From 8586dda29b79f041cac2879ecff0afa3283dfca1 Mon Sep 17 00:00:00 2001 From: Luke Leighton Date: Mon, 27 Oct 1997 15:09:23 +0000 Subject: added LSA Open Policy query and response processing to smbclient (This used to be commit 16cc27852bf54999db4b0a3665b0743d9fe0e74a) --- source3/client/ntclient.c | 129 ++++++++++++++++++++++++++++++++++++++++++++++ source3/include/proto.h | 6 +++ source3/include/smb.h | 22 ++++++++ source3/lsaparse.c | 35 +++++++++++++ source3/pipentlsa.c | 43 +++++++++++++++- source3/smbparse.c | 52 +++++++++++++++++++ 6 files changed, 286 insertions(+), 1 deletion(-) diff --git a/source3/client/ntclient.c b/source3/client/ntclient.c index 93793cfccb..dab8bb1902 100644 --- a/source3/client/ntclient.c +++ b/source3/client/ntclient.c @@ -84,6 +84,102 @@ static uint16 open_rpc_pipe(char *inbuf, char *outbuf, char *rname, int Client, return fnum; } +/**************************************************************************** +do a LSA Open Policy +****************************************************************************/ +static BOOL do_lsa_open_policy(uint16 fnum, char *server_name, LSA_POL_HND *hnd) +{ + char *rparam = NULL; + char *rdata = NULL; + char *p; + int rdrcnt,rprcnt; + pstring data; /* only 1024 bytes */ + uint16 setup[2]; /* only need 2 uint16 setup parameters */ + LSA_Q_OPEN_POL q_o; + int call_id = 0x1; + BOOL valid_pol = False; + + if (hnd == NULL) return False; + + /* create and send a MSRPC command with api LSA_OPENPOLICY */ + + DEBUG(4,("LSA Open Policy\n")); + + /* store the parameters */ + make_q_open_pol(&q_o, server_name, 0, 0, 0x1); + + /* turn parameters into data stream */ + p = lsa_io_q_open_pol(False, &q_o, data + 0x18, data, 4, 0); + + /* create the request RPC_HDR with no data */ + create_rpc_request(call_id, LSA_OPENPOLICY, data, PTR_DIFF(p, data)); + + /* create setup parameters. */ + SIVAL(setup, 0, 0x0026); /* 0x26 indicates "transact named pipe" */ + SIVAL(setup, 2, fnum); /* file handle, from the SMBcreateX pipe, earlier */ + + /* send the data on \PIPE\ */ + if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024, + BUFFER_SIZE, + &rprcnt, &rdrcnt, + NULL, data, setup, + &rparam, &rdata)) + { + LSA_R_OPEN_POL r_o; + RPC_HDR hdr; + int hdr_len; + int pkt_len; + + DEBUG(5, ("cli_call_api: return OK\n")); + + p = rdata; + + if (p) p = smb_io_rpc_hdr (True, &hdr, p, rdata, 4, 0); + if (p) p = align_offset(p, rdata, 4); /* oh, what a surprise */ + + hdr_len = PTR_DIFF(p, rdata); + + if (p && hdr_len != hdr.frag_len - hdr.alloc_hint) + { + /* header length not same as calculated header length */ + DEBUG(2,("do_lsa_open_policy: hdr_len %x != frag_len-alloc_hint\n", + hdr_len, hdr.frag_len - hdr.alloc_hint)); + p = NULL; + } + + if (p) p = lsa_io_r_open_pol(True, &r_o, p, rdata, 4, 0); + + pkt_len = PTR_DIFF(p, rdata); + + if (p && pkt_len != hdr.frag_len) + { + /* packet data size not same as reported fragment length */ + DEBUG(2,("do_lsa_open_policy: pkt_len %x != frag_len \n", + pkt_len, hdr.frag_len)); + p = NULL; + } + + if (p && r_o.status != 0) + { + /* report error code */ + DEBUG(0,("LSA_REQ_CHAL: nt_status error %lx\n", r_o.status)); + p = NULL; + } + + if (p) + { + /* ok, at last: we're happy. return the policy handle */ + memcpy(hnd, r_o.pol.data, sizeof(hnd->data)); + valid_pol = True; + } + } + + if (rparam) free(rparam); + if (rdata) free(rdata); + + return valid_pol; +} + /**************************************************************************** do a LSA Request Challenge ****************************************************************************/ @@ -554,6 +650,7 @@ BOOL do_nt_login(char *desthost, char *myhostname, DOM_ID_INFO_1 id1; LSA_USER_INFO user_info1; + LSA_POL_HND pol; UTIME zerotime; @@ -561,6 +658,7 @@ BOOL do_nt_login(char *desthost, char *myhostname, char nt_owf_mach_pwd[16]; fstring mach_acct; fstring mach_pwd; + fstring server_name; uint16 fnum; char *inbuf,*outbuf; @@ -576,6 +674,33 @@ BOOL do_nt_login(char *desthost, char *myhostname, return False; } + /******************* open the \PIPE\lsarpc file *****************/ + + if ((fnum = open_rpc_pipe(inbuf, outbuf, PIPE_LSARPC, Client, cnum)) == 0xffff) + { + free(inbuf); free(outbuf); + return False; + } + + /******************* Open Policy ********************/ + + fstrcpy(server_name, ("\\\\")); + fstrcpy(&server_name[2], myhostname); + + /* send an open policy request; receive a policy handle */ + if (!do_lsa_open_policy(fnum, server_name, &pol)) + { + cli_smb_close(inbuf, outbuf, Client, cnum, fnum); + free(inbuf); free(outbuf); + return False; + } + + /******************* close the \PIPE\lsarpc file *******************/ + + cli_smb_close(inbuf, outbuf, Client, cnum, fnum); + + + /******************* open the \PIPE\NETLOGON file *****************/ if ((fnum = open_rpc_pipe(inbuf, outbuf, PIPE_NETLOGON, Client, cnum)) == 0xffff) @@ -696,7 +821,11 @@ BOOL do_nt_login(char *desthost, char *myhostname, return False; } + /******************** close the \PIPE\NETLOGON file **************/ + cli_smb_close(inbuf, outbuf, Client, cnum, fnum); + + /* free memory used in all rpc transactions, above */ free(inbuf); free(outbuf); return True; diff --git a/source3/include/proto.h b/source3/include/proto.h index cdecd1ec88..6bb91e8c1f 100644 --- a/source3/include/proto.h +++ b/source3/include/proto.h @@ -373,6 +373,10 @@ struct share_ops *locking_slow_init(int ronly); /*The following definitions come from lsaparse.c */ +void make_q_open_pol(LSA_Q_OPEN_POL *r_q, char *server_name, + uint32 attributes, uint32 sec_qos, + uint16 desired_access); +char* lsa_io_q_open_pol(BOOL io, LSA_Q_OPEN_POL *r_q, char *q, char *base, int align, int depth); char* lsa_io_r_open_pol(BOOL io, LSA_R_OPEN_POL *r_p, char *q, char *base, int align, int depth); char* lsa_io_q_query(BOOL io, LSA_Q_QUERY_INFO *q_q, char *q, char *base, int align, int depth); char* lsa_io_r_query(BOOL io, LSA_R_QUERY_INFO *r_q, char *q, char *base, int align, int depth); @@ -944,6 +948,8 @@ char* smb_io_gid(BOOL io, DOM_GID *gid, char *q, char *base, int align, int dept void make_rpc_header(RPC_HDR *hdr, enum RPC_PKT_TYPE pkt_type, uint32 call_id, int data_len, uint8 opnum); char* smb_io_rpc_hdr(BOOL io, RPC_HDR *rpc, char *q, char *base, int align, int depth); +void make_obj_attr(LSA_OBJ_ATTR *attr, uint32 attributes, uint32 sec_qos); +char* smb_io_obj_attr(BOOL io, LSA_OBJ_ATTR *attr, char *q, char *base, int align, int depth); char* smb_io_pol_hnd(BOOL io, LSA_POL_HND *pol, char *q, char *base, int align, int depth); char* smb_io_dom_query_3(BOOL io, DOM_QUERY_3 *d_q, char *q, char *base, int align, int depth); char* smb_io_dom_query_5(BOOL io, DOM_QUERY_3 *d_q, char *q, char *base, int align, int depth); diff --git a/source3/include/smb.h b/source3/include/smb.h index 7019d41de0..e9734f379d 100644 --- a/source3/include/smb.h +++ b/source3/include/smb.h @@ -265,6 +265,7 @@ typedef fstring string; #define PIPE_SRVSVC "\\PIPE\\srvsvc" #define PIPE_NETLOGON "\\PIPE\\NETLOGON" #define PIPE_NTLSA "\\PIPE\\ntlsa" +#define PIPE_LSARPC "\\PIPE\\lsarpc" /* NETLOGON opcodes and data structures */ @@ -579,6 +580,27 @@ typedef struct lsa_policy_info } LSA_POL_HND; +/* OBJ_ATTR (object attributes) */ +typedef struct object_attributes_info +{ + uint32 len; /* 0x18 - length (in bytes) inc. the length field. */ + uint32 ptr_root_dir; /* 0 - root directory (pointer) */ + uint32 ptr_obj_name; /* 0 - object name (pointer) */ + uint32 attributes; /* 0 - attributes (undocumented) */ + uint32 ptr_sec_desc; /* 0 - security descriptior (pointer) */ + uint32 sec_qos; /* 0 - security quality of service */ + +} LSA_OBJ_ATTR; + +/* LSA_Q_OPEN_POL - LSA Query Open Policy */ +typedef struct lsa_q_open_pol_info +{ + UNISTR2 uni_server_name; /* server name, starting with two '\'s */ + LSA_OBJ_ATTR attr ; /* object attributes */ + + uint32 des_access; /* desired access attributes */ + +} LSA_Q_OPEN_POL; /* LSA_R_OPEN_POL - response to LSA Open Policy */ typedef struct lsa_r_open_pol_info diff --git a/source3/lsaparse.c b/source3/lsaparse.c index 33813ce7af..37cc51bbf8 100644 --- a/source3/lsaparse.c +++ b/source3/lsaparse.c @@ -24,6 +24,41 @@ extern int DEBUGLEVEL; +/******************************************************************* +makes an LSA_Q_OPEN_POL structure. +********************************************************************/ +void make_q_open_pol(LSA_Q_OPEN_POL *r_q, char *server_name, + uint32 attributes, uint32 sec_qos, + uint16 desired_access) +{ + if (r_q == NULL) return; + + DEBUG(5,("make_open_pol\n")); + + make_unistr2 (&(r_q->uni_server_name), server_name, strlen(server_name)); + make_obj_attr(&(r_q->attr ), attributes, sec_qos); + + r_q->des_access = desired_access; +} + +/******************************************************************* +reads or writes an LSA_Q_OPEN_POL structure. +********************************************************************/ +char* lsa_io_q_open_pol(BOOL io, LSA_Q_OPEN_POL *r_q, char *q, char *base, int align, int depth) +{ + if (r_q == NULL) return NULL; + + DEBUG(5,("%s%04x lsa_io_q_open_pol\n", tab_depth(depth), PTR_DIFF(q, base))); + depth++; + + q = smb_io_unistr2 (io, &(r_q->uni_server_name), q, base, align, depth); + q = smb_io_obj_attr(io, &(r_q->attr ), q, base, align, depth); + + DBG_RW_SVAL("des_access", depth, base, io, q, r_q->des_access); q += 2; + + return q; +} + /******************************************************************* reads or writes an LSA_R_OPEN_POL structure. ********************************************************************/ diff --git a/source3/pipentlsa.c b/source3/pipentlsa.c index 05c6194263..4fc61f8e5b 100644 --- a/source3/pipentlsa.c +++ b/source3/pipentlsa.c @@ -34,6 +34,9 @@ extern int DEBUGLEVEL; #ifdef NTDOMAIN +/*************************************************************************** +lsa_reply_open_policy + ***************************************************************************/ static int lsa_reply_open_policy(char *q, char *base) { int i; @@ -54,6 +57,9 @@ static int lsa_reply_open_policy(char *q, char *base) return PTR_DIFF(q, base); } +/*************************************************************************** +make_dom_query + ***************************************************************************/ static void make_dom_query(DOM_QUERY *d_q, char *dom_name, char *dom_sid) { int domlen = strlen(dom_name); @@ -70,6 +76,9 @@ static void make_dom_query(DOM_QUERY *d_q, char *dom_name, char *dom_sid) make_dom_sid(&(d_q->dom_sid), dom_sid); } +/*************************************************************************** +lsa_reply_query_info + ***************************************************************************/ static int lsa_reply_query_info(LSA_Q_QUERY_INFO *q_q, char *q, char *base, char *dom_name, char *dom_sid) { @@ -91,7 +100,12 @@ static int lsa_reply_query_info(LSA_Q_QUERY_INFO *q_q, char *q, char *base, return PTR_DIFF(q, base); } -/* pretty much hard-coded choice of "other" sids, unfortunately... */ +/*************************************************************************** +make_dom_ref + + pretty much hard-coded choice of "other" sids, unfortunately... + + ***************************************************************************/ static void make_dom_ref(DOM_R_REF *ref, char *dom_name, char *dom_sid, char *other_sid1, char *other_sid2, char *other_sid3) @@ -123,6 +137,9 @@ static void make_dom_ref(DOM_R_REF *ref, make_dom_sid(&(ref->ref_dom[3]), other_sid3); } +/*************************************************************************** +make_reply_lookup_rids + ***************************************************************************/ static void make_reply_lookup_rids(LSA_R_LOOKUP_RIDS *r_l, int num_entries, uint32 dom_rids[MAX_LOOKUP_SIDS], char *dom_name, char *dom_sid, @@ -145,6 +162,9 @@ static void make_reply_lookup_rids(LSA_R_LOOKUP_RIDS *r_l, r_l->num_entries3 = num_entries; } +/*************************************************************************** +make_reply_lookup_sids + ***************************************************************************/ static void make_reply_lookup_sids(LSA_R_LOOKUP_SIDS *r_l, int num_entries, fstring dom_sids[MAX_LOOKUP_SIDS], char *dom_name, char *dom_sid, @@ -167,6 +187,9 @@ static void make_reply_lookup_sids(LSA_R_LOOKUP_SIDS *r_l, r_l->num_entries3 = num_entries; } +/*************************************************************************** +lsa_reply_lookup_sids + ***************************************************************************/ static int lsa_reply_lookup_sids(char *q, char *base, int num_entries, fstring dom_sids[MAX_LOOKUP_SIDS], char *dom_name, char *dom_sid, @@ -186,6 +209,9 @@ static int lsa_reply_lookup_sids(char *q, char *base, return PTR_DIFF(q, base); } +/*************************************************************************** +lsa_reply_lookup_rids + ***************************************************************************/ static int lsa_reply_lookup_rids(char *q, char *base, int num_entries, uint32 dom_rids[MAX_LOOKUP_SIDS], char *dom_name, char *dom_sid, @@ -205,6 +231,9 @@ static int lsa_reply_lookup_rids(char *q, char *base, return PTR_DIFF(q, base); } +/*************************************************************************** +api_lsa_open_policy + ***************************************************************************/ static void api_lsa_open_policy( char *param, char *data, char **rdata, int *rdata_len ) { @@ -215,6 +244,9 @@ static void api_lsa_open_policy( char *param, char *data, *rdata_len = lsa_reply_open_policy(*rdata + 0x18, *rdata); } +/*************************************************************************** +api_lsa_query_info + ***************************************************************************/ static void api_lsa_query_info( char *param, char *data, char **rdata, int *rdata_len ) { @@ -233,6 +265,9 @@ static void api_lsa_query_info( char *param, char *data, dom_name, dom_sid); } +/*************************************************************************** +api_lsa_lookup_sids + ***************************************************************************/ static void api_lsa_lookup_sids( char *param, char *data, char **rdata, int *rdata_len ) { @@ -261,6 +296,9 @@ static void api_lsa_lookup_sids( char *param, char *data, "S-1-1", "S-1-3", "S-1-5"); /* the three other SIDs */ } +/*************************************************************************** +api_lsa_lookup_names + ***************************************************************************/ static void api_lsa_lookup_names( char *param, char *data, char **rdata, int *rdata_len ) { @@ -295,6 +333,9 @@ static void api_lsa_lookup_names( char *param, char *data, "S-1-1", "S-1-3", "S-1-5"); /* the three other SIDs */ } +/*************************************************************************** +api_ntLsarpcTNP + ***************************************************************************/ BOOL api_ntLsarpcTNP(int cnum,int uid, char *param,char *data, int mdrcnt,int mprcnt, char **rdata,char **rparam, diff --git a/source3/smbparse.c b/source3/smbparse.c index 785ae74b17..028f172b8e 100644 --- a/source3/smbparse.c +++ b/source3/smbparse.c @@ -839,6 +839,58 @@ char* smb_io_rpc_hdr(BOOL io, RPC_HDR *rpc, char *q, char *base, int align, int return q; } +/******************************************************************* +makes an LSA_OBJ_ATTR structure. +********************************************************************/ +void make_obj_attr(LSA_OBJ_ATTR *attr, uint32 attributes, uint32 sec_qos) +{ + if (attr == NULL) return; + + DEBUG(5,("make_obj_attr\n")); + + attr->len = 0x18; /* length of object attribute block, in bytes */ + attr->ptr_root_dir = 0; + attr->ptr_obj_name = 0; + attr->attributes = attributes; + attr->ptr_sec_desc = 0; + attr->sec_qos = sec_qos; +} + +/******************************************************************* +reads or writes an LSA_OBJ_ATTR structure. +********************************************************************/ +char* smb_io_obj_attr(BOOL io, LSA_OBJ_ATTR *attr, char *q, char *base, int align, int depth) +{ + char *start; + + if (attr == NULL) return NULL; + + DEBUG(5,("%s%04x smb_io_obj_attr\n", tab_depth(depth), PTR_DIFF(q, base))); + depth++; + + q = align_offset(q, base, align); + + start = q; + + /* these pointers had _better_ be zero, because we don't know + what they point to! + */ + DBG_RW_IVAL("len" , depth, base, io, q, attr->len ); q += 4; /* 0x18 - length (in bytes) inc. the length field. */ + DBG_RW_IVAL("ptr_root_dir", depth, base, io, q, attr->ptr_root_dir); q += 4; /* 0 - root directory (pointer) */ + DBG_RW_IVAL("ptr_obj_name", depth, base, io, q, attr->ptr_obj_name); q += 4; /* 0 - object name (pointer) */ + DBG_RW_IVAL("attributes" , depth, base, io, q, attr->attributes ); q += 4; /* 0 - attributes (undocumented) */ + DBG_RW_IVAL("ptr_sec_desc", depth, base, io, q, attr->ptr_sec_desc); q += 4; /* 0 - security descriptior (pointer) */ + DBG_RW_IVAL("sec_qos" , depth, base, io, q, attr->sec_qos ); q += 4; /* 0 - security quality of service */ + + if (attr->len != PTR_DIFF(q, start)) + { + DEBUG(3,("smb_io_obj_attr: length %lx does not match size %lx\n", + attr->len, PTR_DIFF(q, start))); + } + + return q; +} + /******************************************************************* reads or writes an LSA_POL_HND structure. ********************************************************************/ -- cgit