benny/wmic
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

wmi-1.3.16 from opsview.com

Browse Source
This commit is contained in:
Are Casilla
2019-02-16 00:16:52 +01:00
parent 163fdd3d1b
commit 17b3af2911
2146 changed files with 678824 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Samba/source/librpc/rpc/dcerpc.c
+1707
View File
File diff suppressed because it is too large Load Diff
Samba/source/librpc/rpc/dcerpc.h
+263
View File
@@ -0,0 +1,263 @@
/*
Unix SMB/CIFS implementation.
DCERPC client side interface structures
Copyright (C) Tim Potter 2003
Copyright (C) Andrew Tridgell 2003-2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#ifndef __DCERPC_H__
#define __DCERPC_H__
#include "core.h"
#include "librpc/gen_ndr/dcerpc.h"
#include "librpc/ndr/libndr.h"
enum dcerpc_transport_t {
NCACN_NP, NCACN_IP_TCP, NCACN_IP_UDP, NCACN_VNS_IPC, NCACN_VNS_SPP,
NCACN_AT_DSP, NCADG_AT_DDP, NCALRPC, NCACN_UNIX_STREAM, NCADG_UNIX_DGRAM,
NCACN_HTTP, NCADG_IPX, NCACN_SPX };
/*
this defines a generic security context for signed/sealed dcerpc pipes.
*/
struct dcerpc_connection;
struct dcerpc_security {
struct dcerpc_auth *auth_info;
struct gensec_security *generic_state;
/* get the session key */
NTSTATUS (*session_key)(struct dcerpc_connection *, DATA_BLOB *);
};
/*
this holds the information that is not specific to a particular rpc context_id
*/
struct dcerpc_connection {
uint32_t call_id;
uint32_t srv_max_xmit_frag;
uint32_t srv_max_recv_frag;
uint32_t flags;
struct dcerpc_security security_state;
const char *binding_string;
struct event_context *event_ctx;
struct dcerpc_transport {
enum dcerpc_transport_t transport;
void *private;
NTSTATUS (*shutdown_pipe)(struct dcerpc_connection *);
const char *(*peer_name)(struct dcerpc_connection *);
const char *(*target_hostname)(struct dcerpc_connection *);
/* send a request to the server */
NTSTATUS (*send_request)(struct dcerpc_connection *, DATA_BLOB *, BOOL trigger_read);
/* send a read request to the server */
NTSTATUS (*send_read)(struct dcerpc_connection *);
/* a callback to the dcerpc code when a full fragment
has been received */
void (*recv_data)(struct dcerpc_connection *, DATA_BLOB *, NTSTATUS status);
} transport;
/* Requests that have been sent, waiting for a reply */
struct rpc_request *pending;
/* Sync requests waiting to be shipped */
struct rpc_request *request_queue;
/* the next context_id to be assigned */
uint32_t next_context_id;
};
/*
this encapsulates a full dcerpc client side pipe
*/
struct dcerpc_pipe {
uint32_t context_id;
struct dcerpc_syntax_id syntax;
struct dcerpc_syntax_id transfer_syntax;
struct dcerpc_connection *conn;
struct dcerpc_binding *binding;
/* the last fault code from a DCERPC fault */
uint32_t last_fault_code;
/* timeout for individual rpc requests, in seconds */
uint32_t request_timeout;
};
/* default timeout for all rpc requests, in seconds */
#define DCERPC_REQUEST_TIMEOUT 60
/* dcerpc pipe flags */
#define DCERPC_DEBUG_PRINT_IN (1<<0)
#define DCERPC_DEBUG_PRINT_OUT (1<<1)
#define DCERPC_DEBUG_PRINT_BOTH (DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT)
#define DCERPC_DEBUG_VALIDATE_IN (1<<2)
#define DCERPC_DEBUG_VALIDATE_OUT (1<<3)
#define DCERPC_DEBUG_VALIDATE_BOTH (DCERPC_DEBUG_VALIDATE_IN | DCERPC_DEBUG_VALIDATE_OUT)
#define DCERPC_CONNECT (1<<4)
#define DCERPC_SIGN (1<<5)
#define DCERPC_SEAL (1<<6)
#define DCERPC_PUSH_BIGENDIAN (1<<7)
#define DCERPC_PULL_BIGENDIAN (1<<8)
#define DCERPC_SCHANNEL (1<<9)
/* use a 128 bit session key */
#define DCERPC_SCHANNEL_128 (1<<12)
/* check incoming pad bytes */
#define DCERPC_DEBUG_PAD_CHECK (1<<13)
/* set LIBNDR_FLAG_REF_ALLOC flag when decoding NDR */
#define DCERPC_NDR_REF_ALLOC (1<<14)
#define DCERPC_AUTH_OPTIONS (DCERPC_SEAL|DCERPC_SIGN|DCERPC_SCHANNEL|DCERPC_AUTH_SPNEGO|DCERPC_AUTH_KRB5|DCERPC_AUTH_NTLM)
/* select spnego auth */
#define DCERPC_AUTH_SPNEGO (1<<15)
/* select krb5 auth */
#define DCERPC_AUTH_KRB5 (1<<16)
#define DCERPC_SMB2 (1<<17)
/* select NTLM auth */
#define DCERPC_AUTH_NTLM (1<<18)
/*
this is used to find pointers to calls
*/
struct dcerpc_interface_call {
const char *name;
size_t struct_size;
ndr_push_flags_fn_t ndr_push;
ndr_pull_flags_fn_t ndr_pull;
ndr_print_function_t ndr_print;
BOOL async;
};
struct dcerpc_endpoint_list {
uint32_t count;
const char * const *names;
};
struct dcerpc_authservice_list {
uint32_t count;
const char * const *names;
};
struct dcerpc_interface_table {
const char *name;
struct dcerpc_syntax_id syntax_id;
const char *helpstring;
uint32_t num_calls;
const struct dcerpc_interface_call *calls;
const struct dcerpc_endpoint_list *endpoints;
const struct dcerpc_authservice_list *authservices;
};
struct dcerpc_interface_list {
struct dcerpc_interface_list *prev, *next;
const struct dcerpc_interface_table *table;
};
/* this describes a binding to a particular transport/pipe */
struct dcerpc_binding {
enum dcerpc_transport_t transport;
struct dcerpc_syntax_id object;
const char *host;
const char *target_hostname;
const char *endpoint;
const char **options;
uint32_t flags;
};
struct dcerpc_pipe_connect {
struct dcerpc_pipe *pipe;
struct dcerpc_binding *binding;
const char *pipe_name;
const struct dcerpc_interface_table *interface;
struct cli_credentials *creds;
};
enum rpc_request_state {
RPC_REQUEST_PENDING,
RPC_REQUEST_DONE
};
/*
handle for an async dcerpc request
*/
struct rpc_request {
struct rpc_request *next, *prev;
struct dcerpc_pipe *p;
NTSTATUS status;
uint32_t call_id;
enum rpc_request_state state;
DATA_BLOB payload;
uint32_t flags;
uint32_t fault_code;
/* this is used to distinguish bind and alter_context requests
from normal requests */
void (*recv_handler)(struct rpc_request *conn,
DATA_BLOB *blob, struct ncacn_packet *pkt);
const struct GUID *object;
uint16_t opnum;
DATA_BLOB request_data;
BOOL async_call;
/* use by the ndr level async recv call */
struct {
const struct dcerpc_interface_table *table;
uint32_t opnum;
void *struct_ptr;
TALLOC_CTX *mem_ctx;
} ndr;
struct {
void (*callback)(struct rpc_request *);
void *private;
} async;
};
struct epm_tower;
struct epm_floor;
struct smbcli_tree;
struct smb2_tree;
struct socket_address;
#include "librpc/rpc/dcerpc_proto.h"
#endif /* __DCERPC_H__ */
Samba/source/librpc/rpc/dcerpc_auth.c
+383
View File
@@ -0,0 +1,383 @@
/*
Unix SMB/CIFS implementation.
Generic Authentication Interface
Copyright (C) Andrew Tridgell 2003
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
Copyright (C) Stefan Metzmacher 2004
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#include "libcli/composite/composite.h"
#include "auth/gensec/gensec.h"
#include "librpc/rpc/dcerpc.h"
/*
return the rpc syntax and transfer syntax given the pipe uuid and version
*/
static NTSTATUS dcerpc_init_syntaxes(const struct dcerpc_interface_table *table,
struct dcerpc_syntax_id *syntax,
struct dcerpc_syntax_id *transfer_syntax)
{
syntax->uuid = table->syntax_id.uuid;
syntax->if_version = table->syntax_id.if_version;
*transfer_syntax = ndr_transfer_syntax;
return NT_STATUS_OK;
}
/*
Send request to do a non-authenticated dcerpc bind
*/
struct composite_context *dcerpc_bind_auth_none_send(TALLOC_CTX *mem_ctx,
struct dcerpc_pipe *p,
const struct dcerpc_interface_table *table)
{
struct dcerpc_syntax_id syntax;
struct dcerpc_syntax_id transfer_syntax;
struct composite_context *c;
c = composite_create(mem_ctx, p->conn->event_ctx);
if (c == NULL) return NULL;
c->status = dcerpc_init_syntaxes(table,
&syntax, &transfer_syntax);
if (!NT_STATUS_IS_OK(c->status)) {
DEBUG(2,("Invalid uuid string in "
"dcerpc_bind_auth_none_send\n"));
composite_error(c, c->status);
return c;
}
/* c was only allocated as a container for a possible error */
talloc_free(c);
return dcerpc_bind_send(p, mem_ctx, &syntax, &transfer_syntax);
}
/*
Receive result of a non-authenticated dcerpc bind
*/
NTSTATUS dcerpc_bind_auth_none_recv(struct composite_context *ctx)
{
return dcerpc_bind_recv(ctx);
}
/*
Perform sync non-authenticated dcerpc bind
*/
NTSTATUS dcerpc_bind_auth_none(struct dcerpc_pipe *p,
const struct dcerpc_interface_table *table)
{
struct composite_context *ctx;
ctx = dcerpc_bind_auth_none_send(p, p, table);
return dcerpc_bind_auth_none_recv(ctx);
}
struct bind_auth_state {
struct dcerpc_pipe *pipe;
DATA_BLOB credentials;
BOOL more_processing; /* Is there anything more to do after the
* first bind itself received? */
};
static void bind_auth_recv_alter(struct composite_context *creq);
static void bind_auth_next_step(struct composite_context *c)
{
struct bind_auth_state *state;
struct dcerpc_security *sec;
struct composite_context *creq;
BOOL more_processing = False;
state = talloc_get_type(c->private_data, struct bind_auth_state);
sec = &state->pipe->conn->security_state;
/* The status value here, from GENSEC is vital to the security
* of the system. Even if the other end accepts, if GENSEC
* claims 'MORE_PROCESSING_REQUIRED' then you must keep
* feeding it blobs, or else the remote host/attacker might
* avoid mutal authentication requirements.
*
* Likewise, you must not feed GENSEC too much (after the OK),
* it doesn't like that either
*/
c->status = gensec_update(sec->generic_state, state,
sec->auth_info->credentials,
&state->credentials);
if (NT_STATUS_EQUAL(c->status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
more_processing = True;
c->status = NT_STATUS_OK;
}
if (!composite_is_ok(c)) return;
if (state->credentials.length == 0) {
composite_done(c);
return;
}
sec->auth_info->credentials = state->credentials;
if (!more_processing) {
/* NO reply expected, so just send it */
c->status = dcerpc_auth3(state->pipe->conn, state);
if (!composite_is_ok(c)) return;
composite_done(c);
return;
}
/* We are demanding a reply, so use a request that will get us one */
creq = dcerpc_alter_context_send(state->pipe, state,
&state->pipe->syntax,
&state->pipe->transfer_syntax);
if (composite_nomem(creq, c)) return;
composite_continue(c, creq, bind_auth_recv_alter, c);
}
static void bind_auth_recv_alter(struct composite_context *creq)
{
struct composite_context *c = talloc_get_type(creq->async.private_data,
struct composite_context);
c->status = dcerpc_alter_context_recv(creq);
if (!composite_is_ok(c)) return;
bind_auth_next_step(c);
}
static void bind_auth_recv_bindreply(struct composite_context *creq)
{
struct composite_context *c = talloc_get_type(creq->async.private_data,
struct composite_context);
struct bind_auth_state *state = talloc_get_type(c->private_data,
struct bind_auth_state);
c->status = dcerpc_bind_recv(creq);
if (!composite_is_ok(c)) return;
if (!state->more_processing) {
/* The first gensec_update has not requested a second run, so
* we're done here. */
composite_done(c);
return;
}
bind_auth_next_step(c);
}
/**
Bind to a DCE/RPC pipe, send async request
@param mem_ctx TALLOC_CTX for the allocation of the composite_context
@param p The dcerpc_pipe to bind (must already be connected)
@param table The interface table to use (the DCE/RPC bind both selects and interface and authenticates)
@param credentials The credentials of the account to connect with
@param auth_type Select the authentication scheme to use
@param auth_level Chooses between unprotected (connect), signed or sealed
@param service The service (used by Kerberos to select the service principal to contact)
@retval A composite context describing the partial state of the bind
*/
struct composite_context *dcerpc_bind_auth_send(TALLOC_CTX *mem_ctx,
struct dcerpc_pipe *p,
const struct dcerpc_interface_table *table,
struct cli_credentials *credentials,
uint8_t auth_type, uint8_t auth_level,
const char *service)
{
struct composite_context *c, *creq;
struct bind_auth_state *state;
struct dcerpc_security *sec;
struct dcerpc_syntax_id syntax, transfer_syntax;
/* composite context allocation and setup */
c = composite_create(mem_ctx, p->conn->event_ctx);
if (c == NULL) return NULL;
state = talloc(c, struct bind_auth_state);
if (composite_nomem(state, c)) return c;
c->private_data = state;
state->pipe = p;
c->status = dcerpc_init_syntaxes(table,
&syntax,
&transfer_syntax);
if (!composite_is_ok(c)) return c;
sec = &p->conn->security_state;
c->status = gensec_client_start(p, &sec->generic_state,
p->conn->event_ctx);
if (!NT_STATUS_IS_OK(c->status)) {
DEBUG(1, ("Failed to start GENSEC client mode: %s\n",
nt_errstr(c->status)));
composite_error(c, c->status);
return c;
}
c->status = gensec_set_credentials(sec->generic_state, credentials);
if (!NT_STATUS_IS_OK(c->status)) {
DEBUG(1, ("Failed to set GENSEC client credentails: %s\n",
nt_errstr(c->status)));
composite_error(c, c->status);
return c;
}
c->status = gensec_set_target_hostname(sec->generic_state,
p->conn->transport.target_hostname(p->conn));
if (!NT_STATUS_IS_OK(c->status)) {
DEBUG(1, ("Failed to set GENSEC target hostname: %s\n",
nt_errstr(c->status)));
composite_error(c, c->status);
return c;
}
if (service != NULL) {
c->status = gensec_set_target_service(sec->generic_state,
service);
if (!NT_STATUS_IS_OK(c->status)) {
DEBUG(1, ("Failed to set GENSEC target service: %s\n",
nt_errstr(c->status)));
composite_error(c, c->status);
return c;
}
}
c->status = gensec_start_mech_by_authtype(sec->generic_state,
auth_type, auth_level);
if (!NT_STATUS_IS_OK(c->status)) {
DEBUG(1, ("Failed to start GENSEC client mechanism %s: %s\n",
gensec_get_name_by_authtype(auth_type),
nt_errstr(c->status)));
composite_error(c, c->status);
return c;
}
sec->auth_info = talloc(p, struct dcerpc_auth);
if (composite_nomem(sec->auth_info, c)) return c;
sec->auth_info->auth_type = auth_type;
sec->auth_info->auth_level = auth_level,
sec->auth_info->auth_pad_length = 0;
sec->auth_info->auth_reserved = 0;
sec->auth_info->auth_context_id = random();
sec->auth_info->credentials = data_blob(NULL, 0);
/* The status value here, from GENSEC is vital to the security
* of the system. Even if the other end accepts, if GENSEC
* claims 'MORE_PROCESSING_REQUIRED' then you must keep
* feeding it blobs, or else the remote host/attacker might
* avoid mutal authentication requirements.
*
* Likewise, you must not feed GENSEC too much (after the OK),
* it doesn't like that either
*/
c->status = gensec_update(sec->generic_state, state,
sec->auth_info->credentials,
&state->credentials);
if (!NT_STATUS_IS_OK(c->status) &&
!NT_STATUS_EQUAL(c->status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
composite_error(c, c->status);
return c;
}
state->more_processing = NT_STATUS_EQUAL(c->status,
NT_STATUS_MORE_PROCESSING_REQUIRED);
if (state->credentials.length == 0) {
composite_done(c);
return c;
}
sec->auth_info->credentials = state->credentials;
/* The first request always is a dcerpc_bind. The subsequent ones
* depend on gensec results */
creq = dcerpc_bind_send(p, state, &syntax, &transfer_syntax);
if (composite_nomem(creq, c)) return c;
composite_continue(c, creq, bind_auth_recv_bindreply, c);
return c;
}
/**
Bind to a DCE/RPC pipe, receive result
@param creq A composite context describing state of async call
@retval NTSTATUS code
*/
NTSTATUS dcerpc_bind_auth_recv(struct composite_context *creq)
{
NTSTATUS result = composite_wait(creq);
struct bind_auth_state *state = talloc_get_type(creq->private_data,
struct bind_auth_state);
if (NT_STATUS_IS_OK(result)) {
/*
after a successful authenticated bind the session
key reverts to the generic session key
*/
state->pipe->conn->security_state.session_key = dcerpc_generic_session_key;
}
talloc_free(creq);
return result;
}
/**
Perform a GENSEC authenticated bind to a DCE/RPC pipe, sync
@param p The dcerpc_pipe to bind (must already be connected)
@param table The interface table to use (the DCE/RPC bind both selects and interface and authenticates)
@param credentials The credentials of the account to connect with
@param auth_type Select the authentication scheme to use
@param auth_level Chooses between unprotected (connect), signed or sealed
@param service The service (used by Kerberos to select the service principal to contact)
@retval NTSTATUS status code
*/
NTSTATUS dcerpc_bind_auth(struct dcerpc_pipe *p,
const struct dcerpc_interface_table *table,
struct cli_credentials *credentials,
uint8_t auth_type, uint8_t auth_level,
const char *service)
{
struct composite_context *creq;
creq = dcerpc_bind_auth_send(p, p, table, credentials,
auth_type, auth_level, service);
return dcerpc_bind_auth_recv(creq);
}
Samba/source/librpc/rpc/dcerpc_connect.c
+1210
View File
File diff suppressed because it is too large Load Diff
Samba/source/librpc/rpc/dcerpc_error.c
+56
View File
@@ -0,0 +1,56 @@
/*
Unix SMB/CIFS implementation.
dcerpc fault functions
Copyright (C) Stefan Metzmacher 2004
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#include "librpc/rpc/dcerpc.h"
struct dcerpc_fault_table {
const char *errstr;
uint32_t faultcode;
};
static const struct dcerpc_fault_table dcerpc_faults[] =
{
{ "DCERPC_FAULT_OP_RNG_ERROR", DCERPC_FAULT_OP_RNG_ERROR },
{ "DCERPC_FAULT_UNK_IF", DCERPC_FAULT_UNK_IF },
{ "DCERPC_FAULT_NDR", DCERPC_FAULT_NDR },
{ "DCERPC_FAULT_INVALID_TAG", DCERPC_FAULT_INVALID_TAG },
{ "DCERPC_FAULT_CONTEXT_MISMATCH", DCERPC_FAULT_CONTEXT_MISMATCH },
{ "DCERPC_FAULT_OTHER", DCERPC_FAULT_OTHER },
{ "DCERPC_FAULT_ACCESS_DENIED", DCERPC_FAULT_ACCESS_DENIED },
{ NULL, 0}
};
const char *dcerpc_errstr(TALLOC_CTX *mem_ctx, uint32_t fault_code)
{
int idx = 0;
while (dcerpc_faults[idx].errstr != NULL) {
if (dcerpc_faults[idx].faultcode == fault_code) {
return dcerpc_faults[idx].errstr;
}
idx++;
}
return talloc_asprintf(mem_ctx, "DCERPC fault 0x%08x", fault_code);
}
Samba/source/librpc/rpc/dcerpc_schannel.c
+405
View File
@@ -0,0 +1,405 @@
/*
Unix SMB/CIFS implementation.
dcerpc schannel operations
Copyright (C) Andrew Tridgell 2004
Copyright (C) Andrew Bartlett <abartlet@samba.org> 2004-2005
Copyright (C) Rafal Szczesniak 2006
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#include "auth/auth.h"
#include "libcli/composite/composite.h"
#include "libcli/auth/libcli_auth.h"
#include "librpc/gen_ndr/ndr_netlogon.h"
#include "librpc/gen_ndr/ndr_netlogon_c.h"
#include "auth/credentials/credentials.h"
struct schannel_key_state {
struct dcerpc_pipe *pipe;
struct dcerpc_pipe *pipe2;
struct dcerpc_binding *binding;
struct cli_credentials *credentials;
struct creds_CredentialState *creds;
uint32_t negotiate_flags;
struct netr_Credential credentials1;
struct netr_Credential credentials2;
struct netr_Credential credentials3;
struct netr_ServerReqChallenge r;
struct netr_ServerAuthenticate2 a;
const struct samr_Password *mach_pwd;
};
static void continue_secondary_connection(struct composite_context *ctx);
static void continue_bind_auth_none(struct composite_context *ctx);
static void continue_srv_challenge(struct rpc_request *req);
static void continue_srv_auth2(struct rpc_request *req);
/*
Stage 2 of schannel_key: Receive endpoint mapping and request secondary
rpc connection
*/
static void continue_epm_map_binding(struct composite_context *ctx)
{
struct composite_context *c;
struct schannel_key_state *s;
struct composite_context *sec_conn_req;
c = talloc_get_type(ctx->async.private_data, struct composite_context);
s = talloc_get_type(c->private_data, struct schannel_key_state);
/* receive endpoint mapping */
c->status = dcerpc_epm_map_binding_recv(ctx);
if (!NT_STATUS_IS_OK(c->status)) {
DEBUG(0,("Failed to map DCERPC/TCP NCACN_NP pipe for '%s' - %s\n",
DCERPC_NETLOGON_UUID, nt_errstr(c->status)));
composite_error(c, c->status);
return;
}
/* send a request for secondary rpc connection */
sec_conn_req = dcerpc_secondary_connection_send(s->pipe,
s->binding);
if (composite_nomem(sec_conn_req, c)) return;
composite_continue(c, sec_conn_req, continue_secondary_connection, c);
}
/*
Stage 3 of schannel_key: Receive secondary rpc connection and perform
non-authenticated bind request
*/
static void continue_secondary_connection(struct composite_context *ctx)
{
struct composite_context *c;
struct schannel_key_state *s;
struct composite_context *auth_none_req;
c = talloc_get_type(ctx->async.private_data, struct composite_context);
s = talloc_get_type(c->private_data, struct schannel_key_state);
/* receive secondary rpc connection */
c->status = dcerpc_secondary_connection_recv(ctx, &s->pipe2);
if (!composite_is_ok(c)) return;
talloc_steal(s, s->pipe2);
/* initiate a non-authenticated bind */
auth_none_req = dcerpc_bind_auth_none_send(c, s->pipe2, &dcerpc_table_netlogon);
if (composite_nomem(auth_none_req, c)) return;
composite_continue(c, auth_none_req, continue_bind_auth_none, c);
}
/*
Stage 4 of schannel_key: Receive non-authenticated bind and get
a netlogon challenge
*/
static void continue_bind_auth_none(struct composite_context *ctx)
{
struct composite_context *c;
struct schannel_key_state *s;
struct rpc_request *srv_challenge_req;
c = talloc_get_type(ctx->async.private_data, struct composite_context);
s = talloc_get_type(c->private_data, struct schannel_key_state);
/* receive result of non-authenticated bind request */
c->status = dcerpc_bind_auth_none_recv(ctx);
if (!composite_is_ok(c)) return;
/* prepare a challenge request */
s->r.in.server_name = talloc_asprintf(c, "\\\\%s", dcerpc_server_name(s->pipe));
if (composite_nomem(s->r.in.server_name, c)) return;
s->r.in.computer_name = cli_credentials_get_workstation(s->credentials);
s->r.in.credentials = &s->credentials1;
s->r.out.credentials = &s->credentials2;
generate_random_buffer(s->credentials1.data, sizeof(s->credentials1.data));
/*
request a netlogon challenge - a rpc request over opened secondary pipe
*/
srv_challenge_req = dcerpc_netr_ServerReqChallenge_send(s->pipe2, c, &s->r);
if (composite_nomem(srv_challenge_req, c)) return;
composite_continue_rpc(c, srv_challenge_req, continue_srv_challenge, c);
}
/*
Stage 5 of schannel_key: Receive a challenge and perform authentication
on the netlogon pipe
*/
static void continue_srv_challenge(struct rpc_request *req)
{
struct composite_context *c;
struct schannel_key_state *s;
struct rpc_request *srv_auth2_req;
c = talloc_get_type(req->async.private, struct composite_context);
s = talloc_get_type(c->private_data, struct schannel_key_state);
/* receive rpc request result - netlogon challenge */
c->status = dcerpc_ndr_request_recv(req);
if (!composite_is_ok(c)) return;
/* prepare credentials for auth2 request */
s->mach_pwd = cli_credentials_get_nt_hash(s->credentials, c);
creds_client_init(s->creds, &s->credentials1, &s->credentials2,
s->mach_pwd, &s->credentials3, s->negotiate_flags);
/* auth2 request arguments */
s->a.in.server_name = s->r.in.server_name;
s->a.in.account_name = cli_credentials_get_username(s->credentials);
s->a.in.secure_channel_type =
cli_credentials_get_secure_channel_type(s->credentials);
s->a.in.computer_name = cli_credentials_get_workstation(s->credentials);
s->a.in.negotiate_flags = &s->negotiate_flags;
s->a.in.credentials = &s->credentials3;
s->a.out.negotiate_flags = &s->negotiate_flags;
s->a.out.credentials = &s->credentials3;
/*
authenticate on the netlogon pipe - a rpc request over secondary pipe
*/
srv_auth2_req = dcerpc_netr_ServerAuthenticate2_send(s->pipe2, c, &s->a);
if (composite_nomem(srv_auth2_req, c)) return;
composite_continue_rpc(c, srv_auth2_req, continue_srv_auth2, c);
}
/*
Stage 6 of schannel_key: Receive authentication request result and verify
received credentials
*/
static void continue_srv_auth2(struct rpc_request *req)
{
struct composite_context *c;
struct schannel_key_state *s;
c = talloc_get_type(req->async.private, struct composite_context);
s = talloc_get_type(c->private_data, struct schannel_key_state);
/* receive rpc request result - auth2 credentials */
c->status = dcerpc_ndr_request_recv(req);
if (!composite_is_ok(c)) return;
/* verify credentials */
if (!creds_client_check(s->creds, s->a.out.credentials)) {
composite_error(c, NT_STATUS_UNSUCCESSFUL);
return;
}
/* setup current netlogon credentials */
cli_credentials_set_netlogon_creds(s->credentials, s->creds);
composite_done(c);
}
/*
Initiate establishing a schannel key using netlogon challenge
on a secondary pipe
*/
struct composite_context *dcerpc_schannel_key_send(TALLOC_CTX *mem_ctx,
struct dcerpc_pipe *p,
struct cli_credentials *credentials)
{
struct composite_context *c;
struct schannel_key_state *s;
struct composite_context *epm_map_req;
/* composite context allocation and setup */
c = composite_create(mem_ctx, p->conn->event_ctx);
if (c == NULL) return NULL;
s = talloc_zero(c, struct schannel_key_state);
if (composite_nomem(s, c)) return c;
c->private_data = s;
/* store parameters in the state structure */
s->pipe = p;
s->credentials = credentials;
/* allocate credentials */
s->creds = talloc(c, struct creds_CredentialState);
if (composite_nomem(s->creds, c)) return c;
/* type of authentication depends on schannel type */
if (s->pipe->conn->flags & DCERPC_SCHANNEL_128) {
s->negotiate_flags = NETLOGON_NEG_AUTH2_ADS_FLAGS;
} else {
s->negotiate_flags = NETLOGON_NEG_AUTH2_FLAGS;
}
/* allocate binding structure */
s->binding = talloc(c, struct dcerpc_binding);
if (composite_nomem(s->binding, c)) return c;
*s->binding = *s->pipe->binding;
/* request the netlogon endpoint mapping */
epm_map_req = dcerpc_epm_map_binding_send(c, s->binding,
&dcerpc_table_netlogon,
s->pipe->conn->event_ctx);
if (composite_nomem(epm_map_req, c)) return c;
composite_continue(c, epm_map_req, continue_epm_map_binding, c);
return c;
}
/*
Receive result of schannel key request
*/
NTSTATUS dcerpc_schannel_key_recv(struct composite_context *c)
{
NTSTATUS status = composite_wait(c);
talloc_free(c);
return status;
}
struct auth_schannel_state {
struct dcerpc_pipe *pipe;
struct cli_credentials *credentials;
const struct dcerpc_interface_table *table;
uint8_t auth_level;
};
static void continue_bind_auth(struct composite_context *ctx);
/*
Stage 2 of auth_schannel: Receive schannel key and intitiate an
authenticated bind using received credentials
*/
static void continue_schannel_key(struct composite_context *ctx)
{
struct composite_context *auth_req;
struct composite_context *c = talloc_get_type(ctx->async.private_data,
struct composite_context);
struct auth_schannel_state *s = talloc_get_type(c->private_data,
struct auth_schannel_state);
/* receive schannel key */
c->status = dcerpc_schannel_key_recv(ctx);
if (!composite_is_ok(c)) {
DEBUG(1, ("Failed to setup credentials for account %s: %s\n",
cli_credentials_get_username(s->credentials), nt_errstr(c->status)));
return;
}
/* send bind auth request with received creds */
auth_req = dcerpc_bind_auth_send(c, s->pipe, s->table, s->credentials,
DCERPC_AUTH_TYPE_SCHANNEL, s->auth_level,
NULL);
if (composite_nomem(auth_req, c)) return;
composite_continue(c, auth_req, continue_bind_auth, c);
}
/*
Stage 3 of auth_schannel: Receivce result of authenticated bind
and say if we're done ok.
*/
static void continue_bind_auth(struct composite_context *ctx)
{
struct composite_context *c = talloc_get_type(ctx->async.private_data,
struct composite_context);
c->status = dcerpc_bind_auth_recv(ctx);
if (!composite_is_ok(c)) return;
composite_done(c);
}
/*
Initiate schannel authentication request
*/
struct composite_context *dcerpc_bind_auth_schannel_send(TALLOC_CTX *tmp_ctx,
struct dcerpc_pipe *p,
const struct dcerpc_interface_table *table,
struct cli_credentials *credentials,
uint8_t auth_level)
{
struct composite_context *c;
struct auth_schannel_state *s;
struct composite_context *schan_key_req;
/* composite context allocation and setup */
c = composite_create(tmp_ctx, p->conn->event_ctx);
if (c == NULL) return NULL;
s = talloc_zero(c, struct auth_schannel_state);
if (composite_nomem(s, c)) return c;
c->private_data = s;
/* store parameters in the state structure */
s->pipe = p;
s->credentials = credentials;
s->table = table;
s->auth_level = auth_level;
/* start getting schannel key first */
schan_key_req = dcerpc_schannel_key_send(c, p, credentials);
if (composite_nomem(schan_key_req, c)) return c;
composite_continue(c, schan_key_req, continue_schannel_key, c);
return c;
}
/*
Receive result of schannel authentication request
*/
NTSTATUS dcerpc_bind_auth_schannel_recv(struct composite_context *c)
{
NTSTATUS status = composite_wait(c);
talloc_free(c);
return status;
}
/*
Perform schannel authenticated bind - sync version
*/
NTSTATUS dcerpc_bind_auth_schannel(TALLOC_CTX *tmp_ctx,
struct dcerpc_pipe *p,
const struct dcerpc_interface_table *table,
struct cli_credentials *credentials,
uint8_t auth_level)
{
struct composite_context *c;
c = dcerpc_bind_auth_schannel_send(tmp_ctx, p, table, credentials,
auth_level);
return dcerpc_bind_auth_schannel_recv(c);
}
Samba/source/librpc/rpc/dcerpc_smb.c
+582
View File
@@ -0,0 +1,582 @@
/*
Unix SMB/CIFS implementation.
dcerpc over SMB transport
Copyright (C) Tim Potter 2003
Copyright (C) Andrew Tridgell 2003
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#include "libcli/raw/libcliraw.h"
#include "libcli/composite/composite.h"
#include "librpc/rpc/dcerpc.h"
/* transport private information used by SMB pipe transport */
struct smb_private {
uint16_t fnum;
struct smbcli_tree *tree;
const char *server_name;
};
/*
tell the dcerpc layer that the transport is dead
*/
static void pipe_dead(struct dcerpc_connection *c, NTSTATUS status)
{
DEBUG_FN_ENTER;
c->transport.recv_data(c, NULL, status);
DEBUG_FN_EXIT;
}
/*
this holds the state of an in-flight call
*/
struct smb_read_state {
struct dcerpc_connection *c;
struct smbcli_request *req;
size_t received;
DATA_BLOB data;
union smb_read *io;
};
/*
called when a read request has completed
*/
static void smb_read_callback(struct smbcli_request *req)
{
DEBUG_FN_ENTER;
struct smb_private *smb;
struct smb_read_state *state;
union smb_read *io;
uint16_t frag_length;
NTSTATUS status;
state = talloc_get_type(req->async.private, struct smb_read_state);
smb = talloc_get_type(state->c->transport.private, struct smb_private);
io = state->io;
status = smb_raw_read_recv(state->req, io);
if (NT_STATUS_IS_ERR(status)) {
talloc_steal(NULL, state);
pipe_dead(state->c, status);
talloc_free(state);
return;
}
state->received += io->readx.out.nread;
if (state->received < 16) {
DEBUG(0,("dcerpc_smb: short packet (length %d) in read callback!\n",
(int)state->received));
talloc_steal(NULL, state);
pipe_dead(state->c, NT_STATUS_INFO_LENGTH_MISMATCH);
talloc_free(state);
return;
}
frag_length = dcerpc_get_frag_length(&state->data);
if (frag_length <= state->received) {
DATA_BLOB data = state->data;
struct dcerpc_connection *c = state->c;
data.length = state->received;
talloc_steal(state->c, data.data);
talloc_free(state);
c->transport.recv_data(c, &data, NT_STATUS_OK);
return;
}
/* initiate another read request, as we only got part of a fragment */
state->data.data = talloc_realloc(state, state->data.data, uint8_t, frag_length);
io->readx.in.mincnt = MIN(state->c->srv_max_xmit_frag,
frag_length - state->received);
io->readx.in.maxcnt = io->readx.in.mincnt;
io->readx.out.data = state->data.data + state->received;
state->req = smb_raw_read_send(smb->tree, io);
if (state->req == NULL) {
talloc_steal(NULL, state);
pipe_dead(state->c, NT_STATUS_NO_MEMORY);
talloc_free(state);
return;
}
state->req->async.fn = smb_read_callback;
state->req->async.private = state;
DEBUG_FN_EXIT;
}
/*
trigger a read request from the server, possibly with some initial
data in the read buffer
*/
static NTSTATUS send_read_request_continue(struct dcerpc_connection *c, DATA_BLOB *blob)
{
DEBUG_FN_ENTER;
struct smb_private *smb = c->transport.private;
union smb_read *io;
struct smb_read_state *state;
struct smbcli_request *req;
state = talloc(smb, struct smb_read_state);
if (state == NULL) {
return NT_STATUS_NO_MEMORY;
}
state->c = c;
if (blob == NULL) {
state->received = 0;
state->data = data_blob_talloc(state, NULL, 0x2000);
} else {
uint32_t frag_length = blob->length>=16?
dcerpc_get_frag_length(blob):0x2000;
state->received = blob->length;
state->data = data_blob_talloc(state, NULL, frag_length);
if (!state->data.data) {
talloc_free(state);
return NT_STATUS_NO_MEMORY;
}
/* Added by cgibbons@zenoss on 03/10/2010 - prevent a buffer
overrun. This may happen if the data blob has specified
an invalid fragment size out. Safety first! */
if (blob->length > talloc_get_size(state->data.data)) {
talloc_free(state);
return NT_STATUS_NO_MEMORY;
}
memcpy(state->data.data, blob->data, blob->length);
}
state->io = talloc(state, union smb_read);
io = state->io;
io->generic.level = RAW_READ_READX;
io->readx.in.file.fnum = smb->fnum;
io->readx.in.mincnt = state->data.length - state->received;
io->readx.in.maxcnt = io->readx.in.mincnt;
io->readx.in.offset = 0;
io->readx.in.remaining = 0;
io->readx.in.read_for_execute = False;
io->readx.out.data = state->data.data + state->received;
req = smb_raw_read_send(smb->tree, io);
if (req == NULL) {
return NT_STATUS_NO_MEMORY;
}
req->async.fn = smb_read_callback;
req->async.private = state;
state->req = req;
DEBUG_FN_EXIT;
return NT_STATUS_OK;
}
/*
trigger a read request from the server
*/
static NTSTATUS send_read_request(struct dcerpc_connection *c)
{
DEBUG_FN_ENTER;
DEBUG_FN_EXIT;
return send_read_request_continue(c, NULL);
}
/*
this holds the state of an in-flight trans call
*/
struct smb_trans_state {
struct dcerpc_connection *c;
struct smbcli_request *req;
struct smb_trans2 *trans;
};
/*
called when a trans request has completed
*/
static void smb_trans_callback(struct smbcli_request *req)
{
DEBUG_FN_ENTER;
struct smb_trans_state *state = req->async.private;
struct dcerpc_connection *c = state->c;
NTSTATUS status;
status = smb_raw_trans_recv(req, state, state->trans);
if (NT_STATUS_IS_ERR(status)) {
DEBUG_FN_FAIL("smb_raw_trans_recv return error NTSTATUS");
pipe_dead(c, status);
return;
}
if (!NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
DATA_BLOB data = state->trans->out.data;
talloc_steal(c, data.data);
talloc_free(state);
c->transport.recv_data(c, &data, NT_STATUS_OK);
DEBUG_FN_EXIT_MSG("BUFFER_OVERFLOW");
return;
}
/* there is more to receive - setup a readx */
send_read_request_continue(c, &state->trans->out.data);
talloc_free(state);
DEBUG_FN_EXIT;
}
/*
send a SMBtrans style request
*/
static NTSTATUS smb_send_trans_request(struct dcerpc_connection *c, DATA_BLOB *blob)
{
DEBUG_FN_ENTER;
struct smb_private *smb = c->transport.private;
struct smb_trans2 *trans;
uint16_t setup[2];
struct smb_trans_state *state;
state = talloc(smb, struct smb_trans_state);
if (state == NULL) {
return NT_STATUS_NO_MEMORY;
}
state->c = c;
state->trans = talloc(state, struct smb_trans2);
trans = state->trans;
trans->in.data = *blob;
trans->in.params = data_blob(NULL, 0);
setup[0] = TRANSACT_DCERPCCMD;
setup[1] = smb->fnum;
trans->in.max_param = 0;
trans->in.max_data = smb_raw_max_trans_data(smb->tree, 0);
trans->in.max_setup = 0;
trans->in.setup_count = 2;
trans->in.flags = 0;
trans->in.timeout = 0;
trans->in.setup = setup;
trans->in.trans_name = "\\PIPE\\";
state->req = smb_raw_trans_send(smb->tree, trans);
if (state->req == NULL) {
talloc_free(state);
return NT_STATUS_NO_MEMORY;
}
state->req->async.fn = smb_trans_callback;
state->req->async.private = state;
talloc_steal(state, state->req);
DEBUG_FN_EXIT;
return NT_STATUS_OK;
}
/*
called when a write request has completed
*/
static void smb_write_callback(struct smbcli_request *req)
{
DEBUG_FN_ENTER;
struct dcerpc_connection *c = req->async.private;
if (!NT_STATUS_IS_OK(req->status)) {
DEBUG(0,("dcerpc_smb: write callback error\n"));
talloc_steal(NULL, req);
pipe_dead(c, req->status);
}
smbcli_request_destroy(req);
DEBUG_FN_EXIT;
}
/*
send a packet to the server
*/
static NTSTATUS smb_send_request(struct dcerpc_connection *c, DATA_BLOB *blob, BOOL trigger_read)
{
DEBUG_FN_ENTER;
struct smb_private *smb = c->transport.private;
union smb_write io;
struct smbcli_request *req;
if (trigger_read) {
return smb_send_trans_request(c, blob);
}
io.generic.level = RAW_WRITE_WRITEX;
io.writex.in.file.fnum = smb->fnum;
io.writex.in.offset = 0;
io.writex.in.wmode = PIPE_START_MESSAGE;
io.writex.in.remaining = blob->length;
io.writex.in.count = blob->length;
io.writex.in.data = blob->data;
/* we must not timeout at the smb level for rpc requests, as otherwise
signing/sealing can be messed up */
smb->tree->session->transport->options.request_timeout = 0;
req = smb_raw_write_send(smb->tree, &io);
if (req == NULL) {
return NT_STATUS_NO_MEMORY;
}
req->async.fn = smb_write_callback;
req->async.private = c;
if (trigger_read) {
send_read_request(c);
}
DEBUG_FN_EXIT;
return NT_STATUS_OK;
}
/*
shutdown SMB pipe connection
*/
static NTSTATUS smb_shutdown_pipe(struct dcerpc_connection *c)
{
DEBUG_FN_ENTER;
struct smb_private *smb = c->transport.private;
union smb_close io;
struct smbcli_request *req;
/* maybe we're still starting up */
if (!smb) return NT_STATUS_OK;
io.close.level = RAW_CLOSE_CLOSE;
io.close.in.file.fnum = smb->fnum;
io.close.in.write_time = 0;
req = smb_raw_close_send(smb->tree, &io);
if (req != NULL) {
/* we don't care if this fails, so just free it if it succeeds */
req->async.fn = (void (*)(struct smbcli_request *))talloc_free;
}
talloc_free(smb);
DEBUG_FN_EXIT;
return NT_STATUS_OK;
}
/*
return SMB server name (called name)
*/
static const char *smb_peer_name(struct dcerpc_connection *c)
{
struct smb_private *smb = c->transport.private;
return smb->server_name;
}
/*
return remote name we make the actual connection (good for kerberos)
*/
static const char *smb_target_hostname(struct dcerpc_connection *c)
{
struct smb_private *smb = talloc_get_type(c->transport.private, struct smb_private);
return smb->tree->session->transport->socket->hostname;
}
/*
fetch the user session key
*/
static NTSTATUS smb_session_key(struct dcerpc_connection *c, DATA_BLOB *session_key)
{
struct smb_private *smb = c->transport.private;
if (smb->tree->session->user_session_key.data) {
*session_key = smb->tree->session->user_session_key;
return NT_STATUS_OK;
}
return NT_STATUS_NO_USER_SESSION_KEY;
}
struct pipe_open_smb_state {
union smb_open *open;
struct dcerpc_connection *c;
struct smbcli_tree *tree;
struct composite_context *ctx;
};
static void pipe_open_recv(struct smbcli_request *req);
struct composite_context *dcerpc_pipe_open_smb_send(struct dcerpc_connection *c,
struct smbcli_tree *tree,
const char *pipe_name)
{
DEBUG_FN_ENTER;
struct composite_context *ctx;
struct pipe_open_smb_state *state;
struct smbcli_request *req;
ctx = composite_create(c, c->event_ctx);
if (ctx == NULL) return NULL;
state = talloc(ctx, struct pipe_open_smb_state);
if (composite_nomem(state, ctx)) return ctx;
ctx->private_data = state;
state->c = c;
state->tree = tree;
state->ctx = ctx;
state->open = talloc(state, union smb_open);
if (composite_nomem(state->open, ctx)) return ctx;
state->open->ntcreatex.level = RAW_OPEN_NTCREATEX;
state->open->ntcreatex.in.flags = 0;
state->open->ntcreatex.in.root_fid = 0;
state->open->ntcreatex.in.access_mask =
SEC_STD_READ_CONTROL |
SEC_FILE_WRITE_ATTRIBUTE |
SEC_FILE_WRITE_EA |
SEC_FILE_READ_DATA |
SEC_FILE_WRITE_DATA;
state->open->ntcreatex.in.file_attr = 0;
state->open->ntcreatex.in.alloc_size = 0;
state->open->ntcreatex.in.share_access =
NTCREATEX_SHARE_ACCESS_READ |
NTCREATEX_SHARE_ACCESS_WRITE;
state->open->ntcreatex.in.open_disposition = NTCREATEX_DISP_OPEN;
state->open->ntcreatex.in.create_options = 0;
state->open->ntcreatex.in.impersonation =
NTCREATEX_IMPERSONATION_IMPERSONATION;
state->open->ntcreatex.in.security_flags = 0;
if ((strncasecmp(pipe_name, "/pipe/", 6) == 0) ||
(strncasecmp(pipe_name, "\\pipe\\", 6) == 0)) {
pipe_name += 6;
}
state->open->ntcreatex.in.fname =
(pipe_name[0] == '\\') ?
talloc_strdup(state->open, pipe_name) :
talloc_asprintf(state->open, "\\%s", pipe_name);
if (composite_nomem(state->open->ntcreatex.in.fname, ctx)) return ctx;
req = smb_raw_open_send(tree, state->open);
composite_continue_smb(ctx, req, pipe_open_recv, state);
DEBUG_FN_EXIT;
return ctx;
}
static void pipe_open_recv(struct smbcli_request *req)
{
DEBUG_FN_ENTER;
struct pipe_open_smb_state *state = talloc_get_type(req->async.private,
struct pipe_open_smb_state);
struct composite_context *ctx = state->ctx;
struct dcerpc_connection *c = state->c;
struct smb_private *smb;
ctx->status = smb_raw_open_recv(req, state, state->open);
if (!composite_is_ok(ctx)) return;
/*
fill in the transport methods
*/
c->transport.transport = NCACN_NP;
c->transport.private = NULL;
c->transport.shutdown_pipe = smb_shutdown_pipe;
c->transport.peer_name = smb_peer_name;
c->transport.target_hostname = smb_target_hostname;
c->transport.send_request = smb_send_request;
c->transport.send_read = send_read_request;
c->transport.recv_data = NULL;
/* Over-ride the default session key with the SMB session key */
c->security_state.session_key = smb_session_key;
smb = talloc(c, struct smb_private);
if (composite_nomem(smb, ctx)) return;
smb->fnum = state->open->ntcreatex.out.file.fnum;
smb->tree = talloc_reference(smb, state->tree);
smb->server_name= strupper_talloc(smb,
state->tree->session->transport->called.name);
if (composite_nomem(smb->server_name, ctx)) return;
c->transport.private = smb;
composite_done(ctx);
DEBUG_FN_EXIT;
}
NTSTATUS dcerpc_pipe_open_smb_recv(struct composite_context *c)
{
DEBUG_FN_ENTER;
NTSTATUS status = composite_wait(c);
talloc_free(c);
DEBUG_FN_EXIT;
return status;
}
NTSTATUS dcerpc_pipe_open_smb(struct dcerpc_connection *c,
struct smbcli_tree *tree,
const char *pipe_name)
{
DEBUG_FN_ENTER;
struct composite_context *ctx = dcerpc_pipe_open_smb_send(c, tree,
pipe_name);
return dcerpc_pipe_open_smb_recv(ctx);
}
/*
return the SMB tree used for a dcerpc over SMB pipe
*/
struct smbcli_tree *dcerpc_smb_tree(struct dcerpc_connection *c)
{
struct smb_private *smb;
if (c->transport.transport != NCACN_NP) return NULL;
smb = talloc_get_type(c->transport.private, struct smb_private);
if (!smb) return NULL;
return smb->tree;
}
Samba/source/librpc/rpc/dcerpc_smb2.c
+482
View File
@@ -0,0 +1,482 @@
/*
Unix SMB/CIFS implementation.
dcerpc over SMB2 transport
Copyright (C) Andrew Tridgell 2005
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#include "libcli/raw/libcliraw.h"
#include "libcli/composite/composite.h"
#include "libcli/smb2/smb2.h"
#include "libcli/smb2/smb2_calls.h"
#include "libcli/raw/ioctl.h"
#include "librpc/rpc/dcerpc.h"
/* transport private information used by SMB2 pipe transport */
struct smb2_private {
struct smb2_handle handle;
struct smb2_tree *tree;
const char *server_name;
};
/*
tell the dcerpc layer that the transport is dead
*/
static void pipe_dead(struct dcerpc_connection *c, NTSTATUS status)
{
c->transport.recv_data(c, NULL, status);
}
/*
this holds the state of an in-flight call
*/
struct smb2_read_state {
struct dcerpc_connection *c;
DATA_BLOB data;
};
/*
called when a read request has completed
*/
static void smb2_read_callback(struct smb2_request *req)
{
struct smb2_private *smb;
struct smb2_read_state *state;
struct smb2_read io;
uint16_t frag_length;
NTSTATUS status;
state = talloc_get_type(req->async.private, struct smb2_read_state);
smb = talloc_get_type(state->c->transport.private, struct smb2_private);
status = smb2_read_recv(req, state, &io);
if (NT_STATUS_IS_ERR(status)) {
pipe_dead(state->c, status);
talloc_free(state);
return;
}
status = data_blob_append(state, &state->data,
io.out.data.data, io.out.data.length);
if (NT_STATUS_IS_ERR(status)) {
pipe_dead(state->c, status);
talloc_free(state);
return;
}
if (state->data.length < 16) {
DEBUG(0,("dcerpc_smb2: short packet (length %d) in read callback!\n",
(int)state->data.length));
pipe_dead(state->c, NT_STATUS_INFO_LENGTH_MISMATCH);
talloc_free(state);
return;
}
frag_length = dcerpc_get_frag_length(&state->data);
if (frag_length <= state->data.length) {
DATA_BLOB data = state->data;
struct dcerpc_connection *c = state->c;
talloc_steal(c, data.data);
talloc_free(state);
c->transport.recv_data(c, &data, NT_STATUS_OK);
return;
}
/* initiate another read request, as we only got part of a fragment */
ZERO_STRUCT(io);
io.in.file.handle = smb->handle;
io.in.length = MIN(state->c->srv_max_xmit_frag,
frag_length - state->data.length);
if (io.in.length < 16) {
io.in.length = 16;
}
req = smb2_read_send(smb->tree, &io);
if (req == NULL) {
pipe_dead(state->c, NT_STATUS_NO_MEMORY);
talloc_free(state);
return;
}
req->async.fn = smb2_read_callback;
req->async.private = state;
}
/*
trigger a read request from the server, possibly with some initial
data in the read buffer
*/
static NTSTATUS send_read_request_continue(struct dcerpc_connection *c, DATA_BLOB *blob)
{
struct smb2_private *smb = c->transport.private;
struct smb2_read io;
struct smb2_read_state *state;
struct smb2_request *req;
state = talloc(smb, struct smb2_read_state);
if (state == NULL) {
return NT_STATUS_NO_MEMORY;
}
state->c = c;
if (blob == NULL) {
state->data = data_blob(NULL, 0);
} else {
state->data = *blob;
talloc_steal(state, state->data.data);
}
ZERO_STRUCT(io);
io.in.file.handle = smb->handle;
if (state->data.length >= 16) {
uint16_t frag_length = dcerpc_get_frag_length(&state->data);
io.in.length = frag_length - state->data.length;
} else {
io.in.length = 0x2000;
}
req = smb2_read_send(smb->tree, &io);
if (req == NULL) {
return NT_STATUS_NO_MEMORY;
}
req->async.fn = smb2_read_callback;
req->async.private = state;
return NT_STATUS_OK;
}
/*
trigger a read request from the server
*/
static NTSTATUS send_read_request(struct dcerpc_connection *c)
{
return send_read_request_continue(c, NULL);
}
/*
this holds the state of an in-flight trans call
*/
struct smb2_trans_state {
struct dcerpc_connection *c;
};
/*
called when a trans request has completed
*/
static void smb2_trans_callback(struct smb2_request *req)
{
struct smb2_trans_state *state = talloc_get_type(req->async.private,
struct smb2_trans_state);
struct dcerpc_connection *c = state->c;
NTSTATUS status;
struct smb2_ioctl io;
status = smb2_ioctl_recv(req, state, &io);
if (NT_STATUS_IS_ERR(status)) {
pipe_dead(c, status);
return;
}
if (!NT_STATUS_EQUAL(status, STATUS_BUFFER_OVERFLOW)) {
DATA_BLOB data = io.out.out;
talloc_steal(c, data.data);
talloc_free(state);
c->transport.recv_data(c, &data, NT_STATUS_OK);
return;
}
/* there is more to receive - setup a read */
send_read_request_continue(c, &io.out.out);
talloc_free(state);
}
/*
send a SMBtrans style request, using a named pipe read_write fsctl
*/
static NTSTATUS smb2_send_trans_request(struct dcerpc_connection *c, DATA_BLOB *blob)
{
struct smb2_private *smb = talloc_get_type(c->transport.private,
struct smb2_private);
struct smb2_ioctl io;
struct smb2_trans_state *state;
struct smb2_request *req;
state = talloc(smb, struct smb2_trans_state);
if (state == NULL) {
return NT_STATUS_NO_MEMORY;
}
state->c = c;
ZERO_STRUCT(io);
io.in.file.handle = smb->handle;
io.in.function = FSCTL_NAMED_PIPE_READ_WRITE;
io.in.max_response_size = 0x1000;
io.in.flags = 1;
io.in.out = *blob;
req = smb2_ioctl_send(smb->tree, &io);
if (req == NULL) {
talloc_free(state);
return NT_STATUS_NO_MEMORY;
}
req->async.fn = smb2_trans_callback;
req->async.private = state;
talloc_steal(state, req);
return NT_STATUS_OK;
}
/*
called when a write request has completed
*/
static void smb2_write_callback(struct smb2_request *req)
{
struct dcerpc_connection *c = req->async.private;
if (!NT_STATUS_IS_OK(req->status)) {
DEBUG(0,("dcerpc_smb2: write callback error\n"));
pipe_dead(c, req->status);
}
smb2_request_destroy(req);
}
/*
send a packet to the server
*/
static NTSTATUS smb2_send_request(struct dcerpc_connection *c, DATA_BLOB *blob,
BOOL trigger_read)
{
struct smb2_private *smb = c->transport.private;
struct smb2_write io;
struct smb2_request *req;
if (trigger_read) {
return smb2_send_trans_request(c, blob);
}
ZERO_STRUCT(io);
io.in.file.handle = smb->handle;
io.in.data = *blob;
req = smb2_write_send(smb->tree, &io);
if (req == NULL) {
return NT_STATUS_NO_MEMORY;
}
req->async.fn = smb2_write_callback;
req->async.private = c;
return NT_STATUS_OK;
}
/*
shutdown SMB pipe connection
*/
static NTSTATUS smb2_shutdown_pipe(struct dcerpc_connection *c)
{
struct smb2_private *smb = c->transport.private;
struct smb2_close io;
struct smb2_request *req;
/* maybe we're still starting up */
if (!smb) return NT_STATUS_OK;
ZERO_STRUCT(io);
io.in.file.handle = smb->handle;
req = smb2_close_send(smb->tree, &io);
if (req != NULL) {
/* we don't care if this fails, so just free it if it succeeds */
req->async.fn = (void (*)(struct smb2_request *))talloc_free;
}
talloc_free(smb);
return NT_STATUS_OK;
}
/*
return SMB server name
*/
static const char *smb2_peer_name(struct dcerpc_connection *c)
{
struct smb2_private *smb = talloc_get_type(c->transport.private,
struct smb2_private);
return smb->server_name;
}
/*
return remote name we make the actual connection (good for kerberos)
*/
static const char *smb2_target_hostname(struct dcerpc_connection *c)
{
struct smb2_private *smb = talloc_get_type(c->transport.private,
struct smb2_private);
return smb->tree->session->transport->socket->hostname;
}
/*
fetch the user session key
*/
static NTSTATUS smb2_session_key(struct dcerpc_connection *c, DATA_BLOB *session_key)
{
struct smb2_private *smb = talloc_get_type(c->transport.private,
struct smb2_private);
*session_key = smb->tree->session->session_key;
if (session_key->data == NULL) {
return NT_STATUS_NO_USER_SESSION_KEY;
}
return NT_STATUS_OK;
}
struct pipe_open_smb2_state {
struct dcerpc_connection *c;
struct composite_context *ctx;
};
static void pipe_open_recv(struct smb2_request *req);
struct composite_context *dcerpc_pipe_open_smb2_send(struct dcerpc_connection *c,
struct smb2_tree *tree,
const char *pipe_name)
{
struct composite_context *ctx;
struct pipe_open_smb2_state *state;
struct smb2_create io;
struct smb2_request *req;
ctx = composite_create(c, c->event_ctx);
if (ctx == NULL) return NULL;
state = talloc(ctx, struct pipe_open_smb2_state);
if (composite_nomem(state, ctx)) return ctx;
ctx->private_data = state;
state->c = c;
state->ctx = ctx;
ZERO_STRUCT(io);
io.in.access_mask =
SEC_STD_READ_CONTROL |
SEC_FILE_READ_ATTRIBUTE |
SEC_FILE_WRITE_ATTRIBUTE |
SEC_STD_SYNCHRONIZE |
SEC_FILE_READ_EA |
SEC_FILE_WRITE_EA |
SEC_FILE_READ_DATA |
SEC_FILE_WRITE_DATA |
SEC_FILE_APPEND_DATA;
io.in.share_access =
NTCREATEX_SHARE_ACCESS_READ |
NTCREATEX_SHARE_ACCESS_WRITE;
io.in.open_disposition = NTCREATEX_DISP_OPEN;
io.in.create_options =
NTCREATEX_OPTIONS_NON_DIRECTORY_FILE |
NTCREATEX_OPTIONS_UNKNOWN_400000;
io.in.impersonation = NTCREATEX_IMPERSONATION_IMPERSONATION;
if ((strncasecmp(pipe_name, "/pipe/", 6) == 0) ||
(strncasecmp(pipe_name, "\\pipe\\", 6) == 0)) {
pipe_name += 6;
}
io.in.fname = pipe_name;
req = smb2_create_send(tree, &io);
composite_continue_smb2(ctx, req, pipe_open_recv, state);
return ctx;
}
static void pipe_open_recv(struct smb2_request *req)
{
struct pipe_open_smb2_state *state =
talloc_get_type(req->async.private,
struct pipe_open_smb2_state);
struct composite_context *ctx = state->ctx;
struct dcerpc_connection *c = state->c;
struct smb2_tree *tree = req->tree;
struct smb2_private *smb;
struct smb2_create io;
ctx->status = smb2_create_recv(req, state, &io);
if (!composite_is_ok(ctx)) return;
/*
fill in the transport methods
*/
c->transport.transport = NCACN_NP;
c->transport.private = NULL;
c->transport.shutdown_pipe = smb2_shutdown_pipe;
c->transport.peer_name = smb2_peer_name;
c->transport.target_hostname = smb2_target_hostname;
c->transport.send_request = smb2_send_request;
c->transport.send_read = send_read_request;
c->transport.recv_data = NULL;
/* Over-ride the default session key with the SMB session key */
c->security_state.session_key = smb2_session_key;
smb = talloc(c, struct smb2_private);
if (composite_nomem(smb, ctx)) return;
smb->handle = io.out.file.handle;
smb->tree = talloc_reference(smb, tree);
smb->server_name= strupper_talloc(smb,
tree->session->transport->socket->hostname);
if (composite_nomem(smb->server_name, ctx)) return;
c->transport.private = smb;
composite_done(ctx);
}
NTSTATUS dcerpc_pipe_open_smb2_recv(struct composite_context *c)
{
NTSTATUS status = composite_wait(c);
talloc_free(c);
return status;
}
NTSTATUS dcerpc_pipe_open_smb2(struct dcerpc_connection *c,
struct smb2_tree *tree,
const char *pipe_name)
{
struct composite_context *ctx = dcerpc_pipe_open_smb2_send(c, tree, pipe_name);
return dcerpc_pipe_open_smb2_recv(ctx);
}
/*
return the SMB2 tree used for a dcerpc over SMB2 pipe
*/
struct smb2_tree *dcerpc_smb2_tree(struct dcerpc_connection *c)
{
struct smb2_private *smb = talloc_get_type(c->transport.private,
struct smb2_private);
return smb->tree;
}
Samba/source/librpc/rpc/dcerpc_sock.c
+751
View File
@@ -0,0 +1,751 @@
/*
Unix SMB/CIFS implementation.
dcerpc over standard sockets transport
Copyright (C) Andrew Tridgell 2003
Copyright (C) Jelmer Vernooij 2004
Copyright (C) Rafal Szczesniak 2006
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#include "lib/events/events.h"
#include "lib/socket/socket.h"
#include "lib/stream/packet.h"
#include "libcli/composite/composite.h"
#include "librpc/rpc/dcerpc.h"
#include "libcli/resolve/resolve.h"
/* transport private information used by general socket pipe transports */
struct sock_private {
struct fd_event *fde;
struct socket_context *sock;
char *server_name;
struct packet_context *packet;
uint32_t pending_reads;
};
/*
mark the socket dead
*/
static void sock_dead(struct dcerpc_connection *p, NTSTATUS status)
{
DEBUG_FN_ENTER;
struct sock_private *sock = p->transport.private;
if (sock && sock->sock != NULL) {
talloc_free(sock->fde);
talloc_free(sock->sock);
sock->sock = NULL;
}
if (!NT_STATUS_IS_OK(status)) {
p->transport.recv_data(p, NULL, status);
}
DEBUG_FN_EXIT;
}
/*
handle socket recv errors
*/
static void sock_error_handler(void *private, NTSTATUS status)
{
DEBUG_FN_ENTER;
struct dcerpc_connection *p = talloc_get_type(private,
struct dcerpc_connection);
sock_dead(p, status);
DEBUG_FN_EXIT;
}
/*
check if a blob is a complete packet
*/
static NTSTATUS sock_complete_packet(void *private, DATA_BLOB blob, size_t *size)
{
DEBUG_FN_ENTER;
if (blob.length < DCERPC_FRAG_LEN_OFFSET+2) {
return STATUS_MORE_ENTRIES;
}
*size = dcerpc_get_frag_length(&blob);
if (*size > blob.length) {
return STATUS_MORE_ENTRIES;
}
DEBUG_FN_EXIT;
return NT_STATUS_OK;
}
/*
process recv requests
*/
static NTSTATUS sock_process_recv(void *private, DATA_BLOB blob)
{
DEBUG_FN_ENTER;
struct dcerpc_connection *p = talloc_get_type(private,
struct dcerpc_connection);
struct sock_private *sock = p->transport.private;
sock->pending_reads--;
if (sock->pending_reads == 0) {
packet_recv_disable(sock->packet);
}
p->transport.recv_data(p, &blob, NT_STATUS_OK);
DEBUG_FN_EXIT;
return NT_STATUS_OK;
}
/*
called when a IO is triggered by the events system
*/
static void sock_io_handler(struct event_context *ev, struct fd_event *fde,
uint16_t flags, void *private)
{
struct dcerpc_connection *p = talloc_get_type(private,
struct dcerpc_connection);
struct sock_private *sock = p->transport.private;
if (flags & EVENT_FD_WRITE) {
packet_queue_run(sock->packet);
return;
}
if (sock->sock == NULL) {
return;
}
if (flags & EVENT_FD_READ) {
packet_recv(sock->packet);
}
}
/*
initiate a read request - not needed for dcerpc sockets
*/
static NTSTATUS sock_send_read(struct dcerpc_connection *p)
{
DEBUG_FN_ENTER;
struct sock_private *sock = p->transport.private;
sock->pending_reads++;
if (sock->pending_reads == 1) {
packet_recv_enable(sock->packet);
}
DEBUG_FN_EXIT;
return NT_STATUS_OK;
}
/*
send an initial pdu in a multi-pdu sequence
*/
static NTSTATUS sock_send_request(struct dcerpc_connection *p, DATA_BLOB *data,
BOOL trigger_read)
{
DEBUG_FN_ENTER;
struct sock_private *sock = p->transport.private;
DATA_BLOB blob;
NTSTATUS status;
if (sock->sock == NULL) {
DEBUG_FN_FAIL("sock->sock is NULL");
return NT_STATUS_CONNECTION_DISCONNECTED;
}
blob = data_blob_talloc(sock->packet, data->data, data->length);
if (blob.data == NULL) {
DEBUG_FN_FAIL("failed allocating blob");
return NT_STATUS_NO_MEMORY;
}
status = packet_send(sock->packet, blob);
if (!NT_STATUS_IS_OK(status)) {
DEBUG_FN_FAIL("packet_send failed, !NT_STATUS_IS_OK");
return status;
}
if (trigger_read) {
sock_send_read(p);
}
DEBUG_FN_EXIT;
return NT_STATUS_OK;
}
/*
shutdown sock pipe connection
*/
static NTSTATUS sock_shutdown_pipe(struct dcerpc_connection *p)
{
DEBUG_FN_ENTER;
struct sock_private *sock = p->transport.private;
if (sock && sock->sock) {
sock_dead(p, NT_STATUS_OK);
}
DEBUG_FN_EXIT;
return NT_STATUS_OK;
}
/*
return sock server name
*/
static const char *sock_peer_name(struct dcerpc_connection *p)
{
struct sock_private *sock = talloc_get_type(p->transport.private, struct sock_private);
return sock->server_name;
}
/*
return remote name we make the actual connection (good for kerberos)
*/
static const char *sock_target_hostname(struct dcerpc_connection *p)
{
struct sock_private *sock = talloc_get_type(p->transport.private, struct sock_private);
return sock->server_name;
}
struct pipe_open_socket_state {
struct dcerpc_connection *conn;
struct socket_context *socket_ctx;
struct sock_private *sock;
struct socket_address *server;
const char *target_hostname;
enum dcerpc_transport_t transport;
};
static void continue_socket_connect(struct composite_context *ctx)
{
DEBUG_FN_ENTER;
struct dcerpc_connection *conn;
struct sock_private *sock;
struct composite_context *c = talloc_get_type(ctx->async.private_data,
struct composite_context);
struct pipe_open_socket_state *s = talloc_get_type(c->private_data,
struct pipe_open_socket_state);
/* make it easier to write a function calls */
conn = s->conn;
sock = s->sock;
c->status = socket_connect_recv(ctx);
if (!NT_STATUS_IS_OK(c->status)) {
DEBUG(1, ("Failed to connect host %s on port %d - %s\n",
s->server->addr, s->server->port,
nt_errstr(c->status)));
composite_error(c, c->status);
return;
}
/*
fill in the transport methods
*/
conn->transport.transport = s->transport;
conn->transport.private = NULL;
conn->transport.send_request = sock_send_request;
conn->transport.send_read = sock_send_read;
conn->transport.recv_data = NULL;
conn->transport.shutdown_pipe = sock_shutdown_pipe;
conn->transport.peer_name = sock_peer_name;
conn->transport.target_hostname = sock_target_hostname;
sock->sock = s->socket_ctx;
sock->pending_reads = 0;
sock->server_name = strupper_talloc(sock, s->target_hostname);
sock->fde = event_add_fd(conn->event_ctx, sock->sock, socket_get_fd(sock->sock),
0, sock_io_handler, conn);
conn->transport.private = sock;
sock->packet = packet_init(sock);
if (sock->packet == NULL) {
composite_error(c, NT_STATUS_NO_MEMORY);
talloc_free(sock);
return;
}
packet_set_private(sock->packet, conn);
packet_set_socket(sock->packet, sock->sock);
packet_set_callback(sock->packet, sock_process_recv);
packet_set_full_request(sock->packet, sock_complete_packet);
packet_set_error_handler(sock->packet, sock_error_handler);
packet_set_event_context(sock->packet, conn->event_ctx);
packet_set_fde(sock->packet, sock->fde);
packet_set_serialise(sock->packet);
packet_recv_disable(sock->packet);
packet_set_initial_read(sock->packet, 16);
/* ensure we don't get SIGPIPE */
BlockSignals(True,SIGPIPE);
composite_done(c);
DEBUG_FN_EXIT;
}
struct composite_context *dcerpc_pipe_open_socket_send(TALLOC_CTX *mem_ctx,
struct dcerpc_connection *cn,
struct socket_address *server,
const char *target_hostname,
enum dcerpc_transport_t transport)
{
DEBUG_FN_ENTER;
struct composite_context *c;
struct pipe_open_socket_state *s;
struct composite_context *conn_req;
c = composite_create(mem_ctx, cn->event_ctx);
if (c == NULL) return NULL;
s = talloc_zero(c, struct pipe_open_socket_state);
if (composite_nomem(s, c)) return c;
c->private_data = s;
s->conn = cn;
s->transport = transport;
s->server = talloc_reference(c, server);
if (composite_nomem(s->server, c)) return c;
s->target_hostname = talloc_reference(s, target_hostname);
s->sock = talloc(cn, struct sock_private);
if (composite_nomem(s->sock, c)) return c;
c->status = socket_create(server->family, SOCKET_TYPE_STREAM, &s->socket_ctx, 0);
if (!composite_is_ok(c)) return c;
talloc_steal(s->sock, s->socket_ctx);
conn_req = socket_connect_send(s->socket_ctx, NULL, s->server, 0, c->event_ctx);
composite_continue(c, conn_req, continue_socket_connect, c);
DEBUG_FN_EXIT;
return c;
}
NTSTATUS dcerpc_pipe_open_socket_recv(struct composite_context *c)
{
DEBUG_FN_ENTER;
NTSTATUS status = composite_wait(c);
talloc_free(c);
DEBUG_FN_EXIT;
return status;
}
/*
open a rpc connection using the generic socket library
*/
NTSTATUS dcerpc_pipe_open_socket(struct dcerpc_connection *conn,
struct socket_address *server,
const char *target_hostname,
enum dcerpc_transport_t transport)
{
DEBUG_FN_ENTER;
struct composite_context *c;
c = dcerpc_pipe_open_socket_send(conn, conn, server, target_hostname, transport);
DEBUG_FN_EXIT;
return dcerpc_pipe_open_socket_recv(c);
}
struct pipe_tcp_state {
const char *server;
const char *target_hostname;
const char *address;
uint32_t port;
struct socket_address *srvaddr;
struct dcerpc_connection *conn;
};
#if 0 /* disabled till we can resolve names to ipv6 addresses */
static void continue_ipv6_open_socket(struct composite_context *ctx);
#endif
static void continue_ipv4_open_socket(struct composite_context *ctx);
static void continue_ip_resolve_name(struct composite_context *ctx);
static void continue_ip_resolve_name(struct composite_context *ctx)
{
DEBUG_FN_ENTER;
struct composite_context *c = talloc_get_type(ctx->async.private_data,
struct composite_context);
struct pipe_tcp_state *s = talloc_get_type(c->private_data,
struct pipe_tcp_state);
struct composite_context *sock_ipv4_req;
c->status = resolve_name_recv(ctx, s, &s->address);
if (!composite_is_ok(c)) return;
/* prepare server address using host ip:port and transport name */
s->srvaddr = socket_address_from_strings(s->conn, "ipv4", s->address, s->port);
if (composite_nomem(s->srvaddr, c)) return;
/* resolve_nbt_name gives only ipv4 ... - send socket open request */
sock_ipv4_req = dcerpc_pipe_open_socket_send(c, s->conn,
s->srvaddr, s->target_hostname,
NCACN_IP_TCP);
composite_continue(c, sock_ipv4_req, continue_ipv4_open_socket, c);
DEBUG_FN_EXIT;
}
/*
Stage 2 of dcerpc_pipe_open_tcp_send: receive result of pipe open request
on IPv6 and send the request on IPv4 unless IPv6 transport succeeded.
*/
#if 0 /* disabled till we can resolve names to ipv6 addresses */
static void continue_ipv6_open_socket(struct composite_context *ctx)
{
struct composite_context *c = talloc_get_type(ctx->async.private_data,
struct composite_context);
struct pipe_tcp_state *s = talloc_get_type(c->private_data,
struct pipe_tcp_state);
struct composite_context *sock_ipv4_req;
/* receive result of socket open request */
c->status = dcerpc_pipe_open_socket_recv(ctx);
if (NT_STATUS_IS_OK(c->status)) {
composite_done(c);
return;
}
talloc_free(s->srvaddr);
/* prepare server address using host:ip and transport name */
s->srvaddr = socket_address_from_strings(s->conn, "ipv4", s->address, s->port);
if (composite_nomem(s->srvaddr, c)) return;
/* try IPv4 if IPv6 fails */
sock_ipv4_req = dcerpc_pipe_open_socket_send(c, s->conn,
s->srvaddr, s->target_hostname,
NCACN_IP_TCP);
composite_continue(c, sock_ipv4_req, continue_ipv4_open_socket, c);
}
#endif
/*
Stage 2 of dcerpc_pipe_open_tcp_send: receive result of pipe open request
on IPv4 transport.
*/
static void continue_ipv4_open_socket(struct composite_context *ctx)
{
DEBUG_FN_ENTER;
struct composite_context *c = talloc_get_type(ctx->async.private_data,
struct composite_context);
struct pipe_tcp_state *s = talloc_get_type(c->private_data,
struct pipe_tcp_state);
/* receive result socket open request */
c->status = dcerpc_pipe_open_socket_recv(ctx);
if (!NT_STATUS_IS_OK(c->status)) {
/* something went wrong... */
DEBUG(1, ("Failed to connect host %s (%s) on port %d - %s.\n",
s->address, s->target_hostname,
s->port, nt_errstr(c->status)));
composite_error(c, c->status);
return;
}
composite_done(c);
DEBUG_FN_EXIT;
}
/*
Send rpc pipe open request to given host:port using
tcp/ip transport
*/
struct composite_context* dcerpc_pipe_open_tcp_send(struct dcerpc_connection *conn,
const char *server,
const char *target_hostname,
uint32_t port)
{
DEBUG_FN_ENTER;
struct composite_context *c;
struct pipe_tcp_state *s;
struct composite_context *resolve_req;
struct nbt_name name;
/* composite context allocation and setup */
c = composite_create(conn, conn->event_ctx);
if (c == NULL) return NULL;
s = talloc_zero(c, struct pipe_tcp_state);
if (composite_nomem(s, c)) return c;
c->private_data = s;
/* store input parameters in state structure */
s->server = talloc_strdup(c, server);
if (composite_nomem(s->server, c)) return c;
if (target_hostname) {
s->target_hostname = talloc_strdup(c, target_hostname);
if (composite_nomem(s->target_hostname, c)) return c;
}
s->port = port;
s->conn = conn;
make_nbt_name_server(&name, server);
resolve_req = resolve_name_send(&name, c->event_ctx, lp_name_resolve_order());
composite_continue(c, resolve_req, continue_ip_resolve_name, c);
DEBUG_FN_EXIT;
return c;
}
/*
Receive result of pipe open request on tcp/ip
*/
NTSTATUS dcerpc_pipe_open_tcp_recv(struct composite_context *c)
{
DEBUG_FN_ENTER;
NTSTATUS status;
status = composite_wait(c);
talloc_free(c);
DEBUG_FN_EXIT;
return status;
}
/*
Open rpc pipe on tcp/ip transport - sync version
*/
NTSTATUS dcerpc_pipe_open_tcp(struct dcerpc_connection *conn, const char *server,
const char *target_hostname,
uint32_t port)
{
DEBUG_FN_ENTER;
struct composite_context *c;
c = dcerpc_pipe_open_tcp_send(conn, server, target_hostname, port);
return dcerpc_pipe_open_tcp_recv(c);
}
struct pipe_unix_state {
const char *path;
struct socket_address *srvaddr;
struct dcerpc_connection *conn;
};
/*
Stage 2 of dcerpc_pipe_open_unix_stream_send: receive result of pipe open
request on unix socket.
*/
void continue_unix_open_socket(struct composite_context *ctx)
{
struct composite_context *c = talloc_get_type(ctx->async.private_data,
struct composite_context);
c->status = dcerpc_pipe_open_socket_recv(ctx);
if (NT_STATUS_IS_OK(c->status)) {
composite_done(c);
return;
}
composite_error(c, c->status);
}
/*
Send pipe open request on unix socket
*/
struct composite_context *dcerpc_pipe_open_unix_stream_send(struct dcerpc_connection *conn,
const char *path)
{
struct composite_context *c;
struct composite_context *sock_unix_req;
struct pipe_unix_state *s;
/* composite context allocation and setup */
c = composite_create(conn, conn->event_ctx);
if (c == NULL) return NULL;
s = talloc_zero(c, struct pipe_unix_state);
if (composite_nomem(s, c)) return c;
c->private_data = s;
/* store parameters in state structure */
s->path = talloc_strdup(c, path);
if (composite_nomem(s->path, c)) return c;
s->conn = conn;
/* prepare server address using socket path and transport name */
s->srvaddr = socket_address_from_strings(conn, "unix", s->path, 0);
if (composite_nomem(s->srvaddr, c)) return c;
/* send socket open request */
sock_unix_req = dcerpc_pipe_open_socket_send(c, s->conn,
s->srvaddr, NULL,
NCALRPC);
composite_continue(c, sock_unix_req, continue_unix_open_socket, c);
return c;
}
/*
Receive result of pipe open request on unix socket
*/
NTSTATUS dcerpc_pipe_open_unix_stream_recv(struct composite_context *c)
{
NTSTATUS status = composite_wait(c);
talloc_free(c);
return status;
}
/*
Open a rpc pipe on a unix socket - sync version
*/
NTSTATUS dcerpc_pipe_open_unix_stream(struct dcerpc_connection *conn, const char *path)
{
struct composite_context *c = dcerpc_pipe_open_unix_stream_send(conn, path);
return dcerpc_pipe_open_unix_stream_recv(c);
}
struct pipe_np_state {
char *full_path;
struct socket_address *srvaddr;
struct dcerpc_connection *conn;
};
/*
Stage 2 of dcerpc_pipe_open_pipe_send: receive socket open request
*/
void continue_np_open_socket(struct composite_context *ctx)
{
DEBUG_FN_ENTER;
struct composite_context *c = talloc_get_type(ctx->async.private_data,
struct composite_context);
c->status = dcerpc_pipe_open_socket_recv(ctx);
if (!composite_is_ok(c)) return;
composite_done(c);
DEBUG_FN_EXIT;
}
/*
Send pipe open request on ncalrpc
*/
struct composite_context* dcerpc_pipe_open_pipe_send(struct dcerpc_connection *conn,
const char *identifier)
{
DEBUG_FN_ENTER;
char *canon = NULL;
struct composite_context *c;
struct composite_context *sock_np_req;
struct pipe_np_state *s;
/* composite context allocation and setup */
c = composite_create(conn, conn->event_ctx);
if (c == NULL) return NULL;
s = talloc_zero(c, struct pipe_np_state);
if (composite_nomem(s, c)) return c;
c->private_data = s;
/* store parameters in state structure */
canon = talloc_strdup(s, identifier);
if (composite_nomem(canon, c)) return c;
s->conn = conn;
string_replace(canon, '/', '\\');
s->full_path = talloc_asprintf(canon, "%s/%s", lp_ncalrpc_dir(), canon);
if (composite_nomem(s->full_path, c)) return c;
/* prepare server address using path and transport name */
s->srvaddr = socket_address_from_strings(conn, "unix", s->full_path, 0);
if (composite_nomem(s->srvaddr, c)) return c;
/* send socket open request */
sock_np_req = dcerpc_pipe_open_socket_send(c, s->conn, s->srvaddr, NULL, NCALRPC);
composite_continue(c, sock_np_req, continue_np_open_socket, c);
DEBUG_FN_EXIT;
return c;
}
/*
Receive result of pipe open request on ncalrpc
*/
NTSTATUS dcerpc_pipe_open_pipe_recv(struct composite_context *c)
{
DEBUG_FN_ENTER;
NTSTATUS status = composite_wait(c);
talloc_free(c);
DEBUG_FN_EXIT;
return status;
}
/*
Open a rpc pipe on a named pipe - sync version
*/
NTSTATUS dcerpc_pipe_open_pipe(struct dcerpc_connection *conn, const char *identifier)
{
struct composite_context *c = dcerpc_pipe_open_pipe_send(conn, identifier);
return dcerpc_pipe_open_pipe_recv(c);
}
Samba/source/librpc/rpc/dcerpc_util.c
+1409
View File
File diff suppressed because it is too large Load Diff
Samba/source/librpc/rpc/table.c
+135
View File
@@ -0,0 +1,135 @@
/*
Unix SMB/CIFS implementation.
dcerpc utility functions
Copyright (C) Andrew Tridgell 2003
Copyright (C) Jelmer Vernooij 2004
This program is free software; you can redistribute it and/or modify
it under the terms of the GNU General Public License as published by
the Free Software Foundation; either version 2 of the License, or
(at your option) any later version.
This program is distributed in the hope that it will be useful,
but WITHOUT ANY WARRANTY; without even the implied warranty of
MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
GNU General Public License for more details.
You should have received a copy of the GNU General Public License
along with this program; if not, write to the Free Software
Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
*/
#include "includes.h"
#include "lib/util/dlinklist.h"
#include "librpc/rpc/dcerpc.h"
#include "librpc/rpc/dcerpc_table.h"
struct dcerpc_interface_list *dcerpc_pipes = NULL;
/*
register a dcerpc client interface
*/
NTSTATUS librpc_register_interface(const struct dcerpc_interface_table *interface)
{
struct dcerpc_interface_list *l;
for (l = dcerpc_pipes; l; l = l->next) {
if (GUID_equal(&interface->syntax_id.uuid, &l->table->syntax_id.uuid)) {
DEBUG(0, ("Attempt to register interface %s which has the "
"same UUID as already registered interface %s\n",
interface->name, l->table->name));
return NT_STATUS_OBJECT_NAME_COLLISION;
}
}
l = talloc(talloc_autofree_context(), struct dcerpc_interface_list);
l->table = interface;
DLIST_ADD(dcerpc_pipes, l);
return NT_STATUS_OK;
}
/*
find the pipe name for a local IDL interface
*/
const char *idl_pipe_name(const struct GUID *uuid, uint32_t if_version)
{
const struct dcerpc_interface_list *l;
for (l=librpc_dcerpc_pipes();l;l=l->next) {
if (GUID_equal(&l->table->syntax_id.uuid, uuid) &&
l->table->syntax_id.if_version == if_version) {
return l->table->name;
}
}
return "UNKNOWN";
}
/*
find the number of calls defined by local IDL
*/
int idl_num_calls(const struct GUID *uuid, uint32_t if_version)
{
const struct dcerpc_interface_list *l;
for (l=librpc_dcerpc_pipes();l;l=l->next){
if (GUID_equal(&l->table->syntax_id.uuid, uuid) &&
l->table->syntax_id.if_version == if_version) {
return l->table->num_calls;
}
}
return -1;
}
/*
find a dcerpc interface by name
*/
const struct dcerpc_interface_table *idl_iface_by_name(const char *name)
{
const struct dcerpc_interface_list *l;
for (l=librpc_dcerpc_pipes();l;l=l->next) {
if (strcasecmp(l->table->name, name) == 0) {
return l->table;
}
}
return NULL;
}
/*
find a dcerpc interface by uuid
*/
const struct dcerpc_interface_table *idl_iface_by_uuid(const struct GUID *uuid)
{
const struct dcerpc_interface_list *l;
for (l=librpc_dcerpc_pipes();l;l=l->next) {
if (GUID_equal(&l->table->syntax_id.uuid, uuid)) {
return l->table;
}
}
return NULL;
}
/*
return the list of registered dcerpc_pipes
*/
const struct dcerpc_interface_list *librpc_dcerpc_pipes(void)
{
return dcerpc_pipes;
}
NTSTATUS dcerpc_register_builtin_interfaces(void);
NTSTATUS dcerpc_table_init(void)
{
static BOOL initialized = False;
if (initialized) return NT_STATUS_OK;
initialized = True;
dcerpc_register_builtin_interfaces();
return NT_STATUS_OK;
}