static bool dcerpc_floor_pack_rhs_if_version_data(
TALLOC_CTX *mem_ctx, const struct ndr_syntax_id *syntax,
DATA_BLOB *pblob)
{
DATA_BLOB blob;
struct ndr_push *ndr = ndr_push_init_ctx(mem_ctx);
enum ndr_err_code ndr_err;
if (ndr == NULL) {
return false;
}
ndr->flags |= LIBNDR_FLAG_NOALIGN;
ndr_err = ndr_push_uint16(ndr, NDR_SCALARS, syntax->if_version >> 16);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return false;
}
blob = ndr_push_blob(ndr);
talloc_steal(mem_ctx, blob.data);
talloc_free(ndr);
*pblob = blob;
return true;
}
static DATA_BLOB dcerpc_floor_pack_lhs_data(TALLOC_CTX *mem_ctx, const struct ndr_syntax_id *syntax)
{
DATA_BLOB blob;
enum ndr_err_code ndr_err;
struct ndr_push *ndr;
ndr = ndr_push_init_ctx(mem_ctx);
if (ndr == NULL) {
return data_blob_null;
}
ndr->flags |= LIBNDR_FLAG_NOALIGN;
ndr_err = ndr_push_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, &syntax->uuid);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return data_blob_null;
}
ndr_err = ndr_push_uint16(ndr, NDR_SCALARS, syntax->if_version);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return data_blob_null;
}
blob = ndr_push_blob(ndr);
talloc_steal(mem_ctx, blob.data);
talloc_free(ndr);
return blob;
}
/*
generic ndr_size_*() handler for unions
*/
_PUBLIC_ size_t ndr_size_union(const void *p, int flags, uint32_t level, ndr_push_flags_fn_t push, struct smb_iconv_convenience *iconv_convenience)
{
struct ndr_push *ndr;
enum ndr_err_code status;
size_t ret;
/* avoid recursion */
if (flags & LIBNDR_FLAG_NO_NDR_SIZE) return 0;
ndr = ndr_push_init_ctx(NULL, iconv_convenience);
if (!ndr) return 0;
ndr->flags |= flags | LIBNDR_FLAG_NO_NDR_SIZE;
status = ndr_push_set_switch_value(ndr, p, level);
if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
talloc_free(ndr);
return 0;
}
status = push(ndr, NDR_SCALARS|NDR_BUFFERS, p);
if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
talloc_free(ndr);
return 0;
}
ret = ndr->offset;
talloc_free(ndr);
return ret;
}
/*
push a ncacn_packet into a blob, potentially with auth info
*/
NTSTATUS ncacn_push_auth(DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
struct ncacn_packet *pkt,
struct dcerpc_auth *auth_info)
{
struct ndr_push *ndr;
enum ndr_err_code ndr_err;
ndr = ndr_push_init_ctx(mem_ctx);
if (!ndr) {
return NT_STATUS_NO_MEMORY;
}
if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
}
if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
}
if (auth_info) {
pkt->auth_length = auth_info->credentials.length;
} else {
pkt->auth_length = 0;
}
ndr_err = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return ndr_map_error2ntstatus(ndr_err);
}
if (auth_info) {
#if 0
/* the s3 rpc server doesn't handle auth padding in
bind requests. Use zero auth padding to keep us
working with old servers */
uint32_t offset = ndr->offset;
ndr_err = ndr_push_align(ndr, 16);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return ndr_map_error2ntstatus(ndr_err);
}
auth_info->auth_pad_length = ndr->offset - offset;
#else
auth_info->auth_pad_length = 0;
#endif
ndr_err = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, auth_info);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return ndr_map_error2ntstatus(ndr_err);
}
}
*blob = ndr_push_blob(ndr);
/* fill in the frag length */
dcerpc_set_frag_length(blob, blob->length);
return NT_STATUS_OK;
}
static DATA_BLOB dcerpc_floor_pack_lhs_data(TALLOC_CTX *mem_ctx, const struct dcerpc_syntax_id *syntax)
{
struct ndr_push *ndr = ndr_push_init_ctx(mem_ctx);
ndr->flags |= LIBNDR_FLAG_NOALIGN;
ndr_push_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, &syntax->uuid);
ndr_push_uint16(ndr, NDR_SCALARS, syntax->if_version);
return ndr_push_blob(ndr);
}
/*
push a struct to a blob using NDR
*/
_PUBLIC_ enum ndr_err_code ndr_push_struct_blob(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, struct smb_iconv_convenience *iconv_convenience, const void *p, ndr_push_flags_fn_t fn)
{
struct ndr_push *ndr;
ndr = ndr_push_init_ctx(mem_ctx, iconv_convenience);
NDR_ERR_HAVE_NO_MEMORY(ndr);
NDR_CHECK(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
*blob = ndr_push_blob(ndr);
talloc_steal(mem_ctx, blob->data);
talloc_free(ndr);
return NDR_ERR_SUCCESS;
}
static DATA_BLOB dcerpc_floor_pack_lhs_data(TALLOC_CTX *mem_ctx, const struct ndr_syntax_id *syntax)
{
DATA_BLOB blob;
struct ndr_push *ndr = ndr_push_init_ctx(mem_ctx, NULL);
ndr->flags |= LIBNDR_FLAG_NOALIGN;
ndr_push_GUID(ndr, NDR_SCALARS | NDR_BUFFERS, &syntax->uuid);
ndr_push_uint16(ndr, NDR_SCALARS, syntax->if_version);
blob = ndr_push_blob(ndr);
talloc_steal(mem_ctx, blob.data);
talloc_free(ndr);
return blob;
}
/*
push a union to a blob using NDR
*/
_PUBLIC_ enum ndr_err_code ndr_push_union_blob(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, void *p,
uint32_t level, ndr_push_flags_fn_t fn)
{
struct ndr_push *ndr;
ndr = ndr_push_init_ctx(mem_ctx);
NDR_ERR_HAVE_NO_MEMORY(ndr);
NDR_CHECK(ndr_push_set_switch_value(ndr, p, level));
NDR_CHECK(fn(ndr, NDR_SCALARS|NDR_BUFFERS, p));
*blob = ndr_push_blob(ndr);
talloc_steal(mem_ctx, blob->data);
talloc_free(ndr);
return NDR_ERR_SUCCESS;
}
static enum ndr_err_code torture_ndr_push_struct_blob_flags(DATA_BLOB *blob, TALLOC_CTX *mem_ctx, uint32_t flags, uint32_t ndr_flags, const void *p, ndr_push_flags_fn_t fn)
{
struct ndr_push *ndr;
ndr = ndr_push_init_ctx(mem_ctx);
NDR_ERR_HAVE_NO_MEMORY(ndr);
ndr->flags |= ndr_flags;
NDR_CHECK(fn(ndr, flags, p));
*blob = ndr_push_blob(ndr);
talloc_steal(mem_ctx, blob->data);
talloc_free(ndr);
return NDR_ERR_SUCCESS;
}
/*
push a ncacn_packet into a blob, potentially with auth info
*/
NTSTATUS ncacn_push_auth(DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
struct ncacn_packet *pkt,
struct dcerpc_auth *auth_info)
{
NTSTATUS status;
struct ndr_push *ndr;
ndr = ndr_push_init_ctx(mem_ctx);
if (!ndr) {
return NT_STATUS_NO_MEMORY;
}
if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
}
if (pkt->pfc_flags & DCERPC_PFC_FLAG_ORPC) {
ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
}
if (auth_info) {
pkt->auth_length = auth_info->credentials.length;
} else {
pkt->auth_length = 0;
}
status = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
if (auth_info) {
status = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, auth_info);
}
*blob = ndr_push_blob(ndr);
/* fill in the frag length */
dcerpc_set_frag_length(blob, blob->length);
return NT_STATUS_OK;
}
_PUBLIC_ enum ndr_err_code ndr_push_subcontext_start(struct ndr_push *ndr,
struct ndr_push **_subndr,
size_t header_size,
ssize_t size_is)
{
struct ndr_push *subndr;
subndr = ndr_push_init_ctx(ndr, ndr->iconv_convenience);
NDR_ERR_HAVE_NO_MEMORY(subndr);
subndr->flags = ndr->flags & ~LIBNDR_FLAG_NDR64;
if (size_is > 0) {
NDR_CHECK(ndr_push_zero(subndr, size_is));
subndr->offset = 0;
subndr->relative_end_offset = size_is;
}
*_subndr = subndr;
return NDR_ERR_SUCCESS;
}
/*
generic ndr_size_*() handler for structures
*/
_PUBLIC_ size_t ndr_size_struct(const void *p, int flags, ndr_push_flags_fn_t push)
{
struct ndr_push *ndr;
enum ndr_err_code status;
size_t ret;
/* avoid recursion */
if (flags & LIBNDR_FLAG_NO_NDR_SIZE) return 0;
ndr = ndr_push_init_ctx(NULL);
if (!ndr) return 0;
ndr->flags |= flags | LIBNDR_FLAG_NO_NDR_SIZE;
status = push(ndr, NDR_SCALARS|NDR_BUFFERS, discard_const(p));
if (!NDR_ERR_CODE_IS_SUCCESS(status)) {
talloc_free(ndr);
return 0;
}
ret = ndr->offset;
talloc_free(ndr);
return ret;
}
static bool api_frstrans_RdcGetFileDataAsync(struct pipes_struct *p)
{
const struct ndr_interface_call *call;
struct ndr_pull *pull;
struct ndr_push *push;
enum ndr_err_code ndr_err;
struct frstrans_RdcGetFileDataAsync *r;
call = &ndr_table_frstrans.calls[NDR_FRSTRANS_RDCGETFILEDATAASYNC];
r = talloc(talloc_tos(), struct frstrans_RdcGetFileDataAsync);
if (r == NULL) {
return false;
}
pull = ndr_pull_init_blob(&p->in_data.data, r);
if (pull == NULL) {
talloc_free(r);
return false;
}
pull->flags |= LIBNDR_FLAG_REF_ALLOC;
if (p->endian) {
pull->flags |= LIBNDR_FLAG_BIGENDIAN;
}
ndr_err = call->ndr_pull(pull, NDR_IN, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(frstrans_RdcGetFileDataAsync, NDR_IN, r);
}
ZERO_STRUCT(r->out);
r->out.byte_pipe = talloc_zero(r, struct frstrans_BytePipe);
if (r->out.byte_pipe == NULL) {
talloc_free(r);
return false;
}
r->out.result = _frstrans_RdcGetFileDataAsync(p, r);
if (p->fault_state) {
talloc_free(r);
/* Return true here, srv_pipe_hnd.c will take care */
return true;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(frstrans_RdcGetFileDataAsync, NDR_OUT | NDR_SET_VALUES, r);
}
push = ndr_push_init_ctx(r);
if (push == NULL) {
talloc_free(r);
return false;
}
/*
* carry over the pointer count to the reply in case we are
* using full pointer. See NDR specification for full pointers
*/
push->ptr_count = pull->ptr_count;
ndr_err = call->ndr_push(push, NDR_OUT, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
p->out_data.rdata = ndr_push_blob(push);
talloc_steal(p->mem_ctx, p->out_data.rdata.data);
talloc_free(r);
return true;
}
/* create a ndr_push structure, ready for some marshalling */
_PUBLIC_ struct ndr_push *ndr_push_init(void)
{
return ndr_push_init_ctx(NULL);
}
static bool api_frsrpc_FrsStartPromotionParent(struct pipes_struct *p)
{
const struct ndr_interface_call *call;
struct ndr_pull *pull;
struct ndr_push *push;
enum ndr_err_code ndr_err;
struct frsrpc_FrsStartPromotionParent *r;
call = &ndr_table_frsrpc.calls[NDR_FRSRPC_FRSSTARTPROMOTIONPARENT];
r = talloc(talloc_tos(), struct frsrpc_FrsStartPromotionParent);
if (r == NULL) {
return false;
}
pull = ndr_pull_init_blob(&p->in_data.data, r);
if (pull == NULL) {
talloc_free(r);
return false;
}
pull->flags |= LIBNDR_FLAG_REF_ALLOC;
if (p->endian) {
pull->flags |= LIBNDR_FLAG_BIGENDIAN;
}
ndr_err = call->ndr_pull(pull, NDR_IN, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(frsrpc_FrsStartPromotionParent, NDR_IN, r);
}
ZERO_STRUCT(r->out);
r->out.parent_guid = r->in.parent_guid;
r->out.result = _frsrpc_FrsStartPromotionParent(p, r);
if (p->fault_state) {
talloc_free(r);
/* Return true here, srv_pipe_hnd.c will take care */
return true;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(frsrpc_FrsStartPromotionParent, NDR_OUT | NDR_SET_VALUES, r);
}
push = ndr_push_init_ctx(r);
if (push == NULL) {
talloc_free(r);
return false;
}
/*
* carry over the pointer count to the reply in case we are
* using full pointer. See NDR specification for full pointers
*/
push->ptr_count = pull->ptr_count;
ndr_err = call->ndr_push(push, NDR_OUT, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
p->out_data.rdata = ndr_push_blob(push);
talloc_steal(p->mem_ctx, p->out_data.rdata.data);
talloc_free(r);
return true;
}
static bool api_atsvc_JobEnum(struct pipes_struct *p)
{
const struct ndr_interface_call *call;
struct ndr_pull *pull;
struct ndr_push *push;
enum ndr_err_code ndr_err;
struct atsvc_JobEnum *r;
call = &ndr_table_atsvc.calls[NDR_ATSVC_JOBENUM];
r = talloc(talloc_tos(), struct atsvc_JobEnum);
if (r == NULL) {
return false;
}
pull = ndr_pull_init_blob(&p->in_data.data, r);
if (pull == NULL) {
talloc_free(r);
return false;
}
pull->flags |= LIBNDR_FLAG_REF_ALLOC;
if (p->endian) {
pull->flags |= LIBNDR_FLAG_BIGENDIAN;
}
ndr_err = call->ndr_pull(pull, NDR_IN, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(atsvc_JobEnum, NDR_IN, r);
}
ZERO_STRUCT(r->out);
r->out.ctr = r->in.ctr;
r->out.resume_handle = r->in.resume_handle;
r->out.total_entries = talloc_zero(r, uint32_t);
if (r->out.total_entries == NULL) {
talloc_free(r);
return false;
}
r->out.result = _atsvc_JobEnum(p, r);
if (p->fault_state) {
talloc_free(r);
/* Return true here, srv_pipe_hnd.c will take care */
return true;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(atsvc_JobEnum, NDR_OUT | NDR_SET_VALUES, r);
}
push = ndr_push_init_ctx(r);
if (push == NULL) {
talloc_free(r);
return false;
}
/*
* carry over the pointer count to the reply in case we are
* using full pointer. See NDR specification for full pointers
*/
push->ptr_count = pull->ptr_count;
ndr_err = call->ndr_push(push, NDR_OUT, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
p->out_data.rdata = ndr_push_blob(push);
talloc_steal(p->mem_ctx, p->out_data.rdata.data);
talloc_free(r);
return true;
}
static bool api_wbint_LookupUserGroups(struct pipes_struct *p)
{
const struct ndr_interface_call *call;
struct ndr_pull *pull;
struct ndr_push *push;
enum ndr_err_code ndr_err;
struct wbint_LookupUserGroups *r;
call = &ndr_table_wbint.calls[NDR_WBINT_LOOKUPUSERGROUPS];
r = talloc(talloc_tos(), struct wbint_LookupUserGroups);
if (r == NULL) {
return false;
}
pull = ndr_pull_init_blob(&p->in_data.data, r);
if (pull == NULL) {
talloc_free(r);
return false;
}
pull->flags |= LIBNDR_FLAG_REF_ALLOC;
if (p->endian) {
pull->flags |= LIBNDR_FLAG_BIGENDIAN;
}
ndr_err = call->ndr_pull(pull, NDR_IN, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(wbint_LookupUserGroups, NDR_IN, r);
}
ZERO_STRUCT(r->out);
r->out.sids = talloc_zero(r, struct wbint_SidArray);
if (r->out.sids == NULL) {
talloc_free(r);
return false;
}
r->out.result = _wbint_LookupUserGroups(p, r);
if (p->fault_state) {
talloc_free(r);
/* Return true here, srv_pipe_hnd.c will take care */
return true;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(wbint_LookupUserGroups, NDR_OUT | NDR_SET_VALUES, r);
}
push = ndr_push_init_ctx(r);
if (push == NULL) {
talloc_free(r);
return false;
}
/*
* carry over the pointer count to the reply in case we are
* using full pointer. See NDR specification for full pointers
*/
push->ptr_count = pull->ptr_count;
ndr_err = call->ndr_push(push, NDR_OUT, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
p->out_data.rdata = ndr_push_blob(push);
talloc_steal(p->mem_ctx, p->out_data.rdata.data);
talloc_free(r);
return true;
}
/*
this is a paranoid NDR input validator. For every packet we pull
from the wire we push it back again then pull and push it
again. Then we compare the raw NDR data for that to the NDR we
initially generated. If they don't match then we know we must have a
bug in either the pull or push side of our code
*/
static NTSTATUS dcerpc_ndr_validate_out(struct dcerpc_connection *c,
struct ndr_pull *pull_in,
void *struct_ptr,
size_t struct_size,
ndr_push_flags_fn_t ndr_push,
ndr_pull_flags_fn_t ndr_pull,
ndr_print_function_t ndr_print)
{
void *st;
struct ndr_pull *pull;
struct ndr_push *push;
DATA_BLOB blob, blob2;
TALLOC_CTX *mem_ctx = pull_in;
char *s1, *s2;
enum ndr_err_code ndr_err;
st = talloc_size(mem_ctx, struct_size);
if (!st) {
return NT_STATUS_NO_MEMORY;
}
memcpy(st, struct_ptr, struct_size);
push = ndr_push_init_ctx(mem_ctx, c->iconv_convenience);
if (!push) {
return NT_STATUS_NO_MEMORY;
}
ndr_err = ndr_push(push, NDR_OUT, struct_ptr);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
"failed output validation push - %s",
nt_errstr(status));
return ndr_map_error2ntstatus(ndr_err);
}
blob = ndr_push_blob(push);
pull = ndr_pull_init_flags(c, &blob, mem_ctx);
if (!pull) {
return NT_STATUS_NO_MEMORY;
}
pull->flags |= LIBNDR_FLAG_REF_ALLOC;
ndr_err = ndr_pull(pull, NDR_OUT, st);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
"failed output validation pull - %s",
nt_errstr(status));
return ndr_map_error2ntstatus(ndr_err);
}
push = ndr_push_init_ctx(mem_ctx, c->iconv_convenience);
if (!push) {
return NT_STATUS_NO_MEMORY;
}
ndr_err = ndr_push(push, NDR_OUT, st);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
"failed output validation push2 - %s",
nt_errstr(status));
return ndr_map_error2ntstatus(ndr_err);
}
blob2 = ndr_push_blob(push);
if (data_blob_cmp(&blob, &blob2) != 0) {
DEBUG(3,("original:\n"));
dump_data(3, blob.data, blob.length);
DEBUG(3,("secondary:\n"));
dump_data(3, blob2.data, blob2.length);
ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
"failed output validation blobs doesn't match");
return ndr_map_error2ntstatus(ndr_err);
}
/* this checks the printed forms of the two structures, which effectively
tests all of the value() attributes */
s1 = ndr_print_function_string(mem_ctx, ndr_print, "VALIDATE",
NDR_OUT, struct_ptr);
s2 = ndr_print_function_string(mem_ctx, ndr_print, "VALIDATE",
NDR_OUT, st);
if (strcmp(s1, s2) != 0) {
#if 1
DEBUG(3,("VALIDATE ERROR:\nWIRE:\n%s\n GEN:\n%s\n", s1, s2));
#else
/* this is sometimes useful */
printf("VALIDATE ERROR\n");
file_save("wire.dat", s1, strlen(s1));
file_save("gen.dat", s2, strlen(s2));
system("diff -u wire.dat gen.dat");
#endif
ndr_err = ndr_push_error(push, NDR_ERR_VALIDATE,
"failed output validation strings doesn't match");
return ndr_map_error2ntstatus(ndr_err);
}
return NT_STATUS_OK;
}
/*
push a dcerpc request packet into a blob, possibly signing it.
*/
static NTSTATUS ncacn_push_request_sign(struct dcerpc_connection *c,
DATA_BLOB *blob, TALLOC_CTX *mem_ctx,
size_t sig_size,
struct ncacn_packet *pkt)
{
NTSTATUS status;
struct ndr_push *ndr;
DATA_BLOB creds2;
size_t payload_length;
enum ndr_err_code ndr_err;
size_t hdr_size = DCERPC_REQUEST_LENGTH;
/* non-signed packets are simpler */
if (sig_size == 0) {
return ncacn_push_auth(blob, mem_ctx, c->iconv_convenience, pkt, NULL);
}
switch (c->security_state.auth_info->auth_level) {
case DCERPC_AUTH_LEVEL_PRIVACY:
case DCERPC_AUTH_LEVEL_INTEGRITY:
break;
case DCERPC_AUTH_LEVEL_CONNECT:
/* TODO: let the gensec mech decide if it wants to generate a signature */
return ncacn_push_auth(blob, mem_ctx, c->iconv_convenience, pkt, NULL);
case DCERPC_AUTH_LEVEL_NONE:
return ncacn_push_auth(blob, mem_ctx, c->iconv_convenience, pkt, NULL);
default:
return NT_STATUS_INVALID_LEVEL;
}
ndr = ndr_push_init_ctx(mem_ctx, c->iconv_convenience);
if (!ndr) {
return NT_STATUS_NO_MEMORY;
}
if (c->flags & DCERPC_PUSH_BIGENDIAN) {
ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
}
if (c->flags & DCERPC_NDR64) {
ndr->flags |= LIBNDR_FLAG_NDR64;
}
if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
ndr->flags |= LIBNDR_FLAG_OBJECT_PRESENT;
hdr_size += 16;
}
ndr_err = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return ndr_map_error2ntstatus(ndr_err);
}
status = NT_STATUS_OK;
/* pad to 16 byte multiple in the payload portion of the
packet. This matches what w2k3 does */
c->security_state.auth_info->auth_pad_length =
(16 - (pkt->u.request.stub_and_verifier.length & 15)) & 15;
ndr_err = ndr_push_zero(ndr, c->security_state.auth_info->auth_pad_length);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return ndr_map_error2ntstatus(ndr_err);
}
status = NT_STATUS_OK;
payload_length = pkt->u.request.stub_and_verifier.length +
c->security_state.auth_info->auth_pad_length;
/* we start without signature, it will appended later */
c->security_state.auth_info->credentials = data_blob(NULL,0);
/* add the auth verifier */
ndr_err = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS, c->security_state.auth_info);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return ndr_map_error2ntstatus(ndr_err);
}
status = NT_STATUS_OK;
/* extract the whole packet as a blob */
*blob = ndr_push_blob(ndr);
/*
* Setup the frag and auth length in the packet buffer.
* This is needed if the GENSEC mech does AEAD signing
* of the packet headers. The signature itself will be
* appended later.
*/
dcerpc_set_frag_length(blob, blob->length + sig_size);
dcerpc_set_auth_length(blob, sig_size);
/* sign or seal the packet */
switch (c->security_state.auth_info->auth_level) {
case DCERPC_AUTH_LEVEL_PRIVACY:
status = gensec_seal_packet(c->security_state.generic_state,
mem_ctx,
blob->data + hdr_size,
payload_length,
blob->data,
blob->length,
&creds2);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
break;
case DCERPC_AUTH_LEVEL_INTEGRITY:
status = gensec_sign_packet(c->security_state.generic_state,
mem_ctx,
blob->data + hdr_size,
payload_length,
blob->data,
blob->length,
&creds2);
if (!NT_STATUS_IS_OK(status)) {
return status;
}
break;
default:
status = NT_STATUS_INVALID_LEVEL;
break;
}
if (creds2.length != sig_size) {
DEBUG(0,("ncacn_push_request_sign: creds2.length[%u] != sig_size[%u] pad[%u] stub[%u]\n",
(unsigned) creds2.length,
(unsigned) sig_size,
(unsigned) c->security_state.auth_info->auth_pad_length,
(unsigned) pkt->u.request.stub_and_verifier.length));
return NT_STATUS_INTERNAL_ERROR;
}
if (!data_blob_append(mem_ctx, blob, creds2.data, creds2.length)) {
return NT_STATUS_NO_MEMORY;
}
return NT_STATUS_OK;
}
static bool api_fss_GetShareMapping(struct pipes_struct *p)
{
const struct ndr_interface_call *call;
struct ndr_pull *pull;
struct ndr_push *push;
enum ndr_err_code ndr_err;
struct fss_GetShareMapping *r;
call = &ndr_table_FileServerVssAgent.calls[NDR_FSS_GETSHAREMAPPING];
r = talloc(talloc_tos(), struct fss_GetShareMapping);
if (r == NULL) {
return false;
}
pull = ndr_pull_init_blob(&p->in_data.data, r);
if (pull == NULL) {
talloc_free(r);
return false;
}
pull->flags |= LIBNDR_FLAG_REF_ALLOC;
if (p->endian) {
pull->flags |= LIBNDR_FLAG_BIGENDIAN;
}
ndr_err = call->ndr_pull(pull, NDR_IN, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(fss_GetShareMapping, NDR_IN, r);
}
ZERO_STRUCT(r->out);
r->out.ShareMapping = talloc_zero(r, union fssagent_share_mapping);
if (r->out.ShareMapping == NULL) {
talloc_free(r);
return false;
}
r->out.result = _fss_GetShareMapping(p, r);
if (p->fault_state) {
talloc_free(r);
/* Return true here, srv_pipe_hnd.c will take care */
return true;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(fss_GetShareMapping, NDR_OUT | NDR_SET_VALUES, r);
}
push = ndr_push_init_ctx(r);
if (push == NULL) {
talloc_free(r);
return false;
}
/*
* carry over the pointer count to the reply in case we are
* using full pointer. See NDR specification for full pointers
*/
push->ptr_count = pull->ptr_count;
ndr_err = call->ndr_push(push, NDR_OUT, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
p->out_data.rdata = ndr_push_blob(push);
talloc_steal(p->mem_ctx, p->out_data.rdata.data);
talloc_free(r);
return true;
}
static bool api_frstrans_InitializeFileTransferAsync(struct pipes_struct *p)
{
const struct ndr_interface_call *call;
struct ndr_pull *pull;
struct ndr_push *push;
enum ndr_err_code ndr_err;
struct frstrans_InitializeFileTransferAsync *r;
call = &ndr_table_frstrans.calls[NDR_FRSTRANS_INITIALIZEFILETRANSFERASYNC];
r = talloc(talloc_tos(), struct frstrans_InitializeFileTransferAsync);
if (r == NULL) {
return false;
}
pull = ndr_pull_init_blob(&p->in_data.data, r);
if (pull == NULL) {
talloc_free(r);
return false;
}
pull->flags |= LIBNDR_FLAG_REF_ALLOC;
if (p->endian) {
pull->flags |= LIBNDR_FLAG_BIGENDIAN;
}
ndr_err = call->ndr_pull(pull, NDR_IN, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(frstrans_InitializeFileTransferAsync, NDR_IN, r);
}
ZERO_STRUCT(r->out);
r->out.frs_update = r->in.frs_update;
r->out.staging_policy = r->in.staging_policy;
r->out.server_context = talloc_zero(r, struct policy_handle);
if (r->out.server_context == NULL) {
talloc_free(r);
return false;
}
r->out.rdc_file_info = talloc_zero(r, struct frstrans_RdcFileInfo *);
if (r->out.rdc_file_info == NULL) {
talloc_free(r);
return false;
}
r->out.data_buffer = talloc_zero_array(r, uint8_t, r->in.buffer_size);
if (r->out.data_buffer == NULL) {
talloc_free(r);
return false;
}
r->out.size_read = talloc_zero(r, uint32_t);
if (r->out.size_read == NULL) {
talloc_free(r);
return false;
}
r->out.is_end_of_file = talloc_zero(r, uint32_t);
if (r->out.is_end_of_file == NULL) {
talloc_free(r);
return false;
}
r->out.result = _frstrans_InitializeFileTransferAsync(p, r);
if (p->fault_state) {
talloc_free(r);
/* Return true here, srv_pipe_hnd.c will take care */
return true;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(frstrans_InitializeFileTransferAsync, NDR_OUT | NDR_SET_VALUES, r);
}
push = ndr_push_init_ctx(r);
if (push == NULL) {
talloc_free(r);
return false;
}
/*
* carry over the pointer count to the reply in case we are
* using full pointer. See NDR specification for full pointers
*/
push->ptr_count = pull->ptr_count;
ndr_err = call->ndr_push(push, NDR_OUT, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
p->out_data.rdata = ndr_push_blob(push);
talloc_steal(p->mem_ctx, p->out_data.rdata.data);
talloc_free(r);
return true;
}
static bool api_drsuapi_DsCrackNames(struct pipes_struct *p)
{
const struct ndr_interface_call *call;
struct ndr_pull *pull;
struct ndr_push *push;
enum ndr_err_code ndr_err;
struct drsuapi_DsCrackNames *r;
call = &ndr_table_drsuapi.calls[NDR_DRSUAPI_DSCRACKNAMES];
r = talloc(talloc_tos(), struct drsuapi_DsCrackNames);
if (r == NULL) {
return false;
}
pull = ndr_pull_init_blob(&p->in_data.data, r);
if (pull == NULL) {
talloc_free(r);
return false;
}
pull->flags |= LIBNDR_FLAG_REF_ALLOC;
if (p->endian) {
pull->flags |= LIBNDR_FLAG_BIGENDIAN;
}
ndr_err = call->ndr_pull(pull, NDR_IN, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsCrackNames, NDR_IN, r);
}
ZERO_STRUCT(r->out);
r->out.level_out = talloc_zero(r, uint32_t);
if (r->out.level_out == NULL) {
talloc_free(r);
return false;
}
r->out.ctr = talloc_zero(r, union drsuapi_DsNameCtr);
if (r->out.ctr == NULL) {
talloc_free(r);
return false;
}
r->out.result = _drsuapi_DsCrackNames(p, r);
if (p->fault_state) {
talloc_free(r);
/* Return true here, srv_pipe_hnd.c will take care */
return true;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(drsuapi_DsCrackNames, NDR_OUT | NDR_SET_VALUES, r);
}
push = ndr_push_init_ctx(r);
if (push == NULL) {
talloc_free(r);
return false;
}
/*
* carry over the pointer count to the reply in case we are
* using full pointer. See NDR specification for full pointers
*/
push->ptr_count = pull->ptr_count;
ndr_err = call->ndr_push(push, NDR_OUT, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
p->out_data.rdata = ndr_push_blob(push);
talloc_steal(p->mem_ctx, p->out_data.rdata.data);
talloc_free(r);
return true;
}
static bool api_mgmt_inq_princ_name(struct pipes_struct *p)
{
const struct ndr_interface_call *call;
struct ndr_pull *pull;
struct ndr_push *push;
enum ndr_err_code ndr_err;
struct mgmt_inq_princ_name *r;
call = &ndr_table_mgmt.calls[NDR_MGMT_INQ_PRINC_NAME];
r = talloc(talloc_tos(), struct mgmt_inq_princ_name);
if (r == NULL) {
return false;
}
pull = ndr_pull_init_blob(&p->in_data.data, r);
if (pull == NULL) {
talloc_free(r);
return false;
}
pull->flags |= LIBNDR_FLAG_REF_ALLOC;
if (p->endian) {
pull->flags |= LIBNDR_FLAG_BIGENDIAN;
}
ndr_err = call->ndr_pull(pull, NDR_IN, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(mgmt_inq_princ_name, NDR_IN, r);
}
ZERO_STRUCT(r->out);
r->out.princ_name = talloc_zero_array(r, const char, r->in.princ_name_size);
if (r->out.princ_name == NULL) {
talloc_free(r);
return false;
}
r->out.result = _mgmt_inq_princ_name(p, r);
if (p->rng_fault_state) {
talloc_free(r);
/* Return true here, srv_pipe_hnd.c will take care */
return true;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(mgmt_inq_princ_name, NDR_OUT | NDR_SET_VALUES, r);
}
push = ndr_push_init_ctx(r);
if (push == NULL) {
talloc_free(r);
return false;
}
/*
* carry over the pointer count to the reply in case we are
* using full pointer. See NDR specification for full pointers
*/
push->ptr_count = pull->ptr_count;
ndr_err = call->ndr_push(push, NDR_OUT, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
p->out_data.rdata = ndr_push_blob(push);
talloc_steal(p->mem_ctx, p->out_data.rdata.data);
talloc_free(r);
return true;
}
/**
\details Build an EntryID for message from folder and message source ID
*/
_PUBLIC_ enum MAPISTATUS EntryIDFromSourceIDForMessage(TALLOC_CTX *mem_ctx,
mapi_object_t *obj_store,
mapi_object_t *obj_folder,
mapi_object_t *obj_message,
struct SBinary_short *entryID)
{
enum MAPISTATUS retval;
struct ndr_push *ndr;
mapi_object_store_t *store;
const struct SBinary_short *FolderSourceKey;
const struct SBinary_short *MessageSourceKey;
struct SPropTagArray *SPropTagArray;
struct SPropValue *lpPropsf;
struct SPropValue *lpPropsm;
uint32_t count;
/* Sanity checks */
OPENCHANGE_RETVAL_IF(!obj_store, MAPI_E_INVALID_PARAMETER, NULL);
OPENCHANGE_RETVAL_IF(!obj_folder, MAPI_E_INVALID_PARAMETER, NULL);
OPENCHANGE_RETVAL_IF(!obj_message, MAPI_E_INVALID_PARAMETER, NULL);
OPENCHANGE_RETVAL_IF(!entryID, MAPI_E_INVALID_PARAMETER, NULL);
store = (mapi_object_store_t *)obj_store->private_data;
/* Step 1. Retrieve folder Source Key */
SPropTagArray = set_SPropTagArray(mem_ctx, 0x1, PidTagSourceKey);
retval = GetProps(obj_folder, 0, SPropTagArray, &lpPropsf, &count);
MAPIFreeBuffer(SPropTagArray);
if (retval != MAPI_E_SUCCESS) return MAPI_E_NOT_FOUND;
FolderSourceKey = (const struct SBinary_short *)get_SPropValue(lpPropsf, PidTagSourceKey);
if (FolderSourceKey == NULL) return MAPI_E_NOT_FOUND;
/* Step 2. Retrieve message Source Key */
SPropTagArray = set_SPropTagArray(mem_ctx, 0x1, PidTagSourceKey);
retval = GetProps(obj_message, 0, SPropTagArray, &lpPropsm, &count);
MAPIFreeBuffer(SPropTagArray);
if (retval != MAPI_E_SUCCESS) return MAPI_E_NOT_FOUND;
MessageSourceKey = (const struct SBinary_short *)get_SPropValue(lpPropsm, PidTagSourceKey);
if (MessageSourceKey == NULL) return MAPI_E_NOT_FOUND;
/* Step 3. Fill PidTagEntryID */
/* PidTagEntryId size for message is 70 bytes */
/* Flags (4 bytes) + store guid (16 bytes) + object type (2
* bytes) + Folder SourceKey (22 bytes) + Pad (2 bytes) +
* Message Source (22 bytes) + Pad (2 bytes) == 70 bytes */
ndr = ndr_push_init_ctx(NULL);
ndr_set_flags(&ndr->flags, LIBNDR_FLAG_NOALIGN);
ndr->offset = 0;
ndr_push_uint32(ndr, NDR_SCALARS, 0x0);
if (store->store_type == PublicFolder) {
const uint8_t ProviderUID[16] = { 0x1A, 0x44, 0x73, 0x90, 0xAA, 0x66, 0x11, 0xCD, 0x9B, 0xC8, 0x00, 0xAA, 0x00, 0x2F, 0xC4, 0x5A };
ndr_push_array_uint8(ndr, NDR_SCALARS, ProviderUID, 16);
ndr_push_uint16(ndr, NDR_SCALARS, 0x0009);
} else {
ndr_push_GUID(ndr, NDR_SCALARS, &store->guid);
ndr_push_uint16(ndr, NDR_SCALARS, 0x0007);
}
ndr_push_array_uint8(ndr, NDR_SCALARS, FolderSourceKey->lpb, FolderSourceKey->cb);
ndr_push_uint16(ndr, NDR_SCALARS, 0x0);
ndr_push_array_uint8(ndr, NDR_SCALARS, MessageSourceKey->lpb, MessageSourceKey->cb);
ndr_push_uint16(ndr, NDR_SCALARS, 0x0);
entryID->cb = ndr->offset;
entryID->lpb = talloc_steal(mem_ctx, ndr->data);
talloc_free(ndr);
return MAPI_E_SUCCESS;
}
/*
this is a paranoid NDR validator. For every packet we push onto the wire
we pull it back again, then push it again. Then we compare the raw NDR data
for that to the NDR we initially generated. If they don't match then we know
we must have a bug in either the pull or push side of our code
*/
static NTSTATUS dcerpc_ndr_validate_in(struct dcerpc_connection *c,
TALLOC_CTX *mem_ctx,
DATA_BLOB blob,
size_t struct_size,
ndr_push_flags_fn_t ndr_push,
ndr_pull_flags_fn_t ndr_pull)
{
void *st;
struct ndr_pull *pull;
struct ndr_push *push;
DATA_BLOB blob2;
enum ndr_err_code ndr_err;
st = talloc_size(mem_ctx, struct_size);
if (!st) {
return NT_STATUS_NO_MEMORY;
}
pull = ndr_pull_init_flags(c, &blob, mem_ctx);
if (!pull) {
return NT_STATUS_NO_MEMORY;
}
pull->flags |= LIBNDR_FLAG_REF_ALLOC;
ndr_err = ndr_pull(pull, NDR_IN, st);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
"failed input validation pull - %s",
nt_errstr(status));
return ndr_map_error2ntstatus(ndr_err);
}
push = ndr_push_init_ctx(mem_ctx, c->iconv_convenience);
if (!push) {
return NT_STATUS_NO_MEMORY;
}
ndr_err = ndr_push(push, NDR_IN, st);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
NTSTATUS status = ndr_map_error2ntstatus(ndr_err);
ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
"failed input validation push - %s",
nt_errstr(status));
return ndr_map_error2ntstatus(ndr_err);
}
blob2 = ndr_push_blob(push);
if (data_blob_cmp(&blob, &blob2) != 0) {
DEBUG(3,("original:\n"));
dump_data(3, blob.data, blob.length);
DEBUG(3,("secondary:\n"));
dump_data(3, blob2.data, blob2.length);
ndr_err = ndr_pull_error(pull, NDR_ERR_VALIDATE,
"failed input validation blobs doesn't match");
return ndr_map_error2ntstatus(ndr_err);
}
return NT_STATUS_OK;
}
static bool api_frstrans_RequestUpdates(struct pipes_struct *p)
{
const struct ndr_interface_call *call;
struct ndr_pull *pull;
struct ndr_push *push;
enum ndr_err_code ndr_err;
struct frstrans_RequestUpdates *r;
call = &ndr_table_frstrans.calls[NDR_FRSTRANS_REQUESTUPDATES];
r = talloc(talloc_tos(), struct frstrans_RequestUpdates);
if (r == NULL) {
return false;
}
pull = ndr_pull_init_blob(&p->in_data.data, r);
if (pull == NULL) {
talloc_free(r);
return false;
}
pull->flags |= LIBNDR_FLAG_REF_ALLOC;
if (p->endian) {
pull->flags |= LIBNDR_FLAG_BIGENDIAN;
}
ndr_err = call->ndr_pull(pull, NDR_IN, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(frstrans_RequestUpdates, NDR_IN, r);
}
ZERO_STRUCT(r->out);
r->out.frs_update = talloc_zero_array(r, struct frstrans_Update, r->in.credits_available);
if (r->out.frs_update == NULL) {
talloc_free(r);
return false;
}
r->out.update_count = talloc_zero(r, uint32_t);
if (r->out.update_count == NULL) {
talloc_free(r);
return false;
}
r->out.update_status = talloc_zero(r, enum frstrans_UpdateStatus);
if (r->out.update_status == NULL) {
talloc_free(r);
return false;
}
r->out.gvsn_db_guid = talloc_zero(r, struct GUID);
if (r->out.gvsn_db_guid == NULL) {
talloc_free(r);
return false;
}
r->out.gvsn_version = talloc_zero(r, uint64_t);
if (r->out.gvsn_version == NULL) {
talloc_free(r);
return false;
}
r->out.result = _frstrans_RequestUpdates(p, r);
if (p->fault_state) {
talloc_free(r);
/* Return true here, srv_pipe_hnd.c will take care */
return true;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(frstrans_RequestUpdates, NDR_OUT | NDR_SET_VALUES, r);
}
push = ndr_push_init_ctx(r);
if (push == NULL) {
talloc_free(r);
return false;
}
/*
* carry over the pointer count to the reply in case we are
* using full pointer. See NDR specification for full pointers
*/
push->ptr_count = pull->ptr_count;
ndr_err = call->ndr_push(push, NDR_OUT, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
p->out_data.rdata = ndr_push_blob(push);
talloc_steal(p->mem_ctx, p->out_data.rdata.data);
talloc_free(r);
return true;
}
/**
send a rpc request given a dcerpc_call structure
*/
struct rpc_request *dcerpc_ndr_request_send(struct dcerpc_pipe *p,
const struct GUID *object,
const struct ndr_interface_table *table,
uint32_t opnum,
bool async,
TALLOC_CTX *mem_ctx,
void *r)
{
const struct ndr_interface_call *call;
struct ndr_push *push;
NTSTATUS status;
DATA_BLOB request;
struct rpc_request *req;
enum ndr_err_code ndr_err;
call = &table->calls[opnum];
/* setup for a ndr_push_* call */
push = ndr_push_init_ctx(mem_ctx, p->conn->iconv_convenience);
if (!push) {
return NULL;
}
if (p->conn->flags & DCERPC_PUSH_BIGENDIAN) {
push->flags |= LIBNDR_FLAG_BIGENDIAN;
}
if (p->conn->flags & DCERPC_NDR64) {
push->flags |= LIBNDR_FLAG_NDR64;
}
/* push the structure into a blob */
ndr_err = call->ndr_push(push, NDR_IN, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
status = ndr_map_error2ntstatus(ndr_err);
DEBUG(2,("Unable to ndr_push structure in dcerpc_ndr_request_send - %s\n",
nt_errstr(status)));
talloc_free(push);
return NULL;
}
/* retrieve the blob */
request = ndr_push_blob(push);
if (p->conn->flags & DCERPC_DEBUG_VALIDATE_IN) {
status = dcerpc_ndr_validate_in(p->conn, push, request, call->struct_size,
call->ndr_push, call->ndr_pull);
if (!NT_STATUS_IS_OK(status)) {
DEBUG(2,("Validation failed in dcerpc_ndr_request_send - %s\n",
nt_errstr(status)));
talloc_free(push);
return NULL;
}
}
DEBUG(10,("rpc request data:\n"));
dump_data(10, request.data, request.length);
/* make the actual dcerpc request */
req = dcerpc_request_send(p, object, opnum, async, &request);
if (req != NULL) {
req->ndr.table = table;
req->ndr.opnum = opnum;
req->ndr.struct_ptr = r;
req->ndr.mem_ctx = mem_ctx;
}
talloc_free(push);
return req;
}
static bool api_frstrans_EstablishConnection(struct pipes_struct *p)
{
const struct ndr_interface_call *call;
struct ndr_pull *pull;
struct ndr_push *push;
enum ndr_err_code ndr_err;
struct frstrans_EstablishConnection *r;
call = &ndr_table_frstrans.calls[NDR_FRSTRANS_ESTABLISHCONNECTION];
r = talloc(talloc_tos(), struct frstrans_EstablishConnection);
if (r == NULL) {
return false;
}
pull = ndr_pull_init_blob(&p->in_data.data, r);
if (pull == NULL) {
talloc_free(r);
return false;
}
pull->flags |= LIBNDR_FLAG_REF_ALLOC;
if (p->endian) {
pull->flags |= LIBNDR_FLAG_BIGENDIAN;
}
ndr_err = call->ndr_pull(pull, NDR_IN, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(frstrans_EstablishConnection, NDR_IN, r);
}
ZERO_STRUCT(r->out);
r->out.upstream_protocol_version = talloc_zero(r, enum frstrans_ProtocolVersion);
if (r->out.upstream_protocol_version == NULL) {
talloc_free(r);
return false;
}
r->out.upstream_flags = talloc_zero(r, uint32_t);
if (r->out.upstream_flags == NULL) {
talloc_free(r);
return false;
}
r->out.result = _frstrans_EstablishConnection(p, r);
if (p->fault_state) {
talloc_free(r);
/* Return true here, srv_pipe_hnd.c will take care */
return true;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(frstrans_EstablishConnection, NDR_OUT | NDR_SET_VALUES, r);
}
push = ndr_push_init_ctx(r);
if (push == NULL) {
talloc_free(r);
return false;
}
/*
* carry over the pointer count to the reply in case we are
* using full pointer. See NDR specification for full pointers
*/
push->ptr_count = pull->ptr_count;
ndr_err = call->ndr_push(push, NDR_OUT, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
p->out_data.rdata = ndr_push_blob(push);
talloc_steal(p->mem_ctx, p->out_data.rdata.data);
talloc_free(r);
return true;
}
static bool api_decode_pac(struct pipes_struct *p)
{
const struct ndr_interface_call *call;
struct ndr_pull *pull;
struct ndr_push *push;
enum ndr_err_code ndr_err;
struct decode_pac *r;
call = &ndr_table_krb5pac.calls[NDR_DECODE_PAC];
r = talloc(talloc_tos(), struct decode_pac);
if (r == NULL) {
return false;
}
pull = ndr_pull_init_blob(&p->in_data.data, r);
if (pull == NULL) {
talloc_free(r);
return false;
}
pull->flags |= LIBNDR_FLAG_REF_ALLOC;
if (p->endian) {
pull->flags |= LIBNDR_FLAG_BIGENDIAN;
}
ndr_err = call->ndr_pull(pull, NDR_IN, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(decode_pac, NDR_IN, r);
}
_decode_pac(p, r);
if (p->fault_state) {
talloc_free(r);
/* Return true here, srv_pipe_hnd.c will take care */
return true;
}
if (DEBUGLEVEL >= 10) {
NDR_PRINT_FUNCTION_DEBUG(decode_pac, NDR_OUT | NDR_SET_VALUES, r);
}
push = ndr_push_init_ctx(r);
if (push == NULL) {
talloc_free(r);
return false;
}
/*
* carry over the pointer count to the reply in case we are
* using full pointer. See NDR specification for full pointers
*/
push->ptr_count = pull->ptr_count;
ndr_err = call->ndr_push(push, NDR_OUT, r);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
talloc_free(r);
return false;
}
p->out_data.rdata = ndr_push_blob(push);
talloc_steal(p->mem_ctx, p->out_data.rdata.data);
talloc_free(r);
return true;
}
/*
push a signed or sealed dcerpc request packet into a blob
*/
bool dcesrv_auth_response(struct dcesrv_call_state *call,
DATA_BLOB *blob, size_t sig_size,
struct ncacn_packet *pkt)
{
struct dcesrv_connection *dce_conn = call->conn;
NTSTATUS status;
enum ndr_err_code ndr_err;
struct ndr_push *ndr;
uint32_t payload_length;
DATA_BLOB creds2;
/* non-signed packets are simple */
if (sig_size == 0) {
status = ncacn_push_auth(blob, call, pkt, NULL);
return NT_STATUS_IS_OK(status);
}
switch (dce_conn->auth_state.auth_info->auth_level) {
case DCERPC_AUTH_LEVEL_PRIVACY:
case DCERPC_AUTH_LEVEL_INTEGRITY:
break;
case DCERPC_AUTH_LEVEL_CONNECT:
/*
* TODO: let the gensec mech decide if it wants to generate a
* signature that might be needed for schannel...
*/
status = ncacn_push_auth(blob, call, pkt, NULL);
return NT_STATUS_IS_OK(status);
case DCERPC_AUTH_LEVEL_NONE:
status = ncacn_push_auth(blob, call, pkt, NULL);
return NT_STATUS_IS_OK(status);
default:
return false;
}
ndr = ndr_push_init_ctx(call);
if (!ndr) {
return false;
}
if (!(pkt->drep[0] & DCERPC_DREP_LE)) {
ndr->flags |= LIBNDR_FLAG_BIGENDIAN;
}
ndr_err = ndr_push_ncacn_packet(ndr, NDR_SCALARS|NDR_BUFFERS, pkt);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return false;
}
/* pad to 16 byte multiple in the payload portion of the
packet. This matches what w2k3 does. Note that we can't use
ndr_push_align() as that is relative to the start of the
whole packet, whereas w2k8 wants it relative to the start
of the stub */
dce_conn->auth_state.auth_info->auth_pad_length =
(16 - (pkt->u.response.stub_and_verifier.length & 15)) & 15;
ndr_err = ndr_push_zero(ndr,
dce_conn->auth_state.auth_info->auth_pad_length);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return false;
}
payload_length = pkt->u.response.stub_and_verifier.length +
dce_conn->auth_state.auth_info->auth_pad_length;
/* we start without signature, it will appended later */
dce_conn->auth_state.auth_info->credentials = data_blob(NULL, 0);
/* add the auth verifier */
ndr_err = ndr_push_dcerpc_auth(ndr, NDR_SCALARS|NDR_BUFFERS,
dce_conn->auth_state.auth_info);
if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
return false;
}
/* extract the whole packet as a blob */
*blob = ndr_push_blob(ndr);
/*
* Setup the frag and auth length in the packet buffer.
* This is needed if the GENSEC mech does AEAD signing
* of the packet headers. The signature itself will be
* appended later.
*/
dcerpc_set_frag_length(blob, blob->length + sig_size);
dcerpc_set_auth_length(blob, sig_size);
/* sign or seal the packet */
switch (dce_conn->auth_state.auth_info->auth_level) {
case DCERPC_AUTH_LEVEL_PRIVACY:
status = gensec_seal_packet(dce_conn->auth_state.gensec_security,
call,
ndr->data + DCERPC_REQUEST_LENGTH,
payload_length,
blob->data,
blob->length,
&creds2);
break;
case DCERPC_AUTH_LEVEL_INTEGRITY:
status = gensec_sign_packet(dce_conn->auth_state.gensec_security,
call,
ndr->data + DCERPC_REQUEST_LENGTH,
payload_length,
blob->data,
blob->length,
&creds2);
break;
default:
status = NT_STATUS_INVALID_LEVEL;
break;
}
if (!NT_STATUS_IS_OK(status)) {
return false;
}
if (creds2.length != sig_size) {
DEBUG(3,("dcesrv_auth_response: creds2.length[%u] != sig_size[%u] pad[%u] stub[%u]\n",
(unsigned)creds2.length, (uint32_t)sig_size,
(unsigned)dce_conn->auth_state.auth_info->auth_pad_length,
(unsigned)pkt->u.response.stub_and_verifier.length));
dcerpc_set_frag_length(blob, blob->length + creds2.length);
dcerpc_set_auth_length(blob, creds2.length);
}
if (!data_blob_append(call, blob, creds2.data, creds2.length)) {
status = NT_STATUS_NO_MEMORY;
return false;
}
data_blob_free(&creds2);
return true;
}
