source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "system/filesys.h"
  32 #include "srv_pipe_internal.h"
  33 #include "../librpc/gen_ndr/ndr_schannel.h"
  34 #include "../libcli/auth/schannel.h"
  35 #include "../libcli/auth/spnego.h"
  36 #include "dcesrv_auth_generic.h"
  37 #include "dcesrv_gssapi.h"
  38 #include "dcesrv_spnego.h"
  39 #include "rpc_server.h"
  40 #include "rpc_dce.h"
  41 #include "smbd/smbd.h"
  42 #include "auth.h"
  43 #include "ntdomain.h"
  44 #include "rpc_server/srv_pipe.h"
  45 #include "rpc_server/rpc_contexts.h"
  46 #include "lib/param/param.h"
  47
  48 #undef DBGC_CLASS
  49 #define DBGC_CLASS DBGC_RPC_SRV
  50
  51 /**
  52  * Dump everything from the start of the end up of the provided data
  53  * into a file, but only at debug level >= 50
  54  **/
  55 static void dump_pdu_region(const char *name, int v,
  56                             DATA_BLOB *data, size_t start, size_t end)
  57 {
  58         int fd, i;
  59         char *fname = NULL;
  60         ssize_t sz;
  61
  62         if (DEBUGLEVEL < 50) return;
  63
  64         if (start > data->length || end > data->length || start > end) return;
  65
  66         for (i = 1; i < 100; i++) {
  67                 if (v != -1) {
  68                         fname = talloc_asprintf(talloc_tos(),
  69                                                 "/tmp/%s_%d.%d.prs",
  70                                                 name, v, i);
  71                 } else {
  72                         fname = talloc_asprintf(talloc_tos(),
  73                                                 "/tmp/%s_%d.prs",
  74                                                 name, i);
  75                 }
  76                 if (!fname) {
  77                         return;
  78                 }
  79                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  80                 if (fd != -1 || errno != EEXIST) break;
  81         }
  82         if (fd != -1) {
  83                 sz = write(fd, data->data + start, end - start);
  84                 i = close(fd);
  85                 if ((sz != end - start) || (i != 0) ) {
  86                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  87                                   fname, (unsigned long)sz,
  88                                   (unsigned long)end - start, i));
  89                 } else {
  90                         DEBUG(0,("created %s\n", fname));
  91                 }
  92         }
  93         TALLOC_FREE(fname);
  94 }
  95
  96 static DATA_BLOB generic_session_key(void)
  97 {
  98         return data_blob_const("SystemLibraryDTC", 16);
  99 }
 100
 101 /*******************************************************************
 102  Generate the next PDU to be returned from the data.
 103 ********************************************************************/
 104
 105 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
 106                                    struct pipe_auth_data *auth,
 107                                    uint32_t call_id,
 108                                    DATA_BLOB *rdata,
 109                                    size_t data_sent_length,
 110                                    DATA_BLOB *frag,
 111                                    size_t *pdu_size)
 112 {
 113         union dcerpc_payload u;
 114         uint8_t pfc_flags;
 115         size_t data_left;
 116         size_t data_to_send;
 117         size_t frag_len;
 118         size_t pad_len = 0;
 119         size_t auth_len = 0;
 120         NTSTATUS status;
 121
 122         ZERO_STRUCT(u.response);
 123
 124         /* Set up rpc packet pfc flags. */
 125         if (data_sent_length == 0) {
 126                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 127         } else {
 128                 pfc_flags = 0;
 129         }
 130
 131         /* Work out how much we can fit in a single PDU. */
 132         data_left = rdata->length - data_sent_length;
 133
 134         /* Ensure there really is data left to send. */
 135         if (!data_left) {
 136                 DEBUG(0, ("No data left to send !\n"));
 137                 return NT_STATUS_BUFFER_TOO_SMALL;
 138         }
 139
 140         status = dcerpc_guess_sizes(auth,
 141                                     DCERPC_RESPONSE_LENGTH,
 142                                     data_left,
 143                                     RPC_MAX_PDU_FRAG_LEN,
 144                                     SERVER_NDR_PADDING_SIZE,
 145                                     &data_to_send, &frag_len,
 146                                     &auth_len, &pad_len);
 147         if (!NT_STATUS_IS_OK(status)) {
 148                 return status;
 149         }
 150
 151         /* Set up the alloc hint. This should be the data left to send. */
 152         u.response.alloc_hint = data_left;
 153
 154         /* Work out if this PDU will be the last. */
 155         if (data_sent_length + data_to_send >= rdata->length) {
 156                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 157         }
 158
 159         /* Prepare data to be NDR encoded. */
 160         u.response.stub_and_verifier =
 161                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 162
 163         /* Store the packet in the data stream. */
 164         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 165                                           pfc_flags, auth_len, call_id,
 166                                           &u, frag);
 167         if (!NT_STATUS_IS_OK(status)) {
 168                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 169                 return status;
 170         }
 171
 172         if (auth_len) {
 173                 /* Set the proper length on the pdu, including padding.
 174                  * Only needed if an auth trailer will be appended. */
 175                 dcerpc_set_frag_length(frag, frag->length
 176                                                 + pad_len
 177                                                 + DCERPC_AUTH_TRAILER_LENGTH
 178                                                 + auth_len);
 179         }
 180
 181         if (auth_len) {
 182                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 183                 if (!NT_STATUS_IS_OK(status)) {
 184                         data_blob_free(frag);
 185                         return status;
 186                 }
 187         }
 188
 189         *pdu_size = data_to_send;
 190         return NT_STATUS_OK;
 191 }
 192
 193 /*******************************************************************
 194  Generate the next PDU to be returned from the data in p->rdata.
 195 ********************************************************************/
 196
 197 bool create_next_pdu(struct pipes_struct *p)
 198 {
 199         size_t pdu_size = 0;
 200         NTSTATUS status;
 201
 202         /*
 203          * If we're in the fault state, keep returning fault PDU's until
 204          * the pipe gets closed. JRA.
 205          */
 206         if (p->fault_state) {
 207                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 208                 return true;
 209         }
 210
 211         status = create_next_packet(p->mem_ctx, &p->auth,
 212                                     p->call_id, &p->out_data.rdata,
 213                                     p->out_data.data_sent_length,
 214                                     &p->out_data.frag, &pdu_size);
 215         if (!NT_STATUS_IS_OK(status)) {
 216                 DEBUG(0, ("Failed to create packet with error %s, "
 217                           "(auth level %u / type %u)\n",
 218                           nt_errstr(status),
 219                           (unsigned int)p->auth.auth_level,
 220                           (unsigned int)p->auth.auth_type));
 221                 return false;
 222         }
 223
 224         /* Setup the counts for this PDU. */
 225         p->out_data.data_sent_length += pdu_size;
 226         p->out_data.current_pdu_sent = 0;
 227         return true;
 228 }
 229
 230
 231 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 232
 233 /*******************************************************************
 234  Marshall a bind_nak pdu.
 235 *******************************************************************/
 236
 237 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 238 {
 239         NTSTATUS status;
 240         union dcerpc_payload u;
 241
 242         /* Free any memory in the current return data buffer. */
 243         pipe_init_outgoing_data(p);
 244
 245         /*
 246          * Initialize a bind_nak header.
 247          */
 248
 249         ZERO_STRUCT(u);
 250
 251         u.bind_nak.reject_reason  = 0;
 252
 253         /*
 254          * Marshall directly into the outgoing PDU space. We
 255          * must do this as we need to set to the bind response
 256          * header and are never sending more than one PDU here.
 257          */
 258
 259         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 260                                           DCERPC_PKT_BIND_NAK,
 261                                           DCERPC_PFC_FLAG_FIRST |
 262                                                 DCERPC_PFC_FLAG_LAST,
 263                                           0,
 264                                           pkt->call_id,
 265                                           &u,
 266                                           &p->out_data.frag);
 267         if (!NT_STATUS_IS_OK(status)) {
 268                 return False;
 269         }
 270
 271         p->out_data.data_sent_length = 0;
 272         p->out_data.current_pdu_sent = 0;
 273
 274         TALLOC_FREE(p->auth.auth_ctx);
 275         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 276         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 277         p->pipe_bound = False;
 278
 279         return True;
 280 }
 281
 282 /*******************************************************************
 283  Marshall a fault pdu.
 284 *******************************************************************/
 285
 286 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 287 {
 288         NTSTATUS status;
 289         union dcerpc_payload u;
 290
 291         /* Free any memory in the current return data buffer. */
 292         pipe_init_outgoing_data(p);
 293
 294         /*
 295          * Initialize a fault header.
 296          */
 297
 298         ZERO_STRUCT(u);
 299
 300         u.fault.status          = NT_STATUS_V(fault_status);
 301         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 302
 303         /*
 304          * Marshall directly into the outgoing PDU space. We
 305          * must do this as we need to set to the bind response
 306          * header and are never sending more than one PDU here.
 307          */
 308
 309         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 310                                           DCERPC_PKT_FAULT,
 311                                           DCERPC_PFC_FLAG_FIRST |
 312                                            DCERPC_PFC_FLAG_LAST |
 313                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 314                                           0,
 315                                           p->call_id,
 316                                           &u,
 317                                           &p->out_data.frag);
 318         if (!NT_STATUS_IS_OK(status)) {
 319                 return False;
 320         }
 321
 322         p->out_data.data_sent_length = 0;
 323         p->out_data.current_pdu_sent = 0;
 324
 325         return True;
 326 }
 327
 328 /*******************************************************************
 329  Ensure a bind request has the correct abstract & transfer interface.
 330  Used to reject unknown binds from Win2k.
 331 *******************************************************************/
 332
 333 static bool check_bind_req(struct pipes_struct *p,
 334                            struct ndr_syntax_id* abstract,
 335                            struct ndr_syntax_id* transfer,
 336                            uint32_t context_id)
 337 {
 338         struct pipe_rpc_fns *context_fns;
 339         bool ok;
 340
 341         DEBUG(3,("check_bind_req for %s\n",
 342                  get_pipe_name_from_syntax(talloc_tos(), abstract)));
 343
 344         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 345         if (rpc_srv_pipe_exists_by_id(abstract) &&
 346            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 347                 DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
 348                           rpc_srv_get_pipe_cli_name(abstract),
 349                           rpc_srv_get_pipe_srv_name(abstract)));
 350         } else {
 351                 return false;
 352         }
 353
 354         ok = init_pipe_handles(p, abstract);
 355         if (!ok) {
 356                 DEBUG(1, ("Failed to init pipe handles!\n"));
 357                 return false;
 358         }
 359
 360         context_fns = talloc(p, struct pipe_rpc_fns);
 361         if (context_fns == NULL) {
 362                 DEBUG(0,("check_bind_req: talloc() failed!\n"));
 363                 return false;
 364         }
 365
 366         context_fns->next = context_fns->prev = NULL;
 367         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 368         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 369         context_fns->context_id = context_id;
 370         context_fns->syntax = *abstract;
 371
 372         /* add to the list of open contexts */
 373
 374         DLIST_ADD( p->contexts, context_fns );
 375
 376         return True;
 377 }
 378
 379 /**
 380  * Is a named pipe known?
 381  * @param[in] cli_filename      The pipe name requested by the client
 382  * @result                      Do we want to serve this?
 383  */
 384 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
 385 {
 386         const char *pipename = cli_filename;
 387         NTSTATUS status;
 388
 389         if (strnequal(pipename, "\\PIPE\\", 6)) {
 390                 pipename += 5;
 391         }
 392
 393         if (*pipename == '\\') {
 394                 pipename += 1;
 395         }
 396
 397         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 398                 DEBUG(10, ("refusing spoolss access\n"));
 399                 return false;
 400         }
 401
 402         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 403                 return true;
 404         }
 405
 406         status = smb_probe_module("rpc", pipename);
 407         if (!NT_STATUS_IS_OK(status)) {
 408                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
 409                 return false;
 410         }
 411         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 412
 413         /*
 414          * Scan the list again for the interface id
 415          */
 416         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 417                 return true;
 418         }
 419
 420         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 421                    pipename));
 422
 423         return false;
 424 }
 425
 426 /*******************************************************************
 427  Handle the first part of a SPNEGO bind auth.
 428 *******************************************************************/
 429
 430 static bool pipe_spnego_auth_bind(struct pipes_struct *p,
 431                                   TALLOC_CTX *mem_ctx,
 432                                   struct dcerpc_auth *auth_info,
 433                                   DATA_BLOB *response)
 434 {
 435         struct spnego_context *spnego_ctx;
 436         NTSTATUS status;
 437
 438         status = spnego_server_auth_start(p,
 439                                           (auth_info->auth_level ==
 440                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 441                                           (auth_info->auth_level ==
 442                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 443                                           true,
 444                                           &auth_info->credentials,
 445                                           response,
 446                                           p->remote_address,
 447                                           &spnego_ctx);
 448         if (!NT_STATUS_IS_OK(status)) {
 449                 DEBUG(0, ("Failed SPNEGO negotiate (%s)\n",
 450                           nt_errstr(status)));
 451                 return false;
 452         }
 453
 454         /* Make sure data is bound to the memctx, to be freed the caller */
 455         talloc_steal(mem_ctx, response->data);
 456
 457         p->auth.auth_ctx = spnego_ctx;
 458         p->auth.auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 459
 460         DEBUG(10, ("SPNEGO auth started\n"));
 461
 462         return true;
 463 }
 464
 465 /*******************************************************************
 466  Handle an schannel bind auth.
 467 *******************************************************************/
 468
 469 static bool pipe_schannel_auth_bind(struct pipes_struct *p,
 470                                     TALLOC_CTX *mem_ctx,
 471                                     struct dcerpc_auth *auth_info,
 472                                     DATA_BLOB *response)
 473 {
 474         struct NL_AUTH_MESSAGE neg;
 475         struct NL_AUTH_MESSAGE reply;
 476         bool ret;
 477         NTSTATUS status;
 478         struct netlogon_creds_CredentialState *creds;
 479         enum ndr_err_code ndr_err;
 480         struct schannel_state *schannel_auth;
 481         struct loadparm_context *lp_ctx;
 482
 483         ndr_err = ndr_pull_struct_blob(
 484                         &auth_info->credentials, mem_ctx, &neg,
 485                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
 486         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 487                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
 488                 return false;
 489         }
 490
 491         if (DEBUGLEVEL >= 10) {
 492                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
 493         }
 494
 495         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
 496                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
 497                 return false;
 498         }
 499
 500         lp_ctx = loadparm_init_s3(p, loadparm_s3_context());
 501         if (!lp_ctx) {
 502                 DEBUG(0,("pipe_schannel_auth_bind: loadparm_init_s3() failed!\n"));
 503                 return false;
 504         }
 505
 506         /*
 507          * The neg.oem_netbios_computer.a key here must match the remote computer name
 508          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
 509          * operations that use credentials.
 510          */
 511
 512         become_root();
 513         status = schannel_get_creds_state(p, lp_ctx,
 514                                             neg.oem_netbios_computer.a, &creds);
 515         unbecome_root();
 516
 517         talloc_unlink(p, lp_ctx);
 518         if (!NT_STATUS_IS_OK(status)) {
 519                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
 520                 return False;
 521         }
 522
 523         schannel_auth = talloc(p, struct schannel_state);
 524         if (!schannel_auth) {
 525                 TALLOC_FREE(creds);
 526                 return False;
 527         }
 528
 529         schannel_auth->state = SCHANNEL_STATE_START;
 530         schannel_auth->seq_num = 0;
 531         schannel_auth->initiator = false;
 532         schannel_auth->creds = creds;
 533
 534         /*
 535          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
 536          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
 537          * struct of the person who opened the pipe. I need to test this further. JRA.
 538          *
 539          * VL. As we are mapping this to guest set the generic key
 540          * "SystemLibraryDTC" key here. It's a bit difficult to test against
 541          * W2k3, as it does not allow schannel binds against SAMR and LSA
 542          * anymore.
 543          */
 544
 545         ret = session_info_set_session_key(p->session_info, generic_session_key());
 546
 547         if (!ret) {
 548                 DEBUG(0, ("session_info_set_session_key failed\n"));
 549                 return false;
 550         }
 551
 552         /*** SCHANNEL verifier ***/
 553
 554         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
 555         reply.Flags                             = 0;
 556         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
 557                                                       * this has any meaning
 558                                                       * here - gd */
 559
 560         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
 561                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 562         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 563                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
 564                 return false;
 565         }
 566
 567         if (DEBUGLEVEL >= 10) {
 568                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
 569         }
 570
 571         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
 572                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
 573
 574         /* We're finished with this bind - no more packets. */
 575         p->auth.auth_ctx = schannel_auth;
 576         p->auth.auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
 577
 578         p->pipe_bound = True;
 579
 580         return True;
 581 }
 582
 583 /*******************************************************************
 584  Handle an NTLMSSP bind auth.
 585 *******************************************************************/
 586
 587 static bool pipe_auth_generic_bind(struct pipes_struct *p,
 588                                    TALLOC_CTX *mem_ctx,
 589                                    struct dcerpc_auth *auth_info,
 590                                    DATA_BLOB *response)
 591 {
 592         struct gensec_security *gensec_security = NULL;
 593         NTSTATUS status;
 594
 595         status = auth_generic_server_authtype_start(p,
 596                                                     auth_info->auth_type,
 597                                                     auth_info->auth_level,
 598                                                     &auth_info->credentials,
 599                                                     response,
 600                                                     p->remote_address,
 601                                                     &gensec_security);
 602         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 603                 DEBUG(0, (__location__ ": auth_generic_server_authtype_start failed: %s\n",
 604                           nt_errstr(status)));
 605                 return false;
 606         }
 607
 608         /* Make sure data is bound to the memctx, to be freed the caller */
 609         talloc_steal(mem_ctx, response->data);
 610
 611         p->auth.auth_ctx = gensec_security;
 612         p->auth.auth_type = auth_info->auth_type;
 613
 614         return true;
 615 }
 616
 617 /*******************************************************************
 618  Process an NTLMSSP authentication response.
 619  If this function succeeds, the user has been authenticated
 620  and their domain, name and calling workstation stored in
 621  the pipe struct.
 622 *******************************************************************/
 623
 624 static bool pipe_auth_generic_verify_final(TALLOC_CTX *mem_ctx,
 625                                 struct gensec_security *gensec_security,
 626                                 enum dcerpc_AuthLevel auth_level,
 627                                 struct auth_session_info **session_info)
 628 {
 629         NTSTATUS status;
 630         bool ret;
 631
 632         DEBUG(5, (__location__ ": checking user details\n"));
 633
 634         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 635            ensure the underlying NTLMSSP flags are also set. If not we should
 636            refuse the bind. */
 637
 638         status = auth_generic_server_check_flags(gensec_security,
 639                                             (auth_level ==
 640                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 641                                             (auth_level ==
 642                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 643         if (!NT_STATUS_IS_OK(status)) {
 644                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 645                           "security for rpc connection\n"));
 646                 return false;
 647         }
 648
 649         TALLOC_FREE(*session_info);
 650
 651         status = auth_generic_server_get_user_info(gensec_security,
 652                                                 mem_ctx, session_info);
 653         if (!NT_STATUS_IS_OK(status)) {
 654                 DEBUG(0, (__location__ ": failed to obtain the server info "
 655                           "for authenticated user: %s\n", nt_errstr(status)));
 656                 return false;
 657         }
 658
 659         if ((*session_info)->security_token == NULL) {
 660                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 661                 return false;
 662         }
 663
 664         /*
 665          * We're an authenticated bind over smb, so the session key needs to
 666          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 667          * does. See the RPC-SAMBA3SESSIONKEY.
 668          */
 669
 670         ret = session_info_set_session_key((*session_info), generic_session_key());
 671         if (!ret) {
 672                 DEBUG(0, ("Failed to set session key!\n"));
 673                 return false;
 674         }
 675
 676         return true;
 677 }
 678
 679 /*******************************************************************
 680  Handle a GSSAPI bind auth.
 681 *******************************************************************/
 682
 683 static bool pipe_gssapi_auth_bind(struct pipes_struct *p,
 684                                   TALLOC_CTX *mem_ctx,
 685                                   struct dcerpc_auth *auth_info,
 686                                   DATA_BLOB *response)
 687 {
 688         NTSTATUS status;
 689         struct gse_context *gse_ctx = NULL;
 690
 691         status = gssapi_server_auth_start(p,
 692                                           (auth_info->auth_level ==
 693                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 694                                           (auth_info->auth_level ==
 695                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 696                                           true,
 697                                           &auth_info->credentials,
 698                                           response,
 699                                           &gse_ctx);
 700         if (!NT_STATUS_IS_OK(status)) {
 701                 DEBUG(0, ("Failed to init dcerpc gssapi server (%s)\n",
 702                           nt_errstr(status)));
 703                 goto err;
 704         }
 705
 706         /* Make sure data is bound to the memctx, to be freed the caller */
 707         talloc_steal(mem_ctx, response->data);
 708
 709         p->auth.auth_ctx = gse_ctx;
 710         p->auth.auth_type = DCERPC_AUTH_TYPE_KRB5;
 711
 712         DEBUG(10, ("KRB5 auth started\n"));
 713
 714         return true;
 715
 716 err:
 717         TALLOC_FREE(gse_ctx);
 718         return false;
 719 }
 720
 721 static NTSTATUS pipe_gssapi_verify_final(TALLOC_CTX *mem_ctx,
 722                                          struct gse_context *gse_ctx,
 723                                          const struct tsocket_address *remote_address,
 724                                          struct auth_session_info **session_info)
 725 {
 726         NTSTATUS status;
 727         bool bret;
 728
 729         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 730            ensure the underlying flags are also set. If not we should
 731            refuse the bind. */
 732
 733         status = gssapi_server_check_flags(gse_ctx);
 734         if (!NT_STATUS_IS_OK(status)) {
 735                 DEBUG(0, ("Requested Security Layers not honored!\n"));
 736                 return status;
 737         }
 738
 739         status = gssapi_server_get_user_info(gse_ctx, mem_ctx,
 740                                              remote_address, session_info);
 741         if (!NT_STATUS_IS_OK(status)) {
 742                 DEBUG(0, (__location__ ": failed to obtain the server info "
 743                           "for authenticated user: %s\n", nt_errstr(status)));
 744                 return status;
 745         }
 746
 747         /*
 748          * We're an authenticated bind over smb, so the session key needs to
 749          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 750          * does. See the RPC-SAMBA3SESSIONKEY.
 751          */
 752
 753         bret = session_info_set_session_key((*session_info), generic_session_key());
 754         if (!bret) {
 755                 return NT_STATUS_ACCESS_DENIED;
 756         }
 757
 758         return NT_STATUS_OK;
 759 }
 760
 761 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 762 {
 763         enum spnego_mech auth_type;
 764         struct gensec_security *gensec_security;
 765         struct spnego_context *spnego_ctx;
 766         struct gse_context *gse_ctx;
 767         void *mech_ctx;
 768         NTSTATUS status;
 769
 770         switch (p->auth.auth_type) {
 771         case DCERPC_AUTH_TYPE_NTLMSSP:
 772                 gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
 773                                                         struct gensec_security);
 774                 if (!pipe_auth_generic_verify_final(p, gensec_security,
 775                                                 p->auth.auth_level,
 776                                                 &p->session_info)) {
 777                         return NT_STATUS_ACCESS_DENIED;
 778                 }
 779                 break;
 780         case DCERPC_AUTH_TYPE_KRB5:
 781                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 782                                                 struct gse_context);
 783                 status = pipe_gssapi_verify_final(p, gse_ctx,
 784                                                   p->remote_address,
 785                                                   &p->session_info);
 786                 if (!NT_STATUS_IS_OK(status)) {
 787                         DEBUG(1, ("gssapi bind failed with: %s",
 788                                   nt_errstr(status)));
 789                         return status;
 790                 }
 791                 break;
 792         case DCERPC_AUTH_TYPE_SPNEGO:
 793                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 794                                                    struct spnego_context);
 795                 status = spnego_get_negotiated_mech(spnego_ctx,
 796                                                     &auth_type, &mech_ctx);
 797                 if (!NT_STATUS_IS_OK(status)) {
 798                         DEBUG(0, ("Bad SPNEGO state (%s)\n",
 799                                   nt_errstr(status)));
 800                         return status;
 801                 }
 802                 switch(auth_type) {
 803                 case SPNEGO_KRB5:
 804                         gse_ctx = talloc_get_type_abort(mech_ctx,
 805                                                         struct gse_context);
 806                         status = pipe_gssapi_verify_final(p, gse_ctx,
 807                                                           p->remote_address,
 808                                                           &p->session_info);
 809                         if (!NT_STATUS_IS_OK(status)) {
 810                                 DEBUG(1, ("gssapi bind failed with: %s",
 811                                           nt_errstr(status)));
 812                                 return status;
 813                         }
 814                         break;
 815                 case SPNEGO_NTLMSSP:
 816                         gensec_security = talloc_get_type_abort(mech_ctx,
 817                                                 struct gensec_security);
 818                         if (!pipe_auth_generic_verify_final(p, gensec_security,
 819                                                         p->auth.auth_level,
 820                                                         &p->session_info)) {
 821                                 return NT_STATUS_ACCESS_DENIED;
 822                         }
 823                         break;
 824                 default:
 825                         DEBUG(0, (__location__ ": incorrect spnego type "
 826                                   "(%d).\n", auth_type));
 827                         return NT_STATUS_ACCESS_DENIED;
 828                 }
 829                 break;
 830         default:
 831                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
 832                           (unsigned int)p->auth.auth_type));
 833                 return NT_STATUS_ACCESS_DENIED;
 834         }
 835
 836         p->pipe_bound = true;
 837
 838         return NT_STATUS_OK;
 839 }
 840
 841 /*******************************************************************
 842  Respond to a pipe bind request.
 843 *******************************************************************/
 844
 845 static bool api_pipe_bind_req(struct pipes_struct *p,
 846                                 struct ncacn_packet *pkt)
 847 {
 848         struct dcerpc_auth auth_info;
 849         uint16 assoc_gid;
 850         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
 851         NTSTATUS status;
 852         struct ndr_syntax_id id;
 853         union dcerpc_payload u;
 854         struct dcerpc_ack_ctx bind_ack_ctx;
 855         DATA_BLOB auth_resp = data_blob_null;
 856         DATA_BLOB auth_blob = data_blob_null;
 857
 858         /* No rebinds on a bound pipe - use alter context. */
 859         if (p->pipe_bound) {
 860                 DEBUG(2,("Rejecting bind request on bound rpc connection\n"));
 861                 return setup_bind_nak(p, pkt);
 862         }
 863
 864         if (pkt->u.bind.num_contexts == 0) {
 865                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
 866                 goto err_exit;
 867         }
 868
 869         /*
 870          * Try and find the correct pipe name to ensure
 871          * that this is a pipe name we support.
 872          */
 873         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 874         if (rpc_srv_pipe_exists_by_id(&id)) {
 875                 DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 876                           rpc_srv_get_pipe_cli_name(&id),
 877                           rpc_srv_get_pipe_srv_name(&id)));
 878         } else {
 879                 status = smb_probe_module(
 880                         "rpc", get_pipe_name_from_syntax(
 881                                 talloc_tos(),
 882                                 &id));
 883
 884                 if (NT_STATUS_IS_ERR(status)) {
 885                         DEBUG(3,("api_pipe_bind_req: Unknown rpc service name "
 886                                  "%s in bind request.\n",
 887                                  get_pipe_name_from_syntax(talloc_tos(), &id)));
 888
 889                         return setup_bind_nak(p, pkt);
 890                 }
 891
 892                 if (rpc_srv_get_pipe_interface_by_cli_name(
 893                                 get_pipe_name_from_syntax(talloc_tos(),
 894                                                           &id),
 895                                 &id)) {
 896                         DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 897                                   rpc_srv_get_pipe_cli_name(&id),
 898                                   rpc_srv_get_pipe_srv_name(&id)));
 899                 } else {
 900                         DEBUG(0, ("module %s doesn't provide functions for "
 901                                   "pipe %s!\n",
 902                                   get_pipe_name_from_syntax(talloc_tos(), &id),
 903                                   get_pipe_name_from_syntax(talloc_tos(), &id)));
 904                         return setup_bind_nak(p, pkt);
 905                 }
 906         }
 907
 908         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 909
 910         if (pkt->u.bind.assoc_group_id != 0) {
 911                 assoc_gid = pkt->u.bind.assoc_group_id;
 912         } else {
 913                 assoc_gid = 0x53f0;
 914         }
 915
 916         /*
 917          * Create the bind response struct.
 918          */
 919
 920         /* If the requested abstract synt uuid doesn't match our client pipe,
 921                 reject the bind_ack & set the transfer interface synt to all 0's,
 922                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 923                 unknown to NT4)
 924                 Needed when adding entries to a DACL from NT5 - SK */
 925
 926         if (check_bind_req(p,
 927                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 928                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 929                         pkt->u.bind.ctx_list[0].context_id)) {
 930
 931                 bind_ack_ctx.result = 0;
 932                 bind_ack_ctx.reason = 0;
 933                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 934         } else {
 935                 p->pipe_bound = False;
 936                 /* Rejection reason: abstract syntax not supported */
 937                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 938                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
 939                 bind_ack_ctx.syntax = null_ndr_syntax_id;
 940         }
 941
 942         /*
 943          * Check if this is an authenticated bind request.
 944          */
 945         if (pkt->auth_length) {
 946                 /* Quick length check. Won't catch a bad auth footer,
 947                  * prevents overrun. */
 948
 949                 if (pkt->frag_length < RPC_HEADER_LEN +
 950                                         DCERPC_AUTH_TRAILER_LENGTH +
 951                                         pkt->auth_length) {
 952                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
 953                                 "too long for fragment %u.\n",
 954                                 (unsigned int)pkt->auth_length,
 955                                 (unsigned int)pkt->frag_length));
 956                         goto err_exit;
 957                 }
 958
 959                 /*
 960                  * Decode the authentication verifier.
 961                  */
 962                 status = dcerpc_pull_dcerpc_auth(pkt,
 963                                                  &pkt->u.bind.auth_info,
 964                                                  &auth_info, p->endian);
 965                 if (!NT_STATUS_IS_OK(status)) {
 966                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
 967                         goto err_exit;
 968                 }
 969
 970                 auth_type = auth_info.auth_type;
 971
 972                 /* Work out if we have to sign or seal etc. */
 973                 switch (auth_info.auth_level) {
 974                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 975                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 976                         break;
 977                 case DCERPC_AUTH_LEVEL_PRIVACY:
 978                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 979                         break;
 980                 case DCERPC_AUTH_LEVEL_CONNECT:
 981                         p->auth.auth_level = DCERPC_AUTH_LEVEL_CONNECT;
 982                         break;
 983                 default:
 984                         DEBUG(0, ("Unexpected auth level (%u).\n",
 985                                 (unsigned int)auth_info.auth_level ));
 986                         goto err_exit;
 987                 }
 988
 989                 switch (auth_type) {
 990                 case DCERPC_AUTH_TYPE_NTLMSSP:
 991                         if (!pipe_auth_generic_bind(p, pkt,
 992                                                     &auth_info, &auth_resp)) {
 993                                 goto err_exit;
 994                         }
 995                         assoc_gid = 0x7a77;
 996                         break;
 997
 998                 case DCERPC_AUTH_TYPE_SCHANNEL:
 999                         if (!pipe_schannel_auth_bind(p, pkt,
1000                                                 &auth_info, &auth_resp)) {
1001                                 goto err_exit;
1002                         }
1003                         break;
1004
1005                 case DCERPC_AUTH_TYPE_SPNEGO:
1006                         if (!pipe_spnego_auth_bind(p, pkt,
1007                                                 &auth_info, &auth_resp)) {
1008                                 goto err_exit;
1009                         }
1010                         break;
1011
1012                 case DCERPC_AUTH_TYPE_KRB5:
1013                         if (!pipe_gssapi_auth_bind(p, pkt,
1014                                                 &auth_info, &auth_resp)) {
1015                                 goto err_exit;
1016                         }
1017                         break;
1018
1019                 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1020                         if (p->transport == NCALRPC && p->ncalrpc_as_system) {
1021                                 TALLOC_FREE(p->session_info);
1022
1023                                 status = make_session_info_system(p,
1024                                                                   &p->session_info);
1025                                 if (!NT_STATUS_IS_OK(status)) {
1026                                         goto err_exit;
1027                                 }
1028
1029                                 auth_resp = data_blob_talloc(pkt,
1030                                                              "NCALRPC_AUTH_OK",
1031                                                              15);
1032
1033                                 p->auth.auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
1034                                 p->pipe_bound = true;
1035                         } else {
1036                                 goto err_exit;
1037                         }
1038                         break;
1039
1040                 case DCERPC_AUTH_TYPE_NONE:
1041                         break;
1042
1043                 default:
1044                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
1045                         goto err_exit;
1046                 }
1047         }
1048
1049         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
1050                 /* Unauthenticated bind request. */
1051                 /* We're finished - no more packets. */
1052                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
1053                 /* We must set the pipe auth_level here also. */
1054                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1055                 p->pipe_bound = True;
1056                 /* The session key was initialized from the SMB
1057                  * session in make_internal_rpc_pipe_p */
1058         }
1059
1060         ZERO_STRUCT(u.bind_ack);
1061         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1062         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1063         u.bind_ack.assoc_group_id = assoc_gid;
1064
1065         /* name has to be \PIPE\xxxxx */
1066         u.bind_ack.secondary_address =
1067                         talloc_asprintf(pkt, "\\PIPE\\%s",
1068                                         rpc_srv_get_pipe_srv_name(&id));
1069         if (!u.bind_ack.secondary_address) {
1070                 DEBUG(0, ("Out of memory!\n"));
1071                 goto err_exit;
1072         }
1073         u.bind_ack.secondary_address_size =
1074                                 strlen(u.bind_ack.secondary_address) + 1;
1075
1076         u.bind_ack.num_results = 1;
1077         u.bind_ack.ctx_list = &bind_ack_ctx;
1078
1079         /* NOTE: We leave the auth_info empty so we can calculate the padding
1080          * later and then append the auth_info --simo */
1081
1082         /*
1083          * Marshall directly into the outgoing PDU space. We
1084          * must do this as we need to set to the bind response
1085          * header and are never sending more than one PDU here.
1086          */
1087
1088         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1089                                           DCERPC_PKT_BIND_ACK,
1090                                           DCERPC_PFC_FLAG_FIRST |
1091                                                 DCERPC_PFC_FLAG_LAST,
1092                                           auth_resp.length,
1093                                           pkt->call_id,
1094                                           &u,
1095                                           &p->out_data.frag);
1096         if (!NT_STATUS_IS_OK(status)) {
1097                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1098                           nt_errstr(status)));
1099         }
1100
1101         if (auth_resp.length) {
1102
1103                 status = dcerpc_push_dcerpc_auth(pkt,
1104                                                  auth_type,
1105                                                  auth_info.auth_level,
1106                                                  0,
1107                                                  1, /* auth_context_id */
1108                                                  &auth_resp,
1109                                                  &auth_blob);
1110                 if (!NT_STATUS_IS_OK(status)) {
1111                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1112                         goto err_exit;
1113                 }
1114         }
1115
1116         /* Now that we have the auth len store it into the right place in
1117          * the dcerpc header */
1118         dcerpc_set_frag_length(&p->out_data.frag,
1119                                 p->out_data.frag.length + auth_blob.length);
1120
1121         if (auth_blob.length) {
1122
1123                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1124                                         auth_blob.data, auth_blob.length)) {
1125                         DEBUG(0, ("Append of auth info failed.\n"));
1126                         goto err_exit;
1127                 }
1128         }
1129
1130         /*
1131          * Setup the lengths for the initial reply.
1132          */
1133
1134         p->out_data.data_sent_length = 0;
1135         p->out_data.current_pdu_sent = 0;
1136
1137         TALLOC_FREE(auth_blob.data);
1138         return True;
1139
1140   err_exit:
1141
1142         data_blob_free(&p->out_data.frag);
1143         TALLOC_FREE(auth_blob.data);
1144         return setup_bind_nak(p, pkt);
1145 }
1146
1147 /*******************************************************************
1148  This is the "stage3" response after a bind request and reply.
1149 *******************************************************************/
1150
1151 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
1152 {
1153         struct dcerpc_auth auth_info;
1154         DATA_BLOB response = data_blob_null;
1155         struct gensec_security *gensec_security;
1156         struct spnego_context *spnego_ctx;
1157         struct gse_context *gse_ctx;
1158         NTSTATUS status;
1159
1160         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
1161
1162         if (pkt->auth_length == 0) {
1163                 DEBUG(0, ("No auth field sent for bind request!\n"));
1164                 goto err;
1165         }
1166
1167         /* Ensure there's enough data for an authenticated request. */
1168         if (pkt->frag_length < RPC_HEADER_LEN
1169                                 + DCERPC_AUTH_TRAILER_LENGTH
1170                                 + pkt->auth_length) {
1171                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
1172                                 "%u is too large.\n",
1173                         (unsigned int)pkt->auth_length));
1174                 goto err;
1175         }
1176
1177         /*
1178          * Decode the authentication verifier response.
1179          */
1180
1181         status = dcerpc_pull_dcerpc_auth(pkt,
1182                                          &pkt->u.auth3.auth_info,
1183                                          &auth_info, p->endian);
1184         if (!NT_STATUS_IS_OK(status)) {
1185                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
1186                 goto err;
1187         }
1188
1189         /* We must NEVER look at auth_info->auth_pad_len here,
1190          * as old Samba client code gets it wrong and sends it
1191          * as zero. JRA.
1192          */
1193
1194         if (auth_info.auth_type != p->auth.auth_type) {
1195                 DEBUG(0, ("Auth type mismatch! Client sent %d, "
1196                           "but auth was started as type %d!\n",
1197                           auth_info.auth_type, p->auth.auth_type));
1198                 goto err;
1199         }
1200
1201         switch (auth_info.auth_type) {
1202         case DCERPC_AUTH_TYPE_NTLMSSP:
1203                 gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
1204                                                     struct gensec_security);
1205                 status = auth_generic_server_step(gensec_security,
1206                                              pkt, &auth_info.credentials,
1207                                              &response);
1208                 break;
1209         case DCERPC_AUTH_TYPE_KRB5:
1210                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1211                                                 struct gse_context);
1212                 status = gssapi_server_step(gse_ctx,
1213                                             pkt, &auth_info.credentials,
1214                                             &response);
1215                 break;
1216         case DCERPC_AUTH_TYPE_SPNEGO:
1217                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1218                                                    struct spnego_context);
1219                 status = spnego_server_step(spnego_ctx,
1220                                             pkt, &auth_info.credentials,
1221                                             &response);
1222                 break;
1223         default:
1224                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
1225                           (unsigned int)auth_info.auth_type));
1226                 return false;
1227         }
1228
1229         if (NT_STATUS_EQUAL(status,
1230                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1231             response.length) {
1232                 DEBUG(0, (__location__ ": This was supposed to be the final "
1233                           "leg, but crypto machinery claims a response is "
1234                           "needed, aborting auth!\n"));
1235                 data_blob_free(&response);
1236                 goto err;
1237         }
1238         if (!NT_STATUS_IS_OK(status)) {
1239                 DEBUG(0, ("Auth failed (%s)\n", nt_errstr(status)));
1240                 goto err;
1241         }
1242
1243         /* Now verify auth was indeed successful and extract server info */
1244         status = pipe_auth_verify_final(p);
1245         if (!NT_STATUS_IS_OK(status)) {
1246                 DEBUG(0, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1247                 goto err;
1248         }
1249
1250         return true;
1251
1252 err:
1253
1254         TALLOC_FREE(p->auth.auth_ctx);
1255         return false;
1256 }
1257
1258 /****************************************************************************
1259  Deal with an alter context call. Can be third part of 3 leg auth request for
1260  SPNEGO calls.
1261 ****************************************************************************/
1262
1263 static bool api_pipe_alter_context(struct pipes_struct *p,
1264                                         struct ncacn_packet *pkt)
1265 {
1266         struct dcerpc_auth auth_info;
1267         uint16 assoc_gid;
1268         NTSTATUS status;
1269         union dcerpc_payload u;
1270         struct dcerpc_ack_ctx bind_ack_ctx;
1271         DATA_BLOB auth_resp = data_blob_null;
1272         DATA_BLOB auth_blob = data_blob_null;
1273         int pad_len = 0;
1274         struct gensec_security *gensec_security;
1275         struct spnego_context *spnego_ctx;
1276         struct gse_context *gse_ctx;
1277
1278         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1279
1280         if (pkt->u.bind.assoc_group_id != 0) {
1281                 assoc_gid = pkt->u.bind.assoc_group_id;
1282         } else {
1283                 assoc_gid = 0x53f0;
1284         }
1285
1286         /*
1287          * Create the bind response struct.
1288          */
1289
1290         /* If the requested abstract synt uuid doesn't match our client pipe,
1291                 reject the bind_ack & set the transfer interface synt to all 0's,
1292                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1293                 unknown to NT4)
1294                 Needed when adding entries to a DACL from NT5 - SK */
1295
1296         if (check_bind_req(p,
1297                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1298                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1299                         pkt->u.bind.ctx_list[0].context_id)) {
1300
1301                 bind_ack_ctx.result = 0;
1302                 bind_ack_ctx.reason = 0;
1303                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1304         } else {
1305                 p->pipe_bound = False;
1306                 /* Rejection reason: abstract syntax not supported */
1307                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1308                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1309                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1310         }
1311
1312         /*
1313          * Check if this is an authenticated alter context request.
1314          */
1315         if (pkt->auth_length) {
1316                 /* Quick length check. Won't catch a bad auth footer,
1317                  * prevents overrun. */
1318
1319                 if (pkt->frag_length < RPC_HEADER_LEN +
1320                                         DCERPC_AUTH_TRAILER_LENGTH +
1321                                         pkt->auth_length) {
1322                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1323                                 "too long for fragment %u.\n",
1324                                 (unsigned int)pkt->auth_length,
1325                                 (unsigned int)pkt->frag_length ));
1326                         goto err_exit;
1327                 }
1328
1329                 status = dcerpc_pull_dcerpc_auth(pkt,
1330                                                  &pkt->u.bind.auth_info,
1331                                                  &auth_info, p->endian);
1332                 if (!NT_STATUS_IS_OK(status)) {
1333                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1334                         goto err_exit;
1335                 }
1336
1337                 /* We can only finish if the pipe is unbound for now */
1338                 if (p->pipe_bound) {
1339                         DEBUG(0, (__location__ ": Pipe already bound, "
1340                                   "Altering Context not yet supported!\n"));
1341                         goto err_exit;
1342                 }
1343
1344                 if (auth_info.auth_type != p->auth.auth_type) {
1345                         DEBUG(0, ("Auth type mismatch! Client sent %d, "
1346                                   "but auth was started as type %d!\n",
1347                                   auth_info.auth_type, p->auth.auth_type));
1348                         goto err_exit;
1349                 }
1350
1351
1352                 switch (auth_info.auth_type) {
1353                 case DCERPC_AUTH_TYPE_SPNEGO:
1354                         spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1355                                                         struct spnego_context);
1356                         status = spnego_server_step(spnego_ctx,
1357                                                     pkt,
1358                                                     &auth_info.credentials,
1359                                                     &auth_resp);
1360                         break;
1361
1362                 case DCERPC_AUTH_TYPE_KRB5:
1363                         gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1364                                                         struct gse_context);
1365                         status = gssapi_server_step(gse_ctx,
1366                                                     pkt,
1367                                                     &auth_info.credentials,
1368                                                     &auth_resp);
1369                         break;
1370                 case DCERPC_AUTH_TYPE_NTLMSSP:
1371                         gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
1372                                                     struct gensec_security);
1373                         status = auth_generic_server_step(gensec_security,
1374                                                      pkt,
1375                                                      &auth_info.credentials,
1376                                                      &auth_resp);
1377                         break;
1378
1379                 default:
1380                         DEBUG(3, (__location__ ": Usupported auth type (%d) "
1381                                   "in alter-context call\n",
1382                                   auth_info.auth_type));
1383                         goto err_exit;
1384                 }
1385
1386                 if (NT_STATUS_IS_OK(status)) {
1387                         /* third leg of auth, verify auth info */
1388                         status = pipe_auth_verify_final(p);
1389                         if (!NT_STATUS_IS_OK(status)) {
1390                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1391                                           nt_errstr(status)));
1392                                 goto err_exit;
1393                         }
1394                 } else if (NT_STATUS_EQUAL(status,
1395                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1396                         DEBUG(10, ("More auth legs required.\n"));
1397                 } else {
1398                         DEBUG(0, ("Auth step returned an error (%s)\n",
1399                                   nt_errstr(status)));
1400                         goto err_exit;
1401                 }
1402         }
1403
1404         ZERO_STRUCT(u.alter_resp);
1405         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1406         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1407         u.alter_resp.assoc_group_id = assoc_gid;
1408
1409         /* secondary address CAN be NULL
1410          * as the specs say it's ignored.
1411          * It MUST be NULL to have the spoolss working.
1412          */
1413         u.alter_resp.secondary_address = "";
1414         u.alter_resp.secondary_address_size = 1;
1415
1416         u.alter_resp.num_results = 1;
1417         u.alter_resp.ctx_list = &bind_ack_ctx;
1418
1419         /* NOTE: We leave the auth_info empty so we can calculate the padding
1420          * later and then append the auth_info --simo */
1421
1422         /*
1423          * Marshall directly into the outgoing PDU space. We
1424          * must do this as we need to set to the bind response
1425          * header and are never sending more than one PDU here.
1426          */
1427
1428         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1429                                           DCERPC_PKT_ALTER_RESP,
1430                                           DCERPC_PFC_FLAG_FIRST |
1431                                                 DCERPC_PFC_FLAG_LAST,
1432                                           auth_resp.length,
1433                                           pkt->call_id,
1434                                           &u,
1435                                           &p->out_data.frag);
1436         if (!NT_STATUS_IS_OK(status)) {
1437                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1438                           nt_errstr(status)));
1439         }
1440
1441         if (auth_resp.length) {
1442
1443                 /* Work out any padding needed before the auth footer. */
1444                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1445                 if (pad_len) {
1446                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1447                         DEBUG(10, ("auth pad_len = %u\n",
1448                                    (unsigned int)pad_len));
1449                 }
1450
1451                 status = dcerpc_push_dcerpc_auth(pkt,
1452                                                  auth_info.auth_type,
1453                                                  auth_info.auth_level,
1454                                                  pad_len,
1455                                                  1, /* auth_context_id */
1456                                                  &auth_resp,
1457                                                  &auth_blob);
1458                 if (!NT_STATUS_IS_OK(status)) {
1459                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1460                         goto err_exit;
1461                 }
1462         }
1463
1464         /* Now that we have the auth len store it into the right place in
1465          * the dcerpc header */
1466         dcerpc_set_frag_length(&p->out_data.frag,
1467                                 p->out_data.frag.length +
1468                                         pad_len + auth_blob.length);
1469
1470         if (auth_resp.length) {
1471                 if (pad_len) {
1472                         char pad[SERVER_NDR_PADDING_SIZE];
1473                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1474                         if (!data_blob_append(p->mem_ctx,
1475                                                 &p->out_data.frag,
1476                                                 pad, pad_len)) {
1477                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1478                                           "%u bytes of pad data.\n",
1479                                           (unsigned int)pad_len));
1480                                 goto err_exit;
1481                         }
1482                 }
1483
1484                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1485                                         auth_blob.data, auth_blob.length)) {
1486                         DEBUG(0, ("Append of auth info failed.\n"));
1487                         goto err_exit;
1488                 }
1489         }
1490
1491         /*
1492          * Setup the lengths for the initial reply.
1493          */
1494
1495         p->out_data.data_sent_length = 0;
1496         p->out_data.current_pdu_sent = 0;
1497
1498         TALLOC_FREE(auth_blob.data);
1499         return True;
1500
1501   err_exit:
1502
1503         data_blob_free(&p->out_data.frag);
1504         TALLOC_FREE(auth_blob.data);
1505         return setup_bind_nak(p, pkt);
1506 }
1507
1508 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1509                        const struct api_struct *api_rpc_cmds, int n_cmds,
1510                        const struct ndr_syntax_id *syntax);
1511
1512 /****************************************************************************
1513  Find the correct RPC function to call for this request.
1514  If the pipe is authenticated then become the correct UNIX user
1515  before doing the call.
1516 ****************************************************************************/
1517
1518 static bool api_pipe_request(struct pipes_struct *p,
1519                                 struct ncacn_packet *pkt)
1520 {
1521         bool ret = False;
1522         struct pipe_rpc_fns *pipe_fns;
1523
1524         if (!p->pipe_bound) {
1525                 DEBUG(1, ("Pipe not bound!\n"));
1526                 data_blob_free(&p->out_data.rdata);
1527                 return false;
1528         }
1529
1530         if (!become_authenticated_pipe_user(p->session_info)) {
1531                 DEBUG(1, ("Failed to become pipe user!\n"));
1532                 data_blob_free(&p->out_data.rdata);
1533                 return false;
1534         }
1535
1536         /* get the set of RPC functions for this context */
1537
1538         pipe_fns = find_pipe_fns_by_context(p->contexts,
1539                                             pkt->u.request.context_id);
1540
1541         if ( pipe_fns ) {
1542                 TALLOC_CTX *frame = talloc_stackframe();
1543
1544                 DEBUG(5, ("Requested %s rpc service\n",
1545                           get_pipe_name_from_syntax(talloc_tos(), &pipe_fns->syntax)));
1546
1547                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds,
1548                                  &pipe_fns->syntax);
1549
1550                 TALLOC_FREE(frame);
1551         }
1552         else {
1553                 DEBUG(0, ("No rpc function table associated with context "
1554                           "[%d]\n",
1555                           pkt->u.request.context_id));
1556         }
1557
1558         unbecome_authenticated_pipe_user();
1559
1560         return ret;
1561 }
1562
1563 /*******************************************************************
1564  Calls the underlying RPC function for a named pipe.
1565  ********************************************************************/
1566
1567 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1568                        const struct api_struct *api_rpc_cmds, int n_cmds,
1569                        const struct ndr_syntax_id *syntax)
1570 {
1571         int fn_num;
1572         uint32_t offset1;
1573
1574         /* interpret the command */
1575         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1576                  get_pipe_name_from_syntax(talloc_tos(), syntax),
1577                  pkt->u.request.opnum));
1578
1579         if (DEBUGLEVEL >= 50) {
1580                 fstring name;
1581                 slprintf(name, sizeof(name)-1, "in_%s",
1582                          get_pipe_name_from_syntax(talloc_tos(), syntax));
1583                 dump_pdu_region(name, pkt->u.request.opnum,
1584                                 &p->in_data.data, 0,
1585                                 p->in_data.data.length);
1586         }
1587
1588         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1589                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1590                     api_rpc_cmds[fn_num].fn != NULL) {
1591                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1592                                   api_rpc_cmds[fn_num].name));
1593                         break;
1594                 }
1595         }
1596
1597         if (fn_num == n_cmds) {
1598                 /*
1599                  * For an unknown RPC just return a fault PDU but
1600                  * return True to allow RPC's on the pipe to continue
1601                  * and not put the pipe into fault state. JRA.
1602                  */
1603                 DEBUG(4, ("unknown\n"));
1604                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1605                 return True;
1606         }
1607
1608         offset1 = p->out_data.rdata.length;
1609
1610         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1611                 fn_num, api_rpc_cmds[fn_num].fn));
1612         /* do the actual command */
1613         if(!api_rpc_cmds[fn_num].fn(p)) {
1614                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1615                          get_pipe_name_from_syntax(talloc_tos(), syntax),
1616                          api_rpc_cmds[fn_num].name));
1617                 data_blob_free(&p->out_data.rdata);
1618                 return False;
1619         }
1620
1621         if (p->bad_handle_fault_state) {
1622                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1623                 p->bad_handle_fault_state = False;
1624                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
1625                 return True;
1626         }
1627
1628         if (p->rng_fault_state) {
1629                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
1630                 p->rng_fault_state = False;
1631                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1632                 return True;
1633         }
1634
1635         if (DEBUGLEVEL >= 50) {
1636                 fstring name;
1637                 slprintf(name, sizeof(name)-1, "out_%s",
1638                          get_pipe_name_from_syntax(talloc_tos(), syntax));
1639                 dump_pdu_region(name, pkt->u.request.opnum,
1640                                 &p->out_data.rdata, offset1,
1641                                 p->out_data.rdata.length);
1642         }
1643
1644         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1645                  get_pipe_name_from_syntax(talloc_tos(), syntax)));
1646
1647         /* Check for buffer underflow in rpc parsing */
1648         if ((DEBUGLEVEL >= 10) &&
1649             (pkt->frag_length < p->in_data.data.length)) {
1650                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1651                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1652                               p->in_data.data.length - pkt->frag_length);
1653         }
1654
1655         return True;
1656 }
1657
1658 /****************************************************************************
1659  Initialise an outgoing packet.
1660 ****************************************************************************/
1661
1662 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1663 {
1664         output_data *o_data = &p->out_data;
1665
1666         /* Reset the offset counters. */
1667         o_data->data_sent_length = 0;
1668         o_data->current_pdu_sent = 0;
1669
1670         data_blob_free(&o_data->frag);
1671
1672         /* Free any memory in the current return data buffer. */
1673         data_blob_free(&o_data->rdata);
1674
1675         return True;
1676 }
1677
1678 /****************************************************************************
1679  Sets the fault state on incoming packets.
1680 ****************************************************************************/
1681
1682 void set_incoming_fault(struct pipes_struct *p)
1683 {
1684         data_blob_free(&p->in_data.data);
1685         p->in_data.pdu_needed_len = 0;
1686         p->in_data.pdu.length = 0;
1687         p->fault_state = True;
1688
1689         DEBUG(10, ("Setting fault state\n"));
1690 }
1691
1692 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1693                                     struct ncacn_packet *pkt,
1694                                     DATA_BLOB *raw_pkt)
1695 {
1696         NTSTATUS status;
1697         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1698         size_t pad_len;
1699
1700         DEBUG(10, ("Checking request auth.\n"));
1701
1702         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1703                 hdr_size += 16;
1704         }
1705
1706         /* in case of sealing this function will unseal the data in place */
1707         status = dcerpc_check_auth(auth, pkt,
1708                                    &pkt->u.request.stub_and_verifier,
1709                                    hdr_size, raw_pkt,
1710                                    &pad_len);
1711         if (!NT_STATUS_IS_OK(status)) {
1712                 return status;
1713         }
1714
1715
1716         /* remove padding and auth trailer,
1717          * this way the caller will get just the data */
1718         if (pkt->auth_length) {
1719                 size_t trail_len = pad_len
1720                                         + DCERPC_AUTH_TRAILER_LENGTH
1721                                         + pkt->auth_length;
1722                 if (pkt->u.request.stub_and_verifier.length < trail_len) {
1723                         return NT_STATUS_INFO_LENGTH_MISMATCH;
1724                 }
1725                 pkt->u.request.stub_and_verifier.length -= trail_len;
1726         }
1727
1728         return NT_STATUS_OK;
1729 }
1730
1731 /****************************************************************************
1732  Processes a request pdu. This will do auth processing if needed, and
1733  appends the data into the complete stream if the LAST flag is not set.
1734 ****************************************************************************/
1735
1736 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1737 {
1738         NTSTATUS status;
1739         DATA_BLOB data;
1740
1741         if (!p->pipe_bound) {
1742                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1743                 set_incoming_fault(p);
1744                 return False;
1745         }
1746
1747         /* Store the opnum */
1748         p->opnum = pkt->u.request.opnum;
1749
1750         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1751         if (!NT_STATUS_IS_OK(status)) {
1752                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1753                           nt_errstr(status)));
1754                 set_incoming_fault(p);
1755                 return false;
1756         }
1757
1758         data = pkt->u.request.stub_and_verifier;
1759
1760         /*
1761          * Check the data length doesn't go over the 15Mb limit.
1762          * increased after observing a bug in the Windows NT 4.0 SP6a
1763          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1764          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1765          */
1766
1767         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1768                 DEBUG(0, ("process_request_pdu: "
1769                           "rpc data buffer too large (%u) + (%u)\n",
1770                           (unsigned int)p->in_data.data.length,
1771                           (unsigned int)data.length));
1772                 set_incoming_fault(p);
1773                 return False;
1774         }
1775
1776         /*
1777          * Append the data portion into the buffer and return.
1778          */
1779
1780         if (data.length) {
1781                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1782                                           data.data, data.length)) {
1783                         DEBUG(0, ("Unable to append data size %u "
1784                                   "to parse buffer of size %u.\n",
1785                                   (unsigned int)data.length,
1786                                   (unsigned int)p->in_data.data.length));
1787                         set_incoming_fault(p);
1788                         return False;
1789                 }
1790         }
1791
1792         if (pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1793                 bool ret = False;
1794                 /*
1795                  * Ok - we finally have a complete RPC stream.
1796                  * Call the rpc command to process it.
1797                  */
1798
1799                 /*
1800                  * Process the complete data stream here.
1801                  */
1802                 if (pipe_init_outgoing_data(p)) {
1803                         ret = api_pipe_request(p, pkt);
1804                 }
1805
1806                 return ret;
1807         }
1808
1809         return True;
1810 }
1811
1812 /****************************************************************************
1813  Processes a finished PDU stored in p->in_data.pdu.
1814 ****************************************************************************/
1815
1816 void process_complete_pdu(struct pipes_struct *p)
1817 {
1818         struct ncacn_packet *pkt = NULL;
1819         NTSTATUS status;
1820         bool reply = False;
1821
1822         if(p->fault_state) {
1823                 DEBUG(10,("RPC connection in fault state.\n"));
1824                 goto done;
1825         }
1826
1827         pkt = talloc(p->mem_ctx, struct ncacn_packet);
1828         if (!pkt) {
1829                 DEBUG(0, ("Out of memory!\n"));
1830                 goto done;
1831         }
1832
1833         /*
1834          * Ensure we're using the corrent endianness for both the
1835          * RPC header flags and the raw data we will be reading from.
1836          */
1837         if (dcerpc_get_endian_flag(&p->in_data.pdu) & DCERPC_DREP_LE) {
1838                 p->endian = RPC_LITTLE_ENDIAN;
1839         } else {
1840                 p->endian = RPC_BIG_ENDIAN;
1841         }
1842         DEBUG(10, ("PDU is in %s Endian format!\n", p->endian?"Big":"Little"));
1843
1844         status = dcerpc_pull_ncacn_packet(pkt, &p->in_data.pdu,
1845                                           pkt, p->endian);
1846         if (!NT_STATUS_IS_OK(status)) {
1847                 DEBUG(0, ("Failed to unmarshal rpc packet: %s!\n",
1848                           nt_errstr(status)));
1849                 goto done;
1850         }
1851
1852         /* Store the call_id */
1853         p->call_id = pkt->call_id;
1854
1855         DEBUG(10, ("Processing packet type %u\n", (unsigned int)pkt->ptype));
1856
1857         switch (pkt->ptype) {
1858         case DCERPC_PKT_REQUEST:
1859                 reply = process_request_pdu(p, pkt);
1860                 break;
1861
1862         case DCERPC_PKT_PING: /* CL request - ignore... */
1863                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1864                           (unsigned int)pkt->ptype));
1865                 break;
1866
1867         case DCERPC_PKT_RESPONSE: /* No responses here. */
1868                 DEBUG(0, ("Error - DCERPC_PKT_RESPONSE received from client"));
1869                 break;
1870
1871         case DCERPC_PKT_FAULT:
1872         case DCERPC_PKT_WORKING:
1873                 /* CL request - reply to a ping when a call in process. */
1874         case DCERPC_PKT_NOCALL:
1875                 /* CL - server reply to a ping call. */
1876         case DCERPC_PKT_REJECT:
1877         case DCERPC_PKT_ACK:
1878         case DCERPC_PKT_CL_CANCEL:
1879         case DCERPC_PKT_FACK:
1880         case DCERPC_PKT_CANCEL_ACK:
1881                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1882                           (unsigned int)pkt->ptype));
1883                 break;
1884
1885         case DCERPC_PKT_BIND:
1886                 /*
1887                  * We assume that a pipe bind is only in one pdu.
1888                  */
1889                 if (pipe_init_outgoing_data(p)) {
1890                         reply = api_pipe_bind_req(p, pkt);
1891                 }
1892                 break;
1893
1894         case DCERPC_PKT_BIND_ACK:
1895         case DCERPC_PKT_BIND_NAK:
1896                 DEBUG(0, ("Error - DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1897                           "packet type %u received.\n",
1898                           (unsigned int)pkt->ptype));
1899                 break;
1900
1901
1902         case DCERPC_PKT_ALTER:
1903                 /*
1904                  * We assume that a pipe bind is only in one pdu.
1905                  */
1906                 if (pipe_init_outgoing_data(p)) {
1907                         reply = api_pipe_alter_context(p, pkt);
1908                 }
1909                 break;
1910
1911         case DCERPC_PKT_ALTER_RESP:
1912                 DEBUG(0, ("Error - DCERPC_PKT_ALTER_RESP received: "
1913                           "Should only be server -> client.\n"));
1914                 break;
1915
1916         case DCERPC_PKT_AUTH3:
1917                 /*
1918                  * The third packet in an auth exchange.
1919                  */
1920                 if (pipe_init_outgoing_data(p)) {
1921                         reply = api_pipe_bind_auth3(p, pkt);
1922                 }
1923                 break;
1924
1925         case DCERPC_PKT_SHUTDOWN:
1926                 DEBUG(0, ("Error - DCERPC_PKT_SHUTDOWN received: "
1927                           "Should only be server -> client.\n"));
1928                 break;
1929
1930         case DCERPC_PKT_CO_CANCEL:
1931                 /* For now just free all client data and continue
1932                  * processing. */
1933                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1934                          " Abandoning rpc call.\n"));
1935                 /* As we never do asynchronous RPC serving, we can
1936                  * never cancel a call (as far as I know).
1937                  * If we ever did we'd have to send a cancel_ack reply.
1938                  * For now, just free all client data and continue
1939                  * processing. */
1940                 reply = True;
1941                 break;
1942
1943 #if 0
1944                 /* Enable this if we're doing async rpc. */
1945                 /* We must check the outstanding callid matches. */
1946                 if (pipe_init_outgoing_data(p)) {
1947                         /* Send a cancel_ack PDU reply. */
1948                         /* We should probably check the auth-verifier here. */
1949                         reply = setup_cancel_ack_reply(p, pkt);
1950                 }
1951                 break;
1952 #endif
1953
1954         case DCERPC_PKT_ORPHANED:
1955                 /* We should probably check the auth-verifier here.
1956                  * For now just free all client data and continue
1957                  * processing. */
1958                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
1959                           " Abandoning rpc call.\n"));
1960                 reply = True;
1961                 break;
1962
1963         default:
1964                 DEBUG(0, ("process_complete_pdu: "
1965                           "Unknown rpc type = %u received.\n",
1966                           (unsigned int)pkt->ptype));
1967                 break;
1968         }
1969
1970 done:
1971         if (!reply) {
1972                 DEBUG(3,("DCE/RPC fault sent!"));
1973                 set_incoming_fault(p);
1974                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1975                 TALLOC_FREE(pkt);
1976         } else {
1977                 /*
1978                  * Reset the lengths. We're ready for a new pdu.
1979                  */
1980                 TALLOC_FREE(p->in_data.pdu.data);
1981                 p->in_data.pdu_needed_len = 0;
1982                 p->in_data.pdu.length = 0;
1983         }
1984
1985         TALLOC_FREE(pkt);
1986 }
1987