Changeset 988 for vendor/current/source3/librpc/rpc
- Timestamp:
- Nov 24, 2016, 1:14:11 PM (9 years ago)
- Location:
- vendor/current/source3/librpc/rpc
- Files:
-
- 1 deleted
- 4 edited
-
dcerpc.h (modified) (5 diffs)
-
dcerpc_ep.c (modified) (18 diffs)
-
dcerpc_ep.h (modified) (5 diffs)
-
dcerpc_helpers.c (modified) (18 diffs)
-
rpc_common.c (deleted)
Legend:
- Unmodified
- Added
- Removed
-
vendor/current/source3/librpc/rpc/dcerpc.h
r919 r988 34 34 35 35 struct NL_AUTH_MESSAGE; 36 struct gensec_security; 36 37 37 38 /* auth state for all bind types. */ … … 40 41 enum dcerpc_AuthType auth_type; 41 42 enum dcerpc_AuthLevel auth_level; 43 uint32_t auth_context_id; 44 bool client_hdr_signing; 45 bool hdr_signing; 42 46 bool verified_bitmask1; 43 47 44 void *auth_ctx; 45 uint32_t auth_context_id; 48 struct gensec_security *auth_ctx; 46 49 47 /* Only the client code uses these 3 for now */ 48 char *domain; 49 char *user_name; 50 DATA_BLOB user_session_key; 50 /* Only the client code uses this for now */ 51 DATA_BLOB transport_session_key; 51 52 }; 52 53 … … 63 64 struct ncacn_packet *r, 64 65 bool bigendian); 65 NTSTATUS dcerpc_push_schannel_bind(TALLOC_CTX *mem_ctx,66 struct NL_AUTH_MESSAGE *r,67 DATA_BLOB *blob);68 66 NTSTATUS dcerpc_push_dcerpc_auth(TALLOC_CTX *mem_ctx, 69 67 enum dcerpc_AuthType auth_type, … … 75 73 NTSTATUS dcerpc_guess_sizes(struct pipe_auth_data *auth, 76 74 size_t header_len, size_t data_left, 77 size_t max_xmit_frag, size_t pad_alignment,75 size_t max_xmit_frag, 78 76 size_t *data_to_send, size_t *frag_len, 79 77 size_t *auth_len, size_t *pad_len); … … 86 84 DATA_BLOB *raw_pkt); 87 85 88 /* The following definitions come from librpc/rpc/rpc_common.c */89 90 bool smb_register_ndr_interface(const struct ndr_interface_table *interface);91 const struct ndr_interface_table *get_iface_from_syntax(92 const struct ndr_syntax_id *syntax);93 const char *get_pipe_name_from_syntax(TALLOC_CTX *mem_ctx,94 const struct ndr_syntax_id *syntax);95 96 86 #endif /* __S3_DCERPC_H__ */ -
vendor/current/source3/librpc/rpc/dcerpc_ep.c
r917 r988 2 2 * Endpoint Mapper Functions 3 3 * DCERPC local endpoint mapper client routines 4 * Copyright (c) 2010 4 * Copyright (c) 2010-2011 Andreas Schneider. 5 5 * 6 6 * This program is free software; you can redistribute it and/or modify … … 25 25 #include "auth.h" 26 26 #include "rpc_server/rpc_ncacn_np.h" 27 #include "../lib/tsocket/tsocket.h" 28 #include "rpc_server/rpc_config.h" 27 29 28 30 #define EPM_MAX_ANNOTATION_SIZE 64 29 31 30 NTSTATUS dcerpc_binding_vector_create(TALLOC_CTX *mem_ctx, 31 const struct ndr_interface_table *iface, 32 uint16_t port, 33 const char *ncalrpc, 34 struct dcerpc_binding_vector **pbvec) 32 struct dcerpc_binding_vector { 33 struct dcerpc_binding **bindings; 34 uint32_t count; 35 uint32_t allocated; 36 }; 37 38 static bool binding_vector_realloc(struct dcerpc_binding_vector *bvec) 39 { 40 if (bvec->count >= bvec->allocated) { 41 struct dcerpc_binding **tmp; 42 43 tmp = talloc_realloc(bvec, 44 bvec->bindings, 45 struct dcerpc_binding *, 46 bvec->allocated * 2); 47 if (tmp == NULL) { 48 return false; 49 } 50 bvec->bindings = tmp; 51 bvec->allocated = bvec->allocated * 2; 52 } 53 54 return true; 55 } 56 57 NTSTATUS dcerpc_binding_vector_new(TALLOC_CTX *mem_ctx, 58 struct dcerpc_binding_vector **pbvec) 35 59 { 36 60 struct dcerpc_binding_vector *bvec; 37 uint32_t ep_count;38 uint32_t count = 0;39 uint32_t i;40 61 NTSTATUS status; 41 62 TALLOC_CTX *tmp_ctx; … … 45 66 return NT_STATUS_NO_MEMORY; 46 67 } 47 48 ep_count = iface->endpoints->count;49 68 50 69 bvec = talloc_zero(tmp_ctx, struct dcerpc_binding_vector); … … 54 73 } 55 74 56 bvec->bindings = talloc_zero_array(bvec, struct dcerpc_binding, ep_count); 75 bvec->bindings = talloc_zero_array(bvec, 76 struct dcerpc_binding *, 77 4); 57 78 if (bvec->bindings == NULL) { 58 79 status = NT_STATUS_NO_MEMORY; … … 60 81 } 61 82 62 for (i = 0; i < ep_count; i++) { 63 struct dcerpc_binding *b; 64 65 b = talloc_zero(bvec->bindings, struct dcerpc_binding); 66 if (b == NULL) { 67 status = NT_STATUS_NO_MEMORY; 68 goto done; 69 } 70 71 status = dcerpc_parse_binding(b, iface->endpoints->names[i], &b); 72 if (!NT_STATUS_IS_OK(status)) { 73 status = NT_STATUS_UNSUCCESSFUL; 74 goto done; 75 } 76 77 b->object = iface->syntax_id; 78 79 switch (b->transport) { 80 case NCACN_NP: 81 b->host = talloc_asprintf(b, "\\\\%s", global_myname()); 82 if (b->host == NULL) { 83 status = NT_STATUS_NO_MEMORY; 84 goto done; 85 } 86 break; 87 case NCACN_IP_TCP: 88 if (port == 0) { 89 talloc_free(b); 90 continue; 91 } 92 93 b->endpoint = talloc_asprintf(b, "%u", port); 94 if (b->endpoint == NULL) { 95 status = NT_STATUS_NO_MEMORY; 96 goto done; 97 } 98 99 break; 100 case NCALRPC: 101 if (ncalrpc == NULL) { 102 talloc_free(b); 103 continue; 104 } 105 106 b->endpoint = talloc_asprintf(b, 107 "%s/%s", 108 lp_ncalrpc_dir(), 109 ncalrpc); 110 if (b->endpoint == NULL) { 111 status = NT_STATUS_NO_MEMORY; 112 goto done; 113 } 114 break; 115 default: 116 talloc_free(b); 117 continue; 118 } 119 120 bvec->bindings[count] = *b; 121 count++; 122 } 123 124 bvec->count = count; 83 bvec->allocated = 4; 84 bvec->count = 0; 125 85 126 86 *pbvec = talloc_move(mem_ctx, &bvec); … … 133 93 } 134 94 95 NTSTATUS dcerpc_binding_vector_add_np_default(const struct ndr_interface_table *iface, 96 struct dcerpc_binding_vector *bvec) 97 { 98 uint32_t ep_count = iface->endpoints->count; 99 uint32_t i; 100 NTSTATUS status; 101 bool ok; 102 103 for (i = 0; i < ep_count; i++) { 104 struct dcerpc_binding *b; 105 enum dcerpc_transport_t transport; 106 char *unc = NULL; 107 108 status = dcerpc_parse_binding(bvec->bindings, 109 iface->endpoints->names[i], 110 &b); 111 if (!NT_STATUS_IS_OK(status)) { 112 return NT_STATUS_UNSUCCESSFUL; 113 } 114 115 /* Only add the named pipes defined in the iface endpoints */ 116 transport = dcerpc_binding_get_transport(b); 117 if (transport != NCACN_NP) { 118 talloc_free(b); 119 continue; 120 } 121 122 status = dcerpc_binding_set_abstract_syntax(b, &iface->syntax_id); 123 if (!NT_STATUS_IS_OK(status)) { 124 talloc_free(b); 125 return NT_STATUS_UNSUCCESSFUL; 126 } 127 128 unc = talloc_asprintf(b, "\\\\%s", lp_netbios_name()); 129 if (unc == NULL) { 130 talloc_free(b); 131 return NT_STATUS_NO_MEMORY; 132 } 133 134 status = dcerpc_binding_set_string_option(b, "host", unc); 135 TALLOC_FREE(unc); 136 if (!NT_STATUS_IS_OK(status)) { 137 talloc_free(b); 138 return NT_STATUS_NO_MEMORY; 139 } 140 141 ok = binding_vector_realloc(bvec); 142 if (!ok) { 143 talloc_free(b); 144 return NT_STATUS_NO_MEMORY; 145 } 146 147 bvec->bindings[bvec->count] = b; 148 bvec->count++; 149 } 150 151 return NT_STATUS_OK; 152 } 153 154 NTSTATUS dcerpc_binding_vector_add_port(const struct ndr_interface_table *iface, 155 struct dcerpc_binding_vector *bvec, 156 const char *host, 157 uint16_t _port) 158 { 159 uint32_t ep_count = iface->endpoints->count; 160 uint32_t i; 161 NTSTATUS status; 162 bool ok; 163 char port[6]; 164 165 snprintf(port, sizeof(port), "%u", _port); 166 167 for (i = 0; i < ep_count; i++) { 168 struct dcerpc_binding *b; 169 enum dcerpc_transport_t transport; 170 171 status = dcerpc_parse_binding(bvec->bindings, 172 iface->endpoints->names[i], 173 &b); 174 if (!NT_STATUS_IS_OK(status)) { 175 return NT_STATUS_UNSUCCESSFUL; 176 } 177 178 transport = dcerpc_binding_get_transport(b); 179 if (transport != NCACN_IP_TCP) { 180 talloc_free(b); 181 continue; 182 } 183 184 status = dcerpc_binding_set_abstract_syntax(b, &iface->syntax_id); 185 if (!NT_STATUS_IS_OK(status)) { 186 talloc_free(b); 187 return NT_STATUS_UNSUCCESSFUL; 188 } 189 190 status = dcerpc_binding_set_string_option(b, "host", host); 191 if (!NT_STATUS_IS_OK(status)) { 192 talloc_free(b); 193 return NT_STATUS_UNSUCCESSFUL; 194 } 195 196 status = dcerpc_binding_set_string_option(b, "endpoint", port); 197 if (!NT_STATUS_IS_OK(status)) { 198 talloc_free(b); 199 return NT_STATUS_UNSUCCESSFUL; 200 } 201 202 ok = binding_vector_realloc(bvec); 203 if (!ok) { 204 talloc_free(b); 205 return NT_STATUS_NO_MEMORY; 206 } 207 208 bvec->bindings[bvec->count] = b; 209 bvec->count++; 210 211 break; 212 } 213 214 return NT_STATUS_OK; 215 } 216 217 NTSTATUS dcerpc_binding_vector_add_unix(const struct ndr_interface_table *iface, 218 struct dcerpc_binding_vector *bvec, 219 const char *name) 220 { 221 uint32_t ep_count = iface->endpoints->count; 222 uint32_t i; 223 NTSTATUS status; 224 bool ok; 225 226 for (i = 0; i < ep_count; i++) { 227 struct dcerpc_binding *b; 228 enum dcerpc_transport_t transport; 229 char *endpoint = NULL; 230 231 status = dcerpc_parse_binding(bvec->bindings, 232 iface->endpoints->names[i], 233 &b); 234 if (!NT_STATUS_IS_OK(status)) { 235 return NT_STATUS_UNSUCCESSFUL; 236 } 237 238 transport = dcerpc_binding_get_transport(b); 239 if (transport != NCALRPC) { 240 talloc_free(b); 241 continue; 242 } 243 244 status = dcerpc_binding_set_abstract_syntax(b, &iface->syntax_id); 245 if (!NT_STATUS_IS_OK(status)) { 246 talloc_free(b); 247 return NT_STATUS_UNSUCCESSFUL; 248 } 249 250 endpoint = talloc_asprintf(b, 251 "%s/%s", 252 lp_ncalrpc_dir(), 253 name); 254 if (endpoint == NULL) { 255 talloc_free(b); 256 return NT_STATUS_NO_MEMORY; 257 } 258 259 status = dcerpc_binding_set_string_option(b, "endpoint", endpoint); 260 TALLOC_FREE(endpoint); 261 if (!NT_STATUS_IS_OK(status)) { 262 talloc_free(b); 263 return NT_STATUS_UNSUCCESSFUL; 264 } 265 266 ok = binding_vector_realloc(bvec); 267 if (!ok) { 268 talloc_free(b); 269 return NT_STATUS_NO_MEMORY; 270 } 271 272 bvec->bindings[bvec->count] = b; 273 bvec->count++; 274 275 break; 276 } 277 278 return NT_STATUS_OK; 279 } 280 281 NTSTATUS dcerpc_binding_vector_replace_iface(const struct ndr_interface_table *iface, 282 struct dcerpc_binding_vector *v) 283 { 284 uint32_t i; 285 286 for (i = 0; i < v->count; i++) { 287 struct dcerpc_binding *b = v->bindings[i]; 288 NTSTATUS status; 289 290 status = dcerpc_binding_set_abstract_syntax(b, 291 &iface->syntax_id); 292 if (!NT_STATUS_IS_OK(status)) { 293 return status; 294 } 295 } 296 297 return NT_STATUS_OK; 298 } 299 300 struct dcerpc_binding_vector *dcerpc_binding_vector_dup(TALLOC_CTX *mem_ctx, 301 const struct dcerpc_binding_vector *bvec) 302 { 303 struct dcerpc_binding_vector *v; 304 uint32_t i; 305 306 v = talloc(mem_ctx, struct dcerpc_binding_vector); 307 if (v == NULL) { 308 return NULL; 309 } 310 311 v->bindings = talloc_array(v, struct dcerpc_binding *, bvec->allocated); 312 if (v->bindings == NULL) { 313 talloc_free(v); 314 return NULL; 315 } 316 v->allocated = bvec->allocated; 317 318 for (i = 0; i < bvec->count; i++) { 319 struct dcerpc_binding *b; 320 321 b = dcerpc_binding_dup(v->bindings, bvec->bindings[i]); 322 if (b == NULL) { 323 talloc_free(v); 324 return NULL; 325 } 326 v->bindings[i] = b; 327 } 328 v->count = bvec->count; 329 330 return v; 331 } 332 135 333 static NTSTATUS ep_register(TALLOC_CTX *mem_ctx, 334 struct messaging_context *msg_ctx, 136 335 const struct ndr_interface_table *iface, 137 336 const struct dcerpc_binding_vector *bind_vec, … … 146 345 struct pipe_auth_data *auth; 147 346 const char *ncalrpc_sock; 148 const char *rpcsrv_type;347 enum rpc_service_mode_e epmd_mode; 149 348 struct epm_entry_t *entries; 150 349 uint32_t num_ents, i; … … 166 365 } 167 366 168 rpcsrv_type = lp_parm_const_string(GLOBAL_SECTION_SNUM, 169 "rpc_server", "epmapper", 170 "none"); 171 172 if (StrCaseCmp(rpcsrv_type, "embedded") == 0) { 173 static struct client_address client_id; 174 175 strlcpy(client_id.addr, "localhost", sizeof(client_id.addr)); 176 client_id.name = "localhost"; 367 epmd_mode = rpc_epmapper_mode(); 368 369 if (epmd_mode == RPC_SERVICE_MODE_EMBEDDED) { 370 struct tsocket_address *local; 371 int rc; 372 373 rc = tsocket_address_inet_from_strings(tmp_ctx, 374 "ip", 375 "127.0.0.1", 376 0, 377 &local); 378 if (rc < 0) { 379 return NT_STATUS_NO_MEMORY; 380 } 177 381 178 382 status = rpcint_binding_handle(tmp_ctx, 179 383 &ndr_table_epmapper, 180 &client_id,384 local, 181 385 get_session_info_system(), 182 server_messaging_context(),386 msg_ctx, 183 387 &h); 184 388 if (!NT_STATUS_IS_OK(status)) { … … 187 391 goto done; 188 392 } 189 } else if ( StrCaseCmp(rpcsrv_type, "daemon") == 0) {393 } else if (epmd_mode == RPC_SERVICE_MODE_EXTERNAL) { 190 394 /* Connect to the endpoint mapper locally */ 191 395 ncalrpc_sock = talloc_asprintf(tmp_ctx, … … 200 404 status = rpc_pipe_open_ncalrpc(tmp_ctx, 201 405 ncalrpc_sock, 202 &ndr_table_epmapper .syntax_id,406 &ndr_table_epmapper, 203 407 &cli); 204 408 if (!NT_STATUS_IS_OK(status)) { … … 228 432 229 433 for (i = 0; i < num_ents; i++) { 230 struct dcerpc_binding *map_binding = &bind_vec->bindings[i];434 struct dcerpc_binding *map_binding; 231 435 struct epm_twr_t *map_tower; 436 437 map_binding = dcerpc_binding_dup(entries, bind_vec->bindings[i]); 438 if (map_binding == NULL) { 439 status = NT_STATUS_NO_MEMORY; 440 goto done; 441 } 442 443 status = dcerpc_binding_set_abstract_syntax(map_binding, 444 &iface->syntax_id); 445 if (!NT_STATUS_IS_OK(status)) { 446 goto done; 447 } 232 448 233 449 map_tower = talloc_zero(entries, struct epm_twr_t); … … 243 459 goto done; 244 460 } 461 462 TALLOC_FREE(map_binding); 245 463 246 464 entries[i].tower = map_tower; … … 260 478 entries[i].object = *object_guid; 261 479 } else { 262 entries[i].object = map_binding->object.uuid;480 ZERO_STRUCT(entries[i].object); 263 481 } 264 482 } … … 302 520 303 521 NTSTATUS dcerpc_ep_register(TALLOC_CTX *mem_ctx, 522 struct messaging_context *msg_ctx, 304 523 const struct ndr_interface_table *iface, 305 524 const struct dcerpc_binding_vector *bind_vec, … … 309 528 { 310 529 return ep_register(mem_ctx, 530 msg_ctx, 311 531 iface, 312 532 bind_vec, … … 319 539 320 540 NTSTATUS dcerpc_ep_register_noreplace(TALLOC_CTX *mem_ctx, 541 struct messaging_context *msg_ctx, 321 542 const struct ndr_interface_table *iface, 322 543 const struct dcerpc_binding_vector *bind_vec, … … 326 547 { 327 548 return ep_register(mem_ctx, 549 msg_ctx, 328 550 iface, 329 551 bind_vec, … … 335 557 } 336 558 337 NTSTATUS dcerpc_ep_unregister(const struct ndr_interface_table *iface, 559 NTSTATUS dcerpc_ep_unregister(struct messaging_context *msg_ctx, 560 const struct ndr_interface_table *iface, 338 561 const struct dcerpc_binding_vector *bind_vec, 339 562 const struct GUID *object_guid) 340 563 { 341 564 return ep_register(NULL, 565 msg_ctx, 342 566 iface, 343 567 bind_vec, -
vendor/current/source3/librpc/rpc/dcerpc_ep.h
r740 r988 2 2 * Endpoint Mapper Functions 3 3 * DCERPC local endpoint mapper client routines 4 * Copyright (c) 2010 4 * Copyright (c) 2010-2011 Andreas Schneider. 5 5 * 6 6 * This program is free software; you can redistribute it and/or modify … … 21 21 #define _DCERPC_EP_H_ 22 22 23 struct dcerpc_binding_vector { 24 struct dcerpc_binding *bindings; 25 uint32_t count; 26 }; 23 struct dcerpc_binding_vector; 27 24 28 NTSTATUS dcerpc_binding_vector_create(TALLOC_CTX *mem_ctx, 29 const struct ndr_interface_table *iface, 30 uint16_t port, 31 const char *ncalrpc, 32 struct dcerpc_binding_vector **pbvec); 25 /** 26 * @brief Allocate a new binding vector. 27 * 28 * @param[in] mem_ctx The memory context to allocate the vector. 29 * 30 * @param[out] pbvec A pointer to store the binding vector. 31 * 32 * @return An NTSTATUS error code. 33 */ 34 NTSTATUS dcerpc_binding_vector_new(TALLOC_CTX *mem_ctx, 35 struct dcerpc_binding_vector **pbvec); 36 37 /** 38 * @brief Add default named pipes to the binding vector. 39 * 40 * @param[in] iface The rpc interface to add. 41 * 42 * @param[in] bvec The binding vector to add the interface. 43 * 44 * @return An NTSTATUS error code. 45 */ 46 NTSTATUS dcerpc_binding_vector_add_np_default(const struct ndr_interface_table *iface, 47 struct dcerpc_binding_vector *bvec); 48 49 /** 50 * @brief Add a tcpip port to a binding vector. 51 * 52 * @param[in] iface The rpc interface to add. 53 * 54 * @param[in] bvec The binding vector to add the interface, host and port. 55 * 56 * @param[in] host The ip address of the network interface bound. 57 * 58 * @param[in] port The port bound. 59 * 60 * @return An NTSTATUS error code. 61 */ 62 NTSTATUS dcerpc_binding_vector_add_port(const struct ndr_interface_table *iface, 63 struct dcerpc_binding_vector *bvec, 64 const char *host, 65 uint16_t port); 66 67 /** 68 * @brief Add a unix socket (ncalrpc) to a binding vector. 69 * 70 * @param[in] iface The rpc interface to add. 71 * 72 * @param[in] bvec The binding vector to add the interface, host and port. 73 * 74 * @param[in] name The name of the unix socket. 75 * 76 * @return An NTSTATUS error code. 77 */ 78 NTSTATUS dcerpc_binding_vector_add_unix(const struct ndr_interface_table *iface, 79 struct dcerpc_binding_vector *bvec, 80 const char *name); 81 82 /** 83 * @brief Duplicate a dcerpc_binding_vector. 84 * 85 * @param[in] mem_ctx The memory context to create the duplicate on. 86 * 87 * @param[in] bvec The binding vector to duplicate. 88 * 89 * @return The duplicated binding vector or NULL on error. 90 */ 91 struct dcerpc_binding_vector *dcerpc_binding_vector_dup(TALLOC_CTX *mem_ctx, 92 const struct dcerpc_binding_vector *bvec); 93 94 /** 95 * @brief Replace the interface of the bindings in the vector. 96 * 97 * @param[in] iface The new interface identifier to use. 98 * 99 * @param[in] v The binding vector to change. 100 * 101 * @return An NTSTATUS error code. 102 */ 103 NTSTATUS dcerpc_binding_vector_replace_iface(const struct ndr_interface_table *iface, 104 struct dcerpc_binding_vector *v); 33 105 34 106 /** … … 65 137 */ 66 138 NTSTATUS dcerpc_ep_register(TALLOC_CTX *mem_ctx, 139 struct messaging_context *msg_ctx, 67 140 const struct ndr_interface_table *iface, 68 141 const struct dcerpc_binding_vector *bind_vec, … … 72 145 73 146 NTSTATUS dcerpc_ep_register_noreplace(TALLOC_CTX *mem_ctx, 147 struct messaging_context *msg_ctx, 74 148 const struct ndr_interface_table *iface, 75 149 const struct dcerpc_binding_vector *bind_vec, … … 78 152 struct dcerpc_binding_handle **ph); 79 153 80 NTSTATUS dcerpc_ep_unregister(const struct ndr_interface_table *iface, 154 NTSTATUS dcerpc_ep_unregister(struct messaging_context *msg_ctx, 155 const struct ndr_interface_table *iface, 81 156 const struct dcerpc_binding_vector *bind_vec, 82 157 const struct GUID *object_guid); -
vendor/current/source3/librpc/rpc/dcerpc_helpers.c
r919 r988 22 22 #include "librpc/rpc/dcerpc.h" 23 23 #include "librpc/gen_ndr/ndr_dcerpc.h" 24 #include "librpc/gen_ndr/ndr_schannel.h"25 #include "../libcli/auth/schannel.h"26 #include "../libcli/auth/spnego.h"27 #include "../libcli/auth/ntlmssp.h"28 #include "ntlmssp_wrap.h"29 24 #include "librpc/crypto/gse.h" 30 #include " librpc/crypto/spnego.h"25 #include "auth/gensec/gensec.h" 31 26 32 27 #undef DBGC_CLASS … … 138 133 139 134 /** 140 * @brief NDR Encodes a NL_AUTH_MESSAGE141 *142 * @param mem_ctx The memory context the blob will be allocated on143 * @param r The NL_AUTH_MESSAGE to encode144 * @param blob [out] The encoded blob if successful145 *146 * @return a NTSTATUS error code147 */148 NTSTATUS dcerpc_push_schannel_bind(TALLOC_CTX *mem_ctx,149 struct NL_AUTH_MESSAGE *r,150 DATA_BLOB *blob)151 {152 enum ndr_err_code ndr_err;153 154 ndr_err = ndr_push_struct_blob(blob, mem_ctx, r,155 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);156 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {157 return ndr_map_error2ntstatus(ndr_err);158 }159 160 if (DEBUGLEVEL >= 10) {161 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, r);162 }163 164 return NT_STATUS_OK;165 }166 167 /**168 135 * @brief NDR Encodes a dcerpc_auth structure 169 136 * … … 218 185 * @param data_left The data left in the send buffer 219 186 * @param max_xmit_frag The max fragment size. 220 * @param pad_alignment The NDR padding size.221 187 * @param data_to_send [out] The max data we will send in the pdu 222 188 * @param frag_len [out] The total length of the fragment … … 228 194 NTSTATUS dcerpc_guess_sizes(struct pipe_auth_data *auth, 229 195 size_t header_len, size_t data_left, 230 size_t max_xmit_frag, size_t pad_alignment,196 size_t max_xmit_frag, 231 197 size_t *data_to_send, size_t *frag_len, 232 198 size_t *auth_len, size_t *pad_len) … … 234 200 size_t max_len; 235 201 size_t mod_len; 236 struct schannel_state *schannel_auth; 237 struct spnego_context *spnego_ctx; 238 struct gse_context *gse_ctx; 239 enum spnego_mech auth_type; 240 void *auth_ctx; 241 bool seal = false; 242 NTSTATUS status; 202 struct gensec_security *gensec_security; 243 203 244 204 /* no auth token cases first */ … … 255 215 256 216 case DCERPC_AUTH_LEVEL_PRIVACY: 257 seal = true;258 217 break; 259 218 … … 273 232 switch (auth->auth_type) { 274 233 case DCERPC_AUTH_TYPE_SPNEGO: 275 spnego_ctx = talloc_get_type_abort(auth->auth_ctx,276 struct spnego_context);277 status = spnego_get_negotiated_mech(spnego_ctx,278 &auth_type, &auth_ctx);279 if (!NT_STATUS_IS_OK(status)) {280 return status;281 }282 switch (auth_type) {283 case SPNEGO_NTLMSSP:284 *auth_len = NTLMSSP_SIG_SIZE;285 break;286 287 case SPNEGO_KRB5:288 gse_ctx = talloc_get_type_abort(auth_ctx,289 struct gse_context);290 if (!gse_ctx) {291 return NT_STATUS_INVALID_PARAMETER;292 }293 *auth_len = gse_get_signature_length(gse_ctx,294 seal, max_len);295 break;296 297 default:298 return NT_STATUS_INVALID_PARAMETER;299 }300 break;301 302 234 case DCERPC_AUTH_TYPE_NTLMSSP: 303 *auth_len = NTLMSSP_SIG_SIZE; 304 break; 305 235 case DCERPC_AUTH_TYPE_KRB5: 306 236 case DCERPC_AUTH_TYPE_SCHANNEL: 307 schannel_auth = talloc_get_type_abort(auth->auth_ctx, 308 struct schannel_state); 309 *auth_len = netsec_outgoing_sig_size(schannel_auth); 310 break; 311 312 case DCERPC_AUTH_TYPE_KRB5: 313 gse_ctx = talloc_get_type_abort(auth->auth_ctx, 314 struct gse_context); 315 *auth_len = gse_get_signature_length(gse_ctx, 316 seal, max_len); 317 break; 318 237 gensec_security = auth->auth_ctx; 238 mod_len = (max_len % DCERPC_AUTH_PAD_ALIGNMENT); 239 *auth_len = gensec_sig_size(gensec_security, max_len - mod_len); 240 if (*auth_len == 0) { 241 return NT_STATUS_INTERNAL_ERROR; 242 } 243 break; 319 244 default: 320 245 return NT_STATUS_INVALID_PARAMETER; … … 322 247 323 248 max_len -= *auth_len; 249 mod_len = (max_len % DCERPC_AUTH_PAD_ALIGNMENT); 250 max_len -= mod_len; 324 251 325 252 *data_to_send = MIN(max_len, data_left); 326 253 327 mod_len = (header_len + *data_to_send) % pad_alignment; 328 if (mod_len) { 329 *pad_len = pad_alignment - mod_len; 330 } else { 331 *pad_len = 0; 332 } 333 334 if (*data_to_send + *pad_len > max_len) { 335 *data_to_send -= pad_alignment; 336 } 254 *pad_len = DCERPC_AUTH_PAD_LENGTH(*data_to_send); 337 255 338 256 *frag_len = header_len + *data_to_send + *pad_len … … 346 264 ********************************************************************/ 347 265 348 static NTSTATUS add_ ntlmssp_auth_footer(struct auth_ntlmssp_state *auth_state,266 static NTSTATUS add_generic_auth_footer(struct gensec_security *gensec_security, 349 267 enum dcerpc_AuthLevel auth_level, 350 268 DATA_BLOB *rpc_out) … … 356 274 NTSTATUS status; 357 275 358 if (! auth_state) {276 if (!gensec_security) { 359 277 return NT_STATUS_INVALID_PARAMETER; 360 278 } … … 363 281 case DCERPC_AUTH_LEVEL_PRIVACY: 364 282 /* Data portion is encrypted. */ 365 status = auth_ntlmssp_seal_packet(auth_state,366 367 368 369 370 371 372 283 status = gensec_seal_packet(gensec_security, 284 rpc_out->data, 285 rpc_out->data 286 + DCERPC_RESPONSE_LENGTH, 287 data_and_pad_len, 288 rpc_out->data, 289 rpc_out->length, 290 &auth_blob); 373 291 if (!NT_STATUS_IS_OK(status)) { 374 292 return status; … … 378 296 case DCERPC_AUTH_LEVEL_INTEGRITY: 379 297 /* Data is signed. */ 380 status = auth_ntlmssp_sign_packet(auth_state,381 382 383 384 385 386 387 298 status = gensec_sign_packet(gensec_security, 299 rpc_out->data, 300 rpc_out->data 301 + DCERPC_RESPONSE_LENGTH, 302 data_and_pad_len, 303 rpc_out->data, 304 rpc_out->length, 305 &auth_blob); 388 306 if (!NT_STATUS_IS_OK(status)) { 389 307 return status; … … 414 332 ********************************************************************/ 415 333 416 static NTSTATUS get_ ntlmssp_auth_footer(struct auth_ntlmssp_state *auth_state,334 static NTSTATUS get_generic_auth_footer(struct gensec_security *gensec_security, 417 335 enum dcerpc_AuthLevel auth_level, 418 336 DATA_BLOB *data, DATA_BLOB *full_pkt, 419 337 DATA_BLOB *auth_token) 420 338 { 339 if (gensec_security == NULL) { 340 return NT_STATUS_INVALID_PARAMETER; 341 } 342 421 343 switch (auth_level) { 422 344 case DCERPC_AUTH_LEVEL_PRIVACY: 423 345 /* Data portion is encrypted. */ 424 return auth_ntlmssp_unseal_packet(auth_state,425 426 427 428 429 346 return gensec_unseal_packet(gensec_security, 347 data->data, 348 data->length, 349 full_pkt->data, 350 full_pkt->length, 351 auth_token); 430 352 431 353 case DCERPC_AUTH_LEVEL_INTEGRITY: 432 354 /* Data is signed. */ 433 return auth_ntlmssp_check_packet(auth_state, 434 data->data, 435 data->length, 436 full_pkt->data, 437 full_pkt->length, 438 auth_token); 439 440 default: 441 return NT_STATUS_INVALID_PARAMETER; 442 } 443 } 444 445 /******************************************************************* 446 Create and add the schannel sign/seal auth data. 447 ********************************************************************/ 448 449 static NTSTATUS add_schannel_auth_footer(struct schannel_state *sas, 450 enum dcerpc_AuthLevel auth_level, 451 DATA_BLOB *rpc_out) 452 { 453 uint8_t *data_p = rpc_out->data + DCERPC_RESPONSE_LENGTH; 454 size_t data_and_pad_len = rpc_out->length 455 - DCERPC_RESPONSE_LENGTH 456 - DCERPC_AUTH_TRAILER_LENGTH; 457 DATA_BLOB auth_blob; 458 NTSTATUS status; 459 460 if (!sas) { 461 return NT_STATUS_INVALID_PARAMETER; 462 } 463 464 DEBUG(10,("add_schannel_auth_footer: SCHANNEL seq_num=%d\n", 465 sas->seq_num)); 466 467 switch (auth_level) { 468 case DCERPC_AUTH_LEVEL_PRIVACY: 469 status = netsec_outgoing_packet(sas, 470 rpc_out->data, 471 true, 472 data_p, 473 data_and_pad_len, 474 &auth_blob); 475 break; 476 case DCERPC_AUTH_LEVEL_INTEGRITY: 477 status = netsec_outgoing_packet(sas, 478 rpc_out->data, 479 false, 480 data_p, 481 data_and_pad_len, 482 &auth_blob); 483 break; 484 default: 485 status = NT_STATUS_INTERNAL_ERROR; 486 break; 487 } 488 489 if (!NT_STATUS_IS_OK(status)) { 490 DEBUG(1,("add_schannel_auth_footer: failed to process packet: %s\n", 491 nt_errstr(status))); 492 return status; 493 } 494 495 if (DEBUGLEVEL >= 10) { 496 dump_NL_AUTH_SIGNATURE(talloc_tos(), &auth_blob); 497 } 498 499 /* Finally attach the blob. */ 500 if (!data_blob_append(NULL, rpc_out, 501 auth_blob.data, auth_blob.length)) { 502 return NT_STATUS_NO_MEMORY; 503 } 504 data_blob_free(&auth_blob); 505 506 return NT_STATUS_OK; 507 } 508 509 /******************************************************************* 510 Check/unseal the Schannel auth data. (Unseal in place). 511 ********************************************************************/ 512 513 static NTSTATUS get_schannel_auth_footer(TALLOC_CTX *mem_ctx, 514 struct schannel_state *auth_state, 515 enum dcerpc_AuthLevel auth_level, 516 DATA_BLOB *data, DATA_BLOB *full_pkt, 517 DATA_BLOB *auth_token) 518 { 519 switch (auth_level) { 520 case DCERPC_AUTH_LEVEL_PRIVACY: 521 /* Data portion is encrypted. */ 522 return netsec_incoming_packet(auth_state, 523 mem_ctx, true, 524 data->data, 525 data->length, 526 auth_token); 527 528 case DCERPC_AUTH_LEVEL_INTEGRITY: 529 /* Data is signed. */ 530 return netsec_incoming_packet(auth_state, 531 mem_ctx, false, 532 data->data, 533 data->length, 534 auth_token); 535 536 default: 537 return NT_STATUS_INVALID_PARAMETER; 538 } 539 } 540 541 /******************************************************************* 542 Create and add the gssapi sign/seal auth data. 543 ********************************************************************/ 544 545 static NTSTATUS add_gssapi_auth_footer(struct gse_context *gse_ctx, 546 enum dcerpc_AuthLevel auth_level, 547 DATA_BLOB *rpc_out) 548 { 549 DATA_BLOB data; 550 DATA_BLOB auth_blob; 551 NTSTATUS status; 552 553 if (!gse_ctx) { 554 return NT_STATUS_INVALID_PARAMETER; 555 } 556 557 data.data = rpc_out->data + DCERPC_RESPONSE_LENGTH; 558 data.length = rpc_out->length - DCERPC_RESPONSE_LENGTH 559 - DCERPC_AUTH_TRAILER_LENGTH; 560 561 switch (auth_level) { 562 case DCERPC_AUTH_LEVEL_PRIVACY: 563 status = gse_seal(talloc_tos(), gse_ctx, &data, &auth_blob); 564 break; 565 case DCERPC_AUTH_LEVEL_INTEGRITY: 566 status = gse_sign(talloc_tos(), gse_ctx, &data, &auth_blob); 567 break; 568 default: 569 status = NT_STATUS_INTERNAL_ERROR; 570 break; 571 } 572 573 if (!NT_STATUS_IS_OK(status)) { 574 DEBUG(1, ("Failed to process packet: %s\n", 575 nt_errstr(status))); 576 return status; 577 } 578 579 /* Finally attach the blob. */ 580 if (!data_blob_append(NULL, rpc_out, 581 auth_blob.data, auth_blob.length)) { 582 return NT_STATUS_NO_MEMORY; 583 } 584 585 data_blob_free(&auth_blob); 586 587 return NT_STATUS_OK; 588 } 589 590 /******************************************************************* 591 Check/unseal the gssapi auth data. (Unseal in place). 592 ********************************************************************/ 593 594 static NTSTATUS get_gssapi_auth_footer(TALLOC_CTX *mem_ctx, 595 struct gse_context *gse_ctx, 596 enum dcerpc_AuthLevel auth_level, 597 DATA_BLOB *data, DATA_BLOB *full_pkt, 598 DATA_BLOB *auth_token) 599 { 600 /* TODO: pass in full_pkt when 601 * DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN is set */ 602 switch (auth_level) { 603 case DCERPC_AUTH_LEVEL_PRIVACY: 604 /* Data portion is encrypted. */ 605 return gse_unseal(mem_ctx, gse_ctx, 606 data, auth_token); 607 608 case DCERPC_AUTH_LEVEL_INTEGRITY: 609 /* Data is signed. */ 610 return gse_sigcheck(mem_ctx, gse_ctx, 611 data, auth_token); 612 default: 613 return NT_STATUS_INVALID_PARAMETER; 614 } 615 } 616 617 /******************************************************************* 618 Create and add the spnego-negotiated sign/seal auth data. 619 ********************************************************************/ 620 621 static NTSTATUS add_spnego_auth_footer(struct spnego_context *spnego_ctx, 622 enum dcerpc_AuthLevel auth_level, 623 DATA_BLOB *rpc_out) 624 { 625 DATA_BLOB auth_blob; 626 DATA_BLOB rpc_data; 627 NTSTATUS status; 628 629 if (!spnego_ctx) { 630 return NT_STATUS_INVALID_PARAMETER; 631 } 632 633 rpc_data = data_blob_const(rpc_out->data 634 + DCERPC_RESPONSE_LENGTH, 635 rpc_out->length 636 - DCERPC_RESPONSE_LENGTH 637 - DCERPC_AUTH_TRAILER_LENGTH); 638 639 switch (auth_level) { 640 case DCERPC_AUTH_LEVEL_PRIVACY: 641 /* Data portion is encrypted. */ 642 status = spnego_seal(rpc_out->data, spnego_ctx, 643 &rpc_data, rpc_out, &auth_blob); 644 break; 645 646 if (!NT_STATUS_IS_OK(status)) { 647 return status; 648 } 649 break; 650 651 case DCERPC_AUTH_LEVEL_INTEGRITY: 652 /* Data is signed. */ 653 status = spnego_sign(rpc_out->data, spnego_ctx, 654 &rpc_data, rpc_out, &auth_blob); 655 break; 656 657 if (!NT_STATUS_IS_OK(status)) { 658 return status; 659 } 660 break; 661 662 default: 663 /* Can't happen. */ 664 smb_panic("bad auth level"); 665 /* Notreached. */ 666 return NT_STATUS_INVALID_PARAMETER; 667 } 668 669 /* Finally attach the blob. */ 670 if (!data_blob_append(NULL, rpc_out, 671 auth_blob.data, auth_blob.length)) { 672 DEBUG(0, ("Failed to add %u bytes auth blob.\n", 673 (unsigned int)auth_blob.length)); 674 return NT_STATUS_NO_MEMORY; 675 } 676 data_blob_free(&auth_blob); 677 678 return NT_STATUS_OK; 679 } 680 681 static NTSTATUS get_spnego_auth_footer(TALLOC_CTX *mem_ctx, 682 struct spnego_context *sp_ctx, 683 enum dcerpc_AuthLevel auth_level, 684 DATA_BLOB *data, DATA_BLOB *full_pkt, 685 DATA_BLOB *auth_token) 686 { 687 switch (auth_level) { 688 case DCERPC_AUTH_LEVEL_PRIVACY: 689 /* Data portion is encrypted. */ 690 return spnego_unseal(mem_ctx, sp_ctx, 691 data, full_pkt, auth_token); 692 693 case DCERPC_AUTH_LEVEL_INTEGRITY: 694 /* Data is signed. */ 695 return spnego_sigcheck(mem_ctx, sp_ctx, 696 data, full_pkt, auth_token); 355 return gensec_check_packet(gensec_security, 356 data->data, 357 data->length, 358 full_pkt->data, 359 full_pkt->length, 360 auth_token); 697 361 698 362 default: … … 713 377 size_t pad_len, DATA_BLOB *rpc_out) 714 378 { 715 struct schannel_state *schannel_auth; 716 struct auth_ntlmssp_state *ntlmssp_ctx; 717 struct spnego_context *spnego_ctx; 718 struct gse_context *gse_ctx; 719 char pad[CLIENT_NDR_PADDING_SIZE] = { 0, }; 379 struct gensec_security *gensec_security; 380 const char pad[DCERPC_AUTH_PAD_ALIGNMENT] = { 0, }; 720 381 DATA_BLOB auth_info; 721 382 DATA_BLOB auth_blob; 722 383 NTSTATUS status; 723 384 724 if (auth->auth_type == DCERPC_AUTH_TYPE_NONE || 725 auth->auth_type == DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM) { 385 if (auth->auth_type == DCERPC_AUTH_TYPE_NONE) { 726 386 return NT_STATUS_OK; 727 387 } 728 388 729 389 if (pad_len) { 390 SMB_ASSERT(pad_len <= ARRAY_SIZE(pad)); 391 730 392 /* Copy the sign/seal padding data. */ 731 393 if (!data_blob_append(NULL, rpc_out, pad, pad_len)) { … … 761 423 switch (auth->auth_type) { 762 424 case DCERPC_AUTH_TYPE_NONE: 763 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:764 425 status = NT_STATUS_OK; 765 426 break; 766 case DCERPC_AUTH_TYPE_SPNEGO: 767 spnego_ctx = talloc_get_type_abort(auth->auth_ctx, 768 struct spnego_context); 769 status = add_spnego_auth_footer(spnego_ctx, 770 auth->auth_level, rpc_out); 771 break; 772 case DCERPC_AUTH_TYPE_NTLMSSP: 773 ntlmssp_ctx = talloc_get_type_abort(auth->auth_ctx, 774 struct auth_ntlmssp_state); 775 status = add_ntlmssp_auth_footer(ntlmssp_ctx, 427 default: 428 gensec_security = auth->auth_ctx; 429 status = add_generic_auth_footer(gensec_security, 776 430 auth->auth_level, 777 431 rpc_out); 778 break;779 case DCERPC_AUTH_TYPE_SCHANNEL:780 schannel_auth = talloc_get_type_abort(auth->auth_ctx,781 struct schannel_state);782 status = add_schannel_auth_footer(schannel_auth,783 auth->auth_level,784 rpc_out);785 break;786 case DCERPC_AUTH_TYPE_KRB5:787 gse_ctx = talloc_get_type_abort(auth->auth_ctx,788 struct gse_context);789 status = add_gssapi_auth_footer(gse_ctx,790 auth->auth_level,791 rpc_out);792 break;793 default:794 status = NT_STATUS_INVALID_PARAMETER;795 432 break; 796 433 } … … 817 454 DATA_BLOB *raw_pkt) 818 455 { 819 struct schannel_state *schannel_auth; 820 struct auth_ntlmssp_state *ntlmssp_ctx; 821 struct spnego_context *spnego_ctx; 822 struct gse_context *gse_ctx; 456 struct gensec_security *gensec_security; 823 457 NTSTATUS status; 824 458 struct dcerpc_auth auth_info; … … 894 528 switch (auth->auth_type) { 895 529 case DCERPC_AUTH_TYPE_NONE: 896 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:897 530 return NT_STATUS_OK; 898 531 899 case DCERPC_AUTH_TYPE_SPNEGO: 900 spnego_ctx = talloc_get_type_abort(auth->auth_ctx, 901 struct spnego_context); 902 status = get_spnego_auth_footer(pkt, spnego_ctx, 903 auth->auth_level, 904 &data, &full_pkt, 905 &auth_info.credentials); 906 if (!NT_STATUS_IS_OK(status)) { 907 return status; 908 } 909 break; 910 911 case DCERPC_AUTH_TYPE_NTLMSSP: 912 913 DEBUG(10, ("NTLMSSP auth\n")); 914 915 ntlmssp_ctx = talloc_get_type_abort(auth->auth_ctx, 916 struct auth_ntlmssp_state); 917 status = get_ntlmssp_auth_footer(ntlmssp_ctx, 532 default: 533 DEBUG(10, ("GENSEC auth\n")); 534 535 gensec_security = auth->auth_ctx; 536 status = get_generic_auth_footer(gensec_security, 918 537 auth->auth_level, 919 538 &data, &full_pkt, … … 923 542 } 924 543 break; 925 926 case DCERPC_AUTH_TYPE_SCHANNEL:927 928 DEBUG(10, ("SCHANNEL auth\n"));929 930 schannel_auth = talloc_get_type_abort(auth->auth_ctx,931 struct schannel_state);932 status = get_schannel_auth_footer(pkt, schannel_auth,933 auth->auth_level,934 &data, &full_pkt,935 &auth_info.credentials);936 if (!NT_STATUS_IS_OK(status)) {937 return status;938 }939 break;940 941 case DCERPC_AUTH_TYPE_KRB5:942 943 DEBUG(10, ("KRB5 auth\n"));944 945 gse_ctx = talloc_get_type_abort(auth->auth_ctx,946 struct gse_context);947 status = get_gssapi_auth_footer(pkt, gse_ctx,948 auth->auth_level,949 &data, &full_pkt,950 &auth_info.credentials);951 if (!NT_STATUS_IS_OK(status)) {952 return status;953 }954 break;955 956 default:957 DEBUG(0, ("process_request_pdu: "958 "unknown auth type %u set.\n",959 (unsigned int)auth->auth_type));960 return NT_STATUS_INVALID_PARAMETER;961 544 } 962 545
Note:
See TracChangeset
for help on using the changeset viewer.
