From 2fef8f2e87f61043e3f1a2cf7d1f2a4ff9f119ff Mon Sep 17 00:00:00 2001 From: Luke Leighton Date: Wed, 7 Oct 1998 15:22:49 +0000 Subject: dce/rpc (This used to be commit 34afa638f6f7bb145ec094510ac58f7a22dfc3aa) --- source3/include/proto.h | 3 +++ source3/include/rpc_dce.h | 22 +++++++++--------- source3/rpc_parse/parse_prs.c | 8 +++++++ source3/rpc_parse/parse_rpc.c | 15 +++++-------- source3/rpc_server/srv_pipe_hnd.c | 14 ++++++++++++ source3/smbd/ipc.c | 12 +++++++++- source3/smbd/pipes.c | 47 ++++++++++++++++++++++++++++++++++++++- source3/smbd/process.c | 2 +- source3/smbd/reply.c | 4 ++++ 9 files changed, 105 insertions(+), 22 deletions(-) diff --git a/source3/include/proto.h b/source3/include/proto.h index e5b6c0b08e..7492cb7615 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -1489,6 +1489,7 @@ void prs_init(prs_struct *ps, uint32 size, uint8 align, uint32 margin, BOOL io); void prs_mem_free(prs_struct *ps); +void prs_link(prs_struct *ps, prs_struct const *const to); void prs_align(prs_struct *ps); BOOL prs_grow(prs_struct *ps); BOOL prs_uint8(char *name, prs_struct *ps, int depth, uint8 *data8); @@ -1827,6 +1828,7 @@ void reset_chain_p(void); void init_rpc_pipe_hnd(void); pipes_struct *open_rpc_pipe_p(char *pipe_name, connection_struct *conn, uint16 vuid); +int write_pipe(pipes_struct *p, char *data, int n); int read_pipe(pipes_struct *p, char *data, uint32 pos, int n); BOOL set_rpc_pipe_hnd_state(pipes_struct *p, uint16 device_state); BOOL close_rpc_pipe_hnd(pipes_struct *p, connection_struct *conn); @@ -2160,6 +2162,7 @@ BOOL domain_client_validate( char *user, char *domain, int reply_open_pipe_and_X(connection_struct *conn, char *inbuf,char *outbuf,int length,int bufsize); +int reply_pipe_write_and_X(char *inbuf,char *outbuf,int length,int bufsize); int reply_pipe_read_and_X(char *inbuf,char *outbuf,int length,int bufsize); int reply_pipe_close(connection_struct *conn, char *inbuf,char *outbuf); diff --git a/source3/include/rpc_dce.h b/source3/include/rpc_dce.h index 4362b40cd2..a599abb19c 100644 --- a/source3/include/rpc_dce.h +++ b/source3/include/rpc_dce.h @@ -47,7 +47,7 @@ enum NTLM_MESSAGE_TYPE NTLMSSP_NEGOTIATE = 1, NTLMSSP_CHALLENGE = 2, NTLMSSP_AUTH = 3, - NTLMSSP_UNKNOWN = 4 + NTLMSSP_UNKNOWN = 4, }; /* NTLMSSP negotiation flags */ @@ -220,7 +220,9 @@ typedef struct rpc_auth_ntlmssp_chal_info uint32 neg_flags; /* 0x0000 82b1 */ uint8 challenge[8]; /* ntlm challenge */ +#if 0 uint8 reserved [8]; /* zeros */ +#endif } RPC_AUTH_NTLMSSP_CHAL; @@ -231,17 +233,17 @@ typedef struct rpc_auth_ntlmssp_resp_info STRHDR hdr_lm_resp; /* 24 byte response */ STRHDR hdr_nt_resp; /* 24 byte response */ STRHDR hdr_domain; - UNIHDR hdr_usr; - UNIHDR hdr_wks; - UNIHDR hdr_sess_key; /* NULL unless negotiated */ + STRHDR hdr_usr; + STRHDR hdr_wks; + STRHDR hdr_sess_key; /* NULL unless negotiated */ uint32 neg_flags; /* 0x0000 82b1 */ - fstring uni_sess_key; - fstring uni_wks; - fstring uni_usr; - fstring uni_domain; - fstring str_nt_resp; - fstring str_lm_resp; + fstring sess_key; + fstring wks; + fstring user; + fstring domain; + fstring nt_resp; + fstring lm_resp; } RPC_AUTH_NTLMSSP_RESP; diff --git a/source3/rpc_parse/parse_prs.c b/source3/rpc_parse/parse_prs.c index f166bbd704..34f72596ce 100644 --- a/source3/rpc_parse/parse_prs.c +++ b/source3/rpc_parse/parse_prs.c @@ -66,6 +66,14 @@ void prs_mem_free(prs_struct *ps) mem_buf_free(&(ps->data)); } +/******************************************************************* + link one parsing structure to another + ********************************************************************/ +void prs_link(prs_struct *ps, prs_struct const *const to) +{ + DEBUG(0,("NOT IMPLEMENTED\n")); +} + /******************************************************************* align a pointer to a multiple of align_offset bytes. looks like it will work for offsets of 0, 2 and 4... diff --git a/source3/rpc_parse/parse_rpc.c b/source3/rpc_parse/parse_rpc.c index 6a1d2f5713..90a013dc12 100644 --- a/source3/rpc_parse/parse_rpc.c +++ b/source3/rpc_parse/parse_rpc.c @@ -470,7 +470,7 @@ void make_rpc_auth_verifier(RPC_AUTH_VERIFIER *rav, rav->stub_type_len = stub_type_len; /* 0x00 */ rav->padding = 0; /* padding 0x00 */ - rav->ptr_0 = 1; /* non-zero pointer to something */ + rav->ptr_0 = 0x0014a0c0; /* non-zero pointer to something */ fstrcpy(rav->signature, signature); /* "NTLMSSP" */ rav->msg_type = msg_type; /* NTLMSSP_MESSAGE_TYPE */ @@ -511,7 +511,9 @@ void make_rpc_auth_ntlmssp_chal(RPC_AUTH_NTLMSSP_CHAL *chl, chl->neg_flags = neg_flags; /* 0x0082b1 */ memcpy(chl->challenge, challenge, sizeof(chl->challenge)); +/* bzero (chl->reserved , sizeof(chl->reserved)); + */ } /******************************************************************* @@ -529,7 +531,9 @@ void smb_io_rpc_auth_ntlmssp_chal(char *desc, RPC_AUTH_NTLMSSP_CHAL *chl, prs_st prs_uint32("neg_flags", ps, depth, &(chl->neg_flags)); /* 0x0000 82b1 */ prs_uint8s (False, "challenge", ps, depth, chl->challenge, sizeof(chl->challenge)); +/* prs_uint8s (False, "reserved ", ps, depth, chl->reserved , sizeof(chl->reserved )); + */ } /******************************************************************* @@ -551,22 +555,19 @@ void make_rpc_auth_ntlmssp_resp(RPC_AUTH_NTLMSSP_RESP *rsp, make_str_hdr(&rsp->hdr_lm_resp, lm_len, lm_len, 1); make_str_hdr(&rsp->hdr_nt_resp, nt_len, nt_len, 1); make_str_hdr(&rsp->hdr_domain , dom_len, dom_len, 1); -#if BROKEN_CODE make_str_hdr(&rsp->hdr_usr , usr_len, usr_len, 1); make_str_hdr(&rsp->hdr_wks , wks_len, wks_len, 1); make_str_hdr(&rsp->hdr_sess_key, 0, 0, 1); -#endif rsp->neg_flags = neg_flags; -#if BROKEN_CODE memcpy(&rsp->lm_resp, lm_resp, 24); memcpy(&rsp->nt_resp, nt_resp, 24); fstrcpy(rsp->domain, domain); fstrcpy(rsp->user , user ); fstrcpy(rsp->wks , wks ); rsp->sess_key[0] = 0; -#endif + } @@ -583,22 +584,18 @@ void smb_io_rpc_auth_ntlmssp_resp(char *desc, RPC_AUTH_NTLMSSP_RESP *rsp, prs_st smb_io_strhdr("hdr_lm_resp ", &rsp->hdr_lm_resp , ps, depth); smb_io_strhdr("hdr_nt_resp ", &rsp->hdr_nt_resp , ps, depth); smb_io_strhdr("hdr_domain ", &rsp->hdr_domain , ps, depth); -#if BROKEN_CODE smb_io_strhdr("hdr_user ", &rsp->hdr_usr , ps, depth); smb_io_strhdr("hdr_wks ", &rsp->hdr_wks , ps, depth); smb_io_strhdr("hdr_sess_key", &rsp->hdr_sess_key, ps, depth); -#endif prs_uint32("neg_flags", ps, depth, &(rsp->neg_flags)); /* 0x0000 82b1 */ -#if BROKEN_CODE prs_string("sess_key", ps, depth, rsp->sess_key, rsp->hdr_sess_key.str_str_len, sizeof(rsp->sess_key)); prs_string("wks ", ps, depth, rsp->wks , rsp->hdr_wks .str_str_len, sizeof(rsp->wks )); prs_string("user ", ps, depth, rsp->user , rsp->hdr_usr .str_str_len, sizeof(rsp->user )); prs_string("domain ", ps, depth, rsp->domain , rsp->hdr_domain .str_str_len, sizeof(rsp->domain )); prs_string("nt_resp ", ps, depth, rsp->nt_resp , rsp->hdr_nt_resp .str_str_len, sizeof(rsp->nt_resp )); prs_string("lm_resp ", ps, depth, rsp->lm_resp , rsp->hdr_lm_resp .str_str_len, sizeof(rsp->lm_resp )); -#endif } #if 0 diff --git a/source3/rpc_server/srv_pipe_hnd.c b/source3/rpc_server/srv_pipe_hnd.c index cb1ec963d9..e898a8606f 100644 --- a/source3/rpc_server/srv_pipe_hnd.c +++ b/source3/rpc_server/srv_pipe_hnd.c @@ -153,6 +153,20 @@ pipes_struct *open_rpc_pipe_p(char *pipe_name, } +/**************************************************************************** + writes data to a pipe. + ****************************************************************************/ +int write_pipe(pipes_struct *p, char *data, int n) +{ + DEBUG(6,("write_pipe: %x", p->pnum)); + + DEBUG(6,("name: %s open: %s len: %d", + p->name, BOOLSTR(p->open), n)); + + return -1; +} + + /**************************************************************************** reads data from a pipe. diff --git a/source3/smbd/ipc.c b/source3/smbd/ipc.c index ebb3c11da8..f2831ce888 100644 --- a/source3/smbd/ipc.c +++ b/source3/smbd/ipc.c @@ -3159,6 +3159,7 @@ static struct api_cmd api_fd_commands[] = static BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *pd) { BOOL ntlmssp_auth = False; + uint16 assoc_gid; fstring ack_pipe_name; int i = 0; @@ -3214,10 +3215,19 @@ static BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *pd) /*** do the bind ack first ***/ /***/ + if (ntlmssp_auth) + { + assoc_gid = 0x7a77; + } + else + { + assoc_gid = p->hdr_rb.bba.assoc_gid; + } + make_rpc_hdr_ba(&p->hdr_ba, p->hdr_rb.bba.max_tsize, p->hdr_rb.bba.max_rsize, - p->hdr_rb.bba.assoc_gid, + assoc_gid, ack_pipe_name, 0x1, 0x0, 0x0, &(p->hdr_rb.transfer)); diff --git a/source3/smbd/pipes.c b/source3/smbd/pipes.c index 15d395b29a..00eec4e0e3 100644 --- a/source3/smbd/pipes.c +++ b/source3/smbd/pipes.c @@ -105,6 +105,50 @@ int reply_open_pipe_and_X(connection_struct *conn, } +/**************************************************************************** + reply to a write and X + + This code is basically stolen from reply_write_and_X with some + wrinkles to handle pipes. +****************************************************************************/ +int reply_pipe_write_and_X(char *inbuf,char *outbuf,int length,int bufsize) +{ + pipes_struct *p = get_rpc_pipe_p(inbuf,smb_vwv2); + uint32 smb_offs = IVAL(inbuf,smb_vwv3); + size_t numtowrite = SVAL(inbuf,smb_vwv10); + BOOL write_through = BITSETW(inbuf+smb_vwv7, 0); + int nwritten = -1; + int smb_doff = SVAL(inbuf, smb_vwv11); + char *data; + + if (!p) return(ERROR(ERRDOS,ERRbadfid)); + + data = smb_buf(inbuf) + smb_doff; + + if (numtowrite == 0) + { + nwritten = 0; + } + else + { + nwritten = write_pipe(p, data, numtowrite); + } + + if ((nwritten == 0 && numtowrite != 0) || (nwritten < 0)) + { + return (UNIXERROR(ERRDOS,ERRnoaccess)); + } + + set_message(outbuf,6,0,True); + + SSVAL(outbuf,smb_vwv2,nwritten); + + DEBUG(3,("writeX-IPC pnum=%04x nwritten=%d\n", + p->pnum, nwritten)); + + return chain_reply(inbuf,outbuf,length,bufsize); +} + /**************************************************************************** reply to a read and X @@ -134,11 +178,12 @@ int reply_pipe_read_and_X(char *inbuf,char *outbuf,int length,int bufsize) SSVAL(outbuf,smb_vwv6,smb_offset(data,outbuf)); SSVAL(smb_buf(outbuf),-2,nread); - DEBUG(3,("readX pnum=%04x min=%d max=%d nread=%d\n", + DEBUG(3,("readX-IPC pnum=%04x min=%d max=%d nread=%d\n", p->pnum, smb_mincnt, smb_maxcnt, nread)); return chain_reply(inbuf,outbuf,length,bufsize); } + /**************************************************************************** reply to a close ****************************************************************************/ diff --git a/source3/smbd/process.c b/source3/smbd/process.c index 656e2e99e1..6e1bdc941a 100644 --- a/source3/smbd/process.c +++ b/source3/smbd/process.c @@ -329,7 +329,7 @@ struct smb_message_struct {SMBopenX,"SMBopenX",reply_open_and_X,AS_USER | CAN_IPC | QUEUE_IN_OPLOCK }, {SMBreadX,"SMBreadX",reply_read_and_X,AS_USER | CAN_IPC }, - {SMBwriteX,"SMBwriteX",reply_write_and_X,AS_USER}, + {SMBwriteX,"SMBwriteX",reply_write_and_X,AS_USER | CAN_IPC }, {SMBlockingX,"SMBlockingX",reply_lockingX,AS_USER}, {SMBffirst,"SMBffirst",reply_search,AS_USER}, diff --git a/source3/smbd/reply.c b/source3/smbd/reply.c index 6dfff54a0f..7cbd0520d9 100644 --- a/source3/smbd/reply.c +++ b/source3/smbd/reply.c @@ -2250,6 +2250,10 @@ int reply_write_and_X(connection_struct *conn, char *inbuf,char *outbuf,int leng int smb_doff = SVAL(inbuf,smb_vwv11); char *data; + /* If it's an IPC, pass off the pipe handler. */ + if (IS_IPC(conn)) + return reply_pipe_write_and_X(inbuf,outbuf,length,bufsize); + CHECK_FSP(fsp,conn); CHECK_WRITE(fsp); CHECK_ERROR(fsp); -- cgit