Copyright (C) Andrew Tridgell 2003
Copyright (C) Jelmer Vernooij 2004
+ Copyright (C) Andrew Bartlett <abartlet@samba.org> 2005
+ Copyright (C) Rafal Szczesniak 2006
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
- the Free Software Foundation; either version 2 of the License, or
+ the Free Software Foundation; either version 3 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
- along with this program; if not, write to the Free Software
- Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
+ along with this program. If not, see <http://www.gnu.org/licenses/>.
*/
#include "includes.h"
-#include "system/network.h"
-#include "librpc/gen_ndr/ndr_epmapper.h"
+#include "lib/events/events.h"
+#include "libcli/composite/composite.h"
+#include "librpc/gen_ndr/ndr_epmapper_c.h"
+#include "librpc/gen_ndr/ndr_dcerpc.h"
+#include "librpc/gen_ndr/ndr_misc.h"
+#include "auth/credentials/credentials.h"
+#include "param/param.h"
/*
- find the pipe name for a local IDL interface
+ find a dcerpc call on an interface by name
*/
-const char *idl_pipe_name(const char *uuid, uint32_t if_version)
+const struct ndr_interface_call *dcerpc_iface_find_call(const struct ndr_interface_table *iface,
+ const char *name)
{
- const struct dcerpc_interface_list *l;
- for (l=librpc_dcerpc_pipes();l;l=l->next) {
- if (strcasecmp(l->table->uuid, uuid) == 0 &&
- l->table->if_version == if_version) {
- return l->table->name;
- }
- }
- return "UNKNOWN";
-}
-
-/*
- find the number of calls defined by local IDL
-*/
-int idl_num_calls(const char *uuid, uint32_t if_version)
-{
- const struct dcerpc_interface_list *l;
- for (l=librpc_dcerpc_pipes();l;l=l->next){
- if (strcasecmp(l->table->uuid, uuid) == 0 &&
- l->table->if_version == if_version) {
- return l->table->num_calls;
- }
- }
- return -1;
-}
-
-
-/*
- find a dcerpc interface by name
-*/
-const struct dcerpc_interface_table *idl_iface_by_name(const char *name)
-{
- const struct dcerpc_interface_list *l;
- for (l=librpc_dcerpc_pipes();l;l=l->next) {
- if (strcasecmp(l->table->name, name) == 0) {
- return l->table;
- }
- }
- return NULL;
-}
-
-/*
- find a dcerpc interface by uuid
-*/
-const struct dcerpc_interface_table *idl_iface_by_uuid(const char *uuid)
-{
- const struct dcerpc_interface_list *l;
- for (l=librpc_dcerpc_pipes();l;l=l->next) {
- if (strcasecmp(l->table->uuid, uuid) == 0) {
- return l->table;
+ int i;
+ for (i=0;i<iface->num_calls;i++) {
+ if (strcmp(iface->calls[i].name, name) == 0) {
+ return &iface->calls[i];
}
}
return NULL;
}
-
/*
- push a dcerpc_packet into a blob, potentially with auth info
+ push a ncacn_packet into a blob, potentially with auth info
*/
-NTSTATUS dcerpc_push_auth(DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
- struct dcerpc_packet *pkt,
+NTSTATUS ncacn_push_auth(DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
+ struct ncacn_packet *pkt,
struct dcerpc_auth *auth_info)
{
NTSTATUS status;
ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
}
- if (pkt->pfc_flags & DCERPC_PFC_FLAG_ORPC) {
+ if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
}
pkt->auth_length = 0;
}
- status = ndr_push_dcerpc_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
+ status = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
{ "ncadg_ipx", NCADG_IPX, 2,
{ EPM_PROTOCOL_NCADG, EPM_PROTOCOL_IPX },
},
- { "ncacn_spx", NCACN_SPX, 2,
- { EPM_PROTOCOL_NCACN, EPM_PROTOCOL_SPX },
+ { "ncacn_spx", NCACN_SPX, 3,
+ /* I guess some MS programmer confused the identifier for
+ * EPM_PROTOCOL_UUID (0x0D or 13) with the one for
+ * EPM_PROTOCOL_SPX (0x13) here. -- jelmer*/
+ { EPM_PROTOCOL_NCACN, EPM_PROTOCOL_NCALRPC, EPM_PROTOCOL_UUID },
},
};
{"seal", DCERPC_SEAL},
{"connect", DCERPC_CONNECT},
{"spnego", DCERPC_AUTH_SPNEGO},
+ {"ntlm", DCERPC_AUTH_NTLM},
+ {"krb5", DCERPC_AUTH_KRB5},
{"validate", DCERPC_DEBUG_VALIDATE_BOTH},
{"print", DCERPC_DEBUG_PRINT_BOTH},
{"padcheck", DCERPC_DEBUG_PAD_CHECK},
- {"bigendian", DCERPC_PUSH_BIGENDIAN}
+ {"bigendian", DCERPC_PUSH_BIGENDIAN},
+ {"smb2", DCERPC_SMB2}
};
+const char *epm_floor_string(TALLOC_CTX *mem_ctx, struct epm_floor *epm_floor)
+{
+ struct ndr_syntax_id syntax;
+ NTSTATUS status;
+
+ switch(epm_floor->lhs.protocol) {
+ case EPM_PROTOCOL_UUID:
+ status = dcerpc_floor_get_lhs_data(epm_floor, &syntax);
+ if (NT_STATUS_IS_OK(status)) {
+ /* lhs is used: UUID */
+ char *uuidstr;
+
+ if (GUID_equal(&syntax.uuid, &ndr_transfer_syntax.uuid)) {
+ return "NDR";
+ }
+
+ if (GUID_equal(&syntax.uuid, &ndr64_transfer_syntax.uuid)) {
+ return "NDR64";
+ }
+
+ uuidstr = GUID_string(mem_ctx, &syntax.uuid);
+
+ return talloc_asprintf(mem_ctx, " uuid %s/0x%02x", uuidstr, syntax.if_version);
+ } else { /* IPX */
+ return talloc_asprintf(mem_ctx, "IPX:%s",
+ data_blob_hex_string(mem_ctx, &epm_floor->rhs.uuid.unknown));
+ }
+
+ case EPM_PROTOCOL_NCACN:
+ return "RPC-C";
+
+ case EPM_PROTOCOL_NCADG:
+ return "RPC";
+
+ case EPM_PROTOCOL_NCALRPC:
+ return "NCALRPC";
+
+ case EPM_PROTOCOL_DNET_NSP:
+ return "DNET/NSP";
+
+ case EPM_PROTOCOL_IP:
+ return talloc_asprintf(mem_ctx, "IP:%s", epm_floor->rhs.ip.ipaddr);
+
+ case EPM_PROTOCOL_PIPE:
+ return talloc_asprintf(mem_ctx, "PIPE:%s", epm_floor->rhs.pipe.path);
+
+ case EPM_PROTOCOL_SMB:
+ return talloc_asprintf(mem_ctx, "SMB:%s", epm_floor->rhs.smb.unc);
+
+ case EPM_PROTOCOL_UNIX_DS:
+ return talloc_asprintf(mem_ctx, "Unix:%s", epm_floor->rhs.unix_ds.path);
+
+ case EPM_PROTOCOL_NETBIOS:
+ return talloc_asprintf(mem_ctx, "NetBIOS:%s", epm_floor->rhs.netbios.name);
+
+ case EPM_PROTOCOL_NETBEUI:
+ return "NETBeui";
+
+ case EPM_PROTOCOL_SPX:
+ return "SPX";
+
+ case EPM_PROTOCOL_NB_IPX:
+ return "NB_IPX";
+
+ case EPM_PROTOCOL_HTTP:
+ return talloc_asprintf(mem_ctx, "HTTP:%d", epm_floor->rhs.http.port);
+
+ case EPM_PROTOCOL_TCP:
+ return talloc_asprintf(mem_ctx, "TCP:%d", epm_floor->rhs.tcp.port);
+
+ case EPM_PROTOCOL_UDP:
+ return talloc_asprintf(mem_ctx, "UDP:%d", epm_floor->rhs.udp.port);
+
+ default:
+ return talloc_asprintf(mem_ctx, "UNK(%02x):", epm_floor->lhs.protocol);
+ }
+}
/*
form a binding string from a binding structure
*/
-const char *dcerpc_binding_string(TALLOC_CTX *mem_ctx, const struct dcerpc_binding *b)
+char *dcerpc_binding_string(TALLOC_CTX *mem_ctx, const struct dcerpc_binding *b)
{
char *s = talloc_strdup(mem_ctx, "");
int i;
- const char *t_name=NULL;
+ const char *t_name = NULL;
- for (i=0;i<ARRAY_SIZE(transports);i++) {
- if (transports[i].transport == b->transport) {
- t_name = transports[i].name;
+ if (b->transport != NCA_UNKNOWN) {
+ for (i=0;i<ARRAY_SIZE(transports);i++) {
+ if (transports[i].transport == b->transport) {
+ t_name = transports[i].name;
+ }
+ }
+ if (!t_name) {
+ return NULL;
}
- }
- if (!t_name) {
- return NULL;
}
- if (!GUID_all_zero(&b->object)) {
+ if (!GUID_all_zero(&b->object.uuid)) {
s = talloc_asprintf(s, "%s@",
- GUID_string(mem_ctx, &b->object));
+ GUID_string(mem_ctx, &b->object.uuid));
}
- s = talloc_asprintf_append(s, "%s:", t_name);
- if (!s) return NULL;
+ if (t_name != NULL) {
+ s = talloc_asprintf_append(s, "%s:", t_name);
+ if (s == NULL) {
+ return NULL;
+ }
+ }
if (b->host) {
s = talloc_asprintf_append(s, "%s", b->host);
/*
parse a binding string into a dcerpc_binding structure
*/
-NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struct dcerpc_binding *b)
+NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struct dcerpc_binding **b_out)
{
- char *options, *type;
+ struct dcerpc_binding *b;
+ char *options;
char *p;
int i, j, comma_count;
+ b = talloc(mem_ctx, struct dcerpc_binding);
+ if (!b) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
p = strchr(s, '@');
if (p && PTR_DIFF(p, s) == 36) { /* 36 is the length of a UUID */
NTSTATUS status;
- status = GUID_from_string(s, &b->object);
+ status = GUID_from_string(s, &b->object.uuid);
if (NT_STATUS_IS_ERR(status)) {
DEBUG(0, ("Failed parsing UUID\n"));
ZERO_STRUCT(b->object);
}
- b->object_version = 0;
+ b->object.if_version = 0;
p = strchr(s, ':');
- if (!p) {
- return NT_STATUS_INVALID_PARAMETER;
- }
- type = talloc_strndup(mem_ctx, s, PTR_DIFF(p, s));
- if (!type) {
- return NT_STATUS_NO_MEMORY;
- }
+ if (p == NULL) {
+ b->transport = NCA_UNKNOWN;
+ } else {
+ char *type = talloc_strndup(mem_ctx, s, PTR_DIFF(p, s));
+ if (!type) {
+ return NT_STATUS_NO_MEMORY;
+ }
- for (i=0;i<ARRAY_SIZE(transports);i++) {
- if (strcasecmp(type, transports[i].name) == 0) {
- b->transport = transports[i].transport;
- break;
+ for (i=0;i<ARRAY_SIZE(transports);i++) {
+ if (strcasecmp(type, transports[i].name) == 0) {
+ b->transport = transports[i].transport;
+ break;
+ }
}
- }
- if (i==ARRAY_SIZE(transports)) {
- DEBUG(0,("Unknown dcerpc transport '%s'\n", type));
- return NT_STATUS_INVALID_PARAMETER;
- }
+
+ if (i==ARRAY_SIZE(transports)) {
+ DEBUG(0,("Unknown dcerpc transport '%s'\n", type));
+ return NT_STATUS_INVALID_PARAMETER;
+ }
+
+ talloc_free(type);
- s = p+1;
+ s = p+1;
+ }
p = strchr(s, '[');
if (p) {
- b->host = talloc_strndup(mem_ctx, s, PTR_DIFF(p, s));
+ b->host = talloc_strndup(b, s, PTR_DIFF(p, s));
options = talloc_strdup(mem_ctx, p+1);
if (options[strlen(options)-1] != ']') {
return NT_STATUS_INVALID_PARAMETER;
}
options[strlen(options)-1] = 0;
} else {
- b->host = talloc_strdup(mem_ctx, s);
+ b->host = talloc_strdup(b, s);
options = NULL;
}
-
if (!b->host) {
return NT_STATUS_NO_MEMORY;
}
+ b->target_hostname = b->host;
+
b->options = NULL;
b->flags = 0;
+ b->assoc_group_id = 0;
b->endpoint = NULL;
if (!options) {
+ *b_out = b;
return NT_STATUS_OK;
}
comma_count = count_chars(options, ',');
- b->options = talloc_array_p(mem_ctx, const char *, comma_count+2);
+ b->options = talloc_array(b, const char *, comma_count+2);
if (!b->options) {
return NT_STATUS_NO_MEMORY;
}
for (i=0; (p = strchr(options, ',')); i++) {
- b->options[i] = talloc_strndup(mem_ctx, options, PTR_DIFF(p, options));
+ b->options[i] = talloc_strndup(b, options, PTR_DIFF(p, options));
if (!b->options[i]) {
return NT_STATUS_NO_MEMORY;
}
if (b->options[0] == NULL)
b->options = NULL;
+ *b_out = b;
return NT_STATUS_OK;
}
-const char *dcerpc_floor_get_rhs_data(TALLOC_CTX *mem_ctx, struct epm_floor *floor)
+NTSTATUS dcerpc_floor_get_lhs_data(struct epm_floor *epm_floor, struct ndr_syntax_id *syntax)
{
- switch (floor->lhs.protocol) {
+ TALLOC_CTX *mem_ctx = talloc_init("floor_get_lhs_data");
+ struct ndr_pull *ndr = ndr_pull_init_blob(&epm_floor->lhs.lhs_data, mem_ctx);
+ NTSTATUS status;
+ uint16_t if_version=0;
+
+ ndr->flags |= LIBNDR_FLAG_NOALIGN;
+
+ status = ndr_pull_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, &syntax->uuid);
+ if (NT_STATUS_IS_ERR(status)) {
+ talloc_free(mem_ctx);
+ return status;
+ }
+
+ status = ndr_pull_uint16(ndr, NDR_SCALARS, &if_version);
+ syntax->if_version = if_version;
+
+ talloc_free(mem_ctx);
+
+ return status;
+}
+
+static DATA_BLOB dcerpc_floor_pack_lhs_data(TALLOC_CTX *mem_ctx, const struct ndr_syntax_id *syntax)
+{
+ struct ndr_push *ndr = ndr_push_init_ctx(mem_ctx);
+
+ ndr->flags |= LIBNDR_FLAG_NOALIGN;
+
+ ndr_push_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, &syntax->uuid);
+ ndr_push_uint16(ndr, NDR_SCALARS, syntax->if_version);
+
+ return ndr_push_blob(ndr);
+}
+
+const char *dcerpc_floor_get_rhs_data(TALLOC_CTX *mem_ctx, struct epm_floor *epm_floor)
+{
+ switch (epm_floor->lhs.protocol) {
case EPM_PROTOCOL_TCP:
- if (floor->rhs.tcp.port == 0) return NULL;
- return talloc_asprintf(mem_ctx, "%d", floor->rhs.tcp.port);
+ if (epm_floor->rhs.tcp.port == 0) return NULL;
+ return talloc_asprintf(mem_ctx, "%d", epm_floor->rhs.tcp.port);
case EPM_PROTOCOL_UDP:
- if (floor->rhs.udp.port == 0) return NULL;
- return talloc_asprintf(mem_ctx, "%d", floor->rhs.udp.port);
+ if (epm_floor->rhs.udp.port == 0) return NULL;
+ return talloc_asprintf(mem_ctx, "%d", epm_floor->rhs.udp.port);
case EPM_PROTOCOL_HTTP:
- if (floor->rhs.http.port == 0) return NULL;
- return talloc_asprintf(mem_ctx, "%d", floor->rhs.http.port);
+ if (epm_floor->rhs.http.port == 0) return NULL;
+ return talloc_asprintf(mem_ctx, "%d", epm_floor->rhs.http.port);
case EPM_PROTOCOL_IP:
- if (floor->rhs.ip.address == 0) {
- return NULL;
- }
-
- {
- struct ipv4_addr in;
- in.addr = htonl(floor->rhs.ip.address);
- return talloc_strdup(mem_ctx, sys_inet_ntoa(in));
- }
+ return talloc_strdup(mem_ctx, epm_floor->rhs.ip.ipaddr);
case EPM_PROTOCOL_NCACN:
return NULL;
return NULL;
case EPM_PROTOCOL_SMB:
- if (strlen(floor->rhs.smb.unc) == 0) return NULL;
- return talloc_strdup(mem_ctx, floor->rhs.smb.unc);
+ if (strlen(epm_floor->rhs.smb.unc) == 0) return NULL;
+ return talloc_strdup(mem_ctx, epm_floor->rhs.smb.unc);
case EPM_PROTOCOL_PIPE:
- if (strlen(floor->rhs.pipe.path) == 0) return NULL;
- return talloc_strdup(mem_ctx, floor->rhs.pipe.path);
+ if (strlen(epm_floor->rhs.pipe.path) == 0) return NULL;
+ return talloc_strdup(mem_ctx, epm_floor->rhs.pipe.path);
case EPM_PROTOCOL_NETBIOS:
- if (strlen(floor->rhs.netbios.name) == 0) return NULL;
- return talloc_strdup(mem_ctx, floor->rhs.netbios.name);
+ if (strlen(epm_floor->rhs.netbios.name) == 0) return NULL;
+ return talloc_strdup(mem_ctx, epm_floor->rhs.netbios.name);
case EPM_PROTOCOL_NCALRPC:
return NULL;
case EPM_PROTOCOL_VINES_SPP:
- return talloc_asprintf(mem_ctx, "%d", floor->rhs.vines_spp.port);
+ return talloc_asprintf(mem_ctx, "%d", epm_floor->rhs.vines_spp.port);
case EPM_PROTOCOL_VINES_IPC:
- return talloc_asprintf(mem_ctx, "%d", floor->rhs.vines_ipc.port);
+ return talloc_asprintf(mem_ctx, "%d", epm_floor->rhs.vines_ipc.port);
case EPM_PROTOCOL_STREETTALK:
- return talloc_strdup(mem_ctx, floor->rhs.streettalk.streettalk);
+ return talloc_strdup(mem_ctx, epm_floor->rhs.streettalk.streettalk);
case EPM_PROTOCOL_UNIX_DS:
- if (strlen(floor->rhs.unix_ds.path) == 0) return NULL;
- return talloc_strdup(mem_ctx, floor->rhs.unix_ds.path);
+ if (strlen(epm_floor->rhs.unix_ds.path) == 0) return NULL;
+ return talloc_strdup(mem_ctx, epm_floor->rhs.unix_ds.path);
case EPM_PROTOCOL_NULL:
return NULL;
default:
- DEBUG(0,("Unsupported lhs protocol %d\n", floor->lhs.protocol));
+ DEBUG(0,("Unsupported lhs protocol %d\n", epm_floor->lhs.protocol));
break;
}
return NULL;
}
-static NTSTATUS dcerpc_floor_set_rhs_data(TALLOC_CTX *mem_ctx, struct epm_floor *floor, const char *data)
+static NTSTATUS dcerpc_floor_set_rhs_data(TALLOC_CTX *mem_ctx,
+ struct epm_floor *epm_floor,
+ const char *data)
{
- switch (floor->lhs.protocol) {
+ switch (epm_floor->lhs.protocol) {
case EPM_PROTOCOL_TCP:
- floor->rhs.tcp.port = atoi(data);
+ epm_floor->rhs.tcp.port = atoi(data);
return NT_STATUS_OK;
case EPM_PROTOCOL_UDP:
- floor->rhs.udp.port = atoi(data);
+ epm_floor->rhs.udp.port = atoi(data);
return NT_STATUS_OK;
case EPM_PROTOCOL_HTTP:
- floor->rhs.http.port = atoi(data);
+ epm_floor->rhs.http.port = atoi(data);
return NT_STATUS_OK;
case EPM_PROTOCOL_IP:
- if (strlen(data) > 0) {
- floor->rhs.ip.address = ntohl(interpret_addr(data));
- } else {
- floor->rhs.ip.address = 0;
- }
+ epm_floor->rhs.ip.ipaddr = talloc_strdup(mem_ctx, data);
+ NT_STATUS_HAVE_NO_MEMORY(epm_floor->rhs.ip.ipaddr);
return NT_STATUS_OK;
case EPM_PROTOCOL_NCACN:
- floor->rhs.ncacn.minor_version = 0;
+ epm_floor->rhs.ncacn.minor_version = 0;
return NT_STATUS_OK;
case EPM_PROTOCOL_NCADG:
- floor->rhs.ncadg.minor_version = 0;
+ epm_floor->rhs.ncadg.minor_version = 0;
return NT_STATUS_OK;
case EPM_PROTOCOL_SMB:
- floor->rhs.smb.unc = talloc_strdup(mem_ctx, data);
- if (!floor->rhs.smb.unc) {
- return NT_STATUS_NO_MEMORY;
- }
+ epm_floor->rhs.smb.unc = talloc_strdup(mem_ctx, data);
+ NT_STATUS_HAVE_NO_MEMORY(epm_floor->rhs.smb.unc);
return NT_STATUS_OK;
case EPM_PROTOCOL_PIPE:
- floor->rhs.pipe.path = talloc_strdup(mem_ctx, data);
- if (!floor->rhs.pipe.path) {
- return NT_STATUS_NO_MEMORY;
- }
+ epm_floor->rhs.pipe.path = talloc_strdup(mem_ctx, data);
+ NT_STATUS_HAVE_NO_MEMORY(epm_floor->rhs.pipe.path);
return NT_STATUS_OK;
case EPM_PROTOCOL_NETBIOS:
- floor->rhs.netbios.name = talloc_strdup(mem_ctx, data);
- if (!floor->rhs.netbios.name) {
- return NT_STATUS_NO_MEMORY;
- }
+ epm_floor->rhs.netbios.name = talloc_strdup(mem_ctx, data);
+ NT_STATUS_HAVE_NO_MEMORY(epm_floor->rhs.netbios.name);
return NT_STATUS_OK;
case EPM_PROTOCOL_NCALRPC:
return NT_STATUS_OK;
case EPM_PROTOCOL_VINES_SPP:
- floor->rhs.vines_spp.port = atoi(data);
+ epm_floor->rhs.vines_spp.port = atoi(data);
return NT_STATUS_OK;
case EPM_PROTOCOL_VINES_IPC:
- floor->rhs.vines_ipc.port = atoi(data);
+ epm_floor->rhs.vines_ipc.port = atoi(data);
return NT_STATUS_OK;
case EPM_PROTOCOL_STREETTALK:
- floor->rhs.streettalk.streettalk = talloc_strdup(mem_ctx, data);
- if (!floor->rhs.streettalk.streettalk) {
- return NT_STATUS_NO_MEMORY;
- }
+ epm_floor->rhs.streettalk.streettalk = talloc_strdup(mem_ctx, data);
+ NT_STATUS_HAVE_NO_MEMORY(epm_floor->rhs.streettalk.streettalk);
return NT_STATUS_OK;
case EPM_PROTOCOL_UNIX_DS:
- floor->rhs.unix_ds.path = talloc_strdup(mem_ctx, data);
- if (!floor->rhs.unix_ds.path) {
- return NT_STATUS_NO_MEMORY;
- }
+ epm_floor->rhs.unix_ds.path = talloc_strdup(mem_ctx, data);
+ NT_STATUS_HAVE_NO_MEMORY(epm_floor->rhs.unix_ds.path);
return NT_STATUS_OK;
case EPM_PROTOCOL_NULL:
return NT_STATUS_OK;
default:
- DEBUG(0,("Unsupported lhs protocol %d\n", floor->lhs.protocol));
+ DEBUG(0,("Unsupported lhs protocol %d\n", epm_floor->lhs.protocol));
break;
}
}
/* Unknown transport */
- return -1;
+ return (unsigned int)-1;
}
enum dcerpc_transport_t dcerpc_transport_by_tower(struct epm_tower *tower)
}
/* Unknown transport */
- return -1;
+ return (unsigned int)-1;
}
-NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx, struct epm_tower *tower, struct dcerpc_binding *binding)
+NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx,
+ struct epm_tower *tower,
+ struct dcerpc_binding **b_out)
{
+ NTSTATUS status;
+ struct dcerpc_binding *binding;
+
+ binding = talloc(mem_ctx, struct dcerpc_binding);
+ NT_STATUS_HAVE_NO_MEMORY(binding);
+
ZERO_STRUCT(binding->object);
binding->options = NULL;
binding->host = NULL;
+ binding->target_hostname = NULL;
binding->flags = 0;
+ binding->assoc_group_id = 0;
binding->transport = dcerpc_transport_by_tower(tower);
- if (binding->transport == -1) {
+ if (binding->transport == (unsigned int)-1) {
return NT_STATUS_NOT_SUPPORTED;
}
}
/* Set object uuid */
- binding->object = tower->floors[0].lhs.info.uuid.uuid;
- binding->object_version = tower->floors[0].lhs.info.uuid.version;
+ status = dcerpc_floor_get_lhs_data(&tower->floors[0], &binding->object);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ DEBUG(1, ("Error pulling object uuid and version: %s", nt_errstr(status)));
+ return status;
+ }
/* Ignore floor 1, it contains the NDR version info */
/* Set network address */
if (tower->num_floors >= 5) {
binding->host = dcerpc_floor_get_rhs_data(mem_ctx, &tower->floors[4]);
+ NT_STATUS_HAVE_NO_MEMORY(binding->host);
+ binding->target_hostname = binding->host;
}
+ *b_out = binding;
return NT_STATUS_OK;
}
}
tower->num_floors = 2 + num_protocols;
- tower->floors = talloc_array_p(mem_ctx, struct epm_floor, tower->num_floors);
+ tower->floors = talloc_array(mem_ctx, struct epm_floor, tower->num_floors);
/* Floor 0 */
tower->floors[0].lhs.protocol = EPM_PROTOCOL_UUID;
- tower->floors[0].lhs.info.uuid.uuid = binding->object;
- tower->floors[0].lhs.info.uuid.version = binding->object_version;
- tower->floors[0].rhs.uuid.unknown = 0;
+
+ tower->floors[0].lhs.lhs_data = dcerpc_floor_pack_lhs_data(mem_ctx, &binding->object);
+
+ tower->floors[0].rhs.uuid.unknown = data_blob_talloc_zero(mem_ctx, 2);
/* Floor 1 */
tower->floors[1].lhs.protocol = EPM_PROTOCOL_UUID;
- tower->floors[1].lhs.info.uuid.version = NDR_GUID_VERSION;
- tower->floors[1].rhs.uuid.unknown = 0;
- status = GUID_from_string(NDR_GUID, &tower->floors[1].lhs.info.uuid.uuid);
- if (NT_STATUS_IS_ERR(status)) {
- return status;
- }
+ tower->floors[1].lhs.lhs_data = dcerpc_floor_pack_lhs_data(mem_ctx,
+ &ndr_transfer_syntax);
+
+ tower->floors[1].rhs.uuid.unknown = data_blob_talloc_zero(mem_ctx, 2);
+
/* Floor 2 to num_protocols */
for (i = 0; i < num_protocols; i++) {
tower->floors[2 + i].lhs.protocol = protseq[i];
- tower->floors[2 + i].lhs.info.lhs_data = data_blob_talloc(mem_ctx, NULL, 0);
+ tower->floors[2 + i].lhs.lhs_data = data_blob_talloc(mem_ctx, NULL, 0);
ZERO_STRUCT(tower->floors[2 + i].rhs);
dcerpc_floor_set_rhs_data(mem_ctx, &tower->floors[2 + i], "");
}
/* The 5th contains the network address */
if (num_protocols >= 3 && binding->host) {
- status = dcerpc_floor_set_rhs_data(mem_ctx, &tower->floors[4], binding->host);
+ if (is_ipaddress(binding->host)) {
+ status = dcerpc_floor_set_rhs_data(mem_ctx, &tower->floors[4],
+ binding->host);
+ } else {
+ /* note that we don't attempt to resolve the
+ name here - when we get a hostname here we
+ are in the client code, and want to put in
+ a wildcard all-zeros IP for the server to
+ fill in */
+ status = dcerpc_floor_set_rhs_data(mem_ctx, &tower->floors[4],
+ "0.0.0.0");
+ }
if (NT_STATUS_IS_ERR(status)) {
return status;
}
return NT_STATUS_OK;
}
-NTSTATUS dcerpc_epm_map_binding(TALLOC_CTX *mem_ctx, struct dcerpc_binding *binding,
- const char *uuid, uint_t version)
-{
- struct dcerpc_pipe *p;
- NTSTATUS status;
- struct epm_Map r;
+
+struct epm_map_binding_state {
+ struct dcerpc_binding *binding;
+ const struct ndr_interface_table *table;
+ struct dcerpc_pipe *pipe;
struct policy_handle handle;
struct GUID guid;
- struct epm_twr_t twr, *twr_r;
- struct dcerpc_binding epmapper_binding;
- const struct dcerpc_interface_table *table = idl_iface_by_uuid(uuid);
- int i;
+ struct epm_twr_t twr;
+ struct epm_twr_t *twr_r;
+ struct epm_Map r;
+};
- /* First, check if there is a default endpoint specified in the IDL */
- if (table) {
- struct dcerpc_binding default_binding;
-
- /* Find one of the default pipes for this interface */
- for (i = 0; i < table->endpoints->count; i++) {
- status = dcerpc_parse_binding(mem_ctx, table->endpoints->names[i], &default_binding);
+static void continue_epm_recv_binding(struct composite_context *ctx);
+static void continue_epm_map(struct rpc_request *req);
- if (NT_STATUS_IS_OK(status) && default_binding.transport == binding->transport && default_binding.endpoint) {
- binding->endpoint = talloc_strdup(mem_ctx, default_binding.endpoint);
- return NT_STATUS_OK;
- }
- }
- }
+/*
+ Stage 2 of epm_map_binding: Receive connected rpc pipe and send endpoint
+ mapping rpc request
+*/
+static void continue_epm_recv_binding(struct composite_context *ctx)
+{
+ struct rpc_request *map_req;
- ZERO_STRUCT(epmapper_binding);
- epmapper_binding.transport = binding->transport;
- epmapper_binding.host = binding->host;
- epmapper_binding.options = NULL;
- epmapper_binding.flags = 0;
- epmapper_binding.endpoint = NULL;
-
- status = dcerpc_pipe_connect_b(&p,
- &epmapper_binding,
- DCERPC_EPMAPPER_UUID,
- DCERPC_EPMAPPER_VERSION,
- NULL, NULL, NULL);
+ struct composite_context *c = talloc_get_type(ctx->async.private_data,
+ struct composite_context);
+ struct epm_map_binding_state *s = talloc_get_type(c->private_data,
+ struct epm_map_binding_state);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
+ /* receive result of rpc pipe connect request */
+ c->status = dcerpc_pipe_connect_b_recv(ctx, c, &s->pipe);
+ if (!composite_is_ok(c)) return;
- ZERO_STRUCT(handle);
- ZERO_STRUCT(guid);
+ s->pipe->conn->flags |= DCERPC_NDR_REF_ALLOC;
- status = GUID_from_string(uuid, &binding->object);
- if (NT_STATUS_IS_ERR(status)) {
- return status;
- }
+ /* prepare requested binding parameters */
+ s->binding->object = s->table->syntax_id;
+
+ c->status = dcerpc_binding_build_tower(s->pipe, s->binding, &s->twr.tower);
+ if (!composite_is_ok(c)) return;
+
+ /* with some nice pretty paper around it of course */
+ s->r.in.object = &s->guid;
+ s->r.in.map_tower = &s->twr;
+ s->r.in.entry_handle = &s->handle;
+ s->r.in.max_towers = 1;
+ s->r.out.entry_handle = &s->handle;
+
+ /* send request for an endpoint mapping - a rpc request on connected pipe */
+ map_req = dcerpc_epm_Map_send(s->pipe, c, &s->r);
+ if (composite_nomem(map_req, c)) return;
+
+ composite_continue_rpc(c, map_req, continue_epm_map, c);
+}
- binding->object_version = version;
- status = dcerpc_binding_build_tower(p, binding, &twr.tower);
- if (NT_STATUS_IS_ERR(status)) {
- return status;
- }
+/*
+ Stage 3 of epm_map_binding: Receive endpoint mapping and provide binding details
+*/
+static void continue_epm_map(struct rpc_request *req)
+{
+ struct composite_context *c = talloc_get_type(req->async.private_data,
+ struct composite_context);
+ struct epm_map_binding_state *s = talloc_get_type(c->private_data,
+ struct epm_map_binding_state);
- /* with some nice pretty paper around it of course */
- r.in.object = &guid;
- r.in.map_tower = &twr;
- r.in.entry_handle = &handle;
- r.in.max_towers = 1;
- r.out.entry_handle = &handle;
+ /* receive result of a rpc request */
+ c->status = dcerpc_ndr_request_recv(req);
+ if (!composite_is_ok(c)) return;
- status = dcerpc_epm_Map(p, p, &r);
- if (!NT_STATUS_IS_OK(status)) {
- dcerpc_pipe_close(p);
- return status;
- }
- if (r.out.result != 0 || r.out.num_towers != 1) {
- dcerpc_pipe_close(p);
- return NT_STATUS_PORT_UNREACHABLE;
+ /* check the details */
+ if (s->r.out.result != 0 || *s->r.out.num_towers != 1) {
+ composite_error(c, NT_STATUS_PORT_UNREACHABLE);
+ return;
}
-
- twr_r = r.out.towers[0].twr;
- if (!twr_r) {
- dcerpc_pipe_close(p);
- return NT_STATUS_PORT_UNREACHABLE;
+
+ s->twr_r = s->r.out.towers[0].twr;
+ if (s->twr_r == NULL) {
+ composite_error(c, NT_STATUS_PORT_UNREACHABLE);
+ return;
}
- if (twr_r->tower.num_floors != twr.tower.num_floors ||
- twr_r->tower.floors[3].lhs.protocol != twr.tower.floors[3].lhs.protocol) {
- dcerpc_pipe_close(p);
- return NT_STATUS_PORT_UNREACHABLE;
+ if (s->twr_r->tower.num_floors != s->twr.tower.num_floors ||
+ s->twr_r->tower.floors[3].lhs.protocol != s->twr.tower.floors[3].lhs.protocol) {
+ composite_error(c, NT_STATUS_PORT_UNREACHABLE);
+ return;
}
- binding->endpoint = dcerpc_floor_get_rhs_data(mem_ctx, &twr_r->tower.floors[3]);
-
- dcerpc_pipe_close(p);
+ /* get received endpoint */
+ s->binding->endpoint = talloc_reference(s->binding,
+ dcerpc_floor_get_rhs_data(c, &s->twr_r->tower.floors[3]));
+ if (composite_nomem(s->binding->endpoint, c)) return;
- return NT_STATUS_OK;
+ composite_done(c);
}
-/*
- perform an authenticated bind if needed
+/*
+ Request for endpoint mapping of dcerpc binding - try to request for endpoint
+ unless there is default one.
*/
-static NTSTATUS dcerpc_pipe_auth(struct dcerpc_pipe *p,
- struct dcerpc_binding *binding,
- const char *pipe_uuid,
- uint32_t pipe_version,
- const char *domain,
- const char *username,
- const char *password)
+struct composite_context *dcerpc_epm_map_binding_send(TALLOC_CTX *mem_ctx,
+ struct dcerpc_binding *binding,
+ const struct ndr_interface_table *table,
+ struct event_context *ev)
{
- NTSTATUS status;
+ struct composite_context *c;
+ struct epm_map_binding_state *s;
+ struct composite_context *pipe_connect_req;
+ struct cli_credentials *anon_creds;
+ struct event_context *new_ev = NULL;
- p->conn->flags = binding->flags;
+ NTSTATUS status;
+ struct dcerpc_binding *epmapper_binding;
+ int i;
- /* remember the binding string for possible secondary connections */
- p->conn->binding_string = dcerpc_binding_string(p, binding);
-
- if (username && username[0] && (binding->flags & DCERPC_SCHANNEL_ANY)) {
- status = dcerpc_bind_auth_schannel(p, pipe_uuid, pipe_version,
- domain, username, password);
- } else if (username && username[0] && (binding->flags & DCERPC_AUTH_SPNEGO)) {
- status = dcerpc_bind_auth_spnego(p, pipe_uuid, pipe_version, domain, username, password);
- } else if (username && username[0]) {
- status = dcerpc_bind_auth_ntlm(p, pipe_uuid, pipe_version, domain, username, password);
- } else {
- status = dcerpc_bind_auth_none(p, pipe_uuid, pipe_version);
+ /* Try to find event context in memory context in case passed
+ * event_context (argument) was NULL. If there's none, just
+ * create a new one.
+ */
+ if (ev == NULL) {
+ ev = event_context_find(mem_ctx);
+ if (ev == NULL) {
+ new_ev = event_context_init(mem_ctx);
+ if (new_ev == NULL) return NULL;
+ ev = new_ev;
+ }
}
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to bind to uuid %s - %s\n", pipe_uuid, nt_errstr(status)));
+ /* composite context allocation and setup */
+ c = composite_create(mem_ctx, ev);
+ if (c == NULL) {
+ talloc_free(new_ev);
+ return NULL;
}
- return status;
-}
+ talloc_steal(c, new_ev);
+ s = talloc_zero(c, struct epm_map_binding_state);
+ if (composite_nomem(s, c)) return c;
+ c->private_data = s;
-/* open a rpc connection to a rpc pipe on SMB using the binding
- structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncacn_np(struct dcerpc_pipe **pp,
- struct dcerpc_binding *binding,
- const char *pipe_uuid,
- uint32_t pipe_version,
- const char *domain,
- const char *username,
- const char *password)
-{
- struct dcerpc_pipe *p;
- NTSTATUS status;
- BOOL retry;
- struct smbcli_state *cli;
- const char *pipe_name = NULL;
- TALLOC_CTX *tmp_ctx;
+ s->binding = binding;
+ s->table = table;
- *pp = NULL;
+ /* anonymous credentials for rpc connection used to get endpoint mapping */
+ anon_creds = cli_credentials_init(mem_ctx);
+ cli_credentials_set_event_context(anon_creds, ev);
+ cli_credentials_set_conf(anon_creds);
+ cli_credentials_set_anonymous(anon_creds);
- p = dcerpc_pipe_init(NULL);
- if (p == NULL) {
- return NT_STATUS_NO_MEMORY;
- }
- tmp_ctx = talloc_new(p);
-
- /* Look up identifier using the epmapper */
- if (!binding->endpoint) {
- status = dcerpc_epm_map_binding(tmp_ctx, binding, pipe_uuid, pipe_version);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to map DCERPC/TCP NCACN_NP pipe for '%s' - %s\n",
- pipe_uuid, nt_errstr(status)));
- talloc_free(p);
- return status;
+ /*
+ First, check if there is a default endpoint specified in the IDL
+ */
+ if (table != NULL) {
+ struct dcerpc_binding *default_binding;
+
+ /* Find one of the default pipes for this interface */
+ for (i = 0; i < table->endpoints->count; i++) {
+ status = dcerpc_parse_binding(mem_ctx, table->endpoints->names[i], &default_binding);
+
+ if (NT_STATUS_IS_OK(status)) {
+ if (binding->transport == NCA_UNKNOWN)
+ binding->transport = default_binding->transport;
+ if (default_binding->transport == binding->transport &&
+ default_binding->endpoint) {
+ binding->endpoint = talloc_reference(binding, default_binding->endpoint);
+ talloc_free(default_binding);
+
+ composite_done(c);
+ return c;
+
+ } else {
+ talloc_free(default_binding);
+ }
+ }
}
- DEBUG(1,("Mapped to DCERPC/NP pipe %s\n", binding->endpoint));
}
- pipe_name = binding->endpoint;
+ epmapper_binding = talloc_zero(c, struct dcerpc_binding);
+ if (composite_nomem(epmapper_binding, c)) return c;
- if (!strncasecmp(pipe_name, "/pipe/", 6) ||
- !strncasecmp(pipe_name, "\\pipe\\", 6)) {
- pipe_name += 6;
- }
+ /* basic endpoint mapping data */
+ epmapper_binding->transport = binding->transport;
+ epmapper_binding->host = talloc_reference(epmapper_binding, binding->host);
+ epmapper_binding->target_hostname = epmapper_binding->host;
+ epmapper_binding->options = NULL;
+ epmapper_binding->flags = 0;
+ epmapper_binding->assoc_group_id = 0;
+ epmapper_binding->endpoint = NULL;
- if (pipe_name[0] != '\\') {
- pipe_name = talloc_asprintf(tmp_ctx, "\\%s", pipe_name);
- }
+ /* initiate rpc pipe connection */
+ pipe_connect_req = dcerpc_pipe_connect_b_send(c, epmapper_binding,
+ &ndr_table_epmapper,
+ anon_creds, c->event_ctx);
+ if (composite_nomem(pipe_connect_req, c)) return c;
- if (!username || !username[0] ||
- (binding->flags & DCERPC_SCHANNEL_ANY)) {
- status = smbcli_full_connection(p->conn, &cli, lp_netbios_name(),
- binding->host, NULL,
- "ipc$", "?????",
- "", "", NULL, 0, &retry);
- } else {
- status = smbcli_full_connection(p->conn, &cli, lp_netbios_name(),
- binding->host, NULL,
- "ipc$", "?????",
- username, domain,
- password, 0, &retry);
- }
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to connect to %s - %s\n", binding->host, nt_errstr(status)));
- talloc_free(p);
- return status;
- }
+ composite_continue(c, pipe_connect_req, continue_epm_recv_binding, c);
+ return c;
+}
- status = dcerpc_pipe_open_smb(p->conn, cli->tree, pipe_name);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to open pipe %s - %s\n", pipe_name, nt_errstr(status)));
- talloc_free(p);
- return status;
- }
+
+/*
+ Receive result of endpoint mapping request
+ */
+NTSTATUS dcerpc_epm_map_binding_recv(struct composite_context *c)
+{
+ NTSTATUS status = composite_wait(c);
- status = dcerpc_pipe_auth(p, binding, pipe_uuid, pipe_version, domain, username, password);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p);
- return status;
- }
+ talloc_free(c);
+ return status;
+}
- (*pp) = p;
- talloc_free(tmp_ctx);
- return NT_STATUS_OK;
+/*
+ Get endpoint mapping for rpc connection
+*/
+NTSTATUS dcerpc_epm_map_binding(TALLOC_CTX *mem_ctx, struct dcerpc_binding *binding,
+ const struct ndr_interface_table *table, struct event_context *ev)
+{
+ struct composite_context *c;
+
+ c = dcerpc_epm_map_binding_send(mem_ctx, binding, table, ev);
+ return dcerpc_epm_map_binding_recv(c);
}
-/* open a rpc connection to a rpc pipe on SMP using the binding
- structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncalrpc(struct dcerpc_pipe **pp,
- struct dcerpc_binding *binding,
- const char *pipe_uuid,
- uint32_t pipe_version,
- const char *domain,
- const char *username,
- const char *password)
-{
- NTSTATUS status;
- struct dcerpc_pipe *p;
- TALLOC_CTX *tmp_ctx;
- (*pp) = NULL;
+struct pipe_auth_state {
+ struct dcerpc_pipe *pipe;
+ struct dcerpc_binding *binding;
+ const struct ndr_interface_table *table;
+ struct cli_credentials *credentials;
+};
- p = dcerpc_pipe_init(NULL);
- if (p == NULL) {
- return NT_STATUS_NO_MEMORY;
- }
- tmp_ctx = talloc_new(p);
-
- /* Look up identifier using the epmapper */
- if (!binding->endpoint) {
- status = dcerpc_epm_map_binding(tmp_ctx, binding, pipe_uuid, pipe_version);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to map DCERPC/TCP NCALRPC identifier for '%s' - %s\n",
- pipe_uuid, nt_errstr(status)));
- talloc_free(p);
- return status;
- }
- DEBUG(1,("Mapped to DCERPC/LRPC identifier %s\n", binding->endpoint));
- }
- status = dcerpc_pipe_open_pipe(p->conn, binding->endpoint);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to open ncalrpc pipe '%s' - %s\n",
- binding->endpoint, nt_errstr(status)));
- talloc_free(p);
- return status;
- }
+static void continue_auth_schannel(struct composite_context *ctx);
+static void continue_auth(struct composite_context *ctx);
+static void continue_auth_none(struct composite_context *ctx);
+static void continue_ntlmssp_connection(struct composite_context *ctx);
+static void continue_spnego_after_wrong_pass(struct composite_context *ctx);
- status = dcerpc_pipe_auth(p, binding, pipe_uuid, pipe_version, domain, username, password);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p);
- return status;
- }
- (*pp) = p;
- talloc_free(tmp_ctx);
+/*
+ Stage 2 of pipe_auth: Receive result of schannel bind request
+*/
+static void continue_auth_schannel(struct composite_context *ctx)
+{
+ struct composite_context *c = talloc_get_type(ctx->async.private_data,
+ struct composite_context);
- return status;
+ c->status = dcerpc_bind_auth_schannel_recv(ctx);
+ if (!composite_is_ok(c)) return;
+
+ composite_done(c);
}
+/*
+ Stage 2 of pipe_auth: Receive result of authenticated bind request
+*/
+static void continue_auth(struct composite_context *ctx)
+{
+ struct composite_context *c = talloc_get_type(ctx->async.private_data,
+ struct composite_context);
-/* open a rpc connection to a rpc pipe on SMP using the binding
- structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncacn_unix_stream(struct dcerpc_pipe **pp,
- struct dcerpc_binding *binding,
- const char *pipe_uuid,
- uint32_t pipe_version,
- const char *domain,
- const char *username,
- const char *password)
+ c->status = dcerpc_bind_auth_recv(ctx);
+ if (!composite_is_ok(c)) return;
+
+ composite_done(c);
+}
+/*
+ Stage 2 of pipe_auth: Receive result of authenticated bind request, but handle fallbacks:
+ SPNEGO -> NTLMSSP
+*/
+static void continue_auth_auto(struct composite_context *ctx)
{
- NTSTATUS status;
- struct dcerpc_pipe *p;
+ struct composite_context *c = talloc_get_type(ctx->async.private_data,
+ struct composite_context);
+ struct pipe_auth_state *s = talloc_get_type(c->private_data, struct pipe_auth_state);
+ struct composite_context *sec_conn_req;
+
+ c->status = dcerpc_bind_auth_recv(ctx);
+ if (NT_STATUS_EQUAL(c->status, NT_STATUS_INVALID_PARAMETER)) {
+ /*
+ * Retry with NTLMSSP auth as fallback
+ * send a request for secondary rpc connection
+ */
+ sec_conn_req = dcerpc_secondary_connection_send(s->pipe,
+ s->binding);
+ composite_continue(c, sec_conn_req, continue_ntlmssp_connection, c);
+ return;
+ } else if (NT_STATUS_EQUAL(c->status, NT_STATUS_LOGON_FAILURE)) {
+ if (cli_credentials_wrong_password(s->credentials)) {
+ /*
+ * Retry SPNEGO with a better password
+ * send a request for secondary rpc connection
+ */
+ sec_conn_req = dcerpc_secondary_connection_send(s->pipe,
+ s->binding);
+ composite_continue(c, sec_conn_req, continue_spnego_after_wrong_pass, c);
+ return;
+ }
+ }
- (*pp) = NULL;
+ if (!composite_is_ok(c)) return;
- if (!binding->endpoint) {
- DEBUG(0, ("Path to unix socket not specified\n"));
- return NT_STATUS_INVALID_PARAMETER;
- }
+ composite_done(c);
+}
- p = dcerpc_pipe_init(NULL);
- if (p == NULL) {
- return NT_STATUS_NO_MEMORY;
- }
+/*
+ Stage 3 of pipe_auth (fallback to NTLMSSP case): Receive secondary
+ rpc connection (the first one can't be used any more, due to the
+ bind nak) and perform authenticated bind request
+*/
+static void continue_ntlmssp_connection(struct composite_context *ctx)
+{
+ struct composite_context *c;
+ struct pipe_auth_state *s;
+ struct composite_context *auth_req;
+ struct dcerpc_pipe *p2;
- status = dcerpc_pipe_open_unix_stream(p->conn, binding->endpoint);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to open unix socket %s - %s\n",
- binding->endpoint, nt_errstr(status)));
- talloc_free(p);
- return status;
- }
+ c = talloc_get_type(ctx->async.private_data, struct composite_context);
+ s = talloc_get_type(c->private_data, struct pipe_auth_state);
- status = dcerpc_pipe_auth(p, binding, pipe_uuid, pipe_version, domain, username, password);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p);
- return status;
- }
+ /* receive secondary rpc connection */
+ c->status = dcerpc_secondary_connection_recv(ctx, &p2);
+ if (!composite_is_ok(c)) return;
- (*pp) = p;
-
- return status;
+ talloc_steal(s, p2);
+ talloc_steal(p2, s->pipe);
+ s->pipe = p2;
+
+ /* initiate a authenticated bind */
+ auth_req = dcerpc_bind_auth_send(c, s->pipe, s->table,
+ s->credentials, DCERPC_AUTH_TYPE_NTLMSSP,
+ dcerpc_auth_level(s->pipe->conn),
+ s->table->authservices->names[0]);
+ composite_continue(c, auth_req, continue_auth, c);
}
-/* open a rpc connection to a rpc pipe on SMP using the binding
- structure to determine the endpoint and options */
-static NTSTATUS dcerpc_pipe_connect_ncacn_ip_tcp(struct dcerpc_pipe **pp,
- struct dcerpc_binding *binding,
- const char *pipe_uuid,
- uint32_t pipe_version,
- const char *domain,
- const char *username,
- const char *password)
+/*
+ Stage 3 of pipe_auth (retry on wrong password): Receive secondary
+ rpc connection (the first one can't be used any more, due to the
+ bind nak) and perform authenticated bind request
+*/
+static void continue_spnego_after_wrong_pass(struct composite_context *ctx)
{
- NTSTATUS status;
- uint32_t port = 0;
- struct dcerpc_pipe *p;
- TALLOC_CTX *tmp_ctx;
+ struct composite_context *c;
+ struct pipe_auth_state *s;
+ struct composite_context *auth_req;
+ struct dcerpc_pipe *p2;
- (*pp) = NULL;
+ c = talloc_get_type(ctx->async.private_data, struct composite_context);
+ s = talloc_get_type(c->private_data, struct pipe_auth_state);
- p = dcerpc_pipe_init(NULL);
- if (p == NULL) {
- return NT_STATUS_NO_MEMORY;
- }
- tmp_ctx = talloc_new(p);
-
- if (!binding->endpoint) {
- status = dcerpc_epm_map_binding(tmp_ctx, binding,
- pipe_uuid, pipe_version);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to map DCERPC/TCP port for '%s' - %s\n",
- pipe_uuid, nt_errstr(status)));
- talloc_free(p);
- return status;
- }
- DEBUG(1,("Mapped to DCERPC/TCP port %s\n", binding->endpoint));
- }
+ /* receive secondary rpc connection */
+ c->status = dcerpc_secondary_connection_recv(ctx, &p2);
+ if (!composite_is_ok(c)) return;
- port = atoi(binding->endpoint);
+ talloc_steal(s, p2);
+ talloc_steal(p2, s->pipe);
+ s->pipe = p2;
- status = dcerpc_pipe_open_tcp(p->conn, binding->host, port);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to connect to %s:%d - %s\n",
- binding->host, port, nt_errstr(status)));
- talloc_free(p);
- return status;
- }
+ /* initiate a authenticated bind */
+ auth_req = dcerpc_bind_auth_send(c, s->pipe, s->table,
+ s->credentials, DCERPC_AUTH_TYPE_SPNEGO,
+ dcerpc_auth_level(s->pipe->conn),
+ s->table->authservices->names[0]);
+ composite_continue(c, auth_req, continue_auth, c);
+}
- status = dcerpc_pipe_auth(p, binding, pipe_uuid, pipe_version, domain, username, password);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p);
- return status;
- }
- (*pp) = p;
- talloc_free(tmp_ctx);
-
- return status;
+/*
+ Stage 2 of pipe_auth: Receive result of non-authenticated bind request
+*/
+static void continue_auth_none(struct composite_context *ctx)
+{
+ struct composite_context *c = talloc_get_type(ctx->async.private_data,
+ struct composite_context);
+
+ c->status = dcerpc_bind_auth_none_recv(ctx);
+ if (!composite_is_ok(c)) return;
+
+ composite_done(c);
}
-/* open a rpc connection to a rpc pipe, using the specified
- binding structure to determine the endpoint and options */
-NTSTATUS dcerpc_pipe_connect_b(struct dcerpc_pipe **pp,
- struct dcerpc_binding *binding,
- const char *pipe_uuid,
- uint32_t pipe_version,
- const char *domain,
- const char *username,
- const char *password)
+/*
+ Request to perform an authenticated bind if required. Authentication
+ is determined using credentials passed and binding flags.
+*/
+struct composite_context *dcerpc_pipe_auth_send(struct dcerpc_pipe *p,
+ struct dcerpc_binding *binding,
+ const struct ndr_interface_table *table,
+ struct cli_credentials *credentials)
{
- NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
+ struct composite_context *c;
+ struct pipe_auth_state *s;
+ struct composite_context *auth_schannel_req;
+ struct composite_context *auth_req;
+ struct composite_context *auth_none_req;
+ struct dcerpc_connection *conn;
+ uint8_t auth_type;
+
+ /* composite context allocation and setup */
+ c = composite_create(p, p->conn->event_ctx);
+ if (c == NULL) return NULL;
+
+ s = talloc_zero(c, struct pipe_auth_state);
+ if (composite_nomem(s, c)) return c;
+ c->private_data = s;
+
+ /* store parameters in state structure */
+ s->binding = binding;
+ s->table = table;
+ s->credentials = credentials;
+ s->pipe = p;
+
+ conn = s->pipe->conn;
+ conn->flags = binding->flags;
+
+ /* remember the binding string for possible secondary connections */
+ conn->binding_string = dcerpc_binding_string(p, binding);
- switch (binding->transport) {
- case NCACN_NP:
- status = dcerpc_pipe_connect_ncacn_np(pp, binding, pipe_uuid, pipe_version,
- domain, username, password);
- break;
- case NCACN_IP_TCP:
- status = dcerpc_pipe_connect_ncacn_ip_tcp(pp, binding, pipe_uuid, pipe_version,
- domain, username, password);
- break;
- case NCACN_UNIX_STREAM:
- status = dcerpc_pipe_connect_ncacn_unix_stream(pp, binding, pipe_uuid, pipe_version,
- domain, username, password);
- break;
- case NCALRPC:
- status = dcerpc_pipe_connect_ncalrpc(pp, binding, pipe_uuid, pipe_version,
- domain, username, password);
- break;
- default:
- return NT_STATUS_NOT_SUPPORTED;
+ if (cli_credentials_is_anonymous(s->credentials)) {
+ auth_none_req = dcerpc_bind_auth_none_send(c, s->pipe, s->table);
+ composite_continue(c, auth_none_req, continue_auth_none, c);
+ return c;
}
- return status;
-}
-
+ if ((binding->flags & DCERPC_SCHANNEL) &&
+ !cli_credentials_get_netlogon_creds(s->credentials)) {
+ /* If we don't already have netlogon credentials for
+ * the schannel bind, then we have to get these
+ * first */
+ auth_schannel_req = dcerpc_bind_auth_schannel_send(c, s->pipe, s->table,
+ s->credentials,
+ dcerpc_auth_level(conn));
+ composite_continue(c, auth_schannel_req, continue_auth_schannel, c);
+ return c;
+ }
-/* open a rpc connection to a rpc pipe, using the specified string
- binding to determine the endpoint and options */
-NTSTATUS dcerpc_pipe_connect(struct dcerpc_pipe **pp,
- const char *binding,
- const char *pipe_uuid,
- uint32_t pipe_version,
- const char *domain,
- const char *username,
- const char *password)
-{
- struct dcerpc_binding b;
- NTSTATUS status;
- TALLOC_CTX *tmp_ctx;
+ /*
+ * we rely on the already authenticated CIFS connection
+ * if not doing sign or seal
+ */
+ if (conn->transport.transport == NCACN_NP &&
+ !(s->binding->flags & (DCERPC_SIGN|DCERPC_SEAL))) {
+ auth_none_req = dcerpc_bind_auth_none_send(c, s->pipe, s->table);
+ composite_continue(c, auth_none_req, continue_auth_none, c);
+ return c;
+ }
- tmp_ctx = talloc_new(NULL);
- status = dcerpc_parse_binding(tmp_ctx, binding, &b);
- if (!NT_STATUS_IS_OK(status)) {
- DEBUG(0,("Failed to parse dcerpc binding '%s'\n", binding));
- talloc_free(tmp_ctx);
- return status;
+ /* Perform an authenticated DCE-RPC bind
+ */
+ if (!(conn->flags & (DCERPC_SIGN|DCERPC_SEAL))) {
+ /*
+ we are doing an authenticated connection,
+ but not using sign or seal. We must force
+ the CONNECT dcerpc auth type as a NONE auth
+ type doesn't allow authentication
+ information to be passed.
+ */
+ conn->flags |= DCERPC_CONNECT;
}
- DEBUG(3,("Using binding %s\n", dcerpc_binding_string(tmp_ctx, &b)));
+ if (s->binding->flags & DCERPC_AUTH_SPNEGO) {
+ auth_type = DCERPC_AUTH_TYPE_SPNEGO;
- status = dcerpc_pipe_connect_b(pp, &b, pipe_uuid, pipe_version, domain, username, password);
+ } else if (s->binding->flags & DCERPC_AUTH_KRB5) {
+ auth_type = DCERPC_AUTH_TYPE_KRB5;
- talloc_free(tmp_ctx);
+ } else if (s->binding->flags & DCERPC_SCHANNEL) {
+ auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
- return status;
+ } else if (s->binding->flags & DCERPC_AUTH_NTLM) {
+ auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
+
+ } else {
+ /* try SPNEGO with fallback to NTLMSSP */
+ auth_req = dcerpc_bind_auth_send(c, s->pipe, s->table,
+ s->credentials, DCERPC_AUTH_TYPE_SPNEGO,
+ dcerpc_auth_level(conn),
+ s->table->authservices->names[0]);
+ composite_continue(c, auth_req, continue_auth_auto, c);
+ return c;
+ }
+
+ auth_req = dcerpc_bind_auth_send(c, s->pipe, s->table,
+ s->credentials, auth_type,
+ dcerpc_auth_level(conn),
+ s->table->authservices->names[0]);
+ composite_continue(c, auth_req, continue_auth, c);
+ return c;
}
/*
- create a secondary dcerpc connection from a primary connection
+ Receive result of authenticated bind request on dcerpc pipe
+
+ This returns *p, which may be different to the one originally
+ supllied, as it rebinds to a new pipe due to authentication fallback
- if the primary is a SMB connection then the secondary connection
- will be on the same SMB connection, but use a new fnum
*/
-NTSTATUS dcerpc_secondary_connection(struct dcerpc_pipe *p, struct dcerpc_pipe **p2,
- const char *pipe_name,
- const char *pipe_uuid,
- uint32_t pipe_version)
+NTSTATUS dcerpc_pipe_auth_recv(struct composite_context *c, TALLOC_CTX *mem_ctx,
+ struct dcerpc_pipe **p)
{
- struct smbcli_tree *tree;
- NTSTATUS status = NT_STATUS_INVALID_PARAMETER;
- struct dcerpc_binding b;
+ NTSTATUS status;
- (*p2) = dcerpc_pipe_init(p);
- if (*p2 == NULL) {
- return NT_STATUS_NO_MEMORY;
+ struct pipe_auth_state *s = talloc_get_type(c->private_data,
+ struct pipe_auth_state);
+ status = composite_wait(c);
+ if (!NT_STATUS_IS_OK(status)) {
+ char *uuid_str = GUID_string(s->pipe, &s->table->syntax_id.uuid);
+ DEBUG(0, ("Failed to bind to uuid %s - %s\n", uuid_str, nt_errstr(status)));
+ talloc_free(uuid_str);
+ } else {
+ talloc_steal(mem_ctx, s->pipe);
+ *p = s->pipe;
}
-
- switch (p->conn->transport.transport) {
- case NCACN_NP:
- tree = dcerpc_smb_tree(p->conn);
- if (!tree) {
- return NT_STATUS_INVALID_PARAMETER;
- }
- status = dcerpc_pipe_open_smb((*p2)->conn, tree, pipe_name);
- break;
-
- case NCACN_IP_TCP:
- status = dcerpc_parse_binding(p, p->conn->binding_string, &b);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
- status = dcerpc_pipe_open_tcp((*p2)->conn, b.host, atoi(b.endpoint));
- break;
- case NCALRPC:
- status = dcerpc_parse_binding(p, p->conn->binding_string, &b);
- if (!NT_STATUS_IS_OK(status)) {
- return status;
- }
- status = dcerpc_pipe_open_pipe((*p2)->conn, b.endpoint);
- break;
-
- default:
- return NT_STATUS_NOT_SUPPORTED;
- }
+ talloc_free(c);
+ return status;
+}
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(*p2);
- return status;
- }
- (*p2)->conn->flags = p->conn->flags;
+/*
+ Perform an authenticated bind if needed - sync version
- status = dcerpc_bind_auth_none(*p2, pipe_uuid, pipe_version);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(*p2);
- return status;
- }
+ This may change *p, as it rebinds to a new pipe due to authentication fallback
+*/
+NTSTATUS dcerpc_pipe_auth(TALLOC_CTX *mem_ctx,
+ struct dcerpc_pipe **p,
+ struct dcerpc_binding *binding,
+ const struct ndr_interface_table *table,
+ struct cli_credentials *credentials)
+{
+ struct composite_context *c;
- return NT_STATUS_OK;
+ c = dcerpc_pipe_auth_send(*p, binding, table, credentials);
+ return dcerpc_pipe_auth_recv(c, mem_ctx, p);
}
+
NTSTATUS dcerpc_generic_session_key(struct dcerpc_connection *c,
DATA_BLOB *session_key)
{
this triggers on a debug level of >= 10
*/
-void dcerpc_log_packet(const struct dcerpc_interface_table *ndr,
+void dcerpc_log_packet(const struct ndr_interface_table *ndr,
uint32_t opnum, uint32_t flags, DATA_BLOB *pkt)
{
const int num_examples = 20;
if (name == NULL) {
return;
}
- if (!file_exist(name, NULL)) {
+ if (!file_exist(name)) {
if (file_save(name, pkt->data, pkt->length)) {
DEBUG(10,("Logged rpc packet to %s\n", name));
}
*/
NTSTATUS dcerpc_secondary_context(struct dcerpc_pipe *p,
struct dcerpc_pipe **pp2,
- const char *pipe_uuid,
- uint32_t pipe_version)
+ const struct ndr_interface_table *table)
{
NTSTATUS status;
struct dcerpc_pipe *p2;
return NT_STATUS_NO_MEMORY;
}
p2->conn = talloc_reference(p2, p->conn);
+ p2->request_timeout = p->request_timeout;
p2->context_id = ++p->conn->next_context_id;
- status = GUID_from_string(pipe_uuid, &p2->syntax.uuid);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p2);
- return status;
- }
- p2->syntax.if_version = pipe_version;
+ p2->syntax = table->syntax_id;
- status = GUID_from_string(NDR_GUID, &p2->transfer_syntax.uuid);
- if (!NT_STATUS_IS_OK(status)) {
- talloc_free(p2);
- return status;
- }
- p2->transfer_syntax.if_version = NDR_GUID_VERSION;
+ p2->transfer_syntax = ndr_transfer_syntax;
+
+ p2->binding = talloc_reference(p2, p->binding);
status = dcerpc_alter_context(p2, p2, &p2->syntax, &p2->transfer_syntax);
if (!NT_STATUS_IS_OK(status)) {
git.samba.org / kai / samba-autobuild / .git / blobdiff