source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "srv_pipe_internal.h"
  32 #include "../librpc/gen_ndr/ndr_schannel.h"
  33 #include "../libcli/auth/schannel.h"
  34 #include "../libcli/auth/spnego.h"
  35 #include "../libcli/auth/ntlmssp.h"
  36 #include "ntlmssp_wrap.h"
  37 #include "rpc_server.h"
  38
  39 #undef DBGC_CLASS
  40 #define DBGC_CLASS DBGC_RPC_SRV
  41
  42 /**
  43  * Dump everything from the start of the end up of the provided data
  44  * into a file, but only at debug level >= 50
  45  **/
  46 static void dump_pdu_region(const char *name, int v,
  47                             DATA_BLOB *data, size_t start, size_t end)
  48 {
  49         int fd, i;
  50         char *fname = NULL;
  51         ssize_t sz;
  52
  53         if (DEBUGLEVEL < 50) return;
  54
  55         if (start > data->length || end > data->length || start > end) return;
  56
  57         for (i = 1; i < 100; i++) {
  58                 if (v != -1) {
  59                         fname = talloc_asprintf(talloc_tos(),
  60                                                 "/tmp/%s_%d.%d.prs",
  61                                                 name, v, i);
  62                 } else {
  63                         fname = talloc_asprintf(talloc_tos(),
  64                                                 "/tmp/%s_%d.prs",
  65                                                 name, i);
  66                 }
  67                 if (!fname) {
  68                         return;
  69                 }
  70                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  71                 if (fd != -1 || errno != EEXIST) break;
  72         }
  73         if (fd != -1) {
  74                 sz = write(fd, data->data + start, end - start);
  75                 i = close(fd);
  76                 if ((sz != end - start) || (i != 0) ) {
  77                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  78                                   fname, (unsigned long)sz,
  79                                   (unsigned long)end - start, i));
  80                 } else {
  81                         DEBUG(0,("created %s\n", fname));
  82                 }
  83         }
  84         TALLOC_FREE(fname);
  85 }
  86
  87 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  88 {
  89         TALLOC_FREE(auth->a_u.auth_ntlmssp_state);
  90 }
  91
  92 static DATA_BLOB generic_session_key(void)
  93 {
  94         return data_blob("SystemLibraryDTC", 16);
  95 }
  96
  97 /*******************************************************************
  98  Handle NTLMSSP.
  99  ********************************************************************/
 100
 101 static bool add_ntlmssp_auth(pipes_struct *p)
 102 {
 103         enum dcerpc_AuthLevel auth_level = p->auth.auth_level;
 104         DATA_BLOB auth_blob = data_blob_null;
 105         NTSTATUS status;
 106
 107         /* FIXME: Is this right ?
 108          * Keeping only to avoid changing semantics during refactoring
 109          * --simo
 110          */
 111         if (auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
 112                 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 113         }
 114
 115         /* Generate the auth blob. */
 116         switch (auth_level) {
 117         case DCERPC_AUTH_LEVEL_PRIVACY:
 118                 /* Data portion is encrypted. */
 119                 status = auth_ntlmssp_seal_packet(
 120                                 p->auth.a_u.auth_ntlmssp_state,
 121                                 (TALLOC_CTX *)p->out_data.frag.data,
 122                                 &p->out_data.frag.data[DCERPC_RESPONSE_LENGTH],
 123                                 p->out_data.frag.length
 124                                         - DCERPC_RESPONSE_LENGTH
 125                                         - DCERPC_AUTH_TRAILER_LENGTH,
 126                                 p->out_data.frag.data,
 127                                 p->out_data.frag.length,
 128                                 &auth_blob);
 129                 break;
 130
 131         case DCERPC_AUTH_LEVEL_INTEGRITY:
 132                 /* Data is signed. */
 133                 status = auth_ntlmssp_sign_packet(
 134                                 p->auth.a_u.auth_ntlmssp_state,
 135                                 (TALLOC_CTX *)p->out_data.frag.data,
 136                                 &p->out_data.frag.data[DCERPC_RESPONSE_LENGTH],
 137                                 p->out_data.frag.length
 138                                         - DCERPC_RESPONSE_LENGTH
 139                                         - DCERPC_AUTH_TRAILER_LENGTH,
 140                                 p->out_data.frag.data,
 141                                 p->out_data.frag.length,
 142                                 &auth_blob);
 143                 break;
 144
 145         default:
 146                 status = NT_STATUS_INTERNAL_ERROR;
 147                 return false;
 148         }
 149
 150         if (!NT_STATUS_IS_OK(status)) {
 151                 DEBUG(0, ("Failed to add NTLMSSP auth blob: %s\n",
 152                         nt_errstr(status)));
 153                 data_blob_free(&p->out_data.frag);
 154                 return false;
 155         }
 156
 157         /* Finally append the auth blob. */
 158         if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
 159                                 auth_blob.data, auth_blob.length)) {
 160                 DEBUG(0, ("Failed to add %u bytes auth blob.\n",
 161                           (unsigned int)auth_blob.length));
 162                 data_blob_free(&p->out_data.frag);
 163                 return False;
 164         }
 165         data_blob_free(&auth_blob);
 166
 167         return true;
 168 }
 169
 170 /*******************************************************************
 171  Append a schannel authenticated fragment.
 172  ********************************************************************/
 173
 174 static bool add_schannel_auth(pipes_struct *p)
 175 {
 176         DATA_BLOB auth_blob = data_blob_null;
 177         NTSTATUS status;
 178
 179         /* Schannel processing. */
 180         switch (p->auth.auth_level) {
 181         case DCERPC_AUTH_LEVEL_PRIVACY:
 182                 status = netsec_outgoing_packet(
 183                                 p->auth.a_u.schannel_auth,
 184                                 (TALLOC_CTX *)p->out_data.frag.data,
 185                                 true,
 186                                 &p->out_data.frag.data[DCERPC_RESPONSE_LENGTH],
 187                                 p->out_data.frag.length
 188                                         - DCERPC_RESPONSE_LENGTH
 189                                         - DCERPC_AUTH_TRAILER_LENGTH,
 190                                 &auth_blob);
 191                 break;
 192
 193         case DCERPC_AUTH_LEVEL_INTEGRITY:
 194                 status = netsec_outgoing_packet(
 195                                 p->auth.a_u.schannel_auth,
 196                                 (TALLOC_CTX *)p->out_data.frag.data,
 197                                 false,
 198                                 &p->out_data.frag.data[DCERPC_RESPONSE_LENGTH],
 199                                 p->out_data.frag.length
 200                                         - DCERPC_RESPONSE_LENGTH
 201                                         - DCERPC_AUTH_TRAILER_LENGTH,
 202                                 &auth_blob);
 203                 break;
 204
 205         default:
 206                 status = NT_STATUS_INTERNAL_ERROR;
 207                 break;
 208         }
 209
 210         if (!NT_STATUS_IS_OK(status)) {
 211                 DEBUG(0, ("Failed to add SCHANNEL auth blob: %s\n",
 212                         nt_errstr(status)));
 213                 data_blob_free(&p->out_data.frag);
 214                 return false;
 215         }
 216
 217         if (DEBUGLEVEL >= 10) {
 218                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &auth_blob);
 219         }
 220
 221         if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
 222                                 auth_blob.data, auth_blob.length)) {
 223                 DEBUG(0, ("Failed to add %u bytes auth blob.\n",
 224                           (unsigned int)auth_blob.length));
 225                 data_blob_free(&p->out_data.frag);
 226                 return false;
 227         }
 228         data_blob_free(&auth_blob);
 229
 230         return true;
 231 }
 232
 233 /*******************************************************************
 234  Generate the next PDU to be returned from the data.
 235 ********************************************************************/
 236
 237 static bool create_next_packet(pipes_struct *p,
 238                                 enum dcerpc_AuthType auth_type,
 239                                 enum dcerpc_AuthLevel auth_level,
 240                                 size_t auth_length)
 241 {
 242         union dcerpc_payload u;
 243         uint8_t pfc_flags;
 244         size_t data_len_left;
 245         size_t data_len;
 246         size_t max_len;
 247         size_t pad_len = 0;
 248         NTSTATUS status;
 249
 250         ZERO_STRUCT(u.response);
 251
 252         /* Set up rpc packet pfc flags. */
 253         if (p->out_data.data_sent_length == 0) {
 254                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 255         } else {
 256                 pfc_flags = 0;
 257         }
 258
 259         /* Work out how much we can fit in a single PDU. */
 260         data_len_left = p->out_data.rdata.length -
 261                                 p->out_data.data_sent_length;
 262
 263         /* Ensure there really is data left to send. */
 264         if (!data_len_left) {
 265                 DEBUG(0, ("No data left to send !\n"));
 266                 return false;
 267         }
 268
 269         /* Max space available - not including padding. */
 270         if (auth_length) {
 271                 max_len = RPC_MAX_PDU_FRAG_LEN
 272                                 - DCERPC_RESPONSE_LENGTH
 273                                 - DCERPC_AUTH_TRAILER_LENGTH
 274                                 - auth_length;
 275         } else {
 276                 max_len = RPC_MAX_PDU_FRAG_LEN - DCERPC_RESPONSE_LENGTH;
 277         }
 278
 279         /*
 280          * The amount we send is the minimum of the max_len
 281          * and the amount left to send.
 282          */
 283         data_len = MIN(data_len_left, max_len);
 284
 285         if (auth_length) {
 286                 /* Work out any padding alignment requirements. */
 287                 pad_len = (DCERPC_RESPONSE_LENGTH + data_len) %
 288                                                 SERVER_NDR_PADDING_SIZE;
 289                 if (pad_len) {
 290                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
 291                         DEBUG(10, ("Padding size is: %d\n", (int)pad_len));
 292                         /* If we're over filling the packet, we need to make
 293                          * space for the padding at the end of the data. */
 294                         if (data_len + pad_len > max_len) {
 295                                 data_len -= SERVER_NDR_PADDING_SIZE;
 296                         }
 297                 }
 298         }
 299
 300         /* Set up the alloc hint. This should be the data left to send. */
 301         u.response.alloc_hint = data_len_left;
 302
 303         /* Work out if this PDU will be the last. */
 304         if (p->out_data.data_sent_length
 305                                 + data_len >= p->out_data.rdata.length) {
 306                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 307         }
 308
 309         /* Prepare data to be NDR encoded. */
 310         u.response.stub_and_verifier =
 311                 data_blob_const(p->out_data.rdata.data +
 312                                 p->out_data.data_sent_length, data_len);
 313
 314         /* Store the packet in the data stream. */
 315         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 316                                           DCERPC_PKT_RESPONSE,
 317                                           pfc_flags,
 318                                           auth_length,
 319                                           p->call_id,
 320                                           &u,
 321                                           &p->out_data.frag);
 322         if (!NT_STATUS_IS_OK(status)) {
 323                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 324                 return false;
 325         }
 326
 327         if (auth_length) {
 328                 DATA_BLOB empty = data_blob_null;
 329                 DATA_BLOB auth_hdr;
 330
 331                 /* Set the proper length on the pdu, including padding.
 332                  * Only needed if an auth trailer will be appended. */
 333                 dcerpc_set_frag_length(&p->out_data.frag,
 334                                         p->out_data.frag.length
 335                                                 + pad_len
 336                                                 + DCERPC_AUTH_TRAILER_LENGTH
 337                                                 + auth_length);
 338
 339                 if (pad_len) {
 340                         size_t offset = p->out_data.frag.length;
 341
 342                         if (!data_blob_realloc(p->mem_ctx,
 343                                                 &p->out_data.frag,
 344                                                 offset + pad_len)) {
 345                                 DEBUG(0, ("Failed to add padding!\n"));
 346                                 data_blob_free(&p->out_data.frag);
 347                                 return false;
 348                         }
 349                         memset(&p->out_data.frag.data[offset], '\0', pad_len);
 350                 }
 351
 352                 /* auth blob is intentionally empty,
 353                  * it will be appended later */
 354                 status = dcerpc_push_dcerpc_auth(p->out_data.frag.data,
 355                                                  auth_type,
 356                                                  auth_level,
 357                                                  pad_len,
 358                                                  1, /* context id. */
 359                                                  &empty,
 360                                                  &auth_hdr);
 361                 if (!NT_STATUS_IS_OK(status)) {
 362                         DEBUG(0, ("Failed to marshall RPC Auth.\n"));
 363                         return false;
 364                 }
 365
 366                 /* Store auth header in the data stream. */
 367                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
 368                                         auth_hdr.data, auth_hdr.length)) {
 369                         DEBUG(0, ("Out of memory.\n"));
 370                         data_blob_free(&p->out_data.frag);
 371                         return false;
 372                 }
 373                 data_blob_free(&auth_hdr);
 374         }
 375
 376         /* Setup the counts for this PDU. */
 377         p->out_data.data_sent_length += data_len;
 378         p->out_data.current_pdu_sent = 0;
 379         return true;
 380 }
 381
 382 /*******************************************************************
 383  Generate the next PDU to be returned from the data in p->rdata.
 384 ********************************************************************/
 385
 386 bool create_next_pdu(pipes_struct *p)
 387 {
 388         enum dcerpc_AuthType auth_type =
 389                 map_pipe_auth_type_to_rpc_auth_type(p->auth.auth_type);
 390
 391         /*
 392          * If we're in the fault state, keep returning fault PDU's until
 393          * the pipe gets closed. JRA.
 394          */
 395         if (p->fault_state) {
 396                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 397                 return true;
 398         }
 399
 400         switch (p->auth.auth_level) {
 401         case DCERPC_AUTH_LEVEL_NONE:
 402         case DCERPC_AUTH_LEVEL_CONNECT:
 403                 /* This is incorrect for auth level connect. Fixme. JRA */
 404
 405                 /* No authentication done. */
 406                 return create_next_packet(p, auth_type,
 407                                           p->auth.auth_level, 0);
 408
 409         case DCERPC_AUTH_LEVEL_CALL:
 410         case DCERPC_AUTH_LEVEL_PACKET:
 411         case DCERPC_AUTH_LEVEL_INTEGRITY:
 412         case DCERPC_AUTH_LEVEL_PRIVACY:
 413
 414                 switch(p->auth.auth_type) {
 415                 case PIPE_AUTH_TYPE_NTLMSSP:
 416                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 417                         if (!create_next_packet(p, auth_type,
 418                                                 p->auth.auth_level,
 419                                                 NTLMSSP_SIG_SIZE)) {
 420                                 return false;
 421                         }
 422                         return add_ntlmssp_auth(p);
 423
 424                 case PIPE_AUTH_TYPE_SCHANNEL:
 425                         if (!create_next_packet(p, auth_type,
 426                                                 p->auth.auth_level,
 427                                                 NL_AUTH_SIGNATURE_SIZE)) {
 428                                 return false;
 429                         }
 430                         return add_schannel_auth(p);
 431                 default:
 432                         break;
 433                 }
 434         default:
 435                 break;
 436         }
 437
 438         DEBUG(0, ("Invalid internal auth level %u / type %u\n",
 439                   (unsigned int)p->auth.auth_level,
 440                   (unsigned int)p->auth.auth_type));
 441         return false;
 442 }
 443
 444 /*******************************************************************
 445  Process an NTLMSSP authentication response.
 446  If this function succeeds, the user has been authenticated
 447  and their domain, name and calling workstation stored in
 448  the pipe struct.
 449 *******************************************************************/
 450
 451 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 452 {
 453         DATA_BLOB session_key, reply;
 454         NTSTATUS status;
 455         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
 456         bool ret;
 457
 458         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
 459                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 460
 461         ZERO_STRUCT(reply);
 462
 463         /* this has to be done as root in order to verify the password */
 464         become_root();
 465         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 466         unbecome_root();
 467
 468         /* Don't generate a reply. */
 469         data_blob_free(&reply);
 470
 471         if (!NT_STATUS_IS_OK(status)) {
 472                 return False;
 473         }
 474
 475         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 476            ensure the underlying NTLMSSP flags are also set. If not we should
 477            refuse the bind. */
 478
 479         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
 480                 if (!auth_ntlmssp_negotiated_sign(a)) {
 481                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 482                                 "but client declined signing.\n",
 483                                  get_pipe_name_from_syntax(talloc_tos(),
 484                                                            &p->syntax)));
 485                         return False;
 486                 }
 487         }
 488         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 489                 if (!auth_ntlmssp_negotiated_seal(a)) {
 490                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 491                                 "but client declined sealing.\n",
 492                                  get_pipe_name_from_syntax(talloc_tos(),
 493                                                            &p->syntax)));
 494                         return False;
 495                 }
 496         }
 497
 498         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 499                   "workstation: %s\n",
 500                   auth_ntlmssp_get_username(a),
 501                   auth_ntlmssp_get_domain(a),
 502                   auth_ntlmssp_get_client(a)));
 503
 504         TALLOC_FREE(p->server_info);
 505
 506         status = auth_ntlmssp_steal_server_info(p, a, &p->server_info);
 507         if (!NT_STATUS_IS_OK(status)) {
 508                 DEBUG(0, ("auth_ntlmssp_server_info failed to obtain the server info for authenticated user: %s\n",
 509                           nt_errstr(status)));
 510                 return false;
 511         }
 512
 513         if (p->server_info->ptok == NULL) {
 514                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 515                 return False;
 516         }
 517
 518         /*
 519          * We're an authenticated bind over smb, so the session key needs to
 520          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 521          * does. See the RPC-SAMBA3SESSIONKEY.
 522          */
 523
 524         session_key = generic_session_key();
 525         if (session_key.data == NULL) {
 526                 return False;
 527         }
 528
 529         ret = server_info_set_session_key(p->server_info, session_key);
 530
 531         data_blob_free(&session_key);
 532
 533         return True;
 534 }
 535
 536 /*******************************************************************
 537  This is the "stage3" NTLMSSP response after a bind request and reply.
 538 *******************************************************************/
 539
 540 bool api_pipe_bind_auth3(pipes_struct *p, struct ncacn_packet *pkt)
 541 {
 542         struct dcerpc_auth auth_info;
 543         NTSTATUS status;
 544
 545         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 546
 547         if (pkt->auth_length == 0) {
 548                 DEBUG(0, ("No auth field sent for bind request!\n"));
 549                 goto err;
 550         }
 551
 552         /* Ensure there's enough data for an authenticated request. */
 553         if (pkt->frag_length < RPC_HEADER_LEN
 554                                 + DCERPC_AUTH_TRAILER_LENGTH
 555                                 + pkt->auth_length) {
 556                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
 557                                 "%u is too large.\n",
 558                         (unsigned int)pkt->auth_length));
 559                 goto err;
 560         }
 561
 562         /*
 563          * Decode the authentication verifier response.
 564          */
 565
 566         status = dcerpc_pull_dcerpc_auth(pkt,
 567                                          &pkt->u.auth3.auth_info,
 568                                          &auth_info, p->endian);
 569         if (!NT_STATUS_IS_OK(status)) {
 570                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
 571                 goto err;
 572         }
 573
 574         /* We must NEVER look at auth_info->auth_pad_len here,
 575          * as old Samba client code gets it wrong and sends it
 576          * as zero. JRA.
 577          */
 578
 579         if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
 580                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 581                         (unsigned int)auth_info.auth_type ));
 582                 return False;
 583         }
 584
 585         /*
 586          * The following call actually checks the challenge/response data.
 587          * for correctness against the given DOMAIN\user name.
 588          */
 589
 590         if (!pipe_ntlmssp_verify_final(p, &auth_info.credentials)) {
 591                 goto err;
 592         }
 593
 594         p->pipe_bound = True;
 595
 596         return True;
 597
 598  err:
 599
 600         free_pipe_ntlmssp_auth_data(&p->auth);
 601         p->auth.a_u.auth_ntlmssp_state = NULL;
 602
 603         return False;
 604 }
 605
 606 /*******************************************************************
 607  Marshall a bind_nak pdu.
 608 *******************************************************************/
 609
 610 static bool setup_bind_nak(pipes_struct *p, struct ncacn_packet *pkt)
 611 {
 612         NTSTATUS status;
 613         union dcerpc_payload u;
 614
 615         /* Free any memory in the current return data buffer. */
 616         data_blob_free(&p->out_data.rdata);
 617
 618         /*
 619          * Initialize a bind_nak header.
 620          */
 621
 622         ZERO_STRUCT(u);
 623
 624         u.bind_nak.reject_reason  = 0;
 625
 626         /*
 627          * Marshall directly into the outgoing PDU space. We
 628          * must do this as we need to set to the bind response
 629          * header and are never sending more than one PDU here.
 630          */
 631
 632         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 633                                           DCERPC_PKT_BIND_NAK,
 634                                           DCERPC_PFC_FLAG_FIRST |
 635                                                 DCERPC_PFC_FLAG_LAST,
 636                                           0,
 637                                           pkt->call_id,
 638                                           &u,
 639                                           &p->out_data.frag);
 640         if (!NT_STATUS_IS_OK(status)) {
 641                 return False;
 642         }
 643
 644         p->out_data.data_sent_length = 0;
 645         p->out_data.current_pdu_sent = 0;
 646
 647         if (p->auth.auth_data_free_func) {
 648                 (*p->auth.auth_data_free_func)(&p->auth);
 649         }
 650         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 651         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 652         p->pipe_bound = False;
 653
 654         return True;
 655 }
 656
 657 /*******************************************************************
 658  Marshall a fault pdu.
 659 *******************************************************************/
 660
 661 bool setup_fault_pdu(pipes_struct *p, NTSTATUS fault_status)
 662 {
 663         NTSTATUS status;
 664         union dcerpc_payload u;
 665
 666         /* Free any memory in the current return data buffer. */
 667         data_blob_free(&p->out_data.rdata);
 668
 669         /*
 670          * Initialize a fault header.
 671          */
 672
 673         ZERO_STRUCT(u);
 674
 675         u.fault.status          = NT_STATUS_V(fault_status);
 676         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 677
 678         /*
 679          * Marshall directly into the outgoing PDU space. We
 680          * must do this as we need to set to the bind response
 681          * header and are never sending more than one PDU here.
 682          */
 683
 684         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 685                                           DCERPC_PKT_FAULT,
 686                                           DCERPC_PFC_FLAG_FIRST |
 687                                            DCERPC_PFC_FLAG_LAST |
 688                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 689                                           0,
 690                                           p->call_id,
 691                                           &u,
 692                                           &p->out_data.frag);
 693         if (!NT_STATUS_IS_OK(status)) {
 694                 return False;
 695         }
 696
 697         p->out_data.data_sent_length = 0;
 698         p->out_data.current_pdu_sent = 0;
 699
 700         return True;
 701 }
 702
 703 /*******************************************************************
 704  Ensure a bind request has the correct abstract & transfer interface.
 705  Used to reject unknown binds from Win2k.
 706 *******************************************************************/
 707
 708 static bool check_bind_req(struct pipes_struct *p,
 709                            struct ndr_syntax_id* abstract,
 710                            struct ndr_syntax_id* transfer,
 711                            uint32 context_id)
 712 {
 713         struct pipe_rpc_fns *context_fns;
 714
 715         DEBUG(3,("check_bind_req for %s\n",
 716                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 717
 718         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 719         if (rpc_srv_pipe_exists_by_id(abstract) &&
 720            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 721                 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 722                         rpc_srv_get_pipe_cli_name(abstract),
 723                         rpc_srv_get_pipe_srv_name(abstract)));
 724         } else {
 725                 return false;
 726         }
 727
 728         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 729         if (context_fns == NULL) {
 730                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 731                 return False;
 732         }
 733
 734         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 735         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 736         context_fns->context_id = context_id;
 737
 738         /* add to the list of open contexts */
 739
 740         DLIST_ADD( p->contexts, context_fns );
 741
 742         return True;
 743 }
 744
 745 /**
 746  * Is a named pipe known?
 747  * @param[in] cli_filename      The pipe name requested by the client
 748  * @result                      Do we want to serve this?
 749  */
 750 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
 751 {
 752         const char *pipename = cli_filename;
 753         NTSTATUS status;
 754
 755         if (strnequal(pipename, "\\PIPE\\", 6)) {
 756                 pipename += 5;
 757         }
 758
 759         if (*pipename == '\\') {
 760                 pipename += 1;
 761         }
 762
 763         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 764                 DEBUG(10, ("refusing spoolss access\n"));
 765                 return false;
 766         }
 767
 768         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 769                 return true;
 770         }
 771
 772         status = smb_probe_module("rpc", pipename);
 773         if (!NT_STATUS_IS_OK(status)) {
 774                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
 775                 return false;
 776         }
 777         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 778
 779         /*
 780          * Scan the list again for the interface id
 781          */
 782         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 783                 return true;
 784         }
 785
 786         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 787                    pipename));
 788
 789         return false;
 790 }
 791
 792 /*******************************************************************
 793  Handle a SPNEGO krb5 bind auth.
 794 *******************************************************************/
 795
 796 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p,
 797                                            TALLOC_CTX *mem_ctx,
 798                                            struct dcerpc_auth *pauth_info,
 799                                            DATA_BLOB *psecblob,
 800                                            DATA_BLOB *response)
 801 {
 802         return False;
 803 }
 804
 805 /*******************************************************************
 806  Handle the first part of a SPNEGO bind auth.
 807 *******************************************************************/
 808
 809 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p,
 810                                             TALLOC_CTX *mem_ctx,
 811                                             struct dcerpc_auth *pauth_info,
 812                                             DATA_BLOB *response)
 813 {
 814         DATA_BLOB secblob;
 815         DATA_BLOB chal;
 816         char *OIDs[ASN1_MAX_OIDS];
 817         int i;
 818         NTSTATUS status;
 819         bool got_kerberos_mechanism = false;
 820         struct auth_ntlmssp_state *a = NULL;
 821
 822         ZERO_STRUCT(secblob);
 823         ZERO_STRUCT(chal);
 824
 825         if (pauth_info->credentials.data[0] != ASN1_APPLICATION(0)) {
 826                 goto err;
 827         }
 828
 829         /* parse out the OIDs and the first sec blob */
 830         if (!spnego_parse_negTokenInit(pauth_info->credentials, OIDs, NULL, &secblob)) {
 831                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
 832                 goto err;
 833         }
 834
 835         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
 836                 got_kerberos_mechanism = true;
 837         }
 838
 839         for (i=0;OIDs[i];i++) {
 840                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
 841                 TALLOC_FREE(OIDs[i]);
 842         }
 843         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
 844
 845         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
 846                 bool ret;
 847                 ret = pipe_spnego_auth_bind_kerberos(p, mem_ctx, pauth_info,
 848                                                      &secblob, response);
 849                 data_blob_free(&secblob);
 850                 return ret;
 851         }
 852
 853         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
 854                 /* Free any previous auth type. */
 855                 free_pipe_ntlmssp_auth_data(&p->auth);
 856         }
 857
 858         if (!got_kerberos_mechanism) {
 859                 /* Initialize the NTLM engine. */
 860                 status = auth_ntlmssp_start(&a);
 861                 if (!NT_STATUS_IS_OK(status)) {
 862                         goto err;
 863                 }
 864
 865                 switch (pauth_info->auth_level) {
 866                         case DCERPC_AUTH_LEVEL_INTEGRITY:
 867                                 auth_ntlmssp_want_sign(a);
 868                                 break;
 869                         case DCERPC_AUTH_LEVEL_PRIVACY:
 870                                 auth_ntlmssp_want_seal(a);
 871                                 break;
 872                         default:
 873                                 break;
 874                 }
 875                 /*
 876                  * Pass the first security blob of data to it.
 877                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
 878                  * which means we need another packet to complete the bind.
 879                  */
 880
 881                 status = auth_ntlmssp_update(a, secblob, &chal);
 882
 883                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 884                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
 885                         goto err;
 886                 }
 887
 888                 /* Generate the response blob we need for step 2 of the bind. */
 889                 *response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
 890         } else {
 891                 /*
 892                  * SPNEGO negotiate down to NTLMSSP. The subsequent
 893                  * code to process follow-up packets is not complete
 894                  * yet. JRA.
 895                  */
 896                 *response = spnego_gen_auth_response(NULL,
 897                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
 898                                         OID_NTLMSSP);
 899         }
 900
 901         /* Make sure data is bound to the memctx, to be freed the caller */
 902         talloc_steal(mem_ctx, response->data);
 903
 904         /* auth_pad_len will be handled by the caller */
 905
 906         p->auth.a_u.auth_ntlmssp_state = a;
 907         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
 908         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
 909
 910         data_blob_free(&secblob);
 911         data_blob_free(&chal);
 912
 913         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
 914         return True;
 915
 916  err:
 917
 918         data_blob_free(&secblob);
 919         data_blob_free(&chal);
 920
 921         p->auth.a_u.auth_ntlmssp_state = NULL;
 922
 923         return False;
 924 }
 925
 926 /*******************************************************************
 927  Handle the second part of a SPNEGO bind auth.
 928 *******************************************************************/
 929
 930 static bool pipe_spnego_auth_bind_continue(pipes_struct *p,
 931                                            TALLOC_CTX *mem_ctx,
 932                                            struct dcerpc_auth *pauth_info,
 933                                            DATA_BLOB *response)
 934 {
 935         DATA_BLOB auth_blob;
 936         DATA_BLOB auth_reply;
 937         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
 938
 939         ZERO_STRUCT(auth_blob);
 940         ZERO_STRUCT(auth_reply);
 941
 942         /*
 943          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
 944          * fail here as 'a' == NULL.
 945          */
 946         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
 947                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
 948                 goto err;
 949         }
 950
 951         if (pauth_info->credentials.data[0] != ASN1_CONTEXT(1)) {
 952                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
 953                 goto err;
 954         }
 955
 956         if (!spnego_parse_auth(pauth_info->credentials, &auth_blob)) {
 957                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
 958                 goto err;
 959         }
 960
 961         /*
 962          * The following call actually checks the challenge/response data.
 963          * for correctness against the given DOMAIN\user name.
 964          */
 965
 966         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
 967                 goto err;
 968         }
 969
 970         data_blob_free(&auth_blob);
 971
 972         /* Generate the spnego "accept completed" blob - no incoming data. */
 973         *response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
 974
 975         /* Make sure data is bound to the memctx, to be freed the caller */
 976         talloc_steal(mem_ctx, response->data);
 977
 978         data_blob_free(&auth_reply);
 979
 980         p->pipe_bound = True;
 981
 982         return True;
 983
 984  err:
 985
 986         data_blob_free(&auth_blob);
 987         data_blob_free(&auth_reply);
 988
 989         free_pipe_ntlmssp_auth_data(&p->auth);
 990         p->auth.a_u.auth_ntlmssp_state = NULL;
 991
 992         return False;
 993 }
 994
 995 /*******************************************************************
 996  Handle an schannel bind auth.
 997 *******************************************************************/
 998
 999 static bool pipe_schannel_auth_bind(pipes_struct *p,
1000                                     TALLOC_CTX *mem_ctx,
1001                                     struct dcerpc_auth *auth_info,
1002                                     DATA_BLOB *response)
1003 {
1004         struct NL_AUTH_MESSAGE neg;
1005         struct NL_AUTH_MESSAGE reply;
1006         bool ret;
1007         NTSTATUS status;
1008         struct netlogon_creds_CredentialState *creds;
1009         DATA_BLOB session_key;
1010         enum ndr_err_code ndr_err;
1011
1012         ndr_err = ndr_pull_struct_blob(
1013                         &auth_info->credentials, mem_ctx, &neg,
1014                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1015         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1016                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1017                 return false;
1018         }
1019
1020         if (DEBUGLEVEL >= 10) {
1021                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1022         }
1023
1024         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1025                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1026                 return false;
1027         }
1028
1029         /*
1030          * The neg.oem_netbios_computer.a key here must match the remote computer name
1031          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1032          * operations that use credentials.
1033          */
1034
1035         become_root();
1036         status = schannel_get_creds_state(p, lp_private_dir(),
1037                                             neg.oem_netbios_computer.a, &creds);
1038         unbecome_root();
1039
1040         if (!NT_STATUS_IS_OK(status)) {
1041                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1042                 return False;
1043         }
1044
1045         p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1046         if (!p->auth.a_u.schannel_auth) {
1047                 TALLOC_FREE(creds);
1048                 return False;
1049         }
1050
1051         p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1052         p->auth.a_u.schannel_auth->seq_num = 0;
1053         p->auth.a_u.schannel_auth->initiator = false;
1054         p->auth.a_u.schannel_auth->creds = creds;
1055
1056         /*
1057          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1058          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1059          * struct of the person who opened the pipe. I need to test this further. JRA.
1060          *
1061          * VL. As we are mapping this to guest set the generic key
1062          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1063          * W2k3, as it does not allow schannel binds against SAMR and LSA
1064          * anymore.
1065          */
1066
1067         session_key = generic_session_key();
1068         if (session_key.data == NULL) {
1069                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1070                           " key\n"));
1071                 return false;
1072         }
1073
1074         ret = server_info_set_session_key(p->server_info, session_key);
1075
1076         data_blob_free(&session_key);
1077
1078         if (!ret) {
1079                 DEBUG(0, ("server_info_set_session_key failed\n"));
1080                 return false;
1081         }
1082
1083         /*** SCHANNEL verifier ***/
1084
1085         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
1086         reply.Flags                             = 0;
1087         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
1088                                                       * this has any meaning
1089                                                       * here - gd */
1090
1091         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
1092                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1093         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1094                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1095                 return false;
1096         }
1097
1098         if (DEBUGLEVEL >= 10) {
1099                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1100         }
1101
1102         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1103                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1104
1105         /* We're finished with this bind - no more packets. */
1106         p->auth.auth_data_free_func = NULL;
1107         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1108
1109         p->pipe_bound = True;
1110
1111         return True;
1112 }
1113
1114 /*******************************************************************
1115  Handle an NTLMSSP bind auth.
1116 *******************************************************************/
1117
1118 static bool pipe_ntlmssp_auth_bind(pipes_struct *p,
1119                                    TALLOC_CTX *mem_ctx,
1120                                    struct dcerpc_auth *auth_info,
1121                                    DATA_BLOB *response)
1122 {
1123         NTSTATUS status;
1124         struct auth_ntlmssp_state *a = NULL;
1125
1126         if (strncmp((char *)auth_info->credentials.data, "NTLMSSP", 7) != 0) {
1127                 DEBUG(0, ("Failed to read NTLMSSP in blob\n"));
1128                 goto err;
1129         }
1130
1131         /* We have an NTLMSSP blob. */
1132         status = auth_ntlmssp_start(&a);
1133         if (!NT_STATUS_IS_OK(status)) {
1134                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1135                         nt_errstr(status) ));
1136                 goto err;
1137         }
1138
1139         switch (auth_info->auth_level) {
1140         case DCERPC_AUTH_LEVEL_INTEGRITY:
1141                 auth_ntlmssp_want_sign(a);
1142                 break;
1143         case DCERPC_AUTH_LEVEL_PRIVACY:
1144                 auth_ntlmssp_want_seal(a);
1145                 break;
1146         default:
1147                 break;
1148         }
1149
1150         status = auth_ntlmssp_update(a, auth_info->credentials, response);
1151         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1152                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1153                         nt_errstr(status) ));
1154                 goto err;
1155         }
1156
1157         /* Make sure data is bound to the memctx, to be freed the caller */
1158         talloc_steal(mem_ctx, response->data);
1159
1160         p->auth.a_u.auth_ntlmssp_state = a;
1161         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1162         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1163
1164         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1165
1166         /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1167         return True;
1168
1169   err:
1170
1171         free_pipe_ntlmssp_auth_data(&p->auth);
1172         p->auth.a_u.auth_ntlmssp_state = NULL;
1173         return False;
1174 }
1175
1176 /*******************************************************************
1177  Respond to a pipe bind request.
1178 *******************************************************************/
1179
1180 bool api_pipe_bind_req(pipes_struct *p, struct ncacn_packet *pkt)
1181 {
1182         struct dcerpc_auth auth_info;
1183         uint16 assoc_gid;
1184         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1185         NTSTATUS status;
1186         struct ndr_syntax_id id;
1187         union dcerpc_payload u;
1188         struct dcerpc_ack_ctx bind_ack_ctx;
1189         DATA_BLOB auth_resp = data_blob_null;
1190         DATA_BLOB auth_blob = data_blob_null;
1191
1192         /* No rebinds on a bound pipe - use alter context. */
1193         if (p->pipe_bound) {
1194                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1195                          "pipe %s.\n",
1196                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1197                 return setup_bind_nak(p, pkt);
1198         }
1199
1200         if (pkt->u.bind.num_contexts == 0) {
1201                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1202                 goto err_exit;
1203         }
1204
1205         /*
1206          * Try and find the correct pipe name to ensure
1207          * that this is a pipe name we support.
1208          */
1209         id = pkt->u.bind.ctx_list[0].abstract_syntax;
1210         if (rpc_srv_pipe_exists_by_id(&id)) {
1211                 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1212                         rpc_srv_get_pipe_cli_name(&id),
1213                         rpc_srv_get_pipe_srv_name(&id)));
1214         } else {
1215                 status = smb_probe_module(
1216                         "rpc", get_pipe_name_from_syntax(
1217                                 talloc_tos(),
1218                                 &pkt->u.bind.ctx_list[0].abstract_syntax));
1219
1220                 if (NT_STATUS_IS_ERR(status)) {
1221                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1222                                 get_pipe_name_from_syntax(
1223                                         talloc_tos(),
1224                                         &pkt->u.bind.ctx_list[0].abstract_syntax)));
1225
1226                         return setup_bind_nak(p, pkt);
1227                 }
1228
1229                 if (rpc_srv_get_pipe_interface_by_cli_name(
1230                                 get_pipe_name_from_syntax(talloc_tos(),
1231                                                           &p->syntax),
1232                                 &id)) {
1233                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1234                                 rpc_srv_get_pipe_cli_name(&id),
1235                                 rpc_srv_get_pipe_srv_name(&id)));
1236                 } else {
1237                         DEBUG(0, ("module %s doesn't provide functions for "
1238                                   "pipe %s!\n",
1239                                   get_pipe_name_from_syntax(talloc_tos(),
1240                                                             &p->syntax),
1241                                   get_pipe_name_from_syntax(talloc_tos(),
1242                                                             &p->syntax)));
1243                         return setup_bind_nak(p, pkt);
1244                 }
1245         }
1246
1247         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1248
1249         if (pkt->u.bind.assoc_group_id != 0) {
1250                 assoc_gid = pkt->u.bind.assoc_group_id;
1251         } else {
1252                 assoc_gid = 0x53f0;
1253         }
1254
1255         /*
1256          * Create the bind response struct.
1257          */
1258
1259         /* If the requested abstract synt uuid doesn't match our client pipe,
1260                 reject the bind_ack & set the transfer interface synt to all 0's,
1261                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1262                 unknown to NT4)
1263                 Needed when adding entries to a DACL from NT5 - SK */
1264
1265         if (check_bind_req(p,
1266                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1267                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1268                         pkt->u.bind.ctx_list[0].context_id)) {
1269
1270                 bind_ack_ctx.result = 0;
1271                 bind_ack_ctx.reason = 0;
1272                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1273         } else {
1274                 p->pipe_bound = False;
1275                 /* Rejection reason: abstract syntax not supported */
1276                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1277                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1278                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1279         }
1280
1281         /*
1282          * Check if this is an authenticated bind request.
1283          */
1284         if (pkt->auth_length) {
1285                 /* Quick length check. Won't catch a bad auth footer,
1286                  * prevents overrun. */
1287
1288                 if (pkt->frag_length < RPC_HEADER_LEN +
1289                                         DCERPC_AUTH_TRAILER_LENGTH +
1290                                         pkt->auth_length) {
1291                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
1292                                 "too long for fragment %u.\n",
1293                                 (unsigned int)pkt->auth_length,
1294                                 (unsigned int)pkt->frag_length));
1295                         goto err_exit;
1296                 }
1297
1298                 /*
1299                  * Decode the authentication verifier.
1300                  */
1301                 status = dcerpc_pull_dcerpc_auth(pkt,
1302                                                  &pkt->u.bind.auth_info,
1303                                                  &auth_info, p->endian);
1304                 if (!NT_STATUS_IS_OK(status)) {
1305                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1306                         goto err_exit;
1307                 }
1308
1309                 auth_type = auth_info.auth_type;
1310
1311                 /* Work out if we have to sign or seal etc. */
1312                 switch (auth_info.auth_level) {
1313                 case DCERPC_AUTH_LEVEL_INTEGRITY:
1314                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1315                         break;
1316                 case DCERPC_AUTH_LEVEL_PRIVACY:
1317                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1318                         break;
1319                 default:
1320                         DEBUG(0, ("Unexpected auth level (%u).\n",
1321                                 (unsigned int)auth_info.auth_level ));
1322                         goto err_exit;
1323                 }
1324
1325                 switch (auth_type) {
1326                 case DCERPC_AUTH_TYPE_NTLMSSP:
1327                         if (!pipe_ntlmssp_auth_bind(p, pkt,
1328                                                 &auth_info, &auth_resp)) {
1329                                 goto err_exit;
1330                         }
1331                         assoc_gid = 0x7a77;
1332                         break;
1333
1334                 case DCERPC_AUTH_TYPE_SCHANNEL:
1335                         if (!pipe_schannel_auth_bind(p, pkt,
1336                                                 &auth_info, &auth_resp)) {
1337                                 goto err_exit;
1338                         }
1339                         break;
1340
1341                 case DCERPC_AUTH_TYPE_SPNEGO:
1342                         if (!pipe_spnego_auth_bind_negotiate(p, pkt,
1343                                                 &auth_info, &auth_resp)) {
1344                                 goto err_exit;
1345                         }
1346                         break;
1347
1348                 case DCERPC_AUTH_TYPE_NONE:
1349                         break;
1350
1351                 default:
1352                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
1353                         goto err_exit;
1354                 }
1355         }
1356
1357         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
1358                 /* Unauthenticated bind request. */
1359                 /* We're finished - no more packets. */
1360                 p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1361                 /* We must set the pipe auth_level here also. */
1362                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1363                 p->pipe_bound = True;
1364                 /* The session key was initialized from the SMB
1365                  * session in make_internal_rpc_pipe_p */
1366         }
1367
1368         ZERO_STRUCT(u.bind_ack);
1369         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1370         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1371         u.bind_ack.assoc_group_id = assoc_gid;
1372
1373         /* name has to be \PIPE\xxxxx */
1374         u.bind_ack.secondary_address =
1375                         talloc_asprintf(pkt, "\\PIPE\\%s",
1376                                         rpc_srv_get_pipe_srv_name(&id));
1377         if (!u.bind_ack.secondary_address) {
1378                 DEBUG(0, ("Out of memory!\n"));
1379                 goto err_exit;
1380         }
1381         u.bind_ack.secondary_address_size =
1382                                 strlen(u.bind_ack.secondary_address) + 1;
1383
1384         u.bind_ack.num_results = 1;
1385         u.bind_ack.ctx_list = &bind_ack_ctx;
1386
1387         /* NOTE: We leave the auth_info empty so we can calculate the padding
1388          * later and then append the auth_info --simo */
1389
1390         /*
1391          * Marshall directly into the outgoing PDU space. We
1392          * must do this as we need to set to the bind response
1393          * header and are never sending more than one PDU here.
1394          */
1395
1396         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1397                                           DCERPC_PKT_BIND_ACK,
1398                                           DCERPC_PFC_FLAG_FIRST |
1399                                                 DCERPC_PFC_FLAG_LAST,
1400                                           auth_resp.length,
1401                                           pkt->call_id,
1402                                           &u,
1403                                           &p->out_data.frag);
1404         if (!NT_STATUS_IS_OK(status)) {
1405                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1406                           nt_errstr(status)));
1407         }
1408
1409         if (auth_resp.length) {
1410
1411                 status = dcerpc_push_dcerpc_auth(pkt,
1412                                                  auth_type,
1413                                                  auth_info.auth_level,
1414                                                  0,
1415                                                  1, /* auth_context_id */
1416                                                  &auth_resp,
1417                                                  &auth_blob);
1418                 if (!NT_STATUS_IS_OK(status)) {
1419                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1420                         goto err_exit;
1421                 }
1422         }
1423
1424         /* Now that we have the auth len store it into the right place in
1425          * the dcerpc header */
1426         dcerpc_set_frag_length(&p->out_data.frag,
1427                                 p->out_data.frag.length + auth_blob.length);
1428
1429         if (auth_blob.length) {
1430
1431                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1432                                         auth_blob.data, auth_blob.length)) {
1433                         DEBUG(0, ("Append of auth info failed.\n"));
1434                         goto err_exit;
1435                 }
1436         }
1437
1438         /*
1439          * Setup the lengths for the initial reply.
1440          */
1441
1442         p->out_data.data_sent_length = 0;
1443         p->out_data.current_pdu_sent = 0;
1444
1445         TALLOC_FREE(auth_blob.data);
1446         return True;
1447
1448   err_exit:
1449
1450         data_blob_free(&p->out_data.frag);
1451         TALLOC_FREE(auth_blob.data);
1452         return setup_bind_nak(p, pkt);
1453 }
1454
1455 /****************************************************************************
1456  Deal with an alter context call. Can be third part of 3 leg auth request for
1457  SPNEGO calls.
1458 ****************************************************************************/
1459
1460 bool api_pipe_alter_context(pipes_struct *p, struct ncacn_packet *pkt)
1461 {
1462         struct dcerpc_auth auth_info;
1463         uint16 assoc_gid;
1464         NTSTATUS status;
1465         union dcerpc_payload u;
1466         struct dcerpc_ack_ctx bind_ack_ctx;
1467         DATA_BLOB auth_resp = data_blob_null;
1468         DATA_BLOB auth_blob = data_blob_null;
1469         int pad_len = 0;
1470
1471         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1472
1473         if (pkt->u.bind.assoc_group_id != 0) {
1474                 assoc_gid = pkt->u.bind.assoc_group_id;
1475         } else {
1476                 assoc_gid = 0x53f0;
1477         }
1478
1479         /*
1480          * Create the bind response struct.
1481          */
1482
1483         /* If the requested abstract synt uuid doesn't match our client pipe,
1484                 reject the bind_ack & set the transfer interface synt to all 0's,
1485                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1486                 unknown to NT4)
1487                 Needed when adding entries to a DACL from NT5 - SK */
1488
1489         if (check_bind_req(p,
1490                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1491                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1492                         pkt->u.bind.ctx_list[0].context_id)) {
1493
1494                 bind_ack_ctx.result = 0;
1495                 bind_ack_ctx.reason = 0;
1496                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1497         } else {
1498                 p->pipe_bound = False;
1499                 /* Rejection reason: abstract syntax not supported */
1500                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1501                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1502                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1503         }
1504
1505         /*
1506          * Check if this is an authenticated alter context request.
1507          */
1508         if (pkt->auth_length) {
1509                 /* Quick length check. Won't catch a bad auth footer,
1510                  * prevents overrun. */
1511
1512                 if (pkt->frag_length < RPC_HEADER_LEN +
1513                                         DCERPC_AUTH_TRAILER_LENGTH +
1514                                         pkt->auth_length) {
1515                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1516                                 "too long for fragment %u.\n",
1517                                 (unsigned int)pkt->auth_length,
1518                                 (unsigned int)pkt->frag_length ));
1519                         goto err_exit;
1520                 }
1521
1522                 status = dcerpc_pull_dcerpc_auth(pkt,
1523                                                  &pkt->u.bind.auth_info,
1524                                                  &auth_info, p->endian);
1525                 if (!NT_STATUS_IS_OK(status)) {
1526                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1527                         goto err_exit;
1528                 }
1529
1530
1531                 /*
1532                  * Currently only the SPNEGO auth type uses the alter ctx
1533                  * response in place of the NTLMSSP auth3 type.
1534                  */
1535
1536                 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
1537                         /* We can only finish if the pipe is unbound. */
1538                         if (!p->pipe_bound) {
1539                                 if (!pipe_spnego_auth_bind_continue(p, pkt,
1540                                                 &auth_info, &auth_resp)) {
1541                                         goto err_exit;
1542                                 }
1543
1544                         } else {
1545                                 goto err_exit;
1546                         }
1547                 }
1548         }
1549
1550         ZERO_STRUCT(u.alter_resp);
1551         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1552         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1553         u.alter_resp.assoc_group_id = assoc_gid;
1554
1555         /* secondary address CAN be NULL
1556          * as the specs say it's ignored.
1557          * It MUST be NULL to have the spoolss working.
1558          */
1559         u.alter_resp.secondary_address = "";
1560         u.alter_resp.secondary_address_size = 1;
1561
1562         u.alter_resp.num_results = 1;
1563         u.alter_resp.ctx_list = &bind_ack_ctx;
1564
1565         /* NOTE: We leave the auth_info empty so we can calculate the padding
1566          * later and then append the auth_info --simo */
1567
1568         /*
1569          * Marshall directly into the outgoing PDU space. We
1570          * must do this as we need to set to the bind response
1571          * header and are never sending more than one PDU here.
1572          */
1573
1574         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1575                                           DCERPC_PKT_ALTER_RESP,
1576                                           DCERPC_PFC_FLAG_FIRST |
1577                                                 DCERPC_PFC_FLAG_LAST,
1578                                           auth_resp.length,
1579                                           pkt->call_id,
1580                                           &u,
1581                                           &p->out_data.frag);
1582         if (!NT_STATUS_IS_OK(status)) {
1583                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1584                           nt_errstr(status)));
1585         }
1586
1587         if (auth_resp.length) {
1588
1589                 /* Work out any padding needed before the auth footer. */
1590                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1591                 if (pad_len) {
1592                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1593                         DEBUG(10, ("auth pad_len = %u\n",
1594                                    (unsigned int)pad_len));
1595                 }
1596
1597                 status = dcerpc_push_dcerpc_auth(pkt,
1598                                                  auth_info.auth_type,
1599                                                  auth_info.auth_level,
1600                                                  pad_len,
1601                                                  1, /* auth_context_id */
1602                                                  &auth_resp,
1603                                                  &auth_blob);
1604                 if (!NT_STATUS_IS_OK(status)) {
1605                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1606                         goto err_exit;
1607                 }
1608         }
1609
1610         /* Now that we have the auth len store it into the right place in
1611          * the dcerpc header */
1612         dcerpc_set_frag_length(&p->out_data.frag,
1613                                 p->out_data.frag.length +
1614                                         pad_len + auth_blob.length);
1615
1616         if (auth_resp.length) {
1617                 if (pad_len) {
1618                         char pad[SERVER_NDR_PADDING_SIZE];
1619                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1620                         if (!data_blob_append(p->mem_ctx,
1621                                                 &p->out_data.frag,
1622                                                 pad, pad_len)) {
1623                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1624                                           "%u bytes of pad data.\n",
1625                                           (unsigned int)pad_len));
1626                                 goto err_exit;
1627                         }
1628                 }
1629
1630                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1631                                         auth_blob.data, auth_blob.length)) {
1632                         DEBUG(0, ("Append of auth info failed.\n"));
1633                         goto err_exit;
1634                 }
1635         }
1636
1637         /*
1638          * Setup the lengths for the initial reply.
1639          */
1640
1641         p->out_data.data_sent_length = 0;
1642         p->out_data.current_pdu_sent = 0;
1643
1644         TALLOC_FREE(auth_blob.data);
1645         return True;
1646
1647   err_exit:
1648
1649         data_blob_free(&p->out_data.frag);
1650         TALLOC_FREE(auth_blob.data);
1651         return setup_bind_nak(p, pkt);
1652 }
1653
1654 /****************************************************************************
1655  Find the set of RPC functions associated with this context_id
1656 ****************************************************************************/
1657
1658 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
1659 {
1660         PIPE_RPC_FNS *fns = NULL;
1661
1662         if ( !list ) {
1663                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
1664                 return NULL;
1665         }
1666
1667         for (fns=list; fns; fns=fns->next ) {
1668                 if ( fns->context_id == context_id )
1669                         return fns;
1670         }
1671         return NULL;
1672 }
1673
1674 /****************************************************************************
1675  Memory cleanup.
1676 ****************************************************************************/
1677
1678 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
1679 {
1680         PIPE_RPC_FNS *tmp = list;
1681         PIPE_RPC_FNS *tmp2;
1682
1683         while (tmp) {
1684                 tmp2 = tmp->next;
1685                 SAFE_FREE(tmp);
1686                 tmp = tmp2;
1687         }
1688
1689         return;
1690 }
1691
1692 static bool api_rpcTNP(pipes_struct *p, struct ncacn_packet *pkt,
1693                        const struct api_struct *api_rpc_cmds, int n_cmds);
1694
1695 /****************************************************************************
1696  Find the correct RPC function to call for this request.
1697  If the pipe is authenticated then become the correct UNIX user
1698  before doing the call.
1699 ****************************************************************************/
1700
1701 bool api_pipe_request(pipes_struct *p, struct ncacn_packet *pkt)
1702 {
1703         bool ret = False;
1704         bool changed_user = False;
1705         PIPE_RPC_FNS *pipe_fns;
1706
1707         if (p->pipe_bound &&
1708                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
1709                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
1710                 if(!become_authenticated_pipe_user(p)) {
1711                         data_blob_free(&p->out_data.rdata);
1712                         return False;
1713                 }
1714                 changed_user = True;
1715         }
1716
1717         DEBUG(5, ("Requested \\PIPE\\%s\n",
1718                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1719
1720         /* get the set of RPC functions for this context */
1721
1722         pipe_fns = find_pipe_fns_by_context(p->contexts,
1723                                             pkt->u.request.context_id);
1724
1725         if ( pipe_fns ) {
1726                 TALLOC_CTX *frame = talloc_stackframe();
1727                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds);
1728                 TALLOC_FREE(frame);
1729         }
1730         else {
1731                 DEBUG(0, ("No rpc function table associated with context "
1732                           "[%d] on pipe [%s]\n",
1733                           pkt->u.request.context_id,
1734                           get_pipe_name_from_syntax(talloc_tos(),
1735                                                     &p->syntax)));
1736         }
1737
1738         if (changed_user) {
1739                 unbecome_authenticated_pipe_user();
1740         }
1741
1742         return ret;
1743 }
1744
1745 /*******************************************************************
1746  Calls the underlying RPC function for a named pipe.
1747  ********************************************************************/
1748
1749 static bool api_rpcTNP(pipes_struct *p, struct ncacn_packet *pkt,
1750                        const struct api_struct *api_rpc_cmds, int n_cmds)
1751 {
1752         int fn_num;
1753         uint32_t offset1;
1754
1755         /* interpret the command */
1756         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1757                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1758                  pkt->u.request.opnum));
1759
1760         if (DEBUGLEVEL >= 50) {
1761                 fstring name;
1762                 slprintf(name, sizeof(name)-1, "in_%s",
1763                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1764                 dump_pdu_region(name, pkt->u.request.opnum,
1765                                 &p->in_data.data, 0,
1766                                 p->in_data.data.length);
1767         }
1768
1769         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1770                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1771                     api_rpc_cmds[fn_num].fn != NULL) {
1772                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1773                                   api_rpc_cmds[fn_num].name));
1774                         break;
1775                 }
1776         }
1777
1778         if (fn_num == n_cmds) {
1779                 /*
1780                  * For an unknown RPC just return a fault PDU but
1781                  * return True to allow RPC's on the pipe to continue
1782                  * and not put the pipe into fault state. JRA.
1783                  */
1784                 DEBUG(4, ("unknown\n"));
1785                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1786                 return True;
1787         }
1788
1789         offset1 = p->out_data.rdata.length;
1790
1791         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1792                 fn_num, api_rpc_cmds[fn_num].fn));
1793         /* do the actual command */
1794         if(!api_rpc_cmds[fn_num].fn(p)) {
1795                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1796                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1797                          api_rpc_cmds[fn_num].name));
1798                 data_blob_free(&p->out_data.rdata);
1799                 return False;
1800         }
1801
1802         if (p->bad_handle_fault_state) {
1803                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1804                 p->bad_handle_fault_state = False;
1805                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
1806                 return True;
1807         }
1808
1809         if (p->rng_fault_state) {
1810                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
1811                 p->rng_fault_state = False;
1812                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1813                 return True;
1814         }
1815
1816         if (DEBUGLEVEL >= 50) {
1817                 fstring name;
1818                 slprintf(name, sizeof(name)-1, "out_%s",
1819                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1820                 dump_pdu_region(name, pkt->u.request.opnum,
1821                                 &p->out_data.rdata, offset1,
1822                                 p->out_data.rdata.length);
1823         }
1824
1825         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1826                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1827
1828         /* Check for buffer underflow in rpc parsing */
1829         if ((DEBUGLEVEL >= 10) &&
1830             (pkt->frag_length < p->in_data.data.length)) {
1831                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1832                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1833                               p->in_data.data.length - pkt->frag_length);
1834         }
1835
1836         return True;
1837 }
1838
1839 /****************************************************************************
1840  Initialise an outgoing packet.
1841 ****************************************************************************/
1842
1843 static bool pipe_init_outgoing_data(pipes_struct *p)
1844 {
1845         output_data *o_data = &p->out_data;
1846
1847         /* Reset the offset counters. */
1848         o_data->data_sent_length = 0;
1849         o_data->current_pdu_sent = 0;
1850
1851         data_blob_free(&o_data->frag);
1852
1853         /* Free any memory in the current return data buffer. */
1854         data_blob_free(&o_data->rdata);
1855
1856         return True;
1857 }
1858
1859 /****************************************************************************
1860  Sets the fault state on incoming packets.
1861 ****************************************************************************/
1862
1863 void set_incoming_fault(pipes_struct *p)
1864 {
1865         data_blob_free(&p->in_data.data);
1866         p->in_data.pdu_needed_len = 0;
1867         p->in_data.pdu.length = 0;
1868         p->fault_state = True;
1869         DEBUG(10, ("set_incoming_fault: Setting fault state on pipe %s\n",
1870                    get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1871 }
1872
1873 static bool dcesrv_auth_request(pipes_struct *p, struct ncacn_packet *pkt)
1874 {
1875         NTSTATUS status;
1876         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1877         struct dcerpc_auth auth;
1878         uint32_t auth_length;
1879         DATA_BLOB data;
1880         DATA_BLOB full_pkt;
1881
1882         DEBUG(10, ("Checking request auth.\n"));
1883
1884         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1885                 hdr_size += 16;
1886         }
1887
1888         switch (p->auth.auth_level) {
1889         case DCERPC_AUTH_LEVEL_PRIVACY:
1890                 DEBUG(10, ("Requested Privacy.\n"));
1891                 break;
1892
1893         case DCERPC_AUTH_LEVEL_INTEGRITY:
1894                 DEBUG(10, ("Requested Integrity.\n"));
1895                 break;
1896
1897         case DCERPC_AUTH_LEVEL_CONNECT:
1898                 if (pkt->auth_length != 0) {
1899                         break;
1900                 }
1901                 return true;
1902         case DCERPC_AUTH_LEVEL_NONE:
1903                 if (pkt->auth_length != 0) {
1904                         return false;
1905                 }
1906                 return true;
1907
1908         default:
1909                 return false;
1910         }
1911
1912         status = dcerpc_pull_auth_trailer(pkt, pkt,
1913                                           &pkt->u.request.stub_and_verifier,
1914                                           &auth, &auth_length, false);
1915         if (!NT_STATUS_IS_OK(status)) {
1916                 return false;
1917         }
1918
1919         pkt->u.request.stub_and_verifier.length -= auth_length;
1920
1921         data.data = p->in_data.pdu.data + hdr_size;
1922         data.length = pkt->u.request.stub_and_verifier.length;
1923         full_pkt.data = p->in_data.pdu.data;
1924         full_pkt.length = p->in_data.pdu.length - auth.credentials.length;
1925
1926         switch (p->auth.auth_type) {
1927         case PIPE_AUTH_TYPE_NONE:
1928                 return true;
1929
1930         case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
1931         case PIPE_AUTH_TYPE_NTLMSSP:
1932
1933                 DEBUG(10, ("NTLMSSP auth\n"));
1934
1935                 if (!p->auth.a_u.auth_ntlmssp_state) {
1936                         DEBUG(0, ("Invalid auth level, "
1937                                   "failed to process packet auth.\n"));
1938                         return false;
1939                 }
1940
1941                 switch (p->auth.auth_level) {
1942                 case DCERPC_AUTH_LEVEL_PRIVACY:
1943                         status = auth_ntlmssp_unseal_packet(
1944                                         p->auth.a_u.auth_ntlmssp_state,
1945                                         data.data, data.length,
1946                                         full_pkt.data, full_pkt.length,
1947                                         &auth.credentials);
1948                         if (!NT_STATUS_IS_OK(status)) {
1949                                 return false;
1950                         }
1951                         memcpy(pkt->u.request.stub_and_verifier.data,
1952                                 data.data, data.length);
1953                         break;
1954
1955                 case DCERPC_AUTH_LEVEL_INTEGRITY:
1956                         status = auth_ntlmssp_check_packet(
1957                                         p->auth.a_u.auth_ntlmssp_state,
1958                                         data.data, data.length,
1959                                         full_pkt.data, full_pkt.length,
1960                                         &auth.credentials);
1961                         if (!NT_STATUS_IS_OK(status)) {
1962                                 return false;
1963                         }
1964                         break;
1965
1966                 default:
1967                         DEBUG(0, ("Invalid auth level, "
1968                                   "failed to process packet auth.\n"));
1969                         return false;
1970                 }
1971                 break;
1972
1973         case PIPE_AUTH_TYPE_SCHANNEL:
1974
1975                 DEBUG(10, ("SCHANNEL auth\n"));
1976
1977                 switch (p->auth.auth_level) {
1978                 case DCERPC_AUTH_LEVEL_PRIVACY:
1979                         status = netsec_incoming_packet(
1980                                         p->auth.a_u.schannel_auth,
1981                                         pkt, true,
1982                                         data.data, data.length,
1983                                         &auth.credentials);
1984                         if (!NT_STATUS_IS_OK(status)) {
1985                                 return false;
1986                         }
1987                         memcpy(pkt->u.request.stub_and_verifier.data,
1988                                 data.data, data.length);
1989                         break;
1990
1991                 case DCERPC_AUTH_LEVEL_INTEGRITY:
1992                         status = netsec_incoming_packet(
1993                                         p->auth.a_u.schannel_auth,
1994                                         pkt, false,
1995                                         data.data, data.length,
1996                                         &auth.credentials);
1997                         if (!NT_STATUS_IS_OK(status)) {
1998                                 return false;
1999                         }
2000                         break;
2001
2002                 default:
2003                         DEBUG(0, ("Invalid auth level, "
2004                                   "failed to process packet auth.\n"));
2005                         return false;
2006                 }
2007                 break;
2008
2009         default:
2010                 DEBUG(0, ("process_request_pdu: "
2011                           "unknown auth type %u set.\n",
2012                           (unsigned int)p->auth.auth_type));
2013                 set_incoming_fault(p);
2014                 return false;
2015         }
2016
2017         /* remove the indicated amount of padding */
2018         if (pkt->u.request.stub_and_verifier.length < auth.auth_pad_length) {
2019                 return false;
2020         }
2021         pkt->u.request.stub_and_verifier.length -= auth.auth_pad_length;
2022
2023         return true;
2024 }
2025
2026 /****************************************************************************
2027  Processes a request pdu. This will do auth processing if needed, and
2028  appends the data into the complete stream if the LAST flag is not set.
2029 ****************************************************************************/
2030
2031 static bool process_request_pdu(pipes_struct *p, struct ncacn_packet *pkt)
2032 {
2033         DATA_BLOB data;
2034
2035         if (!p->pipe_bound) {
2036                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
2037                 set_incoming_fault(p);
2038                 return False;
2039         }
2040
2041         /* Store the opnum */
2042         p->opnum = pkt->u.request.opnum;
2043
2044         if (!dcesrv_auth_request(p, pkt)) {
2045                 DEBUG(0,("Failed to check packet auth.\n"));
2046                 set_incoming_fault(p);
2047                 return false;
2048         }
2049
2050         data = pkt->u.request.stub_and_verifier;
2051
2052         /*
2053          * Check the data length doesn't go over the 15Mb limit.
2054          * increased after observing a bug in the Windows NT 4.0 SP6a
2055          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
2056          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
2057          */
2058
2059         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
2060                 DEBUG(0, ("process_request_pdu: "
2061                           "rpc data buffer too large (%u) + (%u)\n",
2062                           (unsigned int)p->in_data.data.length,
2063                           (unsigned int)data.length));
2064                 set_incoming_fault(p);
2065                 return False;
2066         }
2067
2068         /*
2069          * Append the data portion into the buffer and return.
2070          */
2071
2072         if (data.length) {
2073                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
2074                                           data.data, data.length)) {
2075                         DEBUG(0, ("Unable to append data size %u "
2076                                   "to parse buffer of size %u.\n",
2077                                   (unsigned int)data.length,
2078                                   (unsigned int)p->in_data.data.length));
2079                         set_incoming_fault(p);
2080                         return False;
2081                 }
2082         }
2083
2084         if (pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
2085                 bool ret = False;
2086                 /*
2087                  * Ok - we finally have a complete RPC stream.
2088                  * Call the rpc command to process it.
2089                  */
2090
2091                 /*
2092                  * Process the complete data stream here.
2093                  */
2094                 if (pipe_init_outgoing_data(p)) {
2095                         ret = api_pipe_request(p, pkt);
2096                 }
2097
2098                 return ret;
2099         }
2100
2101         return True;
2102 }
2103
2104 /****************************************************************************
2105  Processes a finished PDU stored in p->in_data.pdu.
2106 ****************************************************************************/
2107
2108 void process_complete_pdu(pipes_struct *p)
2109 {
2110         struct ncacn_packet *pkt = NULL;
2111         NTSTATUS status;
2112         bool reply = False;
2113
2114         if(p->fault_state) {
2115                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
2116                           get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2117                 goto done;
2118         }
2119
2120         pkt = talloc(p->mem_ctx, struct ncacn_packet);
2121         if (!pkt) {
2122                 DEBUG(0, ("Out of memory!\n"));
2123                 goto done;
2124         }
2125
2126         /*
2127          * Ensure we're using the corrent endianness for both the
2128          * RPC header flags and the raw data we will be reading from.
2129          */
2130         if (dcerpc_get_endian_flag(&p->in_data.pdu) & DCERPC_DREP_LE) {
2131                 p->endian = RPC_LITTLE_ENDIAN;
2132         } else {
2133                 p->endian = RPC_BIG_ENDIAN;
2134         }
2135         DEBUG(10, ("PDU is in %s Endian format!\n", p->endian?"Big":"Little"));
2136
2137         status = dcerpc_pull_ncacn_packet(pkt, &p->in_data.pdu,
2138                                           pkt, p->endian);
2139         if (!NT_STATUS_IS_OK(status)) {
2140                 DEBUG(0, ("Failed to unmarshal rpc packet: %s!\n",
2141                           nt_errstr(status)));
2142                 goto done;
2143         }
2144
2145         /* Store the call_id */
2146         p->call_id = pkt->call_id;
2147
2148         DEBUG(10, ("Processing packet type %d\n", (int)pkt->ptype));
2149
2150         switch (pkt->ptype) {
2151         case DCERPC_PKT_REQUEST:
2152                 reply = process_request_pdu(p, pkt);
2153                 break;
2154
2155         case DCERPC_PKT_PING: /* CL request - ignore... */
2156                 DEBUG(0, ("process_complete_pdu: Error. "
2157                           "Connectionless packet type %d received on "
2158                           "pipe %s.\n", (int)pkt->ptype,
2159                          get_pipe_name_from_syntax(talloc_tos(),
2160                                                    &p->syntax)));
2161                 break;
2162
2163         case DCERPC_PKT_RESPONSE: /* No responses here. */
2164                 DEBUG(0, ("process_complete_pdu: Error. "
2165                           "DCERPC_PKT_RESPONSE received from client "
2166                           "on pipe %s.\n",
2167                          get_pipe_name_from_syntax(talloc_tos(),
2168                                                    &p->syntax)));
2169                 break;
2170
2171         case DCERPC_PKT_FAULT:
2172         case DCERPC_PKT_WORKING:
2173                 /* CL request - reply to a ping when a call in process. */
2174         case DCERPC_PKT_NOCALL:
2175                 /* CL - server reply to a ping call. */
2176         case DCERPC_PKT_REJECT:
2177         case DCERPC_PKT_ACK:
2178         case DCERPC_PKT_CL_CANCEL:
2179         case DCERPC_PKT_FACK:
2180         case DCERPC_PKT_CANCEL_ACK:
2181                 DEBUG(0, ("process_complete_pdu: Error. "
2182                           "Connectionless packet type %u received on "
2183                           "pipe %s.\n", (unsigned int)pkt->ptype,
2184                          get_pipe_name_from_syntax(talloc_tos(),
2185                                                    &p->syntax)));
2186                 break;
2187
2188         case DCERPC_PKT_BIND:
2189                 /*
2190                  * We assume that a pipe bind is only in one pdu.
2191                  */
2192                 if (pipe_init_outgoing_data(p)) {
2193                         reply = api_pipe_bind_req(p, pkt);
2194                 }
2195                 break;
2196
2197         case DCERPC_PKT_BIND_ACK:
2198         case DCERPC_PKT_BIND_NAK:
2199                 DEBUG(0, ("process_complete_pdu: Error. "
2200                           "DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
2201                           "packet type %u received on pipe %s.\n",
2202                           (unsigned int)pkt->ptype,
2203                          get_pipe_name_from_syntax(talloc_tos(),
2204                                                    &p->syntax)));
2205                 break;
2206
2207
2208         case DCERPC_PKT_ALTER:
2209                 /*
2210                  * We assume that a pipe bind is only in one pdu.
2211                  */
2212                 if (pipe_init_outgoing_data(p)) {
2213                         reply = api_pipe_alter_context(p, pkt);
2214                 }
2215                 break;
2216
2217         case DCERPC_PKT_ALTER_RESP:
2218                 DEBUG(0, ("process_complete_pdu: Error. "
2219                           "DCERPC_PKT_ALTER_RESP on pipe %s: "
2220                           "Should only be server -> client.\n",
2221                          get_pipe_name_from_syntax(talloc_tos(),
2222                                                    &p->syntax)));
2223                 break;
2224
2225         case DCERPC_PKT_AUTH3:
2226                 /*
2227                  * The third packet in an NTLMSSP auth exchange.
2228                  */
2229                 if (pipe_init_outgoing_data(p)) {
2230                         reply = api_pipe_bind_auth3(p, pkt);
2231                 }
2232                 break;
2233
2234         case DCERPC_PKT_SHUTDOWN:
2235                 DEBUG(0, ("process_complete_pdu: Error. "
2236                           "DCERPC_PKT_SHUTDOWN on pipe %s: "
2237                           "Should only be server -> client.\n",
2238                          get_pipe_name_from_syntax(talloc_tos(),
2239                                                    &p->syntax)));
2240                 break;
2241
2242         case DCERPC_PKT_CO_CANCEL:
2243                 /* For now just free all client data and continue
2244                  * processing. */
2245                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
2246                          " Abandoning rpc call.\n"));
2247                 /* As we never do asynchronous RPC serving, we can
2248                  * never cancel a call (as far as I know).
2249                  * If we ever did we'd have to send a cancel_ack reply.
2250                  * For now, just free all client data and continue
2251                  * processing. */
2252                 reply = True;
2253                 break;
2254
2255 #if 0
2256                 /* Enable this if we're doing async rpc. */
2257                 /* We must check the outstanding callid matches. */
2258                 if (pipe_init_outgoing_data(p)) {
2259                         /* Send a cancel_ack PDU reply. */
2260                         /* We should probably check the auth-verifier here. */
2261                         reply = setup_cancel_ack_reply(p, pkt);
2262                 }
2263                 break;
2264 #endif
2265
2266         case DCERPC_PKT_ORPHANED:
2267                 /* We should probably check the auth-verifier here.
2268                  * For now just free all client data and continue
2269                  * processing. */
2270                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
2271                           " Abandoning rpc call.\n"));
2272                 reply = True;
2273                 break;
2274
2275         default:
2276                 DEBUG(0, ("process_complete_pdu: "
2277                           "Unknown rpc type = %u received.\n",
2278                           (unsigned int)pkt->ptype));
2279                 break;
2280         }
2281
2282 done:
2283         if (!reply) {
2284                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on "
2285                          "pipe %s\n", get_pipe_name_from_syntax(talloc_tos(),
2286                                                                 &p->syntax)));
2287                 set_incoming_fault(p);
2288                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2289                 TALLOC_FREE(pkt);
2290         } else {
2291                 /*
2292                  * Reset the lengths. We're ready for a new pdu.
2293                  */
2294                 TALLOC_FREE(p->in_data.pdu.data);
2295                 p->in_data.pdu_needed_len = 0;
2296                 p->in_data.pdu.length = 0;
2297         }
2298
2299         TALLOC_FREE(pkt);
2300 }
2301