From a12f04753348e6d52df1f9a2359794deacfc9007 Mon Sep 17 00:00:00 2001 From: Luke Leighton Date: Fri, 24 Oct 1997 13:15:34 +0000 Subject: nterr.c : added a structure that wraps nt errors as strings and enums, so we can do a smb_nt_error() function. Makefile ntclient.c : added ntclient.c, broken out nt domain stuff into a separate file. getting fed up of compile-times and size of client.c. fixed the do_lsa_req_chal() function. made it read the response, and return the challenge credentials received from the server. next stop: do_lsa_auth_2(). client.c : removed nt domain logon functions into a separate file. pipenetlog.c pipentlsa.c pipesrvsvc.c smbparse.c : i'd broken the offsets of the RPC_HDR while trying to sort out the nt client code. fixed it again. added some robustness stuff. util.c : the unistrn2() function was null-terminating the string at one character too many. (This used to be commit 39cec7f698c4461aee05cfbb213879fbd486117d) --- source3/client/client.c | 171 ++--------------------------------- source3/client/ntclient.c | 222 ++++++++++++++++++++++++++++++++++++++++++++++ 2 files changed, 229 insertions(+), 164 deletions(-) create mode 100644 source3/client/ntclient.c (limited to 'source3/client') diff --git a/source3/client/client.c b/source3/client/client.c index 59dd7bc7e5..5dbb2f3b1c 100644 --- a/source3/client/client.c +++ b/source3/client/client.c @@ -147,7 +147,7 @@ static BOOL setup_term_code (char *code) /**************************************************************************** send an SMBclose on an SMB file handle ****************************************************************************/ -static void cli_smb_close(char *inbuf, char *outbuf, int clnt_fd, int c_num, int f_num) +void cli_smb_close(char *inbuf, char *outbuf, int clnt_fd, int c_num, int f_num) { bzero(outbuf,smb_size); set_message(outbuf,3,0,True); @@ -3525,165 +3525,6 @@ static BOOL process(char *base_directory) return(True); } -/**************************************************************************** -do a LSA Request Challenge -****************************************************************************/ -static BOOL do_lsa_req_chal(uint16 fnum) -{ - char *rparam = NULL; - char *rdata = NULL; - char *p; - char *rpc_hdr; - int rdrcnt,rprcnt; - int count = 0; - pstring data; /* only 1024 bytes */ - uint16 setup[2]; /* only need 2 uint16 setup parameters */ - LSA_Q_REQ_CHAL q_c; - DOM_CHAL clnt_chal; - int call_id = 0x1; - - /* create and send a MSRPC command with api LSA_REQCHAL */ - - clnt_chal.data[0] = 0x11111111; - clnt_chal.data[1] = 0x22222222; - - DEBUG(4,("LSA Request Challenge from %s to %s: %lx %lx\n", - desthost, myhostname, clnt_chal.data[0], clnt_chal.data[1])); - - /* store the parameters */ - make_q_req_chal(&q_c, desthost, myhostname, &clnt_chal); - - /* i have absolutely no idea why you do this. or what it is. help! */ - SIVAL(data, 0, 0xF400); - - rpc_hdr = data + 2; - - /* turn parameters into data stream */ - p = lsa_io_q_req_chal(False, &q_c, rpc_hdr + 0x18, rpc_hdr, 4, 5); - - /* create the request RPC_HDR _after_ the main data: length is now known */ - create_rpc_request(call_id, LSA_REQCHAL, rpc_hdr, PTR_DIFF(p, rpc_hdr)); - - /* create setup parameters. */ - SIVAL(setup, 0, 0x0026); /* 0x26 indicates "transact named pipe" */ - SIVAL(setup, 2, fnum); /* file handle, from the SMBcreateX pipe, earlier */ - - /* send the data on \PIPE\ */ - if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024, - BUFFER_SIZE, - &rprcnt,&rdrcnt, - NULL, data, setup, - &rparam,&rdata)) - { - DEBUG(5, ("cli_call_api: return OK\n")); -#if 0 - /* oh, now what??? */ - - int res = SVAL(rparam,0); - int converter=SVAL(rparam,2); - int i; - BOOL long_share_name=False; - - if (res == 0) - { - count=SVAL(rparam,4); - p = rdata; - - } -#endif - } - - if (rparam) free(rparam); - if (rdata) free(rdata); - - return(count>0); -} - -/**************************************************************************** - open an rpc pipe (\NETLOGON or \srvsvc for example) - ****************************************************************************/ -static uint16 open_rpc_pipe(char *inbuf, char *outbuf, char *rname) -{ - int fnum; - char *p; - - DEBUG(5,("open_rpc_pipe: %s\n", rname)); - - bzero(outbuf,smb_size); - set_message(outbuf,15,1 + strlen(rname),True); - - CVAL(outbuf,smb_com) = SMBopenX; - SSVAL(outbuf,smb_tid, cnum); - cli_setup_pkt(outbuf); - - SSVAL(outbuf,smb_vwv0,0xFF); - SSVAL(outbuf,smb_vwv2,1); - SSVAL(outbuf,smb_vwv3,(DENY_NONE<<4)); - SSVAL(outbuf,smb_vwv4,aSYSTEM | aHIDDEN); - SSVAL(outbuf,smb_vwv5,aSYSTEM | aHIDDEN); - SSVAL(outbuf,smb_vwv8,1); - - p = smb_buf(outbuf); - strcpy(p,rname); - p = skip_string(p,1); - - send_smb(Client,outbuf); - receive_smb(Client,inbuf,CLIENT_TIMEOUT); - - if (CVAL(inbuf,smb_rcls) != 0) - { - if (CVAL(inbuf,smb_rcls) == ERRSRV && - SVAL(inbuf,smb_err) == ERRnoresource && - cli_reopen_connection(inbuf,outbuf)) - { - return open_rpc_pipe(inbuf, outbuf, rname); - } - DEBUG(0,("opening remote pipe %s - error %s\n", rname, smb_errstr(inbuf))); - - return 0xffff; - } - - fnum = SVAL(inbuf, smb_vwv2); - - DEBUG(5,("opening pipe: fnum %d\n", fnum)); - - return fnum; -} - -/**************************************************************************** - -****************************************************************************/ -static BOOL cli_lsa_req_chal(void) -{ - uint16 fnum; - char *inbuf,*outbuf; - - inbuf = (char *)malloc(BUFFER_SIZE + SAFETY_MARGIN); - outbuf = (char *)malloc(BUFFER_SIZE + SAFETY_MARGIN); - - if (!inbuf || !outbuf) - { - DEBUG(0,("out of memory\n")); - return -1; - } - - /* open the \PIPE\NETLOGON file */ - fnum = open_rpc_pipe(inbuf, outbuf, PIPE_NETLOGON); - - if (fnum != 0xffff) - { - do_lsa_req_chal(fnum); - - /* close \PIPE\NETLOGON */ - cli_smb_close(inbuf, outbuf, Client, cnum, fnum); - - free(inbuf); free(outbuf); - return True; - } - - return False; -} - /**************************************************************************** usage on the program ****************************************************************************/ @@ -4056,12 +3897,14 @@ static void usage(char *pname) if (cli_open_sockets(port)) { - if (!cli_send_login(NULL,NULL,True,True)) + DOM_CHAL srv_chal; + + if (!cli_send_login(NULL,NULL,True,True)) return(1); + + if (!cli_lsa_req_chal(&srv_chal, desthost, myhostname, Client, cnum)) { - return(1); + return (1); } - - cli_lsa_req_chal(); #if 0 cli_lsa_auth2(); cli_lsa_sam_logon(); diff --git a/source3/client/ntclient.c b/source3/client/ntclient.c new file mode 100644 index 0000000000..decc2e34d6 --- /dev/null +++ b/source3/client/ntclient.c @@ -0,0 +1,222 @@ +/* + Unix SMB/Netbios implementation. + Version 1.9. + SMB client + Copyright (C) Andrew Tridgell 1994-1997 + + This program is free software; you can redistribute it and/or modify + it under the terms of the GNU General Public License as published by + the Free Software Foundation; either version 2 of the License, or + (at your option) any later version. + + This program is distributed in the hope that it will be useful, + but WITHOUT ANY WARRANTY; without even the implied warranty of + MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the + GNU General Public License for more details. + + You should have received a copy of the GNU General Public License + along with this program; if not, write to the Free Software + Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA. +*/ + +#ifdef SYSLOG +#undef SYSLOG +#endif + +#include "includes.h" + +extern int DEBUGLEVEL; + +#define CLIENT_TIMEOUT (30*1000) + +/**************************************************************************** +do a LSA Request Challenge +****************************************************************************/ +static BOOL do_lsa_req_chal(uint16 fnum, + char *desthost, char *myhostname, DOM_CHAL *srv_chal) +{ + char *rparam = NULL; + char *rdata = NULL; + char *p; + int rdrcnt,rprcnt; + pstring data; /* only 1024 bytes */ + uint16 setup[2]; /* only need 2 uint16 setup parameters */ + LSA_Q_REQ_CHAL q_c; + DOM_CHAL clnt_chal; + int call_id = 0x1; + BOOL valid_chal = False; + + if (srv_chal == NULL) return False; + + /* create and send a MSRPC command with api LSA_REQCHAL */ + + clnt_chal.data[0] = 0x11111111; + clnt_chal.data[1] = 0x22222222; + + DEBUG(4,("LSA Request Challenge from %s to %s: %lx %lx\n", + desthost, myhostname, clnt_chal.data[0], clnt_chal.data[1])); + + /* store the parameters */ + make_q_req_chal(&q_c, desthost, myhostname, &clnt_chal); + + + /* turn parameters into data stream */ + p = lsa_io_q_req_chal(False, &q_c, data + 0x18, data, 4, 0); + + /* create the request RPC_HDR _after_ the main data: length is now known */ + create_rpc_request(call_id, LSA_REQCHAL, data, PTR_DIFF(p, data)); + + /* create setup parameters. */ + SIVAL(setup, 0, 0x0026); /* 0x26 indicates "transact named pipe" */ + SIVAL(setup, 2, fnum); /* file handle, from the SMBcreateX pipe, earlier */ + + /* send the data on \PIPE\ */ + if (cli_call_api("\\PIPE\\", 0, PTR_DIFF(p, data), 2, 1024, + BUFFER_SIZE, + &rprcnt,&rdrcnt, + NULL, data, setup, + &rparam,&rdata)) + { + LSA_R_REQ_CHAL r_c; + RPC_HDR hdr; + int hdr_len; + int pkt_len; + + DEBUG(5, ("cli_call_api: return OK\n")); + + p = rdata; + + if (p) p = smb_io_rpc_hdr (True, &hdr, p, rdata, 4, 0); + if (p) p = align_offset(p, rdata, 4); /* oh, what a surprise */ + + hdr_len = PTR_DIFF(p, rdata); + + if (p && hdr_len != hdr.frag_len - hdr.alloc_hint) + { + /* header length not same as calculated header length */ + DEBUG(2,("do_lsa_req_chal: hdr_len %x != frag_len-alloc_hint\n", + hdr_len, hdr.frag_len - hdr.alloc_hint)); + p = NULL; + } + + if (p) p = lsa_io_r_req_chal(True, &r_c, p, rdata, 4, 0); + + pkt_len = PTR_DIFF(p, rdata); + + if (p && pkt_len != hdr.frag_len) + { + /* packet data size not same as reported fragment length */ + DEBUG(2,("do_lsa_req_chal: pkt_len %x != frag_len \n", + pkt_len, hdr.frag_len)); + p = NULL; + } + + if (p && r_c.status != 0) + { + /* report error code */ + DEBUG(0,("LSA_REQ_CHAL: nt_status error %lx\n", r_c.status)); + p = NULL; + } + + if (p) + { + /* ok, at last: we're happy. return the challenge */ + memcpy(srv_chal, r_c.srv_chal.data, sizeof(srv_chal->data)); + valid_chal = True; + } + } + + if (rparam) free(rparam); + if (rdata) free(rdata); + + return valid_chal; +} + +/**************************************************************************** + open an rpc pipe (\NETLOGON or \srvsvc for example) + ****************************************************************************/ +static uint16 open_rpc_pipe(char *inbuf, char *outbuf, char *rname, int Client, int cnum) +{ + int fnum; + char *p; + + DEBUG(5,("open_rpc_pipe: %s\n", rname)); + + bzero(outbuf,smb_size); + set_message(outbuf,15,1 + strlen(rname),True); + + CVAL(outbuf,smb_com) = SMBopenX; + SSVAL(outbuf,smb_tid, cnum); + cli_setup_pkt(outbuf); + + SSVAL(outbuf,smb_vwv0,0xFF); + SSVAL(outbuf,smb_vwv2,1); + SSVAL(outbuf,smb_vwv3,(DENY_NONE<<4)); + SSVAL(outbuf,smb_vwv4,aSYSTEM | aHIDDEN); + SSVAL(outbuf,smb_vwv5,aSYSTEM | aHIDDEN); + SSVAL(outbuf,smb_vwv8,1); + + p = smb_buf(outbuf); + strcpy(p,rname); + p = skip_string(p,1); + + send_smb(Client,outbuf); + receive_smb(Client,inbuf,CLIENT_TIMEOUT); + + if (CVAL(inbuf,smb_rcls) != 0) + { + if (CVAL(inbuf,smb_rcls) == ERRSRV && + SVAL(inbuf,smb_err) == ERRnoresource && + cli_reopen_connection(inbuf,outbuf)) + { + return open_rpc_pipe(inbuf, outbuf, rname, Client, cnum); + } + DEBUG(0,("opening remote pipe %s - error %s\n", rname, smb_errstr(inbuf))); + + return 0xffff; + } + + fnum = SVAL(inbuf, smb_vwv2); + + DEBUG(5,("opening pipe: fnum %d\n", fnum)); + + return fnum; +} + +/**************************************************************************** + +****************************************************************************/ +BOOL cli_lsa_req_chal(DOM_CHAL *srv_chal, char *desthost, char *myhostname, + int Client, int cnum) +{ + uint16 fnum; + char *inbuf,*outbuf; + + if (srv_chal == NULL) return False; + + inbuf = (char *)malloc(BUFFER_SIZE + SAFETY_MARGIN); + outbuf = (char *)malloc(BUFFER_SIZE + SAFETY_MARGIN); + + if (!inbuf || !outbuf) + { + DEBUG(0,("out of memory\n")); + return False; + } + + /* open the \PIPE\NETLOGON file */ + fnum = open_rpc_pipe(inbuf, outbuf, PIPE_NETLOGON, Client, cnum); + + if (fnum != 0xffff) + { + do_lsa_req_chal(fnum, desthost, myhostname, srv_chal); + + /* close \PIPE\NETLOGON */ + cli_smb_close(inbuf, outbuf, Client, cnum, fnum); + + free(inbuf); free(outbuf); + return True; + } + + return False; +} + -- cgit