summaryrefslogtreecommitdiff
path: root/source4
diff options
context:
space:
mode:
Diffstat (limited to 'source4')
-rw-r--r--source4/librpc/rpc/dcerpc.c82
-rw-r--r--source4/librpc/rpc/dcerpc.h5
-rw-r--r--source4/librpc/rpc/dcerpc_auth.c88
-rw-r--r--source4/librpc/rpc/dcerpc_ntlm.c2
-rw-r--r--source4/librpc/rpc/dcerpc_schannel.c2
-rw-r--r--source4/librpc/rpc/dcerpc_spnego.c2
6 files changed, 170 insertions, 11 deletions
diff --git a/source4/librpc/rpc/dcerpc.c b/source4/librpc/rpc/dcerpc.c
index 8afc556528..f7c0100f47 100644
--- a/source4/librpc/rpc/dcerpc.c
+++ b/source4/librpc/rpc/dcerpc.c
@@ -334,7 +334,9 @@ NTSTATUS dcerpc_bind(struct dcerpc_pipe *p,
struct dcerpc_packet pkt;
NTSTATUS status;
DATA_BLOB blob;
- struct dcerpc_syntax_id tsyntax;
+
+ p->syntax = *syntax;
+ p->transfer_syntax = *transfer_syntax;
init_dcerpc_hdr(p, &pkt);
@@ -353,9 +355,8 @@ NTSTATUS dcerpc_bind(struct dcerpc_pipe *p,
}
pkt.u.bind.ctx_list[0].context_id = 0;
pkt.u.bind.ctx_list[0].num_transfer_syntaxes = 1;
- pkt.u.bind.ctx_list[0].abstract_syntax = *syntax;
- tsyntax = *transfer_syntax;
- pkt.u.bind.ctx_list[0].transfer_syntaxes = &tsyntax;
+ pkt.u.bind.ctx_list[0].abstract_syntax = p->syntax;
+ pkt.u.bind.ctx_list[0].transfer_syntaxes = &p->transfer_syntax;
pkt.u.bind.auth_info = data_blob(NULL, 0);
/* construct the NDR form of the packet */
@@ -376,13 +377,13 @@ NTSTATUS dcerpc_bind(struct dcerpc_pipe *p,
return status;
}
- if ((pkt.ptype != DCERPC_PKT_BIND_ACK && pkt.ptype != DCERPC_PKT_ALTER_ACK) ||
+ if ((pkt.ptype != DCERPC_PKT_BIND_ACK) ||
pkt.u.bind_ack.num_results == 0 ||
pkt.u.bind_ack.ctx_list[0].result != 0) {
status = NT_STATUS_UNSUCCESSFUL;
}
- if (pkt.ptype != DCERPC_PKT_ALTER_ACK) {
+ if (pkt.ptype == DCERPC_PKT_BIND_ACK) {
p->srv_max_xmit_frag = pkt.u.bind_ack.max_xmit_frag;
p->srv_max_recv_frag = pkt.u.bind_ack.max_recv_frag;
}
@@ -399,6 +400,75 @@ NTSTATUS dcerpc_bind(struct dcerpc_pipe *p,
}
/*
+ perform a alter context using the given syntax
+
+ the auth_info structure is updated with the reply authentication info
+ on success
+*/
+NTSTATUS dcerpc_alter(struct dcerpc_pipe *p,
+ TALLOC_CTX *mem_ctx)
+{
+ struct dcerpc_packet pkt;
+ NTSTATUS status;
+ DATA_BLOB blob;
+
+ init_dcerpc_hdr(p, &pkt);
+
+ pkt.ptype = DCERPC_PKT_ALTER;
+ pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
+ pkt.call_id = p->call_id;
+ pkt.auth_length = 0;
+
+ pkt.u.alter.max_xmit_frag = 0x2000;
+ pkt.u.alter.max_recv_frag = 0x2000;
+ pkt.u.alter.assoc_group_id = 0;
+ pkt.u.alter.num_contexts = 1;
+ pkt.u.alter.ctx_list = talloc(mem_ctx, sizeof(pkt.u.alter.ctx_list[0]));
+ if (!pkt.u.alter.ctx_list) {
+ return NT_STATUS_NO_MEMORY;
+ }
+ pkt.u.alter.ctx_list[0].context_id = 0;
+ pkt.u.alter.ctx_list[0].num_transfer_syntaxes = 1;
+ pkt.u.alter.ctx_list[0].abstract_syntax = p->syntax;
+ pkt.u.alter.ctx_list[0].transfer_syntaxes = &p->transfer_syntax;
+ pkt.u.alter.auth_info = data_blob(NULL, 0);
+
+ /* construct the NDR form of the packet */
+ status = dcerpc_push_auth(&blob, mem_ctx, &pkt, p->security_state.auth_info);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ /* send it on its way */
+ status = p->transport.full_request(p, mem_ctx, &blob, &blob);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ /* unmarshall the NDR */
+ status = dcerpc_pull(&blob, mem_ctx, &pkt);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ if ((pkt.ptype != DCERPC_PKT_ALTER_ACK) ||
+ pkt.u.alter_ack.num_results == 0 ||
+ pkt.u.alter_ack.ctx_list[0].result != 0) {
+ status = NT_STATUS_UNSUCCESSFUL;
+ }
+
+ /* the bind_ack might contain a reply set of credentials */
+ if (p->security_state.auth_info && pkt.u.alter_ack.auth_info.length) {
+ status = ndr_pull_struct_blob(&pkt.u.alter_ack.auth_info,
+ mem_ctx,
+ p->security_state.auth_info,
+ (ndr_pull_flags_fn_t)ndr_pull_dcerpc_auth);
+ }
+
+ return status;
+}
+
+/*
perform a continued bind (and auth3)
*/
NTSTATUS dcerpc_auth3(struct dcerpc_pipe *p,
diff --git a/source4/librpc/rpc/dcerpc.h b/source4/librpc/rpc/dcerpc.h
index 4f50b261e2..db7552278a 100644
--- a/source4/librpc/rpc/dcerpc.h
+++ b/source4/librpc/rpc/dcerpc.h
@@ -40,7 +40,10 @@ struct dcerpc_pipe {
uint_t flags;
struct dcerpc_security security_state;
const char *binding_string;
-
+
+ struct dcerpc_syntax_id syntax;
+ struct dcerpc_syntax_id transfer_syntax;
+
struct dcerpc_transport {
enum dcerpc_transport_t transport;
void *private;
diff --git a/source4/librpc/rpc/dcerpc_auth.c b/source4/librpc/rpc/dcerpc_auth.c
index 92f1a88485..43b2212d60 100644
--- a/source4/librpc/rpc/dcerpc_auth.c
+++ b/source4/librpc/rpc/dcerpc_auth.c
@@ -44,7 +44,7 @@ NTSTATUS dcerpc_bind_auth_none(struct dcerpc_pipe *p,
return status;
}
-NTSTATUS dcerpc_bind_auth(struct dcerpc_pipe *p, uint8_t auth_type,
+NTSTATUS dcerpc_bind_auth3(struct dcerpc_pipe *p, uint8_t auth_type,
const char *uuid, uint_t version)
{
NTSTATUS status;
@@ -126,4 +126,90 @@ done:
return status;
}
+NTSTATUS dcerpc_bind_alter(struct dcerpc_pipe *p, uint8_t auth_type,
+ const char *uuid, uint_t version)
+{
+ NTSTATUS status;
+ TALLOC_CTX *mem_ctx;
+ DATA_BLOB credentials;
+ DATA_BLOB null_data_blob = data_blob(NULL, 0);
+
+ mem_ctx = talloc_init("dcerpc_bind_auth");
+ if (!mem_ctx) {
+ return NT_STATUS_NO_MEMORY;
+ }
+
+ if (!p->security_state.generic_state) {
+ status = gensec_client_start(&p->security_state.generic_state);
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+
+ status = gensec_start_mech_by_authtype(p->security_state.generic_state, auth_type);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ return status;
+ }
+ }
+
+ p->security_state.auth_info = talloc(p->mem_ctx, sizeof(*p->security_state.auth_info));
+ if (!p->security_state.auth_info) {
+ status = NT_STATUS_NO_MEMORY;
+ goto done;
+ }
+
+ p->security_state.auth_info->auth_type = auth_type;
+ p->security_state.auth_info->auth_pad_length = 0;
+ p->security_state.auth_info->auth_reserved = 0;
+ p->security_state.auth_info->auth_context_id = random();
+ p->security_state.auth_info->credentials = null_data_blob;
+
+ if (p->flags & DCERPC_SEAL) {
+ p->security_state.auth_info->auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
+ } else if (p->flags & DCERPC_SIGN) {
+ p->security_state.auth_info->auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
+ } else {
+ p->security_state.auth_info->auth_level = DCERPC_AUTH_LEVEL_NONE;
+ }
+
+ status = gensec_update(p->security_state.generic_state, mem_ctx,
+ null_data_blob,
+ &credentials);
+
+ if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+ goto done;
+ }
+
+ p->security_state.auth_info->credentials = credentials;
+
+ status = dcerpc_bind_byuuid(p, mem_ctx, uuid, version);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto done;
+ }
+ while(1) {
+ status = gensec_update(p->security_state.generic_state, mem_ctx,
+ p->security_state.auth_info->credentials,
+ &credentials);
+
+ if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
+ goto done;
+ }
+
+ p->security_state.auth_info->credentials = credentials;
+
+ status = dcerpc_alter(p, mem_ctx);
+ if (!NT_STATUS_IS_OK(status)) {
+ goto done;
+ }
+ }
+
+done:
+ talloc_destroy(mem_ctx);
+
+ if (!NT_STATUS_IS_OK(status)) {
+ ZERO_STRUCT(p->security_state);
+ }
+
+ return status;
+}
diff --git a/source4/librpc/rpc/dcerpc_ntlm.c b/source4/librpc/rpc/dcerpc_ntlm.c
index 0f02669eb1..1f8dbc993e 100644
--- a/source4/librpc/rpc/dcerpc_ntlm.c
+++ b/source4/librpc/rpc/dcerpc_ntlm.c
@@ -67,7 +67,7 @@ NTSTATUS dcerpc_bind_auth_ntlm(struct dcerpc_pipe *p,
return status;
}
- status = dcerpc_bind_auth(p, DCERPC_AUTH_TYPE_NTLMSSP,
+ status = dcerpc_bind_auth3(p, DCERPC_AUTH_TYPE_NTLMSSP,
uuid, version);
if (!NT_STATUS_IS_OK(status)) {
diff --git a/source4/librpc/rpc/dcerpc_schannel.c b/source4/librpc/rpc/dcerpc_schannel.c
index ffe60b1bae..73d27cdfa9 100644
--- a/source4/librpc/rpc/dcerpc_schannel.c
+++ b/source4/librpc/rpc/dcerpc_schannel.c
@@ -476,7 +476,7 @@ NTSTATUS dcerpc_bind_auth_schannel(struct dcerpc_pipe *p,
return status;
}
- status = dcerpc_bind_auth(p, DCERPC_AUTH_TYPE_SCHANNEL,
+ status = dcerpc_bind_auth3(p, DCERPC_AUTH_TYPE_SCHANNEL,
uuid, version);
if (!NT_STATUS_IS_OK(status)) {
diff --git a/source4/librpc/rpc/dcerpc_spnego.c b/source4/librpc/rpc/dcerpc_spnego.c
index 141ea787e7..37f2c75b65 100644
--- a/source4/librpc/rpc/dcerpc_spnego.c
+++ b/source4/librpc/rpc/dcerpc_spnego.c
@@ -67,7 +67,7 @@ NTSTATUS dcerpc_bind_auth_spnego(struct dcerpc_pipe *p,
return status;
}
- status = dcerpc_bind_auth(p, DCERPC_AUTH_TYPE_SPNEGO,
+ status = dcerpc_bind_alter(p, DCERPC_AUTH_TYPE_SPNEGO,
uuid, version);
if (!NT_STATUS_IS_OK(status)) {