summaryrefslogtreecommitdiff
path: root/source3
diff options
context:
space:
mode:
Diffstat (limited to 'source3')
-rw-r--r--source3/client/ntclient.c127
-rw-r--r--source3/include/byteorder.h12
-rw-r--r--source3/include/proto.h1
-rw-r--r--source3/lsaparse.c14
-rw-r--r--source3/pipentlsa.c8
5 files changed, 143 insertions, 19 deletions
diff --git a/source3/client/ntclient.c b/source3/client/ntclient.c
index dab8bb1902..5baff450a3 100644
--- a/source3/client/ntclient.c
+++ b/source3/client/ntclient.c
@@ -115,8 +115,8 @@ static BOOL do_lsa_open_policy(uint16 fnum, char *server_name, LSA_POL_HND *hnd)
create_rpc_request(call_id, LSA_OPENPOLICY, data, PTR_DIFF(p, data));
/* create setup parameters. */
- SIVAL(setup, 0, 0x0026); /* 0x26 indicates "transact named pipe" */
- SIVAL(setup, 2, fnum); /* file handle, from the SMBcreateX pipe, earlier */
+ setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */
+ setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
/* send the data on \PIPE\ */
if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024,
@@ -162,7 +162,7 @@ static BOOL do_lsa_open_policy(uint16 fnum, char *server_name, LSA_POL_HND *hnd)
if (p && r_o.status != 0)
{
/* report error code */
- DEBUG(0,("LSA_REQ_CHAL: nt_status error %lx\n", r_o.status));
+ DEBUG(0,("LSA_OPENPOLICY: nt_status error %lx\n", r_o.status));
p = NULL;
}
@@ -181,6 +181,101 @@ static BOOL do_lsa_open_policy(uint16 fnum, char *server_name, LSA_POL_HND *hnd)
}
/****************************************************************************
+do a LSA Query Info Policy
+****************************************************************************/
+static BOOL do_lsa_query_info_pol(uint16 fnum, LSA_POL_HND *hnd, uint16 info_class)
+{
+ char *rparam = NULL;
+ char *rdata = NULL;
+ char *p;
+ int rdrcnt,rprcnt;
+ pstring data; /* only 1024 bytes */
+ uint16 setup[2]; /* only need 2 uint16 setup parameters */
+ LSA_Q_QUERY_INFO q_q;
+ int call_id = 0x1;
+ BOOL valid_response = False;
+
+ if (hnd == NULL) return False;
+
+ /* create and send a MSRPC command with api LSA_QUERYINFOPOLICY */
+
+ DEBUG(4,("LSA Query Info Policy\n"));
+
+ /* store the parameters */
+ make_q_query(&q_q, hnd, info_class);
+
+ /* turn parameters into data stream */
+ p = lsa_io_q_query(False, &q_q, data + 0x18, data, 4, 0);
+
+ /* create the request RPC_HDR with no data */
+ create_rpc_request(call_id, LSA_QUERYINFOPOLICY, data, PTR_DIFF(p, data));
+
+ /* create setup parameters. */
+ setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */
+ setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
+
+ /* send the data on \PIPE\ */
+ if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024,
+ BUFFER_SIZE,
+ &rprcnt, &rdrcnt,
+ NULL, data, setup,
+ &rparam, &rdata))
+ {
+ LSA_R_QUERY_INFO r_q;
+ RPC_HDR hdr;
+ int hdr_len;
+ int pkt_len;
+
+ DEBUG(5, ("cli_call_api: return OK\n"));
+
+ p = rdata;
+
+ if (p) p = smb_io_rpc_hdr (True, &hdr, p, rdata, 4, 0);
+ if (p) p = align_offset(p, rdata, 4); /* oh, what a surprise */
+
+ hdr_len = PTR_DIFF(p, rdata);
+
+ if (p && hdr_len != hdr.frag_len - hdr.alloc_hint)
+ {
+ /* header length not same as calculated header length */
+ DEBUG(2,("do_lsa_query_info: hdr_len %x != frag_len-alloc_hint\n",
+ hdr_len, hdr.frag_len - hdr.alloc_hint));
+ p = NULL;
+ }
+
+ if (p) p = lsa_io_r_query(True, &r_q, p, rdata, 4, 0);
+
+ pkt_len = PTR_DIFF(p, rdata);
+
+ if (p && pkt_len != hdr.frag_len)
+ {
+ /* packet data size not same as reported fragment length */
+ DEBUG(2,("do_lsa_query_info: pkt_len %x != frag_len \n",
+ pkt_len, hdr.frag_len));
+ p = NULL;
+ }
+
+ if (p && r_q.status != 0)
+ {
+ /* report error code */
+ DEBUG(0,("LSA_QUERYINFOPOLICY: nt_status error %lx\n", r_q.status));
+ p = NULL;
+ }
+
+ if (p)
+ {
+ /* ok, at last: we're happy. */
+ valid_response = True;
+ }
+ }
+
+ if (rparam) free(rparam);
+ if (rdata) free(rdata);
+
+ return valid_response;
+}
+
+/****************************************************************************
do a LSA Request Challenge
****************************************************************************/
static BOOL do_lsa_req_chal(uint16 fnum,
@@ -215,8 +310,8 @@ static BOOL do_lsa_req_chal(uint16 fnum,
create_rpc_request(call_id, LSA_REQCHAL, data, PTR_DIFF(p, data));
/* create setup parameters. */
- SIVAL(setup, 0, 0x0026); /* 0x26 indicates "transact named pipe" */
- SIVAL(setup, 2, fnum); /* file handle, from the SMBcreateX pipe, earlier */
+ setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */
+ setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
/* send the data on \PIPE\ */
if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024,
@@ -316,8 +411,8 @@ static BOOL do_lsa_auth2(uint16 fnum,
create_rpc_request(call_id, LSA_AUTH2, data, PTR_DIFF(p, data));
/* create setup parameters. */
- SIVAL(setup, 0, 0x0026); /* 0x26 indicates "transact named pipe" */
- SIVAL(setup, 2, fnum); /* file handle, from the SMBcreateX pipe, earlier */
+ setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */
+ setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
/* send the data on \PIPE\ */
if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024,
@@ -430,8 +525,8 @@ static BOOL do_lsa_sam_logon(uint16 fnum, uint32 sess_key[2], DOM_CRED *sto_clnt
create_rpc_request(call_id, LSA_SAMLOGON, data, PTR_DIFF(p, data));
/* create setup parameters. */
- SIVAL(setup, 0, 0x0026); /* 0x26 indicates "transact named pipe" */
- SIVAL(setup, 2, fnum); /* file handle, from the SMBcreateX pipe, earlier */
+ setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */
+ setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
/* send the data on \PIPE\ */
if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024,
@@ -554,8 +649,8 @@ static BOOL do_lsa_sam_logoff(uint16 fnum, uint32 sess_key[2], DOM_CRED *sto_cln
create_rpc_request(call_id, LSA_SAMLOGOFF, data, PTR_DIFF(p, data));
/* create setup parameters. */
- SIVAL(setup, 0, 0x0026); /* 0x26 indicates "transact named pipe" */
- SIVAL(setup, 2, fnum); /* file handle, from the SMBcreateX pipe, earlier */
+ setup[0] = 0x0026; /* 0x26 indicates "transact named pipe" */
+ setup[2] = fnum; /* file handle, from the SMBcreateX pipe, earlier */
/* send the data on \PIPE\ */
if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024,
@@ -695,6 +790,16 @@ BOOL do_nt_login(char *desthost, char *myhostname,
return False;
}
+ /******************* Query Info Policy ********************/
+
+ /* send a query info policy at level 5; receive an info policy */
+ if (!do_lsa_query_info_pol(fnum, &pol, 0x5))
+ {
+ cli_smb_close(inbuf, outbuf, Client, cnum, fnum);
+ free(inbuf); free(outbuf);
+ return False;
+ }
+
/******************* close the \PIPE\lsarpc file *******************/
cli_smb_close(inbuf, outbuf, Client, cnum, fnum);
diff --git a/source3/include/byteorder.h b/source3/include/byteorder.h
index 147d20d26d..b0dc1b1941 100644
--- a/source3/include/byteorder.h
+++ b/source3/include/byteorder.h
@@ -206,35 +206,35 @@ it also defines lots of intermediate macros, just ignore those :-)
RW_PCVAL(read,inbuf,outbuf,len) \
DEBUG(5,("%s%04x %s: ", \
tab_depth(depth), PTR_DIFF(inbuf,base),string)); \
- { int idx; for (idx = 0; idx < len; idx++) { DEBUG(5,("%02x ", (uint8)((outbuf)[idx]))); } } \
+ { int idx; for (idx = 0; idx < len; idx++) { DEBUG(5,("%02x ", CVAL(&((outbuf)[idx]), 0))); } } \
DEBUG(5,("\n"));
#define DBG_RW_PSVAL(string,depth,base,read,inbuf,outbuf,len) \
RW_PSVAL(read,inbuf,outbuf,len) \
DEBUG(5,("%s%04x %s: ", \
tab_depth(depth), PTR_DIFF(inbuf,base),string)); \
- { int idx; for (idx = 0; idx < len; idx++) { DEBUG(5,("%04x ", (uint16)((outbuf)[idx]))); } } \
+ { int idx; for (idx = 0; idx < len; idx++) { DEBUG(5,("%04x ", SVAL(&((outbuf)[idx]), 0))); } } \
DEBUG(5,("\n"));
#define DBG_RW_PIVAL(string,depth,base,read,inbuf,outbuf,len) \
RW_PIVAL(read,inbuf,outbuf,len) \
DEBUG(5,("%s%04x %s: ", \
tab_depth(depth), PTR_DIFF(inbuf,base),string)); \
- { int idx; for (idx = 0; idx < len; idx++) { DEBUG(5,("%08x ", (uint32)((outbuf)[idx]))); } } \
+ { int idx; for (idx = 0; idx < len; idx++) { DEBUG(5,("%08x ", IVAL(&((outbuf)[idx]), 0))); } } \
DEBUG(5,("\n"));
#define DBG_RW_CVAL(string,depth,base,read,inbuf,outbuf) \
RW_CVAL(read,inbuf,outbuf,0) \
DEBUG(5,("%s%04x %s: %02x\n", \
- tab_depth(depth), PTR_DIFF(inbuf,base),string, CVAL(inbuf, 0)));
+ tab_depth(depth), PTR_DIFF(inbuf,base), string, outbuf));
#define DBG_RW_SVAL(string,depth,base,read,inbuf,outbuf) \
RW_SVAL(read,inbuf,outbuf,0) \
DEBUG(5,("%s%04x %s: %04x\n", \
- tab_depth(depth), PTR_DIFF(inbuf,base),string, SVAL(inbuf, 0)));
+ tab_depth(depth), PTR_DIFF(inbuf,base), string, outbuf));
#define DBG_RW_IVAL(string,depth,base,read,inbuf,outbuf) \
RW_IVAL(read,inbuf,outbuf,0) \
DEBUG(5,("%s%04x %s: %08x\n", \
- tab_depth(depth), PTR_DIFF(inbuf,base),string, IVAL(inbuf, 0)));
+ tab_depth(depth), PTR_DIFF(inbuf,base), string, outbuf));
diff --git a/source3/include/proto.h b/source3/include/proto.h
index 6bb91e8c1f..e0d5d31f40 100644
--- a/source3/include/proto.h
+++ b/source3/include/proto.h
@@ -378,6 +378,7 @@ void make_q_open_pol(LSA_Q_OPEN_POL *r_q, char *server_name,
uint16 desired_access);
char* lsa_io_q_open_pol(BOOL io, LSA_Q_OPEN_POL *r_q, char *q, char *base, int align, int depth);
char* lsa_io_r_open_pol(BOOL io, LSA_R_OPEN_POL *r_p, char *q, char *base, int align, int depth);
+void make_q_query(LSA_Q_QUERY_INFO *q_q, LSA_POL_HND *hnd, uint16 info_class);
char* lsa_io_q_query(BOOL io, LSA_Q_QUERY_INFO *q_q, char *q, char *base, int align, int depth);
char* lsa_io_r_query(BOOL io, LSA_R_QUERY_INFO *r_q, char *q, char *base, int align, int depth);
char* lsa_io_q_lookup_sids(BOOL io, LSA_Q_LOOKUP_SIDS *q_s, char *q, char *base, int align, int depth);
diff --git a/source3/lsaparse.c b/source3/lsaparse.c
index 37cc51bbf8..39ef6c596b 100644
--- a/source3/lsaparse.c
+++ b/source3/lsaparse.c
@@ -77,6 +77,20 @@ char* lsa_io_r_open_pol(BOOL io, LSA_R_OPEN_POL *r_p, char *q, char *base, int a
}
/*******************************************************************
+makes an LSA_Q_QUERY_INFO structure.
+********************************************************************/
+void make_q_query(LSA_Q_QUERY_INFO *q_q, LSA_POL_HND *hnd, uint16 info_class)
+{
+ if (q_q == NULL || hnd == NULL) return;
+
+ DEBUG(5,("make_q_query\n"));
+
+ memcpy(&(q_q->pol), hnd, sizeof(q_q->pol));
+
+ q_q->info_class = info_class;
+}
+
+/*******************************************************************
reads or writes an LSA_Q_QUERY_INFO structure.
********************************************************************/
char* lsa_io_q_query(BOOL io, LSA_Q_QUERY_INFO *q_q, char *q, char *base, int align, int depth)
diff --git a/source3/pipentlsa.c b/source3/pipentlsa.c
index 4fc61f8e5b..cf40ccc7af 100644
--- a/source3/pipentlsa.c
+++ b/source3/pipentlsa.c
@@ -237,8 +237,12 @@ api_lsa_open_policy
static void api_lsa_open_policy( char *param, char *data,
char **rdata, int *rdata_len )
{
- /* we might actually want to decode the query, but it's not necessary */
- /* lsa_io_q_open_policy(...); */
+ LSA_Q_OPEN_POL q_o;
+
+ /* grab the server, object attributes and desired access flag...*/
+ lsa_io_q_open_pol(True, &q_o, data + 0x18, data, 4, 0);
+
+ /* lkclXXXX having decoded it, ignore all fields in the open policy! */
/* return a 20 byte policy handle */
*rdata_len = lsa_reply_open_policy(*rdata + 0x18, *rdata);
generated by cgit (git 2.34.1) at 2024-12-18 21:18:53 +0000