source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "system/filesys.h"
  32 #include "srv_pipe_internal.h"
  33 #include "../librpc/gen_ndr/ndr_schannel.h"
  34 #include "../libcli/auth/schannel.h"
  35 #include "../libcli/auth/spnego.h"
  36 #include "dcesrv_auth_generic.h"
  37 #include "dcesrv_gssapi.h"
  38 #include "dcesrv_spnego.h"
  39 #include "rpc_server.h"
  40 #include "rpc_dce.h"
  41 #include "smbd/smbd.h"
  42 #include "auth.h"
  43 #include "ntdomain.h"
  44 #include "rpc_server/srv_pipe.h"
  45 #include "rpc_server/rpc_contexts.h"
  46 #include "lib/param/param.h"
  47
  48 #undef DBGC_CLASS
  49 #define DBGC_CLASS DBGC_RPC_SRV
  50
  51 /**
  52  * Dump everything from the start of the end up of the provided data
  53  * into a file, but only at debug level >= 50
  54  **/
  55 static void dump_pdu_region(const char *name, int v,
  56                             DATA_BLOB *data, size_t start, size_t end)
  57 {
  58         int fd, i;
  59         char *fname = NULL;
  60         ssize_t sz;
  61
  62         if (DEBUGLEVEL < 50) return;
  63
  64         if (start > data->length || end > data->length || start > end) return;
  65
  66         for (i = 1; i < 100; i++) {
  67                 if (v != -1) {
  68                         fname = talloc_asprintf(talloc_tos(),
  69                                                 "/tmp/%s_%d.%d.prs",
  70                                                 name, v, i);
  71                 } else {
  72                         fname = talloc_asprintf(talloc_tos(),
  73                                                 "/tmp/%s_%d.prs",
  74                                                 name, i);
  75                 }
  76                 if (!fname) {
  77                         return;
  78                 }
  79                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  80                 if (fd != -1 || errno != EEXIST) break;
  81         }
  82         if (fd != -1) {
  83                 sz = write(fd, data->data + start, end - start);
  84                 i = close(fd);
  85                 if ((sz != end - start) || (i != 0) ) {
  86                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  87                                   fname, (unsigned long)sz,
  88                                   (unsigned long)end - start, i));
  89                 } else {
  90                         DEBUG(0,("created %s\n", fname));
  91                 }
  92         }
  93         TALLOC_FREE(fname);
  94 }
  95
  96 static DATA_BLOB generic_session_key(void)
  97 {
  98         return data_blob_const("SystemLibraryDTC", 16);
  99 }
 100
 101 /*******************************************************************
 102  Generate the next PDU to be returned from the data.
 103 ********************************************************************/
 104
 105 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
 106                                    struct pipe_auth_data *auth,
 107                                    uint32_t call_id,
 108                                    DATA_BLOB *rdata,
 109                                    size_t data_sent_length,
 110                                    DATA_BLOB *frag,
 111                                    size_t *pdu_size)
 112 {
 113         union dcerpc_payload u;
 114         uint8_t pfc_flags;
 115         size_t data_left;
 116         size_t data_to_send;
 117         size_t frag_len;
 118         size_t pad_len = 0;
 119         size_t auth_len = 0;
 120         NTSTATUS status;
 121
 122         ZERO_STRUCT(u.response);
 123
 124         /* Set up rpc packet pfc flags. */
 125         if (data_sent_length == 0) {
 126                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 127         } else {
 128                 pfc_flags = 0;
 129         }
 130
 131         /* Work out how much we can fit in a single PDU. */
 132         data_left = rdata->length - data_sent_length;
 133
 134         /* Ensure there really is data left to send. */
 135         if (!data_left) {
 136                 DEBUG(0, ("No data left to send !\n"));
 137                 return NT_STATUS_BUFFER_TOO_SMALL;
 138         }
 139
 140         status = dcerpc_guess_sizes(auth,
 141                                     DCERPC_RESPONSE_LENGTH,
 142                                     data_left,
 143                                     RPC_MAX_PDU_FRAG_LEN,
 144                                     SERVER_NDR_PADDING_SIZE,
 145                                     &data_to_send, &frag_len,
 146                                     &auth_len, &pad_len);
 147         if (!NT_STATUS_IS_OK(status)) {
 148                 return status;
 149         }
 150
 151         /* Set up the alloc hint. This should be the data left to send. */
 152         u.response.alloc_hint = data_left;
 153
 154         /* Work out if this PDU will be the last. */
 155         if (data_sent_length + data_to_send >= rdata->length) {
 156                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 157         }
 158
 159         /* Prepare data to be NDR encoded. */
 160         u.response.stub_and_verifier =
 161                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 162
 163         /* Store the packet in the data stream. */
 164         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 165                                           pfc_flags, auth_len, call_id,
 166                                           &u, frag);
 167         if (!NT_STATUS_IS_OK(status)) {
 168                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 169                 return status;
 170         }
 171
 172         if (auth_len) {
 173                 /* Set the proper length on the pdu, including padding.
 174                  * Only needed if an auth trailer will be appended. */
 175                 dcerpc_set_frag_length(frag, frag->length
 176                                                 + pad_len
 177                                                 + DCERPC_AUTH_TRAILER_LENGTH
 178                                                 + auth_len);
 179         }
 180
 181         if (auth_len) {
 182                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 183                 if (!NT_STATUS_IS_OK(status)) {
 184                         data_blob_free(frag);
 185                         return status;
 186                 }
 187         }
 188
 189         *pdu_size = data_to_send;
 190         return NT_STATUS_OK;
 191 }
 192
 193 /*******************************************************************
 194  Generate the next PDU to be returned from the data in p->rdata.
 195 ********************************************************************/
 196
 197 bool create_next_pdu(struct pipes_struct *p)
 198 {
 199         size_t pdu_size = 0;
 200         NTSTATUS status;
 201
 202         /*
 203          * If we're in the fault state, keep returning fault PDU's until
 204          * the pipe gets closed. JRA.
 205          */
 206         if (p->fault_state) {
 207                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 208                 return true;
 209         }
 210
 211         status = create_next_packet(p->mem_ctx, &p->auth,
 212                                     p->call_id, &p->out_data.rdata,
 213                                     p->out_data.data_sent_length,
 214                                     &p->out_data.frag, &pdu_size);
 215         if (!NT_STATUS_IS_OK(status)) {
 216                 DEBUG(0, ("Failed to create packet with error %s, "
 217                           "(auth level %u / type %u)\n",
 218                           nt_errstr(status),
 219                           (unsigned int)p->auth.auth_level,
 220                           (unsigned int)p->auth.auth_type));
 221                 return false;
 222         }
 223
 224         /* Setup the counts for this PDU. */
 225         p->out_data.data_sent_length += pdu_size;
 226         p->out_data.current_pdu_sent = 0;
 227         return true;
 228 }
 229
 230
 231 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 232
 233 /*******************************************************************
 234  Marshall a bind_nak pdu.
 235 *******************************************************************/
 236
 237 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 238 {
 239         NTSTATUS status;
 240         union dcerpc_payload u;
 241
 242         /* Free any memory in the current return data buffer. */
 243         pipe_init_outgoing_data(p);
 244
 245         /*
 246          * Initialize a bind_nak header.
 247          */
 248
 249         ZERO_STRUCT(u);
 250
 251         u.bind_nak.reject_reason  = 0;
 252
 253         /*
 254          * Marshall directly into the outgoing PDU space. We
 255          * must do this as we need to set to the bind response
 256          * header and are never sending more than one PDU here.
 257          */
 258
 259         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 260                                           DCERPC_PKT_BIND_NAK,
 261                                           DCERPC_PFC_FLAG_FIRST |
 262                                                 DCERPC_PFC_FLAG_LAST,
 263                                           0,
 264                                           pkt->call_id,
 265                                           &u,
 266                                           &p->out_data.frag);
 267         if (!NT_STATUS_IS_OK(status)) {
 268                 return False;
 269         }
 270
 271         p->out_data.data_sent_length = 0;
 272         p->out_data.current_pdu_sent = 0;
 273
 274         TALLOC_FREE(p->auth.auth_ctx);
 275         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 276         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 277         p->pipe_bound = False;
 278
 279         return True;
 280 }
 281
 282 /*******************************************************************
 283  Marshall a fault pdu.
 284 *******************************************************************/
 285
 286 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 287 {
 288         NTSTATUS status;
 289         union dcerpc_payload u;
 290
 291         /* Free any memory in the current return data buffer. */
 292         pipe_init_outgoing_data(p);
 293
 294         /*
 295          * Initialize a fault header.
 296          */
 297
 298         ZERO_STRUCT(u);
 299
 300         u.fault.status          = NT_STATUS_V(fault_status);
 301         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 302
 303         /*
 304          * Marshall directly into the outgoing PDU space. We
 305          * must do this as we need to set to the bind response
 306          * header and are never sending more than one PDU here.
 307          */
 308
 309         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 310                                           DCERPC_PKT_FAULT,
 311                                           DCERPC_PFC_FLAG_FIRST |
 312                                            DCERPC_PFC_FLAG_LAST |
 313                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 314                                           0,
 315                                           p->call_id,
 316                                           &u,
 317                                           &p->out_data.frag);
 318         if (!NT_STATUS_IS_OK(status)) {
 319                 return False;
 320         }
 321
 322         p->out_data.data_sent_length = 0;
 323         p->out_data.current_pdu_sent = 0;
 324
 325         return True;
 326 }
 327
 328 /*******************************************************************
 329  Ensure a bind request has the correct abstract & transfer interface.
 330  Used to reject unknown binds from Win2k.
 331 *******************************************************************/
 332
 333 static bool check_bind_req(struct pipes_struct *p,
 334                            struct ndr_syntax_id* abstract,
 335                            struct ndr_syntax_id* transfer,
 336                            uint32_t context_id)
 337 {
 338         struct pipe_rpc_fns *context_fns;
 339         bool ok;
 340
 341         DEBUG(3,("check_bind_req for %s\n",
 342                  get_pipe_name_from_syntax(talloc_tos(), abstract)));
 343
 344         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 345         if (rpc_srv_pipe_exists_by_id(abstract) &&
 346            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 347                 DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
 348                           rpc_srv_get_pipe_cli_name(abstract),
 349                           rpc_srv_get_pipe_srv_name(abstract)));
 350         } else {
 351                 return false;
 352         }
 353
 354         ok = init_pipe_handles(p, abstract);
 355         if (!ok) {
 356                 DEBUG(1, ("Failed to init pipe handles!\n"));
 357                 return false;
 358         }
 359
 360         context_fns = talloc(p, struct pipe_rpc_fns);
 361         if (context_fns == NULL) {
 362                 DEBUG(0,("check_bind_req: talloc() failed!\n"));
 363                 return false;
 364         }
 365
 366         context_fns->next = context_fns->prev = NULL;
 367         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 368         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 369         context_fns->context_id = context_id;
 370         context_fns->syntax = *abstract;
 371
 372         /* add to the list of open contexts */
 373
 374         DLIST_ADD( p->contexts, context_fns );
 375
 376         return True;
 377 }
 378
 379 /**
 380  * Is a named pipe known?
 381  * @param[in] cli_filename      The pipe name requested by the client
 382  * @result                      Do we want to serve this?
 383  */
 384 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
 385 {
 386         const char *pipename = cli_filename;
 387         NTSTATUS status;
 388
 389         if (strnequal(pipename, "\\PIPE\\", 6)) {
 390                 pipename += 5;
 391         }
 392
 393         if (*pipename == '\\') {
 394                 pipename += 1;
 395         }
 396
 397         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 398                 DEBUG(10, ("refusing spoolss access\n"));
 399                 return false;
 400         }
 401
 402         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 403                 return true;
 404         }
 405
 406         status = smb_probe_module("rpc", pipename);
 407         if (!NT_STATUS_IS_OK(status)) {
 408                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
 409                 return false;
 410         }
 411         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 412
 413         /*
 414          * Scan the list again for the interface id
 415          */
 416         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 417                 return true;
 418         }
 419
 420         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 421                    pipename));
 422
 423         return false;
 424 }
 425
 426 /*******************************************************************
 427  Handle the first part of a SPNEGO bind auth.
 428 *******************************************************************/
 429
 430 static bool pipe_spnego_auth_bind(struct pipes_struct *p,
 431                                   TALLOC_CTX *mem_ctx,
 432                                   struct dcerpc_auth *auth_info,
 433                                   DATA_BLOB *response)
 434 {
 435         struct spnego_context *spnego_ctx;
 436         NTSTATUS status;
 437
 438         status = spnego_server_auth_start(p,
 439                                           (auth_info->auth_level ==
 440                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 441                                           (auth_info->auth_level ==
 442                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 443                                           true,
 444                                           &auth_info->credentials,
 445                                           response,
 446                                           p->remote_address,
 447                                           &spnego_ctx);
 448         if (!NT_STATUS_IS_OK(status)) {
 449                 DEBUG(0, ("Failed SPNEGO negotiate (%s)\n",
 450                           nt_errstr(status)));
 451                 return false;
 452         }
 453
 454         /* Make sure data is bound to the memctx, to be freed the caller */
 455         talloc_steal(mem_ctx, response->data);
 456
 457         p->auth.auth_ctx = spnego_ctx;
 458         p->auth.auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 459
 460         DEBUG(10, ("SPNEGO auth started\n"));
 461
 462         return true;
 463 }
 464
 465 /*******************************************************************
 466  Handle an schannel bind auth.
 467 *******************************************************************/
 468
 469 static bool pipe_schannel_auth_bind(struct pipes_struct *p,
 470                                     TALLOC_CTX *mem_ctx,
 471                                     struct dcerpc_auth *auth_info,
 472                                     DATA_BLOB *response)
 473 {
 474         struct NL_AUTH_MESSAGE neg;
 475         struct NL_AUTH_MESSAGE reply;
 476         bool ret;
 477         NTSTATUS status;
 478         struct netlogon_creds_CredentialState *creds;
 479         enum ndr_err_code ndr_err;
 480         struct schannel_state *schannel_auth;
 481         struct loadparm_context *lp_ctx;
 482
 483         ndr_err = ndr_pull_struct_blob(
 484                         &auth_info->credentials, mem_ctx, &neg,
 485                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
 486         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 487                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
 488                 return false;
 489         }
 490
 491         if (DEBUGLEVEL >= 10) {
 492                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
 493         }
 494
 495         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
 496                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
 497                 return false;
 498         }
 499
 500         lp_ctx = loadparm_init_s3(p, loadparm_s3_context());
 501         if (!lp_ctx) {
 502                 DEBUG(0,("pipe_schannel_auth_bind: loadparm_init_s3() failed!\n"));
 503                 return false;
 504         }
 505
 506         /*
 507          * The neg.oem_netbios_computer.a key here must match the remote computer name
 508          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
 509          * operations that use credentials.
 510          */
 511
 512         become_root();
 513         status = schannel_get_creds_state(p, lp_ctx,
 514                                             neg.oem_netbios_computer.a, &creds);
 515         unbecome_root();
 516
 517         talloc_unlink(p, lp_ctx);
 518         if (!NT_STATUS_IS_OK(status)) {
 519                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
 520                 return False;
 521         }
 522
 523         schannel_auth = talloc(p, struct schannel_state);
 524         if (!schannel_auth) {
 525                 TALLOC_FREE(creds);
 526                 return False;
 527         }
 528
 529         schannel_auth->state = SCHANNEL_STATE_START;
 530         schannel_auth->seq_num = 0;
 531         schannel_auth->initiator = false;
 532         schannel_auth->creds = creds;
 533
 534         /*
 535          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
 536          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
 537          * struct of the person who opened the pipe. I need to test this further. JRA.
 538          *
 539          * VL. As we are mapping this to guest set the generic key
 540          * "SystemLibraryDTC" key here. It's a bit difficult to test against
 541          * W2k3, as it does not allow schannel binds against SAMR and LSA
 542          * anymore.
 543          */
 544
 545         ret = session_info_set_session_key(p->session_info, generic_session_key());
 546
 547         if (!ret) {
 548                 DEBUG(0, ("session_info_set_session_key failed\n"));
 549                 return false;
 550         }
 551
 552         /*** SCHANNEL verifier ***/
 553
 554         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
 555         reply.Flags                             = 0;
 556         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
 557                                                       * this has any meaning
 558                                                       * here - gd */
 559
 560         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
 561                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 562         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 563                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
 564                 return false;
 565         }
 566
 567         if (DEBUGLEVEL >= 10) {
 568                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
 569         }
 570
 571         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
 572                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
 573
 574         /* We're finished with this bind - no more packets. */
 575         p->auth.auth_ctx = schannel_auth;
 576         p->auth.auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
 577
 578         p->pipe_bound = True;
 579
 580         return True;
 581 }
 582
 583 /*******************************************************************
 584  Handle an NTLMSSP bind auth.
 585 *******************************************************************/
 586
 587 static bool pipe_ntlmssp_auth_bind(struct pipes_struct *p,
 588                                    TALLOC_CTX *mem_ctx,
 589                                    struct dcerpc_auth *auth_info,
 590                                    DATA_BLOB *response)
 591 {
 592         struct gensec_security *gensec_security = NULL;
 593         NTSTATUS status;
 594
 595         if (strncmp((char *)auth_info->credentials.data, "NTLMSSP", 7) != 0) {
 596                 DEBUG(0, ("Failed to read NTLMSSP in blob\n"));
 597                 return false;
 598         }
 599
 600         /* We have an NTLMSSP blob. */
 601         status = auth_generic_server_start(p,
 602                                            OID_NTLMSSP,
 603                                            (auth_info->auth_level ==
 604                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 605                                            (auth_info->auth_level ==
 606                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 607                                            true,
 608                                            &auth_info->credentials,
 609                                            response,
 610                                            p->remote_address,
 611                                            &gensec_security);
 612         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 613                 DEBUG(0, (__location__ ": auth_ntlmssp_start failed: %s\n",
 614                           nt_errstr(status)));
 615                 return false;
 616         }
 617
 618         /* Make sure data is bound to the memctx, to be freed the caller */
 619         talloc_steal(mem_ctx, response->data);
 620
 621         p->auth.auth_ctx = gensec_security;
 622         p->auth.auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 623
 624         DEBUG(10, (__location__ ": NTLMSSP auth started\n"));
 625
 626         return true;
 627 }
 628
 629 /*******************************************************************
 630  Process an NTLMSSP authentication response.
 631  If this function succeeds, the user has been authenticated
 632  and their domain, name and calling workstation stored in
 633  the pipe struct.
 634 *******************************************************************/
 635
 636 static bool pipe_auth_generic_verify_final(TALLOC_CTX *mem_ctx,
 637                                 struct gensec_security *gensec_security,
 638                                 enum dcerpc_AuthLevel auth_level,
 639                                 struct auth_session_info **session_info)
 640 {
 641         NTSTATUS status;
 642         bool ret;
 643
 644         DEBUG(5, (__location__ ": checking user details\n"));
 645
 646         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 647            ensure the underlying NTLMSSP flags are also set. If not we should
 648            refuse the bind. */
 649
 650         status = auth_generic_server_check_flags(gensec_security,
 651                                             (auth_level ==
 652                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 653                                             (auth_level ==
 654                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 655         if (!NT_STATUS_IS_OK(status)) {
 656                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 657                           "security for rpc connection\n"));
 658                 return false;
 659         }
 660
 661         TALLOC_FREE(*session_info);
 662
 663         status = auth_generic_server_get_user_info(gensec_security,
 664                                                 mem_ctx, session_info);
 665         if (!NT_STATUS_IS_OK(status)) {
 666                 DEBUG(0, (__location__ ": failed to obtain the server info "
 667                           "for authenticated user: %s\n", nt_errstr(status)));
 668                 return false;
 669         }
 670
 671         if ((*session_info)->security_token == NULL) {
 672                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 673                 return false;
 674         }
 675
 676         /*
 677          * We're an authenticated bind over smb, so the session key needs to
 678          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 679          * does. See the RPC-SAMBA3SESSIONKEY.
 680          */
 681
 682         ret = session_info_set_session_key((*session_info), generic_session_key());
 683         if (!ret) {
 684                 DEBUG(0, ("Failed to set session key!\n"));
 685                 return false;
 686         }
 687
 688         return true;
 689 }
 690
 691 /*******************************************************************
 692  Handle a GSSAPI bind auth.
 693 *******************************************************************/
 694
 695 static bool pipe_gssapi_auth_bind(struct pipes_struct *p,
 696                                   TALLOC_CTX *mem_ctx,
 697                                   struct dcerpc_auth *auth_info,
 698                                   DATA_BLOB *response)
 699 {
 700         NTSTATUS status;
 701         struct gse_context *gse_ctx = NULL;
 702
 703         status = gssapi_server_auth_start(p,
 704                                           (auth_info->auth_level ==
 705                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 706                                           (auth_info->auth_level ==
 707                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 708                                           true,
 709                                           &auth_info->credentials,
 710                                           response,
 711                                           &gse_ctx);
 712         if (!NT_STATUS_IS_OK(status)) {
 713                 DEBUG(0, ("Failed to init dcerpc gssapi server (%s)\n",
 714                           nt_errstr(status)));
 715                 goto err;
 716         }
 717
 718         /* Make sure data is bound to the memctx, to be freed the caller */
 719         talloc_steal(mem_ctx, response->data);
 720
 721         p->auth.auth_ctx = gse_ctx;
 722         p->auth.auth_type = DCERPC_AUTH_TYPE_KRB5;
 723
 724         DEBUG(10, ("KRB5 auth started\n"));
 725
 726         return true;
 727
 728 err:
 729         TALLOC_FREE(gse_ctx);
 730         return false;
 731 }
 732
 733 static NTSTATUS pipe_gssapi_verify_final(TALLOC_CTX *mem_ctx,
 734                                          struct gse_context *gse_ctx,
 735                                          const struct tsocket_address *remote_address,
 736                                          struct auth_session_info **session_info)
 737 {
 738         NTSTATUS status;
 739         bool bret;
 740
 741         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 742            ensure the underlying flags are also set. If not we should
 743            refuse the bind. */
 744
 745         status = gssapi_server_check_flags(gse_ctx);
 746         if (!NT_STATUS_IS_OK(status)) {
 747                 DEBUG(0, ("Requested Security Layers not honored!\n"));
 748                 return status;
 749         }
 750
 751         status = gssapi_server_get_user_info(gse_ctx, mem_ctx,
 752                                              remote_address, session_info);
 753         if (!NT_STATUS_IS_OK(status)) {
 754                 DEBUG(0, (__location__ ": failed to obtain the server info "
 755                           "for authenticated user: %s\n", nt_errstr(status)));
 756                 return status;
 757         }
 758
 759         /*
 760          * We're an authenticated bind over smb, so the session key needs to
 761          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 762          * does. See the RPC-SAMBA3SESSIONKEY.
 763          */
 764
 765         bret = session_info_set_session_key((*session_info), generic_session_key());
 766         if (!bret) {
 767                 return NT_STATUS_ACCESS_DENIED;
 768         }
 769
 770         return NT_STATUS_OK;
 771 }
 772
 773 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 774 {
 775         enum spnego_mech auth_type;
 776         struct gensec_security *gensec_security;
 777         struct spnego_context *spnego_ctx;
 778         struct gse_context *gse_ctx;
 779         void *mech_ctx;
 780         NTSTATUS status;
 781
 782         switch (p->auth.auth_type) {
 783         case DCERPC_AUTH_TYPE_NTLMSSP:
 784                 gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
 785                                                         struct gensec_security);
 786                 if (!pipe_auth_generic_verify_final(p, gensec_security,
 787                                                 p->auth.auth_level,
 788                                                 &p->session_info)) {
 789                         return NT_STATUS_ACCESS_DENIED;
 790                 }
 791                 break;
 792         case DCERPC_AUTH_TYPE_KRB5:
 793                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 794                                                 struct gse_context);
 795                 status = pipe_gssapi_verify_final(p, gse_ctx,
 796                                                   p->remote_address,
 797                                                   &p->session_info);
 798                 if (!NT_STATUS_IS_OK(status)) {
 799                         DEBUG(1, ("gssapi bind failed with: %s",
 800                                   nt_errstr(status)));
 801                         return status;
 802                 }
 803                 break;
 804         case DCERPC_AUTH_TYPE_SPNEGO:
 805                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 806                                                    struct spnego_context);
 807                 status = spnego_get_negotiated_mech(spnego_ctx,
 808                                                     &auth_type, &mech_ctx);
 809                 if (!NT_STATUS_IS_OK(status)) {
 810                         DEBUG(0, ("Bad SPNEGO state (%s)\n",
 811                                   nt_errstr(status)));
 812                         return status;
 813                 }
 814                 switch(auth_type) {
 815                 case SPNEGO_KRB5:
 816                         gse_ctx = talloc_get_type_abort(mech_ctx,
 817                                                         struct gse_context);
 818                         status = pipe_gssapi_verify_final(p, gse_ctx,
 819                                                           p->remote_address,
 820                                                           &p->session_info);
 821                         if (!NT_STATUS_IS_OK(status)) {
 822                                 DEBUG(1, ("gssapi bind failed with: %s",
 823                                           nt_errstr(status)));
 824                                 return status;
 825                         }
 826                         break;
 827                 case SPNEGO_NTLMSSP:
 828                         gensec_security = talloc_get_type_abort(mech_ctx,
 829                                                 struct gensec_security);
 830                         if (!pipe_auth_generic_verify_final(p, gensec_security,
 831                                                         p->auth.auth_level,
 832                                                         &p->session_info)) {
 833                                 return NT_STATUS_ACCESS_DENIED;
 834                         }
 835                         break;
 836                 default:
 837                         DEBUG(0, (__location__ ": incorrect spnego type "
 838                                   "(%d).\n", auth_type));
 839                         return NT_STATUS_ACCESS_DENIED;
 840                 }
 841                 break;
 842         default:
 843                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
 844                           (unsigned int)p->auth.auth_type));
 845                 return NT_STATUS_ACCESS_DENIED;
 846         }
 847
 848         p->pipe_bound = true;
 849
 850         return NT_STATUS_OK;
 851 }
 852
 853 /*******************************************************************
 854  Respond to a pipe bind request.
 855 *******************************************************************/
 856
 857 static bool api_pipe_bind_req(struct pipes_struct *p,
 858                                 struct ncacn_packet *pkt)
 859 {
 860         struct dcerpc_auth auth_info;
 861         uint16 assoc_gid;
 862         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
 863         NTSTATUS status;
 864         struct ndr_syntax_id id;
 865         union dcerpc_payload u;
 866         struct dcerpc_ack_ctx bind_ack_ctx;
 867         DATA_BLOB auth_resp = data_blob_null;
 868         DATA_BLOB auth_blob = data_blob_null;
 869
 870         /* No rebinds on a bound pipe - use alter context. */
 871         if (p->pipe_bound) {
 872                 DEBUG(2,("Rejecting bind request on bound rpc connection\n"));
 873                 return setup_bind_nak(p, pkt);
 874         }
 875
 876         if (pkt->u.bind.num_contexts == 0) {
 877                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
 878                 goto err_exit;
 879         }
 880
 881         /*
 882          * Try and find the correct pipe name to ensure
 883          * that this is a pipe name we support.
 884          */
 885         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 886         if (rpc_srv_pipe_exists_by_id(&id)) {
 887                 DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 888                           rpc_srv_get_pipe_cli_name(&id),
 889                           rpc_srv_get_pipe_srv_name(&id)));
 890         } else {
 891                 status = smb_probe_module(
 892                         "rpc", get_pipe_name_from_syntax(
 893                                 talloc_tos(),
 894                                 &id));
 895
 896                 if (NT_STATUS_IS_ERR(status)) {
 897                         DEBUG(3,("api_pipe_bind_req: Unknown rpc service name "
 898                                  "%s in bind request.\n",
 899                                  get_pipe_name_from_syntax(talloc_tos(), &id)));
 900
 901                         return setup_bind_nak(p, pkt);
 902                 }
 903
 904                 if (rpc_srv_get_pipe_interface_by_cli_name(
 905                                 get_pipe_name_from_syntax(talloc_tos(),
 906                                                           &id),
 907                                 &id)) {
 908                         DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 909                                   rpc_srv_get_pipe_cli_name(&id),
 910                                   rpc_srv_get_pipe_srv_name(&id)));
 911                 } else {
 912                         DEBUG(0, ("module %s doesn't provide functions for "
 913                                   "pipe %s!\n",
 914                                   get_pipe_name_from_syntax(talloc_tos(), &id),
 915                                   get_pipe_name_from_syntax(talloc_tos(), &id)));
 916                         return setup_bind_nak(p, pkt);
 917                 }
 918         }
 919
 920         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 921
 922         if (pkt->u.bind.assoc_group_id != 0) {
 923                 assoc_gid = pkt->u.bind.assoc_group_id;
 924         } else {
 925                 assoc_gid = 0x53f0;
 926         }
 927
 928         /*
 929          * Create the bind response struct.
 930          */
 931
 932         /* If the requested abstract synt uuid doesn't match our client pipe,
 933                 reject the bind_ack & set the transfer interface synt to all 0's,
 934                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 935                 unknown to NT4)
 936                 Needed when adding entries to a DACL from NT5 - SK */
 937
 938         if (check_bind_req(p,
 939                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 940                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 941                         pkt->u.bind.ctx_list[0].context_id)) {
 942
 943                 bind_ack_ctx.result = 0;
 944                 bind_ack_ctx.reason = 0;
 945                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 946         } else {
 947                 p->pipe_bound = False;
 948                 /* Rejection reason: abstract syntax not supported */
 949                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 950                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
 951                 bind_ack_ctx.syntax = null_ndr_syntax_id;
 952         }
 953
 954         /*
 955          * Check if this is an authenticated bind request.
 956          */
 957         if (pkt->auth_length) {
 958                 /* Quick length check. Won't catch a bad auth footer,
 959                  * prevents overrun. */
 960
 961                 if (pkt->frag_length < RPC_HEADER_LEN +
 962                                         DCERPC_AUTH_TRAILER_LENGTH +
 963                                         pkt->auth_length) {
 964                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
 965                                 "too long for fragment %u.\n",
 966                                 (unsigned int)pkt->auth_length,
 967                                 (unsigned int)pkt->frag_length));
 968                         goto err_exit;
 969                 }
 970
 971                 /*
 972                  * Decode the authentication verifier.
 973                  */
 974                 status = dcerpc_pull_dcerpc_auth(pkt,
 975                                                  &pkt->u.bind.auth_info,
 976                                                  &auth_info, p->endian);
 977                 if (!NT_STATUS_IS_OK(status)) {
 978                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
 979                         goto err_exit;
 980                 }
 981
 982                 auth_type = auth_info.auth_type;
 983
 984                 /* Work out if we have to sign or seal etc. */
 985                 switch (auth_info.auth_level) {
 986                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 987                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 988                         break;
 989                 case DCERPC_AUTH_LEVEL_PRIVACY:
 990                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 991                         break;
 992                 case DCERPC_AUTH_LEVEL_CONNECT:
 993                         p->auth.auth_level = DCERPC_AUTH_LEVEL_CONNECT;
 994                         break;
 995                 default:
 996                         DEBUG(0, ("Unexpected auth level (%u).\n",
 997                                 (unsigned int)auth_info.auth_level ));
 998                         goto err_exit;
 999                 }
1000
1001                 switch (auth_type) {
1002                 case DCERPC_AUTH_TYPE_NTLMSSP:
1003                         if (!pipe_ntlmssp_auth_bind(p, pkt,
1004                                                 &auth_info, &auth_resp)) {
1005                                 goto err_exit;
1006                         }
1007                         assoc_gid = 0x7a77;
1008                         break;
1009
1010                 case DCERPC_AUTH_TYPE_SCHANNEL:
1011                         if (!pipe_schannel_auth_bind(p, pkt,
1012                                                 &auth_info, &auth_resp)) {
1013                                 goto err_exit;
1014                         }
1015                         break;
1016
1017                 case DCERPC_AUTH_TYPE_SPNEGO:
1018                         if (!pipe_spnego_auth_bind(p, pkt,
1019                                                 &auth_info, &auth_resp)) {
1020                                 goto err_exit;
1021                         }
1022                         break;
1023
1024                 case DCERPC_AUTH_TYPE_KRB5:
1025                         if (!pipe_gssapi_auth_bind(p, pkt,
1026                                                 &auth_info, &auth_resp)) {
1027                                 goto err_exit;
1028                         }
1029                         break;
1030
1031                 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1032                         if (p->transport == NCALRPC && p->ncalrpc_as_system) {
1033                                 TALLOC_FREE(p->session_info);
1034
1035                                 status = make_session_info_system(p,
1036                                                                   &p->session_info);
1037                                 if (!NT_STATUS_IS_OK(status)) {
1038                                         goto err_exit;
1039                                 }
1040
1041                                 auth_resp = data_blob_talloc(pkt,
1042                                                              "NCALRPC_AUTH_OK",
1043                                                              15);
1044
1045                                 p->auth.auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
1046                                 p->pipe_bound = true;
1047                         } else {
1048                                 goto err_exit;
1049                         }
1050                         break;
1051
1052                 case DCERPC_AUTH_TYPE_NONE:
1053                         break;
1054
1055                 default:
1056                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
1057                         goto err_exit;
1058                 }
1059         }
1060
1061         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
1062                 /* Unauthenticated bind request. */
1063                 /* We're finished - no more packets. */
1064                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
1065                 /* We must set the pipe auth_level here also. */
1066                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1067                 p->pipe_bound = True;
1068                 /* The session key was initialized from the SMB
1069                  * session in make_internal_rpc_pipe_p */
1070         }
1071
1072         ZERO_STRUCT(u.bind_ack);
1073         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1074         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1075         u.bind_ack.assoc_group_id = assoc_gid;
1076
1077         /* name has to be \PIPE\xxxxx */
1078         u.bind_ack.secondary_address =
1079                         talloc_asprintf(pkt, "\\PIPE\\%s",
1080                                         rpc_srv_get_pipe_srv_name(&id));
1081         if (!u.bind_ack.secondary_address) {
1082                 DEBUG(0, ("Out of memory!\n"));
1083                 goto err_exit;
1084         }
1085         u.bind_ack.secondary_address_size =
1086                                 strlen(u.bind_ack.secondary_address) + 1;
1087
1088         u.bind_ack.num_results = 1;
1089         u.bind_ack.ctx_list = &bind_ack_ctx;
1090
1091         /* NOTE: We leave the auth_info empty so we can calculate the padding
1092          * later and then append the auth_info --simo */
1093
1094         /*
1095          * Marshall directly into the outgoing PDU space. We
1096          * must do this as we need to set to the bind response
1097          * header and are never sending more than one PDU here.
1098          */
1099
1100         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1101                                           DCERPC_PKT_BIND_ACK,
1102                                           DCERPC_PFC_FLAG_FIRST |
1103                                                 DCERPC_PFC_FLAG_LAST,
1104                                           auth_resp.length,
1105                                           pkt->call_id,
1106                                           &u,
1107                                           &p->out_data.frag);
1108         if (!NT_STATUS_IS_OK(status)) {
1109                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1110                           nt_errstr(status)));
1111         }
1112
1113         if (auth_resp.length) {
1114
1115                 status = dcerpc_push_dcerpc_auth(pkt,
1116                                                  auth_type,
1117                                                  auth_info.auth_level,
1118                                                  0,
1119                                                  1, /* auth_context_id */
1120                                                  &auth_resp,
1121                                                  &auth_blob);
1122                 if (!NT_STATUS_IS_OK(status)) {
1123                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1124                         goto err_exit;
1125                 }
1126         }
1127
1128         /* Now that we have the auth len store it into the right place in
1129          * the dcerpc header */
1130         dcerpc_set_frag_length(&p->out_data.frag,
1131                                 p->out_data.frag.length + auth_blob.length);
1132
1133         if (auth_blob.length) {
1134
1135                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1136                                         auth_blob.data, auth_blob.length)) {
1137                         DEBUG(0, ("Append of auth info failed.\n"));
1138                         goto err_exit;
1139                 }
1140         }
1141
1142         /*
1143          * Setup the lengths for the initial reply.
1144          */
1145
1146         p->out_data.data_sent_length = 0;
1147         p->out_data.current_pdu_sent = 0;
1148
1149         TALLOC_FREE(auth_blob.data);
1150         return True;
1151
1152   err_exit:
1153
1154         data_blob_free(&p->out_data.frag);
1155         TALLOC_FREE(auth_blob.data);
1156         return setup_bind_nak(p, pkt);
1157 }
1158
1159 /*******************************************************************
1160  This is the "stage3" response after a bind request and reply.
1161 *******************************************************************/
1162
1163 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
1164 {
1165         struct dcerpc_auth auth_info;
1166         DATA_BLOB response = data_blob_null;
1167         struct gensec_security *gensec_security;
1168         struct spnego_context *spnego_ctx;
1169         struct gse_context *gse_ctx;
1170         NTSTATUS status;
1171
1172         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
1173
1174         if (pkt->auth_length == 0) {
1175                 DEBUG(0, ("No auth field sent for bind request!\n"));
1176                 goto err;
1177         }
1178
1179         /* Ensure there's enough data for an authenticated request. */
1180         if (pkt->frag_length < RPC_HEADER_LEN
1181                                 + DCERPC_AUTH_TRAILER_LENGTH
1182                                 + pkt->auth_length) {
1183                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
1184                                 "%u is too large.\n",
1185                         (unsigned int)pkt->auth_length));
1186                 goto err;
1187         }
1188
1189         /*
1190          * Decode the authentication verifier response.
1191          */
1192
1193         status = dcerpc_pull_dcerpc_auth(pkt,
1194                                          &pkt->u.auth3.auth_info,
1195                                          &auth_info, p->endian);
1196         if (!NT_STATUS_IS_OK(status)) {
1197                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
1198                 goto err;
1199         }
1200
1201         /* We must NEVER look at auth_info->auth_pad_len here,
1202          * as old Samba client code gets it wrong and sends it
1203          * as zero. JRA.
1204          */
1205
1206         if (auth_info.auth_type != p->auth.auth_type) {
1207                 DEBUG(0, ("Auth type mismatch! Client sent %d, "
1208                           "but auth was started as type %d!\n",
1209                           auth_info.auth_type, p->auth.auth_type));
1210                 goto err;
1211         }
1212
1213         switch (auth_info.auth_type) {
1214         case DCERPC_AUTH_TYPE_NTLMSSP:
1215                 gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
1216                                                     struct gensec_security);
1217                 status = auth_generic_server_step(gensec_security,
1218                                              pkt, &auth_info.credentials,
1219                                              &response);
1220                 break;
1221         case DCERPC_AUTH_TYPE_KRB5:
1222                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1223                                                 struct gse_context);
1224                 status = gssapi_server_step(gse_ctx,
1225                                             pkt, &auth_info.credentials,
1226                                             &response);
1227                 break;
1228         case DCERPC_AUTH_TYPE_SPNEGO:
1229                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1230                                                    struct spnego_context);
1231                 status = spnego_server_step(spnego_ctx,
1232                                             pkt, &auth_info.credentials,
1233                                             &response);
1234                 break;
1235         default:
1236                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
1237                           (unsigned int)auth_info.auth_type));
1238                 return false;
1239         }
1240
1241         if (NT_STATUS_EQUAL(status,
1242                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1243             response.length) {
1244                 DEBUG(0, (__location__ ": This was supposed to be the final "
1245                           "leg, but crypto machinery claims a response is "
1246                           "needed, aborting auth!\n"));
1247                 data_blob_free(&response);
1248                 goto err;
1249         }
1250         if (!NT_STATUS_IS_OK(status)) {
1251                 DEBUG(0, ("Auth failed (%s)\n", nt_errstr(status)));
1252                 goto err;
1253         }
1254
1255         /* Now verify auth was indeed successful and extract server info */
1256         status = pipe_auth_verify_final(p);
1257         if (!NT_STATUS_IS_OK(status)) {
1258                 DEBUG(0, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1259                 goto err;
1260         }
1261
1262         return true;
1263
1264 err:
1265
1266         TALLOC_FREE(p->auth.auth_ctx);
1267         return false;
1268 }
1269
1270 /****************************************************************************
1271  Deal with an alter context call. Can be third part of 3 leg auth request for
1272  SPNEGO calls.
1273 ****************************************************************************/
1274
1275 static bool api_pipe_alter_context(struct pipes_struct *p,
1276                                         struct ncacn_packet *pkt)
1277 {
1278         struct dcerpc_auth auth_info;
1279         uint16 assoc_gid;
1280         NTSTATUS status;
1281         union dcerpc_payload u;
1282         struct dcerpc_ack_ctx bind_ack_ctx;
1283         DATA_BLOB auth_resp = data_blob_null;
1284         DATA_BLOB auth_blob = data_blob_null;
1285         int pad_len = 0;
1286         struct gensec_security *gensec_security;
1287         struct spnego_context *spnego_ctx;
1288         struct gse_context *gse_ctx;
1289
1290         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1291
1292         if (pkt->u.bind.assoc_group_id != 0) {
1293                 assoc_gid = pkt->u.bind.assoc_group_id;
1294         } else {
1295                 assoc_gid = 0x53f0;
1296         }
1297
1298         /*
1299          * Create the bind response struct.
1300          */
1301
1302         /* If the requested abstract synt uuid doesn't match our client pipe,
1303                 reject the bind_ack & set the transfer interface synt to all 0's,
1304                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1305                 unknown to NT4)
1306                 Needed when adding entries to a DACL from NT5 - SK */
1307
1308         if (check_bind_req(p,
1309                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1310                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1311                         pkt->u.bind.ctx_list[0].context_id)) {
1312
1313                 bind_ack_ctx.result = 0;
1314                 bind_ack_ctx.reason = 0;
1315                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1316         } else {
1317                 p->pipe_bound = False;
1318                 /* Rejection reason: abstract syntax not supported */
1319                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1320                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1321                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1322         }
1323
1324         /*
1325          * Check if this is an authenticated alter context request.
1326          */
1327         if (pkt->auth_length) {
1328                 /* Quick length check. Won't catch a bad auth footer,
1329                  * prevents overrun. */
1330
1331                 if (pkt->frag_length < RPC_HEADER_LEN +
1332                                         DCERPC_AUTH_TRAILER_LENGTH +
1333                                         pkt->auth_length) {
1334                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1335                                 "too long for fragment %u.\n",
1336                                 (unsigned int)pkt->auth_length,
1337                                 (unsigned int)pkt->frag_length ));
1338                         goto err_exit;
1339                 }
1340
1341                 status = dcerpc_pull_dcerpc_auth(pkt,
1342                                                  &pkt->u.bind.auth_info,
1343                                                  &auth_info, p->endian);
1344                 if (!NT_STATUS_IS_OK(status)) {
1345                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1346                         goto err_exit;
1347                 }
1348
1349                 /* We can only finish if the pipe is unbound for now */
1350                 if (p->pipe_bound) {
1351                         DEBUG(0, (__location__ ": Pipe already bound, "
1352                                   "Altering Context not yet supported!\n"));
1353                         goto err_exit;
1354                 }
1355
1356                 if (auth_info.auth_type != p->auth.auth_type) {
1357                         DEBUG(0, ("Auth type mismatch! Client sent %d, "
1358                                   "but auth was started as type %d!\n",
1359                                   auth_info.auth_type, p->auth.auth_type));
1360                         goto err_exit;
1361                 }
1362
1363
1364                 switch (auth_info.auth_type) {
1365                 case DCERPC_AUTH_TYPE_SPNEGO:
1366                         spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1367                                                         struct spnego_context);
1368                         status = spnego_server_step(spnego_ctx,
1369                                                     pkt,
1370                                                     &auth_info.credentials,
1371                                                     &auth_resp);
1372                         break;
1373
1374                 case DCERPC_AUTH_TYPE_KRB5:
1375                         gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1376                                                         struct gse_context);
1377                         status = gssapi_server_step(gse_ctx,
1378                                                     pkt,
1379                                                     &auth_info.credentials,
1380                                                     &auth_resp);
1381                         break;
1382                 case DCERPC_AUTH_TYPE_NTLMSSP:
1383                         gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
1384                                                     struct gensec_security);
1385                         status = auth_generic_server_step(gensec_security,
1386                                                      pkt,
1387                                                      &auth_info.credentials,
1388                                                      &auth_resp);
1389                         break;
1390
1391                 default:
1392                         DEBUG(3, (__location__ ": Usupported auth type (%d) "
1393                                   "in alter-context call\n",
1394                                   auth_info.auth_type));
1395                         goto err_exit;
1396                 }
1397
1398                 if (NT_STATUS_IS_OK(status)) {
1399                         /* third leg of auth, verify auth info */
1400                         status = pipe_auth_verify_final(p);
1401                         if (!NT_STATUS_IS_OK(status)) {
1402                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1403                                           nt_errstr(status)));
1404                                 goto err_exit;
1405                         }
1406                 } else if (NT_STATUS_EQUAL(status,
1407                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1408                         DEBUG(10, ("More auth legs required.\n"));
1409                 } else {
1410                         DEBUG(0, ("Auth step returned an error (%s)\n",
1411                                   nt_errstr(status)));
1412                         goto err_exit;
1413                 }
1414         }
1415
1416         ZERO_STRUCT(u.alter_resp);
1417         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1418         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1419         u.alter_resp.assoc_group_id = assoc_gid;
1420
1421         /* secondary address CAN be NULL
1422          * as the specs say it's ignored.
1423          * It MUST be NULL to have the spoolss working.
1424          */
1425         u.alter_resp.secondary_address = "";
1426         u.alter_resp.secondary_address_size = 1;
1427
1428         u.alter_resp.num_results = 1;
1429         u.alter_resp.ctx_list = &bind_ack_ctx;
1430
1431         /* NOTE: We leave the auth_info empty so we can calculate the padding
1432          * later and then append the auth_info --simo */
1433
1434         /*
1435          * Marshall directly into the outgoing PDU space. We
1436          * must do this as we need to set to the bind response
1437          * header and are never sending more than one PDU here.
1438          */
1439
1440         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1441                                           DCERPC_PKT_ALTER_RESP,
1442                                           DCERPC_PFC_FLAG_FIRST |
1443                                                 DCERPC_PFC_FLAG_LAST,
1444                                           auth_resp.length,
1445                                           pkt->call_id,
1446                                           &u,
1447                                           &p->out_data.frag);
1448         if (!NT_STATUS_IS_OK(status)) {
1449                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1450                           nt_errstr(status)));
1451         }
1452
1453         if (auth_resp.length) {
1454
1455                 /* Work out any padding needed before the auth footer. */
1456                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1457                 if (pad_len) {
1458                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1459                         DEBUG(10, ("auth pad_len = %u\n",
1460                                    (unsigned int)pad_len));
1461                 }
1462
1463                 status = dcerpc_push_dcerpc_auth(pkt,
1464                                                  auth_info.auth_type,
1465                                                  auth_info.auth_level,
1466                                                  pad_len,
1467                                                  1, /* auth_context_id */
1468                                                  &auth_resp,
1469                                                  &auth_blob);
1470                 if (!NT_STATUS_IS_OK(status)) {
1471                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1472                         goto err_exit;
1473                 }
1474         }
1475
1476         /* Now that we have the auth len store it into the right place in
1477          * the dcerpc header */
1478         dcerpc_set_frag_length(&p->out_data.frag,
1479                                 p->out_data.frag.length +
1480                                         pad_len + auth_blob.length);
1481
1482         if (auth_resp.length) {
1483                 if (pad_len) {
1484                         char pad[SERVER_NDR_PADDING_SIZE];
1485                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1486                         if (!data_blob_append(p->mem_ctx,
1487                                                 &p->out_data.frag,
1488                                                 pad, pad_len)) {
1489                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1490                                           "%u bytes of pad data.\n",
1491                                           (unsigned int)pad_len));
1492                                 goto err_exit;
1493                         }
1494                 }
1495
1496                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1497                                         auth_blob.data, auth_blob.length)) {
1498                         DEBUG(0, ("Append of auth info failed.\n"));
1499                         goto err_exit;
1500                 }
1501         }
1502
1503         /*
1504          * Setup the lengths for the initial reply.
1505          */
1506
1507         p->out_data.data_sent_length = 0;
1508         p->out_data.current_pdu_sent = 0;
1509
1510         TALLOC_FREE(auth_blob.data);
1511         return True;
1512
1513   err_exit:
1514
1515         data_blob_free(&p->out_data.frag);
1516         TALLOC_FREE(auth_blob.data);
1517         return setup_bind_nak(p, pkt);
1518 }
1519
1520 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1521                        const struct api_struct *api_rpc_cmds, int n_cmds,
1522                        const struct ndr_syntax_id *syntax);
1523
1524 /****************************************************************************
1525  Find the correct RPC function to call for this request.
1526  If the pipe is authenticated then become the correct UNIX user
1527  before doing the call.
1528 ****************************************************************************/
1529
1530 static bool api_pipe_request(struct pipes_struct *p,
1531                                 struct ncacn_packet *pkt)
1532 {
1533         bool ret = False;
1534         struct pipe_rpc_fns *pipe_fns;
1535
1536         if (!p->pipe_bound) {
1537                 DEBUG(1, ("Pipe not bound!\n"));
1538                 data_blob_free(&p->out_data.rdata);
1539                 return false;
1540         }
1541
1542         if (!become_authenticated_pipe_user(p->session_info)) {
1543                 DEBUG(1, ("Failed to become pipe user!\n"));
1544                 data_blob_free(&p->out_data.rdata);
1545                 return false;
1546         }
1547
1548         /* get the set of RPC functions for this context */
1549
1550         pipe_fns = find_pipe_fns_by_context(p->contexts,
1551                                             pkt->u.request.context_id);
1552
1553         if ( pipe_fns ) {
1554                 TALLOC_CTX *frame = talloc_stackframe();
1555
1556                 DEBUG(5, ("Requested %s rpc service\n",
1557                           get_pipe_name_from_syntax(talloc_tos(), &pipe_fns->syntax)));
1558
1559                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds,
1560                                  &pipe_fns->syntax);
1561
1562                 TALLOC_FREE(frame);
1563         }
1564         else {
1565                 DEBUG(0, ("No rpc function table associated with context "
1566                           "[%d]\n",
1567                           pkt->u.request.context_id));
1568         }
1569
1570         unbecome_authenticated_pipe_user();
1571
1572         return ret;
1573 }
1574
1575 /*******************************************************************
1576  Calls the underlying RPC function for a named pipe.
1577  ********************************************************************/
1578
1579 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1580                        const struct api_struct *api_rpc_cmds, int n_cmds,
1581                        const struct ndr_syntax_id *syntax)
1582 {
1583         int fn_num;
1584         uint32_t offset1;
1585
1586         /* interpret the command */
1587         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1588                  get_pipe_name_from_syntax(talloc_tos(), syntax),
1589                  pkt->u.request.opnum));
1590
1591         if (DEBUGLEVEL >= 50) {
1592                 fstring name;
1593                 slprintf(name, sizeof(name)-1, "in_%s",
1594                          get_pipe_name_from_syntax(talloc_tos(), syntax));
1595                 dump_pdu_region(name, pkt->u.request.opnum,
1596                                 &p->in_data.data, 0,
1597                                 p->in_data.data.length);
1598         }
1599
1600         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1601                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1602                     api_rpc_cmds[fn_num].fn != NULL) {
1603                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1604                                   api_rpc_cmds[fn_num].name));
1605                         break;
1606                 }
1607         }
1608
1609         if (fn_num == n_cmds) {
1610                 /*
1611                  * For an unknown RPC just return a fault PDU but
1612                  * return True to allow RPC's on the pipe to continue
1613                  * and not put the pipe into fault state. JRA.
1614                  */
1615                 DEBUG(4, ("unknown\n"));
1616                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1617                 return True;
1618         }
1619
1620         offset1 = p->out_data.rdata.length;
1621
1622         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1623                 fn_num, api_rpc_cmds[fn_num].fn));
1624         /* do the actual command */
1625         if(!api_rpc_cmds[fn_num].fn(p)) {
1626                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1627                          get_pipe_name_from_syntax(talloc_tos(), syntax),
1628                          api_rpc_cmds[fn_num].name));
1629                 data_blob_free(&p->out_data.rdata);
1630                 return False;
1631         }
1632
1633         if (p->bad_handle_fault_state) {
1634                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1635                 p->bad_handle_fault_state = False;
1636                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
1637                 return True;
1638         }
1639
1640         if (p->rng_fault_state) {
1641                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
1642                 p->rng_fault_state = False;
1643                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1644                 return True;
1645         }
1646
1647         if (DEBUGLEVEL >= 50) {
1648                 fstring name;
1649                 slprintf(name, sizeof(name)-1, "out_%s",
1650                          get_pipe_name_from_syntax(talloc_tos(), syntax));
1651                 dump_pdu_region(name, pkt->u.request.opnum,
1652                                 &p->out_data.rdata, offset1,
1653                                 p->out_data.rdata.length);
1654         }
1655
1656         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1657                  get_pipe_name_from_syntax(talloc_tos(), syntax)));
1658
1659         /* Check for buffer underflow in rpc parsing */
1660         if ((DEBUGLEVEL >= 10) &&
1661             (pkt->frag_length < p->in_data.data.length)) {
1662                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1663                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1664                               p->in_data.data.length - pkt->frag_length);
1665         }
1666
1667         return True;
1668 }
1669
1670 /****************************************************************************
1671  Initialise an outgoing packet.
1672 ****************************************************************************/
1673
1674 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1675 {
1676         output_data *o_data = &p->out_data;
1677
1678         /* Reset the offset counters. */
1679         o_data->data_sent_length = 0;
1680         o_data->current_pdu_sent = 0;
1681
1682         data_blob_free(&o_data->frag);
1683
1684         /* Free any memory in the current return data buffer. */
1685         data_blob_free(&o_data->rdata);
1686
1687         return True;
1688 }
1689
1690 /****************************************************************************
1691  Sets the fault state on incoming packets.
1692 ****************************************************************************/
1693
1694 void set_incoming_fault(struct pipes_struct *p)
1695 {
1696         data_blob_free(&p->in_data.data);
1697         p->in_data.pdu_needed_len = 0;
1698         p->in_data.pdu.length = 0;
1699         p->fault_state = True;
1700
1701         DEBUG(10, ("Setting fault state\n"));
1702 }
1703
1704 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1705                                     struct ncacn_packet *pkt,
1706                                     DATA_BLOB *raw_pkt)
1707 {
1708         NTSTATUS status;
1709         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1710         size_t pad_len;
1711
1712         DEBUG(10, ("Checking request auth.\n"));
1713
1714         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1715                 hdr_size += 16;
1716         }
1717
1718         /* in case of sealing this function will unseal the data in place */
1719         status = dcerpc_check_auth(auth, pkt,
1720                                    &pkt->u.request.stub_and_verifier,
1721                                    hdr_size, raw_pkt,
1722                                    &pad_len);
1723         if (!NT_STATUS_IS_OK(status)) {
1724                 return status;
1725         }
1726
1727
1728         /* remove padding and auth trailer,
1729          * this way the caller will get just the data */
1730         if (pkt->auth_length) {
1731                 size_t trail_len = pad_len
1732                                         + DCERPC_AUTH_TRAILER_LENGTH
1733                                         + pkt->auth_length;
1734                 if (pkt->u.request.stub_and_verifier.length < trail_len) {
1735                         return NT_STATUS_INFO_LENGTH_MISMATCH;
1736                 }
1737                 pkt->u.request.stub_and_verifier.length -= trail_len;
1738         }
1739
1740         return NT_STATUS_OK;
1741 }
1742
1743 /****************************************************************************
1744  Processes a request pdu. This will do auth processing if needed, and
1745  appends the data into the complete stream if the LAST flag is not set.
1746 ****************************************************************************/
1747
1748 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1749 {
1750         NTSTATUS status;
1751         DATA_BLOB data;
1752
1753         if (!p->pipe_bound) {
1754                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1755                 set_incoming_fault(p);
1756                 return False;
1757         }
1758
1759         /* Store the opnum */
1760         p->opnum = pkt->u.request.opnum;
1761
1762         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1763         if (!NT_STATUS_IS_OK(status)) {
1764                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1765                           nt_errstr(status)));
1766                 set_incoming_fault(p);
1767                 return false;
1768         }
1769
1770         data = pkt->u.request.stub_and_verifier;
1771
1772         /*
1773          * Check the data length doesn't go over the 15Mb limit.
1774          * increased after observing a bug in the Windows NT 4.0 SP6a
1775          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1776          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1777          */
1778
1779         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1780                 DEBUG(0, ("process_request_pdu: "
1781                           "rpc data buffer too large (%u) + (%u)\n",
1782                           (unsigned int)p->in_data.data.length,
1783                           (unsigned int)data.length));
1784                 set_incoming_fault(p);
1785                 return False;
1786         }
1787
1788         /*
1789          * Append the data portion into the buffer and return.
1790          */
1791
1792         if (data.length) {
1793                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1794                                           data.data, data.length)) {
1795                         DEBUG(0, ("Unable to append data size %u "
1796                                   "to parse buffer of size %u.\n",
1797                                   (unsigned int)data.length,
1798                                   (unsigned int)p->in_data.data.length));
1799                         set_incoming_fault(p);
1800                         return False;
1801                 }
1802         }
1803
1804         if (pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1805                 bool ret = False;
1806                 /*
1807                  * Ok - we finally have a complete RPC stream.
1808                  * Call the rpc command to process it.
1809                  */
1810
1811                 /*
1812                  * Process the complete data stream here.
1813                  */
1814                 if (pipe_init_outgoing_data(p)) {
1815                         ret = api_pipe_request(p, pkt);
1816                 }
1817
1818                 return ret;
1819         }
1820
1821         return True;
1822 }
1823
1824 /****************************************************************************
1825  Processes a finished PDU stored in p->in_data.pdu.
1826 ****************************************************************************/
1827
1828 void process_complete_pdu(struct pipes_struct *p)
1829 {
1830         struct ncacn_packet *pkt = NULL;
1831         NTSTATUS status;
1832         bool reply = False;
1833
1834         if(p->fault_state) {
1835                 DEBUG(10,("RPC connection in fault state.\n"));
1836                 goto done;
1837         }
1838
1839         pkt = talloc(p->mem_ctx, struct ncacn_packet);
1840         if (!pkt) {
1841                 DEBUG(0, ("Out of memory!\n"));
1842                 goto done;
1843         }
1844
1845         /*
1846          * Ensure we're using the corrent endianness for both the
1847          * RPC header flags and the raw data we will be reading from.
1848          */
1849         if (dcerpc_get_endian_flag(&p->in_data.pdu) & DCERPC_DREP_LE) {
1850                 p->endian = RPC_LITTLE_ENDIAN;
1851         } else {
1852                 p->endian = RPC_BIG_ENDIAN;
1853         }
1854         DEBUG(10, ("PDU is in %s Endian format!\n", p->endian?"Big":"Little"));
1855
1856         status = dcerpc_pull_ncacn_packet(pkt, &p->in_data.pdu,
1857                                           pkt, p->endian);
1858         if (!NT_STATUS_IS_OK(status)) {
1859                 DEBUG(0, ("Failed to unmarshal rpc packet: %s!\n",
1860                           nt_errstr(status)));
1861                 goto done;
1862         }
1863
1864         /* Store the call_id */
1865         p->call_id = pkt->call_id;
1866
1867         DEBUG(10, ("Processing packet type %u\n", (unsigned int)pkt->ptype));
1868
1869         switch (pkt->ptype) {
1870         case DCERPC_PKT_REQUEST:
1871                 reply = process_request_pdu(p, pkt);
1872                 break;
1873
1874         case DCERPC_PKT_PING: /* CL request - ignore... */
1875                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1876                           (unsigned int)pkt->ptype));
1877                 break;
1878
1879         case DCERPC_PKT_RESPONSE: /* No responses here. */
1880                 DEBUG(0, ("Error - DCERPC_PKT_RESPONSE received from client"));
1881                 break;
1882
1883         case DCERPC_PKT_FAULT:
1884         case DCERPC_PKT_WORKING:
1885                 /* CL request - reply to a ping when a call in process. */
1886         case DCERPC_PKT_NOCALL:
1887                 /* CL - server reply to a ping call. */
1888         case DCERPC_PKT_REJECT:
1889         case DCERPC_PKT_ACK:
1890         case DCERPC_PKT_CL_CANCEL:
1891         case DCERPC_PKT_FACK:
1892         case DCERPC_PKT_CANCEL_ACK:
1893                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1894                           (unsigned int)pkt->ptype));
1895                 break;
1896
1897         case DCERPC_PKT_BIND:
1898                 /*
1899                  * We assume that a pipe bind is only in one pdu.
1900                  */
1901                 if (pipe_init_outgoing_data(p)) {
1902                         reply = api_pipe_bind_req(p, pkt);
1903                 }
1904                 break;
1905
1906         case DCERPC_PKT_BIND_ACK:
1907         case DCERPC_PKT_BIND_NAK:
1908                 DEBUG(0, ("Error - DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1909                           "packet type %u received.\n",
1910                           (unsigned int)pkt->ptype));
1911                 break;
1912
1913
1914         case DCERPC_PKT_ALTER:
1915                 /*
1916                  * We assume that a pipe bind is only in one pdu.
1917                  */
1918                 if (pipe_init_outgoing_data(p)) {
1919                         reply = api_pipe_alter_context(p, pkt);
1920                 }
1921                 break;
1922
1923         case DCERPC_PKT_ALTER_RESP:
1924                 DEBUG(0, ("Error - DCERPC_PKT_ALTER_RESP received: "
1925                           "Should only be server -> client.\n"));
1926                 break;
1927
1928         case DCERPC_PKT_AUTH3:
1929                 /*
1930                  * The third packet in an auth exchange.
1931                  */
1932                 if (pipe_init_outgoing_data(p)) {
1933                         reply = api_pipe_bind_auth3(p, pkt);
1934                 }
1935                 break;
1936
1937         case DCERPC_PKT_SHUTDOWN:
1938                 DEBUG(0, ("Error - DCERPC_PKT_SHUTDOWN received: "
1939                           "Should only be server -> client.\n"));
1940                 break;
1941
1942         case DCERPC_PKT_CO_CANCEL:
1943                 /* For now just free all client data and continue
1944                  * processing. */
1945                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1946                          " Abandoning rpc call.\n"));
1947                 /* As we never do asynchronous RPC serving, we can
1948                  * never cancel a call (as far as I know).
1949                  * If we ever did we'd have to send a cancel_ack reply.
1950                  * For now, just free all client data and continue
1951                  * processing. */
1952                 reply = True;
1953                 break;
1954
1955 #if 0
1956                 /* Enable this if we're doing async rpc. */
1957                 /* We must check the outstanding callid matches. */
1958                 if (pipe_init_outgoing_data(p)) {
1959                         /* Send a cancel_ack PDU reply. */
1960                         /* We should probably check the auth-verifier here. */
1961                         reply = setup_cancel_ack_reply(p, pkt);
1962                 }
1963                 break;
1964 #endif
1965
1966         case DCERPC_PKT_ORPHANED:
1967                 /* We should probably check the auth-verifier here.
1968                  * For now just free all client data and continue
1969                  * processing. */
1970                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
1971                           " Abandoning rpc call.\n"));
1972                 reply = True;
1973                 break;
1974
1975         default:
1976                 DEBUG(0, ("process_complete_pdu: "
1977                           "Unknown rpc type = %u received.\n",
1978                           (unsigned int)pkt->ptype));
1979                 break;
1980         }
1981
1982 done:
1983         if (!reply) {
1984                 DEBUG(3,("DCE/RPC fault sent!"));
1985                 set_incoming_fault(p);
1986                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1987                 TALLOC_FREE(pkt);
1988         } else {
1989                 /*
1990                  * Reset the lengths. We're ready for a new pdu.
1991                  */
1992                 TALLOC_FREE(p->in_data.pdu.data);
1993                 p->in_data.pdu_needed_len = 0;
1994                 p->in_data.pdu.length = 0;
1995         }
1996
1997         TALLOC_FREE(pkt);
1998 }
1999