source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "system/filesys.h"
  32 #include "srv_pipe_internal.h"
  33 #include "../librpc/gen_ndr/ndr_schannel.h"
  34 #include "../libcli/auth/schannel.h"
  35 #include "../libcli/auth/spnego.h"
  36 #include "dcesrv_ntlmssp.h"
  37 #include "dcesrv_gssapi.h"
  38 #include "dcesrv_spnego.h"
  39 #include "rpc_server.h"
  40 #include "rpc_dce.h"
  41 #include "smbd/smbd.h"
  42 #include "auth.h"
  43 #include "ntdomain.h"
  44 #include "rpc_server/srv_pipe.h"
  45 #include "rpc_server/rpc_contexts.h"
  46 #include "lib/param/param.h"
  47
  48 #undef DBGC_CLASS
  49 #define DBGC_CLASS DBGC_RPC_SRV
  50
  51 /**
  52  * Dump everything from the start of the end up of the provided data
  53  * into a file, but only at debug level >= 50
  54  **/
  55 static void dump_pdu_region(const char *name, int v,
  56                             DATA_BLOB *data, size_t start, size_t end)
  57 {
  58         int fd, i;
  59         char *fname = NULL;
  60         ssize_t sz;
  61
  62         if (DEBUGLEVEL < 50) return;
  63
  64         if (start > data->length || end > data->length || start > end) return;
  65
  66         for (i = 1; i < 100; i++) {
  67                 if (v != -1) {
  68                         fname = talloc_asprintf(talloc_tos(),
  69                                                 "/tmp/%s_%d.%d.prs",
  70                                                 name, v, i);
  71                 } else {
  72                         fname = talloc_asprintf(talloc_tos(),
  73                                                 "/tmp/%s_%d.prs",
  74                                                 name, i);
  75                 }
  76                 if (!fname) {
  77                         return;
  78                 }
  79                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  80                 if (fd != -1 || errno != EEXIST) break;
  81         }
  82         if (fd != -1) {
  83                 sz = write(fd, data->data + start, end - start);
  84                 i = close(fd);
  85                 if ((sz != end - start) || (i != 0) ) {
  86                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  87                                   fname, (unsigned long)sz,
  88                                   (unsigned long)end - start, i));
  89                 } else {
  90                         DEBUG(0,("created %s\n", fname));
  91                 }
  92         }
  93         TALLOC_FREE(fname);
  94 }
  95
  96 static DATA_BLOB generic_session_key(void)
  97 {
  98         return data_blob_const("SystemLibraryDTC", 16);
  99 }
 100
 101 /*******************************************************************
 102  Generate the next PDU to be returned from the data.
 103 ********************************************************************/
 104
 105 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
 106                                    struct pipe_auth_data *auth,
 107                                    uint32_t call_id,
 108                                    DATA_BLOB *rdata,
 109                                    size_t data_sent_length,
 110                                    DATA_BLOB *frag,
 111                                    size_t *pdu_size)
 112 {
 113         union dcerpc_payload u;
 114         uint8_t pfc_flags;
 115         size_t data_left;
 116         size_t data_to_send;
 117         size_t frag_len;
 118         size_t pad_len = 0;
 119         size_t auth_len = 0;
 120         NTSTATUS status;
 121
 122         ZERO_STRUCT(u.response);
 123
 124         /* Set up rpc packet pfc flags. */
 125         if (data_sent_length == 0) {
 126                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 127         } else {
 128                 pfc_flags = 0;
 129         }
 130
 131         /* Work out how much we can fit in a single PDU. */
 132         data_left = rdata->length - data_sent_length;
 133
 134         /* Ensure there really is data left to send. */
 135         if (!data_left) {
 136                 DEBUG(0, ("No data left to send !\n"));
 137                 return NT_STATUS_BUFFER_TOO_SMALL;
 138         }
 139
 140         status = dcerpc_guess_sizes(auth,
 141                                     DCERPC_RESPONSE_LENGTH,
 142                                     data_left,
 143                                     RPC_MAX_PDU_FRAG_LEN,
 144                                     SERVER_NDR_PADDING_SIZE,
 145                                     &data_to_send, &frag_len,
 146                                     &auth_len, &pad_len);
 147         if (!NT_STATUS_IS_OK(status)) {
 148                 return status;
 149         }
 150
 151         /* Set up the alloc hint. This should be the data left to send. */
 152         u.response.alloc_hint = data_left;
 153
 154         /* Work out if this PDU will be the last. */
 155         if (data_sent_length + data_to_send >= rdata->length) {
 156                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 157         }
 158
 159         /* Prepare data to be NDR encoded. */
 160         u.response.stub_and_verifier =
 161                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 162
 163         /* Store the packet in the data stream. */
 164         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 165                                           pfc_flags, auth_len, call_id,
 166                                           &u, frag);
 167         if (!NT_STATUS_IS_OK(status)) {
 168                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 169                 return status;
 170         }
 171
 172         if (auth_len) {
 173                 /* Set the proper length on the pdu, including padding.
 174                  * Only needed if an auth trailer will be appended. */
 175                 dcerpc_set_frag_length(frag, frag->length
 176                                                 + pad_len
 177                                                 + DCERPC_AUTH_TRAILER_LENGTH
 178                                                 + auth_len);
 179         }
 180
 181         if (auth_len) {
 182                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 183                 if (!NT_STATUS_IS_OK(status)) {
 184                         data_blob_free(frag);
 185                         return status;
 186                 }
 187         }
 188
 189         *pdu_size = data_to_send;
 190         return NT_STATUS_OK;
 191 }
 192
 193 /*******************************************************************
 194  Generate the next PDU to be returned from the data in p->rdata.
 195 ********************************************************************/
 196
 197 bool create_next_pdu(struct pipes_struct *p)
 198 {
 199         size_t pdu_size = 0;
 200         NTSTATUS status;
 201
 202         /*
 203          * If we're in the fault state, keep returning fault PDU's until
 204          * the pipe gets closed. JRA.
 205          */
 206         if (p->fault_state) {
 207                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 208                 return true;
 209         }
 210
 211         status = create_next_packet(p->mem_ctx, &p->auth,
 212                                     p->call_id, &p->out_data.rdata,
 213                                     p->out_data.data_sent_length,
 214                                     &p->out_data.frag, &pdu_size);
 215         if (!NT_STATUS_IS_OK(status)) {
 216                 DEBUG(0, ("Failed to create packet with error %s, "
 217                           "(auth level %u / type %u)\n",
 218                           nt_errstr(status),
 219                           (unsigned int)p->auth.auth_level,
 220                           (unsigned int)p->auth.auth_type));
 221                 return false;
 222         }
 223
 224         /* Setup the counts for this PDU. */
 225         p->out_data.data_sent_length += pdu_size;
 226         p->out_data.current_pdu_sent = 0;
 227         return true;
 228 }
 229
 230
 231 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 232
 233 /*******************************************************************
 234  Marshall a bind_nak pdu.
 235 *******************************************************************/
 236
 237 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 238 {
 239         NTSTATUS status;
 240         union dcerpc_payload u;
 241
 242         /* Free any memory in the current return data buffer. */
 243         pipe_init_outgoing_data(p);
 244
 245         /*
 246          * Initialize a bind_nak header.
 247          */
 248
 249         ZERO_STRUCT(u);
 250
 251         u.bind_nak.reject_reason  = 0;
 252
 253         /*
 254          * Marshall directly into the outgoing PDU space. We
 255          * must do this as we need to set to the bind response
 256          * header and are never sending more than one PDU here.
 257          */
 258
 259         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 260                                           DCERPC_PKT_BIND_NAK,
 261                                           DCERPC_PFC_FLAG_FIRST |
 262                                                 DCERPC_PFC_FLAG_LAST,
 263                                           0,
 264                                           pkt->call_id,
 265                                           &u,
 266                                           &p->out_data.frag);
 267         if (!NT_STATUS_IS_OK(status)) {
 268                 return False;
 269         }
 270
 271         p->out_data.data_sent_length = 0;
 272         p->out_data.current_pdu_sent = 0;
 273
 274         TALLOC_FREE(p->auth.auth_ctx);
 275         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 276         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 277         p->pipe_bound = False;
 278
 279         return True;
 280 }
 281
 282 /*******************************************************************
 283  Marshall a fault pdu.
 284 *******************************************************************/
 285
 286 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 287 {
 288         NTSTATUS status;
 289         union dcerpc_payload u;
 290
 291         /* Free any memory in the current return data buffer. */
 292         pipe_init_outgoing_data(p);
 293
 294         /*
 295          * Initialize a fault header.
 296          */
 297
 298         ZERO_STRUCT(u);
 299
 300         u.fault.status          = NT_STATUS_V(fault_status);
 301         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 302
 303         /*
 304          * Marshall directly into the outgoing PDU space. We
 305          * must do this as we need to set to the bind response
 306          * header and are never sending more than one PDU here.
 307          */
 308
 309         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 310                                           DCERPC_PKT_FAULT,
 311                                           DCERPC_PFC_FLAG_FIRST |
 312                                            DCERPC_PFC_FLAG_LAST |
 313                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 314                                           0,
 315                                           p->call_id,
 316                                           &u,
 317                                           &p->out_data.frag);
 318         if (!NT_STATUS_IS_OK(status)) {
 319                 return False;
 320         }
 321
 322         p->out_data.data_sent_length = 0;
 323         p->out_data.current_pdu_sent = 0;
 324
 325         return True;
 326 }
 327
 328 /*******************************************************************
 329  Ensure a bind request has the correct abstract & transfer interface.
 330  Used to reject unknown binds from Win2k.
 331 *******************************************************************/
 332
 333 static bool check_bind_req(struct pipes_struct *p,
 334                            struct ndr_syntax_id* abstract,
 335                            struct ndr_syntax_id* transfer,
 336                            uint32_t context_id)
 337 {
 338         struct pipe_rpc_fns *context_fns;
 339         bool ok;
 340
 341         DEBUG(3,("check_bind_req for %s\n",
 342                  get_pipe_name_from_syntax(talloc_tos(), abstract)));
 343
 344         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 345         if (rpc_srv_pipe_exists_by_id(abstract) &&
 346            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 347                 DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
 348                           rpc_srv_get_pipe_cli_name(abstract),
 349                           rpc_srv_get_pipe_srv_name(abstract)));
 350         } else {
 351                 return false;
 352         }
 353
 354         ok = init_pipe_handles(p, abstract);
 355         if (!ok) {
 356                 DEBUG(1, ("Failed to init pipe handles!\n"));
 357                 return false;
 358         }
 359
 360         context_fns = talloc(p, struct pipe_rpc_fns);
 361         if (context_fns == NULL) {
 362                 DEBUG(0,("check_bind_req: talloc() failed!\n"));
 363                 return false;
 364         }
 365
 366         context_fns->next = context_fns->prev = NULL;
 367         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 368         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 369         context_fns->context_id = context_id;
 370         context_fns->syntax = *abstract;
 371
 372         /* add to the list of open contexts */
 373
 374         DLIST_ADD( p->contexts, context_fns );
 375
 376         return True;
 377 }
 378
 379 /**
 380  * Is a named pipe known?
 381  * @param[in] cli_filename      The pipe name requested by the client
 382  * @result                      Do we want to serve this?
 383  */
 384 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
 385 {
 386         const char *pipename = cli_filename;
 387         NTSTATUS status;
 388
 389         if (strnequal(pipename, "\\PIPE\\", 6)) {
 390                 pipename += 5;
 391         }
 392
 393         if (*pipename == '\\') {
 394                 pipename += 1;
 395         }
 396
 397         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 398                 DEBUG(10, ("refusing spoolss access\n"));
 399                 return false;
 400         }
 401
 402         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 403                 return true;
 404         }
 405
 406         status = smb_probe_module("rpc", pipename);
 407         if (!NT_STATUS_IS_OK(status)) {
 408                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
 409                 return false;
 410         }
 411         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 412
 413         /*
 414          * Scan the list again for the interface id
 415          */
 416         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 417                 return true;
 418         }
 419
 420         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 421                    pipename));
 422
 423         return false;
 424 }
 425
 426 /*******************************************************************
 427  Handle the first part of a SPNEGO bind auth.
 428 *******************************************************************/
 429
 430 static bool pipe_spnego_auth_bind(struct pipes_struct *p,
 431                                   TALLOC_CTX *mem_ctx,
 432                                   struct dcerpc_auth *auth_info,
 433                                   DATA_BLOB *response)
 434 {
 435         struct spnego_context *spnego_ctx;
 436         NTSTATUS status;
 437
 438         status = spnego_server_auth_start(p,
 439                                           (auth_info->auth_level ==
 440                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 441                                           (auth_info->auth_level ==
 442                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 443                                           true,
 444                                           &auth_info->credentials,
 445                                           response,
 446                                           p->remote_address,
 447                                           &spnego_ctx);
 448         if (!NT_STATUS_IS_OK(status)) {
 449                 DEBUG(0, ("Failed SPNEGO negotiate (%s)\n",
 450                           nt_errstr(status)));
 451                 return false;
 452         }
 453
 454         /* Make sure data is bound to the memctx, to be freed the caller */
 455         talloc_steal(mem_ctx, response->data);
 456
 457         p->auth.auth_ctx = spnego_ctx;
 458         p->auth.auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 459
 460         DEBUG(10, ("SPNEGO auth started\n"));
 461
 462         return true;
 463 }
 464
 465 /*******************************************************************
 466  Handle an schannel bind auth.
 467 *******************************************************************/
 468
 469 static bool pipe_schannel_auth_bind(struct pipes_struct *p,
 470                                     TALLOC_CTX *mem_ctx,
 471                                     struct dcerpc_auth *auth_info,
 472                                     DATA_BLOB *response)
 473 {
 474         struct NL_AUTH_MESSAGE neg;
 475         struct NL_AUTH_MESSAGE reply;
 476         bool ret;
 477         NTSTATUS status;
 478         struct netlogon_creds_CredentialState *creds;
 479         enum ndr_err_code ndr_err;
 480         struct schannel_state *schannel_auth;
 481         struct loadparm_context *lp_ctx;
 482
 483         ndr_err = ndr_pull_struct_blob(
 484                         &auth_info->credentials, mem_ctx, &neg,
 485                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
 486         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 487                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
 488                 return false;
 489         }
 490
 491         if (DEBUGLEVEL >= 10) {
 492                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
 493         }
 494
 495         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
 496                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
 497                 return false;
 498         }
 499
 500         lp_ctx = loadparm_init_s3(p, loadparm_s3_context());
 501         if (!lp_ctx) {
 502                 DEBUG(0,("pipe_schannel_auth_bind: loadparm_init_s3() failed!\n"));
 503                 return false;
 504         }
 505
 506         /*
 507          * The neg.oem_netbios_computer.a key here must match the remote computer name
 508          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
 509          * operations that use credentials.
 510          */
 511
 512         become_root();
 513         status = schannel_get_creds_state(p, lp_ctx,
 514                                             neg.oem_netbios_computer.a, &creds);
 515         unbecome_root();
 516
 517         talloc_unlink(p, lp_ctx);
 518         if (!NT_STATUS_IS_OK(status)) {
 519                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
 520                 return False;
 521         }
 522
 523         schannel_auth = talloc(p, struct schannel_state);
 524         if (!schannel_auth) {
 525                 TALLOC_FREE(creds);
 526                 return False;
 527         }
 528
 529         schannel_auth->state = SCHANNEL_STATE_START;
 530         schannel_auth->seq_num = 0;
 531         schannel_auth->initiator = false;
 532         schannel_auth->creds = creds;
 533
 534         /*
 535          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
 536          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
 537          * struct of the person who opened the pipe. I need to test this further. JRA.
 538          *
 539          * VL. As we are mapping this to guest set the generic key
 540          * "SystemLibraryDTC" key here. It's a bit difficult to test against
 541          * W2k3, as it does not allow schannel binds against SAMR and LSA
 542          * anymore.
 543          */
 544
 545         ret = session_info_set_session_key(p->session_info, generic_session_key());
 546
 547         if (!ret) {
 548                 DEBUG(0, ("session_info_set_session_key failed\n"));
 549                 return false;
 550         }
 551
 552         /*** SCHANNEL verifier ***/
 553
 554         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
 555         reply.Flags                             = 0;
 556         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
 557                                                       * this has any meaning
 558                                                       * here - gd */
 559
 560         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
 561                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 562         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 563                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
 564                 return false;
 565         }
 566
 567         if (DEBUGLEVEL >= 10) {
 568                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
 569         }
 570
 571         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
 572                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
 573
 574         /* We're finished with this bind - no more packets. */
 575         p->auth.auth_ctx = schannel_auth;
 576         p->auth.auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
 577
 578         p->pipe_bound = True;
 579
 580         return True;
 581 }
 582
 583 /*******************************************************************
 584  Handle an NTLMSSP bind auth.
 585 *******************************************************************/
 586
 587 static bool pipe_ntlmssp_auth_bind(struct pipes_struct *p,
 588                                    TALLOC_CTX *mem_ctx,
 589                                    struct dcerpc_auth *auth_info,
 590                                    DATA_BLOB *response)
 591 {
 592         struct gensec_security *gensec_security = NULL;
 593         NTSTATUS status;
 594
 595         if (strncmp((char *)auth_info->credentials.data, "NTLMSSP", 7) != 0) {
 596                 DEBUG(0, ("Failed to read NTLMSSP in blob\n"));
 597                 return false;
 598         }
 599
 600         /* We have an NTLMSSP blob. */
 601         status = ntlmssp_server_auth_start(p,
 602                                            (auth_info->auth_level ==
 603                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 604                                            (auth_info->auth_level ==
 605                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 606                                            true,
 607                                            &auth_info->credentials,
 608                                            response,
 609                                            p->remote_address,
 610                                            &gensec_security);
 611         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 612                 DEBUG(0, (__location__ ": auth_ntlmssp_start failed: %s\n",
 613                           nt_errstr(status)));
 614                 return false;
 615         }
 616
 617         /* Make sure data is bound to the memctx, to be freed the caller */
 618         talloc_steal(mem_ctx, response->data);
 619
 620         p->auth.auth_ctx = gensec_security;
 621         p->auth.auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 622
 623         DEBUG(10, (__location__ ": NTLMSSP auth started\n"));
 624
 625         return true;
 626 }
 627
 628 /*******************************************************************
 629  Process an NTLMSSP authentication response.
 630  If this function succeeds, the user has been authenticated
 631  and their domain, name and calling workstation stored in
 632  the pipe struct.
 633 *******************************************************************/
 634
 635 static bool pipe_ntlmssp_verify_final(TALLOC_CTX *mem_ctx,
 636                                 struct gensec_security *gensec_security,
 637                                 enum dcerpc_AuthLevel auth_level,
 638                                 struct auth_session_info **session_info)
 639 {
 640         NTSTATUS status;
 641         bool ret;
 642
 643         DEBUG(5, (__location__ ": checking user details\n"));
 644
 645         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 646            ensure the underlying NTLMSSP flags are also set. If not we should
 647            refuse the bind. */
 648
 649         status = ntlmssp_server_check_flags(gensec_security,
 650                                             (auth_level ==
 651                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 652                                             (auth_level ==
 653                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 654         if (!NT_STATUS_IS_OK(status)) {
 655                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 656                           "security for rpc connection\n"));
 657                 return false;
 658         }
 659
 660         TALLOC_FREE(*session_info);
 661
 662         status = ntlmssp_server_get_user_info(gensec_security,
 663                                                 mem_ctx, session_info);
 664         if (!NT_STATUS_IS_OK(status)) {
 665                 DEBUG(0, (__location__ ": failed to obtain the server info "
 666                           "for authenticated user: %s\n", nt_errstr(status)));
 667                 return false;
 668         }
 669
 670         if ((*session_info)->security_token == NULL) {
 671                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 672                 return false;
 673         }
 674
 675         /*
 676          * We're an authenticated bind over smb, so the session key needs to
 677          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 678          * does. See the RPC-SAMBA3SESSIONKEY.
 679          */
 680
 681         ret = session_info_set_session_key((*session_info), generic_session_key());
 682         if (!ret) {
 683                 DEBUG(0, ("Failed to set session key!\n"));
 684                 return false;
 685         }
 686
 687         return true;
 688 }
 689
 690 /*******************************************************************
 691  Handle a GSSAPI bind auth.
 692 *******************************************************************/
 693
 694 static bool pipe_gssapi_auth_bind(struct pipes_struct *p,
 695                                   TALLOC_CTX *mem_ctx,
 696                                   struct dcerpc_auth *auth_info,
 697                                   DATA_BLOB *response)
 698 {
 699         NTSTATUS status;
 700         struct gse_context *gse_ctx = NULL;
 701
 702         status = gssapi_server_auth_start(p,
 703                                           (auth_info->auth_level ==
 704                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 705                                           (auth_info->auth_level ==
 706                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 707                                           true,
 708                                           &auth_info->credentials,
 709                                           response,
 710                                           &gse_ctx);
 711         if (!NT_STATUS_IS_OK(status)) {
 712                 DEBUG(0, ("Failed to init dcerpc gssapi server (%s)\n",
 713                           nt_errstr(status)));
 714                 goto err;
 715         }
 716
 717         /* Make sure data is bound to the memctx, to be freed the caller */
 718         talloc_steal(mem_ctx, response->data);
 719
 720         p->auth.auth_ctx = gse_ctx;
 721         p->auth.auth_type = DCERPC_AUTH_TYPE_KRB5;
 722
 723         DEBUG(10, ("KRB5 auth started\n"));
 724
 725         return true;
 726
 727 err:
 728         TALLOC_FREE(gse_ctx);
 729         return false;
 730 }
 731
 732 static NTSTATUS pipe_gssapi_verify_final(TALLOC_CTX *mem_ctx,
 733                                          struct gse_context *gse_ctx,
 734                                          const struct tsocket_address *remote_address,
 735                                          struct auth_session_info **session_info)
 736 {
 737         NTSTATUS status;
 738         bool bret;
 739
 740         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 741            ensure the underlying flags are also set. If not we should
 742            refuse the bind. */
 743
 744         status = gssapi_server_check_flags(gse_ctx);
 745         if (!NT_STATUS_IS_OK(status)) {
 746                 DEBUG(0, ("Requested Security Layers not honored!\n"));
 747                 return status;
 748         }
 749
 750         status = gssapi_server_get_user_info(gse_ctx, mem_ctx,
 751                                              remote_address, session_info);
 752         if (!NT_STATUS_IS_OK(status)) {
 753                 DEBUG(0, (__location__ ": failed to obtain the server info "
 754                           "for authenticated user: %s\n", nt_errstr(status)));
 755                 return status;
 756         }
 757
 758         /*
 759          * We're an authenticated bind over smb, so the session key needs to
 760          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 761          * does. See the RPC-SAMBA3SESSIONKEY.
 762          */
 763
 764         bret = session_info_set_session_key((*session_info), generic_session_key());
 765         if (!bret) {
 766                 return NT_STATUS_ACCESS_DENIED;
 767         }
 768
 769         return NT_STATUS_OK;
 770 }
 771
 772 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 773 {
 774         enum spnego_mech auth_type;
 775         struct gensec_security *gensec_security;
 776         struct spnego_context *spnego_ctx;
 777         struct gse_context *gse_ctx;
 778         void *mech_ctx;
 779         NTSTATUS status;
 780
 781         switch (p->auth.auth_type) {
 782         case DCERPC_AUTH_TYPE_NTLMSSP:
 783                 gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
 784                                                         struct gensec_security);
 785                 if (!pipe_ntlmssp_verify_final(p, gensec_security,
 786                                                 p->auth.auth_level,
 787                                                 &p->session_info)) {
 788                         return NT_STATUS_ACCESS_DENIED;
 789                 }
 790                 break;
 791         case DCERPC_AUTH_TYPE_KRB5:
 792                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 793                                                 struct gse_context);
 794                 status = pipe_gssapi_verify_final(p, gse_ctx,
 795                                                   p->remote_address,
 796                                                   &p->session_info);
 797                 if (!NT_STATUS_IS_OK(status)) {
 798                         DEBUG(1, ("gssapi bind failed with: %s",
 799                                   nt_errstr(status)));
 800                         return status;
 801                 }
 802                 break;
 803         case DCERPC_AUTH_TYPE_SPNEGO:
 804                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 805                                                    struct spnego_context);
 806                 status = spnego_get_negotiated_mech(spnego_ctx,
 807                                                     &auth_type, &mech_ctx);
 808                 if (!NT_STATUS_IS_OK(status)) {
 809                         DEBUG(0, ("Bad SPNEGO state (%s)\n",
 810                                   nt_errstr(status)));
 811                         return status;
 812                 }
 813                 switch(auth_type) {
 814                 case SPNEGO_KRB5:
 815                         gse_ctx = talloc_get_type_abort(mech_ctx,
 816                                                         struct gse_context);
 817                         status = pipe_gssapi_verify_final(p, gse_ctx,
 818                                                           p->remote_address,
 819                                                           &p->session_info);
 820                         if (!NT_STATUS_IS_OK(status)) {
 821                                 DEBUG(1, ("gssapi bind failed with: %s",
 822                                           nt_errstr(status)));
 823                                 return status;
 824                         }
 825                         break;
 826                 case SPNEGO_NTLMSSP:
 827                         gensec_security = talloc_get_type_abort(mech_ctx,
 828                                                 struct gensec_security);
 829                         if (!pipe_ntlmssp_verify_final(p, gensec_security,
 830                                                         p->auth.auth_level,
 831                                                         &p->session_info)) {
 832                                 return NT_STATUS_ACCESS_DENIED;
 833                         }
 834                         break;
 835                 default:
 836                         DEBUG(0, (__location__ ": incorrect spnego type "
 837                                   "(%d).\n", auth_type));
 838                         return NT_STATUS_ACCESS_DENIED;
 839                 }
 840                 break;
 841         default:
 842                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
 843                           (unsigned int)p->auth.auth_type));
 844                 return NT_STATUS_ACCESS_DENIED;
 845         }
 846
 847         p->pipe_bound = true;
 848
 849         return NT_STATUS_OK;
 850 }
 851
 852 /*******************************************************************
 853  Respond to a pipe bind request.
 854 *******************************************************************/
 855
 856 static bool api_pipe_bind_req(struct pipes_struct *p,
 857                                 struct ncacn_packet *pkt)
 858 {
 859         struct dcerpc_auth auth_info;
 860         uint16 assoc_gid;
 861         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
 862         NTSTATUS status;
 863         struct ndr_syntax_id id;
 864         union dcerpc_payload u;
 865         struct dcerpc_ack_ctx bind_ack_ctx;
 866         DATA_BLOB auth_resp = data_blob_null;
 867         DATA_BLOB auth_blob = data_blob_null;
 868
 869         /* No rebinds on a bound pipe - use alter context. */
 870         if (p->pipe_bound) {
 871                 DEBUG(2,("Rejecting bind request on bound rpc connection\n"));
 872                 return setup_bind_nak(p, pkt);
 873         }
 874
 875         if (pkt->u.bind.num_contexts == 0) {
 876                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
 877                 goto err_exit;
 878         }
 879
 880         /*
 881          * Try and find the correct pipe name to ensure
 882          * that this is a pipe name we support.
 883          */
 884         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 885         if (rpc_srv_pipe_exists_by_id(&id)) {
 886                 DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 887                           rpc_srv_get_pipe_cli_name(&id),
 888                           rpc_srv_get_pipe_srv_name(&id)));
 889         } else {
 890                 status = smb_probe_module(
 891                         "rpc", get_pipe_name_from_syntax(
 892                                 talloc_tos(),
 893                                 &id));
 894
 895                 if (NT_STATUS_IS_ERR(status)) {
 896                         DEBUG(3,("api_pipe_bind_req: Unknown rpc service name "
 897                                  "%s in bind request.\n",
 898                                  get_pipe_name_from_syntax(talloc_tos(), &id)));
 899
 900                         return setup_bind_nak(p, pkt);
 901                 }
 902
 903                 if (rpc_srv_get_pipe_interface_by_cli_name(
 904                                 get_pipe_name_from_syntax(talloc_tos(),
 905                                                           &id),
 906                                 &id)) {
 907                         DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 908                                   rpc_srv_get_pipe_cli_name(&id),
 909                                   rpc_srv_get_pipe_srv_name(&id)));
 910                 } else {
 911                         DEBUG(0, ("module %s doesn't provide functions for "
 912                                   "pipe %s!\n",
 913                                   get_pipe_name_from_syntax(talloc_tos(), &id),
 914                                   get_pipe_name_from_syntax(talloc_tos(), &id)));
 915                         return setup_bind_nak(p, pkt);
 916                 }
 917         }
 918
 919         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 920
 921         if (pkt->u.bind.assoc_group_id != 0) {
 922                 assoc_gid = pkt->u.bind.assoc_group_id;
 923         } else {
 924                 assoc_gid = 0x53f0;
 925         }
 926
 927         /*
 928          * Create the bind response struct.
 929          */
 930
 931         /* If the requested abstract synt uuid doesn't match our client pipe,
 932                 reject the bind_ack & set the transfer interface synt to all 0's,
 933                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 934                 unknown to NT4)
 935                 Needed when adding entries to a DACL from NT5 - SK */
 936
 937         if (check_bind_req(p,
 938                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 939                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 940                         pkt->u.bind.ctx_list[0].context_id)) {
 941
 942                 bind_ack_ctx.result = 0;
 943                 bind_ack_ctx.reason = 0;
 944                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 945         } else {
 946                 p->pipe_bound = False;
 947                 /* Rejection reason: abstract syntax not supported */
 948                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 949                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
 950                 bind_ack_ctx.syntax = null_ndr_syntax_id;
 951         }
 952
 953         /*
 954          * Check if this is an authenticated bind request.
 955          */
 956         if (pkt->auth_length) {
 957                 /* Quick length check. Won't catch a bad auth footer,
 958                  * prevents overrun. */
 959
 960                 if (pkt->frag_length < RPC_HEADER_LEN +
 961                                         DCERPC_AUTH_TRAILER_LENGTH +
 962                                         pkt->auth_length) {
 963                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
 964                                 "too long for fragment %u.\n",
 965                                 (unsigned int)pkt->auth_length,
 966                                 (unsigned int)pkt->frag_length));
 967                         goto err_exit;
 968                 }
 969
 970                 /*
 971                  * Decode the authentication verifier.
 972                  */
 973                 status = dcerpc_pull_dcerpc_auth(pkt,
 974                                                  &pkt->u.bind.auth_info,
 975                                                  &auth_info, p->endian);
 976                 if (!NT_STATUS_IS_OK(status)) {
 977                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
 978                         goto err_exit;
 979                 }
 980
 981                 auth_type = auth_info.auth_type;
 982
 983                 /* Work out if we have to sign or seal etc. */
 984                 switch (auth_info.auth_level) {
 985                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 986                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 987                         break;
 988                 case DCERPC_AUTH_LEVEL_PRIVACY:
 989                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 990                         break;
 991                 case DCERPC_AUTH_LEVEL_CONNECT:
 992                         p->auth.auth_level = DCERPC_AUTH_LEVEL_CONNECT;
 993                         break;
 994                 default:
 995                         DEBUG(0, ("Unexpected auth level (%u).\n",
 996                                 (unsigned int)auth_info.auth_level ));
 997                         goto err_exit;
 998                 }
 999
1000                 switch (auth_type) {
1001                 case DCERPC_AUTH_TYPE_NTLMSSP:
1002                         if (!pipe_ntlmssp_auth_bind(p, pkt,
1003                                                 &auth_info, &auth_resp)) {
1004                                 goto err_exit;
1005                         }
1006                         assoc_gid = 0x7a77;
1007                         break;
1008
1009                 case DCERPC_AUTH_TYPE_SCHANNEL:
1010                         if (!pipe_schannel_auth_bind(p, pkt,
1011                                                 &auth_info, &auth_resp)) {
1012                                 goto err_exit;
1013                         }
1014                         break;
1015
1016                 case DCERPC_AUTH_TYPE_SPNEGO:
1017                         if (!pipe_spnego_auth_bind(p, pkt,
1018                                                 &auth_info, &auth_resp)) {
1019                                 goto err_exit;
1020                         }
1021                         break;
1022
1023                 case DCERPC_AUTH_TYPE_KRB5:
1024                         if (!pipe_gssapi_auth_bind(p, pkt,
1025                                                 &auth_info, &auth_resp)) {
1026                                 goto err_exit;
1027                         }
1028                         break;
1029
1030                 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1031                         if (p->transport == NCALRPC && p->ncalrpc_as_system) {
1032                                 TALLOC_FREE(p->session_info);
1033
1034                                 status = make_session_info_system(p,
1035                                                                   &p->session_info);
1036                                 if (!NT_STATUS_IS_OK(status)) {
1037                                         goto err_exit;
1038                                 }
1039
1040                                 auth_resp = data_blob_talloc(pkt,
1041                                                              "NCALRPC_AUTH_OK",
1042                                                              15);
1043
1044                                 p->auth.auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
1045                                 p->pipe_bound = true;
1046                         } else {
1047                                 goto err_exit;
1048                         }
1049                         break;
1050
1051                 case DCERPC_AUTH_TYPE_NONE:
1052                         break;
1053
1054                 default:
1055                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
1056                         goto err_exit;
1057                 }
1058         }
1059
1060         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
1061                 /* Unauthenticated bind request. */
1062                 /* We're finished - no more packets. */
1063                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
1064                 /* We must set the pipe auth_level here also. */
1065                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1066                 p->pipe_bound = True;
1067                 /* The session key was initialized from the SMB
1068                  * session in make_internal_rpc_pipe_p */
1069         }
1070
1071         ZERO_STRUCT(u.bind_ack);
1072         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1073         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1074         u.bind_ack.assoc_group_id = assoc_gid;
1075
1076         /* name has to be \PIPE\xxxxx */
1077         u.bind_ack.secondary_address =
1078                         talloc_asprintf(pkt, "\\PIPE\\%s",
1079                                         rpc_srv_get_pipe_srv_name(&id));
1080         if (!u.bind_ack.secondary_address) {
1081                 DEBUG(0, ("Out of memory!\n"));
1082                 goto err_exit;
1083         }
1084         u.bind_ack.secondary_address_size =
1085                                 strlen(u.bind_ack.secondary_address) + 1;
1086
1087         u.bind_ack.num_results = 1;
1088         u.bind_ack.ctx_list = &bind_ack_ctx;
1089
1090         /* NOTE: We leave the auth_info empty so we can calculate the padding
1091          * later and then append the auth_info --simo */
1092
1093         /*
1094          * Marshall directly into the outgoing PDU space. We
1095          * must do this as we need to set to the bind response
1096          * header and are never sending more than one PDU here.
1097          */
1098
1099         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1100                                           DCERPC_PKT_BIND_ACK,
1101                                           DCERPC_PFC_FLAG_FIRST |
1102                                                 DCERPC_PFC_FLAG_LAST,
1103                                           auth_resp.length,
1104                                           pkt->call_id,
1105                                           &u,
1106                                           &p->out_data.frag);
1107         if (!NT_STATUS_IS_OK(status)) {
1108                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1109                           nt_errstr(status)));
1110         }
1111
1112         if (auth_resp.length) {
1113
1114                 status = dcerpc_push_dcerpc_auth(pkt,
1115                                                  auth_type,
1116                                                  auth_info.auth_level,
1117                                                  0,
1118                                                  1, /* auth_context_id */
1119                                                  &auth_resp,
1120                                                  &auth_blob);
1121                 if (!NT_STATUS_IS_OK(status)) {
1122                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1123                         goto err_exit;
1124                 }
1125         }
1126
1127         /* Now that we have the auth len store it into the right place in
1128          * the dcerpc header */
1129         dcerpc_set_frag_length(&p->out_data.frag,
1130                                 p->out_data.frag.length + auth_blob.length);
1131
1132         if (auth_blob.length) {
1133
1134                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1135                                         auth_blob.data, auth_blob.length)) {
1136                         DEBUG(0, ("Append of auth info failed.\n"));
1137                         goto err_exit;
1138                 }
1139         }
1140
1141         /*
1142          * Setup the lengths for the initial reply.
1143          */
1144
1145         p->out_data.data_sent_length = 0;
1146         p->out_data.current_pdu_sent = 0;
1147
1148         TALLOC_FREE(auth_blob.data);
1149         return True;
1150
1151   err_exit:
1152
1153         data_blob_free(&p->out_data.frag);
1154         TALLOC_FREE(auth_blob.data);
1155         return setup_bind_nak(p, pkt);
1156 }
1157
1158 /*******************************************************************
1159  This is the "stage3" response after a bind request and reply.
1160 *******************************************************************/
1161
1162 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
1163 {
1164         struct dcerpc_auth auth_info;
1165         DATA_BLOB response = data_blob_null;
1166         struct gensec_security *gensec_security;
1167         struct spnego_context *spnego_ctx;
1168         struct gse_context *gse_ctx;
1169         NTSTATUS status;
1170
1171         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
1172
1173         if (pkt->auth_length == 0) {
1174                 DEBUG(0, ("No auth field sent for bind request!\n"));
1175                 goto err;
1176         }
1177
1178         /* Ensure there's enough data for an authenticated request. */
1179         if (pkt->frag_length < RPC_HEADER_LEN
1180                                 + DCERPC_AUTH_TRAILER_LENGTH
1181                                 + pkt->auth_length) {
1182                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
1183                                 "%u is too large.\n",
1184                         (unsigned int)pkt->auth_length));
1185                 goto err;
1186         }
1187
1188         /*
1189          * Decode the authentication verifier response.
1190          */
1191
1192         status = dcerpc_pull_dcerpc_auth(pkt,
1193                                          &pkt->u.auth3.auth_info,
1194                                          &auth_info, p->endian);
1195         if (!NT_STATUS_IS_OK(status)) {
1196                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
1197                 goto err;
1198         }
1199
1200         /* We must NEVER look at auth_info->auth_pad_len here,
1201          * as old Samba client code gets it wrong and sends it
1202          * as zero. JRA.
1203          */
1204
1205         if (auth_info.auth_type != p->auth.auth_type) {
1206                 DEBUG(0, ("Auth type mismatch! Client sent %d, "
1207                           "but auth was started as type %d!\n",
1208                           auth_info.auth_type, p->auth.auth_type));
1209                 goto err;
1210         }
1211
1212         switch (auth_info.auth_type) {
1213         case DCERPC_AUTH_TYPE_NTLMSSP:
1214                 gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
1215                                                     struct gensec_security);
1216                 status = ntlmssp_server_step(gensec_security,
1217                                              pkt, &auth_info.credentials,
1218                                              &response);
1219                 break;
1220         case DCERPC_AUTH_TYPE_KRB5:
1221                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1222                                                 struct gse_context);
1223                 status = gssapi_server_step(gse_ctx,
1224                                             pkt, &auth_info.credentials,
1225                                             &response);
1226                 break;
1227         case DCERPC_AUTH_TYPE_SPNEGO:
1228                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1229                                                    struct spnego_context);
1230                 status = spnego_server_step(spnego_ctx,
1231                                             pkt, &auth_info.credentials,
1232                                             &response);
1233                 break;
1234         default:
1235                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
1236                           (unsigned int)auth_info.auth_type));
1237                 return false;
1238         }
1239
1240         if (NT_STATUS_EQUAL(status,
1241                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1242             response.length) {
1243                 DEBUG(0, (__location__ ": This was supposed to be the final "
1244                           "leg, but crypto machinery claims a response is "
1245                           "needed, aborting auth!\n"));
1246                 data_blob_free(&response);
1247                 goto err;
1248         }
1249         if (!NT_STATUS_IS_OK(status)) {
1250                 DEBUG(0, ("Auth failed (%s)\n", nt_errstr(status)));
1251                 goto err;
1252         }
1253
1254         /* Now verify auth was indeed successful and extract server info */
1255         status = pipe_auth_verify_final(p);
1256         if (!NT_STATUS_IS_OK(status)) {
1257                 DEBUG(0, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1258                 goto err;
1259         }
1260
1261         return true;
1262
1263 err:
1264
1265         TALLOC_FREE(p->auth.auth_ctx);
1266         return false;
1267 }
1268
1269 /****************************************************************************
1270  Deal with an alter context call. Can be third part of 3 leg auth request for
1271  SPNEGO calls.
1272 ****************************************************************************/
1273
1274 static bool api_pipe_alter_context(struct pipes_struct *p,
1275                                         struct ncacn_packet *pkt)
1276 {
1277         struct dcerpc_auth auth_info;
1278         uint16 assoc_gid;
1279         NTSTATUS status;
1280         union dcerpc_payload u;
1281         struct dcerpc_ack_ctx bind_ack_ctx;
1282         DATA_BLOB auth_resp = data_blob_null;
1283         DATA_BLOB auth_blob = data_blob_null;
1284         int pad_len = 0;
1285         struct gensec_security *gensec_security;
1286         struct spnego_context *spnego_ctx;
1287         struct gse_context *gse_ctx;
1288
1289         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1290
1291         if (pkt->u.bind.assoc_group_id != 0) {
1292                 assoc_gid = pkt->u.bind.assoc_group_id;
1293         } else {
1294                 assoc_gid = 0x53f0;
1295         }
1296
1297         /*
1298          * Create the bind response struct.
1299          */
1300
1301         /* If the requested abstract synt uuid doesn't match our client pipe,
1302                 reject the bind_ack & set the transfer interface synt to all 0's,
1303                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1304                 unknown to NT4)
1305                 Needed when adding entries to a DACL from NT5 - SK */
1306
1307         if (check_bind_req(p,
1308                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1309                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1310                         pkt->u.bind.ctx_list[0].context_id)) {
1311
1312                 bind_ack_ctx.result = 0;
1313                 bind_ack_ctx.reason = 0;
1314                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1315         } else {
1316                 p->pipe_bound = False;
1317                 /* Rejection reason: abstract syntax not supported */
1318                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1319                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1320                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1321         }
1322
1323         /*
1324          * Check if this is an authenticated alter context request.
1325          */
1326         if (pkt->auth_length) {
1327                 /* Quick length check. Won't catch a bad auth footer,
1328                  * prevents overrun. */
1329
1330                 if (pkt->frag_length < RPC_HEADER_LEN +
1331                                         DCERPC_AUTH_TRAILER_LENGTH +
1332                                         pkt->auth_length) {
1333                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1334                                 "too long for fragment %u.\n",
1335                                 (unsigned int)pkt->auth_length,
1336                                 (unsigned int)pkt->frag_length ));
1337                         goto err_exit;
1338                 }
1339
1340                 status = dcerpc_pull_dcerpc_auth(pkt,
1341                                                  &pkt->u.bind.auth_info,
1342                                                  &auth_info, p->endian);
1343                 if (!NT_STATUS_IS_OK(status)) {
1344                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1345                         goto err_exit;
1346                 }
1347
1348                 /* We can only finish if the pipe is unbound for now */
1349                 if (p->pipe_bound) {
1350                         DEBUG(0, (__location__ ": Pipe already bound, "
1351                                   "Altering Context not yet supported!\n"));
1352                         goto err_exit;
1353                 }
1354
1355                 if (auth_info.auth_type != p->auth.auth_type) {
1356                         DEBUG(0, ("Auth type mismatch! Client sent %d, "
1357                                   "but auth was started as type %d!\n",
1358                                   auth_info.auth_type, p->auth.auth_type));
1359                         goto err_exit;
1360                 }
1361
1362
1363                 switch (auth_info.auth_type) {
1364                 case DCERPC_AUTH_TYPE_SPNEGO:
1365                         spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1366                                                         struct spnego_context);
1367                         status = spnego_server_step(spnego_ctx,
1368                                                     pkt,
1369                                                     &auth_info.credentials,
1370                                                     &auth_resp);
1371                         break;
1372
1373                 case DCERPC_AUTH_TYPE_KRB5:
1374                         gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1375                                                         struct gse_context);
1376                         status = gssapi_server_step(gse_ctx,
1377                                                     pkt,
1378                                                     &auth_info.credentials,
1379                                                     &auth_resp);
1380                         break;
1381                 case DCERPC_AUTH_TYPE_NTLMSSP:
1382                         gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
1383                                                     struct gensec_security);
1384                         status = ntlmssp_server_step(gensec_security,
1385                                                      pkt,
1386                                                      &auth_info.credentials,
1387                                                      &auth_resp);
1388                         break;
1389
1390                 default:
1391                         DEBUG(3, (__location__ ": Usupported auth type (%d) "
1392                                   "in alter-context call\n",
1393                                   auth_info.auth_type));
1394                         goto err_exit;
1395                 }
1396
1397                 if (NT_STATUS_IS_OK(status)) {
1398                         /* third leg of auth, verify auth info */
1399                         status = pipe_auth_verify_final(p);
1400                         if (!NT_STATUS_IS_OK(status)) {
1401                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1402                                           nt_errstr(status)));
1403                                 goto err_exit;
1404                         }
1405                 } else if (NT_STATUS_EQUAL(status,
1406                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1407                         DEBUG(10, ("More auth legs required.\n"));
1408                 } else {
1409                         DEBUG(0, ("Auth step returned an error (%s)\n",
1410                                   nt_errstr(status)));
1411                         goto err_exit;
1412                 }
1413         }
1414
1415         ZERO_STRUCT(u.alter_resp);
1416         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1417         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1418         u.alter_resp.assoc_group_id = assoc_gid;
1419
1420         /* secondary address CAN be NULL
1421          * as the specs say it's ignored.
1422          * It MUST be NULL to have the spoolss working.
1423          */
1424         u.alter_resp.secondary_address = "";
1425         u.alter_resp.secondary_address_size = 1;
1426
1427         u.alter_resp.num_results = 1;
1428         u.alter_resp.ctx_list = &bind_ack_ctx;
1429
1430         /* NOTE: We leave the auth_info empty so we can calculate the padding
1431          * later and then append the auth_info --simo */
1432
1433         /*
1434          * Marshall directly into the outgoing PDU space. We
1435          * must do this as we need to set to the bind response
1436          * header and are never sending more than one PDU here.
1437          */
1438
1439         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1440                                           DCERPC_PKT_ALTER_RESP,
1441                                           DCERPC_PFC_FLAG_FIRST |
1442                                                 DCERPC_PFC_FLAG_LAST,
1443                                           auth_resp.length,
1444                                           pkt->call_id,
1445                                           &u,
1446                                           &p->out_data.frag);
1447         if (!NT_STATUS_IS_OK(status)) {
1448                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1449                           nt_errstr(status)));
1450         }
1451
1452         if (auth_resp.length) {
1453
1454                 /* Work out any padding needed before the auth footer. */
1455                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1456                 if (pad_len) {
1457                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1458                         DEBUG(10, ("auth pad_len = %u\n",
1459                                    (unsigned int)pad_len));
1460                 }
1461
1462                 status = dcerpc_push_dcerpc_auth(pkt,
1463                                                  auth_info.auth_type,
1464                                                  auth_info.auth_level,
1465                                                  pad_len,
1466                                                  1, /* auth_context_id */
1467                                                  &auth_resp,
1468                                                  &auth_blob);
1469                 if (!NT_STATUS_IS_OK(status)) {
1470                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1471                         goto err_exit;
1472                 }
1473         }
1474
1475         /* Now that we have the auth len store it into the right place in
1476          * the dcerpc header */
1477         dcerpc_set_frag_length(&p->out_data.frag,
1478                                 p->out_data.frag.length +
1479                                         pad_len + auth_blob.length);
1480
1481         if (auth_resp.length) {
1482                 if (pad_len) {
1483                         char pad[SERVER_NDR_PADDING_SIZE];
1484                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1485                         if (!data_blob_append(p->mem_ctx,
1486                                                 &p->out_data.frag,
1487                                                 pad, pad_len)) {
1488                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1489                                           "%u bytes of pad data.\n",
1490                                           (unsigned int)pad_len));
1491                                 goto err_exit;
1492                         }
1493                 }
1494
1495                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1496                                         auth_blob.data, auth_blob.length)) {
1497                         DEBUG(0, ("Append of auth info failed.\n"));
1498                         goto err_exit;
1499                 }
1500         }
1501
1502         /*
1503          * Setup the lengths for the initial reply.
1504          */
1505
1506         p->out_data.data_sent_length = 0;
1507         p->out_data.current_pdu_sent = 0;
1508
1509         TALLOC_FREE(auth_blob.data);
1510         return True;
1511
1512   err_exit:
1513
1514         data_blob_free(&p->out_data.frag);
1515         TALLOC_FREE(auth_blob.data);
1516         return setup_bind_nak(p, pkt);
1517 }
1518
1519 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1520                        const struct api_struct *api_rpc_cmds, int n_cmds,
1521                        const struct ndr_syntax_id *syntax);
1522
1523 /****************************************************************************
1524  Find the correct RPC function to call for this request.
1525  If the pipe is authenticated then become the correct UNIX user
1526  before doing the call.
1527 ****************************************************************************/
1528
1529 static bool api_pipe_request(struct pipes_struct *p,
1530                                 struct ncacn_packet *pkt)
1531 {
1532         bool ret = False;
1533         struct pipe_rpc_fns *pipe_fns;
1534
1535         if (!p->pipe_bound) {
1536                 DEBUG(1, ("Pipe not bound!\n"));
1537                 data_blob_free(&p->out_data.rdata);
1538                 return false;
1539         }
1540
1541         if (!become_authenticated_pipe_user(p->session_info)) {
1542                 DEBUG(1, ("Failed to become pipe user!\n"));
1543                 data_blob_free(&p->out_data.rdata);
1544                 return false;
1545         }
1546
1547         /* get the set of RPC functions for this context */
1548
1549         pipe_fns = find_pipe_fns_by_context(p->contexts,
1550                                             pkt->u.request.context_id);
1551
1552         if ( pipe_fns ) {
1553                 TALLOC_CTX *frame = talloc_stackframe();
1554
1555                 DEBUG(5, ("Requested %s rpc service\n",
1556                           get_pipe_name_from_syntax(talloc_tos(), &pipe_fns->syntax)));
1557
1558                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds,
1559                                  &pipe_fns->syntax);
1560
1561                 TALLOC_FREE(frame);
1562         }
1563         else {
1564                 DEBUG(0, ("No rpc function table associated with context "
1565                           "[%d]\n",
1566                           pkt->u.request.context_id));
1567         }
1568
1569         unbecome_authenticated_pipe_user();
1570
1571         return ret;
1572 }
1573
1574 /*******************************************************************
1575  Calls the underlying RPC function for a named pipe.
1576  ********************************************************************/
1577
1578 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1579                        const struct api_struct *api_rpc_cmds, int n_cmds,
1580                        const struct ndr_syntax_id *syntax)
1581 {
1582         int fn_num;
1583         uint32_t offset1;
1584
1585         /* interpret the command */
1586         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1587                  get_pipe_name_from_syntax(talloc_tos(), syntax),
1588                  pkt->u.request.opnum));
1589
1590         if (DEBUGLEVEL >= 50) {
1591                 fstring name;
1592                 slprintf(name, sizeof(name)-1, "in_%s",
1593                          get_pipe_name_from_syntax(talloc_tos(), syntax));
1594                 dump_pdu_region(name, pkt->u.request.opnum,
1595                                 &p->in_data.data, 0,
1596                                 p->in_data.data.length);
1597         }
1598
1599         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1600                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1601                     api_rpc_cmds[fn_num].fn != NULL) {
1602                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1603                                   api_rpc_cmds[fn_num].name));
1604                         break;
1605                 }
1606         }
1607
1608         if (fn_num == n_cmds) {
1609                 /*
1610                  * For an unknown RPC just return a fault PDU but
1611                  * return True to allow RPC's on the pipe to continue
1612                  * and not put the pipe into fault state. JRA.
1613                  */
1614                 DEBUG(4, ("unknown\n"));
1615                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1616                 return True;
1617         }
1618
1619         offset1 = p->out_data.rdata.length;
1620
1621         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1622                 fn_num, api_rpc_cmds[fn_num].fn));
1623         /* do the actual command */
1624         if(!api_rpc_cmds[fn_num].fn(p)) {
1625                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1626                          get_pipe_name_from_syntax(talloc_tos(), syntax),
1627                          api_rpc_cmds[fn_num].name));
1628                 data_blob_free(&p->out_data.rdata);
1629                 return False;
1630         }
1631
1632         if (p->bad_handle_fault_state) {
1633                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1634                 p->bad_handle_fault_state = False;
1635                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
1636                 return True;
1637         }
1638
1639         if (p->rng_fault_state) {
1640                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
1641                 p->rng_fault_state = False;
1642                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1643                 return True;
1644         }
1645
1646         if (DEBUGLEVEL >= 50) {
1647                 fstring name;
1648                 slprintf(name, sizeof(name)-1, "out_%s",
1649                          get_pipe_name_from_syntax(talloc_tos(), syntax));
1650                 dump_pdu_region(name, pkt->u.request.opnum,
1651                                 &p->out_data.rdata, offset1,
1652                                 p->out_data.rdata.length);
1653         }
1654
1655         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1656                  get_pipe_name_from_syntax(talloc_tos(), syntax)));
1657
1658         /* Check for buffer underflow in rpc parsing */
1659         if ((DEBUGLEVEL >= 10) &&
1660             (pkt->frag_length < p->in_data.data.length)) {
1661                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1662                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1663                               p->in_data.data.length - pkt->frag_length);
1664         }
1665
1666         return True;
1667 }
1668
1669 /****************************************************************************
1670  Initialise an outgoing packet.
1671 ****************************************************************************/
1672
1673 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1674 {
1675         output_data *o_data = &p->out_data;
1676
1677         /* Reset the offset counters. */
1678         o_data->data_sent_length = 0;
1679         o_data->current_pdu_sent = 0;
1680
1681         data_blob_free(&o_data->frag);
1682
1683         /* Free any memory in the current return data buffer. */
1684         data_blob_free(&o_data->rdata);
1685
1686         return True;
1687 }
1688
1689 /****************************************************************************
1690  Sets the fault state on incoming packets.
1691 ****************************************************************************/
1692
1693 void set_incoming_fault(struct pipes_struct *p)
1694 {
1695         data_blob_free(&p->in_data.data);
1696         p->in_data.pdu_needed_len = 0;
1697         p->in_data.pdu.length = 0;
1698         p->fault_state = True;
1699
1700         DEBUG(10, ("Setting fault state\n"));
1701 }
1702
1703 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1704                                     struct ncacn_packet *pkt,
1705                                     DATA_BLOB *raw_pkt)
1706 {
1707         NTSTATUS status;
1708         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1709         size_t pad_len;
1710
1711         DEBUG(10, ("Checking request auth.\n"));
1712
1713         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1714                 hdr_size += 16;
1715         }
1716
1717         /* in case of sealing this function will unseal the data in place */
1718         status = dcerpc_check_auth(auth, pkt,
1719                                    &pkt->u.request.stub_and_verifier,
1720                                    hdr_size, raw_pkt,
1721                                    &pad_len);
1722         if (!NT_STATUS_IS_OK(status)) {
1723                 return status;
1724         }
1725
1726
1727         /* remove padding and auth trailer,
1728          * this way the caller will get just the data */
1729         if (pkt->auth_length) {
1730                 size_t trail_len = pad_len
1731                                         + DCERPC_AUTH_TRAILER_LENGTH
1732                                         + pkt->auth_length;
1733                 if (pkt->u.request.stub_and_verifier.length < trail_len) {
1734                         return NT_STATUS_INFO_LENGTH_MISMATCH;
1735                 }
1736                 pkt->u.request.stub_and_verifier.length -= trail_len;
1737         }
1738
1739         return NT_STATUS_OK;
1740 }
1741
1742 /****************************************************************************
1743  Processes a request pdu. This will do auth processing if needed, and
1744  appends the data into the complete stream if the LAST flag is not set.
1745 ****************************************************************************/
1746
1747 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1748 {
1749         NTSTATUS status;
1750         DATA_BLOB data;
1751
1752         if (!p->pipe_bound) {
1753                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1754                 set_incoming_fault(p);
1755                 return False;
1756         }
1757
1758         /* Store the opnum */
1759         p->opnum = pkt->u.request.opnum;
1760
1761         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1762         if (!NT_STATUS_IS_OK(status)) {
1763                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1764                           nt_errstr(status)));
1765                 set_incoming_fault(p);
1766                 return false;
1767         }
1768
1769         data = pkt->u.request.stub_and_verifier;
1770
1771         /*
1772          * Check the data length doesn't go over the 15Mb limit.
1773          * increased after observing a bug in the Windows NT 4.0 SP6a
1774          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1775          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1776          */
1777
1778         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1779                 DEBUG(0, ("process_request_pdu: "
1780                           "rpc data buffer too large (%u) + (%u)\n",
1781                           (unsigned int)p->in_data.data.length,
1782                           (unsigned int)data.length));
1783                 set_incoming_fault(p);
1784                 return False;
1785         }
1786
1787         /*
1788          * Append the data portion into the buffer and return.
1789          */
1790
1791         if (data.length) {
1792                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1793                                           data.data, data.length)) {
1794                         DEBUG(0, ("Unable to append data size %u "
1795                                   "to parse buffer of size %u.\n",
1796                                   (unsigned int)data.length,
1797                                   (unsigned int)p->in_data.data.length));
1798                         set_incoming_fault(p);
1799                         return False;
1800                 }
1801         }
1802
1803         if (pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1804                 bool ret = False;
1805                 /*
1806                  * Ok - we finally have a complete RPC stream.
1807                  * Call the rpc command to process it.
1808                  */
1809
1810                 /*
1811                  * Process the complete data stream here.
1812                  */
1813                 if (pipe_init_outgoing_data(p)) {
1814                         ret = api_pipe_request(p, pkt);
1815                 }
1816
1817                 return ret;
1818         }
1819
1820         return True;
1821 }
1822
1823 /****************************************************************************
1824  Processes a finished PDU stored in p->in_data.pdu.
1825 ****************************************************************************/
1826
1827 void process_complete_pdu(struct pipes_struct *p)
1828 {
1829         struct ncacn_packet *pkt = NULL;
1830         NTSTATUS status;
1831         bool reply = False;
1832
1833         if(p->fault_state) {
1834                 DEBUG(10,("RPC connection in fault state.\n"));
1835                 goto done;
1836         }
1837
1838         pkt = talloc(p->mem_ctx, struct ncacn_packet);
1839         if (!pkt) {
1840                 DEBUG(0, ("Out of memory!\n"));
1841                 goto done;
1842         }
1843
1844         /*
1845          * Ensure we're using the corrent endianness for both the
1846          * RPC header flags and the raw data we will be reading from.
1847          */
1848         if (dcerpc_get_endian_flag(&p->in_data.pdu) & DCERPC_DREP_LE) {
1849                 p->endian = RPC_LITTLE_ENDIAN;
1850         } else {
1851                 p->endian = RPC_BIG_ENDIAN;
1852         }
1853         DEBUG(10, ("PDU is in %s Endian format!\n", p->endian?"Big":"Little"));
1854
1855         status = dcerpc_pull_ncacn_packet(pkt, &p->in_data.pdu,
1856                                           pkt, p->endian);
1857         if (!NT_STATUS_IS_OK(status)) {
1858                 DEBUG(0, ("Failed to unmarshal rpc packet: %s!\n",
1859                           nt_errstr(status)));
1860                 goto done;
1861         }
1862
1863         /* Store the call_id */
1864         p->call_id = pkt->call_id;
1865
1866         DEBUG(10, ("Processing packet type %u\n", (unsigned int)pkt->ptype));
1867
1868         switch (pkt->ptype) {
1869         case DCERPC_PKT_REQUEST:
1870                 reply = process_request_pdu(p, pkt);
1871                 break;
1872
1873         case DCERPC_PKT_PING: /* CL request - ignore... */
1874                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1875                           (unsigned int)pkt->ptype));
1876                 break;
1877
1878         case DCERPC_PKT_RESPONSE: /* No responses here. */
1879                 DEBUG(0, ("Error - DCERPC_PKT_RESPONSE received from client"));
1880                 break;
1881
1882         case DCERPC_PKT_FAULT:
1883         case DCERPC_PKT_WORKING:
1884                 /* CL request - reply to a ping when a call in process. */
1885         case DCERPC_PKT_NOCALL:
1886                 /* CL - server reply to a ping call. */
1887         case DCERPC_PKT_REJECT:
1888         case DCERPC_PKT_ACK:
1889         case DCERPC_PKT_CL_CANCEL:
1890         case DCERPC_PKT_FACK:
1891         case DCERPC_PKT_CANCEL_ACK:
1892                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1893                           (unsigned int)pkt->ptype));
1894                 break;
1895
1896         case DCERPC_PKT_BIND:
1897                 /*
1898                  * We assume that a pipe bind is only in one pdu.
1899                  */
1900                 if (pipe_init_outgoing_data(p)) {
1901                         reply = api_pipe_bind_req(p, pkt);
1902                 }
1903                 break;
1904
1905         case DCERPC_PKT_BIND_ACK:
1906         case DCERPC_PKT_BIND_NAK:
1907                 DEBUG(0, ("Error - DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1908                           "packet type %u received.\n",
1909                           (unsigned int)pkt->ptype));
1910                 break;
1911
1912
1913         case DCERPC_PKT_ALTER:
1914                 /*
1915                  * We assume that a pipe bind is only in one pdu.
1916                  */
1917                 if (pipe_init_outgoing_data(p)) {
1918                         reply = api_pipe_alter_context(p, pkt);
1919                 }
1920                 break;
1921
1922         case DCERPC_PKT_ALTER_RESP:
1923                 DEBUG(0, ("Error - DCERPC_PKT_ALTER_RESP received: "
1924                           "Should only be server -> client.\n"));
1925                 break;
1926
1927         case DCERPC_PKT_AUTH3:
1928                 /*
1929                  * The third packet in an auth exchange.
1930                  */
1931                 if (pipe_init_outgoing_data(p)) {
1932                         reply = api_pipe_bind_auth3(p, pkt);
1933                 }
1934                 break;
1935
1936         case DCERPC_PKT_SHUTDOWN:
1937                 DEBUG(0, ("Error - DCERPC_PKT_SHUTDOWN received: "
1938                           "Should only be server -> client.\n"));
1939                 break;
1940
1941         case DCERPC_PKT_CO_CANCEL:
1942                 /* For now just free all client data and continue
1943                  * processing. */
1944                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1945                          " Abandoning rpc call.\n"));
1946                 /* As we never do asynchronous RPC serving, we can
1947                  * never cancel a call (as far as I know).
1948                  * If we ever did we'd have to send a cancel_ack reply.
1949                  * For now, just free all client data and continue
1950                  * processing. */
1951                 reply = True;
1952                 break;
1953
1954 #if 0
1955                 /* Enable this if we're doing async rpc. */
1956                 /* We must check the outstanding callid matches. */
1957                 if (pipe_init_outgoing_data(p)) {
1958                         /* Send a cancel_ack PDU reply. */
1959                         /* We should probably check the auth-verifier here. */
1960                         reply = setup_cancel_ack_reply(p, pkt);
1961                 }
1962                 break;
1963 #endif
1964
1965         case DCERPC_PKT_ORPHANED:
1966                 /* We should probably check the auth-verifier here.
1967                  * For now just free all client data and continue
1968                  * processing. */
1969                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
1970                           " Abandoning rpc call.\n"));
1971                 reply = True;
1972                 break;
1973
1974         default:
1975                 DEBUG(0, ("process_complete_pdu: "
1976                           "Unknown rpc type = %u received.\n",
1977                           (unsigned int)pkt->ptype));
1978                 break;
1979         }
1980
1981 done:
1982         if (!reply) {
1983                 DEBUG(3,("DCE/RPC fault sent!"));
1984                 set_incoming_fault(p);
1985                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1986                 TALLOC_FREE(pkt);
1987         } else {
1988                 /*
1989                  * Reset the lengths. We're ready for a new pdu.
1990                  */
1991                 TALLOC_FREE(p->in_data.pdu.data);
1992                 p->in_data.pdu_needed_len = 0;
1993                 p->in_data.pdu.length = 0;
1994         }
1995
1996         TALLOC_FREE(pkt);
1997 }
1998