diff options
| -rw-r--r-- | source3/client/ntclient.c | 204 | ||||
| -rw-r--r-- | source3/include/proto.h | 4 | ||||
| -rw-r--r-- | source3/include/smb.h | 21 | ||||
| -rw-r--r-- | source3/lsaparse.c | 58 | ||||
| -rw-r--r-- | source3/pipeutil.c | 8 | ||||
| -rw-r--r-- | source3/smbparse.c | 4 |
6 files changed, 280 insertions, 19 deletions
diff --git a/source3/client/ntclient.c b/source3/client/ntclient.c index d141bb23c4..16bfaeccbe 100644 --- a/source3/client/ntclient.c +++ b/source3/client/ntclient.c @@ -116,7 +116,7 @@ static BOOL do_lsa_open_policy(uint16 fnum, char *server_name, LSA_POL_HND *hnd) /* create setup parameters. */ setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */ - setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */ + setup[1] = fnum; /* file handle, from the SMBcreateX pipe, earlier */ /* send the data on \PIPE\ */ if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024, @@ -183,7 +183,8 @@ static BOOL do_lsa_open_policy(uint16 fnum, char *server_name, LSA_POL_HND *hnd) /**************************************************************************** do a LSA Query Info Policy ****************************************************************************/ -static BOOL do_lsa_query_info_pol(uint16 fnum, LSA_POL_HND *hnd, uint16 info_class) +static BOOL do_lsa_query_info_pol(uint16 fnum, LSA_POL_HND *hnd, uint16 info_class, + fstring domain_name, pstring domain_sid) { char *rparam = NULL; char *rdata = NULL; @@ -195,7 +196,7 @@ static BOOL do_lsa_query_info_pol(uint16 fnum, LSA_POL_HND *hnd, uint16 info_cla int call_id = 0x1; BOOL valid_response = False; - if (hnd == NULL) return False; + if (hnd == NULL || domain_name == NULL || domain_sid == NULL) return False; /* create and send a MSRPC command with api LSA_QUERYINFOPOLICY */ @@ -212,7 +213,7 @@ static BOOL do_lsa_query_info_pol(uint16 fnum, LSA_POL_HND *hnd, uint16 info_cla /* create setup parameters. */ setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */ - setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */ + setup[1] = fnum; /* file handle, from the SMBcreateX pipe, earlier */ /* send the data on \PIPE\ */ if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024, @@ -262,10 +263,52 @@ static BOOL do_lsa_query_info_pol(uint16 fnum, LSA_POL_HND *hnd, uint16 info_cla p = NULL; } + if (p && r_q.info_class != q_q.info_class) + { + /* report different info classes */ + DEBUG(0,("LSA_QUERYINFOPOLICY: error info_class (q,r) differ - (%x,%x)\n", + q_q.info_class, r_q.info_class)); + p = NULL; + } + if (p) { /* ok, at last: we're happy. */ - valid_response = True; + switch (r_q.info_class) + { + case 3: + { + char *dom_name = unistrn2(r_q.dom.id3.uni_domain_name.buffer, + r_q.dom.id3.uni_domain_name.uni_str_len); + char *dom_sid = dom_sid_to_string(&(r_q.dom.id3.dom_sid)); + fstrcpy(domain_name, dom_name); + pstrcpy(domain_sid , dom_sid); + + valid_response = True; + break; + } + case 5: + { + char *dom_name = unistrn2(r_q.dom.id5.uni_domain_name.buffer, + r_q.dom.id5.uni_domain_name.uni_str_len); + char *dom_sid = dom_sid_to_string(&(r_q.dom.id5.dom_sid)); + fstrcpy(domain_name, dom_name); + pstrcpy(domain_sid , dom_sid); + + valid_response = True; + break; + } + default: + { + DEBUG(3,("LSA_QUERYINFOPOLICY: unknown info class\n")); + domain_name[0] = 0; + domain_sid [0] = 0; + + break; + } + } + DEBUG(3,("LSA_QUERYINFOPOLICY (level %x): domain:%s domain sid:%s\n", + r_q.info_class, domain_name, domain_sid)); } } @@ -276,6 +319,115 @@ static BOOL do_lsa_query_info_pol(uint16 fnum, LSA_POL_HND *hnd, uint16 info_cla } /**************************************************************************** +do a LSA Close +****************************************************************************/ +static BOOL do_lsa_close(uint16 fnum, LSA_POL_HND *hnd) +{ + char *rparam = NULL; + char *rdata = NULL; + char *p; + int rdrcnt,rprcnt; + pstring data; /* only 1024 bytes */ + uint16 setup[2]; /* only need 2 uint16 setup parameters */ + LSA_Q_CLOSE q_c; + int call_id = 0x1; + BOOL valid_close = False; + + if (hnd == NULL) return False; + + /* create and send a MSRPC command with api LSA_OPENPOLICY */ + + DEBUG(4,("LSA Close\n")); + + /* store the parameters */ + make_q_close(&q_c, hnd); + + /* turn parameters into data stream */ + p = lsa_io_q_close(False, &q_c, data + 0x18, data, 4, 0); + + /* create the request RPC_HDR with no data */ + create_rpc_request(call_id, LSA_CLOSE, data, PTR_DIFF(p, data)); + + /* create setup parameters. */ + setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */ + setup[1] = fnum; /* file handle, from the SMBcreateX pipe, earlier */ + + /* send the data on \PIPE\ */ + if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024, + BUFFER_SIZE, + &rprcnt, &rdrcnt, + NULL, data, setup, + &rparam, &rdata)) + { + LSA_R_CLOSE r_c; + RPC_HDR hdr; + int hdr_len; + int pkt_len; + + DEBUG(5, ("cli_call_api: return OK\n")); + + p = rdata; + + if (p) p = smb_io_rpc_hdr (True, &hdr, p, rdata, 4, 0); + if (p) p = align_offset(p, rdata, 4); /* oh, what a surprise */ + + hdr_len = PTR_DIFF(p, rdata); + + if (p && hdr_len != hdr.frag_len - hdr.alloc_hint) + { + /* header length not same as calculated header length */ + DEBUG(2,("do_lsa_close: hdr_len %x != frag_len-alloc_hint\n", + hdr_len, hdr.frag_len - hdr.alloc_hint)); + p = NULL; + } + + if (p) p = lsa_io_r_close(True, &r_c, p, rdata, 4, 0); + + pkt_len = PTR_DIFF(p, rdata); + + if (p && pkt_len != hdr.frag_len) + { + /* packet data size not same as reported fragment length */ + DEBUG(2,("do_lsa_close: pkt_len %x != frag_len \n", + pkt_len, hdr.frag_len)); + p = NULL; + } + + if (p && r_c.status != 0) + { + /* report error code */ + DEBUG(0,("LSA_OPENPOLICY: nt_status error %lx\n", r_c.status)); + p = NULL; + } + + if (p) + { + /* check that the returned policy handle is all zeros */ + int i; + valid_close = True; + + for (i = 0; i < sizeof(r_c.pol.data); i++) + { + if (r_c.pol.data[i] != 0) + { + valid_close = False; + break; + } + } + if (!valid_close) + { + DEBUG(0,("LSA_CLOSE: non-zero handle returned\n")); + } + } + } + + if (rparam) free(rparam); + if (rdata) free(rdata); + + return valid_close; +} + +/**************************************************************************** do a LSA Request Challenge ****************************************************************************/ static BOOL do_lsa_req_chal(uint16 fnum, @@ -311,7 +463,7 @@ static BOOL do_lsa_req_chal(uint16 fnum, /* create setup parameters. */ setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */ - setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */ + setup[1] = fnum; /* file handle, from the SMBcreateX pipe, earlier */ /* send the data on \PIPE\ */ if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024, @@ -412,7 +564,7 @@ static BOOL do_lsa_auth2(uint16 fnum, /* create setup parameters. */ setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */ - setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */ + setup[1] = fnum; /* file handle, from the SMBcreateX pipe, earlier */ /* send the data on \PIPE\ */ if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024, @@ -526,7 +678,7 @@ static BOOL do_lsa_sam_logon(uint16 fnum, uint32 sess_key[2], DOM_CRED *sto_clnt /* create setup parameters. */ setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */ - setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */ + setup[1] = fnum; /* file handle, from the SMBcreateX pipe, earlier */ /* send the data on \PIPE\ */ if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024, @@ -649,7 +801,7 @@ static BOOL do_lsa_sam_logoff(uint16 fnum, uint32 sess_key[2], DOM_CRED *sto_cln /* create setup parameters. */ setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */ - setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */ + setup[1] = fnum; /* file handle, from the SMBcreateX pipe, earlier */ /* send the data on \PIPE\ */ if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024, @@ -754,6 +906,14 @@ BOOL do_nt_login(char *desthost, char *myhostname, fstring mach_pwd; fstring server_name; + /* received from LSA Query Info Policy, level 5 */ + fstring level5_domain_name; + pstring level5_domain_sid; + + /* received from LSA Query Info Policy, level 3 */ + fstring level3_domain_name; + pstring level3_domain_sid; + uint16 fnum; char *inbuf,*outbuf; @@ -789,10 +949,32 @@ BOOL do_nt_login(char *desthost, char *myhostname, return False; } - /******************* Query Info Policy ********************/ + /**************** Query Info Policy, level 3 ********************/ + + /* send a query info policy at level 3; receive an info policy */ + if (!do_lsa_query_info_pol(fnum, &pol, 0x3, + level3_domain_name, level3_domain_sid)) + { + cli_smb_close(inbuf, outbuf, Client, cnum, fnum); + free(inbuf); free(outbuf); + return False; + } + + /**************** Query Info Policy, level 5 ********************/ /* send a query info policy at level 5; receive an info policy */ - if (!do_lsa_query_info_pol(fnum, &pol, 0x5)) + if (!do_lsa_query_info_pol(fnum, &pol, 0x5, + level5_domain_name, level5_domain_sid)) + { + cli_smb_close(inbuf, outbuf, Client, cnum, fnum); + free(inbuf); free(outbuf); + return False; + } + + /******************* Open Policy ********************/ + + /* send a close policy request; receive a close pol response */ + if (!do_lsa_close(fnum, &pol)) { cli_smb_close(inbuf, outbuf, Client, cnum, fnum); free(inbuf); free(outbuf); diff --git a/source3/include/proto.h b/source3/include/proto.h index e0d5d31f40..669ed5fd8d 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -380,6 +380,10 @@ char* lsa_io_q_open_pol(BOOL io, LSA_Q_OPEN_POL *r_q, char *q, char *base, int a char* lsa_io_r_open_pol(BOOL io, LSA_R_OPEN_POL *r_p, char *q, char *base, int align, int depth); void make_q_query(LSA_Q_QUERY_INFO *q_q, LSA_POL_HND *hnd, uint16 info_class); char* lsa_io_q_query(BOOL io, LSA_Q_QUERY_INFO *q_q, char *q, char *base, int align, int depth); +void make_q_close(LSA_Q_CLOSE *q_c, LSA_POL_HND *hnd); +char* lsa_io_q_close(BOOL io, LSA_Q_CLOSE *q_c, char *q, char *base, int align, int depth); +void make_r_close(LSA_R_CLOSE *q_r, LSA_POL_HND *hnd); +char* lsa_io_r_close(BOOL io, LSA_R_CLOSE *r_c, char *q, char *base, int align, int depth); char* lsa_io_r_query(BOOL io, LSA_R_QUERY_INFO *r_q, char *q, char *base, int align, int depth); char* lsa_io_q_lookup_sids(BOOL io, LSA_Q_LOOKUP_SIDS *q_s, char *q, char *base, int align, int depth); char* lsa_io_r_lookup_sids(BOOL io, LSA_R_LOOKUP_SIDS *r_s, char *q, char *base, int align, int depth); diff --git a/source3/include/smb.h b/source3/include/smb.h index e9734f379d..057a0b7550 100644 --- a/source3/include/smb.h +++ b/source3/include/smb.h @@ -364,7 +364,7 @@ typedef struct sid_info uint8 sid_rev_num; /* SID revision number */ uint8 num_auths; /* number of sub-authorities */ uint8 id_auth[6]; /* Identifier Authority */ - uint16 sub_auths[MAXSUBAUTHS]; /* pointer to sub-authorities. */ + uint32 sub_auths[MAXSUBAUTHS]; /* pointer to sub-authorities. */ } DOM_SID; @@ -632,10 +632,27 @@ typedef struct lsa_r_query_info } dom; - uint32 status; /* return code */ + uint32 status; /* return code */ } LSA_R_QUERY_INFO; +/* LSA_Q_CLOSE */ +typedef struct lsa_q_close_info +{ + LSA_POL_HND pol; /* policy handle */ + +} LSA_Q_CLOSE; + +/* LSA_R_CLOSE */ +typedef struct lsa_r_close_info +{ + LSA_POL_HND pol; /* policy handle. should be all zeros. */ + + uint32 status; /* return code */ + +} LSA_R_CLOSE; + + #define MAX_REF_DOMAINS 10 /* DOM_R_REF */ diff --git a/source3/lsaparse.c b/source3/lsaparse.c index 39ef6c596b..7a62b7c903 100644 --- a/source3/lsaparse.c +++ b/source3/lsaparse.c @@ -108,6 +108,64 @@ char* lsa_io_q_query(BOOL io, LSA_Q_QUERY_INFO *q_q, char *q, char *base, int al } /******************************************************************* +makes an LSA_Q_CLOSE structure. +********************************************************************/ +void make_q_close(LSA_Q_CLOSE *q_c, LSA_POL_HND *hnd) +{ + if (q_c == NULL || hnd == NULL) return; + + DEBUG(5,("make_q_close\n")); + + memcpy(&(q_c->pol), hnd, sizeof(q_c->pol)); +} + + +/******************************************************************* +reads or writes an LSA_Q_CLOSE structure. +********************************************************************/ +char* lsa_io_q_close(BOOL io, LSA_Q_CLOSE *q_c, char *q, char *base, int align, int depth) +{ + if (q_c == NULL) return NULL; + + DEBUG(5,("%s%04x lsa_io_q_close\n", tab_depth(depth), PTR_DIFF(q, base))); + depth++; + + q = smb_io_pol_hnd(io, &(q_c->pol), q, base, align, depth); + + return q; +} + +/******************************************************************* +makes an LSA_R_CLOSE structure. +********************************************************************/ +void make_r_close(LSA_R_CLOSE *q_r, LSA_POL_HND *hnd) +{ + if (q_r == NULL || hnd == NULL) return; + + DEBUG(5,("make_r_close\n")); + + memcpy(&(q_r->pol), hnd, sizeof(q_r->pol)); +} + + +/******************************************************************* +reads or writes an LSA_R_CLOSE structure. +********************************************************************/ +char* lsa_io_r_close(BOOL io, LSA_R_CLOSE *r_c, char *q, char *base, int align, int depth) +{ + if (r_c == NULL) return NULL; + + DEBUG(5,("%s%04x lsa_io_r_close\n", tab_depth(depth), PTR_DIFF(q, base))); + depth++; + + q = smb_io_pol_hnd(io, &(r_c->pol), q, base, align, depth); + + DBG_RW_IVAL("status", depth, base, io, q, r_c->status); q += 4; + + return q; +} + +/******************************************************************* reads or writes an LSA_Q_QUERY_INFO structure. ********************************************************************/ char* lsa_io_r_query(BOOL io, LSA_R_QUERY_INFO *r_q, char *q, char *base, int align, int depth) diff --git a/source3/pipeutil.c b/source3/pipeutil.c index dff0374433..93a78df493 100644 --- a/source3/pipeutil.c +++ b/source3/pipeutil.c @@ -106,10 +106,10 @@ char *dom_sid_to_string(DOM_SID *sid) static pstring sidstr; char subauth[16]; int i; - uint32 ia = (sid->id_auth[0]) + - (sid->id_auth[1] << 8 ) + - (sid->id_auth[2] << 16) + - (sid->id_auth[3] << 24); + uint32 ia = (sid->id_auth[5]) + + (sid->id_auth[4] << 8 ) + + (sid->id_auth[3] << 16) + + (sid->id_auth[2] << 24); sprintf(sidstr, "S-%d-%d", sid->sid_rev_num, ia); diff --git a/source3/smbparse.c b/source3/smbparse.c index 028f172b8e..6b02827006 100644 --- a/source3/smbparse.c +++ b/source3/smbparse.c @@ -136,7 +136,7 @@ char* smb_io_dom_sid(BOOL io, DOM_SID *sid, char *q, char *base, int align, int /* oops! XXXX should really issue a warning here... */ if (sid->num_auths > MAXSUBAUTHS) sid->num_auths = MAXSUBAUTHS; - DBG_RW_PIVAL("num_auths ", depth, base, io, q, sid->sub_auths, sid->num_auths); q += sid->num_auths * 4; + DBG_RW_PIVAL("sub_auths ", depth, base, io, q, sid->sub_auths, sid->num_auths); q += sid->num_auths * 4; return q; } @@ -278,7 +278,7 @@ char* smb_io_unistr2(BOOL io, UNISTR2 *uni2, char *q, char *base, int align, int /* buffer advanced by indicated length of string NOT by searching for null-termination */ - DBG_RW_PSVAL("buffer ", depth, base, io, q, uni2->buffer, uni2->uni_max_len); q += uni2->uni_max_len * 2; + DBG_RW_PSVAL("buffer ", depth, base, io, q, uni2->buffer, uni2->uni_max_len); q += uni2->uni_max_len * 2; return q; } |