1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 /* 22 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 23 * Use is subject to license terms. 24 */ 25 26 #ifndef _LIBMLRPC_H 27 #define _LIBMLRPC_H 28 29 #include <sys/types.h> 30 #include <sys/uio.h> 31 #include <smbsrv/wintypes.h> 32 #include <smbsrv/ndr.h> 33 #include <smbsrv/smb_sid.h> 34 #include <smbsrv/smb_xdr.h> 35 36 #ifdef __cplusplus 37 extern "C" { 38 #endif 39 40 /* 41 * An MSRPC compatible implementation of OSF DCE RPC. DCE RPC is derived 42 * from the Apollo Network Computing Architecture (NCA) RPC implementation. 43 * 44 * CAE Specification (1997) 45 * DCE 1.1: Remote Procedure Call 46 * Document Number: C706 47 * The Open Group 48 * ogspecs@opengroup.org 49 * 50 * This implementation is based on the DCE Remote Procedure Call spec with 51 * enhancements to support Unicode strings. The diagram below shows the 52 * DCE RPC layers compared against ONC SUN RPC. 53 * 54 * NDR RPC Layers Sun RPC Layers Remark 55 * +---------------+ +---------------+ +---------------+ 56 * +---------------+ +---------------+ 57 * | Application | | Application | The application 58 * +---------------+ +---------------+ 59 * | Hand coded | | RPCGEN gen'd | Where the real 60 * | client/server | | client/server | work happens 61 * | srvsvc.ndl | | *_svc.c *_clnt| 62 * | srvsvc.c | | | 63 * +---------------+ +---------------+ 64 * | RPC Library | | RPC Library | Calls/Return 65 * | ndr_*.c | | | Binding/PMAP 66 * +---------------+ +---------------+ 67 * | RPC Protocol | | RPC Protocol | Headers, Auth, 68 * | rpcpdu.ndl | | | 69 * +---------------+ +---------------+ 70 * | IDL gen'd | | RPCGEN gen'd | Aggregate 71 * | NDR stubs | | XDR stubs | Composition 72 * | *__ndr.c | | *_xdr.c | 73 * +---------------+ +---------------+ 74 * | NDR Represen | | XDR Represen | Byte order, padding 75 * +---------------+ +---------------+ 76 * | Packet Heaps | | Network Conn | DCERPC does not talk 77 * | ndo_*.c | | clnt_{tcp,udp}| directly to network. 78 * +---------------+ +---------------+ 79 * 80 * There are two major differences between the DCE RPC and ONC RPC: 81 * 82 * 1. NDR RPC only generates or processes packets from buffers. Other 83 * layers must take care of packet transmission and reception. 84 * The packet heaps are managed through a simple interface provided 85 * by the Network Data Representation (NDR) module called ndr_stream_t. 86 * ndo_*.c modules implement the different flavors (operations) of 87 * packet heaps. 88 * 89 * ONC RPC communicates directly with the network. You have to do 90 * something special for the RPC packet to be placed in a buffer 91 * rather than sent to the wire. 92 * 93 * 2. NDR RPC uses application provided heaps to support operations. 94 * A heap is a single, monolithic chunk of memory that NDR RPC manages 95 * as it allocates. When the operation and its result are done, the 96 * heap is disposed of as a single item. The transaction, which 97 * is the anchor of most operations, contains the necessary book- 98 * keeping for the heap. 99 * 100 * ONC RPC uses malloc() liberally throughout its run-time system. 101 * To free results, ONC RPC supports an XDR_FREE operation that 102 * traverses data structures freeing memory as it goes, whether 103 * it was malloc'd or not. 104 */ 105 106 /* 107 * Dispatch Return Code (DRC) 108 * 109 * 0x8000 15:01 Set to indicate a fault, clear indicates status 110 * 0x7F00 08:07 Status/Fault specific 111 * 0x00FF 00:08 PTYPE_... of PDU, 0xFF for header 112 */ 113 #define NDR_DRC_OK 0x0000 114 #define NDR_DRC_MASK_FAULT 0x8000 115 #define NDR_DRC_MASK_SPECIFIER 0xFF00 116 #define NDR_DRC_MASK_PTYPE 0x00FF 117 118 /* Fake PTYPE DRC discriminators */ 119 #define NDR_DRC_PTYPE_RPCHDR(DRC) ((DRC) | 0x00FF) 120 #define NDR_DRC_PTYPE_API(DRC) ((DRC) | 0x00AA) 121 122 /* DRC Recognizers */ 123 #define NDR_DRC_IS_OK(DRC) (((DRC) & NDR_DRC_MASK_SPECIFIER) == 0) 124 #define NDR_DRC_IS_FAULT(DRC) (((DRC) & NDR_DRC_MASK_FAULT) != 0) 125 126 /* 127 * (Un)Marshalling category specifiers 128 */ 129 #define NDR_DRC_FAULT_MODE_MISMATCH 0x8100 130 #define NDR_DRC_RECEIVED 0x0200 131 #define NDR_DRC_FAULT_RECEIVED_RUNT 0x8300 132 #define NDR_DRC_FAULT_RECEIVED_MALFORMED 0x8400 133 #define NDR_DRC_DECODED 0x0500 134 #define NDR_DRC_FAULT_DECODE_FAILED 0x8600 135 #define NDR_DRC_ENCODED 0x0700 136 #define NDR_DRC_FAULT_ENCODE_FAILED 0x8800 137 #define NDR_DRC_FAULT_ENCODE_TOO_BIG 0x8900 138 #define NDR_DRC_SENT 0x0A00 139 #define NDR_DRC_FAULT_SEND_FAILED 0x8B00 140 141 /* 142 * Resource category specifier 143 */ 144 #define NDR_DRC_FAULT_RESOURCE_1 0x9100 145 #define NDR_DRC_FAULT_RESOURCE_2 0x9200 146 147 /* 148 * Parameters. Usually #define'd with useful alias 149 */ 150 #define NDR_DRC_FAULT_PARAM_0_INVALID 0xC000 151 #define NDR_DRC_FAULT_PARAM_0_UNIMPLEMENTED 0xD000 152 #define NDR_DRC_FAULT_PARAM_1_INVALID 0xC100 153 #define NDR_DRC_FAULT_PARAM_1_UNIMPLEMENTED 0xD100 154 #define NDR_DRC_FAULT_PARAM_2_INVALID 0xC200 155 #define NDR_DRC_FAULT_PARAM_2_UNIMPLEMENTED 0xD200 156 #define NDR_DRC_FAULT_PARAM_3_INVALID 0xC300 157 #define NDR_DRC_FAULT_PARAM_3_UNIMPLEMENTED 0xD300 158 159 #define NDR_DRC_FAULT_OUT_OF_MEMORY 0xF000 160 161 /* RPCHDR */ 162 #define NDR_DRC_FAULT_RPCHDR_PTYPE_INVALID 0xC0FF /* PARAM_0_INVALID */ 163 #define NDR_DRC_FAULT_RPCHDR_PTYPE_UNIMPLEMENTED 0xD0FF /* PARAM_0_UNIMP */ 164 165 /* Request */ 166 #define NDR_DRC_FAULT_REQUEST_PCONT_INVALID 0xC000 /* PARAM_0_INVALID */ 167 #define NDR_DRC_FAULT_REQUEST_OPNUM_INVALID 0xC100 /* PARAM_1_INVALID */ 168 169 /* Bind */ 170 #define NDR_DRC_FAULT_BIND_PCONT_BUSY 0xC00B /* PARAM_0_INVALID */ 171 #define NDR_DRC_FAULT_BIND_UNKNOWN_SERVICE 0xC10B /* PARAM_1_INVALID */ 172 #define NDR_DRC_FAULT_BIND_NO_SLOTS 0x910B /* RESOURCE_1 */ 173 #define NDR_DRC_BINDING_MADE 0x000B /* OK */ 174 175 /* API */ 176 #define NDR_DRC_FAULT_API_SERVICE_INVALID 0xC0AA /* PARAM_0_INVALID */ 177 #define NDR_DRC_FAULT_API_BIND_NO_SLOTS 0x91AA /* RESOURCE_1 */ 178 #define NDR_DRC_FAULT_API_OPNUM_INVALID 0xC1AA /* PARAM_1_INVALID */ 179 180 struct ndr_xa; 181 struct ndr_client; 182 183 typedef struct ndr_stub_table { 184 int (*func)(void *, struct ndr_xa *); 185 unsigned short opnum; 186 } ndr_stub_table_t; 187 188 typedef struct ndr_service { 189 char *name; 190 char *desc; 191 char *endpoint; 192 char *sec_addr_port; 193 char *abstract_syntax_uuid; 194 int abstract_syntax_version; 195 char *transfer_syntax_uuid; 196 int transfer_syntax_version; 197 unsigned bind_instance_size; 198 int (*bind_req)(); 199 int (*unbind_and_close)(); 200 int (*call_stub)(struct ndr_xa *); 201 ndr_typeinfo_t *interface_ti; 202 ndr_stub_table_t *stub_table; 203 } ndr_service_t; 204 205 /* 206 * The list of bindings is anchored at a connection. Nothing in the 207 * RPC mechanism allocates them. Binding elements which have service==0 208 * indicate free elements. When a connection is instantiated, at least 209 * one free binding entry should also be established. Something like 210 * this should suffice for most (all) situations: 211 * 212 * struct connection { 213 * .... 214 * ndr_binding_t *binding_list_head; 215 * ndr_binding_t binding_pool[N_BINDING_POOL]; 216 * .... 217 * }; 218 * 219 * init_connection(struct connection *conn) { 220 * .... 221 * ndr_svc_binding_pool_init(&conn->binding_list_head, 222 * conn->binding_pool, N_BINDING_POOL); 223 */ 224 typedef struct ndr_binding { 225 struct ndr_binding *next; 226 ndr_p_context_id_t p_cont_id; 227 unsigned char which_side; 228 struct ndr_client *clnt; 229 ndr_service_t *service; 230 void *instance_specific; 231 } ndr_binding_t; 232 233 #define NDR_BIND_SIDE_CLIENT 1 234 #define NDR_BIND_SIDE_SERVER 2 235 236 #define NDR_BINDING_TO_SPECIFIC(BINDING, TYPE) \ 237 ((TYPE *) (BINDING)->instance_specific) 238 239 /* 240 * The binding list space must be provided by the application library 241 * for use by the underlying RPC library. We need at least two binding 242 * slots per connection. 243 */ 244 #define NDR_N_BINDING_POOL 2 245 246 typedef struct ndr_pipe { 247 int np_fid; 248 uint32_t np_txid; 249 smb_netuserinfo_t np_user; 250 char *np_buf; 251 struct uio np_uio; 252 iovec_t np_iov; 253 ndr_fraglist_t np_frags; 254 int np_refcnt; 255 uint16_t np_max_xmit_frag; 256 uint16_t np_max_recv_frag; 257 ndr_binding_t *np_binding; 258 ndr_binding_t np_binding_pool[NDR_N_BINDING_POOL]; 259 } ndr_pipe_t; 260 261 typedef struct ndr_pipe_info { 262 uint32_t npi_fid; 263 uint32_t npi_permissions; 264 uint32_t npi_num_locks; 265 char npi_pathname[MAXPATHLEN]; 266 char npi_username[MAXNAMELEN]; 267 } ndr_pipe_info_t; 268 269 /* 270 * Number of bytes required to align SIZE on the next dword/4-byte 271 * boundary. 272 */ 273 #define NDR_ALIGN4(SIZE) ((4 - (SIZE)) & 3); 274 275 /* 276 * DCE RPC strings (CAE section 14.3.4) are represented as varying or varying 277 * and conformant one-dimensional arrays. Characters can be single-byte 278 * or multi-byte as long as all characters conform to a fixed element size, 279 * i.e. UCS-2 is okay but UTF-8 is not a valid DCE RPC string format. The 280 * string is terminated by a null character of the appropriate element size. 281 * 282 * MSRPC strings should always be varying/conformant and not null terminated. 283 * This format uses the size_is, first_is and length_is attributes (CAE 284 * section 4.2.18). 285 * 286 * typedef struct string { 287 * DWORD size_is; 288 * DWORD first_is; 289 * DWORD length_is; 290 * wchar_t string[ANY_SIZE_ARRAY]; 291 * } string_t; 292 * 293 * The size_is attribute is used to specify the number of data elements in 294 * each dimension of an array. 295 * 296 * The first_is attribute is used to define the lower bound for significant 297 * elements in each dimension of an array. For strings this is always 0. 298 * 299 * The length_is attribute is used to define the number of significant 300 * elements in each dimension of an array. For strings this is typically 301 * the same as size_is. Although it might be (size_is - 1) if the string 302 * is null terminated. 303 * 304 * 4 bytes 4 bytes 4 bytes 2bytes 2bytes 2bytes 2bytes 305 * +---------+---------+---------+------+------+------+------+ 306 * |size_is |first_is |length_is| char | char | char | char | 307 * +---------+---------+---------+------+------+------+------+ 308 * 309 * Unfortunately, not all MSRPC Unicode strings are null terminated, which 310 * means that the recipient has to manually null-terminate the string after 311 * it has been unmarshalled. There may be a wide-char pad following a 312 * string, and it may sometimes contains zero, but it's not guaranteed. 313 * 314 * To deal with this, MSRPC sometimes uses an additional wrapper with two 315 * more fields, as shown below. 316 * length: the array length in bytes excluding terminating null bytes 317 * maxlen: the array length in bytes including null terminator bytes 318 * LPTSTR: converted to a string_t by NDR 319 * 320 * typedef struct ms_string { 321 * WORD length; 322 * WORD maxlen; 323 * LPTSTR str; 324 * } ms_string_t; 325 */ 326 typedef struct ndr_mstring { 327 uint16_t length; 328 uint16_t allosize; 329 LPTSTR str; 330 } ndr_mstring_t; 331 332 /* 333 * A number of heap areas are used during marshalling and unmarshalling. 334 * Under some circumstances these areas can be discarded by the library 335 * code, i.e. on the server side before returning to the client and on 336 * completion of a client side bind. In the case of a client side RPC 337 * call, these areas must be preserved after an RPC returns to give the 338 * caller time to take a copy of the data. In this case the client must 339 * call ndr_clnt_free_heap to free the memory. 340 * 341 * The heap management data definition looks a bit like this: 342 * 343 * heap -> +---------------+ +------------+ 344 * | iovec[0].base | --> | data block | 345 * | iovec[0].len | +------------+ 346 * +---------------+ 347 * :: 348 * :: 349 * iov -> +---------------+ +------------+ 350 * | iovec[n].base | --> | data block | 351 * | iovec[n].len | +------------+ 352 * +---------------+ ^ ^ 353 * | | 354 * next ----------------------+ | 355 * top -----------------------------------+ 356 * 357 */ 358 359 /* 360 * Setting MAXIOV to 384 will use ((8 * 384) + 16) = 3088 bytes 361 * of the first heap block. 362 */ 363 #define NDR_HEAP_MAXIOV 384 364 #define NDR_HEAP_BLKSZ 8192 365 366 typedef struct ndr_heap { 367 struct iovec iovec[NDR_HEAP_MAXIOV]; 368 struct iovec *iov; 369 int iovcnt; 370 char *top; 371 char *next; 372 } ndr_heap_t; 373 374 /* 375 * Alternate varying/conformant string definition 376 * - for non-null-terminated strings. 377 */ 378 typedef struct ndr_vcs { 379 /* 380 * size_is (actually a copy of length_is) will 381 * be inserted here by the marshalling library. 382 */ 383 uint32_t vc_first_is; 384 uint32_t vc_length_is; 385 uint16_t buffer[ANY_SIZE_ARRAY]; 386 } ndr_vcs_t; 387 388 typedef struct ndr_vcstr { 389 uint16_t wclen; 390 uint16_t wcsize; 391 ndr_vcs_t *vcs; 392 } ndr_vcstr_t; 393 394 typedef struct ndr_vcb { 395 /* 396 * size_is (actually a copy of length_is) will 397 * be inserted here by the marshalling library. 398 */ 399 uint32_t vc_first_is; 400 uint32_t vc_length_is; 401 uint8_t buffer[ANY_SIZE_ARRAY]; 402 } ndr_vcb_t; 403 404 typedef struct ndr_vcbuf { 405 uint16_t len; 406 uint16_t size; 407 ndr_vcb_t *vcb; 408 } ndr_vcbuf_t; 409 410 ndr_heap_t *ndr_heap_create(void); 411 void ndr_heap_destroy(ndr_heap_t *); 412 void *ndr_heap_malloc(ndr_heap_t *, unsigned); 413 void *ndr_heap_strdup(ndr_heap_t *, const char *); 414 int ndr_heap_mstring(ndr_heap_t *, const char *, ndr_mstring_t *); 415 void ndr_heap_mkvcs(ndr_heap_t *, char *, ndr_vcstr_t *); 416 void ndr_heap_mkvcb(ndr_heap_t *, uint8_t *, uint32_t, ndr_vcbuf_t *); 417 smb_sid_t *ndr_heap_siddup(ndr_heap_t *, smb_sid_t *); 418 int ndr_heap_used(ndr_heap_t *); 419 int ndr_heap_avail(ndr_heap_t *); 420 421 #define NDR_MALLOC(XA, SZ) ndr_heap_malloc((XA)->heap, SZ) 422 #define NDR_NEW(XA, T) ndr_heap_malloc((XA)->heap, sizeof (T)) 423 #define NDR_NEWN(XA, T, N) ndr_heap_malloc((XA)->heap, sizeof (T)*(N)) 424 #define NDR_STRDUP(XA, S) ndr_heap_strdup((XA)->heap, (S)) 425 #define NDR_MSTRING(XA, S, OUT) ndr_heap_mstring((XA)->heap, (S), (OUT)) 426 #define NDR_SIDDUP(XA, S) ndr_heap_siddup((XA)->heap, (S)) 427 428 typedef struct ndr_xa { 429 int fid; 430 unsigned short ptype; /* high bits special */ 431 unsigned short opnum; 432 ndr_stream_t recv_nds; 433 ndr_hdr_t recv_hdr; 434 ndr_stream_t send_nds; 435 ndr_hdr_t send_hdr; 436 ndr_binding_t *binding; /* what we're using */ 437 ndr_binding_t *binding_list; /* from connection */ 438 ndr_heap_t *heap; 439 ndr_pipe_t *pipe; 440 } ndr_xa_t; 441 442 /* 443 * 20-byte opaque id used by various RPC services. 444 */ 445 CONTEXT_HANDLE(ndr_hdid) ndr_hdid_t; 446 447 typedef struct ndr_client { 448 int (*xa_init)(struct ndr_client *, ndr_xa_t *); 449 int (*xa_exchange)(struct ndr_client *, ndr_xa_t *); 450 int (*xa_read)(struct ndr_client *, ndr_xa_t *); 451 void (*xa_preserve)(struct ndr_client *, ndr_xa_t *); 452 void (*xa_destruct)(struct ndr_client *, ndr_xa_t *); 453 void (*xa_release)(struct ndr_client *); 454 455 int fid; 456 ndr_hdid_t *handle; 457 ndr_binding_t *binding; 458 ndr_binding_t *binding_list; 459 ndr_binding_t binding_pool[NDR_N_BINDING_POOL]; 460 461 boolean_t nonull; 462 boolean_t heap_preserved; 463 ndr_heap_t *heap; 464 ndr_stream_t *recv_nds; 465 ndr_stream_t *send_nds; 466 467 uint32_t next_call_id; 468 unsigned next_p_cont_id; 469 } ndr_client_t; 470 471 typedef struct ndr_handle { 472 ndr_hdid_t nh_id; 473 struct ndr_handle *nh_next; 474 int nh_fid; 475 const ndr_service_t *nh_svc; 476 ndr_client_t *nh_clnt; 477 void *nh_data; 478 void (*nh_data_free)(void *); 479 } ndr_handle_t; 480 481 #define NDR_PDU_SIZE_HINT_DEFAULT (16*1024) 482 #define NDR_BUF_MAGIC 0x4E425546 /* NBUF */ 483 484 typedef struct ndr_buf { 485 uint32_t nb_magic; 486 ndr_stream_t nb_nds; 487 ndr_heap_t *nb_heap; 488 ndr_typeinfo_t *nb_ti; 489 } ndr_buf_t; 490 491 /* ndr_ops.c */ 492 int nds_initialize(ndr_stream_t *, unsigned, int, ndr_heap_t *); 493 void nds_finalize(ndr_stream_t *, ndr_fraglist_t *); 494 void nds_destruct(ndr_stream_t *); 495 void nds_show_state(ndr_stream_t *); 496 497 /* ndr_client.c */ 498 int ndr_clnt_bind(ndr_client_t *, const char *, ndr_binding_t **); 499 int ndr_clnt_call(ndr_binding_t *, int, void *); 500 void ndr_clnt_free_heap(ndr_client_t *); 501 502 /* ndr_marshal.c */ 503 ndr_buf_t *ndr_buf_init(ndr_typeinfo_t *); 504 void ndr_buf_fini(ndr_buf_t *); 505 int ndr_buf_decode(ndr_buf_t *, unsigned, const char *data, size_t, void *); 506 int ndr_decode_call(ndr_xa_t *, void *); 507 int ndr_encode_return(ndr_xa_t *, void *); 508 int ndr_encode_call(ndr_xa_t *, void *); 509 int ndr_decode_return(ndr_xa_t *, void *); 510 int ndr_decode_pdu_hdr(ndr_xa_t *); 511 int ndr_encode_pdu_hdr(ndr_xa_t *); 512 void ndr_decode_frag_hdr(ndr_stream_t *, ndr_common_header_t *); 513 void ndr_remove_frag_hdr(ndr_stream_t *); 514 void ndr_show_hdr(ndr_common_header_t *); 515 unsigned ndr_bind_ack_hdr_size(ndr_xa_t *); 516 unsigned ndr_alter_context_rsp_hdr_size(void); 517 518 /* ndr_server.c */ 519 int ndr_pipe_open(int, uint8_t *, uint32_t); 520 int ndr_pipe_close(int); 521 int ndr_pipe_read(int, uint8_t *, uint32_t *, uint32_t *); 522 int ndr_pipe_write(int, uint8_t *, uint32_t); 523 void *ndr_pipe_transact(void *); 524 525 int ndr_generic_call_stub(ndr_xa_t *); 526 527 boolean_t ndr_is_admin(ndr_xa_t *); 528 boolean_t ndr_is_poweruser(ndr_xa_t *); 529 int32_t ndr_native_os(ndr_xa_t *); 530 531 /* ndr_svc.c */ 532 ndr_stub_table_t *ndr_svc_find_stub(ndr_service_t *, int); 533 ndr_service_t *ndr_svc_lookup_name(const char *); 534 ndr_service_t *ndr_svc_lookup_uuid(ndr_uuid_t *, int, ndr_uuid_t *, int); 535 int ndr_svc_register(ndr_service_t *); 536 void ndr_svc_unregister(ndr_service_t *); 537 void ndr_svc_binding_pool_init(ndr_binding_t **, ndr_binding_t pool[], int); 538 ndr_binding_t *ndr_svc_find_binding(ndr_xa_t *, ndr_p_context_id_t); 539 ndr_binding_t *ndr_svc_new_binding(ndr_xa_t *); 540 541 int ndr_uuid_parse(char *, ndr_uuid_t *); 542 void ndr_uuid_unparse(ndr_uuid_t *, char *); 543 544 ndr_hdid_t *ndr_hdalloc(const ndr_xa_t *, const void *); 545 void ndr_hdfree(const ndr_xa_t *, const ndr_hdid_t *); 546 ndr_handle_t *ndr_hdlookup(const ndr_xa_t *, const ndr_hdid_t *); 547 void ndr_hdclose(int fid); 548 549 ssize_t ndr_uiomove(caddr_t, size_t, enum uio_rw, struct uio *); 550 551 #ifdef __cplusplus 552 } 553 #endif 554 555 #endif /* _LIBMLRPC_H */ 556