source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "srv_pipe_internal.h"
  32 #include "../librpc/gen_ndr/ndr_schannel.h"
  33 #include "../libcli/auth/schannel.h"
  34 #include "../libcli/auth/spnego.h"
  35 #include "../libcli/auth/ntlmssp.h"
  36
  37 #undef DBGC_CLASS
  38 #define DBGC_CLASS DBGC_RPC_SRV
  39
  40 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  41 {
  42         struct auth_ntlmssp_state *a = auth->a_u.auth_ntlmssp_state;
  43
  44         if (a) {
  45                 auth_ntlmssp_end(&a);
  46         }
  47         auth->a_u.auth_ntlmssp_state = NULL;
  48 }
  49
  50 static DATA_BLOB generic_session_key(void)
  51 {
  52         return data_blob("SystemLibraryDTC", 16);
  53 }
  54
  55 /*******************************************************************
  56  Generate the next PDU to be returned from the data in p->rdata.
  57  Handle NTLMSSP.
  58  ********************************************************************/
  59
  60 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  61 {
  62         RPC_HDR_RESP hdr_resp;
  63         uint32 ss_padding_len = 0;
  64         uint32 data_space_available;
  65         uint32 data_len_left;
  66         uint32 data_len;
  67         NTSTATUS status;
  68         DATA_BLOB auth_blob;
  69         RPC_HDR_AUTH auth_info;
  70         uint8 auth_type, auth_level;
  71         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
  72         TALLOC_CTX *frame;
  73
  74         /*
  75          * If we're in the fault state, keep returning fault PDU's until
  76          * the pipe gets closed. JRA.
  77          */
  78
  79         if(p->fault_state) {
  80                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  81                 return True;
  82         }
  83
  84         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  85
  86         /* Change the incoming request header to a response. */
  87         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
  88
  89         /* Set up rpc header flags. */
  90         if (p->out_data.data_sent_length == 0) {
  91                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
  92         } else {
  93                 p->hdr.flags = 0;
  94         }
  95
  96         /*
  97          * Work out how much we can fit in a single PDU.
  98          */
  99
 100         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 101
 102         /*
 103          * Ensure there really is data left to send.
 104          */
 105
 106         if(!data_len_left) {
 107                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 108                 return False;
 109         }
 110
 111         /* Space available - not including padding. */
 112         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN -
 113                 RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 114
 115         /*
 116          * The amount we send is the minimum of the available
 117          * space and the amount left to send.
 118          */
 119
 120         data_len = MIN(data_len_left, data_space_available);
 121
 122         /* Work out any padding alignment requirements. */
 123         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 124                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 125                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 126                 DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 127                         ss_padding_len ));
 128                 /* If we're over filling the packet, we need to make space
 129                  * for the padding at the end of the data. */
 130                 if (data_len + ss_padding_len > data_space_available) {
 131                         data_len -= SERVER_NDR_PADDING_SIZE;
 132                 }
 133         }
 134
 135         /*
 136          * Set up the alloc hint. This should be the data left to
 137          * send.
 138          */
 139
 140         hdr_resp.alloc_hint = data_len_left;
 141
 142         /*
 143          * Work out if this PDU will be the last.
 144          */
 145
 146         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 147                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 148         }
 149
 150         /*
 151          * Set up the header lengths.
 152          */
 153
 154         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 155                         data_len + ss_padding_len +
 156                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 157         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 158
 159
 160         /*
 161          * Init the parse struct to point at the outgoing
 162          * data.
 163          */
 164
 165         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 166
 167         /* Store the header in the data stream. */
 168         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 169                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 170                 prs_mem_free(&p->out_data.frag);
 171                 return False;
 172         }
 173
 174         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 175                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 176                 prs_mem_free(&p->out_data.frag);
 177                 return False;
 178         }
 179
 180         /* Copy the data into the PDU. */
 181
 182         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 183                                      p->out_data.data_sent_length, data_len)) {
 184                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 185                 prs_mem_free(&p->out_data.frag);
 186                 return False;
 187         }
 188
 189         /* Copy the sign/seal padding data. */
 190         if (ss_padding_len) {
 191                 char pad[SERVER_NDR_PADDING_SIZE];
 192
 193                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 194                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 195                                       ss_padding_len)) {
 196                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 197                                         (unsigned int)ss_padding_len));
 198                         prs_mem_free(&p->out_data.frag);
 199                         return False;
 200                 }
 201         }
 202
 203
 204         /* Now write out the auth header and null blob. */
 205         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 206                 auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 207         } else {
 208                 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 209         }
 210         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 211                 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 212         } else {
 213                 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 214         }
 215
 216         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 217
 218         if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 219                                 &p->out_data.frag, 0)) {
 220                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 221                 prs_mem_free(&p->out_data.frag);
 222                 return False;
 223         }
 224
 225         /* Generate the sign blob. */
 226
 227         frame = talloc_stackframe();
 228         switch (p->auth.auth_level) {
 229                 case DCERPC_AUTH_LEVEL_PRIVACY:
 230                         /* Data portion is encrypted. */
 231                         status = auth_ntlmssp_seal_packet(
 232                                 a, frame,
 233                                 (uint8_t *)prs_data_p(&p->out_data.frag)
 234                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 235                                 data_len + ss_padding_len,
 236                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 237                                 (size_t)prs_offset(&p->out_data.frag),
 238                                 &auth_blob);
 239                         if (!NT_STATUS_IS_OK(status)) {
 240                                 talloc_free(frame);
 241                                 prs_mem_free(&p->out_data.frag);
 242                                 return False;
 243                         }
 244                         break;
 245                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 246                         /* Data is signed. */
 247                         status = auth_ntlmssp_sign_packet(
 248                                 a, frame,
 249                                 (unsigned char *)prs_data_p(&p->out_data.frag)
 250                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 251                                 data_len + ss_padding_len,
 252                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 253                                 (size_t)prs_offset(&p->out_data.frag),
 254                                 &auth_blob);
 255                         if (!NT_STATUS_IS_OK(status)) {
 256                                 talloc_free(frame);
 257                                 prs_mem_free(&p->out_data.frag);
 258                                 return False;
 259                         }
 260                         break;
 261                 default:
 262                         talloc_free(frame);
 263                         prs_mem_free(&p->out_data.frag);
 264                         return False;
 265         }
 266
 267         /* Append the auth blob. */
 268         if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
 269                               NTLMSSP_SIG_SIZE)) {
 270                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 271                                 (unsigned int)NTLMSSP_SIG_SIZE));
 272                 talloc_free(frame);
 273                 prs_mem_free(&p->out_data.frag);
 274                 return False;
 275         }
 276         talloc_free(frame);
 277
 278         /*
 279          * Setup the counts for this PDU.
 280          */
 281
 282         p->out_data.data_sent_length += data_len;
 283         p->out_data.current_pdu_sent = 0;
 284
 285         return True;
 286 }
 287
 288 /*******************************************************************
 289  Generate the next PDU to be returned from the data in p->rdata.
 290  Return an schannel authenticated fragment.
 291  ********************************************************************/
 292
 293 static bool create_next_pdu_schannel(pipes_struct *p)
 294 {
 295         RPC_HDR_RESP hdr_resp;
 296         uint32 ss_padding_len = 0;
 297         uint32 data_len;
 298         uint32 data_space_available;
 299         uint32 data_len_left;
 300         uint32 data_pos;
 301         NTSTATUS status;
 302
 303         /*
 304          * If we're in the fault state, keep returning fault PDU's until
 305          * the pipe gets closed. JRA.
 306          */
 307
 308         if(p->fault_state) {
 309                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 310                 return True;
 311         }
 312
 313         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 314
 315         /* Change the incoming request header to a response. */
 316         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
 317
 318         /* Set up rpc header flags. */
 319         if (p->out_data.data_sent_length == 0) {
 320                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
 321         } else {
 322                 p->hdr.flags = 0;
 323         }
 324
 325         /*
 326          * Work out how much we can fit in a single PDU.
 327          */
 328
 329         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 330
 331         /*
 332          * Ensure there really is data left to send.
 333          */
 334
 335         if(!data_len_left) {
 336                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 337                 return False;
 338         }
 339
 340         /* Space available - not including padding. */
 341         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 342                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
 343                 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 344
 345         /*
 346          * The amount we send is the minimum of the available
 347          * space and the amount left to send.
 348          */
 349
 350         data_len = MIN(data_len_left, data_space_available);
 351
 352         /* Work out any padding alignment requirements. */
 353         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 354                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 355                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 356                 DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 357                         ss_padding_len ));
 358                 /* If we're over filling the packet, we need to make space
 359                  * for the padding at the end of the data. */
 360                 if (data_len + ss_padding_len > data_space_available) {
 361                         data_len -= SERVER_NDR_PADDING_SIZE;
 362                 }
 363         }
 364
 365         /*
 366          * Set up the alloc hint. This should be the data left to
 367          * send.
 368          */
 369
 370         hdr_resp.alloc_hint = data_len_left;
 371
 372         /*
 373          * Work out if this PDU will be the last.
 374          */
 375
 376         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 377                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 378         }
 379
 380         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 381                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 382         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 383
 384         /*
 385          * Init the parse struct to point at the outgoing
 386          * data.
 387          */
 388
 389         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 390
 391         /* Store the header in the data stream. */
 392         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 393                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 394                 prs_mem_free(&p->out_data.frag);
 395                 return False;
 396         }
 397
 398         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 399                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 400                 prs_mem_free(&p->out_data.frag);
 401                 return False;
 402         }
 403
 404         /* Store the current offset. */
 405         data_pos = prs_offset(&p->out_data.frag);
 406
 407         /* Copy the data into the PDU. */
 408
 409         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 410                                      p->out_data.data_sent_length, data_len)) {
 411                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 412                 prs_mem_free(&p->out_data.frag);
 413                 return False;
 414         }
 415
 416         /* Copy the sign/seal padding data. */
 417         if (ss_padding_len) {
 418                 char pad[SERVER_NDR_PADDING_SIZE];
 419                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 420                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 421                                       ss_padding_len)) {
 422                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 423                         prs_mem_free(&p->out_data.frag);
 424                         return False;
 425                 }
 426         }
 427
 428         {
 429                 /*
 430                  * Schannel processing.
 431                  */
 432                 RPC_HDR_AUTH auth_info;
 433                 DATA_BLOB blob;
 434                 uint8_t *data;
 435
 436                 /* Check it's the type of reply we were expecting to decode */
 437
 438                 init_rpc_hdr_auth(&auth_info,
 439                                 DCERPC_AUTH_TYPE_SCHANNEL,
 440                                 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
 441                                         DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
 442                                 ss_padding_len, 1);
 443
 444                 if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 445                                         &p->out_data.frag, 0)) {
 446                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 447                         prs_mem_free(&p->out_data.frag);
 448                         return False;
 449                 }
 450
 451                 data = (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos;
 452
 453                 switch (p->auth.auth_level) {
 454                 case DCERPC_AUTH_LEVEL_PRIVACY:
 455                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 456                                                         talloc_tos(),
 457                                                         true,
 458                                                         data,
 459                                                         data_len + ss_padding_len,
 460                                                         &blob);
 461                         break;
 462                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 463                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 464                                                         talloc_tos(),
 465                                                         false,
 466                                                         data,
 467                                                         data_len + ss_padding_len,
 468                                                         &blob);
 469                         break;
 470                 default:
 471                         status = NT_STATUS_INTERNAL_ERROR;
 472                         break;
 473                 }
 474
 475                 if (!NT_STATUS_IS_OK(status)) {
 476                         DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
 477                                 nt_errstr(status)));
 478                         prs_mem_free(&p->out_data.frag);
 479                         return false;
 480                 }
 481
 482                 /* Finally marshall the blob. */
 483
 484                 if (DEBUGLEVEL >= 10) {
 485                         dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
 486                 }
 487
 488                 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
 489                         prs_mem_free(&p->out_data.frag);
 490                         return false;
 491                 }
 492         }
 493
 494         /*
 495          * Setup the counts for this PDU.
 496          */
 497
 498         p->out_data.data_sent_length += data_len;
 499         p->out_data.current_pdu_sent = 0;
 500
 501         return True;
 502 }
 503
 504 /*******************************************************************
 505  Generate the next PDU to be returned from the data in p->rdata.
 506  No authentication done.
 507 ********************************************************************/
 508
 509 static bool create_next_pdu_noauth(pipes_struct *p)
 510 {
 511         RPC_HDR_RESP hdr_resp;
 512         uint32 data_len;
 513         uint32 data_space_available;
 514         uint32 data_len_left;
 515
 516         /*
 517          * If we're in the fault state, keep returning fault PDU's until
 518          * the pipe gets closed. JRA.
 519          */
 520
 521         if(p->fault_state) {
 522                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 523                 return True;
 524         }
 525
 526         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 527
 528         /* Change the incoming request header to a response. */
 529         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
 530
 531         /* Set up rpc header flags. */
 532         if (p->out_data.data_sent_length == 0) {
 533                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
 534         } else {
 535                 p->hdr.flags = 0;
 536         }
 537
 538         /*
 539          * Work out how much we can fit in a single PDU.
 540          */
 541
 542         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 543
 544         /*
 545          * Ensure there really is data left to send.
 546          */
 547
 548         if(!data_len_left) {
 549                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 550                 return False;
 551         }
 552
 553         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 554                 - RPC_HDR_RESP_LEN;
 555
 556         /*
 557          * The amount we send is the minimum of the available
 558          * space and the amount left to send.
 559          */
 560
 561         data_len = MIN(data_len_left, data_space_available);
 562
 563         /*
 564          * Set up the alloc hint. This should be the data left to
 565          * send.
 566          */
 567
 568         hdr_resp.alloc_hint = data_len_left;
 569
 570         /*
 571          * Work out if this PDU will be the last.
 572          */
 573
 574         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 575                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 576         }
 577
 578         /*
 579          * Set up the header lengths.
 580          */
 581
 582         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 583         p->hdr.auth_len = 0;
 584
 585         /*
 586          * Init the parse struct to point at the outgoing
 587          * data.
 588          */
 589
 590         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 591
 592         /* Store the header in the data stream. */
 593         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 594                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 595                 prs_mem_free(&p->out_data.frag);
 596                 return False;
 597         }
 598
 599         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 600                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 601                 prs_mem_free(&p->out_data.frag);
 602                 return False;
 603         }
 604
 605         /* Copy the data into the PDU. */
 606
 607         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 608                                      p->out_data.data_sent_length, data_len)) {
 609                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 610                 prs_mem_free(&p->out_data.frag);
 611                 return False;
 612         }
 613
 614         /*
 615          * Setup the counts for this PDU.
 616          */
 617
 618         p->out_data.data_sent_length += data_len;
 619         p->out_data.current_pdu_sent = 0;
 620
 621         return True;
 622 }
 623
 624 /*******************************************************************
 625  Generate the next PDU to be returned from the data in p->rdata.
 626 ********************************************************************/
 627
 628 bool create_next_pdu(pipes_struct *p)
 629 {
 630         switch(p->auth.auth_level) {
 631                 case DCERPC_AUTH_LEVEL_NONE:
 632                 case DCERPC_AUTH_LEVEL_CONNECT:
 633                         /* This is incorrect for auth level connect. Fixme. JRA */
 634                         return create_next_pdu_noauth(p);
 635
 636                 default:
 637                         switch(p->auth.auth_type) {
 638                                 case PIPE_AUTH_TYPE_NTLMSSP:
 639                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 640                                         return create_next_pdu_ntlmssp(p);
 641                                 case PIPE_AUTH_TYPE_SCHANNEL:
 642                                         return create_next_pdu_schannel(p);
 643                                 default:
 644                                         break;
 645                         }
 646         }
 647
 648         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 649                         (unsigned int)p->auth.auth_level,
 650                         (unsigned int)p->auth.auth_type));
 651         return False;
 652 }
 653
 654 /*******************************************************************
 655  Process an NTLMSSP authentication response.
 656  If this function succeeds, the user has been authenticated
 657  and their domain, name and calling workstation stored in
 658  the pipe struct.
 659 *******************************************************************/
 660
 661 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 662 {
 663         DATA_BLOB session_key, reply;
 664         NTSTATUS status;
 665         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
 666         bool ret;
 667
 668         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
 669                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 670
 671         ZERO_STRUCT(reply);
 672
 673         /* this has to be done as root in order to verify the password */
 674         become_root();
 675         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 676         unbecome_root();
 677
 678         /* Don't generate a reply. */
 679         data_blob_free(&reply);
 680
 681         if (!NT_STATUS_IS_OK(status)) {
 682                 return False;
 683         }
 684
 685         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 686            ensure the underlying NTLMSSP flags are also set. If not we should
 687            refuse the bind. */
 688
 689         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
 690                 if (!auth_ntlmssp_negotiated_sign(a)) {
 691                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 692                                 "but client declined signing.\n",
 693                                  get_pipe_name_from_syntax(talloc_tos(),
 694                                                            &p->syntax)));
 695                         return False;
 696                 }
 697         }
 698         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 699                 if (!auth_ntlmssp_negotiated_seal(a)) {
 700                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 701                                 "but client declined sealing.\n",
 702                                  get_pipe_name_from_syntax(talloc_tos(),
 703                                                            &p->syntax)));
 704                         return False;
 705                 }
 706         }
 707
 708         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 709                   "workstation: %s\n",
 710                   auth_ntlmssp_get_username(a),
 711                   auth_ntlmssp_get_domain(a),
 712                   auth_ntlmssp_get_client(a)));
 713
 714         TALLOC_FREE(p->server_info);
 715
 716         p->server_info = auth_ntlmssp_server_info(p, a);
 717         if (p->server_info == NULL) {
 718                 DEBUG(0, ("auth_ntlmssp_server_info failed to obtain the server info for authenticated user\n"));
 719                 return false;
 720         }
 721
 722         if (p->server_info->ptok == NULL) {
 723                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 724                 return False;
 725         }
 726
 727         /*
 728          * We're an authenticated bind over smb, so the session key needs to
 729          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 730          * does. See the RPC-SAMBA3SESSIONKEY.
 731          */
 732
 733         session_key = generic_session_key();
 734         if (session_key.data == NULL) {
 735                 return False;
 736         }
 737
 738         ret = server_info_set_session_key(p->server_info, session_key);
 739
 740         data_blob_free(&session_key);
 741
 742         return True;
 743 }
 744
 745 /*******************************************************************
 746  This is the "stage3" NTLMSSP response after a bind request and reply.
 747 *******************************************************************/
 748
 749 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 750 {
 751         RPC_HDR_AUTH auth_info;
 752         uint32 pad = 0;
 753         DATA_BLOB blob;
 754         uint32_t auth_len = p->hdr.auth_len;
 755
 756         ZERO_STRUCT(blob);
 757
 758         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 759
 760         if (auth_len == 0) {
 761                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 762                 goto err;
 763         }
 764
 765         /* 4 bytes padding. */
 766         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 767                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 768                 goto err;
 769         }
 770
 771         /* Ensure there's enough data for an authenticated request. */
 772         if (RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + auth_len >
 773                                 p->hdr.frag_len) {
 774                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
 775                                 "%u is too large.\n",
 776                         (unsigned int)auth_len ));
 777                 goto err;
 778         }
 779
 780         /*
 781          * Decode the authentication verifier response.
 782          */
 783
 784         /* Pull the auth header and the following data into a blob. */
 785         /* NB. The offset of the auth_header is relative to the *end*
 786          * of the packet, not the start. Also, the length of the
 787          * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
 788          * as the RPC header isn't included in rpc_in_p. */
 789         if(!prs_set_offset(rpc_in_p,
 790                         p->hdr.frag_len - RPC_HEADER_LEN -
 791                         RPC_HDR_AUTH_LEN - auth_len)) {
 792                 DEBUG(0,("api_pipe_bind_auth3: cannot move "
 793                         "offset to %u.\n",
 794                         (unsigned int)(p->hdr.frag_len -
 795                                 RPC_HDR_AUTH_LEN - auth_len) ));
 796                 goto err;
 797         }
 798
 799         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in_p, 0)) {
 800                 DEBUG(0,("api_pipe_bind_auth3: failed to "
 801                         "unmarshall RPC_HDR_AUTH.\n"));
 802                 goto err;
 803         }
 804
 805         /* We must NEVER look at auth_info->auth_pad_len here,
 806          * as old Samba client code gets it wrong and sends it
 807          * as zero. JRA.
 808          */
 809
 810         if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
 811                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 812                         (unsigned int)auth_info.auth_type ));
 813                 return False;
 814         }
 815
 816         blob = data_blob(NULL,p->hdr.auth_len);
 817
 818         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 819                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 820                         (unsigned int)p->hdr.auth_len ));
 821                 goto err;
 822         }
 823
 824         /*
 825          * The following call actually checks the challenge/response data.
 826          * for correctness against the given DOMAIN\user name.
 827          */
 828
 829         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 830                 goto err;
 831         }
 832
 833         data_blob_free(&blob);
 834
 835         p->pipe_bound = True;
 836
 837         return True;
 838
 839  err:
 840
 841         data_blob_free(&blob);
 842         free_pipe_ntlmssp_auth_data(&p->auth);
 843         p->auth.a_u.auth_ntlmssp_state = NULL;
 844
 845         return False;
 846 }
 847
 848 /*******************************************************************
 849  Marshall a bind_nak pdu.
 850 *******************************************************************/
 851
 852 static bool setup_bind_nak(pipes_struct *p)
 853 {
 854         NTSTATUS status;
 855         union dcerpc_payload u;
 856         DATA_BLOB blob;
 857
 858         /* Free any memory in the current return data buffer. */
 859         prs_mem_free(&p->out_data.rdata);
 860
 861         /*
 862          * Marshall directly into the outgoing PDU space. We
 863          * must do this as we need to set to the bind response
 864          * header and are never sending more than one PDU here.
 865          */
 866
 867         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 868
 869         /*
 870          * Initialize a bind_nak header.
 871          */
 872
 873         ZERO_STRUCT(u);
 874
 875         u.bind_nak.reject_reason  = 0;
 876
 877         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 878                                           DCERPC_PKT_BIND_NAK,
 879                                           DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
 880                                           RPC_HEADER_LEN + sizeof(uint16_t) /* FIXME - gd */,
 881                                           0,
 882                                           p->hdr.call_id,
 883                                           u,
 884                                           &blob);
 885         if (!NT_STATUS_IS_OK(status)) {
 886                 prs_mem_free(&p->out_data.frag);
 887                 return False;
 888         }
 889
 890         if (!prs_copy_data_in(&p->out_data.frag,
 891                               (char *)blob.data, blob.length)) {
 892                 prs_mem_free(&p->out_data.frag);
 893                 return False;
 894         }
 895
 896         p->out_data.data_sent_length = 0;
 897         p->out_data.current_pdu_sent = 0;
 898
 899         if (p->auth.auth_data_free_func) {
 900                 (*p->auth.auth_data_free_func)(&p->auth);
 901         }
 902         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 903         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 904         p->pipe_bound = False;
 905
 906         return True;
 907 }
 908
 909 /*******************************************************************
 910  Marshall a fault pdu.
 911 *******************************************************************/
 912
 913 bool setup_fault_pdu(pipes_struct *p, NTSTATUS fault_status)
 914 {
 915         NTSTATUS status;
 916         union dcerpc_payload u;
 917         DATA_BLOB blob;
 918
 919         /* Free any memory in the current return data buffer. */
 920         prs_mem_free(&p->out_data.rdata);
 921
 922         /*
 923          * Marshall directly into the outgoing PDU space. We
 924          * must do this as we need to set to the bind response
 925          * header and are never sending more than one PDU here.
 926          */
 927
 928         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 929
 930         /*
 931          * Initialize a fault header.
 932          */
 933
 934         ZERO_STRUCT(u);
 935
 936         u.fault.status          = NT_STATUS_V(fault_status);
 937         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 938
 939         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 940                                           DCERPC_PKT_FAULT,
 941                                           DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST | DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 942                                           RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN /* FIXME - gd */,
 943                                           0,
 944                                           p->hdr.call_id,
 945                                           u,
 946                                           &blob);
 947         if (!NT_STATUS_IS_OK(status)) {
 948                 prs_mem_free(&p->out_data.frag);
 949                 return False;
 950         }
 951
 952         if (!prs_copy_data_in(&p->out_data.frag,
 953                               (char *)blob.data, blob.length)) {
 954                 prs_mem_free(&p->out_data.frag);
 955                 return False;
 956         }
 957
 958         p->out_data.data_sent_length = 0;
 959         p->out_data.current_pdu_sent = 0;
 960
 961         return True;
 962 }
 963
 964 /*******************************************************************
 965  Ensure a bind request has the correct abstract & transfer interface.
 966  Used to reject unknown binds from Win2k.
 967 *******************************************************************/
 968
 969 static bool check_bind_req(struct pipes_struct *p,
 970                            struct ndr_syntax_id* abstract,
 971                            struct ndr_syntax_id* transfer,
 972                            uint32 context_id)
 973 {
 974         struct pipe_rpc_fns *context_fns;
 975
 976         DEBUG(3,("check_bind_req for %s\n",
 977                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 978
 979         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 980         if (rpc_srv_pipe_exists_by_id(abstract) &&
 981            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 982                 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 983                         rpc_srv_get_pipe_cli_name(abstract),
 984                         rpc_srv_get_pipe_srv_name(abstract)));
 985         } else {
 986                 return false;
 987         }
 988
 989         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 990         if (context_fns == NULL) {
 991                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 992                 return False;
 993         }
 994
 995         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 996         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 997         context_fns->context_id = context_id;
 998
 999         /* add to the list of open contexts */
1000
1001         DLIST_ADD( p->contexts, context_fns );
1002
1003         return True;
1004 }
1005
1006 /**
1007  * Is a named pipe known?
1008  * @param[in] cli_filename      The pipe name requested by the client
1009  * @result                      Do we want to serve this?
1010  */
1011 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1012 {
1013         const char *pipename = cli_filename;
1014         NTSTATUS status;
1015
1016         if (strnequal(pipename, "\\PIPE\\", 6)) {
1017                 pipename += 5;
1018         }
1019
1020         if (*pipename == '\\') {
1021                 pipename += 1;
1022         }
1023
1024         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1025                 DEBUG(10, ("refusing spoolss access\n"));
1026                 return false;
1027         }
1028
1029         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1030                 return true;
1031         }
1032
1033         status = smb_probe_module("rpc", pipename);
1034         if (!NT_STATUS_IS_OK(status)) {
1035                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1036                 return false;
1037         }
1038         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
1039
1040         /*
1041          * Scan the list again for the interface id
1042          */
1043         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1044                 return true;
1045         }
1046
1047         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
1048                    pipename));
1049
1050         return false;
1051 }
1052
1053 /*******************************************************************
1054  Handle a SPNEGO krb5 bind auth.
1055 *******************************************************************/
1056
1057 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p,
1058                                            prs_struct *rpc_in_p,
1059                                            struct dcerpc_auth *pauth_info,
1060                                            DATA_BLOB *psecblob,
1061                                            prs_struct *pout_auth)
1062 {
1063         return False;
1064 }
1065
1066 /*******************************************************************
1067  Handle the first part of a SPNEGO bind auth.
1068 *******************************************************************/
1069
1070 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p,
1071                                             prs_struct *rpc_in_p,
1072                                             uint32_t ss_padding_len,
1073                                             struct dcerpc_auth *pauth_info,
1074                                             prs_struct *pout_auth)
1075 {
1076         DATA_BLOB blob;
1077         DATA_BLOB secblob;
1078         DATA_BLOB response;
1079         DATA_BLOB chal;
1080         char *OIDs[ASN1_MAX_OIDS];
1081         int i;
1082         NTSTATUS status;
1083         bool got_kerberos_mechanism = false;
1084         struct auth_ntlmssp_state *a = NULL;
1085
1086         ZERO_STRUCT(secblob);
1087         ZERO_STRUCT(chal);
1088         ZERO_STRUCT(response);
1089
1090         if (pauth_info->credentials.data[0] != ASN1_APPLICATION(0)) {
1091                 goto err;
1092         }
1093
1094         /* parse out the OIDs and the first sec blob */
1095         if (!parse_negTokenTarg(pauth_info->credentials, OIDs, &secblob)) {
1096                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1097                 goto err;
1098         }
1099
1100         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1101                 got_kerberos_mechanism = true;
1102         }
1103
1104         for (i=0;OIDs[i];i++) {
1105                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1106                 TALLOC_FREE(OIDs[i]);
1107         }
1108         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1109
1110         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1111                 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1112                 data_blob_free(&secblob);
1113                 return ret;
1114         }
1115
1116         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1117                 /* Free any previous auth type. */
1118                 free_pipe_ntlmssp_auth_data(&p->auth);
1119         }
1120
1121         if (!got_kerberos_mechanism) {
1122                 /* Initialize the NTLM engine. */
1123                 status = auth_ntlmssp_start(&a);
1124                 if (!NT_STATUS_IS_OK(status)) {
1125                         goto err;
1126                 }
1127
1128                 switch (pauth_info->auth_level) {
1129                         case DCERPC_AUTH_LEVEL_INTEGRITY:
1130                                 auth_ntlmssp_want_sign(a);
1131                                 break;
1132                         case DCERPC_AUTH_LEVEL_PRIVACY:
1133                                 auth_ntlmssp_want_seal(a);
1134                                 break;
1135                         default:
1136                                 break;
1137                 }
1138                 /*
1139                  * Pass the first security blob of data to it.
1140                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1141                  * which means we need another packet to complete the bind.
1142                  */
1143
1144                 status = auth_ntlmssp_update(a, secblob, &chal);
1145
1146                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1147                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1148                         goto err;
1149                 }
1150
1151                 /* Generate the response blob we need for step 2 of the bind. */
1152                 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1153         } else {
1154                 /*
1155                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1156                  * code to process follow-up packets is not complete
1157                  * yet. JRA.
1158                  */
1159                 response = spnego_gen_auth_response(NULL,
1160                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1161                                         OID_NTLMSSP);
1162         }
1163
1164         /* auth_pad_len will be handled by the caller */
1165
1166         status = dcerpc_push_dcerpc_auth(prs_get_mem_context(pout_auth),
1167                                          DCERPC_AUTH_TYPE_SPNEGO,
1168                                          pauth_info->auth_level,
1169                                          ss_padding_len,
1170                                          1, /* auth_context_id */
1171                                          &response,
1172                                          &blob);
1173         if (!NT_STATUS_IS_OK(status)) {
1174                 DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1175                 goto err;
1176         }
1177
1178         /* Copy the blob into the pout_auth parse struct */
1179         if (!prs_copy_data_in(pout_auth, (char *)blob.data, blob.length)) {
1180                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1181                 goto err;
1182         }
1183
1184         p->auth.a_u.auth_ntlmssp_state = a;
1185         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1186         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1187
1188         data_blob_free(&secblob);
1189         data_blob_free(&chal);
1190         data_blob_free(&response);
1191
1192         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1193         return True;
1194
1195  err:
1196
1197         data_blob_free(&secblob);
1198         data_blob_free(&chal);
1199         data_blob_free(&response);
1200
1201         p->auth.a_u.auth_ntlmssp_state = NULL;
1202
1203         return False;
1204 }
1205
1206 /*******************************************************************
1207  Handle the second part of a SPNEGO bind auth.
1208 *******************************************************************/
1209
1210 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1211                                 uint32_t ss_padding_len,
1212                                 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1213 {
1214         RPC_HDR_AUTH auth_info;
1215         DATA_BLOB spnego_blob;
1216         DATA_BLOB auth_blob;
1217         DATA_BLOB auth_reply;
1218         DATA_BLOB response;
1219         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
1220
1221         ZERO_STRUCT(spnego_blob);
1222         ZERO_STRUCT(auth_blob);
1223         ZERO_STRUCT(auth_reply);
1224         ZERO_STRUCT(response);
1225
1226         /*
1227          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1228          * fail here as 'a' == NULL.
1229          */
1230         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1231                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1232                 goto err;
1233         }
1234
1235         /* Grab the SPNEGO blob. */
1236         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1237
1238         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1239                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1240                         (unsigned int)p->hdr.auth_len ));
1241                 goto err;
1242         }
1243
1244         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1245                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1246                 goto err;
1247         }
1248
1249         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1250                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1251                 goto err;
1252         }
1253
1254         /*
1255          * The following call actually checks the challenge/response data.
1256          * for correctness against the given DOMAIN\user name.
1257          */
1258
1259         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1260                 goto err;
1261         }
1262
1263         data_blob_free(&spnego_blob);
1264         data_blob_free(&auth_blob);
1265
1266         /* Generate the spnego "accept completed" blob - no incoming data. */
1267         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1268
1269         /* FIXME - add auth_pad_len here ! */
1270
1271         /* Copy the blob into the pout_auth parse struct */
1272         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1273                         pauth_info->auth_level, ss_padding_len, 1);
1274         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1275                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1276                 goto err;
1277         }
1278
1279         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1280                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1281                 goto err;
1282         }
1283
1284         data_blob_free(&auth_reply);
1285         data_blob_free(&response);
1286
1287         p->pipe_bound = True;
1288
1289         return True;
1290
1291  err:
1292
1293         data_blob_free(&spnego_blob);
1294         data_blob_free(&auth_blob);
1295         data_blob_free(&auth_reply);
1296         data_blob_free(&response);
1297
1298         free_pipe_ntlmssp_auth_data(&p->auth);
1299         p->auth.a_u.auth_ntlmssp_state = NULL;
1300
1301         return False;
1302 }
1303
1304 /*******************************************************************
1305  Handle an schannel bind auth.
1306 *******************************************************************/
1307
1308 static bool pipe_schannel_auth_bind(pipes_struct *p,
1309                                         prs_struct *rpc_in_p,
1310                                         uint32_t ss_padding_len,
1311                                         struct dcerpc_auth *auth_info,
1312                                         prs_struct *pout_auth)
1313 {
1314         DATA_BLOB auth_blob;
1315         struct NL_AUTH_MESSAGE neg;
1316         struct NL_AUTH_MESSAGE reply;
1317         bool ret;
1318         NTSTATUS status;
1319         struct netlogon_creds_CredentialState *creds;
1320         DATA_BLOB session_key;
1321         enum ndr_err_code ndr_err;
1322         DATA_BLOB blob;
1323
1324         ndr_err = ndr_pull_struct_blob(
1325                         &auth_info->credentials,
1326                         prs_get_mem_context(pout_auth), &neg,
1327                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1328         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1329                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1330                 return false;
1331         }
1332
1333         if (DEBUGLEVEL >= 10) {
1334                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1335         }
1336
1337         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1338                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1339                 return false;
1340         }
1341
1342         /*
1343          * The neg.oem_netbios_computer.a key here must match the remote computer name
1344          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1345          * operations that use credentials.
1346          */
1347
1348         become_root();
1349         status = schannel_get_creds_state(p, lp_private_dir(),
1350                                             neg.oem_netbios_computer.a, &creds);
1351         unbecome_root();
1352
1353         if (!NT_STATUS_IS_OK(status)) {
1354                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1355                 return False;
1356         }
1357
1358         p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1359         if (!p->auth.a_u.schannel_auth) {
1360                 TALLOC_FREE(creds);
1361                 return False;
1362         }
1363
1364         p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1365         p->auth.a_u.schannel_auth->seq_num = 0;
1366         p->auth.a_u.schannel_auth->initiator = false;
1367         p->auth.a_u.schannel_auth->creds = creds;
1368
1369         /*
1370          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1371          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1372          * struct of the person who opened the pipe. I need to test this further. JRA.
1373          *
1374          * VL. As we are mapping this to guest set the generic key
1375          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1376          * W2k3, as it does not allow schannel binds against SAMR and LSA
1377          * anymore.
1378          */
1379
1380         session_key = generic_session_key();
1381         if (session_key.data == NULL) {
1382                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1383                           " key\n"));
1384                 return false;
1385         }
1386
1387         ret = server_info_set_session_key(p->server_info, session_key);
1388
1389         data_blob_free(&session_key);
1390
1391         if (!ret) {
1392                 DEBUG(0, ("server_info_set_session_key failed\n"));
1393                 return false;
1394         }
1395
1396         /*** SCHANNEL verifier ***/
1397
1398         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
1399         reply.Flags                             = 0;
1400         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
1401                                                       * this has any meaning
1402                                                       * here - gd */
1403
1404         ndr_err = ndr_push_struct_blob(&auth_blob, talloc_tos(), &reply,
1405                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1406         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1407                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1408                 return false;
1409         }
1410
1411         if (DEBUGLEVEL >= 10) {
1412                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1413         }
1414
1415         status = dcerpc_push_dcerpc_auth(prs_get_mem_context(pout_auth),
1416                                          DCERPC_AUTH_TYPE_SCHANNEL,
1417                                          auth_info->auth_level,
1418                                          ss_padding_len,
1419                                          1, /* auth_context_id */
1420                                          &auth_blob,
1421                                          &blob);
1422         if (!NT_STATUS_IS_OK(status)) {
1423                 DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1424                 return False;
1425         }
1426
1427         if (!prs_copy_data_in(pout_auth, (const char *)blob.data, blob.length)) {
1428                 return false;
1429         }
1430
1431         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1432                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1433
1434         /* We're finished with this bind - no more packets. */
1435         p->auth.auth_data_free_func = NULL;
1436         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1437
1438         p->pipe_bound = True;
1439
1440         return True;
1441 }
1442
1443 /*******************************************************************
1444  Handle an NTLMSSP bind auth.
1445 *******************************************************************/
1446
1447 static bool pipe_ntlmssp_auth_bind(pipes_struct *p,
1448                                         prs_struct *rpc_in_p,
1449                                         uint32_t ss_padding_len,
1450                                         struct dcerpc_auth *auth_info,
1451                                         prs_struct *pout_auth)
1452 {
1453         DATA_BLOB blob;
1454         DATA_BLOB response;
1455         NTSTATUS status;
1456         struct auth_ntlmssp_state *a = NULL;
1457
1458         ZERO_STRUCT(response);
1459
1460         if (strncmp((char *)auth_info->credentials.data, "NTLMSSP", 7) != 0) {
1461                 DEBUG(0, ("Failed to read NTLMSSP in blob\n"));
1462                 goto err;
1463         }
1464
1465         /* We have an NTLMSSP blob. */
1466         status = auth_ntlmssp_start(&a);
1467         if (!NT_STATUS_IS_OK(status)) {
1468                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1469                         nt_errstr(status) ));
1470                 goto err;
1471         }
1472
1473         switch (auth_info->auth_level) {
1474         case DCERPC_AUTH_LEVEL_INTEGRITY:
1475                 auth_ntlmssp_want_sign(a);
1476                 break;
1477         case DCERPC_AUTH_LEVEL_PRIVACY:
1478                 auth_ntlmssp_want_seal(a);
1479                 break;
1480         default:
1481                 break;
1482         }
1483
1484         status = auth_ntlmssp_update(a, auth_info->credentials, &response);
1485         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1486                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1487                         nt_errstr(status) ));
1488                 goto err;
1489         }
1490
1491         status = dcerpc_push_dcerpc_auth(prs_get_mem_context(pout_auth),
1492                                          DCERPC_AUTH_TYPE_NTLMSSP,
1493                                          auth_info->auth_level,
1494                                          ss_padding_len,
1495                                          1, /* auth_context_id */
1496                                          &response,
1497                                          &blob);
1498         if (!NT_STATUS_IS_OK(status)) {
1499                 DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1500                 goto err;
1501         }
1502
1503         /* Copy the blob into the pout_auth parse struct */
1504         if (!prs_copy_data_in(pout_auth, (char *)blob.data, blob.length)) {
1505                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1506                 goto err;
1507         }
1508
1509         p->auth.a_u.auth_ntlmssp_state = a;
1510         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1511         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1512
1513         data_blob_free(&response);
1514
1515         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1516
1517         /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1518         return True;
1519
1520   err:
1521
1522         data_blob_free(&response);
1523
1524         free_pipe_ntlmssp_auth_data(&p->auth);
1525         p->auth.a_u.auth_ntlmssp_state = NULL;
1526         return False;
1527 }
1528
1529 /*******************************************************************
1530  Respond to a pipe bind request.
1531 *******************************************************************/
1532
1533 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1534 {
1535         RPC_HDR_BA hdr_ba;
1536         struct dcerpc_bind rpc_bind;
1537         DATA_BLOB blob_rb;
1538         struct dcerpc_auth auth_info;
1539         DATA_BLOB auth_blob;
1540         uint16 assoc_gid;
1541         fstring ack_pipe_name;
1542         prs_struct out_hdr_ba;
1543         prs_struct out_auth;
1544         int auth_len = 0;
1545         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1546         uint32_t ss_padding_len = 0;
1547         NTSTATUS status;
1548         struct ndr_syntax_id id;
1549
1550         /* No rebinds on a bound pipe - use alter context. */
1551         if (p->pipe_bound) {
1552                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1553                          "pipe %s.\n",
1554                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1555                 return setup_bind_nak(p);
1556         }
1557
1558         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1559
1560         /*
1561          * Marshall directly into the outgoing PDU space. We
1562          * must do this as we need to set to the bind response
1563          * header and are never sending more than one PDU here.
1564          */
1565
1566         /*
1567          * Setup the memory to marshall the ba header, and the
1568          * auth footers.
1569          */
1570
1571         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1572                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1573                 prs_mem_free(&p->out_data.frag);
1574                 return False;
1575         }
1576
1577         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1578                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1579                 prs_mem_free(&p->out_data.frag);
1580                 prs_mem_free(&out_hdr_ba);
1581                 return False;
1582         }
1583
1584         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1585
1586         /* decode the bind request */
1587         blob_rb = data_blob_const(prs_data_p(rpc_in_p),
1588                                   prs_data_size(rpc_in_p));
1589         status = dcerpc_pull_dcerpc_bind(talloc_tos(), &blob_rb, &rpc_bind);
1590         if (!NT_STATUS_IS_OK(status)) {
1591                 goto err_exit;
1592         }
1593
1594         if (rpc_bind.num_contexts == 0) {
1595                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1596                 goto err_exit;
1597         }
1598
1599         /*
1600          * Try and find the correct pipe name to ensure
1601          * that this is a pipe name we support.
1602          */
1603         id = rpc_bind.ctx_list[0].abstract_syntax;
1604         if (rpc_srv_pipe_exists_by_id(&id)) {
1605                 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1606                         rpc_srv_get_pipe_cli_name(&id),
1607                         rpc_srv_get_pipe_srv_name(&id)));
1608         } else {
1609                 status = smb_probe_module(
1610                         "rpc", get_pipe_name_from_syntax(
1611                                 talloc_tos(),
1612                                 &rpc_bind.ctx_list[0].abstract_syntax));
1613
1614                 if (NT_STATUS_IS_ERR(status)) {
1615                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1616                                 get_pipe_name_from_syntax(
1617                                         talloc_tos(),
1618                                         &rpc_bind.ctx_list[0].abstract_syntax)));
1619                         prs_mem_free(&p->out_data.frag);
1620                         prs_mem_free(&out_hdr_ba);
1621                         prs_mem_free(&out_auth);
1622
1623                         return setup_bind_nak(p);
1624                 }
1625
1626                 if (rpc_srv_get_pipe_interface_by_cli_name(
1627                                 get_pipe_name_from_syntax(talloc_tos(),
1628                                                           &p->syntax),
1629                                 &id)) {
1630                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1631                                 rpc_srv_get_pipe_cli_name(&id),
1632                                 rpc_srv_get_pipe_srv_name(&id)));
1633                 } else {
1634                         DEBUG(0, ("module %s doesn't provide functions for "
1635                                   "pipe %s!\n",
1636                                   get_pipe_name_from_syntax(talloc_tos(),
1637                                                             &p->syntax),
1638                                   get_pipe_name_from_syntax(talloc_tos(),
1639                                                             &p->syntax)));
1640                         goto err_exit;
1641                 }
1642         }
1643
1644         /* name has to be \PIPE\xxxxx */
1645         fstrcpy(ack_pipe_name, "\\PIPE\\");
1646         fstrcat(ack_pipe_name, rpc_srv_get_pipe_srv_name(&id));
1647
1648         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1649
1650         if (rpc_bind.assoc_group_id != 0) {
1651                 assoc_gid = rpc_bind.assoc_group_id;
1652         } else {
1653                 assoc_gid = 0x53f0;
1654         }
1655
1656
1657         /*
1658          * Create the bind response struct.
1659          */
1660
1661         /* If the requested abstract synt uuid doesn't match our client pipe,
1662                 reject the bind_ack & set the transfer interface synt to all 0's,
1663                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1664                 unknown to NT4)
1665                 Needed when adding entries to a DACL from NT5 - SK */
1666
1667         if (check_bind_req(p,
1668                         &rpc_bind.ctx_list[0].abstract_syntax,
1669                         &rpc_bind.ctx_list[0].transfer_syntaxes[0],
1670                         rpc_bind.ctx_list[0].context_id)) {
1671                 init_rpc_hdr_ba(&hdr_ba,
1672                         RPC_MAX_PDU_FRAG_LEN,
1673                         RPC_MAX_PDU_FRAG_LEN,
1674                         assoc_gid,
1675                         ack_pipe_name,
1676                         0x1, 0x0, 0x0,
1677                         &rpc_bind.ctx_list[0].transfer_syntaxes[0]);
1678         } else {
1679                 /* Rejection reason: abstract syntax not supported */
1680                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1681                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1682                                         ack_pipe_name, 0x1, 0x2, 0x1,
1683                                         &null_ndr_syntax_id);
1684                 p->pipe_bound = False;
1685         }
1686
1687         /*
1688          * and marshall it.
1689          */
1690
1691         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1692                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1693                 goto err_exit;
1694         }
1695
1696         /*
1697          * Check if this is an authenticated bind request.
1698          */
1699
1700         if (p->hdr.auth_len) {
1701                 /*
1702                  * Decode the authentication verifier.
1703                  */
1704
1705                 /* Work out any padding needed before the auth footer. */
1706                 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
1707                         ss_padding_len = SERVER_NDR_PADDING_SIZE -
1708                                 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
1709                         DEBUG(10,("api_pipe_bind_req: auth pad_len = %u\n",
1710                                 (unsigned int)ss_padding_len ));
1711                 }
1712
1713                 /* Quick length check. Won't catch a bad auth footer,
1714                  * prevents overrun. */
1715
1716                 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
1717                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
1718                                 "too long for fragment %u.\n",
1719                                 (unsigned int)p->hdr.auth_len,
1720                                 (unsigned int)p->hdr.frag_len ));
1721                         goto err_exit;
1722                 }
1723
1724                 /* Pull the auth header and the following data into a blob. */
1725                 /* NB. The offset of the auth_header is relative to the *end*
1726                  * of the packet, not the start. Also, the length of the
1727                  * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
1728                  * as the RPC header isn't included in rpc_in_p. */
1729                 if(!prs_set_offset(rpc_in_p,
1730                                 p->hdr.frag_len - RPC_HEADER_LEN -
1731                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
1732                         DEBUG(0,("api_pipe_bind_req: cannot move "
1733                                 "offset to %u.\n",
1734                                 (unsigned int)(p->hdr.frag_len -
1735                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
1736                         goto err_exit;
1737                 }
1738
1739                 auth_blob = data_blob_const(prs_data_p(rpc_in_p)
1740                                                 + prs_offset(rpc_in_p),
1741                                             prs_data_size(rpc_in_p)
1742                                                 - prs_offset(rpc_in_p));
1743
1744                 status = dcerpc_pull_dcerpc_auth(prs_get_mem_context(rpc_in_p),
1745                                                  &auth_blob, &auth_info);
1746                 if (!NT_STATUS_IS_OK(status)) {
1747                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1748                         goto err_exit;
1749                 }
1750
1751                 auth_type = auth_info.auth_type;
1752
1753                 /* Work out if we have to sign or seal etc. */
1754                 switch (auth_info.auth_level) {
1755                 case DCERPC_AUTH_LEVEL_INTEGRITY:
1756                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1757                         break;
1758                 case DCERPC_AUTH_LEVEL_PRIVACY:
1759                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1760                         break;
1761                 default:
1762                         DEBUG(0, ("Unexpected auth level (%u).\n",
1763                                 (unsigned int)auth_info.auth_level ));
1764                         goto err_exit;
1765                 }
1766         } else {
1767                 ZERO_STRUCT(auth_info);
1768         }
1769
1770         switch(auth_type) {
1771                 case DCERPC_AUTH_TYPE_NTLMSSP:
1772                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p,
1773                                         ss_padding_len, &auth_info, &out_auth)) {
1774                                 goto err_exit;
1775                         }
1776                         assoc_gid = 0x7a77;
1777                         break;
1778
1779                 case DCERPC_AUTH_TYPE_SCHANNEL:
1780                         if (!pipe_schannel_auth_bind(p, rpc_in_p,
1781                                         ss_padding_len, &auth_info, &out_auth)) {
1782                                 goto err_exit;
1783                         }
1784                         break;
1785
1786                 case DCERPC_AUTH_TYPE_SPNEGO:
1787                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p,
1788                                         ss_padding_len, &auth_info, &out_auth)) {
1789                                 goto err_exit;
1790                         }
1791                         break;
1792
1793                 case DCERPC_AUTH_TYPE_NONE:
1794                         /* Unauthenticated bind request. */
1795                         /* We're finished - no more packets. */
1796                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1797                         /* We must set the pipe auth_level here also. */
1798                         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1799                         p->pipe_bound = True;
1800                         /* The session key was initialized from the SMB
1801                          * session in make_internal_rpc_pipe_p */
1802                         ss_padding_len = 0;
1803                         break;
1804
1805                 default:
1806                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1807                         goto err_exit;
1808         }
1809         /*
1810          * Create the header, now we know the length.
1811          */
1812
1813         if (prs_offset(&out_auth)) {
1814                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1815         }
1816
1817         init_rpc_hdr(&p->hdr, DCERPC_PKT_BIND_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1818                         p->hdr.call_id,
1819                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) +
1820                                 ss_padding_len + prs_offset(&out_auth),
1821                         auth_len);
1822
1823         /*
1824          * Marshall the header into the outgoing PDU.
1825          */
1826
1827         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1828                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1829                 goto err_exit;
1830         }
1831
1832         /*
1833          * Now add the RPC_HDR_BA and any auth needed.
1834          */
1835
1836         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1837                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1838                 goto err_exit;
1839         }
1840
1841         if (auth_len) {
1842                 if (ss_padding_len) {
1843                         char pad[SERVER_NDR_PADDING_SIZE];
1844                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1845                         if (!prs_copy_data_in(&p->out_data.frag, pad,
1846                                         ss_padding_len)) {
1847                                 DEBUG(0,("api_pipe_bind_req: failed to add %u "
1848                                         "bytes of pad data.\n",
1849                                         (unsigned int)ss_padding_len));
1850                                 goto err_exit;
1851                         }
1852                 }
1853
1854                 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1855                         DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1856                         goto err_exit;
1857                 }
1858         }
1859
1860         /*
1861          * Setup the lengths for the initial reply.
1862          */
1863
1864         p->out_data.data_sent_length = 0;
1865         p->out_data.current_pdu_sent = 0;
1866
1867         prs_mem_free(&out_hdr_ba);
1868         prs_mem_free(&out_auth);
1869
1870         return True;
1871
1872   err_exit:
1873
1874         prs_mem_free(&p->out_data.frag);
1875         prs_mem_free(&out_hdr_ba);
1876         prs_mem_free(&out_auth);
1877         return setup_bind_nak(p);
1878 }
1879
1880 /****************************************************************************
1881  Deal with an alter context call. Can be third part of 3 leg auth request for
1882  SPNEGO calls.
1883 ****************************************************************************/
1884
1885 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1886 {
1887         RPC_HDR_BA hdr_ba;
1888         struct dcerpc_bind rpc_bind;
1889         DATA_BLOB blob_rb;
1890         RPC_HDR_AUTH auth_info;
1891         uint16 assoc_gid;
1892         fstring ack_pipe_name;
1893         prs_struct out_hdr_ba;
1894         prs_struct out_auth;
1895         int auth_len = 0;
1896         uint32_t ss_padding_len = 0;
1897         NTSTATUS status;
1898
1899         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1900
1901         /*
1902          * Marshall directly into the outgoing PDU space. We
1903          * must do this as we need to set to the bind response
1904          * header and are never sending more than one PDU here.
1905          */
1906
1907         /*
1908          * Setup the memory to marshall the ba header, and the
1909          * auth footers.
1910          */
1911
1912         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1913                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1914                 prs_mem_free(&p->out_data.frag);
1915                 return False;
1916         }
1917
1918         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1919                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1920                 prs_mem_free(&p->out_data.frag);
1921                 prs_mem_free(&out_hdr_ba);
1922                 return False;
1923         }
1924
1925         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1926
1927         /* decode the alter context request */
1928         blob_rb = data_blob_const(prs_data_p(rpc_in_p),
1929                                   prs_data_size(rpc_in_p));
1930         status = dcerpc_pull_dcerpc_bind(talloc_tos(), &blob_rb, &rpc_bind);
1931         if (!NT_STATUS_IS_OK(status)) {
1932                 goto err_exit;
1933         }
1934
1935         /* secondary address CAN be NULL
1936          * as the specs say it's ignored.
1937          * It MUST be NULL to have the spoolss working.
1938          */
1939         fstrcpy(ack_pipe_name,"");
1940
1941         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1942
1943         if (rpc_bind.assoc_group_id != 0) {
1944                 assoc_gid = rpc_bind.assoc_group_id;
1945         } else {
1946                 assoc_gid = 0x53f0;
1947         }
1948
1949         /*
1950          * Create the bind response struct.
1951          */
1952
1953         /* If the requested abstract synt uuid doesn't match our client pipe,
1954                 reject the bind_ack & set the transfer interface synt to all 0's,
1955                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1956                 unknown to NT4)
1957                 Needed when adding entries to a DACL from NT5 - SK */
1958
1959         if (check_bind_req(p,
1960                         &rpc_bind.ctx_list[0].abstract_syntax,
1961                         &rpc_bind.ctx_list[0].transfer_syntaxes[0],
1962                         rpc_bind.ctx_list[0].context_id)) {
1963                 init_rpc_hdr_ba(&hdr_ba,
1964                         RPC_MAX_PDU_FRAG_LEN,
1965                         RPC_MAX_PDU_FRAG_LEN,
1966                         assoc_gid,
1967                         ack_pipe_name,
1968                         0x1, 0x0, 0x0,
1969                         &rpc_bind.ctx_list[0].transfer_syntaxes[0]);
1970         } else {
1971                 /* Rejection reason: abstract syntax not supported */
1972                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1973                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1974                                         ack_pipe_name, 0x1, 0x2, 0x1,
1975                                         &null_ndr_syntax_id);
1976                 p->pipe_bound = False;
1977         }
1978
1979         /*
1980          * and marshall it.
1981          */
1982
1983         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1984                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1985                 goto err_exit;
1986         }
1987
1988
1989         /*
1990          * Check if this is an authenticated alter context request.
1991          */
1992
1993         if (p->hdr.auth_len != 0) {
1994                 /*
1995                  * Decode the authentication verifier.
1996                  */
1997
1998                 /* Work out any padding needed before the auth footer. */
1999                 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
2000                         ss_padding_len = SERVER_NDR_PADDING_SIZE -
2001                                 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
2002                         DEBUG(10,("api_pipe_alter_context: auth pad_len = %u\n",
2003                                 (unsigned int)ss_padding_len ));
2004                 }
2005
2006                 /* Quick length check. Won't catch a bad auth footer,
2007                  * prevents overrun. */
2008
2009                 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
2010                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
2011                                 "too long for fragment %u.\n",
2012                                 (unsigned int)p->hdr.auth_len,
2013                                 (unsigned int)p->hdr.frag_len ));
2014                         goto err_exit;
2015                 }
2016
2017                 /* Pull the auth header and the following data into a blob. */
2018                 /* NB. The offset of the auth_header is relative to the *end*
2019                  * of the packet, not the start. Also, the length of the
2020                  * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2021                  * as the RPC header isn't included in rpc_in_p. */
2022                 if(!prs_set_offset(rpc_in_p,
2023                                 p->hdr.frag_len - RPC_HEADER_LEN -
2024                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
2025                         DEBUG(0,("api_alter_context: cannot move "
2026                                 "offset to %u.\n",
2027                                 (unsigned int)(p->hdr.frag_len -
2028                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
2029                         goto err_exit;
2030                 }
2031
2032                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
2033                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
2034                         goto err_exit;
2035                 }
2036
2037                 /*
2038                  * Currently only the SPNEGO auth type uses the alter ctx
2039                  * response in place of the NTLMSSP auth3 type.
2040                  */
2041
2042                 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
2043                         /* We can only finish if the pipe is unbound. */
2044                         if (!p->pipe_bound) {
2045                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p,
2046                                                 ss_padding_len, &auth_info, &out_auth)) {
2047                                         goto err_exit;
2048                                 }
2049                         } else {
2050                                 goto err_exit;
2051                         }
2052                 }
2053         } else {
2054                 ZERO_STRUCT(auth_info);
2055         }
2056         /*
2057          * Create the header, now we know the length.
2058          */
2059
2060         if (prs_offset(&out_auth)) {
2061                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
2062         }
2063
2064         init_rpc_hdr(&p->hdr, DCERPC_PKT_ALTER_RESP, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
2065                         p->hdr.call_id,
2066                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
2067                         auth_len);
2068
2069         /*
2070          * Marshall the header into the outgoing PDU.
2071          */
2072
2073         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
2074                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
2075                 goto err_exit;
2076         }
2077
2078         /*
2079          * Now add the RPC_HDR_BA and any auth needed.
2080          */
2081
2082         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
2083                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
2084                 goto err_exit;
2085         }
2086
2087         if (auth_len) {
2088                 if (ss_padding_len) {
2089                         char pad[SERVER_NDR_PADDING_SIZE];
2090                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
2091                         if (!prs_copy_data_in(&p->out_data.frag, pad,
2092                                         ss_padding_len)) {
2093                                 DEBUG(0,("api_pipe_alter_context: failed to add %u "
2094                                         "bytes of pad data.\n",
2095                                         (unsigned int)ss_padding_len));
2096                                 goto err_exit;
2097                         }
2098                 }
2099
2100                 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
2101                         DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
2102                         goto err_exit;
2103                 }
2104         }
2105
2106         /*
2107          * Setup the lengths for the initial reply.
2108          */
2109
2110         p->out_data.data_sent_length = 0;
2111         p->out_data.current_pdu_sent = 0;
2112
2113         prs_mem_free(&out_hdr_ba);
2114         prs_mem_free(&out_auth);
2115         return True;
2116
2117   err_exit:
2118
2119         prs_mem_free(&p->out_data.frag);
2120         prs_mem_free(&out_hdr_ba);
2121         prs_mem_free(&out_auth);
2122         return setup_bind_nak(p);
2123 }
2124
2125 /****************************************************************************
2126  Deal with NTLMSSP sign & seal processing on an RPC request.
2127 ****************************************************************************/
2128
2129 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
2130                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
2131 {
2132         RPC_HDR_AUTH auth_info;
2133         uint32 auth_len = p->hdr.auth_len;
2134         uint32 save_offset = prs_offset(rpc_in);
2135         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
2136         unsigned char *data = NULL;
2137         size_t data_len;
2138         unsigned char *full_packet_data = NULL;
2139         size_t full_packet_data_len;
2140         DATA_BLOB auth_blob;
2141
2142         *pstatus = NT_STATUS_OK;
2143
2144         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_NONE || p->auth.auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
2145                 return True;
2146         }
2147
2148         if (!a) {
2149                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2150                 return False;
2151         }
2152
2153         /* Ensure there's enough data for an authenticated request. */
2154         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN
2155                         + auth_len > p->hdr.frag_len) {
2156                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2157                         (unsigned int)auth_len ));
2158                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2159                 return False;
2160         }
2161
2162         /*
2163          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2164          * after the RPC header.
2165          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2166          * functions as NTLMv2 checks the rpc headers also.
2167          * Both of these values include any auth_pad_len bytes.
2168          */
2169
2170         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2171         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2172
2173         full_packet_data = p->in_data.current_in_pdu;
2174         full_packet_data_len = p->hdr.frag_len - auth_len;
2175
2176         /* Pull the auth header and the following data into a blob. */
2177         /* NB. The offset of the auth_header is relative to the *end*
2178          * of the packet, not the start. Also, the length of the
2179          * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2180          * as the RPC header isn't included in rpc_in_p. */
2181         if(!prs_set_offset(rpc_in,
2182                         p->hdr.frag_len - RPC_HEADER_LEN -
2183                         RPC_HDR_AUTH_LEN - auth_len)) {
2184                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move "
2185                         "offset to %u.\n",
2186                         (unsigned int)(p->hdr.frag_len -
2187                                 RPC_HDR_AUTH_LEN - auth_len) ));
2188                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2189                 return False;
2190         }
2191
2192         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2193                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to "
2194                         "unmarshall RPC_HDR_AUTH.\n"));
2195                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2196                 return False;
2197         }
2198
2199         /* Ensure auth_pad_len fits into the packet. */
2200         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2201                         RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2202                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_info.auth_pad_len "
2203                         "too large (%u), auth_len (%u), frag_len = (%u).\n",
2204                         (unsigned int)auth_info.auth_pad_len,
2205                         (unsigned int)auth_len,
2206                         (unsigned int)p->hdr.frag_len ));
2207                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2208                 return False;
2209         }
2210
2211         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2212         auth_blob.length = auth_len;
2213
2214         switch (p->auth.auth_level) {
2215                 case DCERPC_AUTH_LEVEL_PRIVACY:
2216                         /* Data is encrypted. */
2217                         *pstatus = auth_ntlmssp_unseal_packet(a,
2218                                                               data, data_len,
2219                                                               full_packet_data,
2220                                                               full_packet_data_len,
2221                                                               &auth_blob);
2222                         if (!NT_STATUS_IS_OK(*pstatus)) {
2223                                 return False;
2224                         }
2225                         break;
2226                 case DCERPC_AUTH_LEVEL_INTEGRITY:
2227                         /* Data is signed. */
2228                         *pstatus = auth_ntlmssp_check_packet(a,
2229                                                              data, data_len,
2230                                                              full_packet_data,
2231                                                              full_packet_data_len,
2232                                                              &auth_blob);
2233                         if (!NT_STATUS_IS_OK(*pstatus)) {
2234                                 return False;
2235                         }
2236                         break;
2237                 default:
2238                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2239                         return False;
2240         }
2241
2242         /*
2243          * Return the current pointer to the data offset.
2244          */
2245
2246         if(!prs_set_offset(rpc_in, save_offset)) {
2247                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2248                         (unsigned int)save_offset ));
2249                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2250                 return False;
2251         }
2252
2253         /*
2254          * Remember the padding length. We must remove it from the real data
2255          * stream once the sign/seal is done.
2256          */
2257
2258         *p_ss_padding_len = auth_info.auth_pad_len;
2259
2260         return True;
2261 }
2262
2263 /****************************************************************************
2264  Deal with schannel processing on an RPC request.
2265 ****************************************************************************/
2266
2267 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2268 {
2269         uint32 data_len;
2270         uint32 auth_len;
2271         uint32 save_offset = prs_offset(rpc_in);
2272         RPC_HDR_AUTH auth_info;
2273         DATA_BLOB blob;
2274         NTSTATUS status;
2275         uint8_t *data;
2276
2277         auth_len = p->hdr.auth_len;
2278
2279         if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN ||
2280                         auth_len > RPC_HEADER_LEN +
2281                                         RPC_HDR_REQ_LEN +
2282                                         RPC_HDR_AUTH_LEN +
2283                                         auth_len) {
2284                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2285                 return False;
2286         }
2287
2288         /*
2289          * The following is that length of the data we must verify or unseal.
2290          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2291          * preceeding the auth_data, but does include the auth_pad_len bytes.
2292          */
2293
2294         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2295                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2296                         (unsigned int)p->hdr.frag_len,
2297                         (unsigned int)auth_len ));
2298                 return False;
2299         }
2300
2301         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2302                 RPC_HDR_AUTH_LEN - auth_len;
2303
2304         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2305
2306         /* Pull the auth header and the following data into a blob. */
2307         /* NB. The offset of the auth_header is relative to the *end*
2308          * of the packet, not the start. Also, the length of the
2309          * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2310          * as the RPC header isn't included in rpc_in_p. */
2311         if(!prs_set_offset(rpc_in,
2312                         p->hdr.frag_len - RPC_HEADER_LEN -
2313                         RPC_HDR_AUTH_LEN - auth_len)) {
2314                 DEBUG(0,("api_pipe_schannel_process: cannot move "
2315                         "offset to %u.\n",
2316                         (unsigned int)(p->hdr.frag_len -
2317                                 RPC_HDR_AUTH_LEN - auth_len) ));
2318                 return False;
2319         }
2320
2321         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2322                 DEBUG(0,("api_pipe_schannel_process: failed to "
2323                         "unmarshall RPC_HDR_AUTH.\n"));
2324                 return False;
2325         }
2326
2327         /* Ensure auth_pad_len fits into the packet. */
2328         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2329                         RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2330                 DEBUG(0,("api_pipe_schannel_process: auth_info.auth_pad_len "
2331                         "too large (%u), auth_len (%u), frag_len = (%u).\n",
2332                         (unsigned int)auth_info.auth_pad_len,
2333                         (unsigned int)auth_len,
2334                         (unsigned int)p->hdr.frag_len ));
2335                 return False;
2336         }
2337
2338         if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
2339                 DEBUG(0,("Invalid auth info %d on schannel\n",
2340                          auth_info.auth_type));
2341                 return False;
2342         }
2343
2344         blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), auth_len);
2345
2346         if (DEBUGLEVEL >= 10) {
2347                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
2348         }
2349
2350         data = (uint8_t *)prs_data_p(rpc_in)+RPC_HDR_REQ_LEN;
2351
2352         switch (auth_info.auth_level) {
2353         case DCERPC_AUTH_LEVEL_PRIVACY:
2354                 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2355                                                 talloc_tos(),
2356                                                 true,
2357                                                 data,
2358                                                 data_len,
2359                                                 &blob);
2360                 break;
2361         case DCERPC_AUTH_LEVEL_INTEGRITY:
2362                 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2363                                                 talloc_tos(),
2364                                                 false,
2365                                                 data,
2366                                                 data_len,
2367                                                 &blob);
2368                 break;
2369         default:
2370                 status = NT_STATUS_INTERNAL_ERROR;
2371                 break;
2372         }
2373
2374         if (!NT_STATUS_IS_OK(status)) {
2375                 DEBUG(0,("failed to unseal packet: %s\n", nt_errstr(status)));
2376                 return false;
2377         }
2378
2379         /*
2380          * Return the current pointer to the data offset.
2381          */
2382
2383         if(!prs_set_offset(rpc_in, save_offset)) {
2384                 DEBUG(0,("failed to set offset back to %u\n",
2385                          (unsigned int)save_offset ));
2386                 return False;
2387         }
2388
2389         /*
2390          * Remember the padding length. We must remove it from the real data
2391          * stream once the sign/seal is done.
2392          */
2393
2394         *p_ss_padding_len = auth_info.auth_pad_len;
2395
2396         return True;
2397 }
2398
2399 /****************************************************************************
2400  Find the set of RPC functions associated with this context_id
2401 ****************************************************************************/
2402
2403 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2404 {
2405         PIPE_RPC_FNS *fns = NULL;
2406
2407         if ( !list ) {
2408                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2409                 return NULL;
2410         }
2411
2412         for (fns=list; fns; fns=fns->next ) {
2413                 if ( fns->context_id == context_id )
2414                         return fns;
2415         }
2416         return NULL;
2417 }
2418
2419 /****************************************************************************
2420  Memory cleanup.
2421 ****************************************************************************/
2422
2423 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2424 {
2425         PIPE_RPC_FNS *tmp = list;
2426         PIPE_RPC_FNS *tmp2;
2427
2428         while (tmp) {
2429                 tmp2 = tmp->next;
2430                 SAFE_FREE(tmp);
2431                 tmp = tmp2;
2432         }
2433
2434         return;
2435 }
2436
2437 static bool api_rpcTNP(pipes_struct *p,
2438                        const struct api_struct *api_rpc_cmds, int n_cmds);
2439
2440 /****************************************************************************
2441  Find the correct RPC function to call for this request.
2442  If the pipe is authenticated then become the correct UNIX user
2443  before doing the call.
2444 ****************************************************************************/
2445
2446 bool api_pipe_request(pipes_struct *p)
2447 {
2448         bool ret = False;
2449         bool changed_user = False;
2450         PIPE_RPC_FNS *pipe_fns;
2451
2452         if (p->pipe_bound &&
2453                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2454                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2455                 if(!become_authenticated_pipe_user(p)) {
2456                         prs_mem_free(&p->out_data.rdata);
2457                         return False;
2458                 }
2459                 changed_user = True;
2460         }
2461
2462         DEBUG(5, ("Requested \\PIPE\\%s\n",
2463                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2464
2465         /* get the set of RPC functions for this context */
2466
2467         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2468
2469         if ( pipe_fns ) {
2470                 TALLOC_CTX *frame = talloc_stackframe();
2471                 ret = api_rpcTNP(p, pipe_fns->cmds, pipe_fns->n_cmds);
2472                 TALLOC_FREE(frame);
2473         }
2474         else {
2475                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2476                         p->hdr_req.context_id,
2477                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2478         }
2479
2480         if (changed_user) {
2481                 unbecome_authenticated_pipe_user();
2482         }
2483
2484         return ret;
2485 }
2486
2487 /*******************************************************************
2488  Calls the underlying RPC function for a named pipe.
2489  ********************************************************************/
2490
2491 static bool api_rpcTNP(pipes_struct *p,
2492                        const struct api_struct *api_rpc_cmds, int n_cmds)
2493 {
2494         int fn_num;
2495         uint32 offset1, offset2;
2496
2497         /* interpret the command */
2498         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2499                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2500                  p->hdr_req.opnum));
2501
2502         if (DEBUGLEVEL >= 50) {
2503                 fstring name;
2504                 slprintf(name, sizeof(name)-1, "in_%s",
2505                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2506                 prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2507         }
2508
2509         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2510                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2511                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2512                         break;
2513                 }
2514         }
2515
2516         if (fn_num == n_cmds) {
2517                 /*
2518                  * For an unknown RPC just return a fault PDU but
2519                  * return True to allow RPC's on the pipe to continue
2520                  * and not put the pipe into fault state. JRA.
2521                  */
2522                 DEBUG(4, ("unknown\n"));
2523                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2524                 return True;
2525         }
2526
2527         offset1 = prs_offset(&p->out_data.rdata);
2528
2529         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2530                 fn_num, api_rpc_cmds[fn_num].fn));
2531         /* do the actual command */
2532         if(!api_rpc_cmds[fn_num].fn(p)) {
2533                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2534                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2535                          api_rpc_cmds[fn_num].name));
2536                 prs_mem_free(&p->out_data.rdata);
2537                 return False;
2538         }
2539
2540         if (p->bad_handle_fault_state) {
2541                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2542                 p->bad_handle_fault_state = False;
2543                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2544                 return True;
2545         }
2546
2547         if (p->rng_fault_state) {
2548                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2549                 p->rng_fault_state = False;
2550                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2551                 return True;
2552         }
2553
2554         offset2 = prs_offset(&p->out_data.rdata);
2555         prs_set_offset(&p->out_data.rdata, offset1);
2556         if (DEBUGLEVEL >= 50) {
2557                 fstring name;
2558                 slprintf(name, sizeof(name)-1, "out_%s",
2559                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2560                 prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2561         }
2562         prs_set_offset(&p->out_data.rdata, offset2);
2563
2564         DEBUG(5,("api_rpcTNP: called %s successfully\n",
2565                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2566
2567         /* Check for buffer underflow in rpc parsing */
2568
2569         if ((DEBUGLEVEL >= 10) &&
2570             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2571                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2572                 char *data = (char *)SMB_MALLOC(data_len);
2573
2574                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2575                 if (data) {
2576                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2577                         SAFE_FREE(data);
2578                 }
2579
2580         }
2581
2582         return True;
2583 }