Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 :
4 : server side dcerpc common code
5 :
6 : Copyright (C) Andrew Tridgell 2003-2010
7 : Copyright (C) Stefan (metze) Metzmacher 2004-2005
8 :
9 : This program is free software; you can redistribute it and/or modify
10 : it under the terms of the GNU General Public License as published by
11 : the Free Software Foundation; either version 3 of the License, or
12 : (at your option) any later version.
13 :
14 : This program is distributed in the hope that it will be useful,
15 : but WITHOUT ANY WARRANTY; without even the implied warranty of
16 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 : GNU General Public License for more details.
18 :
19 : You should have received a copy of the GNU General Public License
20 : along with this program. If not, see <http://www.gnu.org/licenses/>.
21 : */
22 :
23 : #include "includes.h"
24 : #include "librpc/rpc/dcesrv_core.h"
25 : #include "librpc/rpc/dcesrv_core_proto.h"
26 : #include "librpc/rpc/dcerpc_util.h"
27 : #include "auth/gensec/gensec.h"
28 : #include "lib/util/dlinklist.h"
29 : #include "param/param.h"
30 :
31 : /*
32 : move a call from an existing linked list to the specified list. This
33 : prevents bugs where we forget to remove the call from a previous
34 : list when moving it.
35 : */
36 173812 : static void dcesrv_call_set_list(struct dcesrv_call_state *call,
37 : enum dcesrv_call_list list)
38 : {
39 173812 : switch (call->list) {
40 15190 : case DCESRV_LIST_NONE:
41 15190 : break;
42 0 : case DCESRV_LIST_CALL_LIST:
43 0 : DLIST_REMOVE(call->conn->call_list, call);
44 0 : break;
45 46 : case DCESRV_LIST_FRAGMENTED_CALL_LIST:
46 46 : DLIST_REMOVE(call->conn->incoming_fragmented_call_list, call);
47 46 : break;
48 158576 : case DCESRV_LIST_PENDING_CALL_LIST:
49 158576 : DLIST_REMOVE(call->conn->pending_call_list, call);
50 158576 : break;
51 : }
52 173812 : call->list = list;
53 173812 : switch (list) {
54 0 : case DCESRV_LIST_NONE:
55 0 : break;
56 173812 : case DCESRV_LIST_CALL_LIST:
57 173812 : DLIST_ADD_END(call->conn->call_list, call);
58 173812 : break;
59 0 : case DCESRV_LIST_FRAGMENTED_CALL_LIST:
60 0 : DLIST_ADD_END(call->conn->incoming_fragmented_call_list, call);
61 0 : break;
62 0 : case DCESRV_LIST_PENDING_CALL_LIST:
63 0 : DLIST_ADD_END(call->conn->pending_call_list, call);
64 0 : break;
65 : }
66 173812 : }
67 :
68 :
69 423216 : void dcesrv_init_hdr(struct ncacn_packet *pkt, bool bigendian)
70 : {
71 423216 : pkt->rpc_vers = 5;
72 423216 : pkt->rpc_vers_minor = 0;
73 423216 : if (bigendian) {
74 0 : pkt->drep[0] = 0;
75 : } else {
76 423216 : pkt->drep[0] = DCERPC_DREP_LE;
77 : }
78 423216 : pkt->drep[1] = 0;
79 423216 : pkt->drep[2] = 0;
80 423216 : pkt->drep[3] = 0;
81 423216 : }
82 :
83 :
84 : /*
85 : return a dcerpc fault
86 : */
87 15252 : NTSTATUS dcesrv_fault_with_flags(struct dcesrv_call_state *call,
88 : uint32_t fault_code,
89 : uint8_t extra_flags)
90 : {
91 : struct ncacn_packet pkt;
92 : struct data_blob_list_item *rep;
93 : NTSTATUS status;
94 :
95 : /* setup a fault */
96 15252 : dcesrv_init_hdr(&pkt, lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
97 15252 : pkt.auth_length = 0;
98 15252 : pkt.call_id = call->pkt.call_id;
99 15252 : pkt.ptype = DCERPC_PKT_FAULT;
100 15252 : pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST | extra_flags;
101 15252 : pkt.u.fault.alloc_hint = 24;
102 15252 : if (call->context != NULL) {
103 15119 : pkt.u.fault.context_id = call->context->context_id;
104 : } else {
105 133 : pkt.u.fault.context_id = 0;
106 : }
107 15252 : pkt.u.fault.cancel_count = 0;
108 15252 : pkt.u.fault.flags = 0;
109 15252 : pkt.u.fault.status = fault_code;
110 15252 : pkt.u.fault.reserved = 0;
111 15252 : pkt.u.fault.error_and_verifier = data_blob_null;
112 :
113 15252 : rep = talloc_zero(call, struct data_blob_list_item);
114 15252 : if (!rep) {
115 0 : return NT_STATUS_NO_MEMORY;
116 : }
117 :
118 15252 : status = dcerpc_ncacn_push_auth(&rep->blob, call, &pkt, NULL);
119 15252 : if (!NT_STATUS_IS_OK(status)) {
120 0 : return status;
121 : }
122 :
123 15252 : dcerpc_set_frag_length(&rep->blob, rep->blob.length);
124 :
125 15252 : DLIST_ADD_END(call->replies, rep);
126 15252 : dcesrv_call_set_list(call, DCESRV_LIST_CALL_LIST);
127 :
128 15252 : if (call->conn->call_list && call->conn->call_list->replies) {
129 15252 : if (call->conn->transport.report_output_data) {
130 15252 : call->conn->transport.report_output_data(call->conn);
131 : }
132 : }
133 :
134 15252 : return NT_STATUS_OK;
135 : }
136 :
137 14928 : NTSTATUS dcesrv_fault(struct dcesrv_call_state *call, uint32_t fault_code)
138 : {
139 14928 : return dcesrv_fault_with_flags(call, fault_code, 0);
140 : }
141 :
142 158576 : _PUBLIC_ NTSTATUS dcesrv_reply(struct dcesrv_call_state *call)
143 : {
144 : struct ndr_push *push;
145 : NTSTATUS status;
146 : DATA_BLOB stub;
147 : uint32_t total_length, chunk_size;
148 158576 : struct dcesrv_connection_context *context = call->context;
149 158576 : struct dcesrv_auth *auth = call->auth_state;
150 158576 : size_t sig_size = 0;
151 :
152 : /* call the reply function */
153 158576 : status = context->iface->reply(call, call, call->r);
154 158576 : if (!NT_STATUS_IS_OK(status)) {
155 16 : return dcesrv_fault(call, call->fault_code);
156 : }
157 :
158 : /* form the reply NDR */
159 158560 : push = ndr_push_init_ctx(call);
160 158560 : NT_STATUS_HAVE_NO_MEMORY(push);
161 :
162 : /* carry over the pointer count to the reply in case we are
163 : using full pointer. See NDR specification for full
164 : pointers */
165 158560 : push->ptr_count = call->ndr_pull->ptr_count;
166 :
167 158560 : if (lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx)) {
168 0 : push->flags |= LIBNDR_FLAG_BIGENDIAN;
169 : }
170 :
171 158560 : status = context->iface->ndr_push(call, call, push, call->r);
172 158560 : if (!NT_STATUS_IS_OK(status)) {
173 0 : return dcesrv_fault(call, call->fault_code);
174 : }
175 :
176 158560 : stub = ndr_push_blob(push);
177 :
178 158560 : dcesrv_save_ndr_fuzz_seed(stub,
179 : call,
180 : NDR_OUT);
181 :
182 158560 : total_length = stub.length;
183 :
184 : /* we can write a full max_recv_frag size, minus the dcerpc
185 : request header size */
186 158560 : chunk_size = call->conn->max_xmit_frag;
187 158560 : chunk_size -= DCERPC_REQUEST_LENGTH;
188 158560 : if (auth->auth_finished && auth->gensec_security != NULL) {
189 74330 : size_t max_payload = chunk_size;
190 :
191 74330 : max_payload -= DCERPC_AUTH_TRAILER_LENGTH;
192 74330 : max_payload -= (max_payload % DCERPC_AUTH_PAD_ALIGNMENT);
193 :
194 74330 : sig_size = gensec_sig_size(auth->gensec_security,
195 : max_payload);
196 74330 : if (sig_size) {
197 73144 : chunk_size -= DCERPC_AUTH_TRAILER_LENGTH;
198 73144 : chunk_size -= sig_size;
199 : }
200 : }
201 158560 : chunk_size -= (chunk_size % DCERPC_AUTH_PAD_ALIGNMENT);
202 :
203 : do {
204 : uint32_t length;
205 : struct data_blob_list_item *rep;
206 : struct ncacn_packet pkt;
207 : bool ok;
208 :
209 385340 : rep = talloc_zero(call, struct data_blob_list_item);
210 385340 : NT_STATUS_HAVE_NO_MEMORY(rep);
211 :
212 385340 : length = MIN(chunk_size, stub.length);
213 :
214 : /* form the dcerpc response packet */
215 385340 : dcesrv_init_hdr(&pkt,
216 385340 : lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
217 385340 : pkt.auth_length = 0;
218 385340 : pkt.call_id = call->pkt.call_id;
219 385340 : pkt.ptype = DCERPC_PKT_RESPONSE;
220 385340 : pkt.pfc_flags = 0;
221 385340 : if (stub.length == total_length) {
222 158560 : pkt.pfc_flags |= DCERPC_PFC_FLAG_FIRST;
223 : }
224 385340 : if (length == stub.length) {
225 158560 : pkt.pfc_flags |= DCERPC_PFC_FLAG_LAST;
226 : }
227 385340 : pkt.u.response.alloc_hint = stub.length;
228 : /*
229 : * bug for bug, feature for feature...
230 : *
231 : * Windows truncates the context_id with & 0xFF,
232 : * so we do.
233 : */
234 385340 : pkt.u.response.context_id = context->context_id & 0xFF;
235 385340 : pkt.u.response.cancel_count = 0;
236 385340 : pkt.u.response.stub_and_verifier.data = stub.data;
237 385340 : pkt.u.response.stub_and_verifier.length = length;
238 :
239 385340 : ok = dcesrv_auth_pkt_push(call, &rep->blob, sig_size,
240 : DCERPC_RESPONSE_LENGTH,
241 : &pkt.u.response.stub_and_verifier,
242 : &pkt);
243 385340 : if (!ok) {
244 0 : return dcesrv_fault(call, DCERPC_FAULT_OTHER);
245 : }
246 :
247 385340 : dcerpc_set_frag_length(&rep->blob, rep->blob.length);
248 :
249 385340 : DLIST_ADD_END(call->replies, rep);
250 :
251 385340 : stub.data += length;
252 385340 : stub.length -= length;
253 385340 : } while (stub.length != 0);
254 :
255 : /* move the call from the pending to the finished calls list */
256 158560 : dcesrv_call_set_list(call, DCESRV_LIST_CALL_LIST);
257 :
258 158560 : if (call->conn->call_list && call->conn->call_list->replies) {
259 158560 : if (call->conn->transport.report_output_data) {
260 158560 : call->conn->transport.report_output_data(call->conn);
261 : }
262 : }
263 :
264 158560 : return NT_STATUS_OK;
265 : }
|
