composite_continue(c, auth_req, continue_auth, c);
}
-/* open a rpc connection to a rpc pipe on TCP/IP sockets using the binding
- structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncacn_ip_tcp(TALLOC_CTX *tmp_ctx,
- struct dcerpc_pipe *p,
- struct dcerpc_binding *binding,
- const char *pipe_uuid,
- uint32_t pipe_version)
+/*
+ Stage 3 of pipe_auth (retry on wrong password): Receive secondary
+ rpc connection (the first one can't be used any more, due to the
+ bind nak) and perform authenticated bind request
+*/
+static void continue_spnego_after_wrong_pass(struct composite_context *ctx)
{
- NTSTATUS status;
- uint32_t port = 0;
-
- if (!binding->endpoint) {
- status = dcerpc_epm_map_binding(tmp_ctx, binding,
- pipe_uuid, pipe_version);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to map DCERPC/TCP port for '%s' - %s\n",
- pipe_uuid, nt_errstr(status)));
- return status;
- }
- DEBUG(1,("Mapped to DCERPC/TCP port %s\n", binding->endpoint));
- }
+ struct composite_context *c;
+ struct pipe_auth_state *s;
+ struct composite_context *auth_req;
+ struct dcerpc_pipe *p2;
- port = atoi(binding->endpoint);
+ c = talloc_get_type(ctx->async.private_data, struct composite_context);
+ s = talloc_get_type(c->private_data, struct pipe_auth_state);
- status = dcerpc_pipe_open_tcp(p->conn, binding->host, port);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to connect to %s:%d - %s\n",
- binding->host, port, nt_errstr(status)));
- return status;
- }
+ /* receive secondary rpc connection */
+ c->status = dcerpc_secondary_connection_recv(ctx, &p2);
+ if (!composite_is_ok(c)) return;
+
+ talloc_steal(s, p2);
+ talloc_steal(p2, s->pipe);
+ s->pipe = p2;
- return status;
+ /* initiate a authenticated bind */
+ auth_req = dcerpc_bind_auth_send(c, s->pipe, s->table,
+ s->credentials, DCERPC_AUTH_TYPE_SPNEGO,
+ dcerpc_auth_level(s->pipe->conn),
+ s->table->authservices->names[0]);
+ composite_continue(c, auth_req, continue_auth, c);
}
-/* open a rpc connection to a rpc pipe, using the specified
- binding structure to determine the endpoint and options */
-NTSTATUS dcerpc_pipe_connect_b(TALLOC_CTX *parent_ctx,
- struct dcerpc_pipe **pp,
- struct dcerpc_binding *binding,
- const char *pipe_uuid,
- uint32_t pipe_version,
- struct cli_credentials *credentials)
+/*
+ Stage 2 of pipe_auth: Receive result of non-authenticated bind request
+*/
+static void continue_auth_none(struct composite_context *ctx)
{
- NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
- struct dcerpc_pipe *p;
+ struct composite_context *c = talloc_get_type(ctx->async.private_data,
+ struct composite_context);
+
+ c->status = dcerpc_bind_auth_none_recv(ctx);
+ if (!composite_is_ok(c)) return;
- TALLOC_CTX *tmp_ctx;
+ composite_done(c);
+}
- (*pp) = NULL;
- p = dcerpc_pipe_init(parent_ctx);
- if (p == NULL) {
- return NT_STATUS_NO_MEMORY;
- }
- tmp_ctx = talloc_named(p, 0, "dcerpc_pipe_connect_b tmp_ctx");
+/*
+ Request to perform an authenticated bind if required. Authentication
+ is determined using credentials passed and binding flags.
+*/
+struct composite_context *dcerpc_pipe_auth_send(struct dcerpc_pipe *p,
+ struct dcerpc_binding *binding,
+ const struct dcerpc_interface_table *table,
+ struct cli_credentials *credentials)
+{
+ struct composite_context *c;
+ struct pipe_auth_state *s;
+ struct composite_context *auth_schannel_req;
+ struct composite_context *auth_req;
+ struct composite_context *auth_none_req;
+ struct dcerpc_connection *conn;
+ uint8_t auth_type;
+
+ /* composite context allocation and setup */
+ c = composite_create(p, p->conn->event_ctx);
+ if (c == NULL) return NULL;
+
+ s = talloc_zero(c, struct pipe_auth_state);
+ if (composite_nomem(s, c)) return c;
+ c->private_data = s;
+
+ /* store parameters in state structure */
+ s->binding = binding;
+ s->table = table;
+ s->credentials = credentials;
+ s->pipe = p;
+
+ conn = s->pipe->conn;
+ conn->flags = binding->flags;
+
+ /* remember the binding string for possible secondary connections */
+ conn->binding_string = dcerpc_binding_string(p, binding);
- switch (binding->transport) {
- case NCACN_NP:
- status = dcerpc_pipe_connect_ncacn_np(tmp_ctx,
- p, binding, pipe_uuid, pipe_version, credentials);
- break;
- case NCACN_IP_TCP:
- status = dcerpc_pipe_connect_ncacn_ip_tcp(tmp_ctx,
- p, binding, pipe_uuid, pipe_version);
- break;
- case NCACN_UNIX_STREAM:
- status = dcerpc_pipe_connect_ncacn_unix_stream(tmp_ctx,
- p, binding, pipe_uuid, pipe_version);
- break;
- case NCALRPC:
- status = dcerpc_pipe_connect_ncalrpc(tmp_ctx,
- p, binding, pipe_uuid, pipe_version);
- break;
- default:
- return NT_STATUS_NOT_SUPPORTED;
+ if (cli_credentials_is_anonymous(s->credentials)) {
+ auth_none_req = dcerpc_bind_auth_none_send(c, s->pipe, s->table);
+ composite_continue(c, auth_none_req, continue_auth_none, c);
+ return c;
}
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p);
- return status;
+ if ((binding->flags & DCERPC_SCHANNEL) &&
+ !cli_credentials_get_netlogon_creds(s->credentials)) {
+ /* If we don't already have netlogon credentials for
+ * the schannel bind, then we have to get these
+ * first */
+ auth_schannel_req = dcerpc_bind_auth_schannel_send(c, s->pipe, s->table,
+ s->credentials,
+ dcerpc_auth_level(conn));
+ composite_continue(c, auth_schannel_req, continue_auth_schannel, c);
+ return c;
}
- status = dcerpc_pipe_auth(p, binding, pipe_uuid, pipe_version, credentials);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p);
- return status;
+ /*
+ * we rely on the already authenticated CIFS connection
+ * if not doing sign or seal
+ */
+ if (conn->transport.transport == NCACN_NP &&
+ !(s->binding->flags & (DCERPC_SIGN|DCERPC_SEAL))) {
+ auth_none_req = dcerpc_bind_auth_none_send(c, s->pipe, s->table);
+ composite_continue(c, auth_none_req, continue_auth_none, c);
+ return c;
}
- *pp = p;
- talloc_free(tmp_ctx);
-
- return status;
-}
-/* open a rpc connection to a rpc pipe, using the specified string
- binding to determine the endpoint and options */
-NTSTATUS dcerpc_pipe_connect(TALLOC_CTX *parent_ctx,
- struct dcerpc_pipe **pp,
- const char *binding,
- const char *pipe_uuid,
- uint32_t pipe_version,
- struct cli_credentials *credentials)
-{
- struct dcerpc_binding *b;
- NTSTATUS status;
- TALLOC_CTX *tmp_ctx;
-
- tmp_ctx = talloc_named(parent_ctx, 0, "dcerpc_pipe_connect tmp_ctx");
- if (!tmp_ctx) {
- return NT_STATUS_NO_MEMORY;
+ /* Perform an authenticated DCE-RPC bind
+ */
+ if (!(conn->flags & (DCERPC_SIGN|DCERPC_SEAL))) {
+ /*
+ we are doing an authenticated connection,
+ but not using sign or seal. We must force
+ the CONNECT dcerpc auth type as a NONE auth
+ type doesn't allow authentication
+ information to be passed.
+ */
+ conn->flags |= DCERPC_CONNECT;
}
- status = dcerpc_parse_binding(tmp_ctx, binding, &b);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to parse dcerpc binding '%s'\n", binding));
- talloc_free(tmp_ctx);
- return status;
- }
+ if (s->binding->flags & DCERPC_AUTH_SPNEGO) {
+ auth_type = DCERPC_AUTH_TYPE_SPNEGO;
- DEBUG(3,("Using binding %s\n", dcerpc_binding_string(tmp_ctx, b)));
+ } else if (s->binding->flags & DCERPC_AUTH_KRB5) {
+ auth_type = DCERPC_AUTH_TYPE_KRB5;
- status = dcerpc_pipe_connect_b(tmp_ctx,
- pp, b, pipe_uuid, pipe_version, credentials);
+ } else if (s->binding->flags & DCERPC_SCHANNEL) {
+ auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
- if (NT_STATUS_IS_OK(status)) {
- *pp = talloc_reference(parent_ctx, *pp);
- }
- talloc_free(tmp_ctx);
+ } else if (s->binding->flags & DCERPC_AUTH_NTLM) {
+ auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
- return status;
+ } else {
+ /* try SPNEGO with fallback to NTLMSSP */
+ auth_req = dcerpc_bind_auth_send(c, s->pipe, s->table,
+ s->credentials, DCERPC_AUTH_TYPE_SPNEGO,
+ dcerpc_auth_level(conn),
+ s->table->authservices->names[0]);
+ composite_continue(c, auth_req, continue_auth_auto, c);
+ return c;
+ }
+
+ auth_req = dcerpc_bind_auth_send(c, s->pipe, s->table,
+ s->credentials, auth_type,
+ dcerpc_auth_level(conn),
+ s->table->authservices->names[0]);
+ composite_continue(c, auth_req, continue_auth, c);
+ return c;
}
/*
- create a secondary dcerpc connection from a primary connection
-
- if the primary is a SMB connection then the secondary connection
- will be on the same SMB connection, but use a new fnum
-*/
-NTSTATUS dcerpc_secondary_connection(struct dcerpc_pipe *p, struct dcerpc_pipe **p2,
- struct dcerpc_binding *b)
+ Receive result of authenticated bind request on dcerpc pipe
+ This returns *p, which may be different to the one originally
+ supllied, as it rebinds to a new pipe due to authentication fallback
+*/
+NTSTATUS dcerpc_pipe_auth_recv(struct composite_context *c, TALLOC_CTX *mem_ctx,
+ struct dcerpc_pipe **p)
{
- struct smbcli_tree *tree;
- NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
+ NTSTATUS status;
- (*p2) = dcerpc_pipe_init(p);
- if (*p2 == NULL) {
- return NT_STATUS_NO_MEMORY;
+ struct pipe_auth_state *s = talloc_get_type(c->private_data,
+ struct pipe_auth_state);
+ status = composite_wait(c);
+ if (!NT_STATUS_IS_OK(status)) {
+ char *uuid_str = GUID_string(s->pipe, &s->table->syntax_id.uuid);
+ DEBUG(0, ("Failed to bind to uuid %s - %s\n", uuid_str, nt_errstr(status)));
+ talloc_free(uuid_str);
+ } else {
+ talloc_steal(mem_ctx, s->pipe);
+ *p = s->pipe;
}
-
- switch (p->conn->transport.transport) {
- case NCACN_NP:
- tree = dcerpc_smb_tree(p->conn);
- if (!tree) {
- return NT_STATUS_INVALID_PARAMETER;
- }
- status = dcerpc_pipe_open_smb((*p2)->conn, tree, b->endpoint);
- break;
-
- case NCACN_IP_TCP:
- status = dcerpc_pipe_open_tcp((*p2)->conn, b->host, atoi(b->endpoint));
- break;
- case NCALRPC:
- status = dcerpc_pipe_open_pipe((*p2)->conn, b->endpoint);
- break;
+ talloc_free(c);
+ return status;
+}
- default:
- return NT_STATUS_NOT_SUPPORTED;
- }
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(*p2);
- return status;
- }
+/*
+ Perform an authenticated bind if needed - sync version
- (*p2)->conn->flags = p->conn->flags;
+ This may change *p, as it rebinds to a new pipe due to authentication fallback
+*/
+NTSTATUS dcerpc_pipe_auth(TALLOC_CTX *mem_ctx,
+ struct dcerpc_pipe **p,
+ struct dcerpc_binding *binding,
+ const struct dcerpc_interface_table *table,
+ struct cli_credentials *credentials)
+{
+ struct composite_context *c;
- return NT_STATUS_OK;
+ c = dcerpc_pipe_auth_send(*p, binding, table, credentials);
+ return dcerpc_pipe_auth_recv(c, mem_ctx, p);
}
+
NTSTATUS dcerpc_generic_session_key(struct dcerpc_connection *c,
DATA_BLOB *session_key)
{
*/
NTSTATUS dcerpc_secondary_context(struct dcerpc_pipe *p,
struct dcerpc_pipe **pp2,
- const char *pipe_uuid,
- uint32_t pipe_version)
+ const struct dcerpc_interface_table *table)
{
NTSTATUS status;
struct dcerpc_pipe *p2;
return NT_STATUS_NO_MEMORY;
}
p2->conn = talloc_reference(p2, p->conn);
+ p2->request_timeout = p->request_timeout;
p2->context_id = ++p->conn->next_context_id;
- status = GUID_from_string(pipe_uuid, &p2->syntax.uuid);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p2);
- return status;
- }
- p2->syntax.if_version = pipe_version;
+ p2->syntax = table->syntax_id;
- status = GUID_from_string(NDR_GUID, &p2->transfer_syntax.uuid);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p2);
- return status;
- }
- p2->transfer_syntax.if_version = NDR_GUID_VERSION;
+ p2->transfer_syntax = ndr_transfer_syntax;
+
+ p2->binding = talloc_reference(p2, p->binding);
status = dcerpc_alter_context(p2, p2, &p2->syntax, &p2->transfer_syntax);
if (!NT_STATUS_IS_OK(status)) {
git.samba.org / samba.git / blobdiff