source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "srv_pipe_internal.h"
  32 #include "../librpc/gen_ndr/ndr_schannel.h"
  33 #include "../libcli/auth/schannel.h"
  34 #include "../libcli/auth/spnego.h"
  35 #include "../libcli/auth/ntlmssp.h"
  36
  37 #undef DBGC_CLASS
  38 #define DBGC_CLASS DBGC_RPC_SRV
  39
  40 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  41 {
  42         struct auth_ntlmssp_state *a = auth->a_u.auth_ntlmssp_state;
  43
  44         if (a) {
  45                 auth_ntlmssp_end(&a);
  46         }
  47         auth->a_u.auth_ntlmssp_state = NULL;
  48 }
  49
  50 static DATA_BLOB generic_session_key(void)
  51 {
  52         return data_blob("SystemLibraryDTC", 16);
  53 }
  54
  55 /*******************************************************************
  56  Generate the next PDU to be returned from the data in p->rdata.
  57  Handle NTLMSSP.
  58  ********************************************************************/
  59
  60 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  61 {
  62         RPC_HDR_RESP hdr_resp;
  63         uint32 ss_padding_len = 0;
  64         uint32 data_space_available;
  65         uint32 data_len_left;
  66         uint32 data_len;
  67         NTSTATUS status;
  68         DATA_BLOB auth_blob;
  69         RPC_HDR_AUTH auth_info;
  70         uint8 auth_type, auth_level;
  71         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
  72         TALLOC_CTX *frame;
  73
  74         /*
  75          * If we're in the fault state, keep returning fault PDU's until
  76          * the pipe gets closed. JRA.
  77          */
  78
  79         if(p->fault_state) {
  80                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  81                 return True;
  82         }
  83
  84         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  85
  86         /* Change the incoming request header to a response. */
  87         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
  88
  89         /* Set up rpc header flags. */
  90         if (p->out_data.data_sent_length == 0) {
  91                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
  92         } else {
  93                 p->hdr.flags = 0;
  94         }
  95
  96         /*
  97          * Work out how much we can fit in a single PDU.
  98          */
  99
 100         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 101
 102         /*
 103          * Ensure there really is data left to send.
 104          */
 105
 106         if(!data_len_left) {
 107                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 108                 return False;
 109         }
 110
 111         /* Space available - not including padding. */
 112         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN -
 113                 RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 114
 115         /*
 116          * The amount we send is the minimum of the available
 117          * space and the amount left to send.
 118          */
 119
 120         data_len = MIN(data_len_left, data_space_available);
 121
 122         /* Work out any padding alignment requirements. */
 123         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 124                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 125                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 126                 DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 127                         ss_padding_len ));
 128                 /* If we're over filling the packet, we need to make space
 129                  * for the padding at the end of the data. */
 130                 if (data_len + ss_padding_len > data_space_available) {
 131                         data_len -= SERVER_NDR_PADDING_SIZE;
 132                 }
 133         }
 134
 135         /*
 136          * Set up the alloc hint. This should be the data left to
 137          * send.
 138          */
 139
 140         hdr_resp.alloc_hint = data_len_left;
 141
 142         /*
 143          * Work out if this PDU will be the last.
 144          */
 145
 146         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 147                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 148         }
 149
 150         /*
 151          * Set up the header lengths.
 152          */
 153
 154         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 155                         data_len + ss_padding_len +
 156                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 157         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 158
 159
 160         /*
 161          * Init the parse struct to point at the outgoing
 162          * data.
 163          */
 164
 165         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 166
 167         /* Store the header in the data stream. */
 168         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 169                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 170                 prs_mem_free(&p->out_data.frag);
 171                 return False;
 172         }
 173
 174         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 175                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 176                 prs_mem_free(&p->out_data.frag);
 177                 return False;
 178         }
 179
 180         /* Copy the data into the PDU. */
 181
 182         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 183                                      p->out_data.data_sent_length, data_len)) {
 184                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 185                 prs_mem_free(&p->out_data.frag);
 186                 return False;
 187         }
 188
 189         /* Copy the sign/seal padding data. */
 190         if (ss_padding_len) {
 191                 char pad[SERVER_NDR_PADDING_SIZE];
 192
 193                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 194                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 195                                       ss_padding_len)) {
 196                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 197                                         (unsigned int)ss_padding_len));
 198                         prs_mem_free(&p->out_data.frag);
 199                         return False;
 200                 }
 201         }
 202
 203
 204         /* Now write out the auth header and null blob. */
 205         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 206                 auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 207         } else {
 208                 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 209         }
 210         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 211                 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 212         } else {
 213                 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 214         }
 215
 216         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 217
 218         if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 219                                 &p->out_data.frag, 0)) {
 220                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 221                 prs_mem_free(&p->out_data.frag);
 222                 return False;
 223         }
 224
 225         /* Generate the sign blob. */
 226
 227         frame = talloc_stackframe();
 228         switch (p->auth.auth_level) {
 229                 case DCERPC_AUTH_LEVEL_PRIVACY:
 230                         /* Data portion is encrypted. */
 231                         status = auth_ntlmssp_seal_packet(
 232                                 a, frame,
 233                                 (uint8_t *)prs_data_p(&p->out_data.frag)
 234                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 235                                 data_len + ss_padding_len,
 236                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 237                                 (size_t)prs_offset(&p->out_data.frag),
 238                                 &auth_blob);
 239                         if (!NT_STATUS_IS_OK(status)) {
 240                                 talloc_free(frame);
 241                                 prs_mem_free(&p->out_data.frag);
 242                                 return False;
 243                         }
 244                         break;
 245                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 246                         /* Data is signed. */
 247                         status = auth_ntlmssp_sign_packet(
 248                                 a, frame,
 249                                 (unsigned char *)prs_data_p(&p->out_data.frag)
 250                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 251                                 data_len + ss_padding_len,
 252                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 253                                 (size_t)prs_offset(&p->out_data.frag),
 254                                 &auth_blob);
 255                         if (!NT_STATUS_IS_OK(status)) {
 256                                 talloc_free(frame);
 257                                 prs_mem_free(&p->out_data.frag);
 258                                 return False;
 259                         }
 260                         break;
 261                 default:
 262                         talloc_free(frame);
 263                         prs_mem_free(&p->out_data.frag);
 264                         return False;
 265         }
 266
 267         /* Append the auth blob. */
 268         if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
 269                               NTLMSSP_SIG_SIZE)) {
 270                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 271                                 (unsigned int)NTLMSSP_SIG_SIZE));
 272                 talloc_free(frame);
 273                 prs_mem_free(&p->out_data.frag);
 274                 return False;
 275         }
 276         talloc_free(frame);
 277
 278         /*
 279          * Setup the counts for this PDU.
 280          */
 281
 282         p->out_data.data_sent_length += data_len;
 283         p->out_data.current_pdu_sent = 0;
 284
 285         return True;
 286 }
 287
 288 /*******************************************************************
 289  Generate the next PDU to be returned from the data in p->rdata.
 290  Return an schannel authenticated fragment.
 291  ********************************************************************/
 292
 293 static bool create_next_pdu_schannel(pipes_struct *p)
 294 {
 295         RPC_HDR_RESP hdr_resp;
 296         uint32 ss_padding_len = 0;
 297         uint32 data_len;
 298         uint32 data_space_available;
 299         uint32 data_len_left;
 300         uint32 data_pos;
 301         NTSTATUS status;
 302
 303         /*
 304          * If we're in the fault state, keep returning fault PDU's until
 305          * the pipe gets closed. JRA.
 306          */
 307
 308         if(p->fault_state) {
 309                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 310                 return True;
 311         }
 312
 313         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 314
 315         /* Change the incoming request header to a response. */
 316         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
 317
 318         /* Set up rpc header flags. */
 319         if (p->out_data.data_sent_length == 0) {
 320                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
 321         } else {
 322                 p->hdr.flags = 0;
 323         }
 324
 325         /*
 326          * Work out how much we can fit in a single PDU.
 327          */
 328
 329         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 330
 331         /*
 332          * Ensure there really is data left to send.
 333          */
 334
 335         if(!data_len_left) {
 336                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 337                 return False;
 338         }
 339
 340         /* Space available - not including padding. */
 341         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 342                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
 343                 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 344
 345         /*
 346          * The amount we send is the minimum of the available
 347          * space and the amount left to send.
 348          */
 349
 350         data_len = MIN(data_len_left, data_space_available);
 351
 352         /* Work out any padding alignment requirements. */
 353         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 354                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 355                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 356                 DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 357                         ss_padding_len ));
 358                 /* If we're over filling the packet, we need to make space
 359                  * for the padding at the end of the data. */
 360                 if (data_len + ss_padding_len > data_space_available) {
 361                         data_len -= SERVER_NDR_PADDING_SIZE;
 362                 }
 363         }
 364
 365         /*
 366          * Set up the alloc hint. This should be the data left to
 367          * send.
 368          */
 369
 370         hdr_resp.alloc_hint = data_len_left;
 371
 372         /*
 373          * Work out if this PDU will be the last.
 374          */
 375
 376         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 377                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 378         }
 379
 380         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 381                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 382         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 383
 384         /*
 385          * Init the parse struct to point at the outgoing
 386          * data.
 387          */
 388
 389         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 390
 391         /* Store the header in the data stream. */
 392         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 393                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 394                 prs_mem_free(&p->out_data.frag);
 395                 return False;
 396         }
 397
 398         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 399                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 400                 prs_mem_free(&p->out_data.frag);
 401                 return False;
 402         }
 403
 404         /* Store the current offset. */
 405         data_pos = prs_offset(&p->out_data.frag);
 406
 407         /* Copy the data into the PDU. */
 408
 409         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 410                                      p->out_data.data_sent_length, data_len)) {
 411                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 412                 prs_mem_free(&p->out_data.frag);
 413                 return False;
 414         }
 415
 416         /* Copy the sign/seal padding data. */
 417         if (ss_padding_len) {
 418                 char pad[SERVER_NDR_PADDING_SIZE];
 419                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 420                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 421                                       ss_padding_len)) {
 422                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 423                         prs_mem_free(&p->out_data.frag);
 424                         return False;
 425                 }
 426         }
 427
 428         {
 429                 /*
 430                  * Schannel processing.
 431                  */
 432                 RPC_HDR_AUTH auth_info;
 433                 DATA_BLOB blob;
 434                 uint8_t *data;
 435
 436                 /* Check it's the type of reply we were expecting to decode */
 437
 438                 init_rpc_hdr_auth(&auth_info,
 439                                 DCERPC_AUTH_TYPE_SCHANNEL,
 440                                 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
 441                                         DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
 442                                 ss_padding_len, 1);
 443
 444                 if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 445                                         &p->out_data.frag, 0)) {
 446                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 447                         prs_mem_free(&p->out_data.frag);
 448                         return False;
 449                 }
 450
 451                 data = (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos;
 452
 453                 switch (p->auth.auth_level) {
 454                 case DCERPC_AUTH_LEVEL_PRIVACY:
 455                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 456                                                         talloc_tos(),
 457                                                         true,
 458                                                         data,
 459                                                         data_len + ss_padding_len,
 460                                                         &blob);
 461                         break;
 462                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 463                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 464                                                         talloc_tos(),
 465                                                         false,
 466                                                         data,
 467                                                         data_len + ss_padding_len,
 468                                                         &blob);
 469                         break;
 470                 default:
 471                         status = NT_STATUS_INTERNAL_ERROR;
 472                         break;
 473                 }
 474
 475                 if (!NT_STATUS_IS_OK(status)) {
 476                         DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
 477                                 nt_errstr(status)));
 478                         prs_mem_free(&p->out_data.frag);
 479                         return false;
 480                 }
 481
 482                 /* Finally marshall the blob. */
 483
 484                 if (DEBUGLEVEL >= 10) {
 485                         dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
 486                 }
 487
 488                 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
 489                         prs_mem_free(&p->out_data.frag);
 490                         return false;
 491                 }
 492         }
 493
 494         /*
 495          * Setup the counts for this PDU.
 496          */
 497
 498         p->out_data.data_sent_length += data_len;
 499         p->out_data.current_pdu_sent = 0;
 500
 501         return True;
 502 }
 503
 504 /*******************************************************************
 505  Generate the next PDU to be returned from the data in p->rdata.
 506  No authentication done.
 507 ********************************************************************/
 508
 509 static bool create_next_pdu_noauth(pipes_struct *p)
 510 {
 511         RPC_HDR_RESP hdr_resp;
 512         uint32 data_len;
 513         uint32 data_space_available;
 514         uint32 data_len_left;
 515
 516         /*
 517          * If we're in the fault state, keep returning fault PDU's until
 518          * the pipe gets closed. JRA.
 519          */
 520
 521         if(p->fault_state) {
 522                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 523                 return True;
 524         }
 525
 526         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 527
 528         /* Change the incoming request header to a response. */
 529         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
 530
 531         /* Set up rpc header flags. */
 532         if (p->out_data.data_sent_length == 0) {
 533                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
 534         } else {
 535                 p->hdr.flags = 0;
 536         }
 537
 538         /*
 539          * Work out how much we can fit in a single PDU.
 540          */
 541
 542         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 543
 544         /*
 545          * Ensure there really is data left to send.
 546          */
 547
 548         if(!data_len_left) {
 549                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 550                 return False;
 551         }
 552
 553         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 554                 - RPC_HDR_RESP_LEN;
 555
 556         /*
 557          * The amount we send is the minimum of the available
 558          * space and the amount left to send.
 559          */
 560
 561         data_len = MIN(data_len_left, data_space_available);
 562
 563         /*
 564          * Set up the alloc hint. This should be the data left to
 565          * send.
 566          */
 567
 568         hdr_resp.alloc_hint = data_len_left;
 569
 570         /*
 571          * Work out if this PDU will be the last.
 572          */
 573
 574         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 575                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 576         }
 577
 578         /*
 579          * Set up the header lengths.
 580          */
 581
 582         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 583         p->hdr.auth_len = 0;
 584
 585         /*
 586          * Init the parse struct to point at the outgoing
 587          * data.
 588          */
 589
 590         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 591
 592         /* Store the header in the data stream. */
 593         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 594                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 595                 prs_mem_free(&p->out_data.frag);
 596                 return False;
 597         }
 598
 599         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 600                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 601                 prs_mem_free(&p->out_data.frag);
 602                 return False;
 603         }
 604
 605         /* Copy the data into the PDU. */
 606
 607         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 608                                      p->out_data.data_sent_length, data_len)) {
 609                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 610                 prs_mem_free(&p->out_data.frag);
 611                 return False;
 612         }
 613
 614         /*
 615          * Setup the counts for this PDU.
 616          */
 617
 618         p->out_data.data_sent_length += data_len;
 619         p->out_data.current_pdu_sent = 0;
 620
 621         return True;
 622 }
 623
 624 /*******************************************************************
 625  Generate the next PDU to be returned from the data in p->rdata.
 626 ********************************************************************/
 627
 628 bool create_next_pdu(pipes_struct *p)
 629 {
 630         switch(p->auth.auth_level) {
 631                 case DCERPC_AUTH_LEVEL_NONE:
 632                 case DCERPC_AUTH_LEVEL_CONNECT:
 633                         /* This is incorrect for auth level connect. Fixme. JRA */
 634                         return create_next_pdu_noauth(p);
 635
 636                 default:
 637                         switch(p->auth.auth_type) {
 638                                 case PIPE_AUTH_TYPE_NTLMSSP:
 639                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 640                                         return create_next_pdu_ntlmssp(p);
 641                                 case PIPE_AUTH_TYPE_SCHANNEL:
 642                                         return create_next_pdu_schannel(p);
 643                                 default:
 644                                         break;
 645                         }
 646         }
 647
 648         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 649                         (unsigned int)p->auth.auth_level,
 650                         (unsigned int)p->auth.auth_type));
 651         return False;
 652 }
 653
 654 /*******************************************************************
 655  Process an NTLMSSP authentication response.
 656  If this function succeeds, the user has been authenticated
 657  and their domain, name and calling workstation stored in
 658  the pipe struct.
 659 *******************************************************************/
 660
 661 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 662 {
 663         DATA_BLOB session_key, reply;
 664         NTSTATUS status;
 665         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
 666         bool ret;
 667
 668         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
 669                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 670
 671         ZERO_STRUCT(reply);
 672
 673         /* this has to be done as root in order to verify the password */
 674         become_root();
 675         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 676         unbecome_root();
 677
 678         /* Don't generate a reply. */
 679         data_blob_free(&reply);
 680
 681         if (!NT_STATUS_IS_OK(status)) {
 682                 return False;
 683         }
 684
 685         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 686            ensure the underlying NTLMSSP flags are also set. If not we should
 687            refuse the bind. */
 688
 689         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
 690                 if (!auth_ntlmssp_negotiated_sign(a)) {
 691                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 692                                 "but client declined signing.\n",
 693                                  get_pipe_name_from_syntax(talloc_tos(),
 694                                                            &p->syntax)));
 695                         return False;
 696                 }
 697         }
 698         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 699                 if (!auth_ntlmssp_negotiated_seal(a)) {
 700                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 701                                 "but client declined sealing.\n",
 702                                  get_pipe_name_from_syntax(talloc_tos(),
 703                                                            &p->syntax)));
 704                         return False;
 705                 }
 706         }
 707
 708         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 709                   "workstation: %s\n",
 710                   auth_ntlmssp_get_username(a),
 711                   auth_ntlmssp_get_domain(a),
 712                   auth_ntlmssp_get_client(a)));
 713
 714         TALLOC_FREE(p->server_info);
 715
 716         p->server_info = auth_ntlmssp_server_info(p, a);
 717         if (p->server_info == NULL) {
 718                 DEBUG(0, ("auth_ntlmssp_server_info failed to obtain the server info for authenticated user\n"));
 719                 return false;
 720         }
 721
 722         if (p->server_info->ptok == NULL) {
 723                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 724                 return False;
 725         }
 726
 727         /*
 728          * We're an authenticated bind over smb, so the session key needs to
 729          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 730          * does. See the RPC-SAMBA3SESSIONKEY.
 731          */
 732
 733         session_key = generic_session_key();
 734         if (session_key.data == NULL) {
 735                 return False;
 736         }
 737
 738         ret = server_info_set_session_key(p->server_info, session_key);
 739
 740         data_blob_free(&session_key);
 741
 742         return True;
 743 }
 744
 745 /*******************************************************************
 746  This is the "stage3" NTLMSSP response after a bind request and reply.
 747 *******************************************************************/
 748
 749 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 750 {
 751         RPC_HDR_AUTH auth_info;
 752         uint32 pad = 0;
 753         DATA_BLOB blob;
 754         uint32_t auth_len = p->hdr.auth_len;
 755
 756         ZERO_STRUCT(blob);
 757
 758         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 759
 760         if (auth_len == 0) {
 761                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 762                 goto err;
 763         }
 764
 765         /* 4 bytes padding. */
 766         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 767                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 768                 goto err;
 769         }
 770
 771         /* Ensure there's enough data for an authenticated request. */
 772         if (RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + auth_len >
 773                                 p->hdr.frag_len) {
 774                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
 775                                 "%u is too large.\n",
 776                         (unsigned int)auth_len ));
 777                 goto err;
 778         }
 779
 780         /*
 781          * Decode the authentication verifier response.
 782          */
 783
 784         /* Pull the auth header and the following data into a blob. */
 785         /* NB. The offset of the auth_header is relative to the *end*
 786          * of the packet, not the start. Also, the length of the
 787          * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
 788          * as the RPC header isn't included in rpc_in_p. */
 789         if(!prs_set_offset(rpc_in_p,
 790                         p->hdr.frag_len - RPC_HEADER_LEN -
 791                         RPC_HDR_AUTH_LEN - auth_len)) {
 792                 DEBUG(0,("api_pipe_bind_auth3: cannot move "
 793                         "offset to %u.\n",
 794                         (unsigned int)(p->hdr.frag_len -
 795                                 RPC_HDR_AUTH_LEN - auth_len) ));
 796                 goto err;
 797         }
 798
 799         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in_p, 0)) {
 800                 DEBUG(0,("api_pipe_bind_auth3: failed to "
 801                         "unmarshall RPC_HDR_AUTH.\n"));
 802                 goto err;
 803         }
 804
 805         /* We must NEVER look at auth_info->auth_pad_len here,
 806          * as old Samba client code gets it wrong and sends it
 807          * as zero. JRA.
 808          */
 809
 810         if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
 811                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 812                         (unsigned int)auth_info.auth_type ));
 813                 return False;
 814         }
 815
 816         blob = data_blob(NULL,p->hdr.auth_len);
 817
 818         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 819                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 820                         (unsigned int)p->hdr.auth_len ));
 821                 goto err;
 822         }
 823
 824         /*
 825          * The following call actually checks the challenge/response data.
 826          * for correctness against the given DOMAIN\user name.
 827          */
 828
 829         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 830                 goto err;
 831         }
 832
 833         data_blob_free(&blob);
 834
 835         p->pipe_bound = True;
 836
 837         return True;
 838
 839  err:
 840
 841         data_blob_free(&blob);
 842         free_pipe_ntlmssp_auth_data(&p->auth);
 843         p->auth.a_u.auth_ntlmssp_state = NULL;
 844
 845         return False;
 846 }
 847
 848 /*******************************************************************
 849  Marshall a bind_nak pdu.
 850 *******************************************************************/
 851
 852 static bool setup_bind_nak(pipes_struct *p)
 853 {
 854         NTSTATUS status;
 855         union dcerpc_payload u;
 856         DATA_BLOB blob;
 857
 858         /* Free any memory in the current return data buffer. */
 859         prs_mem_free(&p->out_data.rdata);
 860
 861         /*
 862          * Marshall directly into the outgoing PDU space. We
 863          * must do this as we need to set to the bind response
 864          * header and are never sending more than one PDU here.
 865          */
 866
 867         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 868
 869         /*
 870          * Initialize a bind_nak header.
 871          */
 872
 873         ZERO_STRUCT(u);
 874
 875         u.bind_nak.reject_reason  = 0;
 876
 877         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 878                                           DCERPC_PKT_BIND_NAK,
 879                                           DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
 880                                           RPC_HEADER_LEN + sizeof(uint16_t) /* FIXME - gd */,
 881                                           0,
 882                                           p->hdr.call_id,
 883                                           u,
 884                                           &blob);
 885         if (!NT_STATUS_IS_OK(status)) {
 886                 prs_mem_free(&p->out_data.frag);
 887                 return False;
 888         }
 889
 890         if (!prs_copy_data_in(&p->out_data.frag,
 891                               (char *)blob.data, blob.length)) {
 892                 prs_mem_free(&p->out_data.frag);
 893                 return False;
 894         }
 895
 896         p->out_data.data_sent_length = 0;
 897         p->out_data.current_pdu_sent = 0;
 898
 899         if (p->auth.auth_data_free_func) {
 900                 (*p->auth.auth_data_free_func)(&p->auth);
 901         }
 902         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 903         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 904         p->pipe_bound = False;
 905
 906         return True;
 907 }
 908
 909 /*******************************************************************
 910  Marshall a fault pdu.
 911 *******************************************************************/
 912
 913 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 914 {
 915         RPC_HDR fault_hdr;
 916         RPC_HDR_RESP hdr_resp;
 917         RPC_HDR_FAULT fault_resp;
 918
 919         /* Free any memory in the current return data buffer. */
 920         prs_mem_free(&p->out_data.rdata);
 921
 922         /*
 923          * Marshall directly into the outgoing PDU space. We
 924          * must do this as we need to set to the bind response
 925          * header and are never sending more than one PDU here.
 926          */
 927
 928         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 929
 930         /*
 931          * Initialize a fault header.
 932          */
 933
 934         init_rpc_hdr(&fault_hdr, DCERPC_PKT_FAULT, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST | DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 935             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 936
 937         /*
 938          * Initialize the HDR_RESP and FAULT parts of the PDU.
 939          */
 940
 941         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 942
 943         fault_resp.status = status;
 944         fault_resp.reserved = 0;
 945
 946         /*
 947          * Marshall the header into the outgoing PDU.
 948          */
 949
 950         if(!smb_io_rpc_hdr("", &fault_hdr, &p->out_data.frag, 0)) {
 951                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 952                 prs_mem_free(&p->out_data.frag);
 953                 return False;
 954         }
 955
 956         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 957                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 958                 prs_mem_free(&p->out_data.frag);
 959                 return False;
 960         }
 961
 962         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &p->out_data.frag, 0)) {
 963                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 964                 prs_mem_free(&p->out_data.frag);
 965                 return False;
 966         }
 967
 968         p->out_data.data_sent_length = 0;
 969         p->out_data.current_pdu_sent = 0;
 970
 971         return True;
 972 }
 973
 974 /*******************************************************************
 975  Ensure a bind request has the correct abstract & transfer interface.
 976  Used to reject unknown binds from Win2k.
 977 *******************************************************************/
 978
 979 static bool check_bind_req(struct pipes_struct *p,
 980                            struct ndr_syntax_id* abstract,
 981                            struct ndr_syntax_id* transfer,
 982                            uint32 context_id)
 983 {
 984         struct pipe_rpc_fns *context_fns;
 985
 986         DEBUG(3,("check_bind_req for %s\n",
 987                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 988
 989         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 990         if (rpc_srv_pipe_exists_by_id(abstract) &&
 991            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 992                 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 993                         rpc_srv_get_pipe_cli_name(abstract),
 994                         rpc_srv_get_pipe_srv_name(abstract)));
 995         } else {
 996                 return false;
 997         }
 998
 999         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
1000         if (context_fns == NULL) {
1001                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
1002                 return False;
1003         }
1004
1005         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
1006         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
1007         context_fns->context_id = context_id;
1008
1009         /* add to the list of open contexts */
1010
1011         DLIST_ADD( p->contexts, context_fns );
1012
1013         return True;
1014 }
1015
1016 /**
1017  * Is a named pipe known?
1018  * @param[in] cli_filename      The pipe name requested by the client
1019  * @result                      Do we want to serve this?
1020  */
1021 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1022 {
1023         const char *pipename = cli_filename;
1024         NTSTATUS status;
1025
1026         if (strnequal(pipename, "\\PIPE\\", 6)) {
1027                 pipename += 5;
1028         }
1029
1030         if (*pipename == '\\') {
1031                 pipename += 1;
1032         }
1033
1034         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1035                 DEBUG(10, ("refusing spoolss access\n"));
1036                 return false;
1037         }
1038
1039         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1040                 return true;
1041         }
1042
1043         status = smb_probe_module("rpc", pipename);
1044         if (!NT_STATUS_IS_OK(status)) {
1045                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1046                 return false;
1047         }
1048         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
1049
1050         /*
1051          * Scan the list again for the interface id
1052          */
1053         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1054                 return true;
1055         }
1056
1057         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
1058                    pipename));
1059
1060         return false;
1061 }
1062
1063 /*******************************************************************
1064  Handle a SPNEGO krb5 bind auth.
1065 *******************************************************************/
1066
1067 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1068                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1069 {
1070         return False;
1071 }
1072
1073 /*******************************************************************
1074  Handle the first part of a SPNEGO bind auth.
1075 *******************************************************************/
1076
1077 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1078                                         uint32_t ss_padding_len,
1079                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1080 {
1081         DATA_BLOB blob;
1082         DATA_BLOB secblob;
1083         DATA_BLOB response;
1084         DATA_BLOB chal;
1085         char *OIDs[ASN1_MAX_OIDS];
1086         int i;
1087         NTSTATUS status;
1088         bool got_kerberos_mechanism = false;
1089         struct auth_ntlmssp_state *a = NULL;
1090         RPC_HDR_AUTH auth_info;
1091
1092         ZERO_STRUCT(secblob);
1093         ZERO_STRUCT(chal);
1094         ZERO_STRUCT(response);
1095
1096         /* Grab the SPNEGO blob. */
1097         blob = data_blob(NULL,p->hdr.auth_len);
1098
1099         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1100                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1101                         (unsigned int)p->hdr.auth_len ));
1102                 goto err;
1103         }
1104
1105         if (blob.data[0] != ASN1_APPLICATION(0)) {
1106                 goto err;
1107         }
1108
1109         /* parse out the OIDs and the first sec blob */
1110         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1111                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1112                 goto err;
1113         }
1114
1115         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1116                 got_kerberos_mechanism = true;
1117         }
1118
1119         for (i=0;OIDs[i];i++) {
1120                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1121                 TALLOC_FREE(OIDs[i]);
1122         }
1123         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1124
1125         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1126                 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1127                 data_blob_free(&secblob);
1128                 data_blob_free(&blob);
1129                 return ret;
1130         }
1131
1132         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1133                 /* Free any previous auth type. */
1134                 free_pipe_ntlmssp_auth_data(&p->auth);
1135         }
1136
1137         if (!got_kerberos_mechanism) {
1138                 /* Initialize the NTLM engine. */
1139                 status = auth_ntlmssp_start(&a);
1140                 if (!NT_STATUS_IS_OK(status)) {
1141                         goto err;
1142                 }
1143
1144                 switch (pauth_info->auth_level) {
1145                         case DCERPC_AUTH_LEVEL_INTEGRITY:
1146                                 auth_ntlmssp_want_sign(a);
1147                                 break;
1148                         case DCERPC_AUTH_LEVEL_PRIVACY:
1149                                 auth_ntlmssp_want_seal(a);
1150                                 break;
1151                         default:
1152                                 break;
1153                 }
1154                 /*
1155                  * Pass the first security blob of data to it.
1156                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1157                  * which means we need another packet to complete the bind.
1158                  */
1159
1160                 status = auth_ntlmssp_update(a, secblob, &chal);
1161
1162                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1163                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1164                         goto err;
1165                 }
1166
1167                 /* Generate the response blob we need for step 2 of the bind. */
1168                 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1169         } else {
1170                 /*
1171                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1172                  * code to process follow-up packets is not complete
1173                  * yet. JRA.
1174                  */
1175                 response = spnego_gen_auth_response(NULL,
1176                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1177                                         OID_NTLMSSP);
1178         }
1179
1180         /* auth_pad_len will be handled by the caller */
1181
1182         /* Copy the blob into the pout_auth parse struct */
1183         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1184                         pauth_info->auth_level, ss_padding_len, 1);
1185         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1186                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1187                 goto err;
1188         }
1189
1190         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1191                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1192                 goto err;
1193         }
1194
1195         p->auth.a_u.auth_ntlmssp_state = a;
1196         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1197         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1198
1199         data_blob_free(&blob);
1200         data_blob_free(&secblob);
1201         data_blob_free(&chal);
1202         data_blob_free(&response);
1203
1204         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1205         return True;
1206
1207  err:
1208
1209         data_blob_free(&blob);
1210         data_blob_free(&secblob);
1211         data_blob_free(&chal);
1212         data_blob_free(&response);
1213
1214         p->auth.a_u.auth_ntlmssp_state = NULL;
1215
1216         return False;
1217 }
1218
1219 /*******************************************************************
1220  Handle the second part of a SPNEGO bind auth.
1221 *******************************************************************/
1222
1223 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1224                                 uint32_t ss_padding_len,
1225                                 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1226 {
1227         RPC_HDR_AUTH auth_info;
1228         DATA_BLOB spnego_blob;
1229         DATA_BLOB auth_blob;
1230         DATA_BLOB auth_reply;
1231         DATA_BLOB response;
1232         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
1233
1234         ZERO_STRUCT(spnego_blob);
1235         ZERO_STRUCT(auth_blob);
1236         ZERO_STRUCT(auth_reply);
1237         ZERO_STRUCT(response);
1238
1239         /*
1240          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1241          * fail here as 'a' == NULL.
1242          */
1243         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1244                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1245                 goto err;
1246         }
1247
1248         /* Grab the SPNEGO blob. */
1249         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1250
1251         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1252                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1253                         (unsigned int)p->hdr.auth_len ));
1254                 goto err;
1255         }
1256
1257         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1258                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1259                 goto err;
1260         }
1261
1262         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1263                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1264                 goto err;
1265         }
1266
1267         /*
1268          * The following call actually checks the challenge/response data.
1269          * for correctness against the given DOMAIN\user name.
1270          */
1271
1272         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1273                 goto err;
1274         }
1275
1276         data_blob_free(&spnego_blob);
1277         data_blob_free(&auth_blob);
1278
1279         /* Generate the spnego "accept completed" blob - no incoming data. */
1280         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1281
1282         /* FIXME - add auth_pad_len here ! */
1283
1284         /* Copy the blob into the pout_auth parse struct */
1285         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1286                         pauth_info->auth_level, ss_padding_len, 1);
1287         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1288                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1289                 goto err;
1290         }
1291
1292         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1293                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1294                 goto err;
1295         }
1296
1297         data_blob_free(&auth_reply);
1298         data_blob_free(&response);
1299
1300         p->pipe_bound = True;
1301
1302         return True;
1303
1304  err:
1305
1306         data_blob_free(&spnego_blob);
1307         data_blob_free(&auth_blob);
1308         data_blob_free(&auth_reply);
1309         data_blob_free(&response);
1310
1311         free_pipe_ntlmssp_auth_data(&p->auth);
1312         p->auth.a_u.auth_ntlmssp_state = NULL;
1313
1314         return False;
1315 }
1316
1317 /*******************************************************************
1318  Handle an schannel bind auth.
1319 *******************************************************************/
1320
1321 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1322                                         uint32_t ss_padding_len,
1323                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1324 {
1325         RPC_HDR_AUTH auth_info;
1326         struct NL_AUTH_MESSAGE neg;
1327         struct NL_AUTH_MESSAGE reply;
1328         bool ret;
1329         NTSTATUS status;
1330         struct netlogon_creds_CredentialState *creds;
1331         DATA_BLOB session_key;
1332         enum ndr_err_code ndr_err;
1333         DATA_BLOB blob;
1334
1335         blob = data_blob_const(prs_data_p(rpc_in_p) + prs_offset(rpc_in_p),
1336                                prs_data_size(rpc_in_p));
1337
1338         ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), &neg,
1339                                (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1340         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1341                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1342                 return false;
1343         }
1344
1345         if (DEBUGLEVEL >= 10) {
1346                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1347         }
1348
1349         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1350                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1351                 return false;
1352         }
1353
1354         /*
1355          * The neg.oem_netbios_computer.a key here must match the remote computer name
1356          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1357          * operations that use credentials.
1358          */
1359
1360         become_root();
1361         status = schannel_get_creds_state(p, lp_private_dir(),
1362                                             neg.oem_netbios_computer.a, &creds);
1363         unbecome_root();
1364
1365         if (!NT_STATUS_IS_OK(status)) {
1366                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1367                 return False;
1368         }
1369
1370         p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1371         if (!p->auth.a_u.schannel_auth) {
1372                 TALLOC_FREE(creds);
1373                 return False;
1374         }
1375
1376         p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1377         p->auth.a_u.schannel_auth->seq_num = 0;
1378         p->auth.a_u.schannel_auth->initiator = false;
1379         p->auth.a_u.schannel_auth->creds = creds;
1380
1381         /*
1382          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1383          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1384          * struct of the person who opened the pipe. I need to test this further. JRA.
1385          *
1386          * VL. As we are mapping this to guest set the generic key
1387          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1388          * W2k3, as it does not allow schannel binds against SAMR and LSA
1389          * anymore.
1390          */
1391
1392         session_key = generic_session_key();
1393         if (session_key.data == NULL) {
1394                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1395                           " key\n"));
1396                 return false;
1397         }
1398
1399         ret = server_info_set_session_key(p->server_info, session_key);
1400
1401         data_blob_free(&session_key);
1402
1403         if (!ret) {
1404                 DEBUG(0, ("server_info_set_session_key failed\n"));
1405                 return false;
1406         }
1407
1408         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SCHANNEL,
1409                         pauth_info->auth_level, ss_padding_len, 1);
1410         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1411                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1412                 return False;
1413         }
1414
1415         /*** SCHANNEL verifier ***/
1416
1417         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
1418         reply.Flags                             = 0;
1419         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
1420                                                       * this has any meaning
1421                                                       * here - gd */
1422
1423         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &reply,
1424                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1425         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1426                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1427                 return false;
1428         }
1429
1430         if (DEBUGLEVEL >= 10) {
1431                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1432         }
1433
1434         if (!prs_copy_data_in(pout_auth, (const char *)blob.data, blob.length)) {
1435                 return false;
1436         }
1437
1438         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1439                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1440
1441         /* We're finished with this bind - no more packets. */
1442         p->auth.auth_data_free_func = NULL;
1443         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1444
1445         p->pipe_bound = True;
1446
1447         return True;
1448 }
1449
1450 /*******************************************************************
1451  Handle an NTLMSSP bind auth.
1452 *******************************************************************/
1453
1454 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1455                                         uint32_t ss_padding_len,
1456                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1457 {
1458         RPC_HDR_AUTH auth_info;
1459         DATA_BLOB blob;
1460         DATA_BLOB response;
1461         NTSTATUS status;
1462         struct auth_ntlmssp_state *a = NULL;
1463
1464         ZERO_STRUCT(blob);
1465         ZERO_STRUCT(response);
1466
1467         /* Grab the NTLMSSP blob. */
1468         blob = data_blob(NULL,p->hdr.auth_len);
1469
1470         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1471                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1472                         (unsigned int)p->hdr.auth_len ));
1473                 goto err;
1474         }
1475
1476         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1477                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1478                 goto err;
1479         }
1480
1481         /* We have an NTLMSSP blob. */
1482         status = auth_ntlmssp_start(&a);
1483         if (!NT_STATUS_IS_OK(status)) {
1484                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1485                         nt_errstr(status) ));
1486                 goto err;
1487         }
1488
1489         switch (pauth_info->auth_level) {
1490         case DCERPC_AUTH_LEVEL_INTEGRITY:
1491                 auth_ntlmssp_want_sign(a);
1492                 break;
1493         case DCERPC_AUTH_LEVEL_PRIVACY:
1494                 auth_ntlmssp_want_seal(a);
1495                 break;
1496         default:
1497                 break;
1498         }
1499
1500         status = auth_ntlmssp_update(a, blob, &response);
1501         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1502                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1503                         nt_errstr(status) ));
1504                 goto err;
1505         }
1506
1507         data_blob_free(&blob);
1508
1509         /* Copy the blob into the pout_auth parse struct */
1510         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_NTLMSSP,
1511                         pauth_info->auth_level, ss_padding_len, 1);
1512         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1513                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1514                 goto err;
1515         }
1516
1517         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1518                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1519                 goto err;
1520         }
1521
1522         p->auth.a_u.auth_ntlmssp_state = a;
1523         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1524         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1525
1526         data_blob_free(&blob);
1527         data_blob_free(&response);
1528
1529         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1530
1531         /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1532         return True;
1533
1534   err:
1535
1536         data_blob_free(&blob);
1537         data_blob_free(&response);
1538
1539         free_pipe_ntlmssp_auth_data(&p->auth);
1540         p->auth.a_u.auth_ntlmssp_state = NULL;
1541         return False;
1542 }
1543
1544 /*******************************************************************
1545  Respond to a pipe bind request.
1546 *******************************************************************/
1547
1548 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1549 {
1550         RPC_HDR_BA hdr_ba;
1551         RPC_HDR_RB hdr_rb;
1552         RPC_HDR_AUTH auth_info;
1553         uint16 assoc_gid;
1554         fstring ack_pipe_name;
1555         prs_struct out_hdr_ba;
1556         prs_struct out_auth;
1557         int auth_len = 0;
1558         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1559         uint32_t ss_padding_len = 0;
1560         NTSTATUS status;
1561         struct ndr_syntax_id id;
1562
1563         /* No rebinds on a bound pipe - use alter context. */
1564         if (p->pipe_bound) {
1565                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1566                          "pipe %s.\n",
1567                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1568                 return setup_bind_nak(p);
1569         }
1570
1571         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1572
1573         /*
1574          * Marshall directly into the outgoing PDU space. We
1575          * must do this as we need to set to the bind response
1576          * header and are never sending more than one PDU here.
1577          */
1578
1579         /*
1580          * Setup the memory to marshall the ba header, and the
1581          * auth footers.
1582          */
1583
1584         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1585                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1586                 prs_mem_free(&p->out_data.frag);
1587                 return False;
1588         }
1589
1590         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1591                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1592                 prs_mem_free(&p->out_data.frag);
1593                 prs_mem_free(&out_hdr_ba);
1594                 return False;
1595         }
1596
1597         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1598
1599         ZERO_STRUCT(hdr_rb);
1600
1601         /* decode the bind request */
1602
1603         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1604                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB "
1605                          "struct.\n"));
1606                 goto err_exit;
1607         }
1608
1609         if (hdr_rb.num_contexts == 0) {
1610                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1611                 goto err_exit;
1612         }
1613
1614         /*
1615          * Try and find the correct pipe name to ensure
1616          * that this is a pipe name we support.
1617          */
1618         id = hdr_rb.rpc_context[0].abstract;
1619         if (rpc_srv_pipe_exists_by_id(&id)) {
1620                 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1621                         rpc_srv_get_pipe_cli_name(&id),
1622                         rpc_srv_get_pipe_srv_name(&id)));
1623         } else {
1624                 status = smb_probe_module(
1625                         "rpc", get_pipe_name_from_syntax(
1626                                 talloc_tos(),
1627                                 &hdr_rb.rpc_context[0].abstract));
1628
1629                 if (NT_STATUS_IS_ERR(status)) {
1630                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1631                                 get_pipe_name_from_syntax(
1632                                         talloc_tos(),
1633                                         &hdr_rb.rpc_context[0].abstract)));
1634                         prs_mem_free(&p->out_data.frag);
1635                         prs_mem_free(&out_hdr_ba);
1636                         prs_mem_free(&out_auth);
1637
1638                         return setup_bind_nak(p);
1639                 }
1640
1641                 if (rpc_srv_get_pipe_interface_by_cli_name(
1642                                 get_pipe_name_from_syntax(talloc_tos(),
1643                                                           &p->syntax),
1644                                 &id)) {
1645                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1646                                 rpc_srv_get_pipe_cli_name(&id),
1647                                 rpc_srv_get_pipe_srv_name(&id)));
1648                 } else {
1649                         DEBUG(0, ("module %s doesn't provide functions for "
1650                                   "pipe %s!\n",
1651                                   get_pipe_name_from_syntax(talloc_tos(),
1652                                                             &p->syntax),
1653                                   get_pipe_name_from_syntax(talloc_tos(),
1654                                                             &p->syntax)));
1655                         goto err_exit;
1656                 }
1657         }
1658
1659         /* name has to be \PIPE\xxxxx */
1660         fstrcpy(ack_pipe_name, "\\PIPE\\");
1661         fstrcat(ack_pipe_name, rpc_srv_get_pipe_srv_name(&id));
1662
1663         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1664
1665         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1666
1667         /*
1668          * Create the bind response struct.
1669          */
1670
1671         /* If the requested abstract synt uuid doesn't match our client pipe,
1672                 reject the bind_ack & set the transfer interface synt to all 0's,
1673                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1674                 unknown to NT4)
1675                 Needed when adding entries to a DACL from NT5 - SK */
1676
1677         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1678                                 hdr_rb.rpc_context[0].context_id )) {
1679                 init_rpc_hdr_ba(&hdr_ba,
1680                         RPC_MAX_PDU_FRAG_LEN,
1681                         RPC_MAX_PDU_FRAG_LEN,
1682                         assoc_gid,
1683                         ack_pipe_name,
1684                         0x1, 0x0, 0x0,
1685                         &hdr_rb.rpc_context[0].transfer[0]);
1686         } else {
1687                 /* Rejection reason: abstract syntax not supported */
1688                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1689                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1690                                         ack_pipe_name, 0x1, 0x2, 0x1,
1691                                         &null_ndr_syntax_id);
1692                 p->pipe_bound = False;
1693         }
1694
1695         /*
1696          * and marshall it.
1697          */
1698
1699         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1700                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1701                 goto err_exit;
1702         }
1703
1704         /*
1705          * Check if this is an authenticated bind request.
1706          */
1707
1708         if (p->hdr.auth_len) {
1709                 /*
1710                  * Decode the authentication verifier.
1711                  */
1712
1713                 /* Work out any padding needed before the auth footer. */
1714                 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
1715                         ss_padding_len = SERVER_NDR_PADDING_SIZE -
1716                                 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
1717                         DEBUG(10,("api_pipe_bind_req: auth pad_len = %u\n",
1718                                 (unsigned int)ss_padding_len ));
1719                 }
1720
1721                 /* Quick length check. Won't catch a bad auth footer,
1722                  * prevents overrun. */
1723
1724                 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
1725                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
1726                                 "too long for fragment %u.\n",
1727                                 (unsigned int)p->hdr.auth_len,
1728                                 (unsigned int)p->hdr.frag_len ));
1729                         goto err_exit;
1730                 }
1731
1732                 /* Pull the auth header and the following data into a blob. */
1733                 /* NB. The offset of the auth_header is relative to the *end*
1734                  * of the packet, not the start. Also, the length of the
1735                  * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
1736                  * as the RPC header isn't included in rpc_in_p. */
1737                 if(!prs_set_offset(rpc_in_p,
1738                                 p->hdr.frag_len - RPC_HEADER_LEN -
1739                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
1740                         DEBUG(0,("api_pipe_bind_req: cannot move "
1741                                 "offset to %u.\n",
1742                                 (unsigned int)(p->hdr.frag_len -
1743                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
1744                         goto err_exit;
1745                 }
1746
1747                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1748                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1749                         goto err_exit;
1750                 }
1751
1752                 auth_type = auth_info.auth_type;
1753
1754                 /* Work out if we have to sign or seal etc. */
1755                 switch (auth_info.auth_level) {
1756                         case DCERPC_AUTH_LEVEL_INTEGRITY:
1757                                 p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1758                                 break;
1759                         case DCERPC_AUTH_LEVEL_PRIVACY:
1760                                 p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1761                                 break;
1762                         default:
1763                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1764                                         (unsigned int)auth_info.auth_level ));
1765                                 goto err_exit;
1766                 }
1767         } else {
1768                 ZERO_STRUCT(auth_info);
1769         }
1770
1771         switch(auth_type) {
1772                 case DCERPC_AUTH_TYPE_NTLMSSP:
1773                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p,
1774                                         ss_padding_len, &auth_info, &out_auth)) {
1775                                 goto err_exit;
1776                         }
1777                         assoc_gid = 0x7a77;
1778                         break;
1779
1780                 case DCERPC_AUTH_TYPE_SCHANNEL:
1781                         if (!pipe_schannel_auth_bind(p, rpc_in_p,
1782                                         ss_padding_len, &auth_info, &out_auth)) {
1783                                 goto err_exit;
1784                         }
1785                         break;
1786
1787                 case DCERPC_AUTH_TYPE_SPNEGO:
1788                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p,
1789                                         ss_padding_len, &auth_info, &out_auth)) {
1790                                 goto err_exit;
1791                         }
1792                         break;
1793
1794                 case DCERPC_AUTH_TYPE_NONE:
1795                         /* Unauthenticated bind request. */
1796                         /* We're finished - no more packets. */
1797                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1798                         /* We must set the pipe auth_level here also. */
1799                         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1800                         p->pipe_bound = True;
1801                         /* The session key was initialized from the SMB
1802                          * session in make_internal_rpc_pipe_p */
1803                         ss_padding_len = 0;
1804                         break;
1805
1806                 default:
1807                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1808                         goto err_exit;
1809         }
1810         /*
1811          * Create the header, now we know the length.
1812          */
1813
1814         if (prs_offset(&out_auth)) {
1815                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1816         }
1817
1818         init_rpc_hdr(&p->hdr, DCERPC_PKT_BIND_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1819                         p->hdr.call_id,
1820                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) +
1821                                 ss_padding_len + prs_offset(&out_auth),
1822                         auth_len);
1823
1824         /*
1825          * Marshall the header into the outgoing PDU.
1826          */
1827
1828         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1829                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1830                 goto err_exit;
1831         }
1832
1833         /*
1834          * Now add the RPC_HDR_BA and any auth needed.
1835          */
1836
1837         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1838                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1839                 goto err_exit;
1840         }
1841
1842         if (auth_len) {
1843                 if (ss_padding_len) {
1844                         char pad[SERVER_NDR_PADDING_SIZE];
1845                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1846                         if (!prs_copy_data_in(&p->out_data.frag, pad,
1847                                         ss_padding_len)) {
1848                                 DEBUG(0,("api_pipe_bind_req: failed to add %u "
1849                                         "bytes of pad data.\n",
1850                                         (unsigned int)ss_padding_len));
1851                                 goto err_exit;
1852                         }
1853                 }
1854
1855                 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1856                         DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1857                         goto err_exit;
1858                 }
1859         }
1860
1861         /*
1862          * Setup the lengths for the initial reply.
1863          */
1864
1865         p->out_data.data_sent_length = 0;
1866         p->out_data.current_pdu_sent = 0;
1867
1868         prs_mem_free(&out_hdr_ba);
1869         prs_mem_free(&out_auth);
1870
1871         return True;
1872
1873   err_exit:
1874
1875         prs_mem_free(&p->out_data.frag);
1876         prs_mem_free(&out_hdr_ba);
1877         prs_mem_free(&out_auth);
1878         return setup_bind_nak(p);
1879 }
1880
1881 /****************************************************************************
1882  Deal with an alter context call. Can be third part of 3 leg auth request for
1883  SPNEGO calls.
1884 ****************************************************************************/
1885
1886 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1887 {
1888         RPC_HDR_BA hdr_ba;
1889         RPC_HDR_RB hdr_rb;
1890         RPC_HDR_AUTH auth_info;
1891         uint16 assoc_gid;
1892         fstring ack_pipe_name;
1893         prs_struct out_hdr_ba;
1894         prs_struct out_auth;
1895         int auth_len = 0;
1896         uint32_t ss_padding_len = 0;
1897
1898         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1899
1900         /*
1901          * Marshall directly into the outgoing PDU space. We
1902          * must do this as we need to set to the bind response
1903          * header and are never sending more than one PDU here.
1904          */
1905
1906         /*
1907          * Setup the memory to marshall the ba header, and the
1908          * auth footers.
1909          */
1910
1911         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1912                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1913                 prs_mem_free(&p->out_data.frag);
1914                 return False;
1915         }
1916
1917         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1918                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1919                 prs_mem_free(&p->out_data.frag);
1920                 prs_mem_free(&out_hdr_ba);
1921                 return False;
1922         }
1923
1924         ZERO_STRUCT(hdr_rb);
1925
1926         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1927
1928         /* decode the alter context request */
1929         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1930                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1931                 goto err_exit;
1932         }
1933
1934         /* secondary address CAN be NULL
1935          * as the specs say it's ignored.
1936          * It MUST be NULL to have the spoolss working.
1937          */
1938         fstrcpy(ack_pipe_name,"");
1939
1940         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1941
1942         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1943
1944         /*
1945          * Create the bind response struct.
1946          */
1947
1948         /* If the requested abstract synt uuid doesn't match our client pipe,
1949                 reject the bind_ack & set the transfer interface synt to all 0's,
1950                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1951                 unknown to NT4)
1952                 Needed when adding entries to a DACL from NT5 - SK */
1953
1954         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1955                                 hdr_rb.rpc_context[0].context_id )) {
1956                 init_rpc_hdr_ba(&hdr_ba,
1957                         RPC_MAX_PDU_FRAG_LEN,
1958                         RPC_MAX_PDU_FRAG_LEN,
1959                         assoc_gid,
1960                         ack_pipe_name,
1961                         0x1, 0x0, 0x0,
1962                         &hdr_rb.rpc_context[0].transfer[0]);
1963         } else {
1964                 /* Rejection reason: abstract syntax not supported */
1965                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1966                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1967                                         ack_pipe_name, 0x1, 0x2, 0x1,
1968                                         &null_ndr_syntax_id);
1969                 p->pipe_bound = False;
1970         }
1971
1972         /*
1973          * and marshall it.
1974          */
1975
1976         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1977                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1978                 goto err_exit;
1979         }
1980
1981
1982         /*
1983          * Check if this is an authenticated alter context request.
1984          */
1985
1986         if (p->hdr.auth_len != 0) {
1987                 /*
1988                  * Decode the authentication verifier.
1989                  */
1990
1991                 /* Work out any padding needed before the auth footer. */
1992                 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
1993                         ss_padding_len = SERVER_NDR_PADDING_SIZE -
1994                                 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
1995                         DEBUG(10,("api_pipe_alter_context: auth pad_len = %u\n",
1996                                 (unsigned int)ss_padding_len ));
1997                 }
1998
1999                 /* Quick length check. Won't catch a bad auth footer,
2000                  * prevents overrun. */
2001
2002                 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
2003                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
2004                                 "too long for fragment %u.\n",
2005                                 (unsigned int)p->hdr.auth_len,
2006                                 (unsigned int)p->hdr.frag_len ));
2007                         goto err_exit;
2008                 }
2009
2010                 /* Pull the auth header and the following data into a blob. */
2011                 /* NB. The offset of the auth_header is relative to the *end*
2012                  * of the packet, not the start. Also, the length of the
2013                  * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2014                  * as the RPC header isn't included in rpc_in_p. */
2015                 if(!prs_set_offset(rpc_in_p,
2016                                 p->hdr.frag_len - RPC_HEADER_LEN -
2017                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
2018                         DEBUG(0,("api_alter_context: cannot move "
2019                                 "offset to %u.\n",
2020                                 (unsigned int)(p->hdr.frag_len -
2021                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
2022                         goto err_exit;
2023                 }
2024
2025                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
2026                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
2027                         goto err_exit;
2028                 }
2029
2030                 /*
2031                  * Currently only the SPNEGO auth type uses the alter ctx
2032                  * response in place of the NTLMSSP auth3 type.
2033                  */
2034
2035                 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
2036                         /* We can only finish if the pipe is unbound. */
2037                         if (!p->pipe_bound) {
2038                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p,
2039                                                 ss_padding_len, &auth_info, &out_auth)) {
2040                                         goto err_exit;
2041                                 }
2042                         } else {
2043                                 goto err_exit;
2044                         }
2045                 }
2046         } else {
2047                 ZERO_STRUCT(auth_info);
2048         }
2049         /*
2050          * Create the header, now we know the length.
2051          */
2052
2053         if (prs_offset(&out_auth)) {
2054                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
2055         }
2056
2057         init_rpc_hdr(&p->hdr, DCERPC_PKT_ALTER_RESP, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
2058                         p->hdr.call_id,
2059                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
2060                         auth_len);
2061
2062         /*
2063          * Marshall the header into the outgoing PDU.
2064          */
2065
2066         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
2067                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
2068                 goto err_exit;
2069         }
2070
2071         /*
2072          * Now add the RPC_HDR_BA and any auth needed.
2073          */
2074
2075         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
2076                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
2077                 goto err_exit;
2078         }
2079
2080         if (auth_len) {
2081                 if (ss_padding_len) {
2082                         char pad[SERVER_NDR_PADDING_SIZE];
2083                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
2084                         if (!prs_copy_data_in(&p->out_data.frag, pad,
2085                                         ss_padding_len)) {
2086                                 DEBUG(0,("api_pipe_alter_context: failed to add %u "
2087                                         "bytes of pad data.\n",
2088                                         (unsigned int)ss_padding_len));
2089                                 goto err_exit;
2090                         }
2091                 }
2092
2093                 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
2094                         DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
2095                         goto err_exit;
2096                 }
2097         }
2098
2099         /*
2100          * Setup the lengths for the initial reply.
2101          */
2102
2103         p->out_data.data_sent_length = 0;
2104         p->out_data.current_pdu_sent = 0;
2105
2106         prs_mem_free(&out_hdr_ba);
2107         prs_mem_free(&out_auth);
2108
2109         return True;
2110
2111   err_exit:
2112
2113         prs_mem_free(&p->out_data.frag);
2114         prs_mem_free(&out_hdr_ba);
2115         prs_mem_free(&out_auth);
2116         return setup_bind_nak(p);
2117 }
2118
2119 /****************************************************************************
2120  Deal with NTLMSSP sign & seal processing on an RPC request.
2121 ****************************************************************************/
2122
2123 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
2124                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
2125 {
2126         RPC_HDR_AUTH auth_info;
2127         uint32 auth_len = p->hdr.auth_len;
2128         uint32 save_offset = prs_offset(rpc_in);
2129         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
2130         unsigned char *data = NULL;
2131         size_t data_len;
2132         unsigned char *full_packet_data = NULL;
2133         size_t full_packet_data_len;
2134         DATA_BLOB auth_blob;
2135
2136         *pstatus = NT_STATUS_OK;
2137
2138         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_NONE || p->auth.auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
2139                 return True;
2140         }
2141
2142         if (!a) {
2143                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2144                 return False;
2145         }
2146
2147         /* Ensure there's enough data for an authenticated request. */
2148         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN
2149                         + auth_len > p->hdr.frag_len) {
2150                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2151                         (unsigned int)auth_len ));
2152                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2153                 return False;
2154         }
2155
2156         /*
2157          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2158          * after the RPC header.
2159          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2160          * functions as NTLMv2 checks the rpc headers also.
2161          * Both of these values include any auth_pad_len bytes.
2162          */
2163
2164         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2165         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2166
2167         full_packet_data = p->in_data.current_in_pdu;
2168         full_packet_data_len = p->hdr.frag_len - auth_len;
2169
2170         /* Pull the auth header and the following data into a blob. */
2171         /* NB. The offset of the auth_header is relative to the *end*
2172          * of the packet, not the start. Also, the length of the
2173          * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2174          * as the RPC header isn't included in rpc_in_p. */
2175         if(!prs_set_offset(rpc_in,
2176                         p->hdr.frag_len - RPC_HEADER_LEN -
2177                         RPC_HDR_AUTH_LEN - auth_len)) {
2178                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move "
2179                         "offset to %u.\n",
2180                         (unsigned int)(p->hdr.frag_len -
2181                                 RPC_HDR_AUTH_LEN - auth_len) ));
2182                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2183                 return False;
2184         }
2185
2186         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2187                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to "
2188                         "unmarshall RPC_HDR_AUTH.\n"));
2189                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2190                 return False;
2191         }
2192
2193         /* Ensure auth_pad_len fits into the packet. */
2194         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2195                         RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2196                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_info.auth_pad_len "
2197                         "too large (%u), auth_len (%u), frag_len = (%u).\n",
2198                         (unsigned int)auth_info.auth_pad_len,
2199                         (unsigned int)auth_len,
2200                         (unsigned int)p->hdr.frag_len ));
2201                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2202                 return False;
2203         }
2204
2205         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2206         auth_blob.length = auth_len;
2207
2208         switch (p->auth.auth_level) {
2209                 case DCERPC_AUTH_LEVEL_PRIVACY:
2210                         /* Data is encrypted. */
2211                         *pstatus = auth_ntlmssp_unseal_packet(a,
2212                                                               data, data_len,
2213                                                               full_packet_data,
2214                                                               full_packet_data_len,
2215                                                               &auth_blob);
2216                         if (!NT_STATUS_IS_OK(*pstatus)) {
2217                                 return False;
2218                         }
2219                         break;
2220                 case DCERPC_AUTH_LEVEL_INTEGRITY:
2221                         /* Data is signed. */
2222                         *pstatus = auth_ntlmssp_check_packet(a,
2223                                                              data, data_len,
2224                                                              full_packet_data,
2225                                                              full_packet_data_len,
2226                                                              &auth_blob);
2227                         if (!NT_STATUS_IS_OK(*pstatus)) {
2228                                 return False;
2229                         }
2230                         break;
2231                 default:
2232                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2233                         return False;
2234         }
2235
2236         /*
2237          * Return the current pointer to the data offset.
2238          */
2239
2240         if(!prs_set_offset(rpc_in, save_offset)) {
2241                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2242                         (unsigned int)save_offset ));
2243                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2244                 return False;
2245         }
2246
2247         /*
2248          * Remember the padding length. We must remove it from the real data
2249          * stream once the sign/seal is done.
2250          */
2251
2252         *p_ss_padding_len = auth_info.auth_pad_len;
2253
2254         return True;
2255 }
2256
2257 /****************************************************************************
2258  Deal with schannel processing on an RPC request.
2259 ****************************************************************************/
2260
2261 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2262 {
2263         uint32 data_len;
2264         uint32 auth_len;
2265         uint32 save_offset = prs_offset(rpc_in);
2266         RPC_HDR_AUTH auth_info;
2267         DATA_BLOB blob;
2268         NTSTATUS status;
2269         uint8_t *data;
2270
2271         auth_len = p->hdr.auth_len;
2272
2273         if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN ||
2274                         auth_len > RPC_HEADER_LEN +
2275                                         RPC_HDR_REQ_LEN +
2276                                         RPC_HDR_AUTH_LEN +
2277                                         auth_len) {
2278                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2279                 return False;
2280         }
2281
2282         /*
2283          * The following is that length of the data we must verify or unseal.
2284          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2285          * preceeding the auth_data, but does include the auth_pad_len bytes.
2286          */
2287
2288         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2289                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2290                         (unsigned int)p->hdr.frag_len,
2291                         (unsigned int)auth_len ));
2292                 return False;
2293         }
2294
2295         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2296                 RPC_HDR_AUTH_LEN - auth_len;
2297
2298         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2299
2300         /* Pull the auth header and the following data into a blob. */
2301         /* NB. The offset of the auth_header is relative to the *end*
2302          * of the packet, not the start. Also, the length of the
2303          * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2304          * as the RPC header isn't included in rpc_in_p. */
2305         if(!prs_set_offset(rpc_in,
2306                         p->hdr.frag_len - RPC_HEADER_LEN -
2307                         RPC_HDR_AUTH_LEN - auth_len)) {
2308                 DEBUG(0,("api_pipe_schannel_process: cannot move "
2309                         "offset to %u.\n",
2310                         (unsigned int)(p->hdr.frag_len -
2311                                 RPC_HDR_AUTH_LEN - auth_len) ));
2312                 return False;
2313         }
2314
2315         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2316                 DEBUG(0,("api_pipe_schannel_process: failed to "
2317                         "unmarshall RPC_HDR_AUTH.\n"));
2318                 return False;
2319         }
2320
2321         /* Ensure auth_pad_len fits into the packet. */
2322         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2323                         RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2324                 DEBUG(0,("api_pipe_schannel_process: auth_info.auth_pad_len "
2325                         "too large (%u), auth_len (%u), frag_len = (%u).\n",
2326                         (unsigned int)auth_info.auth_pad_len,
2327                         (unsigned int)auth_len,
2328                         (unsigned int)p->hdr.frag_len ));
2329                 return False;
2330         }
2331
2332         if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
2333                 DEBUG(0,("Invalid auth info %d on schannel\n",
2334                          auth_info.auth_type));
2335                 return False;
2336         }
2337
2338         blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), auth_len);
2339
2340         if (DEBUGLEVEL >= 10) {
2341                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
2342         }
2343
2344         data = (uint8_t *)prs_data_p(rpc_in)+RPC_HDR_REQ_LEN;
2345
2346         switch (auth_info.auth_level) {
2347         case DCERPC_AUTH_LEVEL_PRIVACY:
2348                 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2349                                                 talloc_tos(),
2350                                                 true,
2351                                                 data,
2352                                                 data_len,
2353                                                 &blob);
2354                 break;
2355         case DCERPC_AUTH_LEVEL_INTEGRITY:
2356                 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2357                                                 talloc_tos(),
2358                                                 false,
2359                                                 data,
2360                                                 data_len,
2361                                                 &blob);
2362                 break;
2363         default:
2364                 status = NT_STATUS_INTERNAL_ERROR;
2365                 break;
2366         }
2367
2368         if (!NT_STATUS_IS_OK(status)) {
2369                 DEBUG(0,("failed to unseal packet: %s\n", nt_errstr(status)));
2370                 return false;
2371         }
2372
2373         /*
2374          * Return the current pointer to the data offset.
2375          */
2376
2377         if(!prs_set_offset(rpc_in, save_offset)) {
2378                 DEBUG(0,("failed to set offset back to %u\n",
2379                          (unsigned int)save_offset ));
2380                 return False;
2381         }
2382
2383         /*
2384          * Remember the padding length. We must remove it from the real data
2385          * stream once the sign/seal is done.
2386          */
2387
2388         *p_ss_padding_len = auth_info.auth_pad_len;
2389
2390         return True;
2391 }
2392
2393 /****************************************************************************
2394  Find the set of RPC functions associated with this context_id
2395 ****************************************************************************/
2396
2397 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2398 {
2399         PIPE_RPC_FNS *fns = NULL;
2400
2401         if ( !list ) {
2402                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2403                 return NULL;
2404         }
2405
2406         for (fns=list; fns; fns=fns->next ) {
2407                 if ( fns->context_id == context_id )
2408                         return fns;
2409         }
2410         return NULL;
2411 }
2412
2413 /****************************************************************************
2414  Memory cleanup.
2415 ****************************************************************************/
2416
2417 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2418 {
2419         PIPE_RPC_FNS *tmp = list;
2420         PIPE_RPC_FNS *tmp2;
2421
2422         while (tmp) {
2423                 tmp2 = tmp->next;
2424                 SAFE_FREE(tmp);
2425                 tmp = tmp2;
2426         }
2427
2428         return;
2429 }
2430
2431 static bool api_rpcTNP(pipes_struct *p,
2432                        const struct api_struct *api_rpc_cmds, int n_cmds);
2433
2434 /****************************************************************************
2435  Find the correct RPC function to call for this request.
2436  If the pipe is authenticated then become the correct UNIX user
2437  before doing the call.
2438 ****************************************************************************/
2439
2440 bool api_pipe_request(pipes_struct *p)
2441 {
2442         bool ret = False;
2443         bool changed_user = False;
2444         PIPE_RPC_FNS *pipe_fns;
2445
2446         if (p->pipe_bound &&
2447                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2448                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2449                 if(!become_authenticated_pipe_user(p)) {
2450                         prs_mem_free(&p->out_data.rdata);
2451                         return False;
2452                 }
2453                 changed_user = True;
2454         }
2455
2456         DEBUG(5, ("Requested \\PIPE\\%s\n",
2457                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2458
2459         /* get the set of RPC functions for this context */
2460
2461         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2462
2463         if ( pipe_fns ) {
2464                 TALLOC_CTX *frame = talloc_stackframe();
2465                 ret = api_rpcTNP(p, pipe_fns->cmds, pipe_fns->n_cmds);
2466                 TALLOC_FREE(frame);
2467         }
2468         else {
2469                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2470                         p->hdr_req.context_id,
2471                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2472         }
2473
2474         if (changed_user) {
2475                 unbecome_authenticated_pipe_user();
2476         }
2477
2478         return ret;
2479 }
2480
2481 /*******************************************************************
2482  Calls the underlying RPC function for a named pipe.
2483  ********************************************************************/
2484
2485 static bool api_rpcTNP(pipes_struct *p,
2486                        const struct api_struct *api_rpc_cmds, int n_cmds)
2487 {
2488         int fn_num;
2489         uint32 offset1, offset2;
2490
2491         /* interpret the command */
2492         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2493                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2494                  p->hdr_req.opnum));
2495
2496         if (DEBUGLEVEL >= 50) {
2497                 fstring name;
2498                 slprintf(name, sizeof(name)-1, "in_%s",
2499                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2500                 prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2501         }
2502
2503         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2504                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2505                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2506                         break;
2507                 }
2508         }
2509
2510         if (fn_num == n_cmds) {
2511                 /*
2512                  * For an unknown RPC just return a fault PDU but
2513                  * return True to allow RPC's on the pipe to continue
2514                  * and not put the pipe into fault state. JRA.
2515                  */
2516                 DEBUG(4, ("unknown\n"));
2517                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2518                 return True;
2519         }
2520
2521         offset1 = prs_offset(&p->out_data.rdata);
2522
2523         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2524                 fn_num, api_rpc_cmds[fn_num].fn));
2525         /* do the actual command */
2526         if(!api_rpc_cmds[fn_num].fn(p)) {
2527                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2528                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2529                          api_rpc_cmds[fn_num].name));
2530                 prs_mem_free(&p->out_data.rdata);
2531                 return False;
2532         }
2533
2534         if (p->bad_handle_fault_state) {
2535                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2536                 p->bad_handle_fault_state = False;
2537                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2538                 return True;
2539         }
2540
2541         if (p->rng_fault_state) {
2542                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2543                 p->rng_fault_state = False;
2544                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2545                 return True;
2546         }
2547
2548         offset2 = prs_offset(&p->out_data.rdata);
2549         prs_set_offset(&p->out_data.rdata, offset1);
2550         if (DEBUGLEVEL >= 50) {
2551                 fstring name;
2552                 slprintf(name, sizeof(name)-1, "out_%s",
2553                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2554                 prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2555         }
2556         prs_set_offset(&p->out_data.rdata, offset2);
2557
2558         DEBUG(5,("api_rpcTNP: called %s successfully\n",
2559                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2560
2561         /* Check for buffer underflow in rpc parsing */
2562
2563         if ((DEBUGLEVEL >= 10) &&
2564             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2565                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2566                 char *data = (char *)SMB_MALLOC(data_len);
2567
2568                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2569                 if (data) {
2570                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2571                         SAFE_FREE(data);
2572                 }
2573
2574         }
2575
2576         return True;
2577 }