source/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19  */
  20
  21 /*  this module apparently provides an implementation of DCE/RPC over a
  22  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  23  *  documentation are available (in on-line form) from the X-Open group.
  24  *
  25  *  this module should provide a level of abstraction between SMB
  26  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  27  *  data copies, and network traffic.
  28  *
  29  */
  30
  31 #include "includes.h"
  32
  33 extern struct pipe_id_info pipe_names[];
  34 extern struct current_user current_user;
  35
  36 #undef DBGC_CLASS
  37 #define DBGC_CLASS DBGC_RPC_SRV
  38
  39 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  40 {
  41         AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
  42
  43         if (a) {
  44                 auth_ntlmssp_end(&a);
  45         }
  46         auth->a_u.auth_ntlmssp_state = NULL;
  47 }
  48
  49 /*******************************************************************
  50  Generate the next PDU to be returned from the data in p->rdata.
  51  Handle NTLMSSP.
  52  ********************************************************************/
  53
  54 static BOOL create_next_pdu_ntlmssp(pipes_struct *p)
  55 {
  56         RPC_HDR_RESP hdr_resp;
  57         uint32 ss_padding_len = 0;
  58         uint32 data_space_available;
  59         uint32 data_len_left;
  60         uint32 data_len;
  61         prs_struct outgoing_pdu;
  62         NTSTATUS status;
  63         DATA_BLOB auth_blob;
  64         RPC_HDR_AUTH auth_info;
  65         uint8 auth_type, auth_level;
  66         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
  67
  68         /*
  69          * If we're in the fault state, keep returning fault PDU's until
  70          * the pipe gets closed. JRA.
  71          */
  72
  73         if(p->fault_state) {
  74                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
  75                 return True;
  76         }
  77
  78         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  79
  80         /* Change the incoming request header to a response. */
  81         p->hdr.pkt_type = RPC_RESPONSE;
  82
  83         /* Set up rpc header flags. */
  84         if (p->out_data.data_sent_length == 0) {
  85                 p->hdr.flags = RPC_FLG_FIRST;
  86         } else {
  87                 p->hdr.flags = 0;
  88         }
  89
  90         /*
  91          * Work out how much we can fit in a single PDU.
  92          */
  93
  94         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
  95
  96         /*
  97          * Ensure there really is data left to send.
  98          */
  99
 100         if(!data_len_left) {
 101                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 102                 return False;
 103         }
 104
 105         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 106                                         RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 107
 108         /*
 109          * The amount we send is the minimum of the available
 110          * space and the amount left to send.
 111          */
 112
 113         data_len = MIN(data_len_left, data_space_available);
 114
 115         /*
 116          * Set up the alloc hint. This should be the data left to
 117          * send.
 118          */
 119
 120         hdr_resp.alloc_hint = data_len_left;
 121
 122         /*
 123          * Work out if this PDU will be the last.
 124          */
 125
 126         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 127                 p->hdr.flags |= RPC_FLG_LAST;
 128                 if (data_len_left % 8) {
 129                         ss_padding_len = 8 - (data_len_left % 8);
 130                         DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 131                                 ss_padding_len ));
 132                 }
 133         }
 134
 135         /*
 136          * Set up the header lengths.
 137          */
 138
 139         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 140                         data_len + ss_padding_len +
 141                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 142         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 143
 144
 145         /*
 146          * Init the parse struct to point at the outgoing
 147          * data.
 148          */
 149
 150         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 151         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 152
 153         /* Store the header in the data stream. */
 154         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 155                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 156                 prs_mem_free(&outgoing_pdu);
 157                 return False;
 158         }
 159
 160         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 161                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 162                 prs_mem_free(&outgoing_pdu);
 163                 return False;
 164         }
 165
 166         /* Copy the data into the PDU. */
 167
 168         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 169                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 170                 prs_mem_free(&outgoing_pdu);
 171                 return False;
 172         }
 173
 174         /* Copy the sign/seal padding data. */
 175         if (ss_padding_len) {
 176                 char pad[8];
 177
 178                 memset(pad, '\0', 8);
 179                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 180                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 181                                         (unsigned int)ss_padding_len));
 182                         prs_mem_free(&outgoing_pdu);
 183                         return False;
 184                 }
 185         }
 186
 187
 188         /* Now write out the auth header and null blob. */
 189         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 190                 auth_type = RPC_NTLMSSP_AUTH_TYPE;
 191         } else {
 192                 auth_type = RPC_SPNEGO_AUTH_TYPE;
 193         }
 194         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 195                 auth_level = RPC_AUTH_LEVEL_PRIVACY;
 196         } else {
 197                 auth_level = RPC_AUTH_LEVEL_INTEGRITY;
 198         }
 199
 200         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 201         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 202                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 203                 prs_mem_free(&outgoing_pdu);
 204                 return False;
 205         }
 206
 207         /* Generate the sign blob. */
 208
 209         switch (p->auth.auth_level) {
 210                 case PIPE_AUTH_LEVEL_PRIVACY:
 211                         /* Data portion is encrypted. */
 212                         status = ntlmssp_seal_packet(a->ntlmssp_state,
 213                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 214                                                         data_len + ss_padding_len,
 215                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 216                                                         (size_t)prs_offset(&outgoing_pdu),
 217                                                         &auth_blob);
 218                         if (!NT_STATUS_IS_OK(status)) {
 219                                 data_blob_free(&auth_blob);
 220                                 prs_mem_free(&outgoing_pdu);
 221                                 return False;
 222                         }
 223                         break;
 224                 case PIPE_AUTH_LEVEL_INTEGRITY:
 225                         /* Data is signed. */
 226                         status = ntlmssp_sign_packet(a->ntlmssp_state,
 227                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 228                                                         data_len + ss_padding_len,
 229                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 230                                                         (size_t)prs_offset(&outgoing_pdu),
 231                                                         &auth_blob);
 232                         if (!NT_STATUS_IS_OK(status)) {
 233                                 data_blob_free(&auth_blob);
 234                                 prs_mem_free(&outgoing_pdu);
 235                                 return False;
 236                         }
 237                         break;
 238                 default:
 239                         prs_mem_free(&outgoing_pdu);
 240                         return False;
 241         }
 242
 243         /* Append the auth blob. */
 244         if (!prs_copy_data_in(&outgoing_pdu, (char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
 245                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 246                                 (unsigned int)NTLMSSP_SIG_SIZE));
 247                 data_blob_free(&auth_blob);
 248                 prs_mem_free(&outgoing_pdu);
 249                 return False;
 250         }
 251
 252         data_blob_free(&auth_blob);
 253
 254         /*
 255          * Setup the counts for this PDU.
 256          */
 257
 258         p->out_data.data_sent_length += data_len;
 259         p->out_data.current_pdu_len = p->hdr.frag_len;
 260         p->out_data.current_pdu_sent = 0;
 261
 262         prs_mem_free(&outgoing_pdu);
 263         return True;
 264 }
 265
 266 /*******************************************************************
 267  Generate the next PDU to be returned from the data in p->rdata.
 268  Return an schannel authenticated fragment.
 269  ********************************************************************/
 270
 271 static BOOL create_next_pdu_schannel(pipes_struct *p)
 272 {
 273         RPC_HDR_RESP hdr_resp;
 274         uint32 ss_padding_len = 0;
 275         uint32 data_len;
 276         uint32 data_space_available;
 277         uint32 data_len_left;
 278         prs_struct outgoing_pdu;
 279         uint32 data_pos;
 280
 281         /*
 282          * If we're in the fault state, keep returning fault PDU's until
 283          * the pipe gets closed. JRA.
 284          */
 285
 286         if(p->fault_state) {
 287                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 288                 return True;
 289         }
 290
 291         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 292
 293         /* Change the incoming request header to a response. */
 294         p->hdr.pkt_type = RPC_RESPONSE;
 295
 296         /* Set up rpc header flags. */
 297         if (p->out_data.data_sent_length == 0) {
 298                 p->hdr.flags = RPC_FLG_FIRST;
 299         } else {
 300                 p->hdr.flags = 0;
 301         }
 302
 303         /*
 304          * Work out how much we can fit in a single PDU.
 305          */
 306
 307         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 308
 309         /*
 310          * Ensure there really is data left to send.
 311          */
 312
 313         if(!data_len_left) {
 314                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 315                 return False;
 316         }
 317
 318         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 319                                         RPC_HDR_AUTH_LEN - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 320
 321         /*
 322          * The amount we send is the minimum of the available
 323          * space and the amount left to send.
 324          */
 325
 326         data_len = MIN(data_len_left, data_space_available);
 327
 328         /*
 329          * Set up the alloc hint. This should be the data left to
 330          * send.
 331          */
 332
 333         hdr_resp.alloc_hint = data_len_left;
 334
 335         /*
 336          * Work out if this PDU will be the last.
 337          */
 338
 339         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 340                 p->hdr.flags |= RPC_FLG_LAST;
 341                 if (data_len_left % 8) {
 342                         ss_padding_len = 8 - (data_len_left % 8);
 343                         DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 344                                 ss_padding_len ));
 345                 }
 346         }
 347
 348         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 349                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 350         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 351
 352         /*
 353          * Init the parse struct to point at the outgoing
 354          * data.
 355          */
 356
 357         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 358         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 359
 360         /* Store the header in the data stream. */
 361         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 362                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 363                 prs_mem_free(&outgoing_pdu);
 364                 return False;
 365         }
 366
 367         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 368                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 369                 prs_mem_free(&outgoing_pdu);
 370                 return False;
 371         }
 372
 373         /* Store the current offset. */
 374         data_pos = prs_offset(&outgoing_pdu);
 375
 376         /* Copy the data into the PDU. */
 377
 378         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 379                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 380                 prs_mem_free(&outgoing_pdu);
 381                 return False;
 382         }
 383
 384         /* Copy the sign/seal padding data. */
 385         if (ss_padding_len) {
 386                 char pad[8];
 387                 memset(pad, '\0', 8);
 388                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 389                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 390                         prs_mem_free(&outgoing_pdu);
 391                         return False;
 392                 }
 393         }
 394
 395         {
 396                 /*
 397                  * Schannel processing.
 398                  */
 399                 char *data;
 400                 RPC_HDR_AUTH auth_info;
 401                 RPC_AUTH_SCHANNEL_CHK verf;
 402
 403                 data = prs_data_p(&outgoing_pdu) + data_pos;
 404                 /* Check it's the type of reply we were expecting to decode */
 405
 406                 init_rpc_hdr_auth(&auth_info,
 407                                 RPC_SCHANNEL_AUTH_TYPE,
 408                                 p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY ?
 409                                         RPC_AUTH_LEVEL_PRIVACY : RPC_AUTH_LEVEL_INTEGRITY,
 410                                 ss_padding_len, 1);
 411
 412                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 413                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 414                         prs_mem_free(&outgoing_pdu);
 415                         return False;
 416                 }
 417
 418                 schannel_encode(p->auth.a_u.schannel_auth,
 419                               p->auth.auth_level,
 420                               SENDER_IS_ACCEPTOR,
 421                               &verf, data, data_len + ss_padding_len);
 422
 423                 if (!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 424                                 &verf, &outgoing_pdu, 0)) {
 425                         prs_mem_free(&outgoing_pdu);
 426                         return False;
 427                 }
 428
 429                 p->auth.a_u.schannel_auth->seq_num++;
 430         }
 431
 432         /*
 433          * Setup the counts for this PDU.
 434          */
 435
 436         p->out_data.data_sent_length += data_len;
 437         p->out_data.current_pdu_len = p->hdr.frag_len;
 438         p->out_data.current_pdu_sent = 0;
 439
 440         prs_mem_free(&outgoing_pdu);
 441         return True;
 442 }
 443
 444 /*******************************************************************
 445  Generate the next PDU to be returned from the data in p->rdata.
 446  No authentication done.
 447 ********************************************************************/
 448
 449 static BOOL create_next_pdu_noauth(pipes_struct *p)
 450 {
 451         RPC_HDR_RESP hdr_resp;
 452         uint32 data_len;
 453         uint32 data_space_available;
 454         uint32 data_len_left;
 455         prs_struct outgoing_pdu;
 456
 457         /*
 458          * If we're in the fault state, keep returning fault PDU's until
 459          * the pipe gets closed. JRA.
 460          */
 461
 462         if(p->fault_state) {
 463                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 464                 return True;
 465         }
 466
 467         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 468
 469         /* Change the incoming request header to a response. */
 470         p->hdr.pkt_type = RPC_RESPONSE;
 471
 472         /* Set up rpc header flags. */
 473         if (p->out_data.data_sent_length == 0) {
 474                 p->hdr.flags = RPC_FLG_FIRST;
 475         } else {
 476                 p->hdr.flags = 0;
 477         }
 478
 479         /*
 480          * Work out how much we can fit in a single PDU.
 481          */
 482
 483         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 484
 485         /*
 486          * Ensure there really is data left to send.
 487          */
 488
 489         if(!data_len_left) {
 490                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 491                 return False;
 492         }
 493
 494         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 495
 496         /*
 497          * The amount we send is the minimum of the available
 498          * space and the amount left to send.
 499          */
 500
 501         data_len = MIN(data_len_left, data_space_available);
 502
 503         /*
 504          * Set up the alloc hint. This should be the data left to
 505          * send.
 506          */
 507
 508         hdr_resp.alloc_hint = data_len_left;
 509
 510         /*
 511          * Work out if this PDU will be the last.
 512          */
 513
 514         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 515                 p->hdr.flags |= RPC_FLG_LAST;
 516         }
 517
 518         /*
 519          * Set up the header lengths.
 520          */
 521
 522         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 523         p->hdr.auth_len = 0;
 524
 525         /*
 526          * Init the parse struct to point at the outgoing
 527          * data.
 528          */
 529
 530         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 531         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 532
 533         /* Store the header in the data stream. */
 534         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 535                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 536                 prs_mem_free(&outgoing_pdu);
 537                 return False;
 538         }
 539
 540         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 541                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 542                 prs_mem_free(&outgoing_pdu);
 543                 return False;
 544         }
 545
 546         /* Copy the data into the PDU. */
 547
 548         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 549                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 550                 prs_mem_free(&outgoing_pdu);
 551                 return False;
 552         }
 553
 554         /*
 555          * Setup the counts for this PDU.
 556          */
 557
 558         p->out_data.data_sent_length += data_len;
 559         p->out_data.current_pdu_len = p->hdr.frag_len;
 560         p->out_data.current_pdu_sent = 0;
 561
 562         prs_mem_free(&outgoing_pdu);
 563         return True;
 564 }
 565
 566 /*******************************************************************
 567  Generate the next PDU to be returned from the data in p->rdata.
 568 ********************************************************************/
 569
 570 BOOL create_next_pdu(pipes_struct *p)
 571 {
 572         switch(p->auth.auth_level) {
 573                 case PIPE_AUTH_LEVEL_NONE:
 574                 case PIPE_AUTH_LEVEL_CONNECT:
 575                         /* This is incorrect for auth level connect. Fixme. JRA */
 576                         return create_next_pdu_noauth(p);
 577
 578                 default:
 579                         switch(p->auth.auth_type) {
 580                                 case PIPE_AUTH_TYPE_NTLMSSP:
 581                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 582                                         return create_next_pdu_ntlmssp(p);
 583                                 case PIPE_AUTH_TYPE_SCHANNEL:
 584                                         return create_next_pdu_schannel(p);
 585                                 default:
 586                                         break;
 587                         }
 588         }
 589
 590         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 591                         (unsigned int)p->auth.auth_level,
 592                         (unsigned int)p->auth.auth_type));
 593         return False;
 594 }
 595
 596 /*******************************************************************
 597  Process an NTLMSSP authentication response.
 598  If this function succeeds, the user has been authenticated
 599  and their domain, name and calling workstation stored in
 600  the pipe struct.
 601 *******************************************************************/
 602
 603 static BOOL pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 604 {
 605         DATA_BLOB reply;
 606         NTSTATUS status;
 607         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
 608
 609         DEBUG(5,("pipe_ntlmssp_verify_final: checking user details\n"));
 610
 611         ZERO_STRUCT(reply);
 612
 613         memset(p->user_name, '\0', sizeof(p->user_name));
 614         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 615         memset(p->domain, '\0', sizeof(p->domain));
 616         memset(p->wks, '\0', sizeof(p->wks));
 617
 618         /* Set up for non-authenticated user. */
 619         talloc_free(p->pipe_user.nt_user_token);
 620         p->pipe_user.ut.ngroups = 0;
 621         SAFE_FREE( p->pipe_user.ut.groups);
 622
 623         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 624
 625         /* Don't generate a reply. */
 626         data_blob_free(&reply);
 627
 628         if (!NT_STATUS_IS_OK(status)) {
 629                 return False;
 630         }
 631
 632         fstrcpy(p->user_name, a->ntlmssp_state->user);
 633         fstrcpy(p->pipe_user_name, a->server_info->unix_name);
 634         fstrcpy(p->domain, a->ntlmssp_state->domain);
 635         fstrcpy(p->wks, a->ntlmssp_state->workstation);
 636
 637         DEBUG(5,("pipe_ntlmssp_verify_final: OK: user: %s domain: %s workstation: %s\n",
 638                 p->user_name, p->domain, p->wks));
 639
 640         /*
 641          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 642          */
 643
 644         p->pipe_user.ut.uid = a->server_info->uid;
 645         p->pipe_user.ut.gid = a->server_info->gid;
 646
 647         /*
 648          * Copy the session key from the ntlmssp state.
 649          */
 650
 651         data_blob_free(&p->session_key);
 652         p->session_key = data_blob(a->ntlmssp_state->session_key.data, a->ntlmssp_state->session_key.length);
 653         if (!p->session_key.data) {
 654                 return False;
 655         }
 656
 657         p->pipe_user.ut.ngroups = a->server_info->n_groups;
 658         if (p->pipe_user.ut.ngroups) {
 659                 if (!(p->pipe_user.ut.groups = memdup(a->server_info->groups,
 660                                                 sizeof(gid_t) * p->pipe_user.ut.ngroups))) {
 661                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 662                         return False;
 663                 }
 664         }
 665
 666         if (a->server_info->ptok) {
 667                 p->pipe_user.nt_user_token =
 668                         dup_nt_token(NULL, a->server_info->ptok);
 669         } else {
 670                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 671                 p->pipe_user.nt_user_token = NULL;
 672                 return False;
 673         }
 674
 675         return True;
 676 }
 677
 678 /*******************************************************************
 679  The switch table for the pipe names and the functions to handle them.
 680 *******************************************************************/
 681
 682 struct rpc_table {
 683         struct {
 684                 const char *clnt;
 685                 const char *srv;
 686         } pipe;
 687         struct api_struct *cmds;
 688         int n_cmds;
 689 };
 690
 691 static struct rpc_table *rpc_lookup;
 692 static int rpc_lookup_size;
 693
 694 /*******************************************************************
 695  This is the "stage3" NTLMSSP response after a bind request and reply.
 696 *******************************************************************/
 697
 698 BOOL api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 699 {
 700         RPC_HDR_AUTH auth_info;
 701         uint32 pad;
 702         DATA_BLOB blob;
 703
 704         ZERO_STRUCT(blob);
 705
 706         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 707
 708         if (p->hdr.auth_len == 0) {
 709                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 710                 goto err;
 711         }
 712
 713         /* 4 bytes padding. */
 714         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 715                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 716                 goto err;
 717         }
 718
 719         /*
 720          * Decode the authentication verifier response.
 721          */
 722
 723         if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 724                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
 725                 goto err;
 726         }
 727
 728         if (auth_info.auth_type != RPC_NTLMSSP_AUTH_TYPE) {
 729                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 730                         (unsigned int)auth_info.auth_type ));
 731                 return False;
 732         }
 733
 734         blob = data_blob(NULL,p->hdr.auth_len);
 735
 736         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 737                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 738                         (unsigned int)p->hdr.auth_len ));
 739                 goto err;
 740         }
 741
 742         /*
 743          * The following call actually checks the challenge/response data.
 744          * for correctness against the given DOMAIN\user name.
 745          */
 746
 747         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 748                 goto err;
 749         }
 750
 751         data_blob_free(&blob);
 752
 753         p->pipe_bound = True;
 754
 755         return True;
 756
 757  err:
 758
 759         data_blob_free(&blob);
 760         free_pipe_ntlmssp_auth_data(&p->auth);
 761         p->auth.a_u.auth_ntlmssp_state = NULL;
 762
 763         return False;
 764 }
 765
 766 /*******************************************************************
 767  Marshall a bind_nak pdu.
 768 *******************************************************************/
 769
 770 static BOOL setup_bind_nak(pipes_struct *p)
 771 {
 772         prs_struct outgoing_rpc;
 773         RPC_HDR nak_hdr;
 774         uint16 zero = 0;
 775
 776         /* Free any memory in the current return data buffer. */
 777         prs_mem_free(&p->out_data.rdata);
 778
 779         /*
 780          * Marshall directly into the outgoing PDU space. We
 781          * must do this as we need to set to the bind response
 782          * header and are never sending more than one PDU here.
 783          */
 784
 785         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 786         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 787
 788         /*
 789          * Initialize a bind_nak header.
 790          */
 791
 792         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 793                 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 794
 795         /*
 796          * Marshall the header into the outgoing PDU.
 797          */
 798
 799         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 800                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 801                 prs_mem_free(&outgoing_rpc);
 802                 return False;
 803         }
 804
 805         /*
 806          * Now add the reject reason.
 807          */
 808
 809         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 810                 prs_mem_free(&outgoing_rpc);
 811                 return False;
 812         }
 813
 814         p->out_data.data_sent_length = 0;
 815         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 816         p->out_data.current_pdu_sent = 0;
 817
 818         if (p->auth.auth_data_free_func) {
 819                 (*p->auth.auth_data_free_func)(&p->auth);
 820         }
 821         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
 822         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 823         p->pipe_bound = False;
 824
 825         return True;
 826 }
 827
 828 /*******************************************************************
 829  Marshall a fault pdu.
 830 *******************************************************************/
 831
 832 BOOL setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 833 {
 834         prs_struct outgoing_pdu;
 835         RPC_HDR fault_hdr;
 836         RPC_HDR_RESP hdr_resp;
 837         RPC_HDR_FAULT fault_resp;
 838
 839         /* Free any memory in the current return data buffer. */
 840         prs_mem_free(&p->out_data.rdata);
 841
 842         /*
 843          * Marshall directly into the outgoing PDU space. We
 844          * must do this as we need to set to the bind response
 845          * header and are never sending more than one PDU here.
 846          */
 847
 848         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 849         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 850
 851         /*
 852          * Initialize a fault header.
 853          */
 854
 855         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 856             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 857
 858         /*
 859          * Initialize the HDR_RESP and FAULT parts of the PDU.
 860          */
 861
 862         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 863
 864         fault_resp.status = status;
 865         fault_resp.reserved = 0;
 866
 867         /*
 868          * Marshall the header into the outgoing PDU.
 869          */
 870
 871         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 872                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 873                 prs_mem_free(&outgoing_pdu);
 874                 return False;
 875         }
 876
 877         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 878                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 879                 prs_mem_free(&outgoing_pdu);
 880                 return False;
 881         }
 882
 883         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 884                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 885                 prs_mem_free(&outgoing_pdu);
 886                 return False;
 887         }
 888
 889         p->out_data.data_sent_length = 0;
 890         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 891         p->out_data.current_pdu_sent = 0;
 892
 893         prs_mem_free(&outgoing_pdu);
 894         return True;
 895 }
 896
 897 #if 0
 898 /*******************************************************************
 899  Marshall a cancel_ack pdu.
 900  We should probably check the auth-verifier here.
 901 *******************************************************************/
 902
 903 BOOL setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
 904 {
 905         prs_struct outgoing_pdu;
 906         RPC_HDR ack_reply_hdr;
 907
 908         /* Free any memory in the current return data buffer. */
 909         prs_mem_free(&p->out_data.rdata);
 910
 911         /*
 912          * Marshall directly into the outgoing PDU space. We
 913          * must do this as we need to set to the bind response
 914          * header and are never sending more than one PDU here.
 915          */
 916
 917         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 918         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 919
 920         /*
 921          * Initialize a cancel_ack header.
 922          */
 923
 924         init_rpc_hdr(&ack_reply_hdr, RPC_CANCEL_ACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 925                         p->hdr.call_id, RPC_HEADER_LEN, 0);
 926
 927         /*
 928          * Marshall the header into the outgoing PDU.
 929          */
 930
 931         if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
 932                 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
 933                 prs_mem_free(&outgoing_pdu);
 934                 return False;
 935         }
 936
 937         p->out_data.data_sent_length = 0;
 938         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 939         p->out_data.current_pdu_sent = 0;
 940
 941         prs_mem_free(&outgoing_pdu);
 942         return True;
 943 }
 944 #endif
 945
 946 /*******************************************************************
 947  Ensure a bind request has the correct abstract & transfer interface.
 948  Used to reject unknown binds from Win2k.
 949 *******************************************************************/
 950
 951 BOOL check_bind_req(struct pipes_struct *p, RPC_IFACE* abstract,
 952                     RPC_IFACE* transfer, uint32 context_id)
 953 {
 954         char *pipe_name = p->name;
 955         int i=0;
 956         fstring pname;
 957
 958         fstrcpy(pname,"\\PIPE\\");
 959         fstrcat(pname,pipe_name);
 960
 961         DEBUG(3,("check_bind_req for %s\n", pname));
 962
 963         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 964
 965         for ( i=0; pipe_names[i].client_pipe; i++ ) {
 966                 DEBUG(10,("checking %s\n", pipe_names[i].client_pipe));
 967                 if ( strequal(pipe_names[i].client_pipe, pname)
 968                         && (abstract->version == pipe_names[i].abstr_syntax.version)
 969                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(struct uuid)) == 0)
 970                         && (transfer->version == pipe_names[i].trans_syntax.version)
 971                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(struct uuid)) == 0) ) {
 972                         struct api_struct       *fns = NULL;
 973                         int                     n_fns = 0;
 974                         PIPE_RPC_FNS            *context_fns;
 975
 976                         if ( !(context_fns = SMB_MALLOC_P(PIPE_RPC_FNS)) ) {
 977                                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 978                                 return False;
 979                         }
 980
 981                         /* save the RPC function table associated with this bind */
 982
 983                         get_pipe_fns(i, &fns, &n_fns);
 984
 985                         context_fns->cmds = fns;
 986                         context_fns->n_cmds = n_fns;
 987                         context_fns->context_id = context_id;
 988
 989                         /* add to the list of open contexts */
 990
 991                         DLIST_ADD( p->contexts, context_fns );
 992
 993                         break;
 994                 }
 995         }
 996
 997         if(pipe_names[i].client_pipe == NULL) {
 998                 return False;
 999         }
1000
1001         return True;
1002 }
1003
1004 /*******************************************************************
1005  Register commands to an RPC pipe
1006 *******************************************************************/
1007
1008 NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *srv, const struct api_struct *cmds, int size)
1009 {
1010         struct rpc_table *rpc_entry;
1011
1012         if (!clnt || !srv || !cmds) {
1013                 return NT_STATUS_INVALID_PARAMETER;
1014         }
1015
1016         if (version != SMB_RPC_INTERFACE_VERSION) {
1017                 DEBUG(0,("Can't register rpc commands!\n"
1018                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1019                          ", while this version of samba uses version %d!\n",
1020                          version,SMB_RPC_INTERFACE_VERSION));
1021                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1022         }
1023
1024         /* TODO:
1025          *
1026          * we still need to make sure that don't register the same commands twice!!!
1027          *
1028          * --metze
1029          */
1030
1031         /* We use a temporary variable because this call can fail and
1032            rpc_lookup will still be valid afterwards.  It could then succeed if
1033            called again later */
1034         rpc_lookup_size++;
1035         rpc_entry = SMB_REALLOC_ARRAY(rpc_lookup, struct rpc_table, rpc_lookup_size);
1036         if (NULL == rpc_entry) {
1037                 rpc_lookup_size--;
1038                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1039                 return NT_STATUS_NO_MEMORY;
1040         } else {
1041                 rpc_lookup = rpc_entry;
1042         }
1043
1044         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1045         ZERO_STRUCTP(rpc_entry);
1046         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1047         rpc_entry->pipe.srv = SMB_STRDUP(srv);
1048         rpc_entry->cmds = SMB_REALLOC_ARRAY(rpc_entry->cmds, struct api_struct, rpc_entry->n_cmds + size);
1049         memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds, size * sizeof(struct api_struct));
1050         rpc_entry->n_cmds += size;
1051
1052         return NT_STATUS_OK;
1053 }
1054
1055 /*******************************************************************
1056  Handle a SPNEGO krb5 bind auth.
1057 *******************************************************************/
1058
1059 static BOOL pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1060                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1061 {
1062         return False;
1063 }
1064
1065 /*******************************************************************
1066  Handle the first part of a SPNEGO bind auth.
1067 *******************************************************************/
1068
1069 static BOOL pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1070                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1071 {
1072         DATA_BLOB blob;
1073         DATA_BLOB secblob;
1074         DATA_BLOB response;
1075         DATA_BLOB chal;
1076         char *OIDs[ASN1_MAX_OIDS];
1077         int i;
1078         NTSTATUS status;
1079         BOOL got_kerberos_mechanism = False;
1080         AUTH_NTLMSSP_STATE *a = NULL;
1081         RPC_HDR_AUTH auth_info;
1082
1083         ZERO_STRUCT(secblob);
1084         ZERO_STRUCT(chal);
1085         ZERO_STRUCT(response);
1086
1087         /* Grab the SPNEGO blob. */
1088         blob = data_blob(NULL,p->hdr.auth_len);
1089
1090         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1091                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1092                         (unsigned int)p->hdr.auth_len ));
1093                 goto err;
1094         }
1095
1096         if (blob.data[0] != ASN1_APPLICATION(0)) {
1097                 goto err;
1098         }
1099
1100         /* parse out the OIDs and the first sec blob */
1101         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1102                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1103                 goto err;
1104         }
1105
1106         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1107                 got_kerberos_mechanism = True;
1108         }
1109
1110         for (i=0;OIDs[i];i++) {
1111                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1112                 SAFE_FREE(OIDs[i]);
1113         }
1114         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1115
1116         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || lp_use_kerberos_keytab()) ) {
1117                 BOOL ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1118                 data_blob_free(&secblob);
1119                 data_blob_free(&blob);
1120                 return ret;
1121         }
1122
1123         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1124                 /* Free any previous auth type. */
1125                 free_pipe_ntlmssp_auth_data(&p->auth);
1126         }
1127
1128         /* Initialize the NTLM engine. */
1129         status = auth_ntlmssp_start(&a);
1130         if (!NT_STATUS_IS_OK(status)) {
1131                 goto err;
1132         }
1133
1134         /*
1135          * Pass the first security blob of data to it.
1136          * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1137          * which means we need another packet to complete the bind.
1138          */
1139
1140         status = auth_ntlmssp_update(a, secblob, &chal);
1141
1142         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1143                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1144                 goto err;
1145         }
1146
1147         /* Generate the response blob we need for step 2 of the bind. */
1148         response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1149
1150         /* Copy the blob into the pout_auth parse struct */
1151         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1152         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1153                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1154                 goto err;
1155         }
1156
1157         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1158                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1159                 goto err;
1160         }
1161
1162         p->auth.a_u.auth_ntlmssp_state = a;
1163         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1164         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1165
1166         data_blob_free(&blob);
1167         data_blob_free(&secblob);
1168         data_blob_free(&chal);
1169         data_blob_free(&response);
1170
1171         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1172         return True;
1173
1174  err:
1175
1176         data_blob_free(&blob);
1177         data_blob_free(&secblob);
1178         data_blob_free(&chal);
1179         data_blob_free(&response);
1180
1181         p->auth.a_u.auth_ntlmssp_state = NULL;
1182
1183         return False;
1184 }
1185
1186 /*******************************************************************
1187  Handle the second part of a SPNEGO bind auth.
1188 *******************************************************************/
1189
1190 static BOOL pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1191                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1192 {
1193         RPC_HDR_AUTH auth_info;
1194         DATA_BLOB spnego_blob;
1195         DATA_BLOB auth_blob;
1196         DATA_BLOB auth_reply;
1197         DATA_BLOB response;
1198         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1199
1200         ZERO_STRUCT(spnego_blob);
1201         ZERO_STRUCT(auth_blob);
1202         ZERO_STRUCT(auth_reply);
1203         ZERO_STRUCT(response);
1204
1205         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1206                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1207                 goto err;
1208         }
1209
1210         /* Grab the SPNEGO blob. */
1211         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1212
1213         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1214                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1215                         (unsigned int)p->hdr.auth_len ));
1216                 goto err;
1217         }
1218
1219         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1220                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1221                 goto err;
1222         }
1223
1224         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1225                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1226                 goto err;
1227         }
1228
1229         /*
1230          * The following call actually checks the challenge/response data.
1231          * for correctness against the given DOMAIN\user name.
1232          */
1233
1234         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1235                 goto err;
1236         }
1237
1238         data_blob_free(&spnego_blob);
1239         data_blob_free(&auth_blob);
1240
1241         /* Generate the spnego "accept completed" blob - no incoming data. */
1242         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1243
1244         /* Copy the blob into the pout_auth parse struct */
1245         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1246         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1247                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1248                 goto err;
1249         }
1250
1251         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1252                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1253                 goto err;
1254         }
1255
1256         data_blob_free(&auth_reply);
1257         data_blob_free(&response);
1258
1259         p->pipe_bound = True;
1260
1261         return True;
1262
1263  err:
1264
1265         data_blob_free(&spnego_blob);
1266         data_blob_free(&auth_blob);
1267         data_blob_free(&auth_reply);
1268         data_blob_free(&response);
1269
1270         free_pipe_ntlmssp_auth_data(&p->auth);
1271         p->auth.a_u.auth_ntlmssp_state = NULL;
1272
1273         return False;
1274 }
1275
1276 /*******************************************************************
1277  Handle an schannel bind auth.
1278 *******************************************************************/
1279
1280 static BOOL pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1281                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1282 {
1283         RPC_HDR_AUTH auth_info;
1284         RPC_AUTH_SCHANNEL_NEG neg;
1285         RPC_AUTH_VERIFIER auth_verifier;
1286         BOOL ret;
1287         struct dcinfo *pdcinfo;
1288         uint32 flags;
1289
1290         if (!smb_io_rpc_auth_schannel_neg("", &neg, rpc_in_p, 0)) {
1291                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1292                 return False;
1293         }
1294
1295         become_root();
1296         ret = secrets_restore_schannel_session_info(p->mem_ctx, neg.myname, &pdcinfo);
1297         unbecome_root();
1298
1299         if (!ret) {
1300                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1301                 return False;
1302         }
1303
1304         p->auth.a_u.schannel_auth = TALLOC_P(p->pipe_state_mem_ctx, struct schannel_auth_struct);
1305         if (!p->auth.a_u.schannel_auth) {
1306                 talloc_free(pdcinfo);
1307                 return False;
1308         }
1309
1310         memset(p->auth.a_u.schannel_auth->sess_key, 0, sizeof(p->auth.a_u.schannel_auth->sess_key));
1311         memcpy(p->auth.a_u.schannel_auth->sess_key, pdcinfo->sess_key,
1312                         sizeof(pdcinfo->sess_key));
1313
1314         talloc_free(pdcinfo);
1315
1316         p->auth.a_u.schannel_auth->seq_num = 0;
1317
1318         /*
1319          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1320          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1321          * struct of the person who opened the pipe. I need to test this further. JRA.
1322          */
1323
1324         init_rpc_hdr_auth(&auth_info, RPC_SCHANNEL_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1325         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1326                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1327                 return False;
1328         }
1329
1330         /*** SCHANNEL verifier ***/
1331
1332         init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1333         if(!smb_io_rpc_schannel_verifier("", &auth_verifier, pout_auth, 0)) {
1334                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1335                 return False;
1336         }
1337
1338         prs_align(pout_auth);
1339
1340         flags = 5;
1341         if(!prs_uint32("flags ", pout_auth, 0, &flags)) {
1342                 return False;
1343         }
1344
1345         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1346                 neg.domain, neg.myname));
1347
1348         /* We're finished with this bind - no more packets. */
1349         p->auth.auth_data_free_func = NULL;
1350         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1351
1352         p->pipe_bound = True;
1353
1354         return True;
1355 }
1356
1357 /*******************************************************************
1358  Handle an NTLMSSP bind auth.
1359 *******************************************************************/
1360
1361 static BOOL pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1362                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1363 {
1364         RPC_HDR_AUTH auth_info;
1365         DATA_BLOB blob;
1366         DATA_BLOB response;
1367         NTSTATUS status;
1368         AUTH_NTLMSSP_STATE *a = NULL;
1369
1370         ZERO_STRUCT(blob);
1371         ZERO_STRUCT(response);
1372
1373         /* Grab the NTLMSSP blob. */
1374         blob = data_blob(NULL,p->hdr.auth_len);
1375
1376         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1377                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1378                         (unsigned int)p->hdr.auth_len ));
1379                 goto err;
1380         }
1381
1382         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1383                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1384                 goto err;
1385         }
1386
1387         /* We have an NTLMSSP blob. */
1388         status = auth_ntlmssp_start(&a);
1389         if (!NT_STATUS_IS_OK(status)) {
1390                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1391                         nt_errstr(status) ));
1392                 goto err;
1393         }
1394
1395         status = auth_ntlmssp_update(a, blob, &response);
1396         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1397                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1398                         nt_errstr(status) ));
1399                 goto err;
1400         }
1401
1402         data_blob_free(&blob);
1403
1404         /* Copy the blob into the pout_auth parse struct */
1405         init_rpc_hdr_auth(&auth_info, RPC_NTLMSSP_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1406         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1407                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1408                 goto err;
1409         }
1410
1411         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1412                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1413                 goto err;
1414         }
1415
1416         p->auth.a_u.auth_ntlmssp_state = a;
1417         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1418         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1419
1420         data_blob_free(&blob);
1421         data_blob_free(&response);
1422
1423         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1424
1425         /* We can't set pipe_bound True yet - we need an RPC_AUTH3 response packet... */
1426         return True;
1427
1428   err:
1429
1430         data_blob_free(&blob);
1431         data_blob_free(&response);
1432
1433         free_pipe_ntlmssp_auth_data(&p->auth);
1434         p->auth.a_u.auth_ntlmssp_state = NULL;
1435         return False;
1436 }
1437
1438 /*******************************************************************
1439  Respond to a pipe bind request.
1440 *******************************************************************/
1441
1442 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1443 {
1444         RPC_HDR_BA hdr_ba;
1445         RPC_HDR_RB hdr_rb;
1446         RPC_HDR_AUTH auth_info;
1447         uint16 assoc_gid;
1448         fstring ack_pipe_name;
1449         prs_struct out_hdr_ba;
1450         prs_struct out_auth;
1451         prs_struct outgoing_rpc;
1452         int i = 0;
1453         int auth_len = 0;
1454         unsigned int auth_type = RPC_ANONYMOUS_AUTH_TYPE;
1455
1456         /* No rebinds on a bound pipe - use alter context. */
1457         if (p->pipe_bound) {
1458                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound pipe %s.\n", p->pipe_srv_name));
1459                 return setup_bind_nak(p);
1460         }
1461
1462         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
1463
1464         /*
1465          * Marshall directly into the outgoing PDU space. We
1466          * must do this as we need to set to the bind response
1467          * header and are never sending more than one PDU here.
1468          */
1469
1470         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1471
1472         /*
1473          * Setup the memory to marshall the ba header, and the
1474          * auth footers.
1475          */
1476
1477         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1478                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1479                 prs_mem_free(&outgoing_rpc);
1480                 return False;
1481         }
1482
1483         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1484                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1485                 prs_mem_free(&outgoing_rpc);
1486                 prs_mem_free(&out_hdr_ba);
1487                 return False;
1488         }
1489
1490         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1491
1492         /*
1493          * Try and find the correct pipe name to ensure
1494          * that this is a pipe name we support.
1495          */
1496
1497
1498         for (i = 0; i < rpc_lookup_size; i++) {
1499                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1500                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1501                                 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1502                         fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1503                         break;
1504                 }
1505         }
1506
1507         if (i == rpc_lookup_size) {
1508                 if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) {
1509                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1510                                 p->name ));
1511                         prs_mem_free(&outgoing_rpc);
1512                         prs_mem_free(&out_hdr_ba);
1513                         prs_mem_free(&out_auth);
1514
1515                         return setup_bind_nak(p);
1516                 }
1517
1518                 for (i = 0; i < rpc_lookup_size; i++) {
1519                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1520                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1521                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1522                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1523                                break;
1524                        }
1525                 }
1526
1527                 if (i == rpc_lookup_size) {
1528                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
1529                         goto err_exit;
1530                 }
1531         }
1532
1533         /* decode the bind request */
1534         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1535                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
1536                 goto err_exit;
1537         }
1538
1539         /* name has to be \PIPE\xxxxx */
1540         fstrcpy(ack_pipe_name, "\\PIPE\\");
1541         fstrcat(ack_pipe_name, p->pipe_srv_name);
1542
1543         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1544
1545         /*
1546          * Check if this is an authenticated bind request.
1547          */
1548
1549         if (p->hdr.auth_len) {
1550                 /*
1551                  * Decode the authentication verifier.
1552                  */
1553
1554                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1555                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1556                         goto err_exit;
1557                 }
1558
1559                 auth_type = auth_info.auth_type;
1560
1561                 /* Work out if we have to sign or seal etc. */
1562                 switch (auth_info.auth_level) {
1563                         case RPC_AUTH_LEVEL_INTEGRITY:
1564                                 p->auth.auth_level = PIPE_AUTH_LEVEL_INTEGRITY;
1565                                 break;
1566                         case RPC_AUTH_LEVEL_PRIVACY:
1567                                 p->auth.auth_level = PIPE_AUTH_LEVEL_PRIVACY;
1568                                 break;
1569                         default:
1570                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1571                                         (unsigned int)auth_info.auth_level ));
1572                                 goto err_exit;
1573                 }
1574         } else {
1575                 ZERO_STRUCT(auth_info);
1576         }
1577
1578         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1579
1580         switch(auth_type) {
1581                 case RPC_NTLMSSP_AUTH_TYPE:
1582                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1583                                 goto err_exit;
1584                         }
1585                         assoc_gid = 0x7a77;
1586                         break;
1587
1588                 case RPC_SCHANNEL_AUTH_TYPE:
1589                         if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1590                                 goto err_exit;
1591                         }
1592                         break;
1593
1594                 case RPC_SPNEGO_AUTH_TYPE:
1595                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1596                                 goto err_exit;
1597                         }
1598                         break;
1599
1600                 case RPC_ANONYMOUS_AUTH_TYPE:
1601                         /* Unauthenticated bind request. */
1602                         /* We're finished - no more packets. */
1603                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1604                         /* We must set the pipe auth_level here also. */
1605                         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
1606                         p->pipe_bound = True;
1607                         break;
1608
1609                 default:
1610                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1611                         goto err_exit;
1612         }
1613
1614         /*
1615          * Create the bind response struct.
1616          */
1617
1618         /* If the requested abstract synt uuid doesn't match our client pipe,
1619                 reject the bind_ack & set the transfer interface synt to all 0's,
1620                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1621                 unknown to NT4)
1622                 Needed when adding entries to a DACL from NT5 - SK */
1623
1624         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1625                                 hdr_rb.rpc_context[0].context_id )) {
1626                 init_rpc_hdr_ba(&hdr_ba,
1627                         RPC_MAX_PDU_FRAG_LEN,
1628                         RPC_MAX_PDU_FRAG_LEN,
1629                         assoc_gid,
1630                         ack_pipe_name,
1631                         0x1, 0x0, 0x0,
1632                         &hdr_rb.rpc_context[0].transfer[0]);
1633         } else {
1634                 RPC_IFACE null_interface;
1635                 ZERO_STRUCT(null_interface);
1636                 /* Rejection reason: abstract syntax not supported */
1637                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1638                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1639                                         ack_pipe_name, 0x1, 0x2, 0x1,
1640                                         &null_interface);
1641                 p->pipe_bound = False;
1642         }
1643
1644         /*
1645          * and marshall it.
1646          */
1647
1648         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1649                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1650                 goto err_exit;
1651         }
1652
1653         /*
1654          * Create the header, now we know the length.
1655          */
1656
1657         if (prs_offset(&out_auth)) {
1658                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1659         }
1660
1661         init_rpc_hdr(&p->hdr, RPC_BINDACK, RPC_FLG_FIRST | RPC_FLG_LAST,
1662                         p->hdr.call_id,
1663                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1664                         auth_len);
1665
1666         /*
1667          * Marshall the header into the outgoing PDU.
1668          */
1669
1670         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1671                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1672                 goto err_exit;
1673         }
1674
1675         /*
1676          * Now add the RPC_HDR_BA and any auth needed.
1677          */
1678
1679         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1680                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1681                 goto err_exit;
1682         }
1683
1684         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1685                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1686                 goto err_exit;
1687         }
1688
1689         /*
1690          * Setup the lengths for the initial reply.
1691          */
1692
1693         p->out_data.data_sent_length = 0;
1694         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1695         p->out_data.current_pdu_sent = 0;
1696
1697         prs_mem_free(&out_hdr_ba);
1698         prs_mem_free(&out_auth);
1699
1700         return True;
1701
1702   err_exit:
1703
1704         prs_mem_free(&outgoing_rpc);
1705         prs_mem_free(&out_hdr_ba);
1706         prs_mem_free(&out_auth);
1707         return setup_bind_nak(p);
1708 }
1709
1710 /****************************************************************************
1711  Deal with an alter context call. Can be third part of 3 leg auth request for
1712  SPNEGO calls.
1713 ****************************************************************************/
1714
1715 BOOL api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1716 {
1717         RPC_HDR_BA hdr_ba;
1718         RPC_HDR_RB hdr_rb;
1719         RPC_HDR_AUTH auth_info;
1720         uint16 assoc_gid;
1721         fstring ack_pipe_name;
1722         prs_struct out_hdr_ba;
1723         prs_struct out_auth;
1724         prs_struct outgoing_rpc;
1725         int auth_len = 0;
1726
1727         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
1728
1729         /*
1730          * Marshall directly into the outgoing PDU space. We
1731          * must do this as we need to set to the bind response
1732          * header and are never sending more than one PDU here.
1733          */
1734
1735         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1736
1737         /*
1738          * Setup the memory to marshall the ba header, and the
1739          * auth footers.
1740          */
1741
1742         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1743                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1744                 prs_mem_free(&outgoing_rpc);
1745                 return False;
1746         }
1747
1748         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1749                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1750                 prs_mem_free(&outgoing_rpc);
1751                 prs_mem_free(&out_hdr_ba);
1752                 return False;
1753         }
1754
1755         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1756
1757         /* decode the alter context request */
1758         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1759                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1760                 goto err_exit;
1761         }
1762
1763         /* secondary address CAN be NULL
1764          * as the specs say it's ignored.
1765          * It MUST be NULL to have the spoolss working.
1766          */
1767         fstrcpy(ack_pipe_name,"");
1768
1769         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1770
1771         /*
1772          * Check if this is an authenticated alter context request.
1773          */
1774
1775         if (p->hdr.auth_len != 0) {
1776                 /*
1777                  * Decode the authentication verifier.
1778                  */
1779
1780                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1781                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1782                         goto err_exit;
1783                 }
1784
1785                 /*
1786                  * Currently only the SPNEGO auth type uses the alter ctx
1787                  * response in place of the NTLMSSP auth3 type.
1788                  */
1789
1790                 if (auth_info.auth_type == RPC_SPNEGO_AUTH_TYPE) {
1791                         /* We can only finish if the pipe is unbound. */
1792                         if (!p->pipe_bound) {
1793                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1794                                         goto err_exit;
1795                                 }
1796                         } else {
1797                                 goto err_exit;
1798                         }
1799                 }
1800         } else {
1801                 ZERO_STRUCT(auth_info);
1802         }
1803
1804         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1805
1806         /*
1807          * Create the bind response struct.
1808          */
1809
1810         /* If the requested abstract synt uuid doesn't match our client pipe,
1811                 reject the bind_ack & set the transfer interface synt to all 0's,
1812                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1813                 unknown to NT4)
1814                 Needed when adding entries to a DACL from NT5 - SK */
1815
1816         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1817                                 hdr_rb.rpc_context[0].context_id )) {
1818                 init_rpc_hdr_ba(&hdr_ba,
1819                         RPC_MAX_PDU_FRAG_LEN,
1820                         RPC_MAX_PDU_FRAG_LEN,
1821                         assoc_gid,
1822                         ack_pipe_name,
1823                         0x1, 0x0, 0x0,
1824                         &hdr_rb.rpc_context[0].transfer[0]);
1825         } else {
1826                 RPC_IFACE null_interface;
1827                 ZERO_STRUCT(null_interface);
1828                 /* Rejection reason: abstract syntax not supported */
1829                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1830                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1831                                         ack_pipe_name, 0x1, 0x2, 0x1,
1832                                         &null_interface);
1833                 p->pipe_bound = False;
1834         }
1835
1836         /*
1837          * and marshall it.
1838          */
1839
1840         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1841                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1842                 goto err_exit;
1843         }
1844
1845         /*
1846          * Create the header, now we know the length.
1847          */
1848
1849         if (prs_offset(&out_auth)) {
1850                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1851         }
1852
1853         init_rpc_hdr(&p->hdr, RPC_ALTCONTRESP, RPC_FLG_FIRST | RPC_FLG_LAST,
1854                         p->hdr.call_id,
1855                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1856                         auth_len);
1857
1858         /*
1859          * Marshall the header into the outgoing PDU.
1860          */
1861
1862         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1863                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
1864                 goto err_exit;
1865         }
1866
1867         /*
1868          * Now add the RPC_HDR_BA and any auth needed.
1869          */
1870
1871         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1872                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
1873                 goto err_exit;
1874         }
1875
1876         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1877                 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
1878                 goto err_exit;
1879         }
1880
1881         /*
1882          * Setup the lengths for the initial reply.
1883          */
1884
1885         p->out_data.data_sent_length = 0;
1886         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1887         p->out_data.current_pdu_sent = 0;
1888
1889         prs_mem_free(&out_hdr_ba);
1890         prs_mem_free(&out_auth);
1891
1892         return True;
1893
1894   err_exit:
1895
1896         prs_mem_free(&outgoing_rpc);
1897         prs_mem_free(&out_hdr_ba);
1898         prs_mem_free(&out_auth);
1899         return setup_bind_nak(p);
1900 }
1901
1902 /****************************************************************************
1903  Deal with NTLMSSP sign & seal processing on an RPC request.
1904 ****************************************************************************/
1905
1906 BOOL api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
1907                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
1908 {
1909         RPC_HDR_AUTH auth_info;
1910         uint32 auth_len = p->hdr.auth_len;
1911         uint32 save_offset = prs_offset(rpc_in);
1912         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1913         unsigned char *data = NULL;
1914         size_t data_len;
1915         unsigned char *full_packet_data = NULL;
1916         size_t full_packet_data_len;
1917         DATA_BLOB auth_blob;
1918
1919         *pstatus = NT_STATUS_OK;
1920
1921         if (p->auth.auth_level == PIPE_AUTH_LEVEL_NONE || p->auth.auth_level == PIPE_AUTH_LEVEL_CONNECT) {
1922                 return True;
1923         }
1924
1925         if (!a) {
1926                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1927                 return False;
1928         }
1929
1930         /* Ensure there's enough data for an authenticated request. */
1931         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
1932                         (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
1933                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
1934                         (unsigned int)auth_len ));
1935                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1936                 return False;
1937         }
1938
1939         /*
1940          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
1941          * after the RPC header.
1942          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
1943          * functions as NTLMv2 checks the rpc headers also.
1944          */
1945
1946         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
1947         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
1948
1949         full_packet_data = p->in_data.current_in_pdu;
1950         full_packet_data_len = p->hdr.frag_len - auth_len;
1951
1952         /* Pull the auth header and the following data into a blob. */
1953         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
1954                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
1955                         (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
1956                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1957                 return False;
1958         }
1959
1960         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1961                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1962                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1963                 return False;
1964         }
1965
1966         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
1967         auth_blob.length = auth_len;
1968
1969         switch (p->auth.auth_level) {
1970                 case PIPE_AUTH_LEVEL_PRIVACY:
1971                         /* Data is encrypted. */
1972                         *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
1973                                                         data, data_len,
1974                                                         full_packet_data,
1975                                                         full_packet_data_len,
1976                                                         &auth_blob);
1977                         if (!NT_STATUS_IS_OK(*pstatus)) {
1978                                 return False;
1979                         }
1980                         break;
1981                 case PIPE_AUTH_LEVEL_INTEGRITY:
1982                         /* Data is signed. */
1983                         *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
1984                                                         data, data_len,
1985                                                         full_packet_data,
1986                                                         full_packet_data_len,
1987                                                         &auth_blob);
1988                         if (!NT_STATUS_IS_OK(*pstatus)) {
1989                                 return False;
1990                         }
1991                         break;
1992                 default:
1993                         *pstatus = NT_STATUS_INVALID_PARAMETER;
1994                         return False;
1995         }
1996
1997         /*
1998          * Return the current pointer to the data offset.
1999          */
2000
2001         if(!prs_set_offset(rpc_in, save_offset)) {
2002                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2003                         (unsigned int)save_offset ));
2004                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2005                 return False;
2006         }
2007
2008         /*
2009          * Remember the padding length. We must remove it from the real data
2010          * stream once the sign/seal is done.
2011          */
2012
2013         *p_ss_padding_len = auth_info.auth_pad_len;
2014
2015         return True;
2016 }
2017
2018 /****************************************************************************
2019  Deal with schannel processing on an RPC request.
2020 ****************************************************************************/
2021
2022 BOOL api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2023 {
2024         uint32 data_len;
2025         uint32 auth_len;
2026         uint32 save_offset = prs_offset(rpc_in);
2027         RPC_HDR_AUTH auth_info;
2028         RPC_AUTH_SCHANNEL_CHK schannel_chk;
2029
2030         auth_len = p->hdr.auth_len;
2031
2032         if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
2033                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2034                 return False;
2035         }
2036
2037         /*
2038          * The following is that length of the data we must verify or unseal.
2039          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2040          * preceeding the auth_data.
2041          */
2042
2043         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2044                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2045                         (unsigned int)p->hdr.frag_len,
2046                         (unsigned int)auth_len ));
2047                 return False;
2048         }
2049
2050         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2051                 RPC_HDR_AUTH_LEN - auth_len;
2052
2053         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2054
2055         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2056                 DEBUG(0,("cannot move offset to %u.\n",
2057                          (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2058                 return False;
2059         }
2060
2061         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2062                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2063                 return False;
2064         }
2065
2066         if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
2067                 DEBUG(0,("Invalid auth info %d on schannel\n",
2068                          auth_info.auth_type));
2069                 return False;
2070         }
2071
2072         if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN, &schannel_chk, rpc_in, 0)) {
2073                 DEBUG(0,("failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
2074                 return False;
2075         }
2076
2077         if (!schannel_decode(p->auth.a_u.schannel_auth,
2078                            p->auth.auth_level,
2079                            SENDER_IS_INITIATOR,
2080                            &schannel_chk,
2081                            prs_data_p(rpc_in)+RPC_HDR_REQ_LEN, data_len)) {
2082                 DEBUG(3,("failed to decode PDU\n"));
2083                 return False;
2084         }
2085
2086         /*
2087          * Return the current pointer to the data offset.
2088          */
2089
2090         if(!prs_set_offset(rpc_in, save_offset)) {
2091                 DEBUG(0,("failed to set offset back to %u\n",
2092                          (unsigned int)save_offset ));
2093                 return False;
2094         }
2095
2096         /* The sequence number gets incremented on both send and receive. */
2097         p->auth.a_u.schannel_auth->seq_num++;
2098
2099         /*
2100          * Remember the padding length. We must remove it from the real data
2101          * stream once the sign/seal is done.
2102          */
2103
2104         *p_ss_padding_len = auth_info.auth_pad_len;
2105
2106         return True;
2107 }
2108
2109 /****************************************************************************
2110  Return a user struct for a pipe user.
2111 ****************************************************************************/
2112
2113 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
2114 {
2115         if (p->pipe_bound &&
2116                         (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP ||
2117                         (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2118                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
2119         } else {
2120                 memcpy(user, &current_user, sizeof(struct current_user));
2121         }
2122
2123         return user;
2124 }
2125
2126 /****************************************************************************
2127  Find the set of RPC functions associated with this context_id
2128 ****************************************************************************/
2129
2130 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2131 {
2132         PIPE_RPC_FNS *fns = NULL;
2133         PIPE_RPC_FNS *tmp = NULL;
2134
2135         if ( !list ) {
2136                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2137                 return NULL;
2138         }
2139
2140         for (tmp=list; tmp; tmp=tmp->next ) {
2141                 if ( tmp->context_id == context_id )
2142                         break;
2143         }
2144
2145         fns = tmp;
2146
2147         return fns;
2148 }
2149
2150 /****************************************************************************
2151  Memory cleanup.
2152 ****************************************************************************/
2153
2154 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2155 {
2156         PIPE_RPC_FNS *tmp = list;
2157         PIPE_RPC_FNS *tmp2;
2158
2159         while (tmp) {
2160                 tmp2 = tmp->next;
2161                 SAFE_FREE(tmp);
2162                 tmp = tmp2;
2163         }
2164
2165         return;
2166 }
2167
2168 /****************************************************************************
2169  Find the correct RPC function to call for this request.
2170  If the pipe is authenticated then become the correct UNIX user
2171  before doing the call.
2172 ****************************************************************************/
2173
2174 BOOL api_pipe_request(pipes_struct *p)
2175 {
2176         BOOL ret = False;
2177         BOOL changed_user = False;
2178         PIPE_RPC_FNS *pipe_fns;
2179
2180         if (p->pipe_bound &&
2181                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2182                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2183                 if(!become_authenticated_pipe_user(p)) {
2184                         prs_mem_free(&p->out_data.rdata);
2185                         return False;
2186                 }
2187                 changed_user = True;
2188         }
2189
2190         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
2191
2192         /* get the set of RPC functions for this context */
2193
2194         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2195
2196         if ( pipe_fns ) {
2197                 set_current_rpc_talloc(p->mem_ctx);
2198                 ret = api_rpcTNP(p, p->name, pipe_fns->cmds, pipe_fns->n_cmds);
2199                 set_current_rpc_talloc(NULL);
2200         }
2201         else {
2202                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2203                         p->hdr_req.context_id, p->name));
2204         }
2205
2206         if (changed_user) {
2207                 unbecome_authenticated_pipe_user();
2208         }
2209
2210         return ret;
2211 }
2212
2213 /*******************************************************************
2214  Calls the underlying RPC function for a named pipe.
2215  ********************************************************************/
2216
2217 BOOL api_rpcTNP(pipes_struct *p, const char *rpc_name,
2218                 const struct api_struct *api_rpc_cmds, int n_cmds)
2219 {
2220         int fn_num;
2221         fstring name;
2222         uint32 offset1, offset2;
2223
2224         /* interpret the command */
2225         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
2226
2227         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
2228         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2229
2230         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2231                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2232                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2233                         break;
2234                 }
2235         }
2236
2237         if (fn_num == n_cmds) {
2238                 /*
2239                  * For an unknown RPC just return a fault PDU but
2240                  * return True to allow RPC's on the pipe to continue
2241                  * and not put the pipe into fault state. JRA.
2242                  */
2243                 DEBUG(4, ("unknown\n"));
2244                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
2245                 return True;
2246         }
2247
2248         offset1 = prs_offset(&p->out_data.rdata);
2249
2250         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2251                 fn_num, api_rpc_cmds[fn_num].fn));
2252         /* do the actual command */
2253         if(!api_rpc_cmds[fn_num].fn(p)) {
2254                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
2255                 prs_mem_free(&p->out_data.rdata);
2256                 return False;
2257         }
2258
2259         if (p->bad_handle_fault_state) {
2260                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2261                 p->bad_handle_fault_state = False;
2262                 setup_fault_pdu(p, NT_STATUS(0x1C00001A));
2263                 return True;
2264         }
2265
2266         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
2267         offset2 = prs_offset(&p->out_data.rdata);
2268         prs_set_offset(&p->out_data.rdata, offset1);
2269         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2270         prs_set_offset(&p->out_data.rdata, offset2);
2271
2272         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
2273
2274         /* Check for buffer underflow in rpc parsing */
2275
2276         if ((DEBUGLEVEL >= 10) &&
2277             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2278                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2279                 char *data = SMB_MALLOC(data_len);
2280
2281                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2282                 if (data) {
2283                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2284                         SAFE_FREE(data);
2285                 }
2286
2287         }
2288
2289         return True;
2290 }
2291
2292 /*******************************************************************
2293 *******************************************************************/
2294
2295 void get_pipe_fns( int idx, struct api_struct **fns, int *n_fns )
2296 {
2297         struct api_struct *cmds = NULL;
2298         int               n_cmds = 0;
2299
2300         switch ( idx ) {
2301                 case PI_LSARPC:
2302                         lsa_get_pipe_fns( &cmds, &n_cmds );
2303                         break;
2304                 case PI_LSARPC_DS:
2305                         lsa_ds_get_pipe_fns( &cmds, &n_cmds );
2306                         break;
2307                 case PI_SAMR:
2308                         samr_get_pipe_fns( &cmds, &n_cmds );
2309                         break;
2310                 case PI_NETLOGON:
2311                         netlog_get_pipe_fns( &cmds, &n_cmds );
2312                         break;
2313                 case PI_SRVSVC:
2314                         srvsvc_get_pipe_fns( &cmds, &n_cmds );
2315                         break;
2316                 case PI_WKSSVC:
2317                         wkssvc_get_pipe_fns( &cmds, &n_cmds );
2318                         break;
2319                 case PI_WINREG:
2320                         reg_get_pipe_fns( &cmds, &n_cmds );
2321                         break;
2322                 case PI_SPOOLSS:
2323                         spoolss_get_pipe_fns( &cmds, &n_cmds );
2324                         break;
2325                 case PI_NETDFS:
2326                         netdfs_get_pipe_fns( &cmds, &n_cmds );
2327                         break;
2328                 case PI_SVCCTL:
2329                         svcctl_get_pipe_fns( &cmds, &n_cmds );
2330                         break;
2331                 case PI_EVENTLOG:
2332                         eventlog_get_pipe_fns( &cmds, &n_cmds );
2333                         break;
2334                 case PI_NTSVCS:
2335                         ntsvcs_get_pipe_fns( &cmds, &n_cmds );
2336                         break;
2337 #ifdef DEVELOPER
2338                 case PI_ECHO:
2339                         echo_get_pipe_fns( &cmds, &n_cmds );
2340                         break;
2341 #endif
2342                 default:
2343                         DEBUG(0,("get_pipe_fns: Unknown pipe index! [%d]\n", idx));
2344         }
2345
2346         *fns = cmds;
2347         *n_fns = n_cmds;
2348
2349         return;
2350 }