source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "srv_pipe_internal.h"
  32 #include "../librpc/gen_ndr/ndr_schannel.h"
  33 #include "../libcli/auth/schannel.h"
  34 #include "../libcli/auth/spnego.h"
  35 #include "../libcli/auth/ntlmssp.h"
  36
  37 #undef DBGC_CLASS
  38 #define DBGC_CLASS DBGC_RPC_SRV
  39
  40 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  41 {
  42         struct auth_ntlmssp_state *a = auth->a_u.auth_ntlmssp_state;
  43
  44         if (a) {
  45                 auth_ntlmssp_end(&a);
  46         }
  47         auth->a_u.auth_ntlmssp_state = NULL;
  48 }
  49
  50 static DATA_BLOB generic_session_key(void)
  51 {
  52         return data_blob("SystemLibraryDTC", 16);
  53 }
  54
  55 /*******************************************************************
  56  Generate the next PDU to be returned from the data in p->rdata.
  57  Handle NTLMSSP.
  58  ********************************************************************/
  59
  60 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  61 {
  62         RPC_HDR_RESP hdr_resp;
  63         uint32 ss_padding_len = 0;
  64         uint32 data_space_available;
  65         uint32 data_len_left;
  66         uint32 data_len;
  67         NTSTATUS status;
  68         DATA_BLOB auth_blob;
  69         RPC_HDR_AUTH auth_info;
  70         uint8 auth_type, auth_level;
  71         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
  72         TALLOC_CTX *frame;
  73
  74         /*
  75          * If we're in the fault state, keep returning fault PDU's until
  76          * the pipe gets closed. JRA.
  77          */
  78
  79         if(p->fault_state) {
  80                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  81                 return True;
  82         }
  83
  84         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  85
  86         /* Change the incoming request header to a response. */
  87         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
  88
  89         /* Set up rpc header flags. */
  90         if (p->out_data.data_sent_length == 0) {
  91                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
  92         } else {
  93                 p->hdr.flags = 0;
  94         }
  95
  96         /*
  97          * Work out how much we can fit in a single PDU.
  98          */
  99
 100         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 101
 102         /*
 103          * Ensure there really is data left to send.
 104          */
 105
 106         if(!data_len_left) {
 107                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 108                 return False;
 109         }
 110
 111         /* Space available - not including padding. */
 112         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN -
 113                 RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 114
 115         /*
 116          * The amount we send is the minimum of the available
 117          * space and the amount left to send.
 118          */
 119
 120         data_len = MIN(data_len_left, data_space_available);
 121
 122         /* Work out any padding alignment requirements. */
 123         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 124                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 125                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 126                 DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 127                         ss_padding_len ));
 128                 /* If we're over filling the packet, we need to make space
 129                  * for the padding at the end of the data. */
 130                 if (data_len + ss_padding_len > data_space_available) {
 131                         data_len -= SERVER_NDR_PADDING_SIZE;
 132                 }
 133         }
 134
 135         /*
 136          * Set up the alloc hint. This should be the data left to
 137          * send.
 138          */
 139
 140         hdr_resp.alloc_hint = data_len_left;
 141
 142         /*
 143          * Work out if this PDU will be the last.
 144          */
 145
 146         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 147                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 148         }
 149
 150         /*
 151          * Set up the header lengths.
 152          */
 153
 154         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 155                         data_len + ss_padding_len +
 156                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 157         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 158
 159
 160         /*
 161          * Init the parse struct to point at the outgoing
 162          * data.
 163          */
 164
 165         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 166
 167         /* Store the header in the data stream. */
 168         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 169                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 170                 prs_mem_free(&p->out_data.frag);
 171                 return False;
 172         }
 173
 174         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 175                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 176                 prs_mem_free(&p->out_data.frag);
 177                 return False;
 178         }
 179
 180         /* Copy the data into the PDU. */
 181
 182         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 183                                      p->out_data.data_sent_length, data_len)) {
 184                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 185                 prs_mem_free(&p->out_data.frag);
 186                 return False;
 187         }
 188
 189         /* Copy the sign/seal padding data. */
 190         if (ss_padding_len) {
 191                 char pad[SERVER_NDR_PADDING_SIZE];
 192
 193                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 194                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 195                                       ss_padding_len)) {
 196                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 197                                         (unsigned int)ss_padding_len));
 198                         prs_mem_free(&p->out_data.frag);
 199                         return False;
 200                 }
 201         }
 202
 203
 204         /* Now write out the auth header and null blob. */
 205         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 206                 auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 207         } else {
 208                 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 209         }
 210         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 211                 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 212         } else {
 213                 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 214         }
 215
 216         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 217
 218         if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 219                                 &p->out_data.frag, 0)) {
 220                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 221                 prs_mem_free(&p->out_data.frag);
 222                 return False;
 223         }
 224
 225         /* Generate the sign blob. */
 226
 227         frame = talloc_stackframe();
 228         switch (p->auth.auth_level) {
 229                 case DCERPC_AUTH_LEVEL_PRIVACY:
 230                         /* Data portion is encrypted. */
 231                         status = auth_ntlmssp_seal_packet(
 232                                 a, frame,
 233                                 (uint8_t *)prs_data_p(&p->out_data.frag)
 234                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 235                                 data_len + ss_padding_len,
 236                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 237                                 (size_t)prs_offset(&p->out_data.frag),
 238                                 &auth_blob);
 239                         if (!NT_STATUS_IS_OK(status)) {
 240                                 talloc_free(frame);
 241                                 prs_mem_free(&p->out_data.frag);
 242                                 return False;
 243                         }
 244                         break;
 245                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 246                         /* Data is signed. */
 247                         status = auth_ntlmssp_sign_packet(
 248                                 a, frame,
 249                                 (unsigned char *)prs_data_p(&p->out_data.frag)
 250                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 251                                 data_len + ss_padding_len,
 252                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 253                                 (size_t)prs_offset(&p->out_data.frag),
 254                                 &auth_blob);
 255                         if (!NT_STATUS_IS_OK(status)) {
 256                                 talloc_free(frame);
 257                                 prs_mem_free(&p->out_data.frag);
 258                                 return False;
 259                         }
 260                         break;
 261                 default:
 262                         talloc_free(frame);
 263                         prs_mem_free(&p->out_data.frag);
 264                         return False;
 265         }
 266
 267         /* Append the auth blob. */
 268         if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
 269                               NTLMSSP_SIG_SIZE)) {
 270                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 271                                 (unsigned int)NTLMSSP_SIG_SIZE));
 272                 talloc_free(frame);
 273                 prs_mem_free(&p->out_data.frag);
 274                 return False;
 275         }
 276         talloc_free(frame);
 277
 278         /*
 279          * Setup the counts for this PDU.
 280          */
 281
 282         p->out_data.data_sent_length += data_len;
 283         p->out_data.current_pdu_sent = 0;
 284
 285         return True;
 286 }
 287
 288 /*******************************************************************
 289  Generate the next PDU to be returned from the data in p->rdata.
 290  Return an schannel authenticated fragment.
 291  ********************************************************************/
 292
 293 static bool create_next_pdu_schannel(pipes_struct *p)
 294 {
 295         RPC_HDR_RESP hdr_resp;
 296         uint32 ss_padding_len = 0;
 297         uint32 data_len;
 298         uint32 data_space_available;
 299         uint32 data_len_left;
 300         uint32 data_pos;
 301         NTSTATUS status;
 302
 303         /*
 304          * If we're in the fault state, keep returning fault PDU's until
 305          * the pipe gets closed. JRA.
 306          */
 307
 308         if(p->fault_state) {
 309                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 310                 return True;
 311         }
 312
 313         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 314
 315         /* Change the incoming request header to a response. */
 316         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
 317
 318         /* Set up rpc header flags. */
 319         if (p->out_data.data_sent_length == 0) {
 320                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
 321         } else {
 322                 p->hdr.flags = 0;
 323         }
 324
 325         /*
 326          * Work out how much we can fit in a single PDU.
 327          */
 328
 329         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 330
 331         /*
 332          * Ensure there really is data left to send.
 333          */
 334
 335         if(!data_len_left) {
 336                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 337                 return False;
 338         }
 339
 340         /* Space available - not including padding. */
 341         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 342                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
 343                 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 344
 345         /*
 346          * The amount we send is the minimum of the available
 347          * space and the amount left to send.
 348          */
 349
 350         data_len = MIN(data_len_left, data_space_available);
 351
 352         /* Work out any padding alignment requirements. */
 353         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 354                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 355                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 356                 DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 357                         ss_padding_len ));
 358                 /* If we're over filling the packet, we need to make space
 359                  * for the padding at the end of the data. */
 360                 if (data_len + ss_padding_len > data_space_available) {
 361                         data_len -= SERVER_NDR_PADDING_SIZE;
 362                 }
 363         }
 364
 365         /*
 366          * Set up the alloc hint. This should be the data left to
 367          * send.
 368          */
 369
 370         hdr_resp.alloc_hint = data_len_left;
 371
 372         /*
 373          * Work out if this PDU will be the last.
 374          */
 375
 376         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 377                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 378         }
 379
 380         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 381                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 382         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 383
 384         /*
 385          * Init the parse struct to point at the outgoing
 386          * data.
 387          */
 388
 389         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 390
 391         /* Store the header in the data stream. */
 392         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 393                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 394                 prs_mem_free(&p->out_data.frag);
 395                 return False;
 396         }
 397
 398         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 399                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 400                 prs_mem_free(&p->out_data.frag);
 401                 return False;
 402         }
 403
 404         /* Store the current offset. */
 405         data_pos = prs_offset(&p->out_data.frag);
 406
 407         /* Copy the data into the PDU. */
 408
 409         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 410                                      p->out_data.data_sent_length, data_len)) {
 411                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 412                 prs_mem_free(&p->out_data.frag);
 413                 return False;
 414         }
 415
 416         /* Copy the sign/seal padding data. */
 417         if (ss_padding_len) {
 418                 char pad[SERVER_NDR_PADDING_SIZE];
 419                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 420                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 421                                       ss_padding_len)) {
 422                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 423                         prs_mem_free(&p->out_data.frag);
 424                         return False;
 425                 }
 426         }
 427
 428         {
 429                 /*
 430                  * Schannel processing.
 431                  */
 432                 RPC_HDR_AUTH auth_info;
 433                 DATA_BLOB blob;
 434                 uint8_t *data;
 435
 436                 /* Check it's the type of reply we were expecting to decode */
 437
 438                 init_rpc_hdr_auth(&auth_info,
 439                                 DCERPC_AUTH_TYPE_SCHANNEL,
 440                                 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
 441                                         DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
 442                                 ss_padding_len, 1);
 443
 444                 if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 445                                         &p->out_data.frag, 0)) {
 446                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 447                         prs_mem_free(&p->out_data.frag);
 448                         return False;
 449                 }
 450
 451                 data = (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos;
 452
 453                 switch (p->auth.auth_level) {
 454                 case DCERPC_AUTH_LEVEL_PRIVACY:
 455                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 456                                                         talloc_tos(),
 457                                                         true,
 458                                                         data,
 459                                                         data_len + ss_padding_len,
 460                                                         &blob);
 461                         break;
 462                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 463                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 464                                                         talloc_tos(),
 465                                                         false,
 466                                                         data,
 467                                                         data_len + ss_padding_len,
 468                                                         &blob);
 469                         break;
 470                 default:
 471                         status = NT_STATUS_INTERNAL_ERROR;
 472                         break;
 473                 }
 474
 475                 if (!NT_STATUS_IS_OK(status)) {
 476                         DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
 477                                 nt_errstr(status)));
 478                         prs_mem_free(&p->out_data.frag);
 479                         return false;
 480                 }
 481
 482                 /* Finally marshall the blob. */
 483
 484                 if (DEBUGLEVEL >= 10) {
 485                         dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
 486                 }
 487
 488                 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
 489                         prs_mem_free(&p->out_data.frag);
 490                         return false;
 491                 }
 492         }
 493
 494         /*
 495          * Setup the counts for this PDU.
 496          */
 497
 498         p->out_data.data_sent_length += data_len;
 499         p->out_data.current_pdu_sent = 0;
 500
 501         return True;
 502 }
 503
 504 /*******************************************************************
 505  Generate the next PDU to be returned from the data in p->rdata.
 506  No authentication done.
 507 ********************************************************************/
 508
 509 static bool create_next_pdu_noauth(pipes_struct *p)
 510 {
 511         RPC_HDR_RESP hdr_resp;
 512         uint32 data_len;
 513         uint32 data_space_available;
 514         uint32 data_len_left;
 515
 516         /*
 517          * If we're in the fault state, keep returning fault PDU's until
 518          * the pipe gets closed. JRA.
 519          */
 520
 521         if(p->fault_state) {
 522                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 523                 return True;
 524         }
 525
 526         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 527
 528         /* Change the incoming request header to a response. */
 529         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
 530
 531         /* Set up rpc header flags. */
 532         if (p->out_data.data_sent_length == 0) {
 533                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
 534         } else {
 535                 p->hdr.flags = 0;
 536         }
 537
 538         /*
 539          * Work out how much we can fit in a single PDU.
 540          */
 541
 542         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 543
 544         /*
 545          * Ensure there really is data left to send.
 546          */
 547
 548         if(!data_len_left) {
 549                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 550                 return False;
 551         }
 552
 553         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 554                 - RPC_HDR_RESP_LEN;
 555
 556         /*
 557          * The amount we send is the minimum of the available
 558          * space and the amount left to send.
 559          */
 560
 561         data_len = MIN(data_len_left, data_space_available);
 562
 563         /*
 564          * Set up the alloc hint. This should be the data left to
 565          * send.
 566          */
 567
 568         hdr_resp.alloc_hint = data_len_left;
 569
 570         /*
 571          * Work out if this PDU will be the last.
 572          */
 573
 574         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 575                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 576         }
 577
 578         /*
 579          * Set up the header lengths.
 580          */
 581
 582         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 583         p->hdr.auth_len = 0;
 584
 585         /*
 586          * Init the parse struct to point at the outgoing
 587          * data.
 588          */
 589
 590         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 591
 592         /* Store the header in the data stream. */
 593         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 594                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 595                 prs_mem_free(&p->out_data.frag);
 596                 return False;
 597         }
 598
 599         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 600                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 601                 prs_mem_free(&p->out_data.frag);
 602                 return False;
 603         }
 604
 605         /* Copy the data into the PDU. */
 606
 607         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 608                                      p->out_data.data_sent_length, data_len)) {
 609                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 610                 prs_mem_free(&p->out_data.frag);
 611                 return False;
 612         }
 613
 614         /*
 615          * Setup the counts for this PDU.
 616          */
 617
 618         p->out_data.data_sent_length += data_len;
 619         p->out_data.current_pdu_sent = 0;
 620
 621         return True;
 622 }
 623
 624 /*******************************************************************
 625  Generate the next PDU to be returned from the data in p->rdata.
 626 ********************************************************************/
 627
 628 bool create_next_pdu(pipes_struct *p)
 629 {
 630         switch(p->auth.auth_level) {
 631                 case DCERPC_AUTH_LEVEL_NONE:
 632                 case DCERPC_AUTH_LEVEL_CONNECT:
 633                         /* This is incorrect for auth level connect. Fixme. JRA */
 634                         return create_next_pdu_noauth(p);
 635
 636                 default:
 637                         switch(p->auth.auth_type) {
 638                                 case PIPE_AUTH_TYPE_NTLMSSP:
 639                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 640                                         return create_next_pdu_ntlmssp(p);
 641                                 case PIPE_AUTH_TYPE_SCHANNEL:
 642                                         return create_next_pdu_schannel(p);
 643                                 default:
 644                                         break;
 645                         }
 646         }
 647
 648         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 649                         (unsigned int)p->auth.auth_level,
 650                         (unsigned int)p->auth.auth_type));
 651         return False;
 652 }
 653
 654 /*******************************************************************
 655  Process an NTLMSSP authentication response.
 656  If this function succeeds, the user has been authenticated
 657  and their domain, name and calling workstation stored in
 658  the pipe struct.
 659 *******************************************************************/
 660
 661 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 662 {
 663         DATA_BLOB session_key, reply;
 664         NTSTATUS status;
 665         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
 666         bool ret;
 667
 668         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
 669                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 670
 671         ZERO_STRUCT(reply);
 672
 673         /* this has to be done as root in order to verify the password */
 674         become_root();
 675         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 676         unbecome_root();
 677
 678         /* Don't generate a reply. */
 679         data_blob_free(&reply);
 680
 681         if (!NT_STATUS_IS_OK(status)) {
 682                 return False;
 683         }
 684
 685         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 686            ensure the underlying NTLMSSP flags are also set. If not we should
 687            refuse the bind. */
 688
 689         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
 690                 if (!auth_ntlmssp_negotiated_sign(a)) {
 691                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 692                                 "but client declined signing.\n",
 693                                  get_pipe_name_from_syntax(talloc_tos(),
 694                                                            &p->syntax)));
 695                         return False;
 696                 }
 697         }
 698         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 699                 if (!auth_ntlmssp_negotiated_seal(a)) {
 700                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 701                                 "but client declined sealing.\n",
 702                                  get_pipe_name_from_syntax(talloc_tos(),
 703                                                            &p->syntax)));
 704                         return False;
 705                 }
 706         }
 707
 708         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 709                   "workstation: %s\n",
 710                   auth_ntlmssp_get_username(a),
 711                   auth_ntlmssp_get_domain(a),
 712                   auth_ntlmssp_get_client(a)));
 713
 714         TALLOC_FREE(p->server_info);
 715
 716         p->server_info = auth_ntlmssp_server_info(p, a);
 717         if (p->server_info == NULL) {
 718                 DEBUG(0, ("auth_ntlmssp_server_info failed to obtain the server info for authenticated user\n"));
 719                 return false;
 720         }
 721
 722         if (p->server_info->ptok == NULL) {
 723                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 724                 return False;
 725         }
 726
 727         /*
 728          * We're an authenticated bind over smb, so the session key needs to
 729          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 730          * does. See the RPC-SAMBA3SESSIONKEY.
 731          */
 732
 733         session_key = generic_session_key();
 734         if (session_key.data == NULL) {
 735                 return False;
 736         }
 737
 738         ret = server_info_set_session_key(p->server_info, session_key);
 739
 740         data_blob_free(&session_key);
 741
 742         return True;
 743 }
 744
 745 /*******************************************************************
 746  This is the "stage3" NTLMSSP response after a bind request and reply.
 747 *******************************************************************/
 748
 749 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 750 {
 751         RPC_HDR_AUTH auth_info;
 752         uint32 pad = 0;
 753         DATA_BLOB blob;
 754         uint32_t auth_len = p->hdr.auth_len;
 755
 756         ZERO_STRUCT(blob);
 757
 758         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 759
 760         if (auth_len == 0) {
 761                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 762                 goto err;
 763         }
 764
 765         /* 4 bytes padding. */
 766         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 767                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 768                 goto err;
 769         }
 770
 771         /* Ensure there's enough data for an authenticated request. */
 772         if (RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + auth_len >
 773                                 p->hdr.frag_len) {
 774                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
 775                                 "%u is too large.\n",
 776                         (unsigned int)auth_len ));
 777                 goto err;
 778         }
 779
 780         /*
 781          * Decode the authentication verifier response.
 782          */
 783
 784         /* Pull the auth header and the following data into a blob. */
 785         /* NB. The offset of the auth_header is relative to the *end*
 786          * of the packet, not the start. Also, the length of the
 787          * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
 788          * as the RPC header isn't included in rpc_in_p. */
 789         if(!prs_set_offset(rpc_in_p,
 790                         p->hdr.frag_len - RPC_HEADER_LEN -
 791                         RPC_HDR_AUTH_LEN - auth_len)) {
 792                 DEBUG(0,("api_pipe_bind_auth3: cannot move "
 793                         "offset to %u.\n",
 794                         (unsigned int)(p->hdr.frag_len -
 795                                 RPC_HDR_AUTH_LEN - auth_len) ));
 796                 goto err;
 797         }
 798
 799         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in_p, 0)) {
 800                 DEBUG(0,("api_pipe_bind_auth3: failed to "
 801                         "unmarshall RPC_HDR_AUTH.\n"));
 802                 goto err;
 803         }
 804
 805         /* We must NEVER look at auth_info->auth_pad_len here,
 806          * as old Samba client code gets it wrong and sends it
 807          * as zero. JRA.
 808          */
 809
 810         if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
 811                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 812                         (unsigned int)auth_info.auth_type ));
 813                 return False;
 814         }
 815
 816         blob = data_blob(NULL,p->hdr.auth_len);
 817
 818         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 819                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 820                         (unsigned int)p->hdr.auth_len ));
 821                 goto err;
 822         }
 823
 824         /*
 825          * The following call actually checks the challenge/response data.
 826          * for correctness against the given DOMAIN\user name.
 827          */
 828
 829         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 830                 goto err;
 831         }
 832
 833         data_blob_free(&blob);
 834
 835         p->pipe_bound = True;
 836
 837         return True;
 838
 839  err:
 840
 841         data_blob_free(&blob);
 842         free_pipe_ntlmssp_auth_data(&p->auth);
 843         p->auth.a_u.auth_ntlmssp_state = NULL;
 844
 845         return False;
 846 }
 847
 848 /*******************************************************************
 849  Marshall a bind_nak pdu.
 850 *******************************************************************/
 851
 852 static bool setup_bind_nak(pipes_struct *p)
 853 {
 854         NTSTATUS status;
 855         union dcerpc_payload u;
 856         DATA_BLOB blob;
 857
 858         /* Free any memory in the current return data buffer. */
 859         prs_mem_free(&p->out_data.rdata);
 860
 861         /*
 862          * Marshall directly into the outgoing PDU space. We
 863          * must do this as we need to set to the bind response
 864          * header and are never sending more than one PDU here.
 865          */
 866
 867         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 868
 869         /*
 870          * Initialize a bind_nak header.
 871          */
 872
 873         ZERO_STRUCT(u);
 874
 875         u.bind_nak.reject_reason  = 0;
 876
 877         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 878                                           DCERPC_PKT_BIND_NAK,
 879                                           DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
 880                                           RPC_HEADER_LEN + sizeof(uint16_t) /* FIXME - gd */,
 881                                           0,
 882                                           p->hdr.call_id,
 883                                           u,
 884                                           &blob);
 885         if (!NT_STATUS_IS_OK(status)) {
 886                 prs_mem_free(&p->out_data.frag);
 887                 return False;
 888         }
 889
 890         if (!prs_copy_data_in(&p->out_data.frag,
 891                               (char *)blob.data, blob.length)) {
 892                 prs_mem_free(&p->out_data.frag);
 893                 return False;
 894         }
 895
 896         p->out_data.data_sent_length = 0;
 897         p->out_data.current_pdu_sent = 0;
 898
 899         if (p->auth.auth_data_free_func) {
 900                 (*p->auth.auth_data_free_func)(&p->auth);
 901         }
 902         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 903         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 904         p->pipe_bound = False;
 905
 906         return True;
 907 }
 908
 909 /*******************************************************************
 910  Marshall a fault pdu.
 911 *******************************************************************/
 912
 913 bool setup_fault_pdu(pipes_struct *p, NTSTATUS fault_status)
 914 {
 915         NTSTATUS status;
 916         union dcerpc_payload u;
 917         DATA_BLOB blob;
 918
 919         /* Free any memory in the current return data buffer. */
 920         prs_mem_free(&p->out_data.rdata);
 921
 922         /*
 923          * Marshall directly into the outgoing PDU space. We
 924          * must do this as we need to set to the bind response
 925          * header and are never sending more than one PDU here.
 926          */
 927
 928         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 929
 930         /*
 931          * Initialize a fault header.
 932          */
 933
 934         ZERO_STRUCT(u);
 935
 936         u.fault.status          = NT_STATUS_V(fault_status);
 937         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 938
 939         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 940                                           DCERPC_PKT_FAULT,
 941                                           DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST | DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 942                                           RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN /* FIXME - gd */,
 943                                           0,
 944                                           p->hdr.call_id,
 945                                           u,
 946                                           &blob);
 947         if (!NT_STATUS_IS_OK(status)) {
 948                 prs_mem_free(&p->out_data.frag);
 949                 return False;
 950         }
 951
 952         if (!prs_copy_data_in(&p->out_data.frag,
 953                               (char *)blob.data, blob.length)) {
 954                 prs_mem_free(&p->out_data.frag);
 955                 return False;
 956         }
 957
 958         p->out_data.data_sent_length = 0;
 959         p->out_data.current_pdu_sent = 0;
 960
 961         return True;
 962 }
 963
 964 /*******************************************************************
 965  Ensure a bind request has the correct abstract & transfer interface.
 966  Used to reject unknown binds from Win2k.
 967 *******************************************************************/
 968
 969 static bool check_bind_req(struct pipes_struct *p,
 970                            struct ndr_syntax_id* abstract,
 971                            struct ndr_syntax_id* transfer,
 972                            uint32 context_id)
 973 {
 974         struct pipe_rpc_fns *context_fns;
 975
 976         DEBUG(3,("check_bind_req for %s\n",
 977                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 978
 979         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 980         if (rpc_srv_pipe_exists_by_id(abstract) &&
 981            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 982                 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 983                         rpc_srv_get_pipe_cli_name(abstract),
 984                         rpc_srv_get_pipe_srv_name(abstract)));
 985         } else {
 986                 return false;
 987         }
 988
 989         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 990         if (context_fns == NULL) {
 991                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 992                 return False;
 993         }
 994
 995         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 996         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 997         context_fns->context_id = context_id;
 998
 999         /* add to the list of open contexts */
1000
1001         DLIST_ADD( p->contexts, context_fns );
1002
1003         return True;
1004 }
1005
1006 /**
1007  * Is a named pipe known?
1008  * @param[in] cli_filename      The pipe name requested by the client
1009  * @result                      Do we want to serve this?
1010  */
1011 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1012 {
1013         const char *pipename = cli_filename;
1014         NTSTATUS status;
1015
1016         if (strnequal(pipename, "\\PIPE\\", 6)) {
1017                 pipename += 5;
1018         }
1019
1020         if (*pipename == '\\') {
1021                 pipename += 1;
1022         }
1023
1024         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1025                 DEBUG(10, ("refusing spoolss access\n"));
1026                 return false;
1027         }
1028
1029         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1030                 return true;
1031         }
1032
1033         status = smb_probe_module("rpc", pipename);
1034         if (!NT_STATUS_IS_OK(status)) {
1035                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1036                 return false;
1037         }
1038         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
1039
1040         /*
1041          * Scan the list again for the interface id
1042          */
1043         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1044                 return true;
1045         }
1046
1047         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
1048                    pipename));
1049
1050         return false;
1051 }
1052
1053 /*******************************************************************
1054  Handle a SPNEGO krb5 bind auth.
1055 *******************************************************************/
1056
1057 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1058                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1059 {
1060         return False;
1061 }
1062
1063 /*******************************************************************
1064  Handle the first part of a SPNEGO bind auth.
1065 *******************************************************************/
1066
1067 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1068                                         uint32_t ss_padding_len,
1069                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1070 {
1071         DATA_BLOB blob;
1072         DATA_BLOB secblob;
1073         DATA_BLOB response;
1074         DATA_BLOB chal;
1075         char *OIDs[ASN1_MAX_OIDS];
1076         int i;
1077         NTSTATUS status;
1078         bool got_kerberos_mechanism = false;
1079         struct auth_ntlmssp_state *a = NULL;
1080         RPC_HDR_AUTH auth_info;
1081
1082         ZERO_STRUCT(secblob);
1083         ZERO_STRUCT(chal);
1084         ZERO_STRUCT(response);
1085
1086         /* Grab the SPNEGO blob. */
1087         blob = data_blob(NULL,p->hdr.auth_len);
1088
1089         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1090                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1091                         (unsigned int)p->hdr.auth_len ));
1092                 goto err;
1093         }
1094
1095         if (blob.data[0] != ASN1_APPLICATION(0)) {
1096                 goto err;
1097         }
1098
1099         /* parse out the OIDs and the first sec blob */
1100         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1101                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1102                 goto err;
1103         }
1104
1105         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1106                 got_kerberos_mechanism = true;
1107         }
1108
1109         for (i=0;OIDs[i];i++) {
1110                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1111                 TALLOC_FREE(OIDs[i]);
1112         }
1113         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1114
1115         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1116                 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1117                 data_blob_free(&secblob);
1118                 data_blob_free(&blob);
1119                 return ret;
1120         }
1121
1122         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1123                 /* Free any previous auth type. */
1124                 free_pipe_ntlmssp_auth_data(&p->auth);
1125         }
1126
1127         if (!got_kerberos_mechanism) {
1128                 /* Initialize the NTLM engine. */
1129                 status = auth_ntlmssp_start(&a);
1130                 if (!NT_STATUS_IS_OK(status)) {
1131                         goto err;
1132                 }
1133
1134                 switch (pauth_info->auth_level) {
1135                         case DCERPC_AUTH_LEVEL_INTEGRITY:
1136                                 auth_ntlmssp_want_sign(a);
1137                                 break;
1138                         case DCERPC_AUTH_LEVEL_PRIVACY:
1139                                 auth_ntlmssp_want_seal(a);
1140                                 break;
1141                         default:
1142                                 break;
1143                 }
1144                 /*
1145                  * Pass the first security blob of data to it.
1146                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1147                  * which means we need another packet to complete the bind.
1148                  */
1149
1150                 status = auth_ntlmssp_update(a, secblob, &chal);
1151
1152                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1153                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1154                         goto err;
1155                 }
1156
1157                 /* Generate the response blob we need for step 2 of the bind. */
1158                 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1159         } else {
1160                 /*
1161                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1162                  * code to process follow-up packets is not complete
1163                  * yet. JRA.
1164                  */
1165                 response = spnego_gen_auth_response(NULL,
1166                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1167                                         OID_NTLMSSP);
1168         }
1169
1170         /* auth_pad_len will be handled by the caller */
1171
1172         /* Copy the blob into the pout_auth parse struct */
1173         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1174                         pauth_info->auth_level, ss_padding_len, 1);
1175         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1176                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1177                 goto err;
1178         }
1179
1180         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1181                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1182                 goto err;
1183         }
1184
1185         p->auth.a_u.auth_ntlmssp_state = a;
1186         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1187         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1188
1189         data_blob_free(&blob);
1190         data_blob_free(&secblob);
1191         data_blob_free(&chal);
1192         data_blob_free(&response);
1193
1194         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1195         return True;
1196
1197  err:
1198
1199         data_blob_free(&blob);
1200         data_blob_free(&secblob);
1201         data_blob_free(&chal);
1202         data_blob_free(&response);
1203
1204         p->auth.a_u.auth_ntlmssp_state = NULL;
1205
1206         return False;
1207 }
1208
1209 /*******************************************************************
1210  Handle the second part of a SPNEGO bind auth.
1211 *******************************************************************/
1212
1213 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1214                                 uint32_t ss_padding_len,
1215                                 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1216 {
1217         RPC_HDR_AUTH auth_info;
1218         DATA_BLOB spnego_blob;
1219         DATA_BLOB auth_blob;
1220         DATA_BLOB auth_reply;
1221         DATA_BLOB response;
1222         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
1223
1224         ZERO_STRUCT(spnego_blob);
1225         ZERO_STRUCT(auth_blob);
1226         ZERO_STRUCT(auth_reply);
1227         ZERO_STRUCT(response);
1228
1229         /*
1230          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1231          * fail here as 'a' == NULL.
1232          */
1233         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1234                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1235                 goto err;
1236         }
1237
1238         /* Grab the SPNEGO blob. */
1239         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1240
1241         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1242                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1243                         (unsigned int)p->hdr.auth_len ));
1244                 goto err;
1245         }
1246
1247         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1248                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1249                 goto err;
1250         }
1251
1252         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1253                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1254                 goto err;
1255         }
1256
1257         /*
1258          * The following call actually checks the challenge/response data.
1259          * for correctness against the given DOMAIN\user name.
1260          */
1261
1262         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1263                 goto err;
1264         }
1265
1266         data_blob_free(&spnego_blob);
1267         data_blob_free(&auth_blob);
1268
1269         /* Generate the spnego "accept completed" blob - no incoming data. */
1270         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1271
1272         /* FIXME - add auth_pad_len here ! */
1273
1274         /* Copy the blob into the pout_auth parse struct */
1275         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1276                         pauth_info->auth_level, ss_padding_len, 1);
1277         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1278                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1279                 goto err;
1280         }
1281
1282         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1283                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1284                 goto err;
1285         }
1286
1287         data_blob_free(&auth_reply);
1288         data_blob_free(&response);
1289
1290         p->pipe_bound = True;
1291
1292         return True;
1293
1294  err:
1295
1296         data_blob_free(&spnego_blob);
1297         data_blob_free(&auth_blob);
1298         data_blob_free(&auth_reply);
1299         data_blob_free(&response);
1300
1301         free_pipe_ntlmssp_auth_data(&p->auth);
1302         p->auth.a_u.auth_ntlmssp_state = NULL;
1303
1304         return False;
1305 }
1306
1307 /*******************************************************************
1308  Handle an schannel bind auth.
1309 *******************************************************************/
1310
1311 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1312                                         uint32_t ss_padding_len,
1313                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1314 {
1315         RPC_HDR_AUTH auth_info;
1316         struct NL_AUTH_MESSAGE neg;
1317         struct NL_AUTH_MESSAGE reply;
1318         bool ret;
1319         NTSTATUS status;
1320         struct netlogon_creds_CredentialState *creds;
1321         DATA_BLOB session_key;
1322         enum ndr_err_code ndr_err;
1323         DATA_BLOB blob;
1324
1325         blob = data_blob_const(prs_data_p(rpc_in_p) + prs_offset(rpc_in_p),
1326                                prs_data_size(rpc_in_p));
1327
1328         ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), &neg,
1329                                (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1330         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1331                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1332                 return false;
1333         }
1334
1335         if (DEBUGLEVEL >= 10) {
1336                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1337         }
1338
1339         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1340                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1341                 return false;
1342         }
1343
1344         /*
1345          * The neg.oem_netbios_computer.a key here must match the remote computer name
1346          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1347          * operations that use credentials.
1348          */
1349
1350         become_root();
1351         status = schannel_get_creds_state(p, lp_private_dir(),
1352                                             neg.oem_netbios_computer.a, &creds);
1353         unbecome_root();
1354
1355         if (!NT_STATUS_IS_OK(status)) {
1356                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1357                 return False;
1358         }
1359
1360         p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1361         if (!p->auth.a_u.schannel_auth) {
1362                 TALLOC_FREE(creds);
1363                 return False;
1364         }
1365
1366         p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1367         p->auth.a_u.schannel_auth->seq_num = 0;
1368         p->auth.a_u.schannel_auth->initiator = false;
1369         p->auth.a_u.schannel_auth->creds = creds;
1370
1371         /*
1372          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1373          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1374          * struct of the person who opened the pipe. I need to test this further. JRA.
1375          *
1376          * VL. As we are mapping this to guest set the generic key
1377          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1378          * W2k3, as it does not allow schannel binds against SAMR and LSA
1379          * anymore.
1380          */
1381
1382         session_key = generic_session_key();
1383         if (session_key.data == NULL) {
1384                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1385                           " key\n"));
1386                 return false;
1387         }
1388
1389         ret = server_info_set_session_key(p->server_info, session_key);
1390
1391         data_blob_free(&session_key);
1392
1393         if (!ret) {
1394                 DEBUG(0, ("server_info_set_session_key failed\n"));
1395                 return false;
1396         }
1397
1398         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SCHANNEL,
1399                         pauth_info->auth_level, ss_padding_len, 1);
1400         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1401                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1402                 return False;
1403         }
1404
1405         /*** SCHANNEL verifier ***/
1406
1407         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
1408         reply.Flags                             = 0;
1409         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
1410                                                       * this has any meaning
1411                                                       * here - gd */
1412
1413         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &reply,
1414                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1415         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1416                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1417                 return false;
1418         }
1419
1420         if (DEBUGLEVEL >= 10) {
1421                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1422         }
1423
1424         if (!prs_copy_data_in(pout_auth, (const char *)blob.data, blob.length)) {
1425                 return false;
1426         }
1427
1428         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1429                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1430
1431         /* We're finished with this bind - no more packets. */
1432         p->auth.auth_data_free_func = NULL;
1433         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1434
1435         p->pipe_bound = True;
1436
1437         return True;
1438 }
1439
1440 /*******************************************************************
1441  Handle an NTLMSSP bind auth.
1442 *******************************************************************/
1443
1444 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1445                                         uint32_t ss_padding_len,
1446                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1447 {
1448         RPC_HDR_AUTH auth_info;
1449         DATA_BLOB blob;
1450         DATA_BLOB response;
1451         NTSTATUS status;
1452         struct auth_ntlmssp_state *a = NULL;
1453
1454         ZERO_STRUCT(blob);
1455         ZERO_STRUCT(response);
1456
1457         /* Grab the NTLMSSP blob. */
1458         blob = data_blob(NULL,p->hdr.auth_len);
1459
1460         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1461                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1462                         (unsigned int)p->hdr.auth_len ));
1463                 goto err;
1464         }
1465
1466         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1467                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1468                 goto err;
1469         }
1470
1471         /* We have an NTLMSSP blob. */
1472         status = auth_ntlmssp_start(&a);
1473         if (!NT_STATUS_IS_OK(status)) {
1474                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1475                         nt_errstr(status) ));
1476                 goto err;
1477         }
1478
1479         switch (pauth_info->auth_level) {
1480         case DCERPC_AUTH_LEVEL_INTEGRITY:
1481                 auth_ntlmssp_want_sign(a);
1482                 break;
1483         case DCERPC_AUTH_LEVEL_PRIVACY:
1484                 auth_ntlmssp_want_seal(a);
1485                 break;
1486         default:
1487                 break;
1488         }
1489
1490         status = auth_ntlmssp_update(a, blob, &response);
1491         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1492                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1493                         nt_errstr(status) ));
1494                 goto err;
1495         }
1496
1497         data_blob_free(&blob);
1498
1499         /* Copy the blob into the pout_auth parse struct */
1500         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_NTLMSSP,
1501                         pauth_info->auth_level, ss_padding_len, 1);
1502         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1503                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1504                 goto err;
1505         }
1506
1507         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1508                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1509                 goto err;
1510         }
1511
1512         p->auth.a_u.auth_ntlmssp_state = a;
1513         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1514         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1515
1516         data_blob_free(&blob);
1517         data_blob_free(&response);
1518
1519         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1520
1521         /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1522         return True;
1523
1524   err:
1525
1526         data_blob_free(&blob);
1527         data_blob_free(&response);
1528
1529         free_pipe_ntlmssp_auth_data(&p->auth);
1530         p->auth.a_u.auth_ntlmssp_state = NULL;
1531         return False;
1532 }
1533
1534 /*******************************************************************
1535  Respond to a pipe bind request.
1536 *******************************************************************/
1537
1538 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1539 {
1540         RPC_HDR_BA hdr_ba;
1541         RPC_HDR_RB hdr_rb;
1542         RPC_HDR_AUTH auth_info;
1543         uint16 assoc_gid;
1544         fstring ack_pipe_name;
1545         prs_struct out_hdr_ba;
1546         prs_struct out_auth;
1547         int auth_len = 0;
1548         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1549         uint32_t ss_padding_len = 0;
1550         NTSTATUS status;
1551         struct ndr_syntax_id id;
1552
1553         /* No rebinds on a bound pipe - use alter context. */
1554         if (p->pipe_bound) {
1555                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1556                          "pipe %s.\n",
1557                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1558                 return setup_bind_nak(p);
1559         }
1560
1561         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1562
1563         /*
1564          * Marshall directly into the outgoing PDU space. We
1565          * must do this as we need to set to the bind response
1566          * header and are never sending more than one PDU here.
1567          */
1568
1569         /*
1570          * Setup the memory to marshall the ba header, and the
1571          * auth footers.
1572          */
1573
1574         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1575                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1576                 prs_mem_free(&p->out_data.frag);
1577                 return False;
1578         }
1579
1580         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1581                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1582                 prs_mem_free(&p->out_data.frag);
1583                 prs_mem_free(&out_hdr_ba);
1584                 return False;
1585         }
1586
1587         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1588
1589         ZERO_STRUCT(hdr_rb);
1590
1591         /* decode the bind request */
1592
1593         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1594                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB "
1595                          "struct.\n"));
1596                 goto err_exit;
1597         }
1598
1599         if (hdr_rb.num_contexts == 0) {
1600                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1601                 goto err_exit;
1602         }
1603
1604         /*
1605          * Try and find the correct pipe name to ensure
1606          * that this is a pipe name we support.
1607          */
1608         id = hdr_rb.rpc_context[0].abstract;
1609         if (rpc_srv_pipe_exists_by_id(&id)) {
1610                 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1611                         rpc_srv_get_pipe_cli_name(&id),
1612                         rpc_srv_get_pipe_srv_name(&id)));
1613         } else {
1614                 status = smb_probe_module(
1615                         "rpc", get_pipe_name_from_syntax(
1616                                 talloc_tos(),
1617                                 &hdr_rb.rpc_context[0].abstract));
1618
1619                 if (NT_STATUS_IS_ERR(status)) {
1620                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1621                                 get_pipe_name_from_syntax(
1622                                         talloc_tos(),
1623                                         &hdr_rb.rpc_context[0].abstract)));
1624                         prs_mem_free(&p->out_data.frag);
1625                         prs_mem_free(&out_hdr_ba);
1626                         prs_mem_free(&out_auth);
1627
1628                         return setup_bind_nak(p);
1629                 }
1630
1631                 if (rpc_srv_get_pipe_interface_by_cli_name(
1632                                 get_pipe_name_from_syntax(talloc_tos(),
1633                                                           &p->syntax),
1634                                 &id)) {
1635                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1636                                 rpc_srv_get_pipe_cli_name(&id),
1637                                 rpc_srv_get_pipe_srv_name(&id)));
1638                 } else {
1639                         DEBUG(0, ("module %s doesn't provide functions for "
1640                                   "pipe %s!\n",
1641                                   get_pipe_name_from_syntax(talloc_tos(),
1642                                                             &p->syntax),
1643                                   get_pipe_name_from_syntax(talloc_tos(),
1644                                                             &p->syntax)));
1645                         goto err_exit;
1646                 }
1647         }
1648
1649         /* name has to be \PIPE\xxxxx */
1650         fstrcpy(ack_pipe_name, "\\PIPE\\");
1651         fstrcat(ack_pipe_name, rpc_srv_get_pipe_srv_name(&id));
1652
1653         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1654
1655         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1656
1657         /*
1658          * Create the bind response struct.
1659          */
1660
1661         /* If the requested abstract synt uuid doesn't match our client pipe,
1662                 reject the bind_ack & set the transfer interface synt to all 0's,
1663                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1664                 unknown to NT4)
1665                 Needed when adding entries to a DACL from NT5 - SK */
1666
1667         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1668                                 hdr_rb.rpc_context[0].context_id )) {
1669                 init_rpc_hdr_ba(&hdr_ba,
1670                         RPC_MAX_PDU_FRAG_LEN,
1671                         RPC_MAX_PDU_FRAG_LEN,
1672                         assoc_gid,
1673                         ack_pipe_name,
1674                         0x1, 0x0, 0x0,
1675                         &hdr_rb.rpc_context[0].transfer[0]);
1676         } else {
1677                 /* Rejection reason: abstract syntax not supported */
1678                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1679                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1680                                         ack_pipe_name, 0x1, 0x2, 0x1,
1681                                         &null_ndr_syntax_id);
1682                 p->pipe_bound = False;
1683         }
1684
1685         /*
1686          * and marshall it.
1687          */
1688
1689         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1690                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1691                 goto err_exit;
1692         }
1693
1694         /*
1695          * Check if this is an authenticated bind request.
1696          */
1697
1698         if (p->hdr.auth_len) {
1699                 /*
1700                  * Decode the authentication verifier.
1701                  */
1702
1703                 /* Work out any padding needed before the auth footer. */
1704                 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
1705                         ss_padding_len = SERVER_NDR_PADDING_SIZE -
1706                                 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
1707                         DEBUG(10,("api_pipe_bind_req: auth pad_len = %u\n",
1708                                 (unsigned int)ss_padding_len ));
1709                 }
1710
1711                 /* Quick length check. Won't catch a bad auth footer,
1712                  * prevents overrun. */
1713
1714                 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
1715                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
1716                                 "too long for fragment %u.\n",
1717                                 (unsigned int)p->hdr.auth_len,
1718                                 (unsigned int)p->hdr.frag_len ));
1719                         goto err_exit;
1720                 }
1721
1722                 /* Pull the auth header and the following data into a blob. */
1723                 /* NB. The offset of the auth_header is relative to the *end*
1724                  * of the packet, not the start. Also, the length of the
1725                  * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
1726                  * as the RPC header isn't included in rpc_in_p. */
1727                 if(!prs_set_offset(rpc_in_p,
1728                                 p->hdr.frag_len - RPC_HEADER_LEN -
1729                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
1730                         DEBUG(0,("api_pipe_bind_req: cannot move "
1731                                 "offset to %u.\n",
1732                                 (unsigned int)(p->hdr.frag_len -
1733                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
1734                         goto err_exit;
1735                 }
1736
1737                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1738                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1739                         goto err_exit;
1740                 }
1741
1742                 auth_type = auth_info.auth_type;
1743
1744                 /* Work out if we have to sign or seal etc. */
1745                 switch (auth_info.auth_level) {
1746                         case DCERPC_AUTH_LEVEL_INTEGRITY:
1747                                 p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1748                                 break;
1749                         case DCERPC_AUTH_LEVEL_PRIVACY:
1750                                 p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1751                                 break;
1752                         default:
1753                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1754                                         (unsigned int)auth_info.auth_level ));
1755                                 goto err_exit;
1756                 }
1757         } else {
1758                 ZERO_STRUCT(auth_info);
1759         }
1760
1761         switch(auth_type) {
1762                 case DCERPC_AUTH_TYPE_NTLMSSP:
1763                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p,
1764                                         ss_padding_len, &auth_info, &out_auth)) {
1765                                 goto err_exit;
1766                         }
1767                         assoc_gid = 0x7a77;
1768                         break;
1769
1770                 case DCERPC_AUTH_TYPE_SCHANNEL:
1771                         if (!pipe_schannel_auth_bind(p, rpc_in_p,
1772                                         ss_padding_len, &auth_info, &out_auth)) {
1773                                 goto err_exit;
1774                         }
1775                         break;
1776
1777                 case DCERPC_AUTH_TYPE_SPNEGO:
1778                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p,
1779                                         ss_padding_len, &auth_info, &out_auth)) {
1780                                 goto err_exit;
1781                         }
1782                         break;
1783
1784                 case DCERPC_AUTH_TYPE_NONE:
1785                         /* Unauthenticated bind request. */
1786                         /* We're finished - no more packets. */
1787                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1788                         /* We must set the pipe auth_level here also. */
1789                         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1790                         p->pipe_bound = True;
1791                         /* The session key was initialized from the SMB
1792                          * session in make_internal_rpc_pipe_p */
1793                         ss_padding_len = 0;
1794                         break;
1795
1796                 default:
1797                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1798                         goto err_exit;
1799         }
1800         /*
1801          * Create the header, now we know the length.
1802          */
1803
1804         if (prs_offset(&out_auth)) {
1805                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1806         }
1807
1808         init_rpc_hdr(&p->hdr, DCERPC_PKT_BIND_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1809                         p->hdr.call_id,
1810                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) +
1811                                 ss_padding_len + prs_offset(&out_auth),
1812                         auth_len);
1813
1814         /*
1815          * Marshall the header into the outgoing PDU.
1816          */
1817
1818         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1819                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1820                 goto err_exit;
1821         }
1822
1823         /*
1824          * Now add the RPC_HDR_BA and any auth needed.
1825          */
1826
1827         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1828                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1829                 goto err_exit;
1830         }
1831
1832         if (auth_len) {
1833                 if (ss_padding_len) {
1834                         char pad[SERVER_NDR_PADDING_SIZE];
1835                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1836                         if (!prs_copy_data_in(&p->out_data.frag, pad,
1837                                         ss_padding_len)) {
1838                                 DEBUG(0,("api_pipe_bind_req: failed to add %u "
1839                                         "bytes of pad data.\n",
1840                                         (unsigned int)ss_padding_len));
1841                                 goto err_exit;
1842                         }
1843                 }
1844
1845                 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1846                         DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1847                         goto err_exit;
1848                 }
1849         }
1850
1851         /*
1852          * Setup the lengths for the initial reply.
1853          */
1854
1855         p->out_data.data_sent_length = 0;
1856         p->out_data.current_pdu_sent = 0;
1857
1858         prs_mem_free(&out_hdr_ba);
1859         prs_mem_free(&out_auth);
1860
1861         return True;
1862
1863   err_exit:
1864
1865         prs_mem_free(&p->out_data.frag);
1866         prs_mem_free(&out_hdr_ba);
1867         prs_mem_free(&out_auth);
1868         return setup_bind_nak(p);
1869 }
1870
1871 /****************************************************************************
1872  Deal with an alter context call. Can be third part of 3 leg auth request for
1873  SPNEGO calls.
1874 ****************************************************************************/
1875
1876 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1877 {
1878         RPC_HDR_BA hdr_ba;
1879         RPC_HDR_RB hdr_rb;
1880         RPC_HDR_AUTH auth_info;
1881         uint16 assoc_gid;
1882         fstring ack_pipe_name;
1883         prs_struct out_hdr_ba;
1884         prs_struct out_auth;
1885         int auth_len = 0;
1886         uint32_t ss_padding_len = 0;
1887
1888         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1889
1890         /*
1891          * Marshall directly into the outgoing PDU space. We
1892          * must do this as we need to set to the bind response
1893          * header and are never sending more than one PDU here.
1894          */
1895
1896         /*
1897          * Setup the memory to marshall the ba header, and the
1898          * auth footers.
1899          */
1900
1901         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1902                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1903                 prs_mem_free(&p->out_data.frag);
1904                 return False;
1905         }
1906
1907         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1908                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1909                 prs_mem_free(&p->out_data.frag);
1910                 prs_mem_free(&out_hdr_ba);
1911                 return False;
1912         }
1913
1914         ZERO_STRUCT(hdr_rb);
1915
1916         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1917
1918         /* decode the alter context request */
1919         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1920                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1921                 goto err_exit;
1922         }
1923
1924         /* secondary address CAN be NULL
1925          * as the specs say it's ignored.
1926          * It MUST be NULL to have the spoolss working.
1927          */
1928         fstrcpy(ack_pipe_name,"");
1929
1930         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1931
1932         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1933
1934         /*
1935          * Create the bind response struct.
1936          */
1937
1938         /* If the requested abstract synt uuid doesn't match our client pipe,
1939                 reject the bind_ack & set the transfer interface synt to all 0's,
1940                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1941                 unknown to NT4)
1942                 Needed when adding entries to a DACL from NT5 - SK */
1943
1944         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1945                                 hdr_rb.rpc_context[0].context_id )) {
1946                 init_rpc_hdr_ba(&hdr_ba,
1947                         RPC_MAX_PDU_FRAG_LEN,
1948                         RPC_MAX_PDU_FRAG_LEN,
1949                         assoc_gid,
1950                         ack_pipe_name,
1951                         0x1, 0x0, 0x0,
1952                         &hdr_rb.rpc_context[0].transfer[0]);
1953         } else {
1954                 /* Rejection reason: abstract syntax not supported */
1955                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1956                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1957                                         ack_pipe_name, 0x1, 0x2, 0x1,
1958                                         &null_ndr_syntax_id);
1959                 p->pipe_bound = False;
1960         }
1961
1962         /*
1963          * and marshall it.
1964          */
1965
1966         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1967                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1968                 goto err_exit;
1969         }
1970
1971
1972         /*
1973          * Check if this is an authenticated alter context request.
1974          */
1975
1976         if (p->hdr.auth_len != 0) {
1977                 /*
1978                  * Decode the authentication verifier.
1979                  */
1980
1981                 /* Work out any padding needed before the auth footer. */
1982                 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
1983                         ss_padding_len = SERVER_NDR_PADDING_SIZE -
1984                                 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
1985                         DEBUG(10,("api_pipe_alter_context: auth pad_len = %u\n",
1986                                 (unsigned int)ss_padding_len ));
1987                 }
1988
1989                 /* Quick length check. Won't catch a bad auth footer,
1990                  * prevents overrun. */
1991
1992                 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
1993                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1994                                 "too long for fragment %u.\n",
1995                                 (unsigned int)p->hdr.auth_len,
1996                                 (unsigned int)p->hdr.frag_len ));
1997                         goto err_exit;
1998                 }
1999
2000                 /* Pull the auth header and the following data into a blob. */
2001                 /* NB. The offset of the auth_header is relative to the *end*
2002                  * of the packet, not the start. Also, the length of the
2003                  * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2004                  * as the RPC header isn't included in rpc_in_p. */
2005                 if(!prs_set_offset(rpc_in_p,
2006                                 p->hdr.frag_len - RPC_HEADER_LEN -
2007                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
2008                         DEBUG(0,("api_alter_context: cannot move "
2009                                 "offset to %u.\n",
2010                                 (unsigned int)(p->hdr.frag_len -
2011                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
2012                         goto err_exit;
2013                 }
2014
2015                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
2016                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
2017                         goto err_exit;
2018                 }
2019
2020                 /*
2021                  * Currently only the SPNEGO auth type uses the alter ctx
2022                  * response in place of the NTLMSSP auth3 type.
2023                  */
2024
2025                 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
2026                         /* We can only finish if the pipe is unbound. */
2027                         if (!p->pipe_bound) {
2028                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p,
2029                                                 ss_padding_len, &auth_info, &out_auth)) {
2030                                         goto err_exit;
2031                                 }
2032                         } else {
2033                                 goto err_exit;
2034                         }
2035                 }
2036         } else {
2037                 ZERO_STRUCT(auth_info);
2038         }
2039         /*
2040          * Create the header, now we know the length.
2041          */
2042
2043         if (prs_offset(&out_auth)) {
2044                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
2045         }
2046
2047         init_rpc_hdr(&p->hdr, DCERPC_PKT_ALTER_RESP, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
2048                         p->hdr.call_id,
2049                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
2050                         auth_len);
2051
2052         /*
2053          * Marshall the header into the outgoing PDU.
2054          */
2055
2056         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
2057                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
2058                 goto err_exit;
2059         }
2060
2061         /*
2062          * Now add the RPC_HDR_BA and any auth needed.
2063          */
2064
2065         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
2066                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
2067                 goto err_exit;
2068         }
2069
2070         if (auth_len) {
2071                 if (ss_padding_len) {
2072                         char pad[SERVER_NDR_PADDING_SIZE];
2073                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
2074                         if (!prs_copy_data_in(&p->out_data.frag, pad,
2075                                         ss_padding_len)) {
2076                                 DEBUG(0,("api_pipe_alter_context: failed to add %u "
2077                                         "bytes of pad data.\n",
2078                                         (unsigned int)ss_padding_len));
2079                                 goto err_exit;
2080                         }
2081                 }
2082
2083                 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
2084                         DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
2085                         goto err_exit;
2086                 }
2087         }
2088
2089         /*
2090          * Setup the lengths for the initial reply.
2091          */
2092
2093         p->out_data.data_sent_length = 0;
2094         p->out_data.current_pdu_sent = 0;
2095
2096         prs_mem_free(&out_hdr_ba);
2097         prs_mem_free(&out_auth);
2098
2099         return True;
2100
2101   err_exit:
2102
2103         prs_mem_free(&p->out_data.frag);
2104         prs_mem_free(&out_hdr_ba);
2105         prs_mem_free(&out_auth);
2106         return setup_bind_nak(p);
2107 }
2108
2109 /****************************************************************************
2110  Deal with NTLMSSP sign & seal processing on an RPC request.
2111 ****************************************************************************/
2112
2113 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
2114                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
2115 {
2116         RPC_HDR_AUTH auth_info;
2117         uint32 auth_len = p->hdr.auth_len;
2118         uint32 save_offset = prs_offset(rpc_in);
2119         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
2120         unsigned char *data = NULL;
2121         size_t data_len;
2122         unsigned char *full_packet_data = NULL;
2123         size_t full_packet_data_len;
2124         DATA_BLOB auth_blob;
2125
2126         *pstatus = NT_STATUS_OK;
2127
2128         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_NONE || p->auth.auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
2129                 return True;
2130         }
2131
2132         if (!a) {
2133                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2134                 return False;
2135         }
2136
2137         /* Ensure there's enough data for an authenticated request. */
2138         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN
2139                         + auth_len > p->hdr.frag_len) {
2140                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2141                         (unsigned int)auth_len ));
2142                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2143                 return False;
2144         }
2145
2146         /*
2147          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2148          * after the RPC header.
2149          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2150          * functions as NTLMv2 checks the rpc headers also.
2151          * Both of these values include any auth_pad_len bytes.
2152          */
2153
2154         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2155         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2156
2157         full_packet_data = p->in_data.current_in_pdu;
2158         full_packet_data_len = p->hdr.frag_len - auth_len;
2159
2160         /* Pull the auth header and the following data into a blob. */
2161         /* NB. The offset of the auth_header is relative to the *end*
2162          * of the packet, not the start. Also, the length of the
2163          * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2164          * as the RPC header isn't included in rpc_in_p. */
2165         if(!prs_set_offset(rpc_in,
2166                         p->hdr.frag_len - RPC_HEADER_LEN -
2167                         RPC_HDR_AUTH_LEN - auth_len)) {
2168                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move "
2169                         "offset to %u.\n",
2170                         (unsigned int)(p->hdr.frag_len -
2171                                 RPC_HDR_AUTH_LEN - auth_len) ));
2172                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2173                 return False;
2174         }
2175
2176         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2177                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to "
2178                         "unmarshall RPC_HDR_AUTH.\n"));
2179                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2180                 return False;
2181         }
2182
2183         /* Ensure auth_pad_len fits into the packet. */
2184         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2185                         RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2186                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_info.auth_pad_len "
2187                         "too large (%u), auth_len (%u), frag_len = (%u).\n",
2188                         (unsigned int)auth_info.auth_pad_len,
2189                         (unsigned int)auth_len,
2190                         (unsigned int)p->hdr.frag_len ));
2191                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2192                 return False;
2193         }
2194
2195         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2196         auth_blob.length = auth_len;
2197
2198         switch (p->auth.auth_level) {
2199                 case DCERPC_AUTH_LEVEL_PRIVACY:
2200                         /* Data is encrypted. */
2201                         *pstatus = auth_ntlmssp_unseal_packet(a,
2202                                                               data, data_len,
2203                                                               full_packet_data,
2204                                                               full_packet_data_len,
2205                                                               &auth_blob);
2206                         if (!NT_STATUS_IS_OK(*pstatus)) {
2207                                 return False;
2208                         }
2209                         break;
2210                 case DCERPC_AUTH_LEVEL_INTEGRITY:
2211                         /* Data is signed. */
2212                         *pstatus = auth_ntlmssp_check_packet(a,
2213                                                              data, data_len,
2214                                                              full_packet_data,
2215                                                              full_packet_data_len,
2216                                                              &auth_blob);
2217                         if (!NT_STATUS_IS_OK(*pstatus)) {
2218                                 return False;
2219                         }
2220                         break;
2221                 default:
2222                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2223                         return False;
2224         }
2225
2226         /*
2227          * Return the current pointer to the data offset.
2228          */
2229
2230         if(!prs_set_offset(rpc_in, save_offset)) {
2231                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2232                         (unsigned int)save_offset ));
2233                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2234                 return False;
2235         }
2236
2237         /*
2238          * Remember the padding length. We must remove it from the real data
2239          * stream once the sign/seal is done.
2240          */
2241
2242         *p_ss_padding_len = auth_info.auth_pad_len;
2243
2244         return True;
2245 }
2246
2247 /****************************************************************************
2248  Deal with schannel processing on an RPC request.
2249 ****************************************************************************/
2250
2251 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2252 {
2253         uint32 data_len;
2254         uint32 auth_len;
2255         uint32 save_offset = prs_offset(rpc_in);
2256         RPC_HDR_AUTH auth_info;
2257         DATA_BLOB blob;
2258         NTSTATUS status;
2259         uint8_t *data;
2260
2261         auth_len = p->hdr.auth_len;
2262
2263         if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN ||
2264                         auth_len > RPC_HEADER_LEN +
2265                                         RPC_HDR_REQ_LEN +
2266                                         RPC_HDR_AUTH_LEN +
2267                                         auth_len) {
2268                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2269                 return False;
2270         }
2271
2272         /*
2273          * The following is that length of the data we must verify or unseal.
2274          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2275          * preceeding the auth_data, but does include the auth_pad_len bytes.
2276          */
2277
2278         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2279                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2280                         (unsigned int)p->hdr.frag_len,
2281                         (unsigned int)auth_len ));
2282                 return False;
2283         }
2284
2285         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2286                 RPC_HDR_AUTH_LEN - auth_len;
2287
2288         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2289
2290         /* Pull the auth header and the following data into a blob. */
2291         /* NB. The offset of the auth_header is relative to the *end*
2292          * of the packet, not the start. Also, the length of the
2293          * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2294          * as the RPC header isn't included in rpc_in_p. */
2295         if(!prs_set_offset(rpc_in,
2296                         p->hdr.frag_len - RPC_HEADER_LEN -
2297                         RPC_HDR_AUTH_LEN - auth_len)) {
2298                 DEBUG(0,("api_pipe_schannel_process: cannot move "
2299                         "offset to %u.\n",
2300                         (unsigned int)(p->hdr.frag_len -
2301                                 RPC_HDR_AUTH_LEN - auth_len) ));
2302                 return False;
2303         }
2304
2305         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2306                 DEBUG(0,("api_pipe_schannel_process: failed to "
2307                         "unmarshall RPC_HDR_AUTH.\n"));
2308                 return False;
2309         }
2310
2311         /* Ensure auth_pad_len fits into the packet. */
2312         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2313                         RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2314                 DEBUG(0,("api_pipe_schannel_process: auth_info.auth_pad_len "
2315                         "too large (%u), auth_len (%u), frag_len = (%u).\n",
2316                         (unsigned int)auth_info.auth_pad_len,
2317                         (unsigned int)auth_len,
2318                         (unsigned int)p->hdr.frag_len ));
2319                 return False;
2320         }
2321
2322         if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
2323                 DEBUG(0,("Invalid auth info %d on schannel\n",
2324                          auth_info.auth_type));
2325                 return False;
2326         }
2327
2328         blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), auth_len);
2329
2330         if (DEBUGLEVEL >= 10) {
2331                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
2332         }
2333
2334         data = (uint8_t *)prs_data_p(rpc_in)+RPC_HDR_REQ_LEN;
2335
2336         switch (auth_info.auth_level) {
2337         case DCERPC_AUTH_LEVEL_PRIVACY:
2338                 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2339                                                 talloc_tos(),
2340                                                 true,
2341                                                 data,
2342                                                 data_len,
2343                                                 &blob);
2344                 break;
2345         case DCERPC_AUTH_LEVEL_INTEGRITY:
2346                 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2347                                                 talloc_tos(),
2348                                                 false,
2349                                                 data,
2350                                                 data_len,
2351                                                 &blob);
2352                 break;
2353         default:
2354                 status = NT_STATUS_INTERNAL_ERROR;
2355                 break;
2356         }
2357
2358         if (!NT_STATUS_IS_OK(status)) {
2359                 DEBUG(0,("failed to unseal packet: %s\n", nt_errstr(status)));
2360                 return false;
2361         }
2362
2363         /*
2364          * Return the current pointer to the data offset.
2365          */
2366
2367         if(!prs_set_offset(rpc_in, save_offset)) {
2368                 DEBUG(0,("failed to set offset back to %u\n",
2369                          (unsigned int)save_offset ));
2370                 return False;
2371         }
2372
2373         /*
2374          * Remember the padding length. We must remove it from the real data
2375          * stream once the sign/seal is done.
2376          */
2377
2378         *p_ss_padding_len = auth_info.auth_pad_len;
2379
2380         return True;
2381 }
2382
2383 /****************************************************************************
2384  Find the set of RPC functions associated with this context_id
2385 ****************************************************************************/
2386
2387 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2388 {
2389         PIPE_RPC_FNS *fns = NULL;
2390
2391         if ( !list ) {
2392                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2393                 return NULL;
2394         }
2395
2396         for (fns=list; fns; fns=fns->next ) {
2397                 if ( fns->context_id == context_id )
2398                         return fns;
2399         }
2400         return NULL;
2401 }
2402
2403 /****************************************************************************
2404  Memory cleanup.
2405 ****************************************************************************/
2406
2407 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2408 {
2409         PIPE_RPC_FNS *tmp = list;
2410         PIPE_RPC_FNS *tmp2;
2411
2412         while (tmp) {
2413                 tmp2 = tmp->next;
2414                 SAFE_FREE(tmp);
2415                 tmp = tmp2;
2416         }
2417
2418         return;
2419 }
2420
2421 static bool api_rpcTNP(pipes_struct *p,
2422                        const struct api_struct *api_rpc_cmds, int n_cmds);
2423
2424 /****************************************************************************
2425  Find the correct RPC function to call for this request.
2426  If the pipe is authenticated then become the correct UNIX user
2427  before doing the call.
2428 ****************************************************************************/
2429
2430 bool api_pipe_request(pipes_struct *p)
2431 {
2432         bool ret = False;
2433         bool changed_user = False;
2434         PIPE_RPC_FNS *pipe_fns;
2435
2436         if (p->pipe_bound &&
2437                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2438                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2439                 if(!become_authenticated_pipe_user(p)) {
2440                         prs_mem_free(&p->out_data.rdata);
2441                         return False;
2442                 }
2443                 changed_user = True;
2444         }
2445
2446         DEBUG(5, ("Requested \\PIPE\\%s\n",
2447                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2448
2449         /* get the set of RPC functions for this context */
2450
2451         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2452
2453         if ( pipe_fns ) {
2454                 TALLOC_CTX *frame = talloc_stackframe();
2455                 ret = api_rpcTNP(p, pipe_fns->cmds, pipe_fns->n_cmds);
2456                 TALLOC_FREE(frame);
2457         }
2458         else {
2459                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2460                         p->hdr_req.context_id,
2461                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2462         }
2463
2464         if (changed_user) {
2465                 unbecome_authenticated_pipe_user();
2466         }
2467
2468         return ret;
2469 }
2470
2471 /*******************************************************************
2472  Calls the underlying RPC function for a named pipe.
2473  ********************************************************************/
2474
2475 static bool api_rpcTNP(pipes_struct *p,
2476                        const struct api_struct *api_rpc_cmds, int n_cmds)
2477 {
2478         int fn_num;
2479         uint32 offset1, offset2;
2480
2481         /* interpret the command */
2482         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2483                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2484                  p->hdr_req.opnum));
2485
2486         if (DEBUGLEVEL >= 50) {
2487                 fstring name;
2488                 slprintf(name, sizeof(name)-1, "in_%s",
2489                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2490                 prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2491         }
2492
2493         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2494                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2495                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2496                         break;
2497                 }
2498         }
2499
2500         if (fn_num == n_cmds) {
2501                 /*
2502                  * For an unknown RPC just return a fault PDU but
2503                  * return True to allow RPC's on the pipe to continue
2504                  * and not put the pipe into fault state. JRA.
2505                  */
2506                 DEBUG(4, ("unknown\n"));
2507                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2508                 return True;
2509         }
2510
2511         offset1 = prs_offset(&p->out_data.rdata);
2512
2513         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2514                 fn_num, api_rpc_cmds[fn_num].fn));
2515         /* do the actual command */
2516         if(!api_rpc_cmds[fn_num].fn(p)) {
2517                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2518                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2519                          api_rpc_cmds[fn_num].name));
2520                 prs_mem_free(&p->out_data.rdata);
2521                 return False;
2522         }
2523
2524         if (p->bad_handle_fault_state) {
2525                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2526                 p->bad_handle_fault_state = False;
2527                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2528                 return True;
2529         }
2530
2531         if (p->rng_fault_state) {
2532                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2533                 p->rng_fault_state = False;
2534                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2535                 return True;
2536         }
2537
2538         offset2 = prs_offset(&p->out_data.rdata);
2539         prs_set_offset(&p->out_data.rdata, offset1);
2540         if (DEBUGLEVEL >= 50) {
2541                 fstring name;
2542                 slprintf(name, sizeof(name)-1, "out_%s",
2543                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2544                 prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2545         }
2546         prs_set_offset(&p->out_data.rdata, offset2);
2547
2548         DEBUG(5,("api_rpcTNP: called %s successfully\n",
2549                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2550
2551         /* Check for buffer underflow in rpc parsing */
2552
2553         if ((DEBUGLEVEL >= 10) &&
2554             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2555                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2556                 char *data = (char *)SMB_MALLOC(data_len);
2557
2558                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2559                 if (data) {
2560                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2561                         SAFE_FREE(data);
2562                 }
2563
2564         }
2565
2566         return True;
2567 }