static int rpc_netshareenum(struct smb_ctx *ctx, int *entriesp, int *totalp, struct share_info **entries_listp) { char ctx_string[2+16+1]; /* enough for 64-bit pointer, in hex */ unsigned_char_p_t binding; unsigned32 binding_status; rpc_binding_handle_t binding_h; int error, i, entries; char *addrstr, *srvnamestr; unsigned short *usrvnamestr; unsigned32 level; SHARE_ENUM_STRUCT share_info; SHARE_INFO_1_CONTAINER share_info_1_container; SHARE_INFO_1 *shares, *share; unsigned32 total_entries; unsigned32 status, free_status; struct share_info *entry_list, *elp; static EXCEPTION rpc_x_connect_rejected; static int exceptions_initialized; sprintf(ctx_string, "%p", ctx); rpc_string_binding_compose(NULL, "ncacn_np", ctx_string, "srvsvc", NULL, &binding, &binding_status); if (binding_status != rpc_s_ok) { smb_error(dgettext(TEXT_DOMAIN, "rpc_string_binding_compose failed with %d"), 0, binding_status); return (EINVAL); } rpc_binding_from_string_binding(binding, &binding_h, &status); rpc_string_free(&binding, (unsigned32 *)&free_status); if (binding_status != rpc_s_ok) { smb_error(dgettext(TEXT_DOMAIN, "rpc_binding_from_string_binding failed with %d"), 0, binding_status); return (EINVAL); } level = 1; share_info.share_union.level = 1; share_info.share_union.tagged_union.share1 = &share_info_1_container; share_info_1_container.share_count = 0; share_info_1_container.shares = NULL; /* * Convert the server IP address to a string, and send that as * the "server name" - that's what Windows appears to do, and * that avoids problems with NetBIOS names containing * non-ASCII characters. */ addrstr = inet_ntoa(ctx->ct_srvinaddr.sin_addr); srvnamestr = malloc(strlen(addrstr) + 3); if (srvnamestr == NULL) { status = errno; smb_error(dgettext(TEXT_DOMAIN, "can't allocate string for server address"), status); rpc_binding_free(&binding_h, &free_status); return (status); } strcpy(srvnamestr, "\\\\"); strcat(srvnamestr, addrstr); usrvnamestr = convert_utf8_to_leunicode(srvnamestr); if (usrvnamestr == NULL) { smb_error(dgettext(TEXT_DOMAIN, "can't convert string for server address to Unicode"), 0); rpc_binding_free(&binding_h, &free_status); free(srvnamestr); return (EINVAL); } if (!exceptions_initialized) { EXCEPTION_INIT(rpc_x_connect_rejected); exc_set_status(&rpc_x_connect_rejected, rpc_s_connect_rejected); exceptions_initialized = 1; } /* printf("Calling NetrShareEnum.."); XXX */ TRY status = NetrShareEnum(binding_h, usrvnamestr, &level, &share_info, 4294967295U, &total_entries, NULL); if (status != 0) smb_error(dgettext(TEXT_DOMAIN, "error from NetrShareEnum call: status = 0x%08x"), 0, status); /*CSTYLED*/ CATCH (rpc_x_connect_rejected) /* * This is what we get if we can't open the pipe. * That's a normal occurrence when we're talking * to a system that (presumably) doesn't support * DCE RPC on the server side, such as Windows 95/98/Me, * so we don't log an error. */ /*CSTYLED*/ status = ENOTSUP; CATCH_ALL /* * XXX - should we handle some exceptions differently, * returning different errors, and try RAP only for * ENOTSUP? */ smb_error(dgettext(TEXT_DOMAIN, "error from NetrShareEnum call: exception = %u"), 0, THIS_CATCH->match.value); status = ENOTSUP; ENDTRY rpc_binding_free(&binding_h, &free_status); free(srvnamestr); free(usrvnamestr); if (status != 0) return (ENOTSUP); /* * XXX - if the IDL is correct, it's not clear whether the * unmarshalling code will properly handle the case where * a packet where "share_count" and the max count for the * array of shares don't match; a valid DCE RPC implementation * won't marshal something like that, but there's no guarantee * that the server we're talking to has a valid implementation * (which could be a *malicious* implementation!). */ entries = share_info.share_union.tagged_union.share1->share_count; shares = share_info.share_union.tagged_union.share1->shares; entry_list = calloc(entries, sizeof (struct share_info)); if (entry_list == NULL) { error = errno; goto cleanup_and_return; } for (share = shares, elp = entry_list, i = 0; i < entries; i++, share++) { elp->type = share->shi1_type; elp->netname = convert_unicode_to_utf8(share->shi1_share); if (elp->netname == NULL) goto fail; elp->remark = convert_unicode_to_utf8(share->shi1_remark); if (elp->remark == NULL) goto fail; elp++; } *entriesp = entries; *totalp = total_entries; *entries_listp = entry_list; error = 0; goto cleanup_and_return; fail: error = errno; for (elp = entry_list, i = 0; i < entries; i++, elp++) { /* * elp->netname is set before elp->remark, so if * elp->netname is null, elp->remark is also null. * If either of them is null, we haven't done anything * to any entries after this one. */ if (elp->netname == NULL) break; free(elp->netname); if (elp->remark == NULL) break; free(elp->remark); } free(entry_list); cleanup_and_return: for (share = shares, i = 0; i < entries; i++, share++) { free(share->shi1_share); free(share->shi1_remark); } free(shares); /* * XXX - "share1" should be a unique pointer, but we haven't * changed the marshalling code to support non-full pointers * in unions, so we leave it as a full pointer. * * That means that this might, or might not, be changed from * pointing to "share_info_1_container" to pointing to a * mallocated structure, according to the DCE RPC 1.1 IDL spec; * we free it only if it's changed. */ if (share_info.share_union.tagged_union.share1 != &share_info_1_container) free(share_info.share_union.tagged_union.share1); return (error); }
// Return an appropriate binding for the given ServerName. rpc_binding make_rpc_binding( const char * ServerName, const char * EndPoint) { char * binding_string = NULL; char * endpoint_string = NULL; uint32_t status; if (!EndPoint) { return rpc_binding(); } if (ServerName) { /* add in the "\pipe\" to the endpoint */ asprintf(&endpoint_string, "\\pipe\\%s]", EndPoint); rpc_string_binding_compose(NULL, (idl_char *) "ncacn_np", (idl_char *) ServerName, (idl_char *) endpoint_string, NULL, (idl_char **) &binding_string, &status); if (status != 0) { SMBLogInfo("rpc_string_binding_compose failed on <%s>:<%s> status %#08x", ASL_LEVEL_ERR, ServerName == NULL ? "nullstr" : ServerName, EndPoint == NULL ? "nullstr" : EndPoint, status); /* fallback to the old way instead */ asprintf(&binding_string, "ncacn_np:%s[%s]", ServerName, endpoint_string); } if (endpoint_string != NULL) { free(endpoint_string); } } else { rpc_string_binding_compose(NULL, (idl_char *) "ncalrpc", NULL, (idl_char *) EndPoint, NULL, (idl_char **) &binding_string, &status); if (status != 0) { SMBLogInfo("rpc_string_binding_compose failed on <%s> status %#08x", ASL_LEVEL_ERR, EndPoint == NULL ? "nullstr" : EndPoint, status); /* fallback to the old way instead */ asprintf(&binding_string, "ncalrpc:[%s]", EndPoint); } } if (!binding_string) { platform::invoke_new_handler(); } rpc_binding binding(binding_string); if (status == 0) { /* rpc_string_binding_compose worked */ if (binding_string != NULL) { rpc_string_free((idl_char **) &binding_string, &status); if (status != 0) { SMBLogInfo("rpc_string_free failed on <%s> status %#08x", ASL_LEVEL_ERR, binding_string == NULL ? "nullstr" : binding_string, status); } } } else { /* must have used asprintf */ if (binding_string != NULL) { free(binding_string); } } return binding; }
static NTSTATUS LsaInitBindingFullA( OUT PLSA_BINDING phBinding, IN PCSTR pszProtSeq, IN PCSTR pszHostname, IN PCSTR pszEndpoint, IN PCSTR pszUuid, IN PCSTR pszOptions, IN PIO_CREDS pCreds ) { NTSTATUS ntStatus = STATUS_SUCCESS; unsigned32 rpcStatus = RPC_S_OK; unsigned32 rpcStatus2 = RPC_S_OK; PBYTE pbBindingString = NULL; PBYTE pbProtSeq = NULL; PBYTE pbEndpoint = NULL; PBYTE pbUuid = NULL; PBYTE pbOpts = NULL; PBYTE pbAddr = NULL; handle_t hBinding = NULL; rpc_transport_info_handle_t hInfo = NULL; BAIL_ON_INVALID_PTR(phBinding, ntStatus); BAIL_ON_INVALID_PTR(pszProtSeq, ntStatus); pbProtSeq = (PBYTE)strdup(pszProtSeq); BAIL_ON_NULL_PTR(pbProtSeq, ntStatus); if (pszEndpoint != NULL) { pbEndpoint = (PBYTE) strdup(pszEndpoint); BAIL_ON_NULL_PTR(pbEndpoint, ntStatus); } if (pszUuid != NULL) { pbUuid = (PBYTE)strdup(pszUuid); BAIL_ON_NULL_PTR(pbUuid, ntStatus); } if (pszOptions != NULL) { pbOpts = (PBYTE)strdup(pszOptions); BAIL_ON_NULL_PTR(pbOpts, ntStatus); } if (pszHostname) { pbAddr = (PBYTE)strdup(pszHostname); BAIL_ON_NULL_PTR(pbAddr, ntStatus); } rpc_string_binding_compose( pbUuid, pbProtSeq, pbAddr, pbEndpoint, pbOpts, &pbBindingString, &rpcStatus); BAIL_ON_RPC_STATUS(rpcStatus); rpc_binding_from_string_binding( pbBindingString, &hBinding, &rpcStatus); BAIL_ON_RPC_STATUS(rpcStatus); if (strcmp(pszProtSeq, "ncacn_np") == 0) { rpc_smb_transport_info_from_lwio_creds( pCreds, &hInfo, &rpcStatus); BAIL_ON_RPC_STATUS(rpcStatus); rpc_binding_set_transport_info( hBinding, hInfo, &rpcStatus); BAIL_ON_RPC_STATUS(rpcStatus); hInfo = NULL; } rpc_mgmt_set_com_timeout(hBinding, 6, &rpcStatus); BAIL_ON_RPC_STATUS(rpcStatus); *phBinding = (LSA_BINDING)hBinding; cleanup: LW_SAFE_FREE_MEMORY(pbProtSeq); LW_SAFE_FREE_MEMORY(pbEndpoint); LW_SAFE_FREE_MEMORY(pbUuid); LW_SAFE_FREE_MEMORY(pbOpts); LW_SAFE_FREE_MEMORY(pbAddr); if (pbBindingString) { rpc_string_free(&pbBindingString, &rpcStatus2); } if ((rpcStatus == RPC_S_OK) && (rpcStatus2 != RPC_S_OK)) { rpcStatus = rpcStatus2; } if (hInfo) { rpc_smb_transport_info_free(hInfo); } if (ntStatus == STATUS_SUCCESS && rpcStatus != RPC_S_OK) { ntStatus = LwRpcStatusToNtStatus(rpcStatus); } return ntStatus; error: if (hBinding) { rpc_binding_free(&hBinding, &rpcStatus2); } if (phBinding) { *phBinding = NULL; } goto cleanup; }