1 /*
2    WMI Implementation
3    Copyright (C) 2006 Andrzej Hajda <andrzej.hajda@wp.pl>
4    Copyright (C) 2008-2009 Zenoss, Inc., all rights reserved
5 
6    This program is free software; you can redistribute it and/or modify
7    it under the terms of the GNU General Public License as published by
8    the Free Software Foundation; either version 2 of the License, or
9    (at your option) any later version.
10 
11    This program is distributed in the hope that it will be useful,
12    but WITHOUT ANY WARRANTY; without even the implied warranty of
13    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
14    GNU General Public License for more details.
15 
16    You should have received a copy of the GNU General Public License
17    along with this program; if not, write to the Free Software
18    Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
19 */
20 
21 #include "includes.h"
22 #include "librpc/gen_ndr/dcom.h"
23 #include "librpc/gen_ndr/com_dcom.h"
24 #include "librpc/ndr/libndr.h"
25 #include "librpc/ndr/libndr_proto.h"
26 #include "lib/com/com.h"
27 #include "lib/com/dcom/dcom.h"
28 #include "lib/util/dlinklist.h"
29 #include "librpc/ndr/libndr.h"
30 #include "librpc/gen_ndr/ndr_dcom.h"
31 #include "librpc/rpc/dcerpc.h"
32 #include "librpc/gen_ndr/ndr_misc.h"
33 #include "lib/talloc/talloc.h"
34 #include "libcli/composite/composite.h"
35 #include "wmi/wmi.h"
36 
37 NTSTATUS ndr_pull_WbemClassObject_Object(struct ndr_pull *ndr, int ndr_flags, struct WbemClassObject *r);
38 void duplicate_CIMVAR(TALLOC_CTX *mem_ctx, const union CIMVAR *src, union CIMVAR *dst, enum CIMTYPE_ENUMERATION cimtype);
39 void duplicate_WbemClassObject(TALLOC_CTX *mem_ctx, const struct WbemClassObject *src, struct WbemClassObject *dst);
40 
41 #define NDR_CHECK_LEN(n) do { if (p + (n) > pend) { \
42             			DEBUG(0, ("%s(%d): WBEMDATA_ERR(0x%08X): Buffer too small(0x%04X)\n", __FILE__, __LINE__, ndr->offset, p + (n) - pend)); \
43 				status = NT_STATUS_UNSUCCESSFUL; \
44             			goto end; \
45 			    } \
46 			} while(0)
47 
48 #define NDR_CHECK_EXPR(expr) do { if (!(expr)) {\
49 					DEBUG(0, ("%s(%d): WBEMDATA_ERR(0x%08X): Error parsing(%s)\n", __FILE__, __LINE__, ndr->offset, #expr)); \
50 					status = NT_STATUS_UNSUCCESSFUL; \
51             				goto end; \
52 					} \
53 				    } while(0)
54 
55 #define NDR_CHECK_CONST(val, exp) NDR_CHECK_EXPR((val) == (exp))
56 #define NDR_CHECK_RSTRING(rstring) NDR_CHECK_EXPR((rstring) >= 0)
57 
58 #define NTERR_CHECK(call) status = call; if (!NT_STATUS_IS_OK(status)) goto end;
59 
60 enum {
61 	DATATYPE_CLASSOBJECT = 2,
62 	DATATYPE_OBJECT = 3,
63 
64 	COFLAG_IS_CLASS = 4,
65 };
66 
marshal(struct IUnknown * pv,struct OBJREF * o)67 static NTSTATUS marshal(struct IUnknown *pv, struct OBJREF *o)
68 {
69 	struct ndr_push *ndr;
70 	NTSTATUS status;
71 	struct WbemClassObject *wco;
72 	TALLOC_CTX *mem_ctx;
73 	struct MInterfacePointer *mp;
74 
75 	mp = (struct MInterfacePointer *)((char *)o - offsetof(struct MInterfacePointer, obj)); // FIXME:high remove this Mumbo Jumbo
76 	wco = pv->object_data;
77 	mem_ctx = talloc_new(0);
78 	ndr = talloc_zero(mem_ctx, struct ndr_push);
79 	ndr->flags = 0;
80 	ndr->alloc_size = 1024;
81 	ndr->data = talloc_array(mp, uint8_t, ndr->alloc_size);
82 
83 	if (wco) {
84 		uint32_t ofs;
85 		NTERR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, 0x12345678));
86 		NTERR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, 0));
87 		NTERR_CHECK(ndr_push_WbemClassObject(ndr, NDR_SCALARS | NDR_BUFFERS, wco));
88 		ofs = ndr->offset;
89 		ndr->offset = 4;
90 		NTERR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, ofs - 8));
91 		ndr->offset = ofs;
92 	} else {
93 		NTERR_CHECK(ndr_push_uint32(ndr, NDR_SCALARS, 0));
94 	}
95 	o->u_objref.u_custom.pData = talloc_realloc(mp, ndr->data, uint8_t, ndr->offset);
96 	o->u_objref.u_custom.size = ndr->offset;
97 	mp->size = sizeof(struct OBJREF) - sizeof(union OBJREF_Types) + sizeof(struct u_custom) + o->u_objref.u_custom.size - 4;
98         if (DEBUGLVL(9)) {
99 		NDR_PRINT_DEBUG(WbemClassObject, wco);
100 	}
101 end:
102 	talloc_free(mem_ctx);
103 	return status;
104 }
105 
unmarshal(struct OBJREF * o,struct IUnknown ** pv)106 static NTSTATUS unmarshal(struct OBJREF *o, struct IUnknown **pv)
107 {
108 	struct ndr_pull *ndr;
109 	TALLOC_CTX *mem_ctx;
110 	struct WbemClassObject *wco;
111 	NTSTATUS status;
112 	uint32_t u;
113 
114 	mem_ctx = talloc_new(0);
115 	ndr = talloc_zero(mem_ctx, struct ndr_pull);
116 	ndr->current_mem_ctx = mem_ctx;
117 	ndr->data = o->u_objref.u_custom.pData;
118 	ndr->data_size = o->u_objref.u_custom.size;
119 
120 	NTERR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
121 	if (!u) {
122 		talloc_free(*pv);
123 		*pv = NULL;
124 		status = NT_STATUS_OK;
125 		goto end;
126 	}
127 	NTERR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
128 	if (u + 8 > ndr->data_size) {
129 		DEBUG(1, ("unmarshall_IWbemClassObject: Incorrect data_size"));
130 		status = NT_STATUS_BUFFER_TOO_SMALL;
131 		goto end;
132 	}
133 	wco = talloc_zero(*pv, struct WbemClassObject);
134 	ndr->current_mem_ctx = wco;
135 	status = ndr_pull_WbemClassObject(ndr, NDR_SCALARS | NDR_BUFFERS, wco);
136 
137         if (NT_STATUS_IS_OK(status) && (DEBUGLVL(9))) {
138 		NDR_PRINT_DEBUG(WbemClassObject, wco);
139         }
140 
141 	if (NT_STATUS_IS_OK(status)) {
142 		(*pv)->object_data = wco;
143 	} else {
144 		talloc_free(wco);
145 	}
146 end:
147 	talloc_free(mem_ctx);
148 	return status;
149 }
150 
dcom_IWbemClassObject_from_WbemClassObject(struct com_context * ctx,struct IWbemClassObject ** _p,struct WbemClassObject * wco)151 WERROR dcom_IWbemClassObject_from_WbemClassObject(struct com_context *ctx, struct IWbemClassObject **_p, struct WbemClassObject *wco)
152 {
153 	struct IWbemClassObject *p;
154 
155 
156 	p = talloc_zero(ctx, struct IWbemClassObject);
157 	p->ctx = ctx;
158 	p->obj.signature = 0x574f454d;
159 	p->obj.flags = OBJREF_CUSTOM;
160 	GUID_from_string("dc12a681-737f-11cf-884d-00aa004b2e24", &p->obj.iid);
161 	GUID_from_string("4590f812-1d3a-11d0-891f-00aa004b2e24", &p->obj.u_objref.u_custom.clsid);
162 	p->object_data = (void *)wco;
163 	talloc_steal(p, p->object_data);
164 	*_p = p;
165 	return WERR_OK;
166 }
167 
IWbemClassObject_GetMethod(struct IWbemClassObject * d,TALLOC_CTX * mem_ctx,const char * name,uint32_t flags,struct IWbemClassObject ** in,struct IWbemClassObject ** out)168 WERROR IWbemClassObject_GetMethod(struct IWbemClassObject *d, TALLOC_CTX *mem_ctx, const char *name, uint32_t flags, struct IWbemClassObject **in, struct IWbemClassObject **out)
169 {
170 	uint32_t i;
171 	struct WbemClassObject *wco;
172 
173 	wco = (struct WbemClassObject *)d->object_data;
174 	for (i = 0; i < wco->obj_methods->count; ++i)
175 		if (!strcmp(wco->obj_methods->method[i].name, name)) {
176 			if (in) dcom_IWbemClassObject_from_WbemClassObject(d->ctx, in, wco->obj_methods->method[i].in);
177 			if (out) dcom_IWbemClassObject_from_WbemClassObject(d->ctx, out, wco->obj_methods->method[i].out);
178 			return WERR_OK;
179 		}
180 	return WERR_NOT_FOUND;
181 }
182 
WbemClassObject_CreateInstance(struct WbemClassObject * wco)183 void WbemClassObject_CreateInstance(struct WbemClassObject *wco)
184 {
185 	uint32_t i;
186 
187 	wco->instance = talloc_zero(wco, struct WbemInstance);
188 	wco->instance->default_flags = talloc_array(wco->instance, uint8_t, wco->obj_class->__PROPERTY_COUNT);
189 	wco->instance->data = talloc_array(wco->instance, union CIMVAR, wco->obj_class->__PROPERTY_COUNT);
190 	memset(wco->instance->data, 0, sizeof(union CIMVAR) * wco->obj_class->__PROPERTY_COUNT);
191 	for (i = 0; i < wco->obj_class->__PROPERTY_COUNT; ++i) {
192 		wco->instance->default_flags[i] = 1; // FIXME:high resolve this magic
193 	}
194 	wco->instance->__CLASS = wco->obj_class->__CLASS;
195 	wco->instance->u2_4 = 4;
196 	wco->instance->u3_1 = 1;
197 }
198 
IWbemClassObject_Clone(struct IWbemClassObject * d,TALLOC_CTX * mem_ctx,struct IWbemClassObject ** copy)199 WERROR IWbemClassObject_Clone(struct IWbemClassObject *d, TALLOC_CTX *mem_ctx, struct IWbemClassObject **copy)
200 {
201 	return WERR_NOT_SUPPORTED;
202 }
203 
IWbemClassObject_SpawnInstance(struct IWbemClassObject * d,TALLOC_CTX * mem_ctx,uint32_t flags,struct IWbemClassObject ** instance)204 WERROR IWbemClassObject_SpawnInstance(struct IWbemClassObject *d, TALLOC_CTX *mem_ctx, uint32_t flags, struct IWbemClassObject **instance)
205 {
206 	struct WbemClassObject *wco, *nwco;
207 
208 	wco = (struct WbemClassObject *)d->object_data;
209 	nwco = talloc_zero(mem_ctx, struct WbemClassObject);
210 	nwco->flags = WCF_INSTANCE;
211 	nwco->obj_class = wco->obj_class;
212 	WbemClassObject_CreateInstance(nwco);
213 	dcom_IWbemClassObject_from_WbemClassObject(d->ctx, instance, nwco);
214 	return WERR_OK;
215 }
216 
duplicate_WbemQualifier(TALLOC_CTX * mem_ctx,const struct WbemQualifier * src,struct WbemQualifier * dst)217 void duplicate_WbemQualifier(TALLOC_CTX *mem_ctx, const struct WbemQualifier *src, struct WbemQualifier *dst)
218 {
219 	dst->name = src->name;
220 	if (src->name) dst->name = talloc_strdup(mem_ctx, src->name);
221 
222 	dst->flavors = src->flavors;
223 
224 	dst->cimtype = src->cimtype;
225 
226 	duplicate_CIMVAR(mem_ctx, &src->value, &dst->value, src->cimtype);
227 }
228 
duplicate_CIMSTRINGS(TALLOC_CTX * mem_ctx,const struct CIMSTRINGS * src,struct CIMSTRINGS * dst)229 void duplicate_CIMSTRINGS(TALLOC_CTX *mem_ctx, const struct CIMSTRINGS *src, struct CIMSTRINGS *dst)
230 {
231 	uint32_t i;
232 
233 	dst->count = src->count;
234 	for (i = 0; i < src->count; ++i)
235 		dst->item[i] = talloc_strdup(mem_ctx, src->item[i]);
236 }
237 
duplicate_WbemQualifiers(TALLOC_CTX * mem_ctx,const struct WbemQualifiers * src,struct WbemQualifiers * dst)238 void duplicate_WbemQualifiers(TALLOC_CTX *mem_ctx, const struct WbemQualifiers *src, struct WbemQualifiers *dst)
239 {
240 	uint32_t i;
241 
242 	dst->count = src->count;
243 	for (i = 0; i < src->count; ++i) {
244 		dst->item[i] = talloc_zero(mem_ctx, struct WbemQualifier);
245 		duplicate_WbemQualifier(dst->item[i], src->item[i], dst->item[i]);
246 	}
247 }
248 
duplicate_WbemClass(TALLOC_CTX * mem_ctx,const struct WbemClass * src,struct WbemClass * dst)249 void duplicate_WbemClass(TALLOC_CTX *mem_ctx, const struct WbemClass *src, struct WbemClass *dst)
250 {
251 	uint32_t i;
252 
253 	dst->u_0 = src->u_0;
254 
255 	dst->__CLASS = src->__CLASS;
256 	if (src->__CLASS) dst->__CLASS = talloc_strdup(mem_ctx, src->__CLASS);
257 
258 	duplicate_CIMSTRINGS(mem_ctx, &src->__DERIVATION, &dst->__DERIVATION);
259 	duplicate_WbemQualifiers(mem_ctx, &src->qualifiers, &dst->qualifiers);
260 
261 	dst->__PROPERTY_COUNT = src->__PROPERTY_COUNT;
262 
263 	dst->properties = talloc_array(mem_ctx, struct WbemProperty, src->__PROPERTY_COUNT);
264 	for (i = 0; i < src->__PROPERTY_COUNT; ++i) {
265 		dst->properties[i].name = talloc_strdup(dst->properties, src->properties[i].name);
266 		dst->properties[i].desc = talloc_memdup(dst->properties, src->properties[i].desc, sizeof(*src->properties[i].desc));
267 		duplicate_WbemQualifiers(dst->properties[i].desc, &src->properties[i].desc->qualifiers, &dst->properties[i].desc->qualifiers);
268 	}
269 
270 	dst->default_flags = talloc_array(mem_ctx, uint8_t, src->__PROPERTY_COUNT);
271 	dst->default_values = talloc_array(mem_ctx, union CIMVAR, src->__PROPERTY_COUNT);
272 	for (i = 0; i < src->__PROPERTY_COUNT; ++i) {
273 		dst->default_flags[i] = src->default_flags[i];
274 		duplicate_CIMVAR(dst->default_values, &src->default_values[i], &dst->default_values[i], src->properties[i].desc->cimtype);
275 	}
276 }
277 
duplicate_WbemMethod(TALLOC_CTX * mem_ctx,const struct WbemMethod * src,struct WbemMethod * dst)278 void duplicate_WbemMethod(TALLOC_CTX *mem_ctx, const struct WbemMethod *src, struct WbemMethod *dst)
279 {
280 	dst->name = src->name;
281 	if (src->name) dst->name = talloc_strdup(mem_ctx, src->name);
282 
283 	dst->u0 = src->u0;
284 	dst->u1 = src->u1;
285 
286 	dst->qualifiers = talloc_zero(mem_ctx, struct WbemQualifiers);
287 	duplicate_WbemQualifiers(dst->qualifiers, src->qualifiers, dst->qualifiers);
288 
289 	dst->in = src->in;
290 	if (src->in) {
291 		dst->in = talloc_zero(mem_ctx, struct WbemClassObject);
292 		duplicate_WbemClassObject(dst->in, src->in, dst->in);
293 	}
294 
295 	dst->out = src->out;
296 	if (src->out) {
297 		dst->out = talloc_zero(mem_ctx, struct WbemClassObject);
298 		duplicate_WbemClassObject(dst->out, src->out, dst->out);
299 	}
300 }
301 
duplicate_WbemMethods(TALLOC_CTX * mem_ctx,const struct WbemMethods * src,struct WbemMethods * dst)302 void duplicate_WbemMethods(TALLOC_CTX *mem_ctx, const struct WbemMethods *src, struct WbemMethods *dst)
303 {
304 	uint32_t i;
305 
306 	dst->count = src->count;
307 	dst->u0 = src->u0;
308 	for (i = 0; i < src->count; ++i)
309 		duplicate_WbemMethod(mem_ctx, &src->method[i], &dst->method[i]);
310 }
311 
duplicate_WbemInstance(TALLOC_CTX * mem_ctx,const struct WbemInstance * src,struct WbemInstance * dst,const struct WbemClass * cls)312 void duplicate_WbemInstance(TALLOC_CTX *mem_ctx, const struct WbemInstance *src, struct WbemInstance *dst, const struct WbemClass *cls)
313 {
314 	uint32_t i;
315 
316 	dst->u1_0 = src->u1_0;
317 
318 	dst->__CLASS = src->__CLASS;
319 	if (src->__CLASS) dst->__CLASS = talloc_strdup(mem_ctx, src->__CLASS);
320 
321 	dst->default_flags = talloc_array(mem_ctx, uint8_t, cls->__PROPERTY_COUNT);
322 	dst->data = talloc_array(mem_ctx, union CIMVAR, cls->__PROPERTY_COUNT);
323 	for (i = 0; i < cls->__PROPERTY_COUNT; ++i) {
324 		dst->default_flags[i] = src->default_flags[i];
325 		duplicate_CIMVAR(dst->data, &src->data[i], &dst->data[i], cls->properties[i].desc->cimtype);
326 	}
327 
328 	dst->u2_4 = src->u2_4;
329 	dst->u3_1 = src->u3_1;
330 }
331 
duplicate_WbemClassObject(TALLOC_CTX * mem_ctx,const struct WbemClassObject * src,struct WbemClassObject * dst)332 void duplicate_WbemClassObject(TALLOC_CTX *mem_ctx, const struct WbemClassObject *src, struct WbemClassObject *dst)
333 {
334 	dst->flags = src->flags;
335 	if (src->flags & WCF_CLASS) {
336 		dst->__SERVER = talloc_strdup(mem_ctx, src->__SERVER);
337 		dst->__NAMESPACE = talloc_strdup(mem_ctx, src->__NAMESPACE);
338 	}
339 	if (src->flags & WCF_DECORATIONS) {
340 		dst->sup_class = talloc_zero(mem_ctx, struct WbemClass);
341 		duplicate_WbemClass(dst->sup_class, src->sup_class, dst->sup_class);
342 
343 		dst->sup_methods = talloc_zero(mem_ctx, struct WbemMethods);
344 		duplicate_WbemMethods(dst->sup_methods, src->sup_methods, dst->sup_methods);
345 
346 		dst->obj_methods = talloc_zero(mem_ctx, struct WbemMethods);
347 		duplicate_WbemMethods(dst->obj_methods, src->obj_methods, dst->obj_methods);
348 	}
349 	if (src->flags & (WCF_CLASS | WCF_INSTANCE)) {
350 		dst->obj_class = talloc_zero(mem_ctx, struct WbemClass);
351 		duplicate_WbemClass(dst->obj_class, src->obj_class, dst->obj_class);
352 	}
353 	if (src->flags & WCF_INSTANCE) {
354 		dst->instance = talloc_zero(mem_ctx, struct WbemInstance);
355 		duplicate_WbemInstance(dst->instance, src->instance, dst->instance, src->obj_class);
356 	}
357 }
358 
duplicate_CIMVAR(TALLOC_CTX * mem_ctx,const union CIMVAR * src,union CIMVAR * dst,enum CIMTYPE_ENUMERATION cimtype)359 void duplicate_CIMVAR(TALLOC_CTX *mem_ctx, const union CIMVAR *src, union CIMVAR *dst, enum CIMTYPE_ENUMERATION cimtype)
360 {
361 	uint32_t i;
362 
363 	switch (cimtype & CIM_TYPEMASK) {
364         case CIM_SINT8:
365         case CIM_UINT8:
366         case CIM_SINT16:
367         case CIM_UINT16:
368         case CIM_SINT32:
369         case CIM_UINT32:
370         case CIM_SINT64:
371         case CIM_UINT64:
372         case CIM_REAL32:
373         case CIM_REAL64:
374         case CIM_BOOLEAN:
375 		*dst = *src;
376 		break;
377         case CIM_STRING:
378         case CIM_DATETIME:
379         case CIM_REFERENCE:
380 		dst->v_string = talloc_strdup(mem_ctx, src->v_string);
381 		break;
382 	case CIM_OBJECT:
383 		dst->v_object = talloc_zero(mem_ctx, struct WbemClassObject);
384 		duplicate_WbemClassObject(dst->v_object, src->v_object, dst->v_object);
385 		break;
386         case CIM_ARR_SINT8:
387 	case CIM_ARR_UINT8:
388 		dst->a_uint8 = talloc_memdup(mem_ctx, src->a_uint8, sizeof(struct arr_uint8));
389 		dst->a_uint8->item = talloc_memdup(dst->a_uint8, src->a_uint8->item, src->a_uint8->count);
390 		break;
391         case CIM_ARR_SINT16:
392         case CIM_ARR_UINT16:
393         case CIM_ARR_BOOLEAN:
394 		dst->a_uint8 = talloc_memdup(mem_ctx, src->a_uint8, sizeof(struct arr_uint8));
395 		dst->a_uint8->item = talloc_memdup(dst->a_uint8, src->a_uint8->item, 2*src->a_uint8->count);
396 		break;
397         case CIM_ARR_SINT32:
398         case CIM_ARR_UINT32:
399         case CIM_ARR_REAL32:
400 		dst->a_uint8 = talloc_memdup(mem_ctx, src->a_uint8, sizeof(struct arr_uint8));
401 		dst->a_uint8->item = talloc_memdup(dst->a_uint8, src->a_uint8->item, 4*src->a_uint8->count);
402 		break;
403         case CIM_ARR_SINT64:
404         case CIM_ARR_UINT64:
405 	case CIM_ARR_REAL64:
406 		dst->a_uint8 = talloc_memdup(mem_ctx, src->a_uint8, sizeof(struct arr_uint8));
407 		dst->a_uint8->item = talloc_memdup(dst->a_uint8, src->a_uint8->item, 8*src->a_uint8->count);
408 		break;
409         case CIM_ARR_STRING:
410         case CIM_ARR_DATETIME:
411         case CIM_ARR_REFERENCE:
412 		dst->a_uint8 = talloc_memdup(mem_ctx, src->a_uint8, sizeof(struct arr_uint8));
413 		dst->a_uint8->item = talloc_memdup(dst->a_uint8, src->a_uint8->item, 4*src->a_uint8->count);
414 		for (i = 0; i < src->a_uint8->count; ++i)
415 			dst->a_string->item[i] = talloc_strdup(dst->a_uint8->item, src->a_string->item[i]);
416 		break;
417 	default:
418     		DEBUG(0, ("duplicate_CIMVAR: cimtype 0x%04X not supported\n", cimtype & CIM_TYPEMASK));
419 		break;
420 	}
421 }
422 
WbemClassObject_Get(struct WbemClassObject * d,TALLOC_CTX * mem_ctx,const char * name,uint32_t flags,union CIMVAR * val,enum CIMTYPE_ENUMERATION * cimtype,uint32_t * flavor)423 WERROR WbemClassObject_Get(struct WbemClassObject *d, TALLOC_CTX *mem_ctx, const char *name, uint32_t flags, union CIMVAR *val, enum CIMTYPE_ENUMERATION *cimtype, uint32_t *flavor)
424 {
425 	uint32_t i;
426 	for (i = 0; i < d->obj_class->__PROPERTY_COUNT; ++i) {
427 		if (!strcmp(d->obj_class->properties[i].name, name)) {
428 			duplicate_CIMVAR(mem_ctx, &d->instance->data[i], val, d->obj_class->properties[i].desc->cimtype);
429 			if (cimtype) *cimtype = d->obj_class->properties[i].desc->cimtype;
430 			if (flavor) *flavor = 0; // FIXME:avg implement flavor
431 			return WERR_OK;
432 		}
433 	}
434 	return WERR_NOT_FOUND;
435 }
436 
IWbemClassObject_Put(struct IWbemClassObject * d,TALLOC_CTX * mem_ctx,const char * name,uint32_t flags,union CIMVAR * val,enum CIMTYPE_ENUMERATION cimtype)437 WERROR IWbemClassObject_Put(struct IWbemClassObject *d, TALLOC_CTX *mem_ctx, const char *name, uint32_t flags, union CIMVAR *val, enum CIMTYPE_ENUMERATION cimtype)
438 {
439 	struct WbemClassObject *wco;
440 	uint32_t i;
441 
442 	wco = (struct WbemClassObject *)d->object_data;
443 	for (i = 0; i < wco->obj_class->__PROPERTY_COUNT; ++i) {
444 		if (!strcmp(wco->obj_class->properties[i].name, name)) {
445 			if (cimtype && cimtype != wco->obj_class->properties[i].desc->cimtype) return WERR_INVALID_PARAM;
446 			wco->instance->default_flags[i] = 0;
447 			duplicate_CIMVAR(wco->instance, val, &wco->instance->data[i], wco->obj_class->properties[i].desc->cimtype);
448 			return WERR_OK;
449 		}
450 	}
451 	return WERR_NOT_FOUND;
452 }
453 
454 #define WERR_CHECK(msg) if (!W_ERROR_IS_OK(result)) { \
455                             DEBUG(1, ("ERROR: %s - %s\n", msg, wmi_errstr(result))); \
456                             goto end; \
457                         } else { \
458                             DEBUG(1, ("OK   : %s\n", msg)); \
459                         }
460 
461 struct pair_guid_ptr {
462 	struct GUID guid;
463 	void *ptr;
464 	struct pair_guid_ptr *next, *prev;
465 };
466 
get_ptr_by_guid(struct pair_guid_ptr * list,struct GUID * uuid)467 static void *get_ptr_by_guid(struct pair_guid_ptr *list, struct GUID *uuid)
468 {
469 	for (; list; list = list->next) {
470             	if (GUID_equal(&list->guid, uuid))
471 			return list->ptr;
472 	}
473 	return NULL;
474 }
475 
add_pair_guid_ptr(TALLOC_CTX * mem_ctx,struct pair_guid_ptr ** list,struct GUID * uuid,void * ptr)476 static void add_pair_guid_ptr(TALLOC_CTX *mem_ctx, struct pair_guid_ptr **list, struct GUID *uuid, void *ptr)
477 {
478 	struct pair_guid_ptr *e;
479 
480 	e = talloc(mem_ctx, struct pair_guid_ptr);
481 	e->guid = *uuid;
482 	e->ptr = ptr;
483 	talloc_steal(e, ptr);
484 	DLIST_ADD(*list, e);
485 }
486 
487 struct IEnumWbemClassObject_data {
488     struct GUID guid;
489     struct IWbemFetchSmartEnum *pFSE;
490     struct IWbemWCOSmartEnum *pSE;
491     struct pair_guid_ptr *cache;
492     int32_t lTimeout;
493     uint32_t uCount;
494     uint32_t uReturned;
495     uint32_t size;
496     uint8_t *pData;
497 };
498 
WBEMDATA_Parse(uint8_t * data,uint32_t size,struct IEnumWbemClassObject * d,uint32_t uCount,struct WbemClassObject ** apObjects)499 NTSTATUS WBEMDATA_Parse(uint8_t *data, uint32_t size, struct IEnumWbemClassObject *d, uint32_t uCount, struct WbemClassObject **apObjects)
500 {
501 	struct ndr_pull *ndr;
502 	TALLOC_CTX *mem_ctx;
503 	uint32_t u, i, ofs_next;
504 	uint8_t u8, datatype;
505 	NTSTATUS status;
506 	struct GUID guid;
507 	struct IEnumWbemClassObject_data *ecod;
508 
509 	if (!uCount) return NT_STATUS_NOT_IMPLEMENTED;
510 
511 	ecod = d->object_data;
512 	mem_ctx = talloc_new(0);
513 
514 	ndr = talloc_zero(mem_ctx, struct ndr_pull);
515 	ndr->current_mem_ctx = d->ctx;
516 	ndr->data = data;
517 	ndr->data_size = size;
518 	ndr_set_flags(&ndr->flags, LIBNDR_FLAG_NOALIGN);
519 
520 	NDR_CHECK_set_shift(0x18);
521 	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
522 	NDR_CHECK_CONST(u, 0x0);
523 	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
524 	NDR_CHECK_CONST(u, *(const uint32_t *)"WBEM");
525 	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
526 	NDR_CHECK_CONST(u, *(const uint32_t *)"DATA");
527 	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
528 	NDR_CHECK_CONST(u, 0x1A); /* Length of header */
529 	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
530 	NDR_PULL_NEED_BYTES(ndr, u + 6);
531 	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
532 	NDR_CHECK_CONST(u, 0x0);
533 	NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &u8));
534 	NDR_CHECK_CONST(u8, 0x01); /* Major Version */
535 	NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &u8));
536 	NDR_CHECK_EXPR(u8 <= 1); /* Minor Version 0 - Win2000, 1 - XP/2003 */
537 	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
538 	NDR_CHECK_CONST(u, 0x8); /* Length of header */
539 	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
540 	NDR_PULL_NEED_BYTES(ndr, u);
541 	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
542 	NDR_CHECK_CONST(u, 0xC); /* Length of header */
543 	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
544 	NDR_PULL_NEED_BYTES(ndr, u + 4);
545 	NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
546 	NDR_CHECK_CONST(u, uCount);
547 	for (i = 0; i < uCount; ++i) {
548 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
549 		NDR_CHECK_CONST(u, 0x9); /* Length of header */
550 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
551 		NDR_PULL_NEED_BYTES(ndr, u + 1);
552 		NDR_CHECK(ndr_pull_uint8(ndr, NDR_SCALARS, &datatype));
553 		ofs_next = ndr->offset + u;
554 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
555 		NDR_CHECK_CONST(u, 0x18); /* Length of header */
556 		NDR_CHECK(ndr_pull_uint32(ndr, NDR_SCALARS, &u));
557 		NDR_PULL_NEED_BYTES(ndr, u + 16);
558 		NDR_CHECK(ndr_pull_GUID(ndr, NDR_SCALARS, &guid));
559 		switch (datatype) {
560 		case DATATYPE_CLASSOBJECT:
561 			apObjects[i] = talloc_zero(d->ctx, struct WbemClassObject);
562 			ndr->current_mem_ctx = apObjects[i];
563 			NDR_CHECK(ndr_pull_WbemClassObject(ndr, NDR_SCALARS|NDR_BUFFERS, apObjects[i]));
564 			ndr->current_mem_ctx = d->ctx;
565 			add_pair_guid_ptr(ecod, &ecod->cache, &guid, apObjects[i]->obj_class);
566 			break;
567 		case DATATYPE_OBJECT:
568 			apObjects[i] = talloc_zero(d->ctx, struct WbemClassObject);
569 			apObjects[i]->obj_class = get_ptr_by_guid(ecod->cache, &guid);
570 			(void)talloc_reference(apObjects[i], apObjects[i]->obj_class);
571 			ndr->current_mem_ctx = apObjects[i];
572 			NDR_CHECK(ndr_pull_WbemClassObject_Object(ndr, NDR_SCALARS|NDR_BUFFERS, apObjects[i]));
573 			ndr->current_mem_ctx = d->ctx;
574 			break;
575 		default:
576 			DEBUG(0, ("WBEMDATA_Parse: Data type %d not supported\n", datatype));
577 			status = NT_STATUS_NOT_SUPPORTED;
578 			goto end;
579 		}
580 		ndr->offset = ofs_next;
581     		if (DEBUGLVL(9)) {
582 			NDR_PRINT_DEBUG(WbemClassObject, apObjects[i]);
583 		}
584 	}
585 	status = NT_STATUS_OK;
586 end:
587 	talloc_free(mem_ctx);
588 	return status;
589 }
590 
dcom_proxy_IEnumWbemClassObject_Release_send(struct IUnknown * d,TALLOC_CTX * mem_ctx)591 struct composite_context *dcom_proxy_IEnumWbemClassObject_Release_send(
592         struct IUnknown *d, TALLOC_CTX *mem_ctx)
593 {
594     struct composite_context *c, *cr;
595     struct REMINTERFACEREF iref[3];
596     struct dcom_object_exporter *ox;
597     struct IEnumWbemClassObject_data *ecod;
598     int n;
599 
600     c = composite_create(d->ctx, d->ctx->event_ctx);
601     if (c == NULL) return NULL;
602     c->private_data = d;
603 
604     ox = object_exporter_by_ip(d->ctx, d);
605     iref[0].ipid = IUnknown_ipid(d);
606     iref[0].cPublicRefs = 5;
607     iref[0].cPrivateRefs = 0;
608     n = 1;
609 
610     ecod = d->object_data;
611     if (ecod) {
612         if (ecod->pFSE) {
613             talloc_steal(d, ecod->pFSE);
614             iref[n].ipid = IUnknown_ipid(ecod->pFSE);
615             iref[n].cPublicRefs = 5;
616             iref[n].cPrivateRefs = 0;
617             ++n;
618         }
619         if (ecod->pSE) {
620             talloc_steal(d, ecod->pSE);
621             iref[n].ipid = IUnknown_ipid(ecod->pSE);
622             iref[n].cPublicRefs = 5;
623             iref[n].cPrivateRefs = 0;
624             ++n;
625         }
626     }
627 
628     cr = IRemUnknown_RemRelease_send(ox->rem_unknown, mem_ctx, n, iref);
629     composite_continue(c, cr, dcom_release_continue, c);
630     return c;
631 }
632 
633 /* TODO: BUGGY dcom proxy generation misnames this function */
634 extern WERROR IWbemWCOSmartEnum_IWbemWCOSmartEnum_Next_recv(
635         struct composite_context *c, uint32_t *puReturned, uint32_t *pSize,
636         uint8_t **pData);
637 
638 /*
639  * Continue a SmartNext enumeration request by processing the returned results
640  * and setting up the data for processing by the parent composite.
641  */
smart_next_enum_continue(struct composite_context * ctx)642 static void smart_next_enum_continue(struct composite_context *ctx)
643 {
644     struct composite_context *c = NULL;
645     struct IEnumWbemClassObject *d = NULL;
646     struct IEnumWbemClassObject_data *s = NULL;
647     uint32_t uReturned = 0;
648     uint32_t size = 0;
649     uint8_t *pData = NULL;
650     WERROR result;
651 
652     /* retrieve the parent composite context */
653     c = talloc_get_type(ctx->async.private_data, struct composite_context);
654 
655     /* retrieve the enumeration state data */
656     d = (struct IEnumWbemClassObject *)talloc_get_type(c->private_data,
657             struct IUnknown);
658     s = d->object_data;
659 
660     /*
661      * The successful method execution MUST return WBEM_S_NO_ERROR. If the
662      * number of the remaining CIM objects to be retrieved is less than the
663      * number of requested CIM objects, the server MUST return WBEM_S_FALSE.
664      * If the number of requested objects was not returned in the specified
665      * time out period, then WBEM_S_TIMEDOUT will be returned.
666      */
667     result = IWbemWCOSmartEnum_IWbemWCOSmartEnum_Next_recv(ctx, &uReturned,
668             &size, &pData);
669     if (W_ERROR_V(result) == WBEM_NO_ERROR
670         || W_ERROR_V(result) == WBEM_S_FALSE
671         || W_ERROR_V(result) == WBEM_S_TIMEDOUT)
672     {
673         s->uReturned = uReturned;
674         s->size = size;
675         s->pData = pData;
676         c->status = NT_STATUS_OK;
677         composite_done(c);
678     }
679     else
680     {
681         composite_error(c, werror_to_ntstatus(result));
682     }
683 }
684 
685 /*
686  * Continue a SmartNext enumeration request by finishing the fetch request for
687  * the actual IWbemWCOSmartEnum interface object.
688  */
smart_next_fetch_enum_continue(struct composite_context * ctx)689 static void smart_next_fetch_enum_continue(struct composite_context *ctx)
690 {
691     struct composite_context *c = NULL;
692     struct composite_context *new_ctx = NULL;
693     struct IEnumWbemClassObject *d = NULL;
694     struct IEnumWbemClassObject_data *s = NULL;
695     struct IWbemWCOSmartEnum *pSmartEnum = NULL;
696     WERROR result;
697 
698     /* retrieve the parent composite context */
699     c = talloc_get_type(ctx->async.private_data, struct composite_context);
700 
701     /* retrieve the enumeration state data */
702     d = (struct IEnumWbemClassObject *)talloc_get_type(c->private_data,
703             struct IUnknown);
704     s = d->object_data;
705 
706     /* retrieve the results of the IWbemFetchSmartEnum:GetSmartEnum request */
707     result = IWbemFetchSmartEnum_Fetch_recv(ctx, &pSmartEnum);
708     if (!W_ERROR_IS_OK(result))
709     {
710         DEBUG(1, ("IWbemFetchSmartEnum_Fetch_recv failed: %08X %s\n",
711                 W_ERROR_V(result), wmi_errstr(result)));
712         composite_error(c, werror_to_ntstatus(result));
713     }
714     else
715     {
716         s->pSE = pSmartEnum;
717 
718         /* TODO: at this point, we can free the pEnumFetch interface, right? */
719 
720         /* allocate a new GUID for this specific enumeration request */
721         s->guid = GUID_random();
722 
723         new_ctx = IWbemWCOSmartEnum_Next_send(s->pSE, c, &s->guid,
724                 s->lTimeout, s->uCount);
725         if (composite_nomem(new_ctx, c)) return;
726 
727         composite_continue(c, new_ctx, smart_next_enum_continue, c);
728     }
729 }
730 
731 /*
732  * Continue a SmartNext enumeration request by processing the results of
733  * the IRemUnknown::RemQueryInterface call to fetch the IWbemWCOSmartEnum
734  * interface pointer.
735  */
smart_next_query_interface_continue(struct composite_context * ctx)736 static void smart_next_query_interface_continue(struct composite_context *ctx)
737 {
738     struct composite_context *c = NULL;
739     struct composite_context *new_ctx = NULL;
740     struct IEnumWbemClassObject *d = NULL;
741     struct IEnumWbemClassObject_data *s = NULL;
742     struct IUnknown **interfaces = NULL;
743 
744     /* retrieve the parent composite context */
745     c = talloc_get_type(ctx->async.private_data, struct composite_context);
746 
747     /* retrieve the enumeration state data */
748     d = (struct IEnumWbemClassObject *)talloc_get_type(c->private_data,
749             struct IUnknown);
750     s = d->object_data;
751 
752     /* process the results of the RemQueryInterface call */
753     c->status = dcom_query_interface_recv(ctx, c, &interfaces);
754     if (!composite_is_ok(c)) return;
755 
756     s->pFSE = (struct IWbemFetchSmartEnum *)interfaces[0];
757     talloc_free(interfaces);
758 
759     /*
760      * send off the IWbemFetchSmartEnum:GetSmartEnum request that should return
761      * a new IWbemWCOSmartEnum interface pointer if all goes well
762      */
763     new_ctx = IWbemFetchSmartEnum_Fetch_send(s->pFSE, c);
764     if (composite_nomem(new_ctx, c)) return;
765 
766     composite_continue(c, new_ctx, smart_next_fetch_enum_continue, c);
767 }
768 
769 /*
770  * Asynchronously send a SmartNext enumeration request.
771  */
IEnumWbemClassObject_SmartNext_send(struct IEnumWbemClassObject * d,TALLOC_CTX * parent_ctx,int32_t lTimeout,uint32_t uCount)772 struct composite_context *IEnumWbemClassObject_SmartNext_send(
773         struct IEnumWbemClassObject *d, TALLOC_CTX *parent_ctx,
774         int32_t lTimeout, uint32_t uCount)
775 {
776     struct composite_context *c = NULL;
777     struct composite_context *new_ctx = NULL;
778     struct IEnumWbemClassObject_data *s = NULL;
779     struct GUID iid;
780 
781     /* create a new composite to be used for this call sequence */
782     c = composite_create(parent_ctx, d->ctx->event_ctx);
783     if (c == NULL) return NULL;
784 
785     /* if we're not continuing an existing enumeration then allocate state */
786     s = d->object_data;
787     if (s == NULL)
788     {
789         s = talloc_zero(d, struct IEnumWbemClassObject_data);
790         if (composite_nomem(s, c)) return c;
791         d->object_data = s;
792         c->private_data = d;
793         s->lTimeout = lTimeout;
794         s->uCount = uCount;
795 
796         /* TODO: why?! */
797         d->vtable->Release_send = dcom_proxy_IEnumWbemClassObject_Release_send;
798 
799         /*
800          * retrieve the IWbemFetchSmartEnum interface so that we can then ask it
801          * for an IWbemWCOSmartEnum enumerator, which is a network optimized
802          * enumerator
803          */
804         GUID_from_string(COM_IWBEMFETCHSMARTENUM_UUID, &iid);
805 
806         new_ctx = dcom_query_interface_send((struct IUnknown *)d, c, 5, 1, &iid);
807         if (composite_nomem(new_ctx, c)) return c;
808 
809         composite_continue(c, new_ctx, smart_next_query_interface_continue, c);
810     }
811     else
812     {
813         /*
814          * we're just continuing an existing enumeration request, so save the
815          * state data in our new composite and issue the next
816          * IWbemWCOSmartEnum:Next call.
817          */
818         c->private_data = d;
819         new_ctx = IWbemWCOSmartEnum_Next_send(s->pSE, c, &s->guid,
820                 s->lTimeout, s->uCount);
821         if (composite_nomem(new_ctx, c)) return c;
822 
823         composite_continue(c, new_ctx, smart_next_enum_continue, c);
824     }
825 
826     return c;
827 }
828 
829 /*
830  * Asynchronously receive a SmartNext enumeration request.
831  */
IEnumWbemClassObject_SmartNext_recv(struct composite_context * c,TALLOC_CTX * parent_ctx,struct WbemClassObject ** apObjects,uint32_t * puReturned)832 WERROR IEnumWbemClassObject_SmartNext_recv(struct composite_context *c,
833         TALLOC_CTX *parent_ctx, struct WbemClassObject **apObjects,
834         uint32_t *puReturned)
835 {
836     struct IEnumWbemClassObject *d = c->private_data;
837     struct IEnumWbemClassObject_data *s = d->object_data;
838     WERROR result = WERR_OK;
839     NTSTATUS status;
840 
841     /* make sure there are no objects returned by data, in case of error */
842     *puReturned = 0;
843 
844     /*
845      * wait for the composite to be complete (should be a no-op in fully
846      * asynchronous mode) and then handle the results
847      */
848     status = composite_wait(c);
849     if (!NT_STATUS_IS_OK(status))
850     {
851         result = ntstatus_to_werror(status);
852     }
853     else
854     {
855         if (s->pData != NULL)
856         {
857             status = WBEMDATA_Parse(s->pData, s->size, d, s->uReturned,
858                     apObjects);
859             if (NT_STATUS_IS_OK(status))
860             {
861                 *puReturned = s->uReturned;
862             }
863             result = ntstatus_to_werror(status);
864         }
865     }
866 
867     talloc_free(c);
868     return result;
869 }
870 
871 /*
872  * Synchronously perform a SmartNext enumeration request.
873  */
IEnumWbemClassObject_SmartNext(struct IEnumWbemClassObject * d,TALLOC_CTX * mem_ctx,int32_t lTimeout,uint32_t uCount,struct WbemClassObject ** apObjects,uint32_t * puReturned)874 WERROR IEnumWbemClassObject_SmartNext(struct IEnumWbemClassObject *d,
875         TALLOC_CTX *mem_ctx, int32_t lTimeout, uint32_t uCount,
876         struct WbemClassObject **apObjects, uint32_t *puReturned)
877 {
878     struct composite_context *c = IEnumWbemClassObject_SmartNext_send(d,
879             mem_ctx, lTimeout, uCount);
880     return IEnumWbemClassObject_SmartNext_recv(c, mem_ctx, apObjects,
881             puReturned);
882 }
883 
dcom_proxy_IWbemClassObject_init()884 NTSTATUS dcom_proxy_IWbemClassObject_init()
885 {
886 	struct GUID clsid;
887 	GUID_from_string("4590f812-1d3a-11d0-891f-00aa004b2e24", &clsid);
888 	dcom_register_marshal(&clsid, marshal, unmarshal);
889 
890 #if 0
891 	struct IEnumWbemClassObject_vtable *proxy_vtable;
892 	proxy_vtable = (struct IEnumWbemClassObject_vtable *)dcom_proxy_vtable_by_iid((struct GUID *)&dcerpc_table_IEnumWbemClassObject.syntax_id.uuid);
893 	if (proxy_vtable)
894 		proxy_vtable->Release_send = dcom_proxy_IEnumWbemClassObject_Release_send;
895 	else
896 		DEBUG(0, ("WARNING: IEnumWbemClassObject should be initialized before IWbemClassObject."));
897 #endif
898 
899         return NT_STATUS_OK;
900 }
901