Line data Source code
1 : /*
2 : Unix SMB/CIFS implementation.
3 :
4 : server side dcerpc common code
5 :
6 : Copyright (C) Andrew Tridgell 2003-2010
7 : Copyright (C) Stefan (metze) Metzmacher 2004-2005
8 :
9 : This program is free software; you can redistribute it and/or modify
10 : it under the terms of the GNU General Public License as published by
11 : the Free Software Foundation; either version 3 of the License, or
12 : (at your option) any later version.
13 :
14 : This program is distributed in the hope that it will be useful,
15 : but WITHOUT ANY WARRANTY; without even the implied warranty of
16 : MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
17 : GNU General Public License for more details.
18 :
19 : You should have received a copy of the GNU General Public License
20 : along with this program. If not, see <http://www.gnu.org/licenses/>.
21 : */
22 :
23 : #include "includes.h"
24 : #include "librpc/rpc/dcesrv_core.h"
25 : #include "librpc/rpc/dcesrv_core_proto.h"
26 : #include "librpc/rpc/dcerpc_util.h"
27 : #include "auth/gensec/gensec.h"
28 : #include "lib/util/dlinklist.h"
29 : #include "param/param.h"
30 :
31 : /*
32 : move a call from an existing linked list to the specified list. This
33 : prevents bugs where we forget to remove the call from a previous
34 : list when moving it.
35 : */
36 836114 : static void dcesrv_call_set_list(struct dcesrv_call_state *call,
37 : enum dcesrv_call_list list)
38 : {
39 836114 : switch (call->list) {
40 2519 : case DCESRV_LIST_NONE:
41 2519 : break;
42 0 : case DCESRV_LIST_CALL_LIST:
43 0 : DLIST_REMOVE(call->conn->call_list, call);
44 0 : break;
45 46 : case DCESRV_LIST_FRAGMENTED_CALL_LIST:
46 46 : DLIST_REMOVE(call->conn->incoming_fragmented_call_list, call);
47 46 : break;
48 833203 : case DCESRV_LIST_PENDING_CALL_LIST:
49 833203 : DLIST_REMOVE(call->conn->pending_call_list, call);
50 826794 : break;
51 : }
52 836114 : call->list = list;
53 836114 : switch (list) {
54 0 : case DCESRV_LIST_NONE:
55 0 : break;
56 836114 : case DCESRV_LIST_CALL_LIST:
57 836114 : DLIST_ADD_END(call->conn->call_list, call);
58 829359 : break;
59 0 : case DCESRV_LIST_FRAGMENTED_CALL_LIST:
60 0 : DLIST_ADD_END(call->conn->incoming_fragmented_call_list, call);
61 0 : break;
62 0 : case DCESRV_LIST_PENDING_CALL_LIST:
63 0 : DLIST_ADD_END(call->conn->pending_call_list, call);
64 0 : break;
65 : }
66 836114 : }
67 :
68 :
69 1188703 : void dcesrv_init_hdr(struct ncacn_packet *pkt, bool bigendian)
70 : {
71 1188703 : pkt->rpc_vers = 5;
72 1188703 : pkt->rpc_vers_minor = 0;
73 1188703 : if (bigendian) {
74 0 : pkt->drep[0] = 0;
75 : } else {
76 1188703 : pkt->drep[0] = DCERPC_DREP_LE;
77 : }
78 1188703 : pkt->drep[1] = 0;
79 1188703 : pkt->drep[2] = 0;
80 1188703 : pkt->drep[3] = 0;
81 1188703 : }
82 :
83 :
84 : /*
85 : return a dcerpc fault
86 : */
87 2927 : NTSTATUS dcesrv_fault_with_flags(struct dcesrv_call_state *call,
88 : uint32_t fault_code,
89 : uint8_t extra_flags)
90 : {
91 346 : struct ncacn_packet pkt;
92 346 : struct data_blob_list_item *rep;
93 346 : NTSTATUS status;
94 :
95 : /* setup a fault */
96 2927 : dcesrv_init_hdr(&pkt, lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
97 2927 : pkt.auth_length = 0;
98 2927 : pkt.call_id = call->pkt.call_id;
99 2927 : pkt.ptype = DCERPC_PKT_FAULT;
100 2927 : pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST | extra_flags;
101 2927 : pkt.u.fault.alloc_hint = 24;
102 2927 : if (call->context != NULL) {
103 2785 : pkt.u.fault.context_id = call->context->context_id;
104 : } else {
105 142 : pkt.u.fault.context_id = 0;
106 : }
107 2927 : pkt.u.fault.cancel_count = 0;
108 2927 : pkt.u.fault.flags = 0;
109 2927 : pkt.u.fault.status = fault_code;
110 2927 : pkt.u.fault.reserved = 0;
111 2927 : pkt.u.fault.error_and_verifier = data_blob_null;
112 :
113 2927 : rep = talloc_zero(call, struct data_blob_list_item);
114 2927 : if (!rep) {
115 0 : return NT_STATUS_NO_MEMORY;
116 : }
117 :
118 2927 : status = dcerpc_ncacn_push_auth(&rep->blob, call, &pkt, NULL);
119 2927 : if (!NT_STATUS_IS_OK(status)) {
120 0 : return status;
121 : }
122 :
123 2927 : dcerpc_set_frag_length(&rep->blob, rep->blob.length);
124 :
125 2927 : DLIST_ADD_END(call->replies, rep);
126 2927 : dcesrv_call_set_list(call, DCESRV_LIST_CALL_LIST);
127 :
128 2927 : if (call->conn->call_list && call->conn->call_list->replies) {
129 2927 : if (call->conn->transport.report_output_data) {
130 2927 : call->conn->transport.report_output_data(call->conn);
131 : }
132 : }
133 :
134 2927 : return NT_STATUS_OK;
135 : }
136 :
137 2585 : NTSTATUS dcesrv_fault(struct dcesrv_call_state *call, uint32_t fault_code)
138 : {
139 2585 : return dcesrv_fault_with_flags(call, fault_code, 0);
140 : }
141 :
142 833203 : _PUBLIC_ NTSTATUS dcesrv_reply(struct dcesrv_call_state *call)
143 : {
144 6409 : struct ndr_push *push;
145 6409 : NTSTATUS status;
146 6409 : DATA_BLOB stub;
147 6409 : uint32_t total_length, chunk_size;
148 833203 : struct dcesrv_connection_context *context = call->context;
149 833203 : struct dcesrv_auth *auth = call->auth_state;
150 833203 : size_t sig_size = 0;
151 :
152 : /* call the reply function */
153 833203 : status = context->iface->reply(call, call, call->r);
154 833203 : if (!NT_STATUS_IS_OK(status)) {
155 16 : return dcesrv_fault(call, call->fault_code);
156 : }
157 :
158 : /* form the reply NDR */
159 833187 : push = ndr_push_init_ctx(call);
160 833187 : NT_STATUS_HAVE_NO_MEMORY(push);
161 :
162 : /* carry over the pointer count to the reply in case we are
163 : using full pointer. See NDR specification for full
164 : pointers */
165 833187 : push->ptr_count = call->ndr_pull->ptr_count;
166 :
167 833187 : if (lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx)) {
168 0 : push->flags |= LIBNDR_FLAG_BIGENDIAN;
169 : }
170 :
171 833187 : if (context->ndr64) {
172 0 : push->flags |= LIBNDR_FLAG_NDR64;
173 : }
174 :
175 833187 : status = context->iface->ndr_push(call, call, push, call->r);
176 833187 : if (!NT_STATUS_IS_OK(status)) {
177 0 : return dcesrv_fault(call, call->fault_code);
178 : }
179 :
180 833187 : stub = ndr_push_blob(push);
181 :
182 833187 : dcesrv_save_ndr_fuzz_seed(stub,
183 : call,
184 : NDR_OUT);
185 :
186 833187 : total_length = stub.length;
187 :
188 : /* we can write a full max_recv_frag size, minus the dcerpc
189 : request header size */
190 833187 : chunk_size = call->conn->max_xmit_frag;
191 833187 : chunk_size -= DCERPC_REQUEST_LENGTH;
192 833187 : if (auth->auth_finished && auth->gensec_security != NULL) {
193 98571 : size_t max_payload = chunk_size;
194 :
195 98571 : max_payload -= DCERPC_AUTH_TRAILER_LENGTH;
196 98571 : max_payload -= (max_payload % DCERPC_AUTH_PAD_ALIGNMENT);
197 :
198 98571 : sig_size = gensec_sig_size(auth->gensec_security,
199 : max_payload);
200 98571 : if (sig_size) {
201 97191 : chunk_size -= DCERPC_AUTH_TRAILER_LENGTH;
202 97191 : chunk_size -= sig_size;
203 : }
204 : }
205 833187 : chunk_size -= (chunk_size % DCERPC_AUTH_PAD_ALIGNMENT);
206 :
207 6491 : do {
208 6491 : uint32_t length;
209 6491 : struct data_blob_list_item *rep;
210 6491 : struct ncacn_packet pkt;
211 6491 : bool ok;
212 :
213 1123994 : rep = talloc_zero(call, struct data_blob_list_item);
214 1123994 : NT_STATUS_HAVE_NO_MEMORY(rep);
215 :
216 1123994 : length = MIN(chunk_size, stub.length);
217 :
218 : /* form the dcerpc response packet */
219 1123994 : dcesrv_init_hdr(&pkt,
220 1123994 : lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
221 1123994 : pkt.auth_length = 0;
222 1123994 : pkt.call_id = call->pkt.call_id;
223 1123994 : pkt.ptype = DCERPC_PKT_RESPONSE;
224 1123994 : pkt.pfc_flags = 0;
225 1123994 : if (stub.length == total_length) {
226 833187 : pkt.pfc_flags |= DCERPC_PFC_FLAG_FIRST;
227 : }
228 1123994 : if (length == stub.length) {
229 833187 : pkt.pfc_flags |= DCERPC_PFC_FLAG_LAST;
230 : }
231 1123994 : pkt.u.response.alloc_hint = stub.length;
232 : /*
233 : * bug for bug, feature for feature...
234 : *
235 : * Windows truncates the context_id with & 0xFF,
236 : * so we do.
237 : */
238 1123994 : pkt.u.response.context_id = context->context_id & 0xFF;
239 1123994 : pkt.u.response.cancel_count = 0;
240 1123994 : pkt.u.response.stub_and_verifier.data = stub.data;
241 1123994 : pkt.u.response.stub_and_verifier.length = length;
242 :
243 1123994 : ok = dcesrv_auth_pkt_push(call, &rep->blob, sig_size,
244 : DCERPC_RESPONSE_LENGTH,
245 : &pkt.u.response.stub_and_verifier,
246 : &pkt);
247 1123994 : if (!ok) {
248 0 : return dcesrv_fault(call, DCERPC_FAULT_OTHER);
249 : }
250 :
251 1123994 : dcerpc_set_frag_length(&rep->blob, rep->blob.length);
252 :
253 1123994 : DLIST_ADD_END(call->replies, rep);
254 :
255 1123994 : stub.data += length;
256 1123994 : stub.length -= length;
257 1123994 : } while (stub.length != 0);
258 :
259 : /* move the call from the pending to the finished calls list */
260 833187 : dcesrv_call_set_list(call, DCESRV_LIST_CALL_LIST);
261 :
262 833187 : if (call->conn->call_list && call->conn->call_list->replies) {
263 833187 : if (call->conn->transport.report_output_data) {
264 833187 : call->conn->transport.report_output_data(call->conn);
265 : }
266 : }
267 :
268 833187 : return NT_STATUS_OK;
269 : }
270 :
271 17654 : _PUBLIC_ void _dcesrv_async_reply(struct dcesrv_call_state *call,
272 : const char *func,
273 : const char *location)
274 : {
275 17654 : struct dcesrv_connection *conn = call->conn;
276 1290 : NTSTATUS status;
277 :
278 17654 : status = dcesrv_reply(call);
279 17654 : if (!NT_STATUS_IS_OK(status)) {
280 0 : D_ERR("%s: %s: dcesrv_async_reply() failed - %s\n",
281 : func, location, nt_errstr(status));
282 0 : dcesrv_terminate_connection(conn, nt_errstr(status));
283 : }
284 17654 : }
|
