source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "srv_pipe_internal.h"
  32 #include "../librpc/gen_ndr/ndr_schannel.h"
  33 #include "../libcli/auth/schannel.h"
  34 #include "../libcli/auth/spnego.h"
  35 #include "../libcli/auth/ntlmssp.h"
  36
  37 #undef DBGC_CLASS
  38 #define DBGC_CLASS DBGC_RPC_SRV
  39
  40 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  41 {
  42         struct auth_ntlmssp_state *a = auth->a_u.auth_ntlmssp_state;
  43
  44         if (a) {
  45                 auth_ntlmssp_end(&a);
  46         }
  47         auth->a_u.auth_ntlmssp_state = NULL;
  48 }
  49
  50 static DATA_BLOB generic_session_key(void)
  51 {
  52         return data_blob("SystemLibraryDTC", 16);
  53 }
  54
  55 /*******************************************************************
  56  Generate the next PDU to be returned from the data in p->rdata.
  57  Handle NTLMSSP.
  58  ********************************************************************/
  59
  60 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  61 {
  62         DATA_BLOB hdr;
  63         uint8_t hdr_flags;
  64         RPC_HDR_RESP hdr_resp;
  65         uint32 ss_padding_len = 0;
  66         uint32 data_space_available;
  67         uint32 data_len_left;
  68         uint32 data_len;
  69         NTSTATUS status;
  70         DATA_BLOB auth_blob;
  71         RPC_HDR_AUTH auth_info;
  72         uint8 auth_type, auth_level;
  73         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
  74         TALLOC_CTX *frame;
  75
  76         /*
  77          * If we're in the fault state, keep returning fault PDU's until
  78          * the pipe gets closed. JRA.
  79          */
  80
  81         if(p->fault_state) {
  82                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  83                 return True;
  84         }
  85
  86         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  87
  88         /* Set up rpc header flags. */
  89         if (p->out_data.data_sent_length == 0) {
  90                 hdr_flags = DCERPC_PFC_FLAG_FIRST;
  91         } else {
  92                 hdr_flags = 0;
  93         }
  94
  95         /*
  96          * Work out how much we can fit in a single PDU.
  97          */
  98
  99         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 100
 101         /*
 102          * Ensure there really is data left to send.
 103          */
 104
 105         if(!data_len_left) {
 106                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 107                 return False;
 108         }
 109
 110         /* Space available - not including padding. */
 111         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN -
 112                 RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 113
 114         /*
 115          * The amount we send is the minimum of the available
 116          * space and the amount left to send.
 117          */
 118
 119         data_len = MIN(data_len_left, data_space_available);
 120
 121         /* Work out any padding alignment requirements. */
 122         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 123                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 124                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 125                 DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 126                         ss_padding_len ));
 127                 /* If we're over filling the packet, we need to make space
 128                  * for the padding at the end of the data. */
 129                 if (data_len + ss_padding_len > data_space_available) {
 130                         data_len -= SERVER_NDR_PADDING_SIZE;
 131                 }
 132         }
 133
 134         /*
 135          * Set up the alloc hint. This should be the data left to
 136          * send.
 137          */
 138
 139         hdr_resp.alloc_hint = data_len_left;
 140
 141         /*
 142          * Work out if this PDU will be the last.
 143          */
 144         if (p->out_data.data_sent_length + data_len >=
 145                                         prs_offset(&p->out_data.rdata)) {
 146                 hdr_flags |= DCERPC_PFC_FLAG_LAST;
 147         }
 148
 149         /*
 150          * Init the parse struct to point at the outgoing
 151          * data.
 152          */
 153         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 154
 155         status = dcerpc_push_ncacn_packet_header(
 156                                 prs_get_mem_context(&p->out_data.frag),
 157                                 DCERPC_PKT_RESPONSE,
 158                                 hdr_flags,
 159                                 RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 160                                   data_len + ss_padding_len +
 161                                   RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE,
 162                                 NTLMSSP_SIG_SIZE,
 163                                 p->call_id,
 164                                 &hdr);
 165         if (!NT_STATUS_IS_OK(status)) {
 166                 DEBUG(0, ("Failed to marshall RPC Header.\n"));
 167                 prs_mem_free(&p->out_data.frag);
 168                 return False;
 169         }
 170
 171         /* Store the header in the data stream. */
 172         if (!prs_copy_data_in(&p->out_data.frag,
 173                                 (char *)hdr.data, hdr.length)) {
 174                 DEBUG(0, ("Out of memory.\n"));
 175                 prs_mem_free(&p->out_data.frag);
 176                 return False;
 177         }
 178
 179         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 180                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 181                 prs_mem_free(&p->out_data.frag);
 182                 return False;
 183         }
 184
 185         /* Copy the data into the PDU. */
 186
 187         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 188                                      p->out_data.data_sent_length, data_len)) {
 189                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 190                 prs_mem_free(&p->out_data.frag);
 191                 return False;
 192         }
 193
 194         /* Copy the sign/seal padding data. */
 195         if (ss_padding_len) {
 196                 char pad[SERVER_NDR_PADDING_SIZE];
 197
 198                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 199                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 200                                       ss_padding_len)) {
 201                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 202                                         (unsigned int)ss_padding_len));
 203                         prs_mem_free(&p->out_data.frag);
 204                         return False;
 205                 }
 206         }
 207
 208
 209         /* Now write out the auth header and null blob. */
 210         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 211                 auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 212         } else {
 213                 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 214         }
 215         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 216                 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 217         } else {
 218                 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 219         }
 220
 221         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 222
 223         if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 224                                 &p->out_data.frag, 0)) {
 225                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 226                 prs_mem_free(&p->out_data.frag);
 227                 return False;
 228         }
 229
 230         /* Generate the sign blob. */
 231
 232         frame = talloc_stackframe();
 233         switch (p->auth.auth_level) {
 234                 case DCERPC_AUTH_LEVEL_PRIVACY:
 235                         /* Data portion is encrypted. */
 236                         status = auth_ntlmssp_seal_packet(
 237                                 a, frame,
 238                                 (uint8_t *)prs_data_p(&p->out_data.frag)
 239                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 240                                 data_len + ss_padding_len,
 241                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 242                                 (size_t)prs_offset(&p->out_data.frag),
 243                                 &auth_blob);
 244                         if (!NT_STATUS_IS_OK(status)) {
 245                                 talloc_free(frame);
 246                                 prs_mem_free(&p->out_data.frag);
 247                                 return False;
 248                         }
 249                         break;
 250                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 251                         /* Data is signed. */
 252                         status = auth_ntlmssp_sign_packet(
 253                                 a, frame,
 254                                 (unsigned char *)prs_data_p(&p->out_data.frag)
 255                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 256                                 data_len + ss_padding_len,
 257                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 258                                 (size_t)prs_offset(&p->out_data.frag),
 259                                 &auth_blob);
 260                         if (!NT_STATUS_IS_OK(status)) {
 261                                 talloc_free(frame);
 262                                 prs_mem_free(&p->out_data.frag);
 263                                 return False;
 264                         }
 265                         break;
 266                 default:
 267                         talloc_free(frame);
 268                         prs_mem_free(&p->out_data.frag);
 269                         return False;
 270         }
 271
 272         /* Append the auth blob. */
 273         if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
 274                               NTLMSSP_SIG_SIZE)) {
 275                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 276                                 (unsigned int)NTLMSSP_SIG_SIZE));
 277                 talloc_free(frame);
 278                 prs_mem_free(&p->out_data.frag);
 279                 return False;
 280         }
 281         talloc_free(frame);
 282
 283         /*
 284          * Setup the counts for this PDU.
 285          */
 286
 287         p->out_data.data_sent_length += data_len;
 288         p->out_data.current_pdu_sent = 0;
 289
 290         return True;
 291 }
 292
 293 /*******************************************************************
 294  Generate the next PDU to be returned from the data in p->rdata.
 295  Return an schannel authenticated fragment.
 296  ********************************************************************/
 297
 298 static bool create_next_pdu_schannel(pipes_struct *p)
 299 {
 300         DATA_BLOB hdr;
 301         uint8_t hdr_flags;
 302         RPC_HDR_RESP hdr_resp;
 303         uint32 ss_padding_len = 0;
 304         uint32 data_len;
 305         uint32 data_space_available;
 306         uint32 data_len_left;
 307         uint32 data_pos;
 308         NTSTATUS status;
 309
 310         /*
 311          * If we're in the fault state, keep returning fault PDU's until
 312          * the pipe gets closed. JRA.
 313          */
 314
 315         if(p->fault_state) {
 316                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 317                 return True;
 318         }
 319
 320         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 321
 322         /* Set up rpc header flags. */
 323         if (p->out_data.data_sent_length == 0) {
 324                 hdr_flags = DCERPC_PFC_FLAG_FIRST;
 325         } else {
 326                 hdr_flags = 0;
 327         }
 328
 329         /*
 330          * Work out how much we can fit in a single PDU.
 331          */
 332
 333         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 334
 335         /*
 336          * Ensure there really is data left to send.
 337          */
 338
 339         if(!data_len_left) {
 340                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 341                 return False;
 342         }
 343
 344         /* Space available - not including padding. */
 345         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 346                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
 347                 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 348
 349         /*
 350          * The amount we send is the minimum of the available
 351          * space and the amount left to send.
 352          */
 353
 354         data_len = MIN(data_len_left, data_space_available);
 355
 356         /* Work out any padding alignment requirements. */
 357         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 358                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 359                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 360                 DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 361                         ss_padding_len ));
 362                 /* If we're over filling the packet, we need to make space
 363                  * for the padding at the end of the data. */
 364                 if (data_len + ss_padding_len > data_space_available) {
 365                         data_len -= SERVER_NDR_PADDING_SIZE;
 366                 }
 367         }
 368
 369         /*
 370          * Set up the alloc hint. This should be the data left to
 371          * send.
 372          */
 373
 374         hdr_resp.alloc_hint = data_len_left;
 375
 376         /*
 377          * Work out if this PDU will be the last.
 378          */
 379         if (p->out_data.data_sent_length + data_len >=
 380                                         prs_offset(&p->out_data.rdata)) {
 381                 hdr_flags |= DCERPC_PFC_FLAG_LAST;
 382         }
 383
 384         /*
 385          * Init the parse struct to point at the outgoing
 386          * data.
 387          */
 388         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 389
 390         status = dcerpc_push_ncacn_packet_header(
 391                                 prs_get_mem_context(&p->out_data.frag),
 392                                 DCERPC_PKT_RESPONSE,
 393                                 hdr_flags,
 394                                 RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 395                                   data_len + ss_padding_len +
 396                                   RPC_HDR_AUTH_LEN +
 397                                   RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 398                                 RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 399                                 p->call_id,
 400                                 &hdr);
 401         if (!NT_STATUS_IS_OK(status)) {
 402                 DEBUG(0, ("Failed to marshall RPC Header.\n"));
 403                 prs_mem_free(&p->out_data.frag);
 404                 return False;
 405         }
 406
 407         /* Store the header in the data stream. */
 408         if (!prs_copy_data_in(&p->out_data.frag,
 409                                 (char *)hdr.data, hdr.length)) {
 410                 DEBUG(0, ("Out of memory.\n"));
 411                 prs_mem_free(&p->out_data.frag);
 412                 return False;
 413         }
 414
 415         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 416                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 417                 prs_mem_free(&p->out_data.frag);
 418                 return False;
 419         }
 420
 421         /* Store the current offset. */
 422         data_pos = prs_offset(&p->out_data.frag);
 423
 424         /* Copy the data into the PDU. */
 425
 426         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 427                                      p->out_data.data_sent_length, data_len)) {
 428                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 429                 prs_mem_free(&p->out_data.frag);
 430                 return False;
 431         }
 432
 433         /* Copy the sign/seal padding data. */
 434         if (ss_padding_len) {
 435                 char pad[SERVER_NDR_PADDING_SIZE];
 436                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 437                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 438                                       ss_padding_len)) {
 439                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 440                         prs_mem_free(&p->out_data.frag);
 441                         return False;
 442                 }
 443         }
 444
 445         {
 446                 /*
 447                  * Schannel processing.
 448                  */
 449                 RPC_HDR_AUTH auth_info;
 450                 DATA_BLOB blob;
 451                 uint8_t *data;
 452
 453                 /* Check it's the type of reply we were expecting to decode */
 454
 455                 init_rpc_hdr_auth(&auth_info,
 456                                 DCERPC_AUTH_TYPE_SCHANNEL,
 457                                 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
 458                                         DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
 459                                 ss_padding_len, 1);
 460
 461                 if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 462                                         &p->out_data.frag, 0)) {
 463                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 464                         prs_mem_free(&p->out_data.frag);
 465                         return False;
 466                 }
 467
 468                 data = (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos;
 469
 470                 switch (p->auth.auth_level) {
 471                 case DCERPC_AUTH_LEVEL_PRIVACY:
 472                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 473                                                         talloc_tos(),
 474                                                         true,
 475                                                         data,
 476                                                         data_len + ss_padding_len,
 477                                                         &blob);
 478                         break;
 479                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 480                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 481                                                         talloc_tos(),
 482                                                         false,
 483                                                         data,
 484                                                         data_len + ss_padding_len,
 485                                                         &blob);
 486                         break;
 487                 default:
 488                         status = NT_STATUS_INTERNAL_ERROR;
 489                         break;
 490                 }
 491
 492                 if (!NT_STATUS_IS_OK(status)) {
 493                         DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
 494                                 nt_errstr(status)));
 495                         prs_mem_free(&p->out_data.frag);
 496                         return false;
 497                 }
 498
 499                 /* Finally marshall the blob. */
 500
 501                 if (DEBUGLEVEL >= 10) {
 502                         dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
 503                 }
 504
 505                 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
 506                         prs_mem_free(&p->out_data.frag);
 507                         return false;
 508                 }
 509         }
 510
 511         /*
 512          * Setup the counts for this PDU.
 513          */
 514
 515         p->out_data.data_sent_length += data_len;
 516         p->out_data.current_pdu_sent = 0;
 517
 518         return True;
 519 }
 520
 521 /*******************************************************************
 522  Generate the next PDU to be returned from the data in p->rdata.
 523  No authentication done.
 524 ********************************************************************/
 525
 526 static bool create_next_pdu_noauth(pipes_struct *p)
 527 {
 528         DATA_BLOB hdr;
 529         uint8_t hdr_flags;
 530         NTSTATUS status;
 531         RPC_HDR_RESP hdr_resp;
 532         uint32 data_len;
 533         uint32 data_space_available;
 534         uint32 data_len_left;
 535
 536         /*
 537          * If we're in the fault state, keep returning fault PDU's until
 538          * the pipe gets closed. JRA.
 539          */
 540
 541         if(p->fault_state) {
 542                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 543                 return True;
 544         }
 545
 546         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 547
 548         /* Set up rpc header flags. */
 549         if (p->out_data.data_sent_length == 0) {
 550                 hdr_flags = DCERPC_PFC_FLAG_FIRST;
 551         } else {
 552                 hdr_flags = 0;
 553         }
 554
 555         /*
 556          * Work out how much we can fit in a single PDU.
 557          */
 558
 559         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 560
 561         /*
 562          * Ensure there really is data left to send.
 563          */
 564
 565         if(!data_len_left) {
 566                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 567                 return False;
 568         }
 569
 570         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 571                 - RPC_HDR_RESP_LEN;
 572
 573         /*
 574          * The amount we send is the minimum of the available
 575          * space and the amount left to send.
 576          */
 577
 578         data_len = MIN(data_len_left, data_space_available);
 579
 580         /*
 581          * Set up the alloc hint. This should be the data left to
 582          * send.
 583          */
 584
 585         hdr_resp.alloc_hint = data_len_left;
 586
 587         /*
 588          * Work out if this PDU will be the last.
 589          */
 590         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 591                 hdr_flags |= DCERPC_PFC_FLAG_LAST;
 592         }
 593
 594         /*
 595          * Init the parse struct to point at the outgoing
 596          * data.
 597          */
 598         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 599
 600         status = dcerpc_push_ncacn_packet_header(
 601                                 prs_get_mem_context(&p->out_data.frag),
 602                                 DCERPC_PKT_RESPONSE,
 603                                 hdr_flags,
 604                                 RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len,
 605                                 0,
 606                                 p->call_id,
 607                                 &hdr);
 608         if (!NT_STATUS_IS_OK(status)) {
 609                 DEBUG(0, ("Failed to marshall RPC Header.\n"));
 610                 prs_mem_free(&p->out_data.frag);
 611                 return False;
 612         }
 613
 614         /* Store the header in the data stream. */
 615         if (!prs_copy_data_in(&p->out_data.frag,
 616                                 (char *)hdr.data, hdr.length)) {
 617                 DEBUG(0, ("Out of memory.\n"));
 618                 prs_mem_free(&p->out_data.frag);
 619                 return False;
 620         }
 621
 622         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 623                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 624                 prs_mem_free(&p->out_data.frag);
 625                 return False;
 626         }
 627
 628         /* Copy the data into the PDU. */
 629
 630         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 631                                      p->out_data.data_sent_length, data_len)) {
 632                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 633                 prs_mem_free(&p->out_data.frag);
 634                 return False;
 635         }
 636
 637         /*
 638          * Setup the counts for this PDU.
 639          */
 640
 641         p->out_data.data_sent_length += data_len;
 642         p->out_data.current_pdu_sent = 0;
 643
 644         return True;
 645 }
 646
 647 /*******************************************************************
 648  Generate the next PDU to be returned from the data in p->rdata.
 649 ********************************************************************/
 650
 651 bool create_next_pdu(pipes_struct *p)
 652 {
 653         switch(p->auth.auth_level) {
 654                 case DCERPC_AUTH_LEVEL_NONE:
 655                 case DCERPC_AUTH_LEVEL_CONNECT:
 656                         /* This is incorrect for auth level connect. Fixme. JRA */
 657                         return create_next_pdu_noauth(p);
 658
 659                 default:
 660                         switch(p->auth.auth_type) {
 661                                 case PIPE_AUTH_TYPE_NTLMSSP:
 662                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 663                                         return create_next_pdu_ntlmssp(p);
 664                                 case PIPE_AUTH_TYPE_SCHANNEL:
 665                                         return create_next_pdu_schannel(p);
 666                                 default:
 667                                         break;
 668                         }
 669         }
 670
 671         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 672                         (unsigned int)p->auth.auth_level,
 673                         (unsigned int)p->auth.auth_type));
 674         return False;
 675 }
 676
 677 /*******************************************************************
 678  Process an NTLMSSP authentication response.
 679  If this function succeeds, the user has been authenticated
 680  and their domain, name and calling workstation stored in
 681  the pipe struct.
 682 *******************************************************************/
 683
 684 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 685 {
 686         DATA_BLOB session_key, reply;
 687         NTSTATUS status;
 688         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
 689         bool ret;
 690
 691         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
 692                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 693
 694         ZERO_STRUCT(reply);
 695
 696         /* this has to be done as root in order to verify the password */
 697         become_root();
 698         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 699         unbecome_root();
 700
 701         /* Don't generate a reply. */
 702         data_blob_free(&reply);
 703
 704         if (!NT_STATUS_IS_OK(status)) {
 705                 return False;
 706         }
 707
 708         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 709            ensure the underlying NTLMSSP flags are also set. If not we should
 710            refuse the bind. */
 711
 712         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
 713                 if (!auth_ntlmssp_negotiated_sign(a)) {
 714                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 715                                 "but client declined signing.\n",
 716                                  get_pipe_name_from_syntax(talloc_tos(),
 717                                                            &p->syntax)));
 718                         return False;
 719                 }
 720         }
 721         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 722                 if (!auth_ntlmssp_negotiated_seal(a)) {
 723                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 724                                 "but client declined sealing.\n",
 725                                  get_pipe_name_from_syntax(talloc_tos(),
 726                                                            &p->syntax)));
 727                         return False;
 728                 }
 729         }
 730
 731         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 732                   "workstation: %s\n",
 733                   auth_ntlmssp_get_username(a),
 734                   auth_ntlmssp_get_domain(a),
 735                   auth_ntlmssp_get_client(a)));
 736
 737         TALLOC_FREE(p->server_info);
 738
 739         p->server_info = auth_ntlmssp_server_info(p, a);
 740         if (p->server_info == NULL) {
 741                 DEBUG(0, ("auth_ntlmssp_server_info failed to obtain the server info for authenticated user\n"));
 742                 return false;
 743         }
 744
 745         if (p->server_info->ptok == NULL) {
 746                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 747                 return False;
 748         }
 749
 750         /*
 751          * We're an authenticated bind over smb, so the session key needs to
 752          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 753          * does. See the RPC-SAMBA3SESSIONKEY.
 754          */
 755
 756         session_key = generic_session_key();
 757         if (session_key.data == NULL) {
 758                 return False;
 759         }
 760
 761         ret = server_info_set_session_key(p->server_info, session_key);
 762
 763         data_blob_free(&session_key);
 764
 765         return True;
 766 }
 767
 768 /*******************************************************************
 769  This is the "stage3" NTLMSSP response after a bind request and reply.
 770 *******************************************************************/
 771
 772 bool api_pipe_bind_auth3(pipes_struct *p, struct ncacn_packet *pkt)
 773 {
 774         struct dcerpc_auth auth_info;
 775         uint32_t auth_len = pkt->auth_length;
 776         NTSTATUS status;
 777
 778         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 779
 780         if (auth_len == 0) {
 781                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 782                 goto err;
 783         }
 784
 785         /* Ensure there's enough data for an authenticated request. */
 786         if (RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + auth_len >
 787                                 pkt->frag_length) {
 788                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
 789                                 "%u is too large.\n",
 790                         (unsigned int)auth_len ));
 791                 goto err;
 792         }
 793
 794         /*
 795          * Decode the authentication verifier response.
 796          */
 797
 798         status = dcerpc_pull_dcerpc_auth(pkt,
 799                                          &pkt->u.auth3.auth_info,
 800                                          &auth_info);
 801         if (!NT_STATUS_IS_OK(status)) {
 802                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
 803                 goto err;
 804         }
 805
 806         /* We must NEVER look at auth_info->auth_pad_len here,
 807          * as old Samba client code gets it wrong and sends it
 808          * as zero. JRA.
 809          */
 810
 811         if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
 812                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 813                         (unsigned int)auth_info.auth_type ));
 814                 return False;
 815         }
 816
 817         /*
 818          * The following call actually checks the challenge/response data.
 819          * for correctness against the given DOMAIN\user name.
 820          */
 821
 822         if (!pipe_ntlmssp_verify_final(p, &auth_info.credentials)) {
 823                 goto err;
 824         }
 825
 826         p->pipe_bound = True;
 827
 828         return True;
 829
 830  err:
 831
 832         free_pipe_ntlmssp_auth_data(&p->auth);
 833         p->auth.a_u.auth_ntlmssp_state = NULL;
 834
 835         return False;
 836 }
 837
 838 /*******************************************************************
 839  Marshall a bind_nak pdu.
 840 *******************************************************************/
 841
 842 static bool setup_bind_nak(pipes_struct *p, struct ncacn_packet *pkt)
 843 {
 844         NTSTATUS status;
 845         union dcerpc_payload u;
 846         DATA_BLOB blob;
 847
 848         /* Free any memory in the current return data buffer. */
 849         prs_mem_free(&p->out_data.rdata);
 850
 851         /*
 852          * Marshall directly into the outgoing PDU space. We
 853          * must do this as we need to set to the bind response
 854          * header and are never sending more than one PDU here.
 855          */
 856
 857         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 858
 859         /*
 860          * Initialize a bind_nak header.
 861          */
 862
 863         ZERO_STRUCT(u);
 864
 865         u.bind_nak.reject_reason  = 0;
 866
 867         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 868                                           DCERPC_PKT_BIND_NAK,
 869                                           DCERPC_PFC_FLAG_FIRST |
 870                                                 DCERPC_PFC_FLAG_LAST,
 871                                           0,
 872                                           pkt->call_id,
 873                                           &u,
 874                                           &blob);
 875         if (!NT_STATUS_IS_OK(status)) {
 876                 prs_mem_free(&p->out_data.frag);
 877                 return False;
 878         }
 879
 880         if (!prs_copy_data_in(&p->out_data.frag,
 881                               (char *)blob.data, blob.length)) {
 882                 prs_mem_free(&p->out_data.frag);
 883                 return False;
 884         }
 885
 886         p->out_data.data_sent_length = 0;
 887         p->out_data.current_pdu_sent = 0;
 888
 889         if (p->auth.auth_data_free_func) {
 890                 (*p->auth.auth_data_free_func)(&p->auth);
 891         }
 892         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 893         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 894         p->pipe_bound = False;
 895
 896         return True;
 897 }
 898
 899 /*******************************************************************
 900  Marshall a fault pdu.
 901 *******************************************************************/
 902
 903 bool setup_fault_pdu(pipes_struct *p, NTSTATUS fault_status)
 904 {
 905         NTSTATUS status;
 906         union dcerpc_payload u;
 907         DATA_BLOB blob;
 908
 909         /* Free any memory in the current return data buffer. */
 910         prs_mem_free(&p->out_data.rdata);
 911
 912         /*
 913          * Marshall directly into the outgoing PDU space. We
 914          * must do this as we need to set to the bind response
 915          * header and are never sending more than one PDU here.
 916          */
 917
 918         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 919
 920         /*
 921          * Initialize a fault header.
 922          */
 923
 924         ZERO_STRUCT(u);
 925
 926         u.fault.status          = NT_STATUS_V(fault_status);
 927         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 928
 929         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 930                                           DCERPC_PKT_FAULT,
 931                                           DCERPC_PFC_FLAG_FIRST |
 932                                            DCERPC_PFC_FLAG_LAST |
 933                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 934                                           0,
 935                                           p->call_id,
 936                                           &u,
 937                                           &blob);
 938         if (!NT_STATUS_IS_OK(status)) {
 939                 prs_mem_free(&p->out_data.frag);
 940                 return False;
 941         }
 942
 943         if (!prs_copy_data_in(&p->out_data.frag,
 944                               (char *)blob.data, blob.length)) {
 945                 prs_mem_free(&p->out_data.frag);
 946                 return False;
 947         }
 948
 949         p->out_data.data_sent_length = 0;
 950         p->out_data.current_pdu_sent = 0;
 951
 952         return True;
 953 }
 954
 955 /*******************************************************************
 956  Ensure a bind request has the correct abstract & transfer interface.
 957  Used to reject unknown binds from Win2k.
 958 *******************************************************************/
 959
 960 static bool check_bind_req(struct pipes_struct *p,
 961                            struct ndr_syntax_id* abstract,
 962                            struct ndr_syntax_id* transfer,
 963                            uint32 context_id)
 964 {
 965         struct pipe_rpc_fns *context_fns;
 966
 967         DEBUG(3,("check_bind_req for %s\n",
 968                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 969
 970         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 971         if (rpc_srv_pipe_exists_by_id(abstract) &&
 972            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 973                 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 974                         rpc_srv_get_pipe_cli_name(abstract),
 975                         rpc_srv_get_pipe_srv_name(abstract)));
 976         } else {
 977                 return false;
 978         }
 979
 980         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 981         if (context_fns == NULL) {
 982                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 983                 return False;
 984         }
 985
 986         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 987         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 988         context_fns->context_id = context_id;
 989
 990         /* add to the list of open contexts */
 991
 992         DLIST_ADD( p->contexts, context_fns );
 993
 994         return True;
 995 }
 996
 997 /**
 998  * Is a named pipe known?
 999  * @param[in] cli_filename      The pipe name requested by the client
1000  * @result                      Do we want to serve this?
1001  */
1002 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1003 {
1004         const char *pipename = cli_filename;
1005         NTSTATUS status;
1006
1007         if (strnequal(pipename, "\\PIPE\\", 6)) {
1008                 pipename += 5;
1009         }
1010
1011         if (*pipename == '\\') {
1012                 pipename += 1;
1013         }
1014
1015         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1016                 DEBUG(10, ("refusing spoolss access\n"));
1017                 return false;
1018         }
1019
1020         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1021                 return true;
1022         }
1023
1024         status = smb_probe_module("rpc", pipename);
1025         if (!NT_STATUS_IS_OK(status)) {
1026                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1027                 return false;
1028         }
1029         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
1030
1031         /*
1032          * Scan the list again for the interface id
1033          */
1034         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1035                 return true;
1036         }
1037
1038         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
1039                    pipename));
1040
1041         return false;
1042 }
1043
1044 /*******************************************************************
1045  Handle a SPNEGO krb5 bind auth.
1046 *******************************************************************/
1047
1048 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p,
1049                                            struct dcerpc_auth *pauth_info,
1050                                            DATA_BLOB *psecblob,
1051                                            prs_struct *pout_auth)
1052 {
1053         return False;
1054 }
1055
1056 /*******************************************************************
1057  Handle the first part of a SPNEGO bind auth.
1058 *******************************************************************/
1059
1060 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p,
1061                                             uint32_t ss_padding_len,
1062                                             struct dcerpc_auth *pauth_info,
1063                                             prs_struct *pout_auth)
1064 {
1065         DATA_BLOB blob;
1066         DATA_BLOB secblob;
1067         DATA_BLOB response;
1068         DATA_BLOB chal;
1069         char *OIDs[ASN1_MAX_OIDS];
1070         int i;
1071         NTSTATUS status;
1072         bool got_kerberos_mechanism = false;
1073         struct auth_ntlmssp_state *a = NULL;
1074
1075         ZERO_STRUCT(secblob);
1076         ZERO_STRUCT(chal);
1077         ZERO_STRUCT(response);
1078
1079         if (pauth_info->credentials.data[0] != ASN1_APPLICATION(0)) {
1080                 goto err;
1081         }
1082
1083         /* parse out the OIDs and the first sec blob */
1084         if (!parse_negTokenTarg(pauth_info->credentials, OIDs, &secblob)) {
1085                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1086                 goto err;
1087         }
1088
1089         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1090                 got_kerberos_mechanism = true;
1091         }
1092
1093         for (i=0;OIDs[i];i++) {
1094                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1095                 TALLOC_FREE(OIDs[i]);
1096         }
1097         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1098
1099         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1100                 bool ret;
1101                 ret = pipe_spnego_auth_bind_kerberos(p, pauth_info,
1102                                                      &secblob, pout_auth);
1103                 data_blob_free(&secblob);
1104                 return ret;
1105         }
1106
1107         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1108                 /* Free any previous auth type. */
1109                 free_pipe_ntlmssp_auth_data(&p->auth);
1110         }
1111
1112         if (!got_kerberos_mechanism) {
1113                 /* Initialize the NTLM engine. */
1114                 status = auth_ntlmssp_start(&a);
1115                 if (!NT_STATUS_IS_OK(status)) {
1116                         goto err;
1117                 }
1118
1119                 switch (pauth_info->auth_level) {
1120                         case DCERPC_AUTH_LEVEL_INTEGRITY:
1121                                 auth_ntlmssp_want_sign(a);
1122                                 break;
1123                         case DCERPC_AUTH_LEVEL_PRIVACY:
1124                                 auth_ntlmssp_want_seal(a);
1125                                 break;
1126                         default:
1127                                 break;
1128                 }
1129                 /*
1130                  * Pass the first security blob of data to it.
1131                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1132                  * which means we need another packet to complete the bind.
1133                  */
1134
1135                 status = auth_ntlmssp_update(a, secblob, &chal);
1136
1137                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1138                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1139                         goto err;
1140                 }
1141
1142                 /* Generate the response blob we need for step 2 of the bind. */
1143                 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1144         } else {
1145                 /*
1146                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1147                  * code to process follow-up packets is not complete
1148                  * yet. JRA.
1149                  */
1150                 response = spnego_gen_auth_response(NULL,
1151                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1152                                         OID_NTLMSSP);
1153         }
1154
1155         /* auth_pad_len will be handled by the caller */
1156
1157         status = dcerpc_push_dcerpc_auth(prs_get_mem_context(pout_auth),
1158                                          DCERPC_AUTH_TYPE_SPNEGO,
1159                                          pauth_info->auth_level,
1160                                          ss_padding_len,
1161                                          1, /* auth_context_id */
1162                                          &response,
1163                                          &blob);
1164         if (!NT_STATUS_IS_OK(status)) {
1165                 DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1166                 goto err;
1167         }
1168
1169         /* Copy the blob into the pout_auth parse struct */
1170         if (!prs_copy_data_in(pout_auth, (char *)blob.data, blob.length)) {
1171                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1172                 goto err;
1173         }
1174
1175         p->auth.a_u.auth_ntlmssp_state = a;
1176         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1177         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1178
1179         data_blob_free(&secblob);
1180         data_blob_free(&chal);
1181         data_blob_free(&response);
1182
1183         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1184         return True;
1185
1186  err:
1187
1188         data_blob_free(&secblob);
1189         data_blob_free(&chal);
1190         data_blob_free(&response);
1191
1192         p->auth.a_u.auth_ntlmssp_state = NULL;
1193
1194         return False;
1195 }
1196
1197 /*******************************************************************
1198  Handle the second part of a SPNEGO bind auth.
1199 *******************************************************************/
1200
1201 static bool pipe_spnego_auth_bind_continue(pipes_struct *p,
1202                                            uint32_t ss_padding_len,
1203                                            struct dcerpc_auth *pauth_info,
1204                                            prs_struct *pout_auth)
1205 {
1206         RPC_HDR_AUTH auth_info;
1207         DATA_BLOB auth_blob;
1208         DATA_BLOB auth_reply;
1209         DATA_BLOB response;
1210         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
1211
1212         ZERO_STRUCT(auth_blob);
1213         ZERO_STRUCT(auth_reply);
1214         ZERO_STRUCT(response);
1215
1216         /*
1217          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1218          * fail here as 'a' == NULL.
1219          */
1220         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1221                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1222                 goto err;
1223         }
1224
1225         if (pauth_info->credentials.data[0] != ASN1_CONTEXT(1)) {
1226                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1227                 goto err;
1228         }
1229
1230         if (!spnego_parse_auth(pauth_info->credentials, &auth_blob)) {
1231                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1232                 goto err;
1233         }
1234
1235         /*
1236          * The following call actually checks the challenge/response data.
1237          * for correctness against the given DOMAIN\user name.
1238          */
1239
1240         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1241                 goto err;
1242         }
1243
1244         data_blob_free(&auth_blob);
1245
1246         /* Generate the spnego "accept completed" blob - no incoming data. */
1247         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1248
1249         /* FIXME - add auth_pad_len here ! */
1250
1251         /* Copy the blob into the pout_auth parse struct */
1252         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1253                         pauth_info->auth_level, ss_padding_len, 1);
1254         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1255                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1256                 goto err;
1257         }
1258
1259         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1260                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1261                 goto err;
1262         }
1263
1264         data_blob_free(&auth_reply);
1265         data_blob_free(&response);
1266
1267         p->pipe_bound = True;
1268
1269         return True;
1270
1271  err:
1272
1273         data_blob_free(&auth_blob);
1274         data_blob_free(&auth_reply);
1275         data_blob_free(&response);
1276
1277         free_pipe_ntlmssp_auth_data(&p->auth);
1278         p->auth.a_u.auth_ntlmssp_state = NULL;
1279
1280         return False;
1281 }
1282
1283 /*******************************************************************
1284  Handle an schannel bind auth.
1285 *******************************************************************/
1286
1287 static bool pipe_schannel_auth_bind(pipes_struct *p,
1288                                         uint32_t ss_padding_len,
1289                                         struct dcerpc_auth *auth_info,
1290                                         prs_struct *pout_auth)
1291 {
1292         DATA_BLOB auth_blob;
1293         struct NL_AUTH_MESSAGE neg;
1294         struct NL_AUTH_MESSAGE reply;
1295         bool ret;
1296         NTSTATUS status;
1297         struct netlogon_creds_CredentialState *creds;
1298         DATA_BLOB session_key;
1299         enum ndr_err_code ndr_err;
1300         DATA_BLOB blob;
1301
1302         ndr_err = ndr_pull_struct_blob(
1303                         &auth_info->credentials,
1304                         prs_get_mem_context(pout_auth), &neg,
1305                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1306         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1307                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1308                 return false;
1309         }
1310
1311         if (DEBUGLEVEL >= 10) {
1312                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1313         }
1314
1315         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1316                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1317                 return false;
1318         }
1319
1320         /*
1321          * The neg.oem_netbios_computer.a key here must match the remote computer name
1322          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1323          * operations that use credentials.
1324          */
1325
1326         become_root();
1327         status = schannel_get_creds_state(p, lp_private_dir(),
1328                                             neg.oem_netbios_computer.a, &creds);
1329         unbecome_root();
1330
1331         if (!NT_STATUS_IS_OK(status)) {
1332                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1333                 return False;
1334         }
1335
1336         p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1337         if (!p->auth.a_u.schannel_auth) {
1338                 TALLOC_FREE(creds);
1339                 return False;
1340         }
1341
1342         p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1343         p->auth.a_u.schannel_auth->seq_num = 0;
1344         p->auth.a_u.schannel_auth->initiator = false;
1345         p->auth.a_u.schannel_auth->creds = creds;
1346
1347         /*
1348          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1349          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1350          * struct of the person who opened the pipe. I need to test this further. JRA.
1351          *
1352          * VL. As we are mapping this to guest set the generic key
1353          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1354          * W2k3, as it does not allow schannel binds against SAMR and LSA
1355          * anymore.
1356          */
1357
1358         session_key = generic_session_key();
1359         if (session_key.data == NULL) {
1360                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1361                           " key\n"));
1362                 return false;
1363         }
1364
1365         ret = server_info_set_session_key(p->server_info, session_key);
1366
1367         data_blob_free(&session_key);
1368
1369         if (!ret) {
1370                 DEBUG(0, ("server_info_set_session_key failed\n"));
1371                 return false;
1372         }
1373
1374         /*** SCHANNEL verifier ***/
1375
1376         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
1377         reply.Flags                             = 0;
1378         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
1379                                                       * this has any meaning
1380                                                       * here - gd */
1381
1382         ndr_err = ndr_push_struct_blob(&auth_blob, talloc_tos(), &reply,
1383                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1384         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1385                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1386                 return false;
1387         }
1388
1389         if (DEBUGLEVEL >= 10) {
1390                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1391         }
1392
1393         status = dcerpc_push_dcerpc_auth(prs_get_mem_context(pout_auth),
1394                                          DCERPC_AUTH_TYPE_SCHANNEL,
1395                                          auth_info->auth_level,
1396                                          ss_padding_len,
1397                                          1, /* auth_context_id */
1398                                          &auth_blob,
1399                                          &blob);
1400         if (!NT_STATUS_IS_OK(status)) {
1401                 DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1402                 return False;
1403         }
1404
1405         if (!prs_copy_data_in(pout_auth, (const char *)blob.data, blob.length)) {
1406                 return false;
1407         }
1408
1409         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1410                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1411
1412         /* We're finished with this bind - no more packets. */
1413         p->auth.auth_data_free_func = NULL;
1414         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1415
1416         p->pipe_bound = True;
1417
1418         return True;
1419 }
1420
1421 /*******************************************************************
1422  Handle an NTLMSSP bind auth.
1423 *******************************************************************/
1424
1425 static bool pipe_ntlmssp_auth_bind(pipes_struct *p,
1426                                         uint32_t ss_padding_len,
1427                                         struct dcerpc_auth *auth_info,
1428                                         prs_struct *pout_auth)
1429 {
1430         DATA_BLOB blob;
1431         DATA_BLOB response;
1432         NTSTATUS status;
1433         struct auth_ntlmssp_state *a = NULL;
1434
1435         ZERO_STRUCT(response);
1436
1437         if (strncmp((char *)auth_info->credentials.data, "NTLMSSP", 7) != 0) {
1438                 DEBUG(0, ("Failed to read NTLMSSP in blob\n"));
1439                 goto err;
1440         }
1441
1442         /* We have an NTLMSSP blob. */
1443         status = auth_ntlmssp_start(&a);
1444         if (!NT_STATUS_IS_OK(status)) {
1445                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1446                         nt_errstr(status) ));
1447                 goto err;
1448         }
1449
1450         switch (auth_info->auth_level) {
1451         case DCERPC_AUTH_LEVEL_INTEGRITY:
1452                 auth_ntlmssp_want_sign(a);
1453                 break;
1454         case DCERPC_AUTH_LEVEL_PRIVACY:
1455                 auth_ntlmssp_want_seal(a);
1456                 break;
1457         default:
1458                 break;
1459         }
1460
1461         status = auth_ntlmssp_update(a, auth_info->credentials, &response);
1462         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1463                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1464                         nt_errstr(status) ));
1465                 goto err;
1466         }
1467
1468         status = dcerpc_push_dcerpc_auth(prs_get_mem_context(pout_auth),
1469                                          DCERPC_AUTH_TYPE_NTLMSSP,
1470                                          auth_info->auth_level,
1471                                          ss_padding_len,
1472                                          1, /* auth_context_id */
1473                                          &response,
1474                                          &blob);
1475         if (!NT_STATUS_IS_OK(status)) {
1476                 DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1477                 goto err;
1478         }
1479
1480         /* Copy the blob into the pout_auth parse struct */
1481         if (!prs_copy_data_in(pout_auth, (char *)blob.data, blob.length)) {
1482                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1483                 goto err;
1484         }
1485
1486         p->auth.a_u.auth_ntlmssp_state = a;
1487         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1488         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1489
1490         data_blob_free(&response);
1491
1492         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1493
1494         /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1495         return True;
1496
1497   err:
1498
1499         data_blob_free(&response);
1500
1501         free_pipe_ntlmssp_auth_data(&p->auth);
1502         p->auth.a_u.auth_ntlmssp_state = NULL;
1503         return False;
1504 }
1505
1506 /*******************************************************************
1507  Respond to a pipe bind request.
1508 *******************************************************************/
1509
1510 bool api_pipe_bind_req(pipes_struct *p, struct ncacn_packet *pkt)
1511 {
1512         RPC_HDR hdr;
1513         RPC_HDR_BA hdr_ba;
1514         struct dcerpc_auth auth_info;
1515         uint16 assoc_gid;
1516         fstring ack_pipe_name;
1517         prs_struct out_hdr_ba;
1518         prs_struct out_auth;
1519         int auth_len = 0;
1520         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1521         uint32_t ss_padding_len = 0;
1522         NTSTATUS status;
1523         struct ndr_syntax_id id;
1524
1525         /* No rebinds on a bound pipe - use alter context. */
1526         if (p->pipe_bound) {
1527                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1528                          "pipe %s.\n",
1529                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1530                 return setup_bind_nak(p, pkt);
1531         }
1532
1533         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1534
1535         /*
1536          * Marshall directly into the outgoing PDU space. We
1537          * must do this as we need to set to the bind response
1538          * header and are never sending more than one PDU here.
1539          */
1540
1541         /*
1542          * Setup the memory to marshall the ba header, and the
1543          * auth footers.
1544          */
1545
1546         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1547                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1548                 prs_mem_free(&p->out_data.frag);
1549                 return False;
1550         }
1551
1552         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1553                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1554                 prs_mem_free(&p->out_data.frag);
1555                 prs_mem_free(&out_hdr_ba);
1556                 return False;
1557         }
1558
1559         if (pkt->u.bind.num_contexts == 0) {
1560                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1561                 goto err_exit;
1562         }
1563
1564         /*
1565          * Try and find the correct pipe name to ensure
1566          * that this is a pipe name we support.
1567          */
1568         id = pkt->u.bind.ctx_list[0].abstract_syntax;
1569         if (rpc_srv_pipe_exists_by_id(&id)) {
1570                 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1571                         rpc_srv_get_pipe_cli_name(&id),
1572                         rpc_srv_get_pipe_srv_name(&id)));
1573         } else {
1574                 status = smb_probe_module(
1575                         "rpc", get_pipe_name_from_syntax(
1576                                 talloc_tos(),
1577                                 &pkt->u.bind.ctx_list[0].abstract_syntax));
1578
1579                 if (NT_STATUS_IS_ERR(status)) {
1580                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1581                                 get_pipe_name_from_syntax(
1582                                         talloc_tos(),
1583                                         &pkt->u.bind.ctx_list[0].abstract_syntax)));
1584                         prs_mem_free(&p->out_data.frag);
1585                         prs_mem_free(&out_hdr_ba);
1586                         prs_mem_free(&out_auth);
1587
1588                         return setup_bind_nak(p, pkt);
1589                 }
1590
1591                 if (rpc_srv_get_pipe_interface_by_cli_name(
1592                                 get_pipe_name_from_syntax(talloc_tos(),
1593                                                           &p->syntax),
1594                                 &id)) {
1595                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1596                                 rpc_srv_get_pipe_cli_name(&id),
1597                                 rpc_srv_get_pipe_srv_name(&id)));
1598                 } else {
1599                         DEBUG(0, ("module %s doesn't provide functions for "
1600                                   "pipe %s!\n",
1601                                   get_pipe_name_from_syntax(talloc_tos(),
1602                                                             &p->syntax),
1603                                   get_pipe_name_from_syntax(talloc_tos(),
1604                                                             &p->syntax)));
1605                         goto err_exit;
1606                 }
1607         }
1608
1609         /* name has to be \PIPE\xxxxx */
1610         fstrcpy(ack_pipe_name, "\\PIPE\\");
1611         fstrcat(ack_pipe_name, rpc_srv_get_pipe_srv_name(&id));
1612
1613         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1614
1615         if (pkt->u.bind.assoc_group_id != 0) {
1616                 assoc_gid = pkt->u.bind.assoc_group_id;
1617         } else {
1618                 assoc_gid = 0x53f0;
1619         }
1620
1621
1622         /*
1623          * Create the bind response struct.
1624          */
1625
1626         /* If the requested abstract synt uuid doesn't match our client pipe,
1627                 reject the bind_ack & set the transfer interface synt to all 0's,
1628                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1629                 unknown to NT4)
1630                 Needed when adding entries to a DACL from NT5 - SK */
1631
1632         if (check_bind_req(p,
1633                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1634                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1635                         pkt->u.bind.ctx_list[0].context_id)) {
1636                 init_rpc_hdr_ba(&hdr_ba,
1637                         RPC_MAX_PDU_FRAG_LEN,
1638                         RPC_MAX_PDU_FRAG_LEN,
1639                         assoc_gid,
1640                         ack_pipe_name,
1641                         0x1, 0x0, 0x0,
1642                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0]);
1643         } else {
1644                 /* Rejection reason: abstract syntax not supported */
1645                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1646                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1647                                         ack_pipe_name, 0x1, 0x2, 0x1,
1648                                         &null_ndr_syntax_id);
1649                 p->pipe_bound = False;
1650         }
1651
1652         /*
1653          * and marshall it.
1654          */
1655
1656         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1657                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1658                 goto err_exit;
1659         }
1660
1661         /*
1662          * Check if this is an authenticated bind request.
1663          */
1664
1665         if (pkt->auth_length) {
1666                 /*
1667                  * Decode the authentication verifier.
1668                  */
1669
1670                 /* Work out any padding needed before the auth footer. */
1671                 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
1672                         ss_padding_len = SERVER_NDR_PADDING_SIZE -
1673                                 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
1674                         DEBUG(10,("api_pipe_bind_req: auth pad_len = %u\n",
1675                                 (unsigned int)ss_padding_len ));
1676                 }
1677
1678                 /* Quick length check. Won't catch a bad auth footer,
1679                  * prevents overrun. */
1680
1681                 if (pkt->frag_length < RPC_HEADER_LEN +
1682                                         RPC_HDR_AUTH_LEN +
1683                                         pkt->auth_length) {
1684                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
1685                                 "too long for fragment %u.\n",
1686                                 (unsigned int)pkt->auth_length,
1687                                 (unsigned int)pkt->frag_length));
1688                         goto err_exit;
1689                 }
1690
1691                 status = dcerpc_pull_dcerpc_auth(pkt,
1692                                                  &pkt->u.bind.auth_info,
1693                                                  &auth_info);
1694                 if (!NT_STATUS_IS_OK(status)) {
1695                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1696                         goto err_exit;
1697                 }
1698
1699                 auth_type = auth_info.auth_type;
1700
1701                 /* Work out if we have to sign or seal etc. */
1702                 switch (auth_info.auth_level) {
1703                 case DCERPC_AUTH_LEVEL_INTEGRITY:
1704                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1705                         break;
1706                 case DCERPC_AUTH_LEVEL_PRIVACY:
1707                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1708                         break;
1709                 default:
1710                         DEBUG(0, ("Unexpected auth level (%u).\n",
1711                                 (unsigned int)auth_info.auth_level ));
1712                         goto err_exit;
1713                 }
1714         } else {
1715                 ZERO_STRUCT(auth_info);
1716         }
1717
1718         switch(auth_type) {
1719                 case DCERPC_AUTH_TYPE_NTLMSSP:
1720                         if (!pipe_ntlmssp_auth_bind(p, ss_padding_len,
1721                                                     &auth_info, &out_auth)) {
1722                                 goto err_exit;
1723                         }
1724                         assoc_gid = 0x7a77;
1725                         break;
1726
1727                 case DCERPC_AUTH_TYPE_SCHANNEL:
1728                         if (!pipe_schannel_auth_bind(p, ss_padding_len,
1729                                                     &auth_info, &out_auth)) {
1730                                 goto err_exit;
1731                         }
1732                         break;
1733
1734                 case DCERPC_AUTH_TYPE_SPNEGO:
1735                         if (!pipe_spnego_auth_bind_negotiate(p,
1736                                                     ss_padding_len,
1737                                                     &auth_info, &out_auth)) {
1738                                 goto err_exit;
1739                         }
1740                         break;
1741
1742                 case DCERPC_AUTH_TYPE_NONE:
1743                         /* Unauthenticated bind request. */
1744                         /* We're finished - no more packets. */
1745                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1746                         /* We must set the pipe auth_level here also. */
1747                         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1748                         p->pipe_bound = True;
1749                         /* The session key was initialized from the SMB
1750                          * session in make_internal_rpc_pipe_p */
1751                         ss_padding_len = 0;
1752                         break;
1753
1754                 default:
1755                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1756                         goto err_exit;
1757         }
1758         /*
1759          * Create the header, now we know the length.
1760          */
1761
1762         if (prs_offset(&out_auth)) {
1763                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1764         }
1765
1766         init_rpc_hdr(&hdr,
1767                         DCERPC_PKT_BIND_ACK,
1768                         DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1769                         pkt->call_id,
1770                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) +
1771                                 ss_padding_len + prs_offset(&out_auth),
1772                         auth_len);
1773
1774         /*
1775          * Marshall the header into the outgoing PDU.
1776          */
1777
1778         if (!smb_io_rpc_hdr("", &hdr, &p->out_data.frag, 0)) {
1779                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1780                 goto err_exit;
1781         }
1782
1783         /*
1784          * Now add the RPC_HDR_BA and any auth needed.
1785          */
1786
1787         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1788                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1789                 goto err_exit;
1790         }
1791
1792         if (auth_len) {
1793                 if (ss_padding_len) {
1794                         char pad[SERVER_NDR_PADDING_SIZE];
1795                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1796                         if (!prs_copy_data_in(&p->out_data.frag, pad,
1797                                         ss_padding_len)) {
1798                                 DEBUG(0,("api_pipe_bind_req: failed to add %u "
1799                                         "bytes of pad data.\n",
1800                                         (unsigned int)ss_padding_len));
1801                                 goto err_exit;
1802                         }
1803                 }
1804
1805                 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1806                         DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1807                         goto err_exit;
1808                 }
1809         }
1810
1811         /*
1812          * Setup the lengths for the initial reply.
1813          */
1814
1815         p->out_data.data_sent_length = 0;
1816         p->out_data.current_pdu_sent = 0;
1817
1818         prs_mem_free(&out_hdr_ba);
1819         prs_mem_free(&out_auth);
1820
1821         return True;
1822
1823   err_exit:
1824
1825         prs_mem_free(&p->out_data.frag);
1826         prs_mem_free(&out_hdr_ba);
1827         prs_mem_free(&out_auth);
1828         return setup_bind_nak(p, pkt);
1829 }
1830
1831 /****************************************************************************
1832  Deal with an alter context call. Can be third part of 3 leg auth request for
1833  SPNEGO calls.
1834 ****************************************************************************/
1835
1836 bool api_pipe_alter_context(pipes_struct *p, struct ncacn_packet *pkt)
1837 {
1838         RPC_HDR hdr;
1839         RPC_HDR_BA hdr_ba;
1840         struct dcerpc_auth auth_info;
1841         uint16 assoc_gid;
1842         fstring ack_pipe_name;
1843         prs_struct out_hdr_ba;
1844         prs_struct out_auth;
1845         int auth_len = 0;
1846         uint32_t ss_padding_len = 0;
1847         NTSTATUS status;
1848
1849         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1850
1851         /*
1852          * Marshall directly into the outgoing PDU space. We
1853          * must do this as we need to set to the bind response
1854          * header and are never sending more than one PDU here.
1855          */
1856
1857         /*
1858          * Setup the memory to marshall the ba header, and the
1859          * auth footers.
1860          */
1861
1862         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1863                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1864                 prs_mem_free(&p->out_data.frag);
1865                 return False;
1866         }
1867
1868         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1869                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1870                 prs_mem_free(&p->out_data.frag);
1871                 prs_mem_free(&out_hdr_ba);
1872                 return False;
1873         }
1874
1875         /* secondary address CAN be NULL
1876          * as the specs say it's ignored.
1877          * It MUST be NULL to have the spoolss working.
1878          */
1879         fstrcpy(ack_pipe_name,"");
1880
1881         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1882
1883         if (pkt->u.bind.assoc_group_id != 0) {
1884                 assoc_gid = pkt->u.bind.assoc_group_id;
1885         } else {
1886                 assoc_gid = 0x53f0;
1887         }
1888
1889         /*
1890          * Create the bind response struct.
1891          */
1892
1893         /* If the requested abstract synt uuid doesn't match our client pipe,
1894                 reject the bind_ack & set the transfer interface synt to all 0's,
1895                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1896                 unknown to NT4)
1897                 Needed when adding entries to a DACL from NT5 - SK */
1898
1899         if (check_bind_req(p,
1900                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1901                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1902                         pkt->u.bind.ctx_list[0].context_id)) {
1903                 init_rpc_hdr_ba(&hdr_ba,
1904                         RPC_MAX_PDU_FRAG_LEN,
1905                         RPC_MAX_PDU_FRAG_LEN,
1906                         assoc_gid,
1907                         ack_pipe_name,
1908                         0x1, 0x0, 0x0,
1909                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0]);
1910         } else {
1911                 /* Rejection reason: abstract syntax not supported */
1912                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1913                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1914                                         ack_pipe_name, 0x1, 0x2, 0x1,
1915                                         &null_ndr_syntax_id);
1916                 p->pipe_bound = False;
1917         }
1918
1919         /*
1920          * and marshall it.
1921          */
1922
1923         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1924                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1925                 goto err_exit;
1926         }
1927
1928
1929         /*
1930          * Check if this is an authenticated alter context request.
1931          */
1932
1933         if (pkt->auth_length != 0) {
1934                 /*
1935                  * Decode the authentication verifier.
1936                  */
1937
1938                 /* Work out any padding needed before the auth footer. */
1939                 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
1940                         ss_padding_len = SERVER_NDR_PADDING_SIZE -
1941                                 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
1942                         DEBUG(10,("api_pipe_alter_context: auth pad_len = %u\n",
1943                                 (unsigned int)ss_padding_len ));
1944                 }
1945
1946                 /* Quick length check. Won't catch a bad auth footer,
1947                  * prevents overrun. */
1948
1949                 if (pkt->frag_length < RPC_HEADER_LEN +
1950                                         RPC_HDR_AUTH_LEN +
1951                                         pkt->auth_length) {
1952                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1953                                 "too long for fragment %u.\n",
1954                                 (unsigned int)pkt->auth_length,
1955                                 (unsigned int)pkt->frag_length ));
1956                         goto err_exit;
1957                 }
1958
1959                 status = dcerpc_pull_dcerpc_auth(pkt,
1960                                                  &pkt->u.bind.auth_info,
1961                                                  &auth_info);
1962                 if (!NT_STATUS_IS_OK(status)) {
1963                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1964                         goto err_exit;
1965                 }
1966
1967
1968                 /*
1969                  * Currently only the SPNEGO auth type uses the alter ctx
1970                  * response in place of the NTLMSSP auth3 type.
1971                  */
1972
1973                 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
1974                         /* We can only finish if the pipe is unbound. */
1975                         if (!p->pipe_bound) {
1976                                 if (!pipe_spnego_auth_bind_continue(p,
1977                                                     ss_padding_len,
1978                                                     &auth_info, &out_auth)) {
1979                                         goto err_exit;
1980                                 }
1981                         } else {
1982                                 goto err_exit;
1983                         }
1984                 }
1985         } else {
1986                 ZERO_STRUCT(auth_info);
1987         }
1988         /*
1989          * Create the header, now we know the length.
1990          */
1991
1992         if (prs_offset(&out_auth)) {
1993                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1994         }
1995
1996         init_rpc_hdr(&hdr, DCERPC_PKT_ALTER_RESP, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1997                         pkt->call_id,
1998                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1999                         auth_len);
2000
2001         /*
2002          * Marshall the header into the outgoing PDU.
2003          */
2004
2005         if(!smb_io_rpc_hdr("", &hdr, &p->out_data.frag, 0)) {
2006                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
2007                 goto err_exit;
2008         }
2009
2010         /*
2011          * Now add the RPC_HDR_BA and any auth needed.
2012          */
2013
2014         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
2015                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
2016                 goto err_exit;
2017         }
2018
2019         if (auth_len) {
2020                 if (ss_padding_len) {
2021                         char pad[SERVER_NDR_PADDING_SIZE];
2022                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
2023                         if (!prs_copy_data_in(&p->out_data.frag, pad,
2024                                         ss_padding_len)) {
2025                                 DEBUG(0,("api_pipe_alter_context: failed to add %u "
2026                                         "bytes of pad data.\n",
2027                                         (unsigned int)ss_padding_len));
2028                                 goto err_exit;
2029                         }
2030                 }
2031
2032                 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
2033                         DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
2034                         goto err_exit;
2035                 }
2036         }
2037
2038         /*
2039          * Setup the lengths for the initial reply.
2040          */
2041
2042         p->out_data.data_sent_length = 0;
2043         p->out_data.current_pdu_sent = 0;
2044
2045         prs_mem_free(&out_hdr_ba);
2046         prs_mem_free(&out_auth);
2047         return True;
2048
2049   err_exit:
2050
2051         prs_mem_free(&p->out_data.frag);
2052         prs_mem_free(&out_hdr_ba);
2053         prs_mem_free(&out_auth);
2054         return setup_bind_nak(p, pkt);
2055 }
2056
2057 /****************************************************************************
2058  Find the set of RPC functions associated with this context_id
2059 ****************************************************************************/
2060
2061 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2062 {
2063         PIPE_RPC_FNS *fns = NULL;
2064
2065         if ( !list ) {
2066                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2067                 return NULL;
2068         }
2069
2070         for (fns=list; fns; fns=fns->next ) {
2071                 if ( fns->context_id == context_id )
2072                         return fns;
2073         }
2074         return NULL;
2075 }
2076
2077 /****************************************************************************
2078  Memory cleanup.
2079 ****************************************************************************/
2080
2081 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2082 {
2083         PIPE_RPC_FNS *tmp = list;
2084         PIPE_RPC_FNS *tmp2;
2085
2086         while (tmp) {
2087                 tmp2 = tmp->next;
2088                 SAFE_FREE(tmp);
2089                 tmp = tmp2;
2090         }
2091
2092         return;
2093 }
2094
2095 static bool api_rpcTNP(pipes_struct *p, struct ncacn_packet *pkt,
2096                        const struct api_struct *api_rpc_cmds, int n_cmds);
2097
2098 /****************************************************************************
2099  Find the correct RPC function to call for this request.
2100  If the pipe is authenticated then become the correct UNIX user
2101  before doing the call.
2102 ****************************************************************************/
2103
2104 bool api_pipe_request(pipes_struct *p, struct ncacn_packet *pkt)
2105 {
2106         bool ret = False;
2107         bool changed_user = False;
2108         PIPE_RPC_FNS *pipe_fns;
2109
2110         if (p->pipe_bound &&
2111                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2112                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2113                 if(!become_authenticated_pipe_user(p)) {
2114                         prs_mem_free(&p->out_data.rdata);
2115                         return False;
2116                 }
2117                 changed_user = True;
2118         }
2119
2120         DEBUG(5, ("Requested \\PIPE\\%s\n",
2121                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2122
2123         /* get the set of RPC functions for this context */
2124
2125         pipe_fns = find_pipe_fns_by_context(p->contexts,
2126                                             pkt->u.request.context_id);
2127
2128         if ( pipe_fns ) {
2129                 TALLOC_CTX *frame = talloc_stackframe();
2130                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds);
2131                 TALLOC_FREE(frame);
2132         }
2133         else {
2134                 DEBUG(0, ("No rpc function table associated with context "
2135                           "[%d] on pipe [%s]\n",
2136                           pkt->u.request.context_id,
2137                           get_pipe_name_from_syntax(talloc_tos(),
2138                                                     &p->syntax)));
2139         }
2140
2141         if (changed_user) {
2142                 unbecome_authenticated_pipe_user();
2143         }
2144
2145         return ret;
2146 }
2147
2148 /*******************************************************************
2149  Calls the underlying RPC function for a named pipe.
2150  ********************************************************************/
2151
2152 static bool api_rpcTNP(pipes_struct *p, struct ncacn_packet *pkt,
2153                        const struct api_struct *api_rpc_cmds, int n_cmds)
2154 {
2155         int fn_num;
2156         uint32 offset1, offset2;
2157
2158         /* interpret the command */
2159         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2160                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2161                  pkt->u.request.opnum));
2162
2163         if (DEBUGLEVEL >= 50) {
2164                 fstring name;
2165                 slprintf(name, sizeof(name)-1, "in_%s",
2166                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2167                 prs_dump(name, pkt->u.request.opnum, &p->in_data.data);
2168         }
2169
2170         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2171                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
2172                     api_rpc_cmds[fn_num].fn != NULL) {
2173                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
2174                                   api_rpc_cmds[fn_num].name));
2175                         break;
2176                 }
2177         }
2178
2179         if (fn_num == n_cmds) {
2180                 /*
2181                  * For an unknown RPC just return a fault PDU but
2182                  * return True to allow RPC's on the pipe to continue
2183                  * and not put the pipe into fault state. JRA.
2184                  */
2185                 DEBUG(4, ("unknown\n"));
2186                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2187                 return True;
2188         }
2189
2190         offset1 = prs_offset(&p->out_data.rdata);
2191
2192         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2193                 fn_num, api_rpc_cmds[fn_num].fn));
2194         /* do the actual command */
2195         if(!api_rpc_cmds[fn_num].fn(p)) {
2196                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2197                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2198                          api_rpc_cmds[fn_num].name));
2199                 prs_mem_free(&p->out_data.rdata);
2200                 return False;
2201         }
2202
2203         if (p->bad_handle_fault_state) {
2204                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2205                 p->bad_handle_fault_state = False;
2206                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2207                 return True;
2208         }
2209
2210         if (p->rng_fault_state) {
2211                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2212                 p->rng_fault_state = False;
2213                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2214                 return True;
2215         }
2216
2217         offset2 = prs_offset(&p->out_data.rdata);
2218         prs_set_offset(&p->out_data.rdata, offset1);
2219         if (DEBUGLEVEL >= 50) {
2220                 fstring name;
2221                 slprintf(name, sizeof(name)-1, "out_%s",
2222                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2223                 prs_dump(name, pkt->u.request.opnum, &p->out_data.rdata);
2224         }
2225         prs_set_offset(&p->out_data.rdata, offset2);
2226
2227         DEBUG(5,("api_rpcTNP: called %s successfully\n",
2228                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2229
2230         /* Check for buffer underflow in rpc parsing */
2231
2232         if ((DEBUGLEVEL >= 10) &&
2233             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2234                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2235                 char *data = (char *)SMB_MALLOC(data_len);
2236
2237                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2238                 if (data) {
2239                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2240                         SAFE_FREE(data);
2241                 }
2242
2243         }
2244
2245         return True;
2246 }