source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "srv_pipe_internal.h"
  32 #include "../librpc/gen_ndr/ndr_schannel.h"
  33 #include "../libcli/auth/schannel.h"
  34 #include "../libcli/auth/spnego.h"
  35 #include "../libcli/auth/ntlmssp.h"
  36
  37 #undef DBGC_CLASS
  38 #define DBGC_CLASS DBGC_RPC_SRV
  39
  40 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  41 {
  42         struct auth_ntlmssp_state *a = auth->a_u.auth_ntlmssp_state;
  43
  44         if (a) {
  45                 auth_ntlmssp_end(&a);
  46         }
  47         auth->a_u.auth_ntlmssp_state = NULL;
  48 }
  49
  50 static DATA_BLOB generic_session_key(void)
  51 {
  52         return data_blob("SystemLibraryDTC", 16);
  53 }
  54
  55 /*******************************************************************
  56  Generate the next PDU to be returned from the data in p->rdata.
  57  Handle NTLMSSP.
  58  ********************************************************************/
  59
  60 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  61 {
  62         DATA_BLOB hdr;
  63         uint8_t hdr_flags;
  64         RPC_HDR_RESP hdr_resp;
  65         uint32 ss_padding_len = 0;
  66         uint32 data_space_available;
  67         uint32 data_len_left;
  68         uint32 data_len;
  69         NTSTATUS status;
  70         DATA_BLOB auth_blob;
  71         RPC_HDR_AUTH auth_info;
  72         uint8 auth_type, auth_level;
  73         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
  74         TALLOC_CTX *frame;
  75
  76         /*
  77          * If we're in the fault state, keep returning fault PDU's until
  78          * the pipe gets closed. JRA.
  79          */
  80
  81         if(p->fault_state) {
  82                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  83                 return True;
  84         }
  85
  86         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  87
  88         /* Set up rpc header flags. */
  89         if (p->out_data.data_sent_length == 0) {
  90                 hdr_flags = DCERPC_PFC_FLAG_FIRST;
  91         } else {
  92                 hdr_flags = 0;
  93         }
  94
  95         /*
  96          * Work out how much we can fit in a single PDU.
  97          */
  98
  99         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 100
 101         /*
 102          * Ensure there really is data left to send.
 103          */
 104
 105         if(!data_len_left) {
 106                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 107                 return False;
 108         }
 109
 110         /* Space available - not including padding. */
 111         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN -
 112                 RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 113
 114         /*
 115          * The amount we send is the minimum of the available
 116          * space and the amount left to send.
 117          */
 118
 119         data_len = MIN(data_len_left, data_space_available);
 120
 121         /* Work out any padding alignment requirements. */
 122         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 123                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 124                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 125                 DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 126                         ss_padding_len ));
 127                 /* If we're over filling the packet, we need to make space
 128                  * for the padding at the end of the data. */
 129                 if (data_len + ss_padding_len > data_space_available) {
 130                         data_len -= SERVER_NDR_PADDING_SIZE;
 131                 }
 132         }
 133
 134         /*
 135          * Set up the alloc hint. This should be the data left to
 136          * send.
 137          */
 138
 139         hdr_resp.alloc_hint = data_len_left;
 140
 141         /*
 142          * Work out if this PDU will be the last.
 143          */
 144         if (p->out_data.data_sent_length + data_len >=
 145                                         prs_offset(&p->out_data.rdata)) {
 146                 hdr_flags |= DCERPC_PFC_FLAG_LAST;
 147         }
 148
 149         /*
 150          * Init the parse struct to point at the outgoing
 151          * data.
 152          */
 153         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 154
 155         status = dcerpc_push_ncacn_packet_header(
 156                                 prs_get_mem_context(&p->out_data.frag),
 157                                 DCERPC_PKT_RESPONSE,
 158                                 hdr_flags,
 159                                 RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 160                                   data_len + ss_padding_len +
 161                                   RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE,
 162                                 NTLMSSP_SIG_SIZE,
 163                                 p->call_id,
 164                                 &hdr);
 165         if (!NT_STATUS_IS_OK(status)) {
 166                 DEBUG(0, ("Failed to marshall RPC Header.\n"));
 167                 prs_mem_free(&p->out_data.frag);
 168                 return False;
 169         }
 170
 171         /* Store the header in the data stream. */
 172         if (!prs_copy_data_in(&p->out_data.frag,
 173                                 (char *)hdr.data, hdr.length)) {
 174                 DEBUG(0, ("Out of memory.\n"));
 175                 prs_mem_free(&p->out_data.frag);
 176                 return False;
 177         }
 178
 179         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 180                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 181                 prs_mem_free(&p->out_data.frag);
 182                 return False;
 183         }
 184
 185         /* Copy the data into the PDU. */
 186
 187         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 188                                      p->out_data.data_sent_length, data_len)) {
 189                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 190                 prs_mem_free(&p->out_data.frag);
 191                 return False;
 192         }
 193
 194         /* Copy the sign/seal padding data. */
 195         if (ss_padding_len) {
 196                 char pad[SERVER_NDR_PADDING_SIZE];
 197
 198                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 199                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 200                                       ss_padding_len)) {
 201                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 202                                         (unsigned int)ss_padding_len));
 203                         prs_mem_free(&p->out_data.frag);
 204                         return False;
 205                 }
 206         }
 207
 208
 209         /* Now write out the auth header and null blob. */
 210         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 211                 auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 212         } else {
 213                 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 214         }
 215         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 216                 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 217         } else {
 218                 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 219         }
 220
 221         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 222
 223         if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 224                                 &p->out_data.frag, 0)) {
 225                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 226                 prs_mem_free(&p->out_data.frag);
 227                 return False;
 228         }
 229
 230         /* Generate the sign blob. */
 231
 232         frame = talloc_stackframe();
 233         switch (p->auth.auth_level) {
 234                 case DCERPC_AUTH_LEVEL_PRIVACY:
 235                         /* Data portion is encrypted. */
 236                         status = auth_ntlmssp_seal_packet(
 237                                 a, frame,
 238                                 (uint8_t *)prs_data_p(&p->out_data.frag)
 239                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 240                                 data_len + ss_padding_len,
 241                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 242                                 (size_t)prs_offset(&p->out_data.frag),
 243                                 &auth_blob);
 244                         if (!NT_STATUS_IS_OK(status)) {
 245                                 talloc_free(frame);
 246                                 prs_mem_free(&p->out_data.frag);
 247                                 return False;
 248                         }
 249                         break;
 250                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 251                         /* Data is signed. */
 252                         status = auth_ntlmssp_sign_packet(
 253                                 a, frame,
 254                                 (unsigned char *)prs_data_p(&p->out_data.frag)
 255                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 256                                 data_len + ss_padding_len,
 257                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 258                                 (size_t)prs_offset(&p->out_data.frag),
 259                                 &auth_blob);
 260                         if (!NT_STATUS_IS_OK(status)) {
 261                                 talloc_free(frame);
 262                                 prs_mem_free(&p->out_data.frag);
 263                                 return False;
 264                         }
 265                         break;
 266                 default:
 267                         talloc_free(frame);
 268                         prs_mem_free(&p->out_data.frag);
 269                         return False;
 270         }
 271
 272         /* Append the auth blob. */
 273         if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
 274                               NTLMSSP_SIG_SIZE)) {
 275                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 276                                 (unsigned int)NTLMSSP_SIG_SIZE));
 277                 talloc_free(frame);
 278                 prs_mem_free(&p->out_data.frag);
 279                 return False;
 280         }
 281         talloc_free(frame);
 282
 283         /*
 284          * Setup the counts for this PDU.
 285          */
 286
 287         p->out_data.data_sent_length += data_len;
 288         p->out_data.current_pdu_sent = 0;
 289
 290         return True;
 291 }
 292
 293 /*******************************************************************
 294  Generate the next PDU to be returned from the data in p->rdata.
 295  Return an schannel authenticated fragment.
 296  ********************************************************************/
 297
 298 static bool create_next_pdu_schannel(pipes_struct *p)
 299 {
 300         DATA_BLOB hdr;
 301         uint8_t hdr_flags;
 302         RPC_HDR_RESP hdr_resp;
 303         uint32 ss_padding_len = 0;
 304         uint32 data_len;
 305         uint32 data_space_available;
 306         uint32 data_len_left;
 307         uint32 data_pos;
 308         NTSTATUS status;
 309
 310         /*
 311          * If we're in the fault state, keep returning fault PDU's until
 312          * the pipe gets closed. JRA.
 313          */
 314
 315         if(p->fault_state) {
 316                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 317                 return True;
 318         }
 319
 320         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 321
 322         /* Set up rpc header flags. */
 323         if (p->out_data.data_sent_length == 0) {
 324                 hdr_flags = DCERPC_PFC_FLAG_FIRST;
 325         } else {
 326                 hdr_flags = 0;
 327         }
 328
 329         /*
 330          * Work out how much we can fit in a single PDU.
 331          */
 332
 333         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 334
 335         /*
 336          * Ensure there really is data left to send.
 337          */
 338
 339         if(!data_len_left) {
 340                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 341                 return False;
 342         }
 343
 344         /* Space available - not including padding. */
 345         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 346                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
 347                 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 348
 349         /*
 350          * The amount we send is the minimum of the available
 351          * space and the amount left to send.
 352          */
 353
 354         data_len = MIN(data_len_left, data_space_available);
 355
 356         /* Work out any padding alignment requirements. */
 357         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 358                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 359                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 360                 DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 361                         ss_padding_len ));
 362                 /* If we're over filling the packet, we need to make space
 363                  * for the padding at the end of the data. */
 364                 if (data_len + ss_padding_len > data_space_available) {
 365                         data_len -= SERVER_NDR_PADDING_SIZE;
 366                 }
 367         }
 368
 369         /*
 370          * Set up the alloc hint. This should be the data left to
 371          * send.
 372          */
 373
 374         hdr_resp.alloc_hint = data_len_left;
 375
 376         /*
 377          * Work out if this PDU will be the last.
 378          */
 379         if (p->out_data.data_sent_length + data_len >=
 380                                         prs_offset(&p->out_data.rdata)) {
 381                 hdr_flags |= DCERPC_PFC_FLAG_LAST;
 382         }
 383
 384         /*
 385          * Init the parse struct to point at the outgoing
 386          * data.
 387          */
 388         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 389
 390         status = dcerpc_push_ncacn_packet_header(
 391                                 prs_get_mem_context(&p->out_data.frag),
 392                                 DCERPC_PKT_RESPONSE,
 393                                 hdr_flags,
 394                                 RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 395                                   data_len + ss_padding_len +
 396                                   RPC_HDR_AUTH_LEN +
 397                                   RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 398                                 RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 399                                 p->call_id,
 400                                 &hdr);
 401         if (!NT_STATUS_IS_OK(status)) {
 402                 DEBUG(0, ("Failed to marshall RPC Header.\n"));
 403                 prs_mem_free(&p->out_data.frag);
 404                 return False;
 405         }
 406
 407         /* Store the header in the data stream. */
 408         if (!prs_copy_data_in(&p->out_data.frag,
 409                                 (char *)hdr.data, hdr.length)) {
 410                 DEBUG(0, ("Out of memory.\n"));
 411                 prs_mem_free(&p->out_data.frag);
 412                 return False;
 413         }
 414
 415         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 416                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 417                 prs_mem_free(&p->out_data.frag);
 418                 return False;
 419         }
 420
 421         /* Store the current offset. */
 422         data_pos = prs_offset(&p->out_data.frag);
 423
 424         /* Copy the data into the PDU. */
 425
 426         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 427                                      p->out_data.data_sent_length, data_len)) {
 428                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 429                 prs_mem_free(&p->out_data.frag);
 430                 return False;
 431         }
 432
 433         /* Copy the sign/seal padding data. */
 434         if (ss_padding_len) {
 435                 char pad[SERVER_NDR_PADDING_SIZE];
 436                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 437                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 438                                       ss_padding_len)) {
 439                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 440                         prs_mem_free(&p->out_data.frag);
 441                         return False;
 442                 }
 443         }
 444
 445         {
 446                 /*
 447                  * Schannel processing.
 448                  */
 449                 RPC_HDR_AUTH auth_info;
 450                 DATA_BLOB blob;
 451                 uint8_t *data;
 452
 453                 /* Check it's the type of reply we were expecting to decode */
 454
 455                 init_rpc_hdr_auth(&auth_info,
 456                                 DCERPC_AUTH_TYPE_SCHANNEL,
 457                                 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
 458                                         DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
 459                                 ss_padding_len, 1);
 460
 461                 if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 462                                         &p->out_data.frag, 0)) {
 463                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 464                         prs_mem_free(&p->out_data.frag);
 465                         return False;
 466                 }
 467
 468                 data = (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos;
 469
 470                 switch (p->auth.auth_level) {
 471                 case DCERPC_AUTH_LEVEL_PRIVACY:
 472                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 473                                                         talloc_tos(),
 474                                                         true,
 475                                                         data,
 476                                                         data_len + ss_padding_len,
 477                                                         &blob);
 478                         break;
 479                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 480                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 481                                                         talloc_tos(),
 482                                                         false,
 483                                                         data,
 484                                                         data_len + ss_padding_len,
 485                                                         &blob);
 486                         break;
 487                 default:
 488                         status = NT_STATUS_INTERNAL_ERROR;
 489                         break;
 490                 }
 491
 492                 if (!NT_STATUS_IS_OK(status)) {
 493                         DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
 494                                 nt_errstr(status)));
 495                         prs_mem_free(&p->out_data.frag);
 496                         return false;
 497                 }
 498
 499                 /* Finally marshall the blob. */
 500
 501                 if (DEBUGLEVEL >= 10) {
 502                         dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
 503                 }
 504
 505                 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
 506                         prs_mem_free(&p->out_data.frag);
 507                         return false;
 508                 }
 509         }
 510
 511         /*
 512          * Setup the counts for this PDU.
 513          */
 514
 515         p->out_data.data_sent_length += data_len;
 516         p->out_data.current_pdu_sent = 0;
 517
 518         return True;
 519 }
 520
 521 /*******************************************************************
 522  Generate the next PDU to be returned from the data in p->rdata.
 523  No authentication done.
 524 ********************************************************************/
 525
 526 static bool create_next_pdu_noauth(pipes_struct *p)
 527 {
 528         DATA_BLOB hdr;
 529         uint8_t hdr_flags;
 530         NTSTATUS status;
 531         RPC_HDR_RESP hdr_resp;
 532         uint32 data_len;
 533         uint32 data_space_available;
 534         uint32 data_len_left;
 535
 536         /*
 537          * If we're in the fault state, keep returning fault PDU's until
 538          * the pipe gets closed. JRA.
 539          */
 540
 541         if(p->fault_state) {
 542                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 543                 return True;
 544         }
 545
 546         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 547
 548         /* Set up rpc header flags. */
 549         if (p->out_data.data_sent_length == 0) {
 550                 hdr_flags = DCERPC_PFC_FLAG_FIRST;
 551         } else {
 552                 hdr_flags = 0;
 553         }
 554
 555         /*
 556          * Work out how much we can fit in a single PDU.
 557          */
 558
 559         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 560
 561         /*
 562          * Ensure there really is data left to send.
 563          */
 564
 565         if(!data_len_left) {
 566                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 567                 return False;
 568         }
 569
 570         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 571                 - RPC_HDR_RESP_LEN;
 572
 573         /*
 574          * The amount we send is the minimum of the available
 575          * space and the amount left to send.
 576          */
 577
 578         data_len = MIN(data_len_left, data_space_available);
 579
 580         /*
 581          * Set up the alloc hint. This should be the data left to
 582          * send.
 583          */
 584
 585         hdr_resp.alloc_hint = data_len_left;
 586
 587         /*
 588          * Work out if this PDU will be the last.
 589          */
 590         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 591                 hdr_flags |= DCERPC_PFC_FLAG_LAST;
 592         }
 593
 594         /*
 595          * Init the parse struct to point at the outgoing
 596          * data.
 597          */
 598         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 599
 600         status = dcerpc_push_ncacn_packet_header(
 601                                 prs_get_mem_context(&p->out_data.frag),
 602                                 DCERPC_PKT_RESPONSE,
 603                                 hdr_flags,
 604                                 RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len,
 605                                 0,
 606                                 p->call_id,
 607                                 &hdr);
 608         if (!NT_STATUS_IS_OK(status)) {
 609                 DEBUG(0, ("Failed to marshall RPC Header.\n"));
 610                 prs_mem_free(&p->out_data.frag);
 611                 return False;
 612         }
 613
 614         /* Store the header in the data stream. */
 615         if (!prs_copy_data_in(&p->out_data.frag,
 616                                 (char *)hdr.data, hdr.length)) {
 617                 DEBUG(0, ("Out of memory.\n"));
 618                 prs_mem_free(&p->out_data.frag);
 619                 return False;
 620         }
 621
 622         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 623                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 624                 prs_mem_free(&p->out_data.frag);
 625                 return False;
 626         }
 627
 628         /* Copy the data into the PDU. */
 629
 630         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 631                                      p->out_data.data_sent_length, data_len)) {
 632                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 633                 prs_mem_free(&p->out_data.frag);
 634                 return False;
 635         }
 636
 637         /*
 638          * Setup the counts for this PDU.
 639          */
 640
 641         p->out_data.data_sent_length += data_len;
 642         p->out_data.current_pdu_sent = 0;
 643
 644         return True;
 645 }
 646
 647 /*******************************************************************
 648  Generate the next PDU to be returned from the data in p->rdata.
 649 ********************************************************************/
 650
 651 bool create_next_pdu(pipes_struct *p)
 652 {
 653         switch(p->auth.auth_level) {
 654                 case DCERPC_AUTH_LEVEL_NONE:
 655                 case DCERPC_AUTH_LEVEL_CONNECT:
 656                         /* This is incorrect for auth level connect. Fixme. JRA */
 657                         return create_next_pdu_noauth(p);
 658
 659                 default:
 660                         switch(p->auth.auth_type) {
 661                                 case PIPE_AUTH_TYPE_NTLMSSP:
 662                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 663                                         return create_next_pdu_ntlmssp(p);
 664                                 case PIPE_AUTH_TYPE_SCHANNEL:
 665                                         return create_next_pdu_schannel(p);
 666                                 default:
 667                                         break;
 668                         }
 669         }
 670
 671         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 672                         (unsigned int)p->auth.auth_level,
 673                         (unsigned int)p->auth.auth_type));
 674         return False;
 675 }
 676
 677 /*******************************************************************
 678  Process an NTLMSSP authentication response.
 679  If this function succeeds, the user has been authenticated
 680  and their domain, name and calling workstation stored in
 681  the pipe struct.
 682 *******************************************************************/
 683
 684 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 685 {
 686         DATA_BLOB session_key, reply;
 687         NTSTATUS status;
 688         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
 689         bool ret;
 690
 691         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
 692                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 693
 694         ZERO_STRUCT(reply);
 695
 696         /* this has to be done as root in order to verify the password */
 697         become_root();
 698         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 699         unbecome_root();
 700
 701         /* Don't generate a reply. */
 702         data_blob_free(&reply);
 703
 704         if (!NT_STATUS_IS_OK(status)) {
 705                 return False;
 706         }
 707
 708         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 709            ensure the underlying NTLMSSP flags are also set. If not we should
 710            refuse the bind. */
 711
 712         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
 713                 if (!auth_ntlmssp_negotiated_sign(a)) {
 714                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 715                                 "but client declined signing.\n",
 716                                  get_pipe_name_from_syntax(talloc_tos(),
 717                                                            &p->syntax)));
 718                         return False;
 719                 }
 720         }
 721         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 722                 if (!auth_ntlmssp_negotiated_seal(a)) {
 723                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 724                                 "but client declined sealing.\n",
 725                                  get_pipe_name_from_syntax(talloc_tos(),
 726                                                            &p->syntax)));
 727                         return False;
 728                 }
 729         }
 730
 731         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 732                   "workstation: %s\n",
 733                   auth_ntlmssp_get_username(a),
 734                   auth_ntlmssp_get_domain(a),
 735                   auth_ntlmssp_get_client(a)));
 736
 737         TALLOC_FREE(p->server_info);
 738
 739         p->server_info = auth_ntlmssp_server_info(p, a);
 740         if (p->server_info == NULL) {
 741                 DEBUG(0, ("auth_ntlmssp_server_info failed to obtain the server info for authenticated user\n"));
 742                 return false;
 743         }
 744
 745         if (p->server_info->ptok == NULL) {
 746                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 747                 return False;
 748         }
 749
 750         /*
 751          * We're an authenticated bind over smb, so the session key needs to
 752          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 753          * does. See the RPC-SAMBA3SESSIONKEY.
 754          */
 755
 756         session_key = generic_session_key();
 757         if (session_key.data == NULL) {
 758                 return False;
 759         }
 760
 761         ret = server_info_set_session_key(p->server_info, session_key);
 762
 763         data_blob_free(&session_key);
 764
 765         return True;
 766 }
 767
 768 /*******************************************************************
 769  This is the "stage3" NTLMSSP response after a bind request and reply.
 770 *******************************************************************/
 771
 772 bool api_pipe_bind_auth3(pipes_struct *p, struct ncacn_packet *pkt)
 773 {
 774         struct dcerpc_auth auth_info;
 775         uint32_t auth_len = pkt->auth_length;
 776         NTSTATUS status;
 777
 778         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 779
 780         if (auth_len == 0) {
 781                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 782                 goto err;
 783         }
 784
 785         /* Ensure there's enough data for an authenticated request. */
 786         if (RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + auth_len >
 787                                 pkt->frag_length) {
 788                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
 789                                 "%u is too large.\n",
 790                         (unsigned int)auth_len ));
 791                 goto err;
 792         }
 793
 794         /*
 795          * Decode the authentication verifier response.
 796          */
 797
 798         status = dcerpc_pull_dcerpc_auth(pkt,
 799                                          &pkt->u.auth3.auth_info,
 800                                          &auth_info);
 801         if (!NT_STATUS_IS_OK(status)) {
 802                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
 803                 goto err;
 804         }
 805
 806         /* We must NEVER look at auth_info->auth_pad_len here,
 807          * as old Samba client code gets it wrong and sends it
 808          * as zero. JRA.
 809          */
 810
 811         if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
 812                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 813                         (unsigned int)auth_info.auth_type ));
 814                 return False;
 815         }
 816
 817         /*
 818          * The following call actually checks the challenge/response data.
 819          * for correctness against the given DOMAIN\user name.
 820          */
 821
 822         if (!pipe_ntlmssp_verify_final(p, &auth_info.credentials)) {
 823                 goto err;
 824         }
 825
 826         p->pipe_bound = True;
 827
 828         return True;
 829
 830  err:
 831
 832         free_pipe_ntlmssp_auth_data(&p->auth);
 833         p->auth.a_u.auth_ntlmssp_state = NULL;
 834
 835         return False;
 836 }
 837
 838 /*******************************************************************
 839  Marshall a bind_nak pdu.
 840 *******************************************************************/
 841
 842 static bool setup_bind_nak(pipes_struct *p, struct ncacn_packet *pkt)
 843 {
 844         NTSTATUS status;
 845         union dcerpc_payload u;
 846         DATA_BLOB blob;
 847
 848         /* Free any memory in the current return data buffer. */
 849         prs_mem_free(&p->out_data.rdata);
 850
 851         /*
 852          * Marshall directly into the outgoing PDU space. We
 853          * must do this as we need to set to the bind response
 854          * header and are never sending more than one PDU here.
 855          */
 856
 857         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 858
 859         /*
 860          * Initialize a bind_nak header.
 861          */
 862
 863         ZERO_STRUCT(u);
 864
 865         u.bind_nak.reject_reason  = 0;
 866
 867         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 868                                           DCERPC_PKT_BIND_NAK,
 869                                           DCERPC_PFC_FLAG_FIRST |
 870                                                 DCERPC_PFC_FLAG_LAST,
 871                                           0,
 872                                           pkt->call_id,
 873                                           &u,
 874                                           &blob);
 875         if (!NT_STATUS_IS_OK(status)) {
 876                 prs_mem_free(&p->out_data.frag);
 877                 return False;
 878         }
 879
 880         if (!prs_copy_data_in(&p->out_data.frag,
 881                               (char *)blob.data, blob.length)) {
 882                 prs_mem_free(&p->out_data.frag);
 883                 return False;
 884         }
 885
 886         p->out_data.data_sent_length = 0;
 887         p->out_data.current_pdu_sent = 0;
 888
 889         if (p->auth.auth_data_free_func) {
 890                 (*p->auth.auth_data_free_func)(&p->auth);
 891         }
 892         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 893         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 894         p->pipe_bound = False;
 895
 896         return True;
 897 }
 898
 899 /*******************************************************************
 900  Marshall a fault pdu.
 901 *******************************************************************/
 902
 903 bool setup_fault_pdu(pipes_struct *p, NTSTATUS fault_status)
 904 {
 905         NTSTATUS status;
 906         union dcerpc_payload u;
 907         DATA_BLOB blob;
 908
 909         /* Free any memory in the current return data buffer. */
 910         prs_mem_free(&p->out_data.rdata);
 911
 912         /*
 913          * Marshall directly into the outgoing PDU space. We
 914          * must do this as we need to set to the bind response
 915          * header and are never sending more than one PDU here.
 916          */
 917
 918         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 919
 920         /*
 921          * Initialize a fault header.
 922          */
 923
 924         ZERO_STRUCT(u);
 925
 926         u.fault.status          = NT_STATUS_V(fault_status);
 927         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 928
 929         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 930                                           DCERPC_PKT_FAULT,
 931                                           DCERPC_PFC_FLAG_FIRST |
 932                                            DCERPC_PFC_FLAG_LAST |
 933                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 934                                           0,
 935                                           p->call_id,
 936                                           &u,
 937                                           &blob);
 938         if (!NT_STATUS_IS_OK(status)) {
 939                 prs_mem_free(&p->out_data.frag);
 940                 return False;
 941         }
 942
 943         if (!prs_copy_data_in(&p->out_data.frag,
 944                               (char *)blob.data, blob.length)) {
 945                 prs_mem_free(&p->out_data.frag);
 946                 return False;
 947         }
 948
 949         p->out_data.data_sent_length = 0;
 950         p->out_data.current_pdu_sent = 0;
 951
 952         return True;
 953 }
 954
 955 /*******************************************************************
 956  Ensure a bind request has the correct abstract & transfer interface.
 957  Used to reject unknown binds from Win2k.
 958 *******************************************************************/
 959
 960 static bool check_bind_req(struct pipes_struct *p,
 961                            struct ndr_syntax_id* abstract,
 962                            struct ndr_syntax_id* transfer,
 963                            uint32 context_id)
 964 {
 965         struct pipe_rpc_fns *context_fns;
 966
 967         DEBUG(3,("check_bind_req for %s\n",
 968                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 969
 970         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 971         if (rpc_srv_pipe_exists_by_id(abstract) &&
 972            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 973                 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 974                         rpc_srv_get_pipe_cli_name(abstract),
 975                         rpc_srv_get_pipe_srv_name(abstract)));
 976         } else {
 977                 return false;
 978         }
 979
 980         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 981         if (context_fns == NULL) {
 982                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 983                 return False;
 984         }
 985
 986         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 987         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 988         context_fns->context_id = context_id;
 989
 990         /* add to the list of open contexts */
 991
 992         DLIST_ADD( p->contexts, context_fns );
 993
 994         return True;
 995 }
 996
 997 /**
 998  * Is a named pipe known?
 999  * @param[in] cli_filename      The pipe name requested by the client
1000  * @result                      Do we want to serve this?
1001  */
1002 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1003 {
1004         const char *pipename = cli_filename;
1005         NTSTATUS status;
1006
1007         if (strnequal(pipename, "\\PIPE\\", 6)) {
1008                 pipename += 5;
1009         }
1010
1011         if (*pipename == '\\') {
1012                 pipename += 1;
1013         }
1014
1015         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1016                 DEBUG(10, ("refusing spoolss access\n"));
1017                 return false;
1018         }
1019
1020         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1021                 return true;
1022         }
1023
1024         status = smb_probe_module("rpc", pipename);
1025         if (!NT_STATUS_IS_OK(status)) {
1026                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1027                 return false;
1028         }
1029         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
1030
1031         /*
1032          * Scan the list again for the interface id
1033          */
1034         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1035                 return true;
1036         }
1037
1038         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
1039                    pipename));
1040
1041         return false;
1042 }
1043
1044 /*******************************************************************
1045  Handle a SPNEGO krb5 bind auth.
1046 *******************************************************************/
1047
1048 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p,
1049                                            TALLOC_CTX *mem_ctx,
1050                                            struct dcerpc_auth *pauth_info,
1051                                            DATA_BLOB *psecblob,
1052                                            DATA_BLOB *response)
1053 {
1054         return False;
1055 }
1056
1057 /*******************************************************************
1058  Handle the first part of a SPNEGO bind auth.
1059 *******************************************************************/
1060
1061 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p,
1062                                             TALLOC_CTX *mem_ctx,
1063                                             struct dcerpc_auth *pauth_info,
1064                                             DATA_BLOB *response)
1065 {
1066         DATA_BLOB secblob;
1067         DATA_BLOB chal;
1068         char *OIDs[ASN1_MAX_OIDS];
1069         int i;
1070         NTSTATUS status;
1071         bool got_kerberos_mechanism = false;
1072         struct auth_ntlmssp_state *a = NULL;
1073
1074         ZERO_STRUCT(secblob);
1075         ZERO_STRUCT(chal);
1076
1077         if (pauth_info->credentials.data[0] != ASN1_APPLICATION(0)) {
1078                 goto err;
1079         }
1080
1081         /* parse out the OIDs and the first sec blob */
1082         if (!parse_negTokenTarg(pauth_info->credentials, OIDs, &secblob)) {
1083                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1084                 goto err;
1085         }
1086
1087         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1088                 got_kerberos_mechanism = true;
1089         }
1090
1091         for (i=0;OIDs[i];i++) {
1092                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1093                 TALLOC_FREE(OIDs[i]);
1094         }
1095         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1096
1097         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1098                 bool ret;
1099                 ret = pipe_spnego_auth_bind_kerberos(p, mem_ctx, pauth_info,
1100                                                      &secblob, response);
1101                 data_blob_free(&secblob);
1102                 return ret;
1103         }
1104
1105         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1106                 /* Free any previous auth type. */
1107                 free_pipe_ntlmssp_auth_data(&p->auth);
1108         }
1109
1110         if (!got_kerberos_mechanism) {
1111                 /* Initialize the NTLM engine. */
1112                 status = auth_ntlmssp_start(&a);
1113                 if (!NT_STATUS_IS_OK(status)) {
1114                         goto err;
1115                 }
1116
1117                 switch (pauth_info->auth_level) {
1118                         case DCERPC_AUTH_LEVEL_INTEGRITY:
1119                                 auth_ntlmssp_want_sign(a);
1120                                 break;
1121                         case DCERPC_AUTH_LEVEL_PRIVACY:
1122                                 auth_ntlmssp_want_seal(a);
1123                                 break;
1124                         default:
1125                                 break;
1126                 }
1127                 /*
1128                  * Pass the first security blob of data to it.
1129                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1130                  * which means we need another packet to complete the bind.
1131                  */
1132
1133                 status = auth_ntlmssp_update(a, secblob, &chal);
1134
1135                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1136                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1137                         goto err;
1138                 }
1139
1140                 /* Generate the response blob we need for step 2 of the bind. */
1141                 *response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1142         } else {
1143                 /*
1144                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1145                  * code to process follow-up packets is not complete
1146                  * yet. JRA.
1147                  */
1148                 *response = spnego_gen_auth_response(NULL,
1149                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1150                                         OID_NTLMSSP);
1151         }
1152
1153         /* Make sure data is bound to the memctx, to be freed the caller */
1154         talloc_steal(mem_ctx, response->data);
1155
1156         /* auth_pad_len will be handled by the caller */
1157
1158         p->auth.a_u.auth_ntlmssp_state = a;
1159         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1160         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1161
1162         data_blob_free(&secblob);
1163         data_blob_free(&chal);
1164
1165         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1166         return True;
1167
1168  err:
1169
1170         data_blob_free(&secblob);
1171         data_blob_free(&chal);
1172
1173         p->auth.a_u.auth_ntlmssp_state = NULL;
1174
1175         return False;
1176 }
1177
1178 /*******************************************************************
1179  Handle the second part of a SPNEGO bind auth.
1180 *******************************************************************/
1181
1182 static bool pipe_spnego_auth_bind_continue(pipes_struct *p,
1183                                            TALLOC_CTX *mem_ctx,
1184                                            struct dcerpc_auth *pauth_info,
1185                                            DATA_BLOB *response)
1186 {
1187         DATA_BLOB auth_blob;
1188         DATA_BLOB auth_reply;
1189         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
1190
1191         ZERO_STRUCT(auth_blob);
1192         ZERO_STRUCT(auth_reply);
1193
1194         /*
1195          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1196          * fail here as 'a' == NULL.
1197          */
1198         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1199                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1200                 goto err;
1201         }
1202
1203         if (pauth_info->credentials.data[0] != ASN1_CONTEXT(1)) {
1204                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1205                 goto err;
1206         }
1207
1208         if (!spnego_parse_auth(pauth_info->credentials, &auth_blob)) {
1209                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1210                 goto err;
1211         }
1212
1213         /*
1214          * The following call actually checks the challenge/response data.
1215          * for correctness against the given DOMAIN\user name.
1216          */
1217
1218         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1219                 goto err;
1220         }
1221
1222         data_blob_free(&auth_blob);
1223
1224         /* Generate the spnego "accept completed" blob - no incoming data. */
1225         *response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1226
1227         /* Make sure data is bound to the memctx, to be freed the caller */
1228         talloc_steal(mem_ctx, response->data);
1229
1230         data_blob_free(&auth_reply);
1231
1232         p->pipe_bound = True;
1233
1234         return True;
1235
1236  err:
1237
1238         data_blob_free(&auth_blob);
1239         data_blob_free(&auth_reply);
1240
1241         free_pipe_ntlmssp_auth_data(&p->auth);
1242         p->auth.a_u.auth_ntlmssp_state = NULL;
1243
1244         return False;
1245 }
1246
1247 /*******************************************************************
1248  Handle an schannel bind auth.
1249 *******************************************************************/
1250
1251 static bool pipe_schannel_auth_bind(pipes_struct *p,
1252                                     TALLOC_CTX *mem_ctx,
1253                                     struct dcerpc_auth *auth_info,
1254                                     DATA_BLOB *response)
1255 {
1256         struct NL_AUTH_MESSAGE neg;
1257         struct NL_AUTH_MESSAGE reply;
1258         bool ret;
1259         NTSTATUS status;
1260         struct netlogon_creds_CredentialState *creds;
1261         DATA_BLOB session_key;
1262         enum ndr_err_code ndr_err;
1263
1264         ndr_err = ndr_pull_struct_blob(
1265                         &auth_info->credentials, mem_ctx, &neg,
1266                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1267         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1268                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1269                 return false;
1270         }
1271
1272         if (DEBUGLEVEL >= 10) {
1273                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1274         }
1275
1276         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1277                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1278                 return false;
1279         }
1280
1281         /*
1282          * The neg.oem_netbios_computer.a key here must match the remote computer name
1283          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1284          * operations that use credentials.
1285          */
1286
1287         become_root();
1288         status = schannel_get_creds_state(p, lp_private_dir(),
1289                                             neg.oem_netbios_computer.a, &creds);
1290         unbecome_root();
1291
1292         if (!NT_STATUS_IS_OK(status)) {
1293                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1294                 return False;
1295         }
1296
1297         p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1298         if (!p->auth.a_u.schannel_auth) {
1299                 TALLOC_FREE(creds);
1300                 return False;
1301         }
1302
1303         p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1304         p->auth.a_u.schannel_auth->seq_num = 0;
1305         p->auth.a_u.schannel_auth->initiator = false;
1306         p->auth.a_u.schannel_auth->creds = creds;
1307
1308         /*
1309          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1310          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1311          * struct of the person who opened the pipe. I need to test this further. JRA.
1312          *
1313          * VL. As we are mapping this to guest set the generic key
1314          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1315          * W2k3, as it does not allow schannel binds against SAMR and LSA
1316          * anymore.
1317          */
1318
1319         session_key = generic_session_key();
1320         if (session_key.data == NULL) {
1321                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1322                           " key\n"));
1323                 return false;
1324         }
1325
1326         ret = server_info_set_session_key(p->server_info, session_key);
1327
1328         data_blob_free(&session_key);
1329
1330         if (!ret) {
1331                 DEBUG(0, ("server_info_set_session_key failed\n"));
1332                 return false;
1333         }
1334
1335         /*** SCHANNEL verifier ***/
1336
1337         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
1338         reply.Flags                             = 0;
1339         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
1340                                                       * this has any meaning
1341                                                       * here - gd */
1342
1343         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
1344                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1345         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1346                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1347                 return false;
1348         }
1349
1350         if (DEBUGLEVEL >= 10) {
1351                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1352         }
1353
1354         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1355                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1356
1357         /* We're finished with this bind - no more packets. */
1358         p->auth.auth_data_free_func = NULL;
1359         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1360
1361         p->pipe_bound = True;
1362
1363         return True;
1364 }
1365
1366 /*******************************************************************
1367  Handle an NTLMSSP bind auth.
1368 *******************************************************************/
1369
1370 static bool pipe_ntlmssp_auth_bind(pipes_struct *p,
1371                                    TALLOC_CTX *mem_ctx,
1372                                    struct dcerpc_auth *auth_info,
1373                                    DATA_BLOB *response)
1374 {
1375         NTSTATUS status;
1376         struct auth_ntlmssp_state *a = NULL;
1377
1378         if (strncmp((char *)auth_info->credentials.data, "NTLMSSP", 7) != 0) {
1379                 DEBUG(0, ("Failed to read NTLMSSP in blob\n"));
1380                 goto err;
1381         }
1382
1383         /* We have an NTLMSSP blob. */
1384         status = auth_ntlmssp_start(&a);
1385         if (!NT_STATUS_IS_OK(status)) {
1386                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1387                         nt_errstr(status) ));
1388                 goto err;
1389         }
1390
1391         switch (auth_info->auth_level) {
1392         case DCERPC_AUTH_LEVEL_INTEGRITY:
1393                 auth_ntlmssp_want_sign(a);
1394                 break;
1395         case DCERPC_AUTH_LEVEL_PRIVACY:
1396                 auth_ntlmssp_want_seal(a);
1397                 break;
1398         default:
1399                 break;
1400         }
1401
1402         status = auth_ntlmssp_update(a, auth_info->credentials, response);
1403         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1404                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1405                         nt_errstr(status) ));
1406                 goto err;
1407         }
1408
1409         /* Make sure data is bound to the memctx, to be freed the caller */
1410         talloc_steal(mem_ctx, response->data);
1411
1412         p->auth.a_u.auth_ntlmssp_state = a;
1413         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1414         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1415
1416         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1417
1418         /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1419         return True;
1420
1421   err:
1422
1423         free_pipe_ntlmssp_auth_data(&p->auth);
1424         p->auth.a_u.auth_ntlmssp_state = NULL;
1425         return False;
1426 }
1427
1428 /*******************************************************************
1429  Respond to a pipe bind request.
1430 *******************************************************************/
1431
1432 bool api_pipe_bind_req(pipes_struct *p, struct ncacn_packet *pkt)
1433 {
1434         struct dcerpc_auth auth_info;
1435         uint16 assoc_gid;
1436         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1437         NTSTATUS status;
1438         struct ndr_syntax_id id;
1439         union dcerpc_payload u;
1440         struct dcerpc_ack_ctx bind_ack_ctx;
1441         DATA_BLOB auth_resp = data_blob_null;
1442         DATA_BLOB auth_blob = data_blob_null;
1443         DATA_BLOB blob = data_blob_null;
1444         int pad_len = 0;
1445
1446         /* No rebinds on a bound pipe - use alter context. */
1447         if (p->pipe_bound) {
1448                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1449                          "pipe %s.\n",
1450                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1451                 return setup_bind_nak(p, pkt);
1452         }
1453
1454         if (pkt->u.bind.num_contexts == 0) {
1455                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1456                 goto err_exit;
1457         }
1458
1459         /*
1460          * Try and find the correct pipe name to ensure
1461          * that this is a pipe name we support.
1462          */
1463         id = pkt->u.bind.ctx_list[0].abstract_syntax;
1464         if (rpc_srv_pipe_exists_by_id(&id)) {
1465                 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1466                         rpc_srv_get_pipe_cli_name(&id),
1467                         rpc_srv_get_pipe_srv_name(&id)));
1468         } else {
1469                 status = smb_probe_module(
1470                         "rpc", get_pipe_name_from_syntax(
1471                                 talloc_tos(),
1472                                 &pkt->u.bind.ctx_list[0].abstract_syntax));
1473
1474                 if (NT_STATUS_IS_ERR(status)) {
1475                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1476                                 get_pipe_name_from_syntax(
1477                                         talloc_tos(),
1478                                         &pkt->u.bind.ctx_list[0].abstract_syntax)));
1479
1480                         return setup_bind_nak(p, pkt);
1481                 }
1482
1483                 if (rpc_srv_get_pipe_interface_by_cli_name(
1484                                 get_pipe_name_from_syntax(talloc_tos(),
1485                                                           &p->syntax),
1486                                 &id)) {
1487                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1488                                 rpc_srv_get_pipe_cli_name(&id),
1489                                 rpc_srv_get_pipe_srv_name(&id)));
1490                 } else {
1491                         DEBUG(0, ("module %s doesn't provide functions for "
1492                                   "pipe %s!\n",
1493                                   get_pipe_name_from_syntax(talloc_tos(),
1494                                                             &p->syntax),
1495                                   get_pipe_name_from_syntax(talloc_tos(),
1496                                                             &p->syntax)));
1497                         return setup_bind_nak(p, pkt);
1498                 }
1499         }
1500
1501         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1502
1503         if (pkt->u.bind.assoc_group_id != 0) {
1504                 assoc_gid = pkt->u.bind.assoc_group_id;
1505         } else {
1506                 assoc_gid = 0x53f0;
1507         }
1508
1509         /*
1510          * Marshall directly into the outgoing PDU space. We
1511          * must do this as we need to set to the bind response
1512          * header and are never sending more than one PDU here.
1513          */
1514
1515         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1516
1517         /*
1518          * Create the bind response struct.
1519          */
1520
1521         /* If the requested abstract synt uuid doesn't match our client pipe,
1522                 reject the bind_ack & set the transfer interface synt to all 0's,
1523                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1524                 unknown to NT4)
1525                 Needed when adding entries to a DACL from NT5 - SK */
1526
1527         if (check_bind_req(p,
1528                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1529                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1530                         pkt->u.bind.ctx_list[0].context_id)) {
1531
1532                 bind_ack_ctx.result = 0;
1533                 bind_ack_ctx.reason = 0;
1534                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1535         } else {
1536                 p->pipe_bound = False;
1537                 /* Rejection reason: abstract syntax not supported */
1538                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1539                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1540                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1541         }
1542
1543         /*
1544          * Check if this is an authenticated bind request.
1545          */
1546         if (pkt->auth_length) {
1547                 /* Quick length check. Won't catch a bad auth footer,
1548                  * prevents overrun. */
1549
1550                 if (pkt->frag_length < RPC_HEADER_LEN +
1551                                         RPC_HDR_AUTH_LEN +
1552                                         pkt->auth_length) {
1553                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
1554                                 "too long for fragment %u.\n",
1555                                 (unsigned int)pkt->auth_length,
1556                                 (unsigned int)pkt->frag_length));
1557                         goto err_exit;
1558                 }
1559
1560                 /*
1561                  * Decode the authentication verifier.
1562                  */
1563                 status = dcerpc_pull_dcerpc_auth(pkt,
1564                                                  &pkt->u.bind.auth_info,
1565                                                  &auth_info);
1566                 if (!NT_STATUS_IS_OK(status)) {
1567                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1568                         goto err_exit;
1569                 }
1570
1571                 auth_type = auth_info.auth_type;
1572
1573                 /* Work out if we have to sign or seal etc. */
1574                 switch (auth_info.auth_level) {
1575                 case DCERPC_AUTH_LEVEL_INTEGRITY:
1576                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1577                         break;
1578                 case DCERPC_AUTH_LEVEL_PRIVACY:
1579                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1580                         break;
1581                 default:
1582                         DEBUG(0, ("Unexpected auth level (%u).\n",
1583                                 (unsigned int)auth_info.auth_level ));
1584                         goto err_exit;
1585                 }
1586
1587                 switch (auth_type) {
1588                 case DCERPC_AUTH_TYPE_NTLMSSP:
1589                         if (!pipe_ntlmssp_auth_bind(p, pkt,
1590                                                 &auth_info, &auth_resp)) {
1591                                 goto err_exit;
1592                         }
1593                         assoc_gid = 0x7a77;
1594                         break;
1595
1596                 case DCERPC_AUTH_TYPE_SCHANNEL:
1597                         if (!pipe_schannel_auth_bind(p, pkt,
1598                                                 &auth_info, &auth_resp)) {
1599                                 goto err_exit;
1600                         }
1601                         break;
1602
1603                 case DCERPC_AUTH_TYPE_SPNEGO:
1604                         if (!pipe_spnego_auth_bind_negotiate(p, pkt,
1605                                                 &auth_info, &auth_resp)) {
1606                                 goto err_exit;
1607                         }
1608                         break;
1609
1610                 case DCERPC_AUTH_TYPE_NONE:
1611                         break;
1612
1613                 default:
1614                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
1615                         goto err_exit;
1616                 }
1617         }
1618
1619         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
1620                 /* Unauthenticated bind request. */
1621                 /* We're finished - no more packets. */
1622                 p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1623                 /* We must set the pipe auth_level here also. */
1624                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1625                 p->pipe_bound = True;
1626                 /* The session key was initialized from the SMB
1627                  * session in make_internal_rpc_pipe_p */
1628         }
1629
1630         ZERO_STRUCT(u.bind_ack);
1631         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1632         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1633         u.bind_ack.assoc_group_id = assoc_gid;
1634
1635         /* name has to be \PIPE\xxxxx */
1636         u.bind_ack.secondary_address =
1637                         talloc_asprintf(pkt, "\\PIPE\\%s",
1638                                         rpc_srv_get_pipe_srv_name(&id));
1639         if (!u.bind_ack.secondary_address) {
1640                 DEBUG(0, ("Out of memory!\n"));
1641                 goto err_exit;
1642         }
1643         u.bind_ack.secondary_address_size =
1644                                 strlen(u.bind_ack.secondary_address) + 1;
1645
1646         u.bind_ack.num_results = 1;
1647         u.bind_ack.ctx_list = &bind_ack_ctx;
1648
1649         /* NOTE: We leave the auth_info empty so we can calculate the padding
1650          * later and then append the auth_info --simo */
1651
1652         status = dcerpc_push_ncacn_packet(pkt, DCERPC_PKT_BIND_ACK,
1653                                           DCERPC_PFC_FLAG_FIRST |
1654                                                 DCERPC_PFC_FLAG_LAST,
1655                                           auth_resp.length,
1656                                           pkt->call_id,
1657                                           &u, &blob);
1658         if (!NT_STATUS_IS_OK(status)) {
1659                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1660                           nt_errstr(status)));
1661         }
1662
1663         if (auth_resp.length) {
1664
1665                 /* Work out any padding needed before the auth footer. */
1666                 pad_len = blob.length % SERVER_NDR_PADDING_SIZE;
1667                 if (pad_len) {
1668                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1669                         DEBUG(10, ("auth pad_len = %u\n",
1670                                    (unsigned int)pad_len));
1671                 }
1672
1673                 status = dcerpc_push_dcerpc_auth(pkt,
1674                                                  auth_type,
1675                                                  auth_info.auth_level,
1676                                                  pad_len,
1677                                                  1, /* auth_context_id */
1678                                                  &auth_resp,
1679                                                  &auth_blob);
1680                 if (!NT_STATUS_IS_OK(status)) {
1681                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1682                         goto err_exit;
1683                 }
1684         }
1685
1686         /* Now that we have the auth len store it into the right place in
1687          * the dcerpc header */
1688         dcerpc_set_frag_length(&blob, blob.length + pad_len + auth_blob.length);
1689
1690         /* And finally copy all bits in the output pdu */
1691         if (!prs_copy_data_in(&p->out_data.frag,
1692                                         (char *)blob.data, blob.length)) {
1693                 DEBUG(0, ("Failed to copy data to output buffer.\n"));
1694                 goto err_exit;
1695         }
1696
1697         if (auth_blob.length) {
1698                 if (pad_len) {
1699                         char pad[SERVER_NDR_PADDING_SIZE];
1700                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1701                         if (!prs_copy_data_in(&p->out_data.frag, pad, pad_len)) {
1702                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1703                                           "%u bytes of pad data.\n",
1704                                   (unsigned int)pad_len));
1705                                 goto err_exit;
1706                         }
1707                 }
1708
1709                 if (!prs_copy_data_in(&p->out_data.frag,
1710                                         (char *)auth_blob.data,
1711                                         auth_blob.length)) {
1712                         DEBUG(0, ("Append of auth info failed.\n"));
1713                         goto err_exit;
1714                 }
1715         }
1716
1717         /*
1718          * Setup the lengths for the initial reply.
1719          */
1720
1721         p->out_data.data_sent_length = 0;
1722         p->out_data.current_pdu_sent = 0;
1723
1724         TALLOC_FREE(auth_blob.data);
1725         TALLOC_FREE(blob.data);
1726         return True;
1727
1728   err_exit:
1729
1730         prs_mem_free(&p->out_data.frag);
1731         TALLOC_FREE(auth_blob.data);
1732         TALLOC_FREE(blob.data);
1733         return setup_bind_nak(p, pkt);
1734 }
1735
1736 /****************************************************************************
1737  Deal with an alter context call. Can be third part of 3 leg auth request for
1738  SPNEGO calls.
1739 ****************************************************************************/
1740
1741 bool api_pipe_alter_context(pipes_struct *p, struct ncacn_packet *pkt)
1742 {
1743         RPC_HDR hdr;
1744         RPC_HDR_BA hdr_ba;
1745         struct dcerpc_auth auth_info;
1746         uint16 assoc_gid;
1747         fstring ack_pipe_name;
1748         prs_struct out_hdr_ba;
1749         int auth_len = 0;
1750         uint32_t ss_padding_len = 0;
1751         NTSTATUS status;
1752         DATA_BLOB auth_resp = data_blob_null;
1753         DATA_BLOB auth_blob = data_blob_null;
1754
1755         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1756
1757         /*
1758          * Marshall directly into the outgoing PDU space. We
1759          * must do this as we need to set to the bind response
1760          * header and are never sending more than one PDU here.
1761          */
1762
1763         /*
1764          * Setup the memory to marshall the ba header, and the
1765          * auth footers.
1766          */
1767
1768         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1769                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1770                 prs_mem_free(&p->out_data.frag);
1771                 return False;
1772         }
1773
1774         /* secondary address CAN be NULL
1775          * as the specs say it's ignored.
1776          * It MUST be NULL to have the spoolss working.
1777          */
1778         fstrcpy(ack_pipe_name,"");
1779
1780         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1781
1782         if (pkt->u.bind.assoc_group_id != 0) {
1783                 assoc_gid = pkt->u.bind.assoc_group_id;
1784         } else {
1785                 assoc_gid = 0x53f0;
1786         }
1787
1788         /*
1789          * Create the bind response struct.
1790          */
1791
1792         /* If the requested abstract synt uuid doesn't match our client pipe,
1793                 reject the bind_ack & set the transfer interface synt to all 0's,
1794                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1795                 unknown to NT4)
1796                 Needed when adding entries to a DACL from NT5 - SK */
1797
1798         if (check_bind_req(p,
1799                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1800                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1801                         pkt->u.bind.ctx_list[0].context_id)) {
1802                 init_rpc_hdr_ba(&hdr_ba,
1803                         RPC_MAX_PDU_FRAG_LEN,
1804                         RPC_MAX_PDU_FRAG_LEN,
1805                         assoc_gid,
1806                         ack_pipe_name,
1807                         0x1, 0x0, 0x0,
1808                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0]);
1809         } else {
1810                 /* Rejection reason: abstract syntax not supported */
1811                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1812                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1813                                         ack_pipe_name, 0x1, 0x2, 0x1,
1814                                         &null_ndr_syntax_id);
1815                 p->pipe_bound = False;
1816         }
1817
1818         /*
1819          * and marshall it.
1820          */
1821
1822         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1823                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1824                 goto err_exit;
1825         }
1826
1827
1828         /*
1829          * Check if this is an authenticated alter context request.
1830          */
1831
1832         if (pkt->auth_length != 0) {
1833                 /*
1834                  * Decode the authentication verifier.
1835                  */
1836
1837                 /* Work out any padding needed before the auth footer. */
1838                 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
1839                         ss_padding_len = SERVER_NDR_PADDING_SIZE -
1840                                 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
1841                         DEBUG(10,("api_pipe_alter_context: auth pad_len = %u\n",
1842                                 (unsigned int)ss_padding_len ));
1843                 }
1844
1845                 /* Quick length check. Won't catch a bad auth footer,
1846                  * prevents overrun. */
1847
1848                 if (pkt->frag_length < RPC_HEADER_LEN +
1849                                         RPC_HDR_AUTH_LEN +
1850                                         pkt->auth_length) {
1851                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1852                                 "too long for fragment %u.\n",
1853                                 (unsigned int)pkt->auth_length,
1854                                 (unsigned int)pkt->frag_length ));
1855                         goto err_exit;
1856                 }
1857
1858                 status = dcerpc_pull_dcerpc_auth(pkt,
1859                                                  &pkt->u.bind.auth_info,
1860                                                  &auth_info);
1861                 if (!NT_STATUS_IS_OK(status)) {
1862                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1863                         goto err_exit;
1864                 }
1865
1866
1867                 /*
1868                  * Currently only the SPNEGO auth type uses the alter ctx
1869                  * response in place of the NTLMSSP auth3 type.
1870                  */
1871
1872                 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
1873                         /* We can only finish if the pipe is unbound. */
1874                         if (!p->pipe_bound) {
1875                                 if (!pipe_spnego_auth_bind_continue(p, pkt,
1876                                                 &auth_info, &auth_resp)) {
1877                                         goto err_exit;
1878                                 }
1879
1880                         } else {
1881                                 goto err_exit;
1882                         }
1883                 }
1884         } else {
1885                 ZERO_STRUCT(auth_info);
1886         }
1887
1888         if (auth_resp.length) {
1889                 status = dcerpc_push_dcerpc_auth(pkt,
1890                                                  auth_info.auth_type,
1891                                                  auth_info.auth_level,
1892                                                  ss_padding_len,
1893                                                  1, /* auth_context_id */
1894                                                  &auth_resp,
1895                                                  &auth_blob);
1896                 if (!NT_STATUS_IS_OK(status)) {
1897                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1898                         goto err_exit;
1899                 }
1900
1901                 auth_len = auth_resp.length;
1902         }
1903         /*
1904          * Create the header, now we know the length.
1905          */
1906
1907         init_rpc_hdr(&hdr, DCERPC_PKT_ALTER_RESP, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1908                         pkt->call_id,
1909                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + auth_blob.length,
1910                         auth_len);
1911
1912         /*
1913          * Marshall the header into the outgoing PDU.
1914          */
1915
1916         if(!smb_io_rpc_hdr("", &hdr, &p->out_data.frag, 0)) {
1917                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
1918                 goto err_exit;
1919         }
1920
1921         /*
1922          * Now add the RPC_HDR_BA and any auth needed.
1923          */
1924
1925         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1926                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
1927                 goto err_exit;
1928         }
1929
1930         if (auth_len) {
1931                 if (ss_padding_len) {
1932                         char pad[SERVER_NDR_PADDING_SIZE];
1933                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1934                         if (!prs_copy_data_in(&p->out_data.frag, pad,
1935                                         ss_padding_len)) {
1936                                 DEBUG(0,("api_pipe_alter_context: failed to add %u "
1937                                         "bytes of pad data.\n",
1938                                         (unsigned int)ss_padding_len));
1939                                 goto err_exit;
1940                         }
1941                 }
1942
1943                 if (!prs_copy_data_in(&p->out_data.frag,
1944                                         (char *)auth_blob.data,
1945                                         auth_blob.length)) {
1946                         DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
1947                         goto err_exit;
1948                 }
1949         }
1950
1951         /*
1952          * Setup the lengths for the initial reply.
1953          */
1954
1955         p->out_data.data_sent_length = 0;
1956         p->out_data.current_pdu_sent = 0;
1957
1958         prs_mem_free(&out_hdr_ba);
1959         TALLOC_FREE(auth_blob.data);
1960         return True;
1961
1962   err_exit:
1963
1964         prs_mem_free(&p->out_data.frag);
1965         prs_mem_free(&out_hdr_ba);
1966         TALLOC_FREE(auth_blob.data);
1967         return setup_bind_nak(p, pkt);
1968 }
1969
1970 /****************************************************************************
1971  Find the set of RPC functions associated with this context_id
1972 ****************************************************************************/
1973
1974 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
1975 {
1976         PIPE_RPC_FNS *fns = NULL;
1977
1978         if ( !list ) {
1979                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
1980                 return NULL;
1981         }
1982
1983         for (fns=list; fns; fns=fns->next ) {
1984                 if ( fns->context_id == context_id )
1985                         return fns;
1986         }
1987         return NULL;
1988 }
1989
1990 /****************************************************************************
1991  Memory cleanup.
1992 ****************************************************************************/
1993
1994 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
1995 {
1996         PIPE_RPC_FNS *tmp = list;
1997         PIPE_RPC_FNS *tmp2;
1998
1999         while (tmp) {
2000                 tmp2 = tmp->next;
2001                 SAFE_FREE(tmp);
2002                 tmp = tmp2;
2003         }
2004
2005         return;
2006 }
2007
2008 static bool api_rpcTNP(pipes_struct *p, struct ncacn_packet *pkt,
2009                        const struct api_struct *api_rpc_cmds, int n_cmds);
2010
2011 /****************************************************************************
2012  Find the correct RPC function to call for this request.
2013  If the pipe is authenticated then become the correct UNIX user
2014  before doing the call.
2015 ****************************************************************************/
2016
2017 bool api_pipe_request(pipes_struct *p, struct ncacn_packet *pkt)
2018 {
2019         bool ret = False;
2020         bool changed_user = False;
2021         PIPE_RPC_FNS *pipe_fns;
2022
2023         if (p->pipe_bound &&
2024                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2025                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2026                 if(!become_authenticated_pipe_user(p)) {
2027                         prs_mem_free(&p->out_data.rdata);
2028                         return False;
2029                 }
2030                 changed_user = True;
2031         }
2032
2033         DEBUG(5, ("Requested \\PIPE\\%s\n",
2034                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2035
2036         /* get the set of RPC functions for this context */
2037
2038         pipe_fns = find_pipe_fns_by_context(p->contexts,
2039                                             pkt->u.request.context_id);
2040
2041         if ( pipe_fns ) {
2042                 TALLOC_CTX *frame = talloc_stackframe();
2043                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds);
2044                 TALLOC_FREE(frame);
2045         }
2046         else {
2047                 DEBUG(0, ("No rpc function table associated with context "
2048                           "[%d] on pipe [%s]\n",
2049                           pkt->u.request.context_id,
2050                           get_pipe_name_from_syntax(talloc_tos(),
2051                                                     &p->syntax)));
2052         }
2053
2054         if (changed_user) {
2055                 unbecome_authenticated_pipe_user();
2056         }
2057
2058         return ret;
2059 }
2060
2061 /*******************************************************************
2062  Calls the underlying RPC function for a named pipe.
2063  ********************************************************************/
2064
2065 static bool api_rpcTNP(pipes_struct *p, struct ncacn_packet *pkt,
2066                        const struct api_struct *api_rpc_cmds, int n_cmds)
2067 {
2068         int fn_num;
2069         uint32 offset1, offset2;
2070
2071         /* interpret the command */
2072         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2073                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2074                  pkt->u.request.opnum));
2075
2076         if (DEBUGLEVEL >= 50) {
2077                 fstring name;
2078                 slprintf(name, sizeof(name)-1, "in_%s",
2079                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2080                 prs_dump(name, pkt->u.request.opnum, &p->in_data.data);
2081         }
2082
2083         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2084                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
2085                     api_rpc_cmds[fn_num].fn != NULL) {
2086                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
2087                                   api_rpc_cmds[fn_num].name));
2088                         break;
2089                 }
2090         }
2091
2092         if (fn_num == n_cmds) {
2093                 /*
2094                  * For an unknown RPC just return a fault PDU but
2095                  * return True to allow RPC's on the pipe to continue
2096                  * and not put the pipe into fault state. JRA.
2097                  */
2098                 DEBUG(4, ("unknown\n"));
2099                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2100                 return True;
2101         }
2102
2103         offset1 = prs_offset(&p->out_data.rdata);
2104
2105         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2106                 fn_num, api_rpc_cmds[fn_num].fn));
2107         /* do the actual command */
2108         if(!api_rpc_cmds[fn_num].fn(p)) {
2109                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2110                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2111                          api_rpc_cmds[fn_num].name));
2112                 prs_mem_free(&p->out_data.rdata);
2113                 return False;
2114         }
2115
2116         if (p->bad_handle_fault_state) {
2117                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2118                 p->bad_handle_fault_state = False;
2119                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2120                 return True;
2121         }
2122
2123         if (p->rng_fault_state) {
2124                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2125                 p->rng_fault_state = False;
2126                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2127                 return True;
2128         }
2129
2130         offset2 = prs_offset(&p->out_data.rdata);
2131         prs_set_offset(&p->out_data.rdata, offset1);
2132         if (DEBUGLEVEL >= 50) {
2133                 fstring name;
2134                 slprintf(name, sizeof(name)-1, "out_%s",
2135                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2136                 prs_dump(name, pkt->u.request.opnum, &p->out_data.rdata);
2137         }
2138         prs_set_offset(&p->out_data.rdata, offset2);
2139
2140         DEBUG(5,("api_rpcTNP: called %s successfully\n",
2141                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2142
2143         /* Check for buffer underflow in rpc parsing */
2144
2145         if ((DEBUGLEVEL >= 10) &&
2146             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2147                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2148                 char *data = (char *)SMB_MALLOC(data_len);
2149
2150                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2151                 if (data) {
2152                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2153                         SAFE_FREE(data);
2154                 }
2155
2156         }
2157
2158         return True;
2159 }