librpc/rpc/rpc_common.h

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    Copyright (C) Stefan Metzmacher 2010-2011
   5    Copyright (C) Andrew Tridgell 2010-2011
   6    Copyright (C) Simo Sorce 2010
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License as published by
  10    the Free Software Foundation; either version 3 of the License, or
  11    (at your option) any later version.
  12
  13    This program is distributed in the hope that it will be useful,
  14    but WITHOUT ANY WARRANTY; without even the implied warranty of
  15    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  16    GNU General Public License for more details.
  17
  18    You should have received a copy of the GNU General Public License
  19    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  20 */
  21
  22 #ifndef __DEFAULT_LIBRPC_RPCCOMMON_H__
  23 #define __DEFAULT_LIBRPC_RPCCOMMON_H__
  24
  25 #include "gen_ndr/dcerpc.h"
  26 #include "lib/util/attr.h"
  27
  28 struct dcerpc_binding_handle;
  29 struct GUID;
  30 struct ndr_interface_table;
  31 struct ndr_interface_call;
  32 struct ndr_push;
  33 struct ndr_pull;
  34 struct ncacn_packet;
  35 struct epm_floor;
  36 struct epm_tower;
  37 struct tevent_context;
  38 struct tstream_context;
  39 struct gensec_security;
  40
  41 enum dcerpc_transport_t {
  42         NCA_UNKNOWN, NCACN_NP, NCACN_IP_TCP, NCACN_IP_UDP, NCACN_VNS_IPC,
  43         NCACN_VNS_SPP, NCACN_AT_DSP, NCADG_AT_DDP, NCALRPC, NCACN_UNIX_STREAM,
  44         NCADG_UNIX_DGRAM, NCACN_HTTP, NCADG_IPX, NCACN_SPX, NCACN_INTERNAL };
  45
  46 /** this describes a binding to a particular transport/pipe */
  47 struct dcerpc_binding;
  48
  49 /* dcerpc pipe flags */
  50 #define DCERPC_DEBUG_PRINT_IN          (1<<0)
  51 #define DCERPC_DEBUG_PRINT_OUT         (1<<1)
  52 #define DCERPC_DEBUG_PRINT_BOTH (DCERPC_DEBUG_PRINT_IN | DCERPC_DEBUG_PRINT_OUT)
  53
  54 #define DCERPC_DEBUG_VALIDATE_IN       (1<<2)
  55 #define DCERPC_DEBUG_VALIDATE_OUT      (1<<3)
  56 #define DCERPC_DEBUG_VALIDATE_BOTH (DCERPC_DEBUG_VALIDATE_IN | DCERPC_DEBUG_VALIDATE_OUT)
  57
  58 #define DCERPC_CONNECT                 (1<<4)
  59 #define DCERPC_SIGN                    (1<<5)
  60 #define DCERPC_SEAL                    (1<<6)
  61
  62 #define DCERPC_PUSH_BIGENDIAN          (1<<7)
  63 #define DCERPC_PULL_BIGENDIAN          (1<<8)
  64
  65 #define DCERPC_SCHANNEL                (1<<9)
  66
  67 #define DCERPC_ANON_FALLBACK           (1<<10)
  68
  69 /* use a 128 bit session key */
  70 #define DCERPC_SCHANNEL_128            (1<<12)
  71
  72 /* check incoming pad bytes */
  73 #define DCERPC_DEBUG_PAD_CHECK         (1<<13)
  74
  75 /* set LIBNDR_FLAG_REF_ALLOC flag when decoding NDR */
  76 #define DCERPC_NDR_REF_ALLOC           (1<<14)
  77
  78 #define DCERPC_AUTH_OPTIONS    (DCERPC_SEAL|DCERPC_SIGN|DCERPC_SCHANNEL|DCERPC_AUTH_SPNEGO|DCERPC_AUTH_KRB5|DCERPC_AUTH_NTLM)
  79
  80 /* select spnego auth */
  81 #define DCERPC_AUTH_SPNEGO             (1<<15)
  82
  83 /* select krb5 auth */
  84 #define DCERPC_AUTH_KRB5               (1<<16)
  85
  86 #define DCERPC_SMB2                    (1<<17)
  87
  88 /* select NTLM auth */
  89 #define DCERPC_AUTH_NTLM               (1<<18)
  90
  91 /* this triggers the DCERPC_PFC_FLAG_CONC_MPX flag in the bind request */
  92 #define DCERPC_CONCURRENT_MULTIPLEX     (1<<19)
  93
  94 /* this indicates DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN flag was negotiated */
  95 #define DCERPC_HEADER_SIGNING          (1<<20)
  96
  97 /* use NDR64 transport */
  98 #define DCERPC_NDR64                   (1<<21)
  99
 100 /* handle upgrades or downgrades automatically */
 101 #define DCERPC_SCHANNEL_AUTO           (1<<23)
 102
 103 /* use aes schannel with hmac-sh256 session key */
 104 #define DCERPC_SCHANNEL_AES            (1<<24)
 105
 106 /* this triggers the DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN flag in the bind request */
 107 #define DCERPC_PROPOSE_HEADER_SIGNING          (1<<25)
 108
 109 #define DCERPC_PACKET                   (1<<26)
 110
 111 #define DCERPC_SMB1                    (1<<27)
 112
 113 /* The following definitions come from ../librpc/rpc/dcerpc_error.c  */
 114
 115 const char *dcerpc_errstr(TALLOC_CTX *mem_ctx, uint32_t fault_code);
 116 NTSTATUS dcerpc_fault_to_nt_status(uint32_t fault_code);
 117 uint32_t dcerpc_fault_from_nt_status(NTSTATUS nt_status);
 118
 119 /* The following definitions come from ../librpc/rpc/binding.c  */
 120
 121 const char *epm_floor_string(TALLOC_CTX *mem_ctx, struct epm_floor *epm_floor);
 122 char *dcerpc_floor_get_rhs_data(TALLOC_CTX *mem_ctx, struct epm_floor *epm_floor);
 123 enum dcerpc_transport_t dcerpc_transport_by_endpoint_protocol(int prot);
 124 struct dcerpc_binding *dcerpc_binding_dup(TALLOC_CTX *mem_ctx,
 125                                           const struct dcerpc_binding *b);
 126 NTSTATUS dcerpc_binding_build_tower(TALLOC_CTX *mem_ctx,
 127                                     const struct dcerpc_binding *binding,
 128                                     struct epm_tower *tower);
 129 NTSTATUS dcerpc_binding_from_tower(TALLOC_CTX *mem_ctx,
 130                                    struct epm_tower *tower,
 131                                    struct dcerpc_binding **b_out);
 132 NTSTATUS dcerpc_parse_binding(TALLOC_CTX *mem_ctx, const char *s, struct dcerpc_binding **b_out);
 133 char *dcerpc_binding_string(TALLOC_CTX *mem_ctx, const struct dcerpc_binding *b);
 134 struct GUID dcerpc_binding_get_object(const struct dcerpc_binding *b);
 135 NTSTATUS dcerpc_binding_set_object(struct dcerpc_binding *b,
 136                                    struct GUID object);
 137 enum dcerpc_transport_t dcerpc_binding_get_transport(const struct dcerpc_binding *b);
 138 NTSTATUS dcerpc_binding_set_transport(struct dcerpc_binding *b,
 139                                       enum dcerpc_transport_t transport);
 140 void dcerpc_binding_get_auth_info(const struct dcerpc_binding *b,
 141                                   enum dcerpc_AuthType *_auth_type,
 142                                   enum dcerpc_AuthLevel *_auth_level);
 143 uint32_t dcerpc_binding_get_assoc_group_id(const struct dcerpc_binding *b);
 144 NTSTATUS dcerpc_binding_set_assoc_group_id(struct dcerpc_binding *b,
 145                                            uint32_t assoc_group_id);
 146 struct ndr_syntax_id dcerpc_binding_get_abstract_syntax(const struct dcerpc_binding *b);
 147 NTSTATUS dcerpc_binding_set_abstract_syntax(struct dcerpc_binding *b,
 148                                             const struct ndr_syntax_id *syntax);
 149 const char *dcerpc_binding_get_string_option(const struct dcerpc_binding *b,
 150                                              const char *name);
 151 char *dcerpc_binding_copy_string_option(TALLOC_CTX *mem_ctx,
 152                                         const struct dcerpc_binding *b,
 153                                         const char *name);
 154 NTSTATUS dcerpc_binding_set_string_option(struct dcerpc_binding *b,
 155                                           const char *name,
 156                                           const char *value);
 157 void *_dcerpc_binding_get_pointer_option(const struct dcerpc_binding *b,
 158                                          const char *name,
 159                                          const char *type);
 160 #define dcerpc_binding_get_pointer_option(b, name, type) \
 161         talloc_get_type(_dcerpc_binding_get_pointer_option(b, name, #type), type)
 162 uint32_t dcerpc_binding_get_flags(const struct dcerpc_binding *b);
 163 NTSTATUS dcerpc_binding_set_flags(struct dcerpc_binding *b,
 164                                   uint32_t additional,
 165                                   uint32_t clear);
 166 NTSTATUS dcerpc_floor_get_lhs_data(const struct epm_floor *epm_floor, struct ndr_syntax_id *syntax);
 167 const char *derpc_transport_string_by_transport(enum dcerpc_transport_t t);
 168 enum dcerpc_transport_t dcerpc_transport_by_name(const char *name);
 169 enum dcerpc_transport_t dcerpc_transport_by_tower(const struct epm_tower *tower);
 170
 171 /* The following definitions come from ../librpc/rpc/dcerpc_util.c  */
 172
 173 void dcerpc_set_frag_length(DATA_BLOB *blob, uint16_t v);
 174 uint16_t dcerpc_get_frag_length(const DATA_BLOB *blob);
 175 void dcerpc_set_auth_length(DATA_BLOB *blob, uint16_t v);
 176 uint16_t dcerpc_get_auth_length(const DATA_BLOB *blob);
 177 uint8_t dcerpc_get_endian_flag(DATA_BLOB *blob);
 178 uint8_t dcerpc_get_auth_type(const DATA_BLOB *blob);
 179 uint8_t dcerpc_get_auth_level(const DATA_BLOB *blob);
 180 uint32_t dcerpc_get_auth_context_id(const DATA_BLOB *blob);
 181 const char *dcerpc_default_transport_endpoint(TALLOC_CTX *mem_ctx,
 182                                               enum dcerpc_transport_t transport,
 183                                               const struct ndr_interface_table *table);
 184
 185 NTSTATUS dcerpc_pull_ncacn_packet(TALLOC_CTX *mem_ctx,
 186                                   const DATA_BLOB *blob,
 187                                   struct ncacn_packet *r);
 188
 189 /**
 190 * @brief        Pull a dcerpc_auth structure, taking account of any auth
 191 *               padding in the blob. For request/response packets we pass
 192 *               the whole data blob, so auth_data_only must be set to false
 193 *               as the blob contains data+pad+auth and no just pad+auth.
 194 *
 195 * @param pkt            - The ncacn_packet strcuture
 196 * @param mem_ctx        - The mem_ctx used to allocate dcerpc_auth elements
 197 * @param pkt_trailer    - The packet trailer data, usually the trailing
 198 *                         auth_info blob, but in the request/response case
 199 *                         this is the stub_and_verifier blob.
 200 * @param auth           - A preallocated dcerpc_auth *empty* structure
 201 * @param auth_length    - The length of the auth trail, sum of auth header
 202 *                         lenght and pkt->auth_length
 203 * @param auth_data_only - Whether the pkt_trailer includes only the auth_blob
 204 *                         (+ padding) or also other data.
 205 *
 206 * @return               - A NTSTATUS error code.
 207 */
 208 NTSTATUS dcerpc_pull_auth_trailer(const struct ncacn_packet *pkt,
 209                                   TALLOC_CTX *mem_ctx,
 210                                   const DATA_BLOB *pkt_trailer,
 211                                   struct dcerpc_auth *auth,
 212                                   uint32_t *auth_length,
 213                                   bool auth_data_only);
 214 NTSTATUS dcerpc_verify_ncacn_packet_header(const struct ncacn_packet *pkt,
 215                                            enum dcerpc_pkt_type ptype,
 216                                            size_t max_auth_info,
 217                                            uint8_t required_flags,
 218                                            uint8_t optional_flags);
 219 NTSTATUS dcerpc_ncacn_pull_pkt_auth(const struct dcerpc_auth *auth_state,
 220                                     struct gensec_security *gensec,
 221                                     TALLOC_CTX *mem_ctx,
 222                                     enum dcerpc_pkt_type ptype,
 223                                     uint8_t required_flags,
 224                                     uint8_t optional_flags,
 225                                     uint8_t payload_offset,
 226                                     DATA_BLOB *payload_and_verifier,
 227                                     DATA_BLOB *raw_packet,
 228                                     const struct ncacn_packet *pkt);
 229 NTSTATUS dcerpc_ncacn_push_pkt_auth(const struct dcerpc_auth *auth_state,
 230                                     struct gensec_security *gensec,
 231                                     TALLOC_CTX *mem_ctx,
 232                                     DATA_BLOB *raw_packet,
 233                                     size_t sig_size,
 234                                     uint8_t payload_offset,
 235                                     const DATA_BLOB *payload,
 236                                     const struct ncacn_packet *pkt);
 237 struct tevent_req *dcerpc_read_ncacn_packet_send(TALLOC_CTX *mem_ctx,
 238                                                  struct tevent_context *ev,
 239                                                  struct tstream_context *stream);
 240 NTSTATUS dcerpc_read_ncacn_packet_recv(struct tevent_req *req,
 241                                        TALLOC_CTX *mem_ctx,
 242                                        struct ncacn_packet **pkt,
 243                                        DATA_BLOB *buffer);
 244
 245 /* The following definitions come from ../librpc/rpc/binding_handle.c  */
 246
 247 struct dcerpc_binding_handle_ops {
 248         const char *name;
 249
 250         bool (*is_connected)(struct dcerpc_binding_handle *h);
 251         uint32_t (*set_timeout)(struct dcerpc_binding_handle *h,
 252                                 uint32_t timeout);
 253
 254         void (*auth_info)(struct dcerpc_binding_handle *h,
 255                           enum dcerpc_AuthType *auth_type,
 256                           enum dcerpc_AuthLevel *auth_level);
 257
 258         struct tevent_req *(*raw_call_send)(TALLOC_CTX *mem_ctx,
 259                                             struct tevent_context *ev,
 260                                             struct dcerpc_binding_handle *h,
 261                                             const struct GUID *object,
 262                                             uint32_t opnum,
 263                                             uint32_t in_flags,
 264                                             const uint8_t *in_data,
 265                                             size_t in_length);
 266         NTSTATUS (*raw_call_recv)(struct tevent_req *req,
 267                                   TALLOC_CTX *mem_ctx,
 268                                   uint8_t **out_data,
 269                                   size_t *out_length,
 270                                   uint32_t *out_flags);
 271
 272         struct tevent_req *(*disconnect_send)(TALLOC_CTX *mem_ctx,
 273                                               struct tevent_context *ev,
 274                                               struct dcerpc_binding_handle *h);
 275         NTSTATUS (*disconnect_recv)(struct tevent_req *req);
 276
 277         /* TODO: remove the following functions */
 278         bool (*push_bigendian)(struct dcerpc_binding_handle *h);
 279         bool (*ref_alloc)(struct dcerpc_binding_handle *h);
 280         bool (*use_ndr64)(struct dcerpc_binding_handle *h);
 281         void (*do_ndr_print)(struct dcerpc_binding_handle *h,
 282                              int ndr_flags,
 283                              const void *struct_ptr,
 284                              const struct ndr_interface_call *call);
 285         void (*ndr_push_failed)(struct dcerpc_binding_handle *h,
 286                                 NTSTATUS error,
 287                                 const void *struct_ptr,
 288                                 const struct ndr_interface_call *call);
 289         void (*ndr_pull_failed)(struct dcerpc_binding_handle *h,
 290                                 NTSTATUS error,
 291                                 const DATA_BLOB *blob,
 292                                 const struct ndr_interface_call *call);
 293         NTSTATUS (*ndr_validate_in)(struct dcerpc_binding_handle *h,
 294                                     TALLOC_CTX *mem_ctx,
 295                                     const DATA_BLOB *blob,
 296                                     const struct ndr_interface_call *call);
 297         NTSTATUS (*ndr_validate_out)(struct dcerpc_binding_handle *h,
 298                                      struct ndr_pull *pull_in,
 299                                      const void *struct_ptr,
 300                                      const struct ndr_interface_call *call);
 301 };
 302
 303 struct dcerpc_binding_handle *_dcerpc_binding_handle_create(TALLOC_CTX *mem_ctx,
 304                                         const struct dcerpc_binding_handle_ops *ops,
 305                                         const struct GUID *object,
 306                                         const struct ndr_interface_table *table,
 307                                         void *pstate,
 308                                         size_t psize,
 309                                         const char *type,
 310                                         const char *location);
 311 #define dcerpc_binding_handle_create(mem_ctx, ops, object, table, \
 312                                 state, type, location) \
 313         _dcerpc_binding_handle_create(mem_ctx, ops, object, table, \
 314                                 state, sizeof(type), #type, location)
 315
 316 void *_dcerpc_binding_handle_data(struct dcerpc_binding_handle *h);
 317 #define dcerpc_binding_handle_data(_h, _type) \
 318         talloc_get_type_abort(_dcerpc_binding_handle_data(_h), _type)
 319
 320 _DEPRECATED_ void dcerpc_binding_handle_set_sync_ev(struct dcerpc_binding_handle *h,
 321                                                     struct tevent_context *ev);
 322
 323 bool dcerpc_binding_handle_is_connected(struct dcerpc_binding_handle *h);
 324
 325 uint32_t dcerpc_binding_handle_set_timeout(struct dcerpc_binding_handle *h,
 326                                            uint32_t timeout);
 327
 328 void dcerpc_binding_handle_auth_info(struct dcerpc_binding_handle *h,
 329                                      enum dcerpc_AuthType *auth_type,
 330                                      enum dcerpc_AuthLevel *auth_level);
 331
 332 struct tevent_req *dcerpc_binding_handle_raw_call_send(TALLOC_CTX *mem_ctx,
 333                                                 struct tevent_context *ev,
 334                                                 struct dcerpc_binding_handle *h,
 335                                                 const struct GUID *object,
 336                                                 uint32_t opnum,
 337                                                 uint32_t in_flags,
 338                                                 const uint8_t *in_data,
 339                                                 size_t in_length);
 340 NTSTATUS dcerpc_binding_handle_raw_call_recv(struct tevent_req *req,
 341                                              TALLOC_CTX *mem_ctx,
 342                                              uint8_t **out_data,
 343                                              size_t *out_length,
 344                                              uint32_t *out_flags);
 345 NTSTATUS dcerpc_binding_handle_raw_call(struct dcerpc_binding_handle *h,
 346                                         const struct GUID *object,
 347                                         uint32_t opnum,
 348                                         uint32_t in_flags,
 349                                         const uint8_t *in_data,
 350                                         size_t in_length,
 351                                         TALLOC_CTX *mem_ctx,
 352                                         uint8_t **out_data,
 353                                         size_t *out_length,
 354                                         uint32_t *out_flags);
 355
 356 struct tevent_req *dcerpc_binding_handle_disconnect_send(TALLOC_CTX *mem_ctx,
 357                                                 struct tevent_context *ev,
 358                                                 struct dcerpc_binding_handle *h);
 359 NTSTATUS dcerpc_binding_handle_disconnect_recv(struct tevent_req *req);
 360
 361 struct tevent_req *dcerpc_binding_handle_call_send(TALLOC_CTX *mem_ctx,
 362                                         struct tevent_context *ev,
 363                                         struct dcerpc_binding_handle *h,
 364                                         const struct GUID *object,
 365                                         const struct ndr_interface_table *table,
 366                                         uint32_t opnum,
 367                                         TALLOC_CTX *r_mem,
 368                                         void *r_ptr);
 369 NTSTATUS dcerpc_binding_handle_call_recv(struct tevent_req *req);
 370 NTSTATUS dcerpc_binding_handle_call(struct dcerpc_binding_handle *h,
 371                                     const struct GUID *object,
 372                                     const struct ndr_interface_table *table,
 373                                     uint32_t opnum,
 374                                     TALLOC_CTX *r_mem,
 375                                     void *r_ptr);
 376
 377 /**
 378  * Extract header information from a ncacn_packet
 379  * as a dcerpc_sec_vt_header2 as used by the security verification trailer.
 380  *
 381  * @param[in] pkt a packet
 382  *
 383  * @return a dcerpc_sec_vt_header2
 384  */
 385 struct dcerpc_sec_vt_header2 dcerpc_sec_vt_header2_from_ncacn_packet(const struct ncacn_packet *pkt);
 386
 387
 388 /**
 389  * Test if two dcerpc_sec_vt_header2 structures are equal
 390  * without consideration of reserved fields.
 391  *
 392  * @param v1 a pointer to a dcerpc_sec_vt_header2 structure
 393  * @param v2 a pointer to a dcerpc_sec_vt_header2 structure
 394  *
 395  * @retval true if *v1 equals *v2
 396  */
 397 bool dcerpc_sec_vt_header2_equal(const struct dcerpc_sec_vt_header2 *v1,
 398                                  const struct dcerpc_sec_vt_header2 *v2);
 399
 400 /**
 401  * Check for consistency of the security verification trailer with the PDU header.
 402  * See <a href="http://msdn.microsoft.com/en-us/library/cc243559.aspx">MS-RPCE 2.2.2.13</a>.
 403  * A check with an empty trailer succeeds.
 404  *
 405  * @param[in] vt a pointer to the security verification trailer.
 406  * @param[in] bitmask1 which flags were negotiated on the connection.
 407  * @param[in] pcontext the syntaxes negotiatied for the presentation context.
 408  * @param[in] header2 some fields from the PDU header.
 409  *
 410  * @retval true on success.
 411  */
 412 bool dcerpc_sec_verification_trailer_check(
 413                 const struct dcerpc_sec_verification_trailer *vt,
 414                 const uint32_t *bitmask1,
 415                 const struct dcerpc_sec_vt_pcontext *pcontext,
 416                 const struct dcerpc_sec_vt_header2 *header2);
 417
 418 /**
 419  * @brief check and optionally extract the Bind Time Features from
 420  * the given ndr_syntax_id.
 421  *
 422  * <a href="http://msdn.microsoft.com/en-us/library/cc243715.aspx">MS-RPCE 3.3.1.5.3 Bind Time Feature Negotiation</a>.
 423  *
 424  * @param[in]  s the syntax that should be checked.
 425  *
 426  * @param[out] features This is optional, it will be filled with the extracted
 427  *                      features the on success, otherwise it's filled with 0.
 428  *
 429  * @return true if the syntax matches the 6CB71C2C-9812-4540 prefix with version 1, false otherwise.
 430  *
 431  * @see dcerpc_construct_bind_time_features
 432  */
 433 bool dcerpc_extract_bind_time_features(struct ndr_syntax_id syntax, uint64_t *features);
 434
 435 /**
 436  * @brief Construct a ndr_syntax_id used for Bind Time Features Negotiation.
 437  *
 438  * <a href="http://msdn.microsoft.com/en-us/library/cc243715.aspx">MS-RPCE 3.3.1.5.3 Bind Time Feature Negotiation</a>.
 439  *
 440  * @param[in] features The supported features.
 441  *
 442  * @return The ndr_syntax_id with the given features.
 443  *
 444  * @see dcerpc_extract_bind_time_features
 445  */
 446 struct ndr_syntax_id dcerpc_construct_bind_time_features(uint64_t features);
 447
 448 #define DCERPC_AUTH_PAD_LENGTH(stub_length) (\
 449         (((stub_length) % DCERPC_AUTH_PAD_ALIGNMENT) > 0)?\
 450         (DCERPC_AUTH_PAD_ALIGNMENT - (stub_length) % DCERPC_AUTH_PAD_ALIGNMENT):\
 451         0)
 452
 453 #endif /* __DEFAULT_LIBRPC_RPCCOMMON_H__ */