summaryrefslogtreecommitdiffstats
path: root/source/smbd/ipc.c
diff options
context:
space:
mode:
Diffstat (limited to 'source/smbd/ipc.c')
-rw-r--r--source/smbd/ipc.c251
1 files changed, 11 insertions, 240 deletions
diff --git a/source/smbd/ipc.c b/source/smbd/ipc.c
index c0ce1900235..c647a5de3e0 100644
--- a/source/smbd/ipc.c
+++ b/source/smbd/ipc.c
@@ -3110,251 +3110,18 @@ static BOOL api_WPrintPortEnum(connection_struct *conn,uint16 vuid, char *param,
return(True);
}
-static BOOL api_pipe_ntlmssp(pipes_struct *p, prs_struct *pd)
-{
- /* receive a negotiate; send a challenge; receive a response */
- switch (p->auth_verifier.msg_type)
- {
- case NTLMSSP_NEGOTIATE:
- {
- smb_io_rpc_auth_ntlmssp_neg("", &p->ntlmssp_neg, pd, 0);
- break;
- }
- case NTLMSSP_AUTH:
- {
- smb_io_rpc_auth_ntlmssp_resp("", &p->ntlmssp_resp, pd, 0);
- break;
- }
- default:
- {
- /* NTLMSSP expected: unexpected message type */
- DEBUG(3,("unexpected message type in NTLMSSP %d\n",
- p->auth_verifier.msg_type));
- return False;
- }
- }
-
- return (pd->offset != 0);
-}
-
-struct api_cmd
-{
- char * pipe_clnt_name;
- char * pipe_srv_name;
- BOOL (*fn) (pipes_struct *, prs_struct *);
-};
-
-static struct api_cmd api_fd_commands[] =
-{
- { "lsarpc", "lsass", api_ntlsa_rpc },
- { "samr", "lsass", api_samr_rpc },
- { "srvsvc", "ntsvcs", api_srvsvc_rpc },
- { "wkssvc", "ntsvcs", api_wkssvc_rpc },
- { "NETLOGON", "lsass", api_netlog_rpc },
- { "winreg", "winreg", api_reg_rpc },
- { NULL, NULL, NULL }
-};
-
-static BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *pd)
-{
- BOOL ntlmssp_auth = False;
- uint16 assoc_gid;
- fstring ack_pipe_name;
- int i = 0;
-
- DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
-
- for (i = 0; api_fd_commands[i].pipe_clnt_name; i++)
- {
- if (strequal(api_fd_commands[i].pipe_clnt_name, p->name) &&
- api_fd_commands[i].fn != NULL)
- {
- DEBUG(3,("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
- api_fd_commands[i].pipe_clnt_name,
- api_fd_commands[i].pipe_srv_name));
- fstrcpy(p->pipe_srv_name, api_fd_commands[i].pipe_srv_name);
- break;
- }
- }
-
- if (api_fd_commands[i].fn == NULL) return False;
-
- /* decode the bind request */
- smb_io_rpc_hdr_rb("", &p->hdr_rb, pd, 0);
-
- if (pd->offset == 0) return False;
-
- if (p->hdr.auth_len != 0)
- {
- /* decode the authentication verifier */
- smb_io_rpc_auth_verifier("", &p->auth_verifier, pd, 0);
-
- if (pd->offset == 0) return False;
-
- ntlmssp_auth = strequal(p->auth_verifier.signature, "NTLMSSP");
-
- if (ntlmssp_auth)
- {
- if (!api_pipe_ntlmssp(p, pd)) return False;
- }
- }
-
- /* name has to be \PIPE\xxxxx */
- fstrcpy(ack_pipe_name, "\\PIPE\\");
- fstrcat(ack_pipe_name, p->pipe_srv_name);
-
- DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
-
- prs_init(&(p->rdata), 1024, 4, 0, False);
- prs_init(&(p->rhdr ), 0x10, 4, 0, False);
- prs_init(&(p->rauth), 1024, 4, 0, False);
- prs_init(&(p->rntlm), 1024, 4, 0, False);
-
- /***/
- /*** do the bind ack first ***/
- /***/
-
- if (ntlmssp_auth)
- {
- assoc_gid = 0x7a77;
- }
- else
- {
- assoc_gid = p->hdr_rb.bba.assoc_gid;
- }
-
- make_rpc_hdr_ba(&p->hdr_ba,
- p->hdr_rb.bba.max_tsize,
- p->hdr_rb.bba.max_rsize,
- assoc_gid,
- ack_pipe_name,
- 0x1, 0x0, 0x0,
- &(p->hdr_rb.transfer));
-
- smb_io_rpc_hdr_ba("", &p->hdr_ba, &p->rdata, 0);
- mem_realloc_data(p->rdata.data, p->rdata.offset);
-
- /***/
- /*** now the authentication ***/
- /***/
-
- if (ntlmssp_auth)
- {
- uint8 challenge[8];
- generate_random_buffer(challenge, 8, False);
-
- make_rpc_auth_verifier(&p->auth_verifier,
- 0x0a, 0x06, 0,
- "NTLMSSP", NTLMSSP_CHALLENGE);
- smb_io_rpc_auth_verifier("", &p->auth_verifier, &p->rauth, 0);
- mem_realloc_data(p->rauth.data, p->rauth.offset);
-
- make_rpc_auth_ntlmssp_chal(&p->ntlmssp_chal,
- 0x000082b1, challenge);
- smb_io_rpc_auth_ntlmssp_chal("", &p->ntlmssp_chal, &p->rntlm, 0);
- mem_realloc_data(p->rntlm.data, p->rntlm.offset);
- }
-
- /***/
- /*** then do the header, now we know the length ***/
- /***/
-
- make_rpc_hdr(&p->hdr, RPC_BINDACK, RPC_FLG_FIRST | RPC_FLG_LAST,
- p->hdr.call_id,
- p->rdata.offset + p->rauth.offset + p->rntlm.offset + 0x10,
- p->rauth.offset + p->rntlm.offset);
-
- smb_io_rpc_hdr("", &p->hdr, &p->rhdr, 0);
- mem_realloc_data(p->rhdr.data, p->rdata.offset);
-
- /***/
- /*** link rpc header, bind acknowledgment and authentication responses ***/
- /***/
-
- p->rhdr.data->offset.start = 0;
- p->rhdr.data->offset.end = p->rhdr.offset;
- p->rhdr.data->next = p->rdata.data;
-
- if (ntlmssp_auth)
- {
- p->rdata.data->offset.start = p->rhdr.offset;
- p->rdata.data->offset.end = p->rhdr.offset + p->rdata.offset;
- p->rdata.data->next = p->rauth.data;
-
- p->rauth.data->offset.start = p->rhdr.offset + p->rdata.offset;
- p->rauth.data->offset.end = p->rhdr.offset + p->rdata.offset + p->rauth.offset;
- p->rauth.data->next = p->rntlm.data;
-
- p->rntlm.data->offset.start = p->rhdr.offset + p->rdata.offset + p->rauth.offset;
- p->rntlm.data->offset.end = p->rhdr.offset + p->rdata.offset + p->rauth.offset + p->rntlm.offset;
- p->rntlm.data->next = NULL;
- }
- else
- {
- p->rdata.data->offset.start = p->rhdr.offset;
- p->rdata.data->offset.end = p->rhdr.offset + p->rdata.offset;
- p->rdata.data->next = NULL;
- }
-
- return True;
-}
-
-static BOOL api_pipe_request(pipes_struct *p, prs_struct *pd)
-{
- int i = 0;
-
- for (i = 0; api_fd_commands[i].pipe_clnt_name; i++)
- {
- if (strequal(api_fd_commands[i].pipe_clnt_name, p->name) &&
- api_fd_commands[i].fn != NULL)
- {
- DEBUG(3,("Doing \\PIPE\\%s\n", api_fd_commands[i].pipe_clnt_name));
- return api_fd_commands[i].fn(p, pd);
- }
- }
- return False;
-}
-
-static BOOL api_dce_rpc_command(char *outbuf,
+static void api_rpc_trans_reply(char *outbuf,
pipes_struct *p,
prs_struct *pd)
{
- BOOL reply = False;
- if (pd->data == NULL) return False;
-
- /* process the rpc header */
- smb_io_rpc_hdr("", &p->hdr, pd, 0);
-
- if (pd->offset == 0) return False;
+ send_trans_reply(outbuf, p->rhdr.data, NULL, NULL, 0, p->file_offset);
- switch (p->hdr.pkt_type)
+ if (mem_buf_len(p->rhdr.data) <= p->file_offset)
{
- case RPC_BIND :
- {
- reply = api_pipe_bind_req(p, pd);
- break;
- }
- case RPC_REQUEST:
- {
- reply = api_pipe_request (p, pd);
- break;
- }
+ /* all of data was sent: no need to wait for SMBreadX calls */
+ mem_free_data(p->rhdr .data);
+ mem_free_data(p->rdata.data);
}
-
- if (reply)
- {
- /* now send the reply */
- send_trans_reply(outbuf, p->rhdr.data, NULL, NULL, 0, p->file_offset);
-
- if (mem_buf_len(p->rhdr.data) <= p->file_offset)
- {
- /* all of data was sent: no need to wait for SMBreadX calls */
- mem_free_data(p->rhdr .data);
- mem_free_data(p->rdata.data);
- }
- }
-
- return reply;
}
/****************************************************************************
@@ -3463,7 +3230,11 @@ static int api_fd_reply(connection_struct *conn,uint16 vuid,char *outbuf,
case 0x26:
{
/* dce/rpc command */
- reply = api_dce_rpc_command(outbuf, p, &pd);
+ reply = rpc_command(p, &pd);
+ if (reply)
+ {
+ api_rpc_trans_reply(outbuf, p, &pd);
+ }
break;
}
case 0x01:
generated by cgit (git 2.34.1) at 2024-11-14 05:20:15 +0000