source4/rpc_server/common/reply.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    server side dcerpc common code
   5
   6    Copyright (C) Andrew Tridgell 2003-2010
   7    Copyright (C) Stefan (metze) Metzmacher 2004-2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "auth/auth.h"
  25 #include "auth/gensec/gensec.h"
  26 #include "../lib/util/dlinklist.h"
  27 #include "rpc_server/dcerpc_server.h"
  28 #include "rpc_server/dcerpc_server_proto.h"
  29 #include "rpc_server/common/proto.h"
  30 #include "librpc/rpc/dcerpc_proto.h"
  31 #include "system/filesys.h"
  32 #include "libcli/security/security.h"
  33 #include "param/param.h"
  34 #include "../lib/tsocket/tsocket.h"
  35 #include "../libcli/named_pipe_auth/npa_tstream.h"
  36 #include "smbd/service_stream.h"
  37 #include "../lib/tsocket/tsocket.h"
  38 #include "lib/socket/socket.h"
  39 #include "smbd/process_model.h"
  40 #include "lib/messaging/irpc.h"
  41 #include "librpc/rpc/rpc_common.h"
  42
  43
  44 /*
  45   move a call from an existing linked list to the specified list. This
  46   prevents bugs where we forget to remove the call from a previous
  47   list when moving it.
  48  */
  49 static void dcesrv_call_set_list(struct dcesrv_call_state *call,
  50                                  enum dcesrv_call_list list)
  51 {
  52         switch (call->list) {
  53         case DCESRV_LIST_NONE:
  54                 break;
  55         case DCESRV_LIST_CALL_LIST:
  56                 DLIST_REMOVE(call->conn->call_list, call);
  57                 break;
  58         case DCESRV_LIST_FRAGMENTED_CALL_LIST:
  59                 DLIST_REMOVE(call->conn->incoming_fragmented_call_list, call);
  60                 break;
  61         case DCESRV_LIST_PENDING_CALL_LIST:
  62                 DLIST_REMOVE(call->conn->pending_call_list, call);
  63                 break;
  64         }
  65         call->list = list;
  66         switch (list) {
  67         case DCESRV_LIST_NONE:
  68                 break;
  69         case DCESRV_LIST_CALL_LIST:
  70                 DLIST_ADD_END(call->conn->call_list, call);
  71                 break;
  72         case DCESRV_LIST_FRAGMENTED_CALL_LIST:
  73                 DLIST_ADD_END(call->conn->incoming_fragmented_call_list, call);
  74                 break;
  75         case DCESRV_LIST_PENDING_CALL_LIST:
  76                 DLIST_ADD_END(call->conn->pending_call_list, call);
  77                 break;
  78         }
  79 }
  80
  81
  82 void dcesrv_init_hdr(struct ncacn_packet *pkt, bool bigendian)
  83 {
  84         pkt->rpc_vers = 5;
  85         pkt->rpc_vers_minor = 0;
  86         if (bigendian) {
  87                 pkt->drep[0] = 0;
  88         } else {
  89                 pkt->drep[0] = DCERPC_DREP_LE;
  90         }
  91         pkt->drep[1] = 0;
  92         pkt->drep[2] = 0;
  93         pkt->drep[3] = 0;
  94 }
  95
  96
  97 /*
  98   return a dcerpc fault
  99 */
 100 NTSTATUS dcesrv_fault(struct dcesrv_call_state *call, uint32_t fault_code)
 101 {
 102         struct ncacn_packet pkt;
 103         struct data_blob_list_item *rep;
 104         static const uint8_t zeros[4] = { 0, };
 105         NTSTATUS status;
 106
 107         /* setup a fault */
 108         dcesrv_init_hdr(&pkt, lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
 109         pkt.auth_length = 0;
 110         pkt.call_id = call->pkt.call_id;
 111         pkt.ptype = DCERPC_PKT_FAULT;
 112         pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
 113         pkt.u.fault.alloc_hint = 0;
 114         pkt.u.fault.context_id = 0;
 115         pkt.u.fault.cancel_count = 0;
 116         pkt.u.fault.status = fault_code;
 117         pkt.u.fault._pad = data_blob_const(zeros, sizeof(zeros));
 118
 119         rep = talloc_zero(call, struct data_blob_list_item);
 120         if (!rep) {
 121                 return NT_STATUS_NO_MEMORY;
 122         }
 123
 124         status = ncacn_push_auth(&rep->blob, call, &pkt, NULL);
 125         if (!NT_STATUS_IS_OK(status)) {
 126                 return status;
 127         }
 128
 129         dcerpc_set_frag_length(&rep->blob, rep->blob.length);
 130
 131         DLIST_ADD_END(call->replies, rep);
 132         dcesrv_call_set_list(call, DCESRV_LIST_CALL_LIST);
 133
 134         if (call->conn->call_list && call->conn->call_list->replies) {
 135                 if (call->conn->transport.report_output_data) {
 136                         call->conn->transport.report_output_data(call->conn);
 137                 }
 138         }
 139
 140         return NT_STATUS_OK;
 141 }
 142
 143
 144
 145 _PUBLIC_ NTSTATUS dcesrv_reply(struct dcesrv_call_state *call)
 146 {
 147         struct ndr_push *push;
 148         NTSTATUS status;
 149         DATA_BLOB stub;
 150         uint32_t total_length, chunk_size;
 151         struct dcesrv_connection_context *context = call->context;
 152         size_t sig_size = 0;
 153
 154         /* call the reply function */
 155         status = context->iface->reply(call, call, call->r);
 156         if (!NT_STATUS_IS_OK(status)) {
 157                 return dcesrv_fault(call, call->fault_code);
 158         }
 159
 160         /* form the reply NDR */
 161         push = ndr_push_init_ctx(call);
 162         NT_STATUS_HAVE_NO_MEMORY(push);
 163
 164         /* carry over the pointer count to the reply in case we are
 165            using full pointer. See NDR specification for full
 166            pointers */
 167         push->ptr_count = call->ndr_pull->ptr_count;
 168
 169         if (lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx)) {
 170                 push->flags |= LIBNDR_FLAG_BIGENDIAN;
 171         }
 172
 173         status = context->iface->ndr_push(call, call, push, call->r);
 174         if (!NT_STATUS_IS_OK(status)) {
 175                 return dcesrv_fault(call, call->fault_code);
 176         }
 177
 178         stub = ndr_push_blob(push);
 179
 180         total_length = stub.length;
 181
 182         /* we can write a full max_recv_frag size, minus the dcerpc
 183            request header size */
 184         chunk_size = call->conn->max_xmit_frag;
 185         chunk_size -= DCERPC_REQUEST_LENGTH;
 186         if (call->conn->auth_state.auth_info &&
 187             call->conn->auth_state.gensec_security) {
 188                 size_t max_payload = chunk_size;
 189
 190                 max_payload -= DCERPC_AUTH_TRAILER_LENGTH;
 191                 max_payload -= (max_payload % DCERPC_AUTH_PAD_ALIGNMENT);
 192
 193                 sig_size = gensec_sig_size(call->conn->auth_state.gensec_security,
 194                                            max_payload);
 195                 if (sig_size) {
 196                         chunk_size -= DCERPC_AUTH_TRAILER_LENGTH;
 197                         chunk_size -= sig_size;
 198                 }
 199         }
 200         chunk_size -= (chunk_size % DCERPC_AUTH_PAD_ALIGNMENT);
 201
 202         do {
 203                 uint32_t length;
 204                 struct data_blob_list_item *rep;
 205                 struct ncacn_packet pkt;
 206
 207                 rep = talloc_zero(call, struct data_blob_list_item);
 208                 NT_STATUS_HAVE_NO_MEMORY(rep);
 209
 210                 length = MIN(chunk_size, stub.length);
 211
 212                 /* form the dcerpc response packet */
 213                 dcesrv_init_hdr(&pkt,
 214                                 lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
 215                 pkt.auth_length = 0;
 216                 pkt.call_id = call->pkt.call_id;
 217                 pkt.ptype = DCERPC_PKT_RESPONSE;
 218                 pkt.pfc_flags = 0;
 219                 if (stub.length == total_length) {
 220                         pkt.pfc_flags |= DCERPC_PFC_FLAG_FIRST;
 221                 }
 222                 if (length == stub.length) {
 223                         pkt.pfc_flags |= DCERPC_PFC_FLAG_LAST;
 224                 }
 225                 pkt.u.response.alloc_hint = stub.length;
 226                 pkt.u.response.context_id = call->pkt.u.request.context_id;
 227                 pkt.u.response.cancel_count = 0;
 228                 pkt.u.response._pad.data = call->pkt.u.request._pad.data;
 229                 pkt.u.response._pad.length = call->pkt.u.request._pad.length;
 230                 pkt.u.response.stub_and_verifier.data = stub.data;
 231                 pkt.u.response.stub_and_verifier.length = length;
 232
 233                 if (!dcesrv_auth_response(call, &rep->blob, sig_size, &pkt)) {
 234                         return dcesrv_fault(call, DCERPC_FAULT_OTHER);
 235                 }
 236
 237                 dcerpc_set_frag_length(&rep->blob, rep->blob.length);
 238
 239                 DLIST_ADD_END(call->replies, rep);
 240
 241                 stub.data += length;
 242                 stub.length -= length;
 243         } while (stub.length != 0);
 244
 245         /* move the call from the pending to the finished calls list */
 246         dcesrv_call_set_list(call, DCESRV_LIST_CALL_LIST);
 247
 248         if (call->conn->call_list && call->conn->call_list->replies) {
 249                 if (call->conn->transport.report_output_data) {
 250                         call->conn->transport.report_output_data(call->conn);
 251                 }
 252         }
 253
 254         return NT_STATUS_OK;
 255 }
 256
 257 NTSTATUS dcesrv_generic_session_key(struct dcesrv_connection *c,
 258                                     DATA_BLOB *session_key)
 259 {
 260         enum dcerpc_transport_t transport =
 261                 dcerpc_binding_get_transport(c->endpoint->ep_description);
 262
 263         if (transport != NCALRPC && transport != NCACN_UNIX_STREAM) {
 264                 return NT_STATUS_NO_USER_SESSION_KEY;
 265         }
 266
 267         return dcerpc_generic_session_key(NULL, session_key);
 268 }