summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
authorLuke Leighton <lkcl@samba.org>1997-10-27 15:09:23 +0000
committerLuke Leighton <lkcl@samba.org>1997-10-27 15:09:23 +0000
commit8586dda29b79f041cac2879ecff0afa3283dfca1 (patch)
treefc937d1c8f7a6fa4b1d4fdf127e51560a3ae7ec5
parent71d648cdb431ecf984196a7e480208a94fcdf390 (diff)
downloadsamba-8586dda29b79f041cac2879ecff0afa3283dfca1.tar.gz
samba-8586dda29b79f041cac2879ecff0afa3283dfca1.tar.bz2
samba-8586dda29b79f041cac2879ecff0afa3283dfca1.zip
added LSA Open Policy query and response processing to smbclient
(This used to be commit 16cc27852bf54999db4b0a3665b0743d9fe0e74a)
-rw-r--r--source3/client/ntclient.c129
-rw-r--r--source3/include/proto.h6
-rw-r--r--source3/include/smb.h22
-rw-r--r--source3/lsaparse.c35
-rw-r--r--source3/pipentlsa.c43
-rw-r--r--source3/smbparse.c52
6 files changed, 286 insertions, 1 deletions
diff --git a/source3/client/ntclient.c b/source3/client/ntclient.c
index 93793cfccb..dab8bb1902 100644
--- a/source3/client/ntclient.c
+++ b/source3/client/ntclient.c
@@ -85,6 +85,102 @@ static uint16 open_rpc_pipe(char *inbuf, char *outbuf, char *rname, int Client,
}
/****************************************************************************
+do a LSA Open Policy
+****************************************************************************/
+static BOOL do_lsa_open_policy(uint16 fnum, char *server_name, LSA_POL_HND *hnd)
+{
+ char *rparam = NULL;
+ char *rdata = NULL;
+ char *p;
+ int rdrcnt,rprcnt;
+ pstring data; /* only 1024 bytes */
+ uint16 setup[2]; /* only need 2 uint16 setup parameters */
+ LSA_Q_OPEN_POL q_o;
+ int call_id = 0x1;
+ BOOL valid_pol = False;
+
+ if (hnd == NULL) return False;
+
+ /* create and send a MSRPC command with api LSA_OPENPOLICY */
+
+ DEBUG(4,("LSA Open Policy\n"));
+
+ /* store the parameters */
+ make_q_open_pol(&q_o, server_name, 0, 0, 0x1);
+
+ /* turn parameters into data stream */
+ p = lsa_io_q_open_pol(False, &q_o, data + 0x18, data, 4, 0);
+
+ /* create the request RPC_HDR with no data */
+ create_rpc_request(call_id, LSA_OPENPOLICY, data, PTR_DIFF(p, data));
+
+ /* create setup parameters. */
+ SIVAL(setup, 0, 0x0026); /* 0x26 indicates "transact named pipe" */
+ SIVAL(setup, 2, fnum); /* file handle, from the SMBcreateX pipe, earlier */
+
+ /* send the data on \PIPE\ */
+ if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024,
+ BUFFER_SIZE,
+ &rprcnt, &rdrcnt,
+ NULL, data, setup,
+ &rparam, &rdata))
+ {
+ LSA_R_OPEN_POL r_o;
+ RPC_HDR hdr;
+ int hdr_len;
+ int pkt_len;
+
+ DEBUG(5, ("cli_call_api: return OK\n"));
+
+ p = rdata;
+
+ if (p) p = smb_io_rpc_hdr (True, &hdr, p, rdata, 4, 0);
+ if (p) p = align_offset(p, rdata, 4); /* oh, what a surprise */
+
+ hdr_len = PTR_DIFF(p, rdata);
+
+ if (p && hdr_len != hdr.frag_len - hdr.alloc_hint)
+ {
+ /* header length not same as calculated header length */
+ DEBUG(2,("do_lsa_open_policy: hdr_len %x != frag_len-alloc_hint\n",
+ hdr_len, hdr.frag_len - hdr.alloc_hint));
+ p = NULL;
+ }
+
+ if (p) p = lsa_io_r_open_pol(True, &r_o, p, rdata, 4, 0);
+
+ pkt_len = PTR_DIFF(p, rdata);
+
+ if (p && pkt_len != hdr.frag_len)
+ {
+ /* packet data size not same as reported fragment length */
+ DEBUG(2,("do_lsa_open_policy: pkt_len %x != frag_len \n",
+ pkt_len, hdr.frag_len));
+ p = NULL;
+ }
+
+ if (p && r_o.status != 0)
+ {
+ /* report error code */
+ DEBUG(0,("LSA_REQ_CHAL: nt_status error %lx\n", r_o.status));
+ p = NULL;
+ }
+
+ if (p)
+ {
+ /* ok, at last: we're happy. return the policy handle */
+ memcpy(hnd, r_o.pol.data, sizeof(hnd->data));
+ valid_pol = True;
+ }
+ }
+
+ if (rparam) free(rparam);
+ if (rdata) free(rdata);
+
+ return valid_pol;
+}
+
+/****************************************************************************
do a LSA Request Challenge
****************************************************************************/
static BOOL do_lsa_req_chal(uint16 fnum,
@@ -554,6 +650,7 @@ BOOL do_nt_login(char *desthost, char *myhostname,
DOM_ID_INFO_1 id1;
LSA_USER_INFO user_info1;
+ LSA_POL_HND pol;
UTIME zerotime;
@@ -561,6 +658,7 @@ BOOL do_nt_login(char *desthost, char *myhostname,
char nt_owf_mach_pwd[16];
fstring mach_acct;
fstring mach_pwd;
+ fstring server_name;
uint16 fnum;
char *inbuf,*outbuf;
@@ -576,6 +674,33 @@ BOOL do_nt_login(char *desthost, char *myhostname,
return False;
}
+ /******************* open the \PIPE\lsarpc file *****************/
+
+ if ((fnum = open_rpc_pipe(inbuf, outbuf, PIPE_LSARPC, Client, cnum)) == 0xffff)
+ {
+ free(inbuf); free(outbuf);
+ return False;
+ }
+
+ /******************* Open Policy ********************/
+
+ fstrcpy(server_name, ("\\\\"));
+ fstrcpy(&server_name[2], myhostname);
+
+ /* send an open policy request; receive a policy handle */
+ if (!do_lsa_open_policy(fnum, server_name, &pol))
+ {
+ cli_smb_close(inbuf, outbuf, Client, cnum, fnum);
+ free(inbuf); free(outbuf);
+ return False;
+ }
+
+ /******************* close the \PIPE\lsarpc file *******************/
+
+ cli_smb_close(inbuf, outbuf, Client, cnum, fnum);
+
+
+
/******************* open the \PIPE\NETLOGON file *****************/
if ((fnum = open_rpc_pipe(inbuf, outbuf, PIPE_NETLOGON, Client, cnum)) == 0xffff)
@@ -696,7 +821,11 @@ BOOL do_nt_login(char *desthost, char *myhostname,
return False;
}
+ /******************** close the \PIPE\NETLOGON file **************/
+
cli_smb_close(inbuf, outbuf, Client, cnum, fnum);
+
+ /* free memory used in all rpc transactions, above */
free(inbuf); free(outbuf);
return True;
diff --git a/source3/include/proto.h b/source3/include/proto.h
index cdecd1ec88..6bb91e8c1f 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -373,6 +373,10 @@ struct share_ops *locking_slow_init(int ronly);
/*The following definitions come from lsaparse.c */
+void make_q_open_pol(LSA_Q_OPEN_POL *r_q, char *server_name,
+ uint32 attributes, uint32 sec_qos,
+ uint16 desired_access);
+char* lsa_io_q_open_pol(BOOL io, LSA_Q_OPEN_POL *r_q, char *q, char *base, int align, int depth);
char* lsa_io_r_open_pol(BOOL io, LSA_R_OPEN_POL *r_p, char *q, char *base, int align, int depth);
char* lsa_io_q_query(BOOL io, LSA_Q_QUERY_INFO *q_q, char *q, char *base, int align, int depth);
char* lsa_io_r_query(BOOL io, LSA_R_QUERY_INFO *r_q, char *q, char *base, int align, int depth);
@@ -944,6 +948,8 @@ char* smb_io_gid(BOOL io, DOM_GID *gid, char *q, char *base, int align, int dept
void make_rpc_header(RPC_HDR *hdr, enum RPC_PKT_TYPE pkt_type,
uint32 call_id, int data_len, uint8 opnum);
char* smb_io_rpc_hdr(BOOL io, RPC_HDR *rpc, char *q, char *base, int align, int depth);
+void make_obj_attr(LSA_OBJ_ATTR *attr, uint32 attributes, uint32 sec_qos);
+char* smb_io_obj_attr(BOOL io, LSA_OBJ_ATTR *attr, char *q, char *base, int align, int depth);
char* smb_io_pol_hnd(BOOL io, LSA_POL_HND *pol, char *q, char *base, int align, int depth);
char* smb_io_dom_query_3(BOOL io, DOM_QUERY_3 *d_q, char *q, char *base, int align, int depth);
char* smb_io_dom_query_5(BOOL io, DOM_QUERY_3 *d_q, char *q, char *base, int align, int depth);
diff --git a/source3/include/smb.h b/source3/include/smb.h
index 7019d41de0..e9734f379d 100644
--- a/source3/include/smb.h
+++ b/source3/include/smb.h
@@ -265,6 +265,7 @@ typedef fstring string;
#define PIPE_SRVSVC "\\PIPE\\srvsvc"
#define PIPE_NETLOGON "\\PIPE\\NETLOGON"
#define PIPE_NTLSA "\\PIPE\\ntlsa"
+#define PIPE_LSARPC "\\PIPE\\lsarpc"
/* NETLOGON opcodes and data structures */
@@ -579,6 +580,27 @@ typedef struct lsa_policy_info
} LSA_POL_HND;
+/* OBJ_ATTR (object attributes) */
+typedef struct object_attributes_info
+{
+ uint32 len; /* 0x18 - length (in bytes) inc. the length field. */
+ uint32 ptr_root_dir; /* 0 - root directory (pointer) */
+ uint32 ptr_obj_name; /* 0 - object name (pointer) */
+ uint32 attributes; /* 0 - attributes (undocumented) */
+ uint32 ptr_sec_desc; /* 0 - security descriptior (pointer) */
+ uint32 sec_qos; /* 0 - security quality of service */
+
+} LSA_OBJ_ATTR;
+
+/* LSA_Q_OPEN_POL - LSA Query Open Policy */
+typedef struct lsa_q_open_pol_info
+{
+ UNISTR2 uni_server_name; /* server name, starting with two '\'s */
+ LSA_OBJ_ATTR attr ; /* object attributes */
+
+ uint32 des_access; /* desired access attributes */
+
+} LSA_Q_OPEN_POL;
/* LSA_R_OPEN_POL - response to LSA Open Policy */
typedef struct lsa_r_open_pol_info
diff --git a/source3/lsaparse.c b/source3/lsaparse.c
index 33813ce7af..37cc51bbf8 100644
--- a/source3/lsaparse.c
+++ b/source3/lsaparse.c
@@ -25,6 +25,41 @@ extern int DEBUGLEVEL;
/*******************************************************************
+makes an LSA_Q_OPEN_POL structure.
+********************************************************************/
+void make_q_open_pol(LSA_Q_OPEN_POL *r_q, char *server_name,
+ uint32 attributes, uint32 sec_qos,
+ uint16 desired_access)
+{
+ if (r_q == NULL) return;
+
+ DEBUG(5,("make_open_pol\n"));
+
+ make_unistr2 (&(r_q->uni_server_name), server_name, strlen(server_name));
+ make_obj_attr(&(r_q->attr ), attributes, sec_qos);
+
+ r_q->des_access = desired_access;
+}
+
+/*******************************************************************
+reads or writes an LSA_Q_OPEN_POL structure.
+********************************************************************/
+char* lsa_io_q_open_pol(BOOL io, LSA_Q_OPEN_POL *r_q, char *q, char *base, int align, int depth)
+{
+ if (r_q == NULL) return NULL;
+
+ DEBUG(5,("%s%04x lsa_io_q_open_pol\n", tab_depth(depth), PTR_DIFF(q, base)));
+ depth++;
+
+ q = smb_io_unistr2 (io, &(r_q->uni_server_name), q, base, align, depth);
+ q = smb_io_obj_attr(io, &(r_q->attr ), q, base, align, depth);
+
+ DBG_RW_SVAL("des_access", depth, base, io, q, r_q->des_access); q += 2;
+
+ return q;
+}
+
+/*******************************************************************
reads or writes an LSA_R_OPEN_POL structure.
********************************************************************/
char* lsa_io_r_open_pol(BOOL io, LSA_R_OPEN_POL *r_p, char *q, char *base, int align, int depth)
diff --git a/source3/pipentlsa.c b/source3/pipentlsa.c
index 05c6194263..4fc61f8e5b 100644
--- a/source3/pipentlsa.c
+++ b/source3/pipentlsa.c
@@ -34,6 +34,9 @@ extern int DEBUGLEVEL;
#ifdef NTDOMAIN
+/***************************************************************************
+lsa_reply_open_policy
+ ***************************************************************************/
static int lsa_reply_open_policy(char *q, char *base)
{
int i;
@@ -54,6 +57,9 @@ static int lsa_reply_open_policy(char *q, char *base)
return PTR_DIFF(q, base);
}
+/***************************************************************************
+make_dom_query
+ ***************************************************************************/
static void make_dom_query(DOM_QUERY *d_q, char *dom_name, char *dom_sid)
{
int domlen = strlen(dom_name);
@@ -70,6 +76,9 @@ static void make_dom_query(DOM_QUERY *d_q, char *dom_name, char *dom_sid)
make_dom_sid(&(d_q->dom_sid), dom_sid);
}
+/***************************************************************************
+lsa_reply_query_info
+ ***************************************************************************/
static int lsa_reply_query_info(LSA_Q_QUERY_INFO *q_q, char *q, char *base,
char *dom_name, char *dom_sid)
{
@@ -91,7 +100,12 @@ static int lsa_reply_query_info(LSA_Q_QUERY_INFO *q_q, char *q, char *base,
return PTR_DIFF(q, base);
}
-/* pretty much hard-coded choice of "other" sids, unfortunately... */
+/***************************************************************************
+make_dom_ref
+
+ pretty much hard-coded choice of "other" sids, unfortunately...
+
+ ***************************************************************************/
static void make_dom_ref(DOM_R_REF *ref,
char *dom_name, char *dom_sid,
char *other_sid1, char *other_sid2, char *other_sid3)
@@ -123,6 +137,9 @@ static void make_dom_ref(DOM_R_REF *ref,
make_dom_sid(&(ref->ref_dom[3]), other_sid3);
}
+/***************************************************************************
+make_reply_lookup_rids
+ ***************************************************************************/
static void make_reply_lookup_rids(LSA_R_LOOKUP_RIDS *r_l,
int num_entries, uint32 dom_rids[MAX_LOOKUP_SIDS],
char *dom_name, char *dom_sid,
@@ -145,6 +162,9 @@ static void make_reply_lookup_rids(LSA_R_LOOKUP_RIDS *r_l,
r_l->num_entries3 = num_entries;
}
+/***************************************************************************
+make_reply_lookup_sids
+ ***************************************************************************/
static void make_reply_lookup_sids(LSA_R_LOOKUP_SIDS *r_l,
int num_entries, fstring dom_sids[MAX_LOOKUP_SIDS],
char *dom_name, char *dom_sid,
@@ -167,6 +187,9 @@ static void make_reply_lookup_sids(LSA_R_LOOKUP_SIDS *r_l,
r_l->num_entries3 = num_entries;
}
+/***************************************************************************
+lsa_reply_lookup_sids
+ ***************************************************************************/
static int lsa_reply_lookup_sids(char *q, char *base,
int num_entries, fstring dom_sids[MAX_LOOKUP_SIDS],
char *dom_name, char *dom_sid,
@@ -186,6 +209,9 @@ static int lsa_reply_lookup_sids(char *q, char *base,
return PTR_DIFF(q, base);
}
+/***************************************************************************
+lsa_reply_lookup_rids
+ ***************************************************************************/
static int lsa_reply_lookup_rids(char *q, char *base,
int num_entries, uint32 dom_rids[MAX_LOOKUP_SIDS],
char *dom_name, char *dom_sid,
@@ -205,6 +231,9 @@ static int lsa_reply_lookup_rids(char *q, char *base,
return PTR_DIFF(q, base);
}
+/***************************************************************************
+api_lsa_open_policy
+ ***************************************************************************/
static void api_lsa_open_policy( char *param, char *data,
char **rdata, int *rdata_len )
{
@@ -215,6 +244,9 @@ static void api_lsa_open_policy( char *param, char *data,
*rdata_len = lsa_reply_open_policy(*rdata + 0x18, *rdata);
}
+/***************************************************************************
+api_lsa_query_info
+ ***************************************************************************/
static void api_lsa_query_info( char *param, char *data,
char **rdata, int *rdata_len )
{
@@ -233,6 +265,9 @@ static void api_lsa_query_info( char *param, char *data,
dom_name, dom_sid);
}
+/***************************************************************************
+api_lsa_lookup_sids
+ ***************************************************************************/
static void api_lsa_lookup_sids( char *param, char *data,
char **rdata, int *rdata_len )
{
@@ -261,6 +296,9 @@ static void api_lsa_lookup_sids( char *param, char *data,
"S-1-1", "S-1-3", "S-1-5"); /* the three other SIDs */
}
+/***************************************************************************
+api_lsa_lookup_names
+ ***************************************************************************/
static void api_lsa_lookup_names( char *param, char *data,
char **rdata, int *rdata_len )
{
@@ -295,6 +333,9 @@ static void api_lsa_lookup_names( char *param, char *data,
"S-1-1", "S-1-3", "S-1-5"); /* the three other SIDs */
}
+/***************************************************************************
+api_ntLsarpcTNP
+ ***************************************************************************/
BOOL api_ntLsarpcTNP(int cnum,int uid, char *param,char *data,
int mdrcnt,int mprcnt,
char **rdata,char **rparam,
diff --git a/source3/smbparse.c b/source3/smbparse.c
index 785ae74b17..028f172b8e 100644
--- a/source3/smbparse.c
+++ b/source3/smbparse.c
@@ -840,6 +840,58 @@ char* smb_io_rpc_hdr(BOOL io, RPC_HDR *rpc, char *q, char *base, int align, int
}
/*******************************************************************
+makes an LSA_OBJ_ATTR structure.
+********************************************************************/
+void make_obj_attr(LSA_OBJ_ATTR *attr, uint32 attributes, uint32 sec_qos)
+{
+ if (attr == NULL) return;
+
+ DEBUG(5,("make_obj_attr\n"));
+
+ attr->len = 0x18; /* length of object attribute block, in bytes */
+ attr->ptr_root_dir = 0;
+ attr->ptr_obj_name = 0;
+ attr->attributes = attributes;
+ attr->ptr_sec_desc = 0;
+ attr->sec_qos = sec_qos;
+}
+
+/*******************************************************************
+reads or writes an LSA_OBJ_ATTR structure.
+********************************************************************/
+char* smb_io_obj_attr(BOOL io, LSA_OBJ_ATTR *attr, char *q, char *base, int align, int depth)
+{
+ char *start;
+
+ if (attr == NULL) return NULL;
+
+ DEBUG(5,("%s%04x smb_io_obj_attr\n", tab_depth(depth), PTR_DIFF(q, base)));
+ depth++;
+
+ q = align_offset(q, base, align);
+
+ start = q;
+
+ /* these pointers had _better_ be zero, because we don't know
+ what they point to!
+ */
+ DBG_RW_IVAL("len" , depth, base, io, q, attr->len ); q += 4; /* 0x18 - length (in bytes) inc. the length field. */
+ DBG_RW_IVAL("ptr_root_dir", depth, base, io, q, attr->ptr_root_dir); q += 4; /* 0 - root directory (pointer) */
+ DBG_RW_IVAL("ptr_obj_name", depth, base, io, q, attr->ptr_obj_name); q += 4; /* 0 - object name (pointer) */
+ DBG_RW_IVAL("attributes" , depth, base, io, q, attr->attributes ); q += 4; /* 0 - attributes (undocumented) */
+ DBG_RW_IVAL("ptr_sec_desc", depth, base, io, q, attr->ptr_sec_desc); q += 4; /* 0 - security descriptior (pointer) */
+ DBG_RW_IVAL("sec_qos" , depth, base, io, q, attr->sec_qos ); q += 4; /* 0 - security quality of service */
+
+ if (attr->len != PTR_DIFF(q, start))
+ {
+ DEBUG(3,("smb_io_obj_attr: length %lx does not match size %lx\n",
+ attr->len, PTR_DIFF(q, start)));
+ }
+
+ return q;
+}
+
+/*******************************************************************
reads or writes an LSA_POL_HND structure.
********************************************************************/
char* smb_io_pol_hnd(BOOL io, LSA_POL_HND *pol, char *q, char *base, int align, int depth)