source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "system/filesys.h"
  32 #include "srv_pipe_internal.h"
  33 #include "../librpc/gen_ndr/ndr_dcerpc.h"
  34 #include "../librpc/rpc/rpc_common.h"
  35 #include "dcesrv_auth_generic.h"
  36 #include "rpc_server.h"
  37 #include "rpc_dce.h"
  38 #include "smbd/smbd.h"
  39 #include "auth.h"
  40 #include "ntdomain.h"
  41 #include "rpc_server/srv_pipe.h"
  42 #include "rpc_server/rpc_contexts.h"
  43 #include "lib/param/param.h"
  44 #include "librpc/ndr/ndr_table.h"
  45 #include "auth/gensec/gensec.h"
  46 #include "librpc/ndr/ndr_dcerpc.h"
  47 #include "lib/tsocket/tsocket.h"
  48 #include "../librpc/gen_ndr/ndr_samr.h"
  49 #include "../librpc/gen_ndr/ndr_lsa.h"
  50 #include "../librpc/gen_ndr/ndr_netlogon.h"
  51 #include "../librpc/gen_ndr/ndr_epmapper.h"
  52 #include "../librpc/gen_ndr/ndr_echo.h"
  53
  54 #undef DBGC_CLASS
  55 #define DBGC_CLASS DBGC_RPC_SRV
  56
  57 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p);
  58
  59 /**
  60  * Dump everything from the start of the end up of the provided data
  61  * into a file, but only at debug level >= 50
  62  **/
  63 static void dump_pdu_region(const char *name, int v,
  64                             DATA_BLOB *data, size_t start, size_t end)
  65 {
  66         int fd, i;
  67         char *fname = NULL;
  68         ssize_t sz;
  69
  70         if (DEBUGLEVEL < 50) return;
  71
  72         if (start > data->length || end > data->length || start > end) return;
  73
  74         for (i = 1; i < 100; i++) {
  75                 if (v != -1) {
  76                         fname = talloc_asprintf(talloc_tos(),
  77                                                 "/tmp/%s_%d.%d.prs",
  78                                                 name, v, i);
  79                 } else {
  80                         fname = talloc_asprintf(talloc_tos(),
  81                                                 "/tmp/%s_%d.prs",
  82                                                 name, i);
  83                 }
  84                 if (!fname) {
  85                         return;
  86                 }
  87                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  88                 if (fd != -1 || errno != EEXIST) break;
  89         }
  90         if (fd != -1) {
  91                 sz = write(fd, data->data + start, end - start);
  92                 i = close(fd);
  93                 if ((sz != end - start) || (i != 0) ) {
  94                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  95                                   fname, (unsigned long)sz,
  96                                   (unsigned long)end - start, i));
  97                 } else {
  98                         DEBUG(0,("created %s\n", fname));
  99                 }
 100         }
 101         TALLOC_FREE(fname);
 102 }
 103
 104 static DATA_BLOB generic_session_key(void)
 105 {
 106         return data_blob_const("SystemLibraryDTC", 16);
 107 }
 108
 109 /*******************************************************************
 110  Generate the next PDU to be returned from the data.
 111 ********************************************************************/
 112
 113 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
 114                                    struct pipe_auth_data *auth,
 115                                    uint32_t call_id,
 116                                    DATA_BLOB *rdata,
 117                                    size_t data_sent_length,
 118                                    DATA_BLOB *frag,
 119                                    size_t *pdu_size)
 120 {
 121         union dcerpc_payload u;
 122         uint8_t pfc_flags;
 123         size_t data_left;
 124         size_t data_to_send;
 125         size_t frag_len;
 126         size_t pad_len = 0;
 127         size_t auth_len = 0;
 128         NTSTATUS status;
 129
 130         ZERO_STRUCT(u.response);
 131
 132         /* Set up rpc packet pfc flags. */
 133         if (data_sent_length == 0) {
 134                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 135         } else {
 136                 pfc_flags = 0;
 137         }
 138
 139         /* Work out how much we can fit in a single PDU. */
 140         data_left = rdata->length - data_sent_length;
 141
 142         /* Ensure there really is data left to send. */
 143         if (!data_left) {
 144                 DEBUG(0, ("No data left to send !\n"));
 145                 return NT_STATUS_BUFFER_TOO_SMALL;
 146         }
 147
 148         status = dcerpc_guess_sizes(auth,
 149                                     DCERPC_RESPONSE_LENGTH,
 150                                     data_left,
 151                                     RPC_MAX_PDU_FRAG_LEN,
 152                                     &data_to_send, &frag_len,
 153                                     &auth_len, &pad_len);
 154         if (!NT_STATUS_IS_OK(status)) {
 155                 return status;
 156         }
 157
 158         /* Set up the alloc hint. This should be the data left to send. */
 159         u.response.alloc_hint = data_left;
 160
 161         /* Work out if this PDU will be the last. */
 162         if (data_sent_length + data_to_send >= rdata->length) {
 163                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 164         }
 165
 166         /* Prepare data to be NDR encoded. */
 167         u.response.stub_and_verifier =
 168                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 169
 170         /* Store the packet in the data stream. */
 171         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 172                                           pfc_flags, auth_len, call_id,
 173                                           &u, frag);
 174         if (!NT_STATUS_IS_OK(status)) {
 175                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 176                 return status;
 177         }
 178
 179         if (auth_len) {
 180                 /* Set the proper length on the pdu, including padding.
 181                  * Only needed if an auth trailer will be appended. */
 182                 dcerpc_set_frag_length(frag, frag->length
 183                                                 + pad_len
 184                                                 + DCERPC_AUTH_TRAILER_LENGTH
 185                                                 + auth_len);
 186         }
 187
 188         if (auth_len) {
 189                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 190                 if (!NT_STATUS_IS_OK(status)) {
 191                         data_blob_free(frag);
 192                         return status;
 193                 }
 194         }
 195
 196         *pdu_size = data_to_send;
 197         return NT_STATUS_OK;
 198 }
 199
 200 /*******************************************************************
 201  Generate the next PDU to be returned from the data in p->rdata.
 202 ********************************************************************/
 203
 204 bool create_next_pdu(struct pipes_struct *p)
 205 {
 206         size_t pdu_size = 0;
 207         NTSTATUS status;
 208
 209         /*
 210          * If we're in the fault state, keep returning fault PDU's until
 211          * the pipe gets closed. JRA.
 212          */
 213         if (p->fault_state) {
 214                 setup_fault_pdu(p, NT_STATUS(p->fault_state));
 215                 return true;
 216         }
 217
 218         status = create_next_packet(p->mem_ctx, &p->auth,
 219                                     p->call_id, &p->out_data.rdata,
 220                                     p->out_data.data_sent_length,
 221                                     &p->out_data.frag, &pdu_size);
 222         if (!NT_STATUS_IS_OK(status)) {
 223                 DEBUG(0, ("Failed to create packet with error %s, "
 224                           "(auth level %u / type %u)\n",
 225                           nt_errstr(status),
 226                           (unsigned int)p->auth.auth_level,
 227                           (unsigned int)p->auth.auth_type));
 228                 return false;
 229         }
 230
 231         /* Setup the counts for this PDU. */
 232         p->out_data.data_sent_length += pdu_size;
 233         p->out_data.current_pdu_sent = 0;
 234         return true;
 235 }
 236
 237
 238 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 239
 240 /*******************************************************************
 241  Marshall a bind_nak pdu.
 242 *******************************************************************/
 243
 244 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 245 {
 246         NTSTATUS status;
 247         union dcerpc_payload u;
 248
 249         /* Free any memory in the current return data buffer. */
 250         pipe_init_outgoing_data(p);
 251
 252         /*
 253          * Initialize a bind_nak header.
 254          */
 255
 256         ZERO_STRUCT(u);
 257
 258         u.bind_nak.reject_reason  = 0;
 259
 260         /*
 261          * Marshall directly into the outgoing PDU space. We
 262          * must do this as we need to set to the bind response
 263          * header and are never sending more than one PDU here.
 264          */
 265
 266         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 267                                           DCERPC_PKT_BIND_NAK,
 268                                           DCERPC_PFC_FLAG_FIRST |
 269                                                 DCERPC_PFC_FLAG_LAST,
 270                                           0,
 271                                           pkt->call_id,
 272                                           &u,
 273                                           &p->out_data.frag);
 274         if (!NT_STATUS_IS_OK(status)) {
 275                 return False;
 276         }
 277
 278         p->out_data.data_sent_length = 0;
 279         p->out_data.current_pdu_sent = 0;
 280
 281         set_incoming_fault(p);
 282         TALLOC_FREE(p->auth.auth_ctx);
 283         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 284         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 285         p->pipe_bound = False;
 286         p->allow_bind = false;
 287         p->allow_alter = false;
 288         p->allow_auth3 = false;
 289
 290         return True;
 291 }
 292
 293 /*******************************************************************
 294  Marshall a fault pdu.
 295 *******************************************************************/
 296
 297 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 298 {
 299         NTSTATUS status;
 300         union dcerpc_payload u;
 301
 302         /* Free any memory in the current return data buffer. */
 303         pipe_init_outgoing_data(p);
 304
 305         /*
 306          * Initialize a fault header.
 307          */
 308
 309         ZERO_STRUCT(u);
 310
 311         u.fault.status          = NT_STATUS_V(fault_status);
 312         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 313
 314         /*
 315          * Marshall directly into the outgoing PDU space. We
 316          * must do this as we need to set to the bind response
 317          * header and are never sending more than one PDU here.
 318          */
 319
 320         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 321                                           DCERPC_PKT_FAULT,
 322                                           DCERPC_PFC_FLAG_FIRST |
 323                                            DCERPC_PFC_FLAG_LAST |
 324                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 325                                           0,
 326                                           p->call_id,
 327                                           &u,
 328                                           &p->out_data.frag);
 329         if (!NT_STATUS_IS_OK(status)) {
 330                 return False;
 331         }
 332
 333         p->out_data.data_sent_length = 0;
 334         p->out_data.current_pdu_sent = 0;
 335
 336         return True;
 337 }
 338
 339 /*******************************************************************
 340  Ensure a bind request has the correct abstract & transfer interface.
 341  Used to reject unknown binds from Win2k.
 342 *******************************************************************/
 343
 344 static bool check_bind_req(struct pipes_struct *p,
 345                            struct ndr_syntax_id* abstract,
 346                            struct ndr_syntax_id* transfer,
 347                            uint32_t context_id)
 348 {
 349         struct pipe_rpc_fns *context_fns;
 350         bool ok;
 351         const char *interface_name = NULL;
 352
 353         DEBUG(3,("check_bind_req for %s context_id=%u\n",
 354                  ndr_interface_name(&abstract->uuid,
 355                                     abstract->if_version),
 356                  (unsigned)context_id));
 357
 358         ok = ndr_syntax_id_equal(transfer, &ndr_transfer_syntax_ndr);
 359         if (!ok) {
 360                 DEBUG(1,("check_bind_req unknown transfer syntax for "
 361                          "%s context_id=%u\n",
 362                          ndr_interface_name(&abstract->uuid,
 363                                     abstract->if_version),
 364                          (unsigned)context_id));
 365                 return false;
 366         }
 367
 368         for (context_fns = p->contexts;
 369              context_fns != NULL;
 370              context_fns = context_fns->next)
 371         {
 372                 if (context_fns->context_id != context_id) {
 373                         continue;
 374                 }
 375
 376                 ok = ndr_syntax_id_equal(&context_fns->syntax,
 377                                          abstract);
 378                 if (ok) {
 379                         return true;
 380                 }
 381
 382                 DEBUG(1,("check_bind_req: changing abstract syntax for "
 383                          "%s context_id=%u into %s not supported\n",
 384                          ndr_interface_name(&context_fns->syntax.uuid,
 385                                             context_fns->syntax.if_version),
 386                          (unsigned)context_id,
 387                          ndr_interface_name(&abstract->uuid,
 388                                             abstract->if_version)));
 389                 return false;
 390         }
 391
 392         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 393         if (!rpc_srv_pipe_exists_by_id(abstract)) {
 394                 return false;
 395         }
 396
 397         DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
 398                   rpc_srv_get_pipe_cli_name(abstract),
 399                   rpc_srv_get_pipe_srv_name(abstract)));
 400
 401         ok = init_pipe_handles(p, abstract);
 402         if (!ok) {
 403                 DEBUG(1, ("Failed to init pipe handles!\n"));
 404                 return false;
 405         }
 406
 407         context_fns = talloc_zero(p, struct pipe_rpc_fns);
 408         if (context_fns == NULL) {
 409                 DEBUG(0,("check_bind_req: talloc() failed!\n"));
 410                 return false;
 411         }
 412
 413         interface_name = ndr_interface_name(&abstract->uuid,
 414                                             abstract->if_version);
 415         SMB_ASSERT(interface_name != NULL);
 416
 417         context_fns->next = context_fns->prev = NULL;
 418         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 419         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 420         context_fns->context_id = context_id;
 421         context_fns->syntax = *abstract;
 422
 423         context_fns->allow_connect = lp_allow_dcerpc_auth_level_connect();
 424         /*
 425          * for the samr, lsarpc and netlogon interfaces we don't allow "connect"
 426          * auth_level by default.
 427          */
 428         ok = ndr_syntax_id_equal(abstract, &ndr_table_samr.syntax_id);
 429         if (ok) {
 430                 context_fns->allow_connect = false;
 431         }
 432         ok = ndr_syntax_id_equal(abstract, &ndr_table_lsarpc.syntax_id);
 433         if (ok) {
 434                 context_fns->allow_connect = false;
 435         }
 436         ok = ndr_syntax_id_equal(abstract, &ndr_table_netlogon.syntax_id);
 437         if (ok) {
 438                 context_fns->allow_connect = false;
 439         }
 440         /*
 441          * for the epmapper and echo interfaces we allow "connect"
 442          * auth_level by default.
 443          */
 444         ok = ndr_syntax_id_equal(abstract, &ndr_table_epmapper.syntax_id);
 445         if (ok) {
 446                 context_fns->allow_connect = true;
 447         }
 448         ok = ndr_syntax_id_equal(abstract, &ndr_table_rpcecho.syntax_id);
 449         if (ok) {
 450                 context_fns->allow_connect = true;
 451         }
 452         /*
 453          * every interface can be modified to allow "connect" auth_level by
 454          * using a parametric option like:
 455          * allow dcerpc auth level connect:<interface>
 456          * e.g.
 457          * allow dcerpc auth level connect:samr = yes
 458          */
 459         context_fns->allow_connect = lp_parm_bool(-1,
 460                 "allow dcerpc auth level connect",
 461                 interface_name, context_fns->allow_connect);
 462
 463         /* add to the list of open contexts */
 464
 465         DLIST_ADD( p->contexts, context_fns );
 466
 467         return True;
 468 }
 469
 470 /**
 471  * Is a named pipe known?
 472  * @param[in] pipename          Just the filename
 473  * @result                      Do we want to serve this?
 474  */
 475 bool is_known_pipename(const char *pipename, struct ndr_syntax_id *syntax)
 476 {
 477         NTSTATUS status;
 478
 479         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 480                 DEBUG(10, ("refusing spoolss access\n"));
 481                 return false;
 482         }
 483
 484         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 485                 return true;
 486         }
 487
 488         status = smb_probe_module("rpc", pipename);
 489         if (!NT_STATUS_IS_OK(status)) {
 490                 DEBUG(10, ("is_known_pipename: %s unknown\n", pipename));
 491                 return false;
 492         }
 493         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 494
 495         /*
 496          * Scan the list again for the interface id
 497          */
 498         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 499                 return true;
 500         }
 501
 502         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 503                    pipename));
 504
 505         return false;
 506 }
 507
 508 /*******************************************************************
 509  Handle an NTLMSSP bind auth.
 510 *******************************************************************/
 511
 512 static bool pipe_auth_generic_bind(struct pipes_struct *p,
 513                                    struct ncacn_packet *pkt,
 514                                    struct dcerpc_auth *auth_info,
 515                                    DATA_BLOB *response)
 516 {
 517         TALLOC_CTX *mem_ctx = pkt;
 518         struct gensec_security *gensec_security = NULL;
 519         NTSTATUS status;
 520
 521         status = auth_generic_server_authtype_start(p,
 522                                                     auth_info->auth_type,
 523                                                     auth_info->auth_level,
 524                                                     &auth_info->credentials,
 525                                                     response,
 526                                                     p->remote_address,
 527                                                     &gensec_security);
 528         if (!NT_STATUS_IS_OK(status) &&
 529             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED))
 530         {
 531                 DEBUG(0, (__location__ ": auth_generic_server_authtype_start[%u/%u] failed: %s\n",
 532                           auth_info->auth_type, auth_info->auth_level, nt_errstr(status)));
 533                 return false;
 534         }
 535
 536         /* Make sure data is bound to the memctx, to be freed the caller */
 537         talloc_steal(mem_ctx, response->data);
 538
 539         p->auth.auth_ctx = gensec_security;
 540         p->auth.auth_type = auth_info->auth_type;
 541         p->auth.auth_level = auth_info->auth_level;
 542
 543         if (pkt->pfc_flags & DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN) {
 544                 p->auth.client_hdr_signing = true;
 545                 p->auth.hdr_signing = gensec_have_feature(gensec_security,
 546                                                 GENSEC_FEATURE_SIGN_PKT_HEADER);
 547         }
 548
 549         if (p->auth.hdr_signing) {
 550                 gensec_want_feature(gensec_security,
 551                                     GENSEC_FEATURE_SIGN_PKT_HEADER);
 552         }
 553
 554         if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 555                 return true;
 556         }
 557
 558         status = pipe_auth_verify_final(p);
 559         if (!NT_STATUS_IS_OK(status)) {
 560                 DEBUG(0, ("pipe_auth_verify_final failed: %s\n",
 561                           nt_errstr(status)));
 562                 return false;
 563         }
 564
 565         return true;
 566 }
 567
 568 /*******************************************************************
 569  Process an NTLMSSP authentication response.
 570  If this function succeeds, the user has been authenticated
 571  and their domain, name and calling workstation stored in
 572  the pipe struct.
 573 *******************************************************************/
 574
 575 static bool pipe_auth_generic_verify_final(TALLOC_CTX *mem_ctx,
 576                                 struct gensec_security *gensec_security,
 577                                 enum dcerpc_AuthLevel auth_level,
 578                                 struct auth_session_info **session_info)
 579 {
 580         NTSTATUS status;
 581         bool ret;
 582
 583         DEBUG(5, (__location__ ": checking user details\n"));
 584
 585         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 586            ensure the underlying NTLMSSP flags are also set. If not we should
 587            refuse the bind. */
 588
 589         status = auth_generic_server_check_flags(gensec_security,
 590                                             (auth_level ==
 591                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 592                                             (auth_level ==
 593                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 594         if (!NT_STATUS_IS_OK(status)) {
 595                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 596                           "security for rpc connection\n"));
 597                 return false;
 598         }
 599
 600         TALLOC_FREE(*session_info);
 601
 602         status = auth_generic_server_get_user_info(gensec_security,
 603                                                 mem_ctx, session_info);
 604         if (!NT_STATUS_IS_OK(status)) {
 605                 DEBUG(0, (__location__ ": failed to obtain the server info "
 606                           "for authenticated user: %s\n", nt_errstr(status)));
 607                 return false;
 608         }
 609
 610         if ((*session_info)->security_token == NULL) {
 611                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 612                 return false;
 613         }
 614
 615         if ((*session_info)->unix_token == NULL) {
 616                 DEBUG(1, ("Auth module failed to provide unix_token\n"));
 617                 return false;
 618         }
 619
 620         /*
 621          * We're an authenticated bind over smb, so the session key needs to
 622          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 623          * does. See the RPC-SAMBA3SESSIONKEY.
 624          */
 625
 626         ret = session_info_set_session_key((*session_info), generic_session_key());
 627         if (!ret) {
 628                 DEBUG(0, ("Failed to set session key!\n"));
 629                 return false;
 630         }
 631
 632         return true;
 633 }
 634
 635 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 636 {
 637         struct gensec_security *gensec_security;
 638         bool ok;
 639
 640         if (p->auth.auth_type == DCERPC_AUTH_TYPE_NONE) {
 641                 p->pipe_bound = true;
 642                 return NT_STATUS_OK;
 643         }
 644
 645         gensec_security = p->auth.auth_ctx;
 646
 647         ok = pipe_auth_generic_verify_final(p, gensec_security,
 648                                             p->auth.auth_level,
 649                                             &p->session_info);
 650         if (!ok) {
 651                 return NT_STATUS_ACCESS_DENIED;
 652         }
 653
 654         p->pipe_bound = true;
 655
 656         return NT_STATUS_OK;
 657 }
 658
 659 /*******************************************************************
 660  Respond to a pipe bind request.
 661 *******************************************************************/
 662
 663 static bool api_pipe_bind_req(struct pipes_struct *p,
 664                                 struct ncacn_packet *pkt)
 665 {
 666         struct dcerpc_auth auth_info = {0};
 667         uint16_t assoc_gid;
 668         NTSTATUS status;
 669         struct ndr_syntax_id id;
 670         uint8_t pfc_flags = 0;
 671         union dcerpc_payload u;
 672         struct dcerpc_ack_ctx bind_ack_ctx;
 673         DATA_BLOB auth_resp = data_blob_null;
 674         DATA_BLOB auth_blob = data_blob_null;
 675         const struct ndr_interface_table *table;
 676
 677         if (!p->allow_bind) {
 678                 DEBUG(2,("Pipe not in allow bind state\n"));
 679                 return setup_bind_nak(p, pkt);
 680         }
 681         p->allow_bind = false;
 682
 683         status = dcerpc_verify_ncacn_packet_header(pkt,
 684                         DCERPC_PKT_BIND,
 685                         pkt->u.bind.auth_info.length,
 686                         0, /* required flags */
 687                         DCERPC_PFC_FLAG_FIRST |
 688                         DCERPC_PFC_FLAG_LAST |
 689                         DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
 690                         0x08 | /* this is not defined, but should be ignored */
 691                         DCERPC_PFC_FLAG_CONC_MPX |
 692                         DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
 693                         DCERPC_PFC_FLAG_MAYBE |
 694                         DCERPC_PFC_FLAG_OBJECT_UUID);
 695         if (!NT_STATUS_IS_OK(status)) {
 696                 DEBUG(1, ("api_pipe_bind_req: invalid pdu: %s\n",
 697                           nt_errstr(status)));
 698                 NDR_PRINT_DEBUG(ncacn_packet, pkt);
 699                 goto err_exit;
 700         }
 701
 702         if (pkt->u.bind.num_contexts == 0) {
 703                 DEBUG(1, ("api_pipe_bind_req: no rpc contexts around\n"));
 704                 goto err_exit;
 705         }
 706
 707         if (pkt->u.bind.ctx_list[0].num_transfer_syntaxes == 0) {
 708                 DEBUG(1, ("api_pipe_bind_req: no transfer syntaxes around\n"));
 709                 goto err_exit;
 710         }
 711
 712         /*
 713          * Try and find the correct pipe name to ensure
 714          * that this is a pipe name we support.
 715          */
 716         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 717
 718         table = ndr_table_by_uuid(&id.uuid);
 719         if (table == NULL) {
 720                 DEBUG(0,("unknown interface\n"));
 721                 return false;
 722         }
 723
 724         if (rpc_srv_pipe_exists_by_id(&id)) {
 725                 DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 726                           rpc_srv_get_pipe_cli_name(&id),
 727                           rpc_srv_get_pipe_srv_name(&id)));
 728         } else {
 729                 status = smb_probe_module(
 730                         "rpc", dcerpc_default_transport_endpoint(pkt,
 731                                 NCACN_NP, table));
 732
 733                 if (NT_STATUS_IS_ERR(status)) {
 734                         DEBUG(3,("api_pipe_bind_req: Unknown rpc service name "
 735                                  "%s in bind request.\n",
 736                                  ndr_interface_name(&id.uuid,
 737                                                     id.if_version)));
 738
 739                         return setup_bind_nak(p, pkt);
 740                 }
 741
 742                 if (rpc_srv_get_pipe_interface_by_cli_name(
 743                                 dcerpc_default_transport_endpoint(pkt,
 744                                         NCACN_NP, table),
 745                                 &id)) {
 746                         DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 747                                   rpc_srv_get_pipe_cli_name(&id),
 748                                   rpc_srv_get_pipe_srv_name(&id)));
 749                 } else {
 750                         DEBUG(0, ("module %s doesn't provide functions for "
 751                                   "pipe %s!\n",
 752                                   ndr_interface_name(&id.uuid,
 753                                                      id.if_version),
 754                                   ndr_interface_name(&id.uuid,
 755                                                      id.if_version)));
 756                         return setup_bind_nak(p, pkt);
 757                 }
 758         }
 759
 760         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 761
 762         if (pkt->u.bind.assoc_group_id != 0) {
 763                 assoc_gid = pkt->u.bind.assoc_group_id;
 764         } else {
 765                 assoc_gid = 0x53f0;
 766         }
 767
 768         /*
 769          * Create the bind response struct.
 770          */
 771
 772         /* If the requested abstract synt uuid doesn't match our client pipe,
 773                 reject the bind_ack & set the transfer interface synt to all 0's,
 774                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 775                 unknown to NT4)
 776                 Needed when adding entries to a DACL from NT5 - SK */
 777
 778         if (check_bind_req(p,
 779                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 780                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 781                         pkt->u.bind.ctx_list[0].context_id)) {
 782
 783                 bind_ack_ctx.result = 0;
 784                 bind_ack_ctx.reason.value = 0;
 785                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 786         } else {
 787                 /* Rejection reason: abstract syntax not supported */
 788                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 789                 bind_ack_ctx.reason.value = DCERPC_BIND_REASON_ASYNTAX;
 790                 bind_ack_ctx.syntax = ndr_syntax_id_null;
 791         }
 792
 793         /*
 794          * Check if this is an authenticated bind request.
 795          */
 796         if (pkt->auth_length) {
 797                 /*
 798                  * Decode the authentication verifier.
 799                  */
 800                 status = dcerpc_pull_auth_trailer(pkt, pkt,
 801                                                   &pkt->u.bind.auth_info,
 802                                                   &auth_info, NULL, true);
 803                 if (!NT_STATUS_IS_OK(status)) {
 804                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
 805                         goto err_exit;
 806                 }
 807
 808                 if (!pipe_auth_generic_bind(p, pkt,
 809                                             &auth_info, &auth_resp)) {
 810                         goto err_exit;
 811                 }
 812         } else {
 813                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 814                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 815         }
 816
 817         ZERO_STRUCT(u.bind_ack);
 818         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
 819         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
 820         u.bind_ack.assoc_group_id = assoc_gid;
 821
 822         /* name has to be \PIPE\xxxxx */
 823         u.bind_ack.secondary_address =
 824                         talloc_asprintf(pkt, "\\PIPE\\%s",
 825                                         rpc_srv_get_pipe_srv_name(&id));
 826         if (!u.bind_ack.secondary_address) {
 827                 DEBUG(0, ("Out of memory!\n"));
 828                 goto err_exit;
 829         }
 830         u.bind_ack.secondary_address_size =
 831                                 strlen(u.bind_ack.secondary_address) + 1;
 832
 833         u.bind_ack.num_results = 1;
 834         u.bind_ack.ctx_list = &bind_ack_ctx;
 835
 836         /* NOTE: We leave the auth_info empty so we can calculate the padding
 837          * later and then append the auth_info --simo */
 838
 839         /*
 840          * Marshall directly into the outgoing PDU space. We
 841          * must do this as we need to set to the bind response
 842          * header and are never sending more than one PDU here.
 843          */
 844
 845         pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
 846
 847         if (p->auth.hdr_signing) {
 848                 pfc_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
 849         }
 850
 851         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 852                                           DCERPC_PKT_BIND_ACK,
 853                                           pfc_flags,
 854                                           auth_resp.length,
 855                                           pkt->call_id,
 856                                           &u,
 857                                           &p->out_data.frag);
 858         if (!NT_STATUS_IS_OK(status)) {
 859                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
 860                           nt_errstr(status)));
 861                 goto err_exit;
 862         }
 863
 864         if (auth_resp.length) {
 865
 866                 status = dcerpc_push_dcerpc_auth(pkt,
 867                                                  p->auth.auth_type,
 868                                                  p->auth.auth_level,
 869                                                  0,
 870                                                  1, /* auth_context_id */
 871                                                  &auth_resp,
 872                                                  &auth_blob);
 873                 if (!NT_STATUS_IS_OK(status)) {
 874                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
 875                         goto err_exit;
 876                 }
 877         }
 878
 879         /* Now that we have the auth len store it into the right place in
 880          * the dcerpc header */
 881         dcerpc_set_frag_length(&p->out_data.frag,
 882                                 p->out_data.frag.length + auth_blob.length);
 883
 884         if (auth_blob.length) {
 885
 886                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
 887                                         auth_blob.data, auth_blob.length)) {
 888                         DEBUG(0, ("Append of auth info failed.\n"));
 889                         goto err_exit;
 890                 }
 891         }
 892
 893         /*
 894          * Setup the lengths for the initial reply.
 895          */
 896
 897         p->out_data.data_sent_length = 0;
 898         p->out_data.current_pdu_sent = 0;
 899
 900         TALLOC_FREE(auth_blob.data);
 901
 902         if (bind_ack_ctx.result == 0) {
 903                 p->allow_alter = true;
 904                 p->allow_auth3 = true;
 905                 if (p->auth.auth_type == DCERPC_AUTH_TYPE_NONE) {
 906                         status = pipe_auth_verify_final(p);
 907                         if (!NT_STATUS_IS_OK(status)) {
 908                                 DEBUG(0, ("pipe_auth_verify_final failed: %s\n",
 909                                           nt_errstr(status)));
 910                                 goto err_exit;
 911                         }
 912                 }
 913         } else {
 914                 goto err_exit;
 915         }
 916
 917         return True;
 918
 919   err_exit:
 920
 921         data_blob_free(&p->out_data.frag);
 922         TALLOC_FREE(auth_blob.data);
 923         return setup_bind_nak(p, pkt);
 924 }
 925
 926 /*******************************************************************
 927  This is the "stage3" response after a bind request and reply.
 928 *******************************************************************/
 929
 930 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
 931 {
 932         struct dcerpc_auth auth_info;
 933         DATA_BLOB response = data_blob_null;
 934         struct gensec_security *gensec_security;
 935         NTSTATUS status;
 936
 937         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 938
 939         if (!p->allow_auth3) {
 940                 DEBUG(1, ("Pipe not in allow auth3 state.\n"));
 941                 goto err;
 942         }
 943
 944         status = dcerpc_verify_ncacn_packet_header(pkt,
 945                         DCERPC_PKT_AUTH3,
 946                         pkt->u.auth3.auth_info.length,
 947                         0, /* required flags */
 948                         DCERPC_PFC_FLAG_FIRST |
 949                         DCERPC_PFC_FLAG_LAST |
 950                         DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
 951                         0x08 | /* this is not defined, but should be ignored */
 952                         DCERPC_PFC_FLAG_CONC_MPX |
 953                         DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
 954                         DCERPC_PFC_FLAG_MAYBE |
 955                         DCERPC_PFC_FLAG_OBJECT_UUID);
 956         if (!NT_STATUS_IS_OK(status)) {
 957                 DEBUG(1, ("api_pipe_bind_auth3: invalid pdu: %s\n",
 958                           nt_errstr(status)));
 959                 NDR_PRINT_DEBUG(ncacn_packet, pkt);
 960                 goto err;
 961         }
 962
 963         /* We can only finish if the pipe is unbound for now */
 964         if (p->pipe_bound) {
 965                 DEBUG(0, (__location__ ": Pipe already bound, "
 966                           "AUTH3 not supported!\n"));
 967                 goto err;
 968         }
 969
 970         if (pkt->auth_length == 0) {
 971                 DEBUG(1, ("No auth field sent for auth3 request!\n"));
 972                 goto err;
 973         }
 974
 975         /*
 976          * Decode the authentication verifier response.
 977          */
 978
 979         status = dcerpc_pull_auth_trailer(pkt, pkt,
 980                                           &pkt->u.auth3.auth_info,
 981                                           &auth_info, NULL, true);
 982         if (!NT_STATUS_IS_OK(status)) {
 983                 DEBUG(1, ("Failed to unmarshall dcerpc_auth.\n"));
 984                 goto err;
 985         }
 986
 987         /* We must NEVER look at auth_info->auth_pad_len here,
 988          * as old Samba client code gets it wrong and sends it
 989          * as zero. JRA.
 990          */
 991
 992         if (auth_info.auth_type != p->auth.auth_type) {
 993                 DEBUG(1, ("Auth type mismatch! Client sent %d, "
 994                           "but auth was started as type %d!\n",
 995                           auth_info.auth_type, p->auth.auth_type));
 996                 goto err;
 997         }
 998
 999         if (auth_info.auth_level != p->auth.auth_level) {
1000                 DEBUG(1, ("Auth level mismatch! Client sent %d, "
1001                           "but auth was started as level %d!\n",
1002                           auth_info.auth_level, p->auth.auth_level));
1003                 goto err;
1004         }
1005
1006         gensec_security = p->auth.auth_ctx;
1007
1008         status = auth_generic_server_step(gensec_security,
1009                                           pkt, &auth_info.credentials,
1010                                           &response);
1011
1012         if (NT_STATUS_EQUAL(status,
1013                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1014             response.length) {
1015                 DEBUG(1, (__location__ ": This was supposed to be the final "
1016                           "leg, but crypto machinery claims a response is "
1017                           "needed, aborting auth!\n"));
1018                 data_blob_free(&response);
1019                 goto err;
1020         }
1021         if (!NT_STATUS_IS_OK(status)) {
1022                 DEBUG(2, ("Auth failed (%s)\n", nt_errstr(status)));
1023                 goto err;
1024         }
1025
1026         /* Now verify auth was indeed successful and extract server info */
1027         status = pipe_auth_verify_final(p);
1028         if (!NT_STATUS_IS_OK(status)) {
1029                 DEBUG(2, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1030                 goto err;
1031         }
1032
1033         return true;
1034
1035 err:
1036         p->pipe_bound = false;
1037         p->allow_bind = false;
1038         p->allow_alter = false;
1039         p->allow_auth3 = false;
1040
1041         TALLOC_FREE(p->auth.auth_ctx);
1042         return false;
1043 }
1044
1045 /****************************************************************************
1046  Deal with an alter context call. Can be third part of 3 leg auth request for
1047  SPNEGO calls.
1048 ****************************************************************************/
1049
1050 static bool api_pipe_alter_context(struct pipes_struct *p,
1051                                         struct ncacn_packet *pkt)
1052 {
1053         struct dcerpc_auth auth_info = {0};
1054         uint16_t assoc_gid;
1055         NTSTATUS status;
1056         union dcerpc_payload u;
1057         struct dcerpc_ack_ctx alter_ack_ctx;
1058         DATA_BLOB auth_resp = data_blob_null;
1059         DATA_BLOB auth_blob = data_blob_null;
1060         struct gensec_security *gensec_security;
1061
1062         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1063
1064         if (!p->allow_alter) {
1065                 DEBUG(1, ("Pipe not in allow alter state.\n"));
1066                 goto err_exit;
1067         }
1068
1069         status = dcerpc_verify_ncacn_packet_header(pkt,
1070                         DCERPC_PKT_ALTER,
1071                         pkt->u.alter.auth_info.length,
1072                         0, /* required flags */
1073                         DCERPC_PFC_FLAG_FIRST |
1074                         DCERPC_PFC_FLAG_LAST |
1075                         DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
1076                         0x08 | /* this is not defined, but should be ignored */
1077                         DCERPC_PFC_FLAG_CONC_MPX |
1078                         DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
1079                         DCERPC_PFC_FLAG_MAYBE |
1080                         DCERPC_PFC_FLAG_OBJECT_UUID);
1081         if (!NT_STATUS_IS_OK(status)) {
1082                 DEBUG(1, ("api_pipe_alter_context: invalid pdu: %s\n",
1083                           nt_errstr(status)));
1084                 NDR_PRINT_DEBUG(ncacn_packet, pkt);
1085                 goto err_exit;
1086         }
1087
1088         if (pkt->u.alter.num_contexts == 0) {
1089                 DEBUG(1, ("api_pipe_alter_context: no rpc contexts around\n"));
1090                 goto err_exit;
1091         }
1092
1093         if (pkt->u.alter.ctx_list[0].num_transfer_syntaxes == 0) {
1094                 DEBUG(1, ("api_pipe_alter_context: no transfer syntaxes around\n"));
1095                 goto err_exit;
1096         }
1097
1098         if (pkt->u.alter.assoc_group_id != 0) {
1099                 assoc_gid = pkt->u.alter.assoc_group_id;
1100         } else {
1101                 assoc_gid = 0x53f0;
1102         }
1103
1104         /*
1105          * Create the bind response struct.
1106          */
1107
1108         /* If the requested abstract synt uuid doesn't match our client pipe,
1109                 reject the alter_ack & set the transfer interface synt to all 0's,
1110                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1111                 unknown to NT4)
1112                 Needed when adding entries to a DACL from NT5 - SK */
1113
1114         if (check_bind_req(p,
1115                         &pkt->u.alter.ctx_list[0].abstract_syntax,
1116                         &pkt->u.alter.ctx_list[0].transfer_syntaxes[0],
1117                         pkt->u.alter.ctx_list[0].context_id)) {
1118
1119                 alter_ack_ctx.result = 0;
1120                 alter_ack_ctx.reason.value = 0;
1121                 alter_ack_ctx.syntax = pkt->u.alter.ctx_list[0].transfer_syntaxes[0];
1122         } else {
1123                 /* Rejection reason: abstract syntax not supported */
1124                 alter_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1125                 alter_ack_ctx.reason.value = DCERPC_BIND_REASON_ASYNTAX;
1126                 alter_ack_ctx.syntax = ndr_syntax_id_null;
1127         }
1128
1129         /*
1130          * Check if this is an authenticated alter context request.
1131          */
1132         if (pkt->auth_length) {
1133                 /* We can only finish if the pipe is unbound for now */
1134                 if (p->pipe_bound) {
1135                         DEBUG(0, (__location__ ": Pipe already bound, "
1136                                   "Altering Context not yet supported!\n"));
1137                         goto err_exit;
1138                 }
1139
1140                 status = dcerpc_pull_auth_trailer(pkt, pkt,
1141                                                   &pkt->u.alter.auth_info,
1142                                                   &auth_info, NULL, true);
1143                 if (!NT_STATUS_IS_OK(status)) {
1144                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1145                         goto err_exit;
1146                 }
1147
1148                 if (auth_info.auth_type != p->auth.auth_type) {
1149                         DEBUG(0, ("Auth type mismatch! Client sent %d, "
1150                                   "but auth was started as type %d!\n",
1151                                   auth_info.auth_type, p->auth.auth_type));
1152                         goto err_exit;
1153                 }
1154
1155                 if (auth_info.auth_level != p->auth.auth_level) {
1156                         DEBUG(0, ("Auth level mismatch! Client sent %d, "
1157                                   "but auth was started as level %d!\n",
1158                                   auth_info.auth_level, p->auth.auth_level));
1159                         goto err_exit;
1160                 }
1161
1162                 gensec_security = p->auth.auth_ctx;
1163                 status = auth_generic_server_step(gensec_security,
1164                                                   pkt,
1165                                                   &auth_info.credentials,
1166                                                   &auth_resp);
1167                 if (NT_STATUS_IS_OK(status)) {
1168                         /* third leg of auth, verify auth info */
1169                         status = pipe_auth_verify_final(p);
1170                         if (!NT_STATUS_IS_OK(status)) {
1171                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1172                                           nt_errstr(status)));
1173                                 goto err_exit;
1174                         }
1175                 } else if (NT_STATUS_EQUAL(status,
1176                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1177                         DEBUG(10, ("More auth legs required.\n"));
1178                 } else {
1179                         DEBUG(0, ("Auth step returned an error (%s)\n",
1180                                   nt_errstr(status)));
1181                         goto err_exit;
1182                 }
1183         }
1184
1185         ZERO_STRUCT(u.alter_resp);
1186         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1187         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1188         u.alter_resp.assoc_group_id = assoc_gid;
1189
1190         /* secondary address CAN be NULL
1191          * as the specs say it's ignored.
1192          * It MUST be NULL to have the spoolss working.
1193          */
1194         u.alter_resp.secondary_address = "";
1195         u.alter_resp.secondary_address_size = 1;
1196
1197         u.alter_resp.num_results = 1;
1198         u.alter_resp.ctx_list = &alter_ack_ctx;
1199
1200         /* NOTE: We leave the auth_info empty so we can calculate the padding
1201          * later and then append the auth_info --simo */
1202
1203         /*
1204          * Marshall directly into the outgoing PDU space. We
1205          * must do this as we need to set to the bind response
1206          * header and are never sending more than one PDU here.
1207          */
1208
1209         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1210                                           DCERPC_PKT_ALTER_RESP,
1211                                           DCERPC_PFC_FLAG_FIRST |
1212                                                 DCERPC_PFC_FLAG_LAST,
1213                                           auth_resp.length,
1214                                           pkt->call_id,
1215                                           &u,
1216                                           &p->out_data.frag);
1217         if (!NT_STATUS_IS_OK(status)) {
1218                 DEBUG(0, ("Failed to marshall alter_resp packet. (%s)\n",
1219                           nt_errstr(status)));
1220                 goto err_exit;
1221         }
1222
1223         if (auth_resp.length) {
1224                 status = dcerpc_push_dcerpc_auth(pkt,
1225                                                  auth_info.auth_type,
1226                                                  auth_info.auth_level,
1227                                                  0, /* pad_len */
1228                                                  1, /* auth_context_id */
1229                                                  &auth_resp,
1230                                                  &auth_blob);
1231                 if (!NT_STATUS_IS_OK(status)) {
1232                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1233                         goto err_exit;
1234                 }
1235         }
1236
1237         /* Now that we have the auth len store it into the right place in
1238          * the dcerpc header */
1239         dcerpc_set_frag_length(&p->out_data.frag,
1240                                 p->out_data.frag.length +
1241                                 auth_blob.length);
1242
1243         if (auth_resp.length) {
1244                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1245                                         auth_blob.data, auth_blob.length)) {
1246                         DEBUG(0, ("Append of auth info failed.\n"));
1247                         goto err_exit;
1248                 }
1249         }
1250
1251         /*
1252          * Setup the lengths for the initial reply.
1253          */
1254
1255         p->out_data.data_sent_length = 0;
1256         p->out_data.current_pdu_sent = 0;
1257
1258         TALLOC_FREE(auth_blob.data);
1259         return True;
1260
1261   err_exit:
1262
1263         data_blob_free(&p->out_data.frag);
1264         TALLOC_FREE(auth_blob.data);
1265         return setup_bind_nak(p, pkt);
1266 }
1267
1268 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1269                        const struct api_struct *api_rpc_cmds, int n_cmds,
1270                        const struct ndr_syntax_id *syntax);
1271
1272 static bool srv_pipe_check_verification_trailer(struct pipes_struct *p,
1273                                                 struct ncacn_packet *pkt,
1274                                                 struct pipe_rpc_fns *pipe_fns)
1275 {
1276         TALLOC_CTX *frame = talloc_stackframe();
1277         struct dcerpc_sec_verification_trailer *vt = NULL;
1278         const uint32_t bitmask1 =
1279                 p->auth.client_hdr_signing ? DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING : 0;
1280         const struct dcerpc_sec_vt_pcontext pcontext = {
1281                 .abstract_syntax = pipe_fns->syntax,
1282                 .transfer_syntax = ndr_transfer_syntax_ndr,
1283         };
1284         const struct dcerpc_sec_vt_header2 header2 =
1285                dcerpc_sec_vt_header2_from_ncacn_packet(pkt);
1286         struct ndr_pull *ndr;
1287         enum ndr_err_code ndr_err;
1288         bool ret = false;
1289
1290         ndr = ndr_pull_init_blob(&p->in_data.data, frame);
1291         if (ndr == NULL) {
1292                 goto done;
1293         }
1294
1295         ndr_err = ndr_pop_dcerpc_sec_verification_trailer(ndr, frame, &vt);
1296         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1297                 goto done;
1298         }
1299
1300         ret = dcerpc_sec_verification_trailer_check(vt, &bitmask1,
1301                                                     &pcontext, &header2);
1302 done:
1303         TALLOC_FREE(frame);
1304         return ret;
1305 }
1306
1307 /****************************************************************************
1308  Find the correct RPC function to call for this request.
1309  If the pipe is authenticated then become the correct UNIX user
1310  before doing the call.
1311 ****************************************************************************/
1312
1313 static bool api_pipe_request(struct pipes_struct *p,
1314                                 struct ncacn_packet *pkt)
1315 {
1316         TALLOC_CTX *frame = talloc_stackframe();
1317         bool ret = False;
1318         struct pipe_rpc_fns *pipe_fns;
1319         const char *interface_name = NULL;
1320
1321         if (!p->pipe_bound) {
1322                 DEBUG(1, ("Pipe not bound!\n"));
1323                 data_blob_free(&p->out_data.rdata);
1324                 TALLOC_FREE(frame);
1325                 return false;
1326         }
1327
1328         /* get the set of RPC functions for this context */
1329         pipe_fns = find_pipe_fns_by_context(p->contexts,
1330                                             pkt->u.request.context_id);
1331         if (pipe_fns == NULL) {
1332                 DEBUG(0, ("No rpc function table associated with context "
1333                           "[%d]\n",
1334                           pkt->u.request.context_id));
1335                 data_blob_free(&p->out_data.rdata);
1336                 TALLOC_FREE(frame);
1337                 return false;
1338         }
1339
1340         interface_name = ndr_interface_name(&pipe_fns->syntax.uuid,
1341                                             pipe_fns->syntax.if_version);
1342         SMB_ASSERT(interface_name != NULL);
1343
1344         switch (p->auth.auth_level) {
1345         case DCERPC_AUTH_LEVEL_NONE:
1346         case DCERPC_AUTH_LEVEL_INTEGRITY:
1347         case DCERPC_AUTH_LEVEL_PRIVACY:
1348                 break;
1349         default:
1350                 if (!pipe_fns->allow_connect) {
1351                         char *addr;
1352
1353                         addr = tsocket_address_string(p->remote_address, frame);
1354
1355                         DEBUG(1, ("%s: restrict auth_level_connect access "
1356                                   "to [%s] with auth[type=0x%x,level=0x%x] "
1357                                   "on [%s] from [%s]\n",
1358                                   __func__, interface_name,
1359                                   p->auth.auth_type,
1360                                   p->auth.auth_level,
1361                                   derpc_transport_string_by_transport(p->transport),
1362                                   addr));
1363
1364                         setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_ACCESS_DENIED));
1365                         TALLOC_FREE(frame);
1366                         return true;
1367                 }
1368                 break;
1369         }
1370
1371         if (!srv_pipe_check_verification_trailer(p, pkt, pipe_fns)) {
1372                 DEBUG(1, ("srv_pipe_check_verification_trailer: failed\n"));
1373                 set_incoming_fault(p);
1374                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_ACCESS_DENIED));
1375                 data_blob_free(&p->out_data.rdata);
1376                 TALLOC_FREE(frame);
1377                 return true;
1378         }
1379
1380         if (!become_authenticated_pipe_user(p->session_info)) {
1381                 DEBUG(1, ("Failed to become pipe user!\n"));
1382                 data_blob_free(&p->out_data.rdata);
1383                 TALLOC_FREE(frame);
1384                 return false;
1385         }
1386
1387         DEBUG(5, ("Requested %s rpc service\n", interface_name));
1388
1389         ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds,
1390                          &pipe_fns->syntax);
1391         unbecome_authenticated_pipe_user();
1392
1393         TALLOC_FREE(frame);
1394         return ret;
1395 }
1396
1397 /*******************************************************************
1398  Calls the underlying RPC function for a named pipe.
1399  ********************************************************************/
1400
1401 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1402                        const struct api_struct *api_rpc_cmds, int n_cmds,
1403                        const struct ndr_syntax_id *syntax)
1404 {
1405         int fn_num;
1406         uint32_t offset1;
1407         const struct ndr_interface_table *table;
1408
1409         /* interpret the command */
1410         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1411                  ndr_interface_name(&syntax->uuid, syntax->if_version),
1412                  pkt->u.request.opnum));
1413
1414         table = ndr_table_by_uuid(&syntax->uuid);
1415         if (table == NULL) {
1416                 DEBUG(0,("unknown interface\n"));
1417                 return false;
1418         }
1419
1420         if (DEBUGLEVEL >= 50) {
1421                 fstring name;
1422                 slprintf(name, sizeof(name)-1, "in_%s",
1423                          dcerpc_default_transport_endpoint(pkt, NCACN_NP, table));
1424                 dump_pdu_region(name, pkt->u.request.opnum,
1425                                 &p->in_data.data, 0,
1426                                 p->in_data.data.length);
1427         }
1428
1429         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1430                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1431                     api_rpc_cmds[fn_num].fn != NULL) {
1432                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1433                                   api_rpc_cmds[fn_num].name));
1434                         break;
1435                 }
1436         }
1437
1438         if (fn_num == n_cmds) {
1439                 /*
1440                  * For an unknown RPC just return a fault PDU but
1441                  * return True to allow RPC's on the pipe to continue
1442                  * and not put the pipe into fault state. JRA.
1443                  */
1444                 DEBUG(4, ("unknown\n"));
1445                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1446                 return True;
1447         }
1448
1449         offset1 = p->out_data.rdata.length;
1450
1451         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1452                 fn_num, api_rpc_cmds[fn_num].fn));
1453         /* do the actual command */
1454         if(!api_rpc_cmds[fn_num].fn(p)) {
1455                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1456                          ndr_interface_name(&syntax->uuid, syntax->if_version),
1457                          api_rpc_cmds[fn_num].name));
1458                 data_blob_free(&p->out_data.rdata);
1459                 return False;
1460         }
1461
1462         if (p->fault_state) {
1463                 DEBUG(4,("api_rpcTNP: fault(%d) return.\n", p->fault_state));
1464                 setup_fault_pdu(p, NT_STATUS(p->fault_state));
1465                 p->fault_state = 0;
1466                 return true;
1467         }
1468
1469         if (DEBUGLEVEL >= 50) {
1470                 fstring name;
1471                 slprintf(name, sizeof(name)-1, "out_%s",
1472                          dcerpc_default_transport_endpoint(pkt, NCACN_NP, table));
1473                 dump_pdu_region(name, pkt->u.request.opnum,
1474                                 &p->out_data.rdata, offset1,
1475                                 p->out_data.rdata.length);
1476         }
1477
1478         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1479                  ndr_interface_name(&syntax->uuid, syntax->if_version)));
1480
1481         /* Check for buffer underflow in rpc parsing */
1482         if ((DEBUGLEVEL >= 10) &&
1483             (pkt->frag_length < p->in_data.data.length)) {
1484                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1485                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1486                               p->in_data.data.length - pkt->frag_length);
1487         }
1488
1489         return True;
1490 }
1491
1492 /****************************************************************************
1493  Initialise an outgoing packet.
1494 ****************************************************************************/
1495
1496 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1497 {
1498         output_data *o_data = &p->out_data;
1499
1500         /* Reset the offset counters. */
1501         o_data->data_sent_length = 0;
1502         o_data->current_pdu_sent = 0;
1503
1504         data_blob_free(&o_data->frag);
1505
1506         /* Free any memory in the current return data buffer. */
1507         data_blob_free(&o_data->rdata);
1508
1509         return True;
1510 }
1511
1512 /****************************************************************************
1513  Sets the fault state on incoming packets.
1514 ****************************************************************************/
1515
1516 void set_incoming_fault(struct pipes_struct *p)
1517 {
1518         data_blob_free(&p->in_data.data);
1519         p->in_data.pdu_needed_len = 0;
1520         p->in_data.pdu.length = 0;
1521         p->fault_state = DCERPC_NCA_S_PROTO_ERROR;
1522
1523         p->allow_alter = false;
1524         p->allow_auth3 = false;
1525         p->pipe_bound = false;
1526
1527         DEBUG(10, ("Setting fault state\n"));
1528 }
1529
1530 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1531                                     struct ncacn_packet *pkt,
1532                                     DATA_BLOB *raw_pkt)
1533 {
1534         NTSTATUS status;
1535         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1536
1537         DEBUG(10, ("Checking request auth.\n"));
1538
1539         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1540                 hdr_size += 16;
1541         }
1542
1543         /* in case of sealing this function will unseal the data in place */
1544         status = dcerpc_check_auth(auth, pkt,
1545                                    &pkt->u.request.stub_and_verifier,
1546                                    hdr_size, raw_pkt);
1547         if (!NT_STATUS_IS_OK(status)) {
1548                 return status;
1549         }
1550
1551         return NT_STATUS_OK;
1552 }
1553
1554 /****************************************************************************
1555  Processes a request pdu. This will do auth processing if needed, and
1556  appends the data into the complete stream if the LAST flag is not set.
1557 ****************************************************************************/
1558
1559 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1560 {
1561         NTSTATUS status;
1562         DATA_BLOB data;
1563         struct dcerpc_sec_vt_header2 hdr2;
1564
1565         if (!p->pipe_bound) {
1566                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1567                 set_incoming_fault(p);
1568                 return False;
1569         }
1570
1571         /*
1572          * We don't ignore DCERPC_PFC_FLAG_PENDING_CANCEL.
1573          * TODO: we can reject it with DCERPC_FAULT_NO_CALL_ACTIVE later.
1574          */
1575         status = dcerpc_verify_ncacn_packet_header(pkt,
1576                         DCERPC_PKT_REQUEST,
1577                         pkt->u.request.stub_and_verifier.length,
1578                         0, /* required_flags */
1579                         DCERPC_PFC_FLAG_FIRST |
1580                         DCERPC_PFC_FLAG_LAST |
1581                         0x08 | /* this is not defined, but should be ignored */
1582                         DCERPC_PFC_FLAG_CONC_MPX |
1583                         DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
1584                         DCERPC_PFC_FLAG_MAYBE |
1585                         DCERPC_PFC_FLAG_OBJECT_UUID);
1586         if (!NT_STATUS_IS_OK(status)) {
1587                 DEBUG(1, ("process_request_pdu: invalid pdu: %s\n",
1588                           nt_errstr(status)));
1589                 NDR_PRINT_DEBUG(ncacn_packet, pkt);
1590                 set_incoming_fault(p);
1591                 return false;
1592         }
1593
1594         hdr2 = dcerpc_sec_vt_header2_from_ncacn_packet(pkt);
1595         if (pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST) {
1596                 p->header2 = hdr2;
1597         } else {
1598                 if (!dcerpc_sec_vt_header2_equal(&hdr2, &p->header2)) {
1599                         set_incoming_fault(p);
1600                         return false;
1601                 }
1602         }
1603
1604         /* Store the opnum */
1605         p->opnum = pkt->u.request.opnum;
1606
1607         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1608         if (!NT_STATUS_IS_OK(status)) {
1609                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1610                           nt_errstr(status)));
1611                 set_incoming_fault(p);
1612                 return false;
1613         }
1614
1615         data = pkt->u.request.stub_and_verifier;
1616
1617         /*
1618          * Check the data length doesn't go over the 15Mb limit.
1619          * increased after observing a bug in the Windows NT 4.0 SP6a
1620          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1621          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1622          */
1623
1624         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1625                 DEBUG(0, ("process_request_pdu: "
1626                           "rpc data buffer too large (%u) + (%u)\n",
1627                           (unsigned int)p->in_data.data.length,
1628                           (unsigned int)data.length));
1629                 set_incoming_fault(p);
1630                 return False;
1631         }
1632
1633         /*
1634          * Append the data portion into the buffer and return.
1635          */
1636
1637         if (data.length) {
1638                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1639                                           data.data, data.length)) {
1640                         DEBUG(0, ("Unable to append data size %u "
1641                                   "to parse buffer of size %u.\n",
1642                                   (unsigned int)data.length,
1643                                   (unsigned int)p->in_data.data.length));
1644                         set_incoming_fault(p);
1645                         return False;
1646                 }
1647         }
1648
1649         if (!(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
1650                 return true;
1651         }
1652
1653         /*
1654          * Ok - we finally have a complete RPC stream.
1655          * Call the rpc command to process it.
1656          */
1657
1658         return api_pipe_request(p, pkt);
1659 }
1660
1661 void process_complete_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1662 {
1663         bool reply = false;
1664
1665         /* Store the call_id */
1666         p->call_id = pkt->call_id;
1667
1668         DEBUG(10, ("Processing packet type %u\n", (unsigned int)pkt->ptype));
1669
1670         if (!pipe_init_outgoing_data(p)) {
1671                 goto done;
1672         }
1673
1674         switch (pkt->ptype) {
1675         case DCERPC_PKT_REQUEST:
1676                 reply = process_request_pdu(p, pkt);
1677                 break;
1678
1679         case DCERPC_PKT_PING: /* CL request - ignore... */
1680                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1681                           (unsigned int)pkt->ptype));
1682                 break;
1683
1684         case DCERPC_PKT_RESPONSE: /* No responses here. */
1685                 DEBUG(0, ("Error - DCERPC_PKT_RESPONSE received from client"));
1686                 break;
1687
1688         case DCERPC_PKT_FAULT:
1689         case DCERPC_PKT_WORKING:
1690                 /* CL request - reply to a ping when a call in process. */
1691         case DCERPC_PKT_NOCALL:
1692                 /* CL - server reply to a ping call. */
1693         case DCERPC_PKT_REJECT:
1694         case DCERPC_PKT_ACK:
1695         case DCERPC_PKT_CL_CANCEL:
1696         case DCERPC_PKT_FACK:
1697         case DCERPC_PKT_CANCEL_ACK:
1698                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1699                           (unsigned int)pkt->ptype));
1700                 break;
1701
1702         case DCERPC_PKT_BIND:
1703                 /*
1704                  * We assume that a pipe bind is only in one pdu.
1705                  */
1706                 reply = api_pipe_bind_req(p, pkt);
1707                 break;
1708
1709         case DCERPC_PKT_BIND_ACK:
1710         case DCERPC_PKT_BIND_NAK:
1711                 DEBUG(0, ("Error - DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1712                           "packet type %u received.\n",
1713                           (unsigned int)pkt->ptype));
1714                 break;
1715
1716
1717         case DCERPC_PKT_ALTER:
1718                 /*
1719                  * We assume that a pipe bind is only in one pdu.
1720                  */
1721                 reply = api_pipe_alter_context(p, pkt);
1722                 break;
1723
1724         case DCERPC_PKT_ALTER_RESP:
1725                 DEBUG(0, ("Error - DCERPC_PKT_ALTER_RESP received: "
1726                           "Should only be server -> client.\n"));
1727                 break;
1728
1729         case DCERPC_PKT_AUTH3:
1730                 /*
1731                  * The third packet in an auth exchange.
1732                  */
1733                 reply = api_pipe_bind_auth3(p, pkt);
1734                 break;
1735
1736         case DCERPC_PKT_SHUTDOWN:
1737                 DEBUG(0, ("Error - DCERPC_PKT_SHUTDOWN received: "
1738                           "Should only be server -> client.\n"));
1739                 break;
1740
1741         case DCERPC_PKT_CO_CANCEL:
1742                 /* For now just free all client data and continue
1743                  * processing. */
1744                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1745                          " Abandoning rpc call.\n"));
1746                 /* As we never do asynchronous RPC serving, we can
1747                  * never cancel a call (as far as I know).
1748                  * If we ever did we'd have to send a cancel_ack reply.
1749                  * For now, just free all client data and continue
1750                  * processing. */
1751                 reply = True;
1752                 break;
1753
1754 #if 0
1755                 /* Enable this if we're doing async rpc. */
1756                 /* We must check the outstanding callid matches. */
1757                 if (pipe_init_outgoing_data(p)) {
1758                         /* Send a cancel_ack PDU reply. */
1759                         /* We should probably check the auth-verifier here. */
1760                         reply = setup_cancel_ack_reply(p, pkt);
1761                 }
1762                 break;
1763 #endif
1764
1765         case DCERPC_PKT_ORPHANED:
1766                 /* We should probably check the auth-verifier here.
1767                  * For now just free all client data and continue
1768                  * processing. */
1769                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
1770                           " Abandoning rpc call.\n"));
1771                 reply = True;
1772                 break;
1773
1774         default:
1775                 DEBUG(0, ("process_complete_pdu: "
1776                           "Unknown rpc type = %u received.\n",
1777                           (unsigned int)pkt->ptype));
1778                 break;
1779         }
1780
1781 done:
1782         if (!reply) {
1783                 DEBUG(3,("DCE/RPC fault sent!"));
1784                 set_incoming_fault(p);
1785                 setup_fault_pdu(p, NT_STATUS(DCERPC_NCA_S_PROTO_ERROR));
1786         }
1787         /* pkt and p->in_data.pdu.data freed by caller */
1788 }
1789