2 Unix SMB/CIFS implementation.
4 dcerpc utility functions
6 Copyright (C) Andrew Tridgell 2003
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License as published by
10 the Free Software Foundation; either version 2 of the License, or
11 (at your option) any later version.
13 This program is distributed in the hope that it will be useful,
14 but WITHOUT ANY WARRANTY; without even the implied warranty of
15 MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
16 GNU General Public License for more details.
18 You should have received a copy of the GNU General Public License
19 along with this program; if not, write to the Free Software
20 Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
26 this ndr_size_* stuff should really be auto-generated ....
29 static size_t ndr_size_epm_floor(struct epm_floor *fl)
32 if (fl->lhs.protocol == EPM_PROTOCOL_UUID) {
35 ret += fl->lhs.info.lhs_data.length;
37 ret += fl->rhs.rhs_data.length;
41 size_t ndr_size_epm_towers(struct epm_towers *towers)
45 for (i=0;i<towers->num_floors;i++) {
46 ret += ndr_size_epm_floor(&towers->floors[i]);
52 work out what TCP port to use for a given interface on a given host
54 NTSTATUS dcerpc_epm_map_tcp_port(const char *server,
55 const char *uuid, uint_t version,
58 struct dcerpc_pipe *p;
61 struct policy_handle handle;
63 struct epm_twr_t twr, *twr_r;
65 if (strcasecmp(uuid, DCERPC_EPMAPPER_UUID) == 0 ||
66 strcasecmp(uuid, DCERPC_MGMT_UUID) == 0) {
67 /* don't lookup epmapper via epmapper! */
68 *port = EPMAPPER_PORT;
72 status = dcerpc_pipe_open_tcp(&p, server, EPMAPPER_PORT, AF_UNSPEC );
73 if (!NT_STATUS_IS_OK(status)) {
77 /* we can use the pipes memory context here as we will have a short
79 status = dcerpc_bind_byuuid(p, p,
81 DCERPC_EPMAPPER_VERSION);
82 if (!NT_STATUS_IS_OK(status)) {
90 twr.towers.num_floors = 5;
91 twr.towers.floors = talloc(p, sizeof(twr.towers.floors[0]) * 5);
93 /* what I'd like for christmas ... */
95 /* an RPC interface ... */
96 twr.towers.floors[0].lhs.protocol = EPM_PROTOCOL_UUID;
97 GUID_from_string(uuid, &twr.towers.floors[0].lhs.info.uuid.uuid);
98 twr.towers.floors[0].lhs.info.uuid.version = version;
99 twr.towers.floors[0].rhs.rhs_data = data_blob_talloc_zero(p, 2);
101 /* encoded with NDR ... */
102 twr.towers.floors[1].lhs.protocol = EPM_PROTOCOL_UUID;
103 GUID_from_string(NDR_GUID, &twr.towers.floors[1].lhs.info.uuid.uuid);
104 twr.towers.floors[1].lhs.info.uuid.version = NDR_GUID_VERSION;
105 twr.towers.floors[1].rhs.rhs_data = data_blob_talloc_zero(p, 2);
107 /* on an RPC connection ... */
108 twr.towers.floors[2].lhs.protocol = EPM_PROTOCOL_NCACN_RPC_C;
109 twr.towers.floors[2].lhs.info.lhs_data = data_blob(NULL, 0);
110 twr.towers.floors[2].rhs.rhs_data = data_blob_talloc_zero(p, 2);
112 /* on a TCP port ... */
113 twr.towers.floors[3].lhs.protocol = EPM_PROTOCOL_NCACN_TCP;
114 twr.towers.floors[3].lhs.info.lhs_data = data_blob(NULL, 0);
115 twr.towers.floors[3].rhs.rhs_data = data_blob_talloc_zero(p, 2);
117 /* on an IP link ... */
118 twr.towers.floors[4].lhs.protocol = EPM_PROTOCOL_NCACN_IP;
119 twr.towers.floors[4].lhs.info.lhs_data = data_blob(NULL, 0);
120 twr.towers.floors[4].rhs.rhs_data = data_blob_talloc_zero(p, 4);
122 /* with some nice pretty paper around it of course */
124 r.in.map_tower = &twr;
125 r.in.entry_handle = &handle;
127 r.out.entry_handle = &handle;
129 status = dcerpc_epm_Map(p, p, &r);
130 if (!NT_STATUS_IS_OK(status)) {
131 dcerpc_pipe_close(p);
134 if (r.out.result != 0 || r.out.num_towers != 1) {
135 dcerpc_pipe_close(p);
136 return NT_STATUS_PORT_UNREACHABLE;
139 twr_r = r.out.towers[0].twr;
141 dcerpc_pipe_close(p);
142 return NT_STATUS_PORT_UNREACHABLE;
145 if (twr_r->towers.num_floors != 5 ||
146 twr_r->towers.floors[3].lhs.protocol != twr.towers.floors[3].lhs.protocol ||
147 twr_r->towers.floors[3].rhs.rhs_data.length != 2) {
148 dcerpc_pipe_close(p);
149 return NT_STATUS_PORT_UNREACHABLE;
152 *port = RSVAL(twr_r->towers.floors[3].rhs.rhs_data.data, 0);
154 dcerpc_pipe_close(p);
161 find the pipe name for a local IDL interface
163 const char *idl_pipe_name(const char *uuid, uint32_t if_version)
166 for (i=0;dcerpc_pipes[i];i++) {
167 if (strcasecmp(dcerpc_pipes[i]->uuid, uuid) == 0 &&
168 dcerpc_pipes[i]->if_version == if_version) {
169 return dcerpc_pipes[i]->name;
176 find the number of calls defined by local IDL
178 int idl_num_calls(const char *uuid, uint32_t if_version)
181 for (i=0;dcerpc_pipes[i];i++) {
182 if (strcasecmp(dcerpc_pipes[i]->uuid, uuid) == 0 &&
183 dcerpc_pipes[i]->if_version == if_version) {
184 return dcerpc_pipes[i]->num_calls;
192 find a dcerpc interface by name
194 const struct dcerpc_interface_table *idl_iface_by_name(const char *name)
197 for (i=0;dcerpc_pipes[i];i++) {
198 if (strcasecmp(dcerpc_pipes[i]->name, name) == 0) {
199 return dcerpc_pipes[i];
206 find a dcerpc interface by uuid
208 const struct dcerpc_interface_table *idl_iface_by_uuid(const char *uuid)
211 for (i=0;dcerpc_pipes[i];i++) {
212 if (strcasecmp(dcerpc_pipes[i]->uuid, uuid) == 0) {
213 return dcerpc_pipes[i];
222 push a dcerpc_packet into a blob, potentially with auth info
224 NTSTATUS dcerpc_push_auth(DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
225 struct dcerpc_packet *pkt,
226 struct dcerpc_auth *auth_info)
229 struct ndr_push *ndr;
231 ndr = ndr_push_init_ctx(mem_ctx);
233 return NT_STATUS_NO_MEMORY;
236 if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
237 ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
241 pkt->auth_length = auth_info->credentials.length;
243 pkt->auth_length = 0;
246 status = ndr_push_dcerpc_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
247 if (!NT_STATUS_IS_OK(status)) {
252 status = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, auth_info);
255 *blob = ndr_push_blob(ndr);
257 /* fill in the frag length */
258 dcerpc_set_frag_length(blob, blob->length);
264 static const struct {
266 enum dcerpc_transport_t transport;
267 } ncacn_transports[] = {
268 {"ncacn_np", NCACN_NP},
269 {"ncacn_ip_tcp", NCACN_IP_TCP}
272 static const struct {
275 } ncacn_options[] = {
276 {"sign", DCERPC_SIGN},
277 {"seal", DCERPC_SEAL},
278 {"validate", DCERPC_DEBUG_VALIDATE_BOTH},
279 {"print", DCERPC_DEBUG_PRINT_BOTH},
280 {"padcheck", DCERPC_DEBUG_PAD_CHECK},
281 {"bigendian", DCERPC_PUSH_BIGENDIAN}
285 form a binding string from a binding structure
287 const char *dcerpc_binding_string(TALLOC_CTX *mem_ctx, const struct dcerpc_binding *b)
291 const char *t_name=NULL;
293 for (i=0;i<ARRAY_SIZE(ncacn_transports);i++) {
294 if (ncacn_transports[i].transport == b->transport) {
295 t_name = ncacn_transports[i].name;
302 s = talloc_asprintf(mem_ctx, "%s:%s:[", t_name, b->host);
305 /* this is a *really* inefficent way of dealing with strings,
306 but this is rarely called and the strings are always short,
308 for (i=0;b->options && b->options[i];i++) {
309 s = talloc_asprintf(mem_ctx, "%s%s,", s, b->options[i]);
312 for (i=0;i<ARRAY_SIZE(ncacn_options);i++) {
313 if (b->flags & ncacn_options[i].flag) {
314 s = talloc_asprintf(mem_ctx, "%s%s,", s, ncacn_options[i].name);
318 if (s[strlen(s)-1] == ',') {
321 s = talloc_asprintf(mem_ctx, "%s]", s);
327 parse a binding string into a dcerpc_binding structure
329 NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struct dcerpc_binding *b)
331 char *part1, *part2, *part3;
333 int i, j, comma_count;
337 return NT_STATUS_INVALID_PARAMETER;
339 part1 = talloc_strndup(mem_ctx, s, PTR_DIFF(p, s));
341 return NT_STATUS_NO_MEMORY;
349 part2 = talloc_strndup(mem_ctx, s, PTR_DIFF(p, s));
350 part3 = talloc_strdup(mem_ctx, p+1);
351 if (part3[strlen(part3)-1] != ']') {
352 return NT_STATUS_INVALID_PARAMETER;
354 part3[strlen(part3)-1] = 0;
356 part2 = talloc_strdup(mem_ctx, s);
360 part2 = talloc_strndup(mem_ctx, s, PTR_DIFF(p, s));
361 part3 = talloc_strdup(mem_ctx, p+1);
364 return NT_STATUS_NO_MEMORY;
367 for (i=0;i<ARRAY_SIZE(ncacn_transports);i++) {
368 if (strcasecmp(part1, ncacn_transports[i].name) == 0) {
369 b->transport = ncacn_transports[i].transport;
373 if (i==ARRAY_SIZE(ncacn_transports)) {
374 DEBUG(0,("Unknown dcerpc transport '%s'\n", part1));
375 return NT_STATUS_INVALID_PARAMETER;
386 /* the [] brackets are optional */
387 if (*part3 == '[' && part3[strlen(part3)-1] == ']') {
389 part3[strlen(part3)-1] = 0;
392 comma_count = count_chars(part3, ',');
393 b->options = talloc_array_p(mem_ctx, const char *, comma_count+2);
395 return NT_STATUS_NO_MEMORY;
398 for (i=0; (p = strchr(part3, ',')); i++) {
399 b->options[i] = talloc_strndup(mem_ctx, part3, PTR_DIFF(p, part3));
400 if (!b->options[i]) {
401 return NT_STATUS_NO_MEMORY;
405 b->options[i] = part3;
406 b->options[i+1] = NULL;
408 /* some options are pre-parsed for convenience */
409 for (i=0;b->options[i];i++) {
410 for (j=0;j<ARRAY_SIZE(ncacn_options);j++) {
411 if (strcasecmp(ncacn_options[j].name, b->options[i]) == 0) {
413 b->flags |= ncacn_options[j].flag;
414 for (k=i;b->options[k];k++) {
415 b->options[k] = b->options[k+1];
427 /* open a rpc connection to a rpc pipe on SMB using the binding
428 structure to determine the endpoint and options */
429 static NTSTATUS dcerpc_pipe_connect_ncacn_np(struct dcerpc_pipe **p,
430 struct dcerpc_binding *binding,
431 const char *pipe_uuid,
432 uint32_t pipe_version,
434 const char *username,
435 const char *password)
439 struct smbcli_state *cli;
440 const char *pipe_name;
442 if (!binding->options || !binding->options[0]) {
443 const struct dcerpc_interface_table *table = idl_iface_by_uuid(pipe_uuid);
445 DEBUG(0,("Unknown interface endpoint '%s'\n", pipe_uuid));
446 return NT_STATUS_INVALID_PARAMETER;
448 /* only try the first endpoint for now */
449 pipe_name = table->endpoints->names[0];
451 pipe_name = binding->options[0];
454 if (strncasecmp(pipe_name, "\\pipe\\", 6) == 0) {
457 if (strncasecmp(pipe_name, "/pipe/", 6) == 0) {
461 if (!username || !username[0]) {
462 status = smbcli_full_connection(&cli, lp_netbios_name(),
465 "", "", NULL, 0, &retry);
467 status = smbcli_full_connection(&cli, lp_netbios_name(),
471 password, 0, &retry);
473 if (!NT_STATUS_IS_OK(status)) {
474 DEBUG(0,("Failed to connect to %s - %s\n", binding->host, nt_errstr(status)));
478 status = dcerpc_pipe_open_smb(p, cli->tree, pipe_name);
479 if (!NT_STATUS_IS_OK(status)) {
480 DEBUG(0,("Failed to open pipe %s - %s\n", pipe_name, nt_errstr(status)));
482 smbcli_shutdown(cli);
486 /* this ensures that the reference count is decremented so
487 a pipe close will really close the link */
488 smbcli_tree_close(cli->tree);
490 (*p)->flags = binding->flags;
492 /* remember the binding string for possible secondary connections */
493 (*p)->binding_string = dcerpc_binding_string((*p), binding);
495 if (username && username[0] && (binding->flags & DCERPC_SCHANNEL_ANY)) {
496 status = dcerpc_bind_auth_schannel(*p, pipe_uuid, pipe_version,
497 domain, username, password);
498 } else if (username && username[0] && (binding->flags & (DCERPC_SIGN | DCERPC_SEAL))) {
499 status = dcerpc_bind_auth_ntlm(*p, pipe_uuid, pipe_version, domain, username, password);
501 status = dcerpc_bind_auth_none(*p, pipe_uuid, pipe_version);
505 if (!NT_STATUS_IS_OK(status)) {
506 DEBUG(0,("Failed to bind to uuid %s - %s\n", pipe_uuid, nt_errstr(status)));
507 dcerpc_pipe_close(*p);
516 /* open a rpc connection to a rpc pipe on SMP using the binding
517 structure to determine the endpoint and options */
518 static NTSTATUS dcerpc_pipe_connect_ncacn_ip_tcp(struct dcerpc_pipe **p,
519 struct dcerpc_binding *binding,
520 const char *pipe_uuid,
521 uint32_t pipe_version,
523 const char *username,
524 const char *password)
529 if (binding->options && binding->options[0]) {
530 port = atoi(binding->options[0]);
534 status = dcerpc_epm_map_tcp_port(binding->host,
535 pipe_uuid, pipe_version,
537 if (!NT_STATUS_IS_OK(status)) {
538 DEBUG(0,("Failed to map DCERPC/TCP port for '%s' - %s\n",
539 pipe_uuid, nt_errstr(status)));
542 DEBUG(1,("Mapped to DCERPC/TCP port %u\n", port));
545 status = dcerpc_pipe_open_tcp(p, binding->host, port, AF_UNSPEC);
546 if (!NT_STATUS_IS_OK(status)) {
547 DEBUG(0,("Failed to connect to %s:%d\n", binding->host, port));
551 /* it doesn't seem to work to do a null NTLMSSP session without either sign
552 or seal, so force signing if we are doing ntlmssp */
553 if (username && username[0] && !(binding->flags & (DCERPC_SIGN|DCERPC_SEAL))) {
554 binding->flags |= DCERPC_SIGN;
557 (*p)->flags = binding->flags;
559 /* remember the binding string for possible secondary connections */
560 (*p)->binding_string = dcerpc_binding_string((*p), binding);
562 if (username && username[0] && (binding->flags & DCERPC_SCHANNEL_ANY)) {
563 status = dcerpc_bind_auth_schannel(*p, pipe_uuid, pipe_version,
564 domain, username, password);
565 } else if (username && username[0] && (binding->flags & (DCERPC_SIGN | DCERPC_SEAL))) {
566 status = dcerpc_bind_auth_ntlm(*p, pipe_uuid, pipe_version, domain, username, password);
568 status = dcerpc_bind_auth_none(*p, pipe_uuid, pipe_version);
571 if (!NT_STATUS_IS_OK(status)) {
572 DEBUG(0,("Failed to bind to uuid %s - %s\n",
573 pipe_uuid, nt_errstr(status)));
574 dcerpc_pipe_close(*p);
583 /* open a rpc connection to a rpc pipe, using the specified
584 binding structure to determine the endpoint and options */
585 NTSTATUS dcerpc_pipe_connect_b(struct dcerpc_pipe **p,
586 struct dcerpc_binding *binding,
587 const char *pipe_uuid,
588 uint32_t pipe_version,
590 const char *username,
591 const char *password)
593 NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
595 switch (binding->transport) {
597 status = dcerpc_pipe_connect_ncacn_np(p, binding, pipe_uuid, pipe_version,
598 domain, username, password);
601 status = dcerpc_pipe_connect_ncacn_ip_tcp(p, binding, pipe_uuid, pipe_version,
602 domain, username, password);
610 /* open a rpc connection to a rpc pipe, using the specified string
611 binding to determine the endpoint and options */
612 NTSTATUS dcerpc_pipe_connect(struct dcerpc_pipe **p,
614 const char *pipe_uuid,
615 uint32_t pipe_version,
617 const char *username,
618 const char *password)
620 struct dcerpc_binding b;
624 mem_ctx = talloc_init("dcerpc_pipe_connect");
625 if (!mem_ctx) return NT_STATUS_NO_MEMORY;
627 status = dcerpc_parse_binding(mem_ctx, binding, &b);
628 if (!NT_STATUS_IS_OK(status)) {
629 DEBUG(0,("Failed to parse dcerpc binding '%s'\n", binding));
630 talloc_destroy(mem_ctx);
634 DEBUG(3,("Using binding %s\n", dcerpc_binding_string(mem_ctx, &b)));
636 status = dcerpc_pipe_connect_b(p, &b, pipe_uuid, pipe_version, domain, username, password);
638 talloc_destroy(mem_ctx);
644 create a secondary dcerpc connection from a primary connection
646 if the primary is a SMB connection then the secondary connection
647 will be on the same SMB connection, but use a new fnum
649 NTSTATUS dcerpc_secondary_connection(struct dcerpc_pipe *p, struct dcerpc_pipe **p2,
650 const char *pipe_name,
651 const char *pipe_uuid,
652 uint32_t pipe_version)
654 struct smbcli_tree *tree;
655 NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
656 struct dcerpc_binding b;
658 switch (p->transport.transport) {
660 tree = dcerpc_smb_tree(p);
662 return NT_STATUS_INVALID_PARAMETER;
665 status = dcerpc_pipe_open_smb(p2, tree, pipe_name);
669 status = dcerpc_parse_binding(p, p->binding_string, &b);
670 if (!NT_STATUS_IS_OK(status)) {
673 b.flags &= ~DCERPC_AUTH_OPTIONS;
674 status = dcerpc_pipe_connect_ncacn_ip_tcp(p2, &b, pipe_uuid,
680 if (!NT_STATUS_IS_OK(status)) {
684 (*p2)->flags = p->flags;
686 status = dcerpc_bind_auth_none(*p2, pipe_uuid, pipe_version);
687 if (!NT_STATUS_IS_OK(status)) {
694 NTSTATUS dcerpc_generic_session_key(struct dcerpc_pipe *p,
695 DATA_BLOB *session_key)
697 /* this took quite a few CPU cycles to find ... */
698 session_key->data = "SystemLibraryDTC";
699 session_key->length = 16;
704 fetch the user session key - may be default (above) or the SMB session key
706 NTSTATUS dcerpc_fetch_session_key(struct dcerpc_pipe *p,
707 DATA_BLOB *session_key)
709 return p->security_state.session_key(p, session_key);
714 log a rpc packet in a format suitable for ndrdump. This is especially useful
715 for sealed packets, where ethereal cannot easily see the contents
717 this triggers on a debug level of >= 10
719 void dcerpc_log_packet(const struct dcerpc_interface_table *ndr,
720 uint32_t opnum, uint32_t flags, DATA_BLOB *pkt)
722 const int num_examples = 20;
725 if (DEBUGLEVEL < 10) return;
727 for (i=0;i<num_examples;i++) {
729 asprintf(&name, "%s/rpclog/%s-%u.%d.%s",
730 lp_lockdir(), ndr->name, opnum, i,
731 (flags&NDR_IN)?"in":"out");
735 if (!file_exist(name, NULL)) {
736 if (file_save(name, pkt->data, pkt->length)) {
737 DEBUG(10,("Logged rpc packet to %s\n", name));