source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "system/filesys.h"
  32 #include "srv_pipe_internal.h"
  33 #include "../librpc/gen_ndr/ndr_schannel.h"
  34 #include "../libcli/auth/schannel.h"
  35 #include "../libcli/auth/spnego.h"
  36 #include "dcesrv_auth_generic.h"
  37 #include "dcesrv_gssapi.h"
  38 #include "dcesrv_spnego.h"
  39 #include "rpc_server.h"
  40 #include "rpc_dce.h"
  41 #include "smbd/smbd.h"
  42 #include "auth.h"
  43 #include "ntdomain.h"
  44 #include "rpc_server/srv_pipe.h"
  45 #include "rpc_server/rpc_contexts.h"
  46 #include "lib/param/param.h"
  47
  48 #undef DBGC_CLASS
  49 #define DBGC_CLASS DBGC_RPC_SRV
  50
  51 /**
  52  * Dump everything from the start of the end up of the provided data
  53  * into a file, but only at debug level >= 50
  54  **/
  55 static void dump_pdu_region(const char *name, int v,
  56                             DATA_BLOB *data, size_t start, size_t end)
  57 {
  58         int fd, i;
  59         char *fname = NULL;
  60         ssize_t sz;
  61
  62         if (DEBUGLEVEL < 50) return;
  63
  64         if (start > data->length || end > data->length || start > end) return;
  65
  66         for (i = 1; i < 100; i++) {
  67                 if (v != -1) {
  68                         fname = talloc_asprintf(talloc_tos(),
  69                                                 "/tmp/%s_%d.%d.prs",
  70                                                 name, v, i);
  71                 } else {
  72                         fname = talloc_asprintf(talloc_tos(),
  73                                                 "/tmp/%s_%d.prs",
  74                                                 name, i);
  75                 }
  76                 if (!fname) {
  77                         return;
  78                 }
  79                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  80                 if (fd != -1 || errno != EEXIST) break;
  81         }
  82         if (fd != -1) {
  83                 sz = write(fd, data->data + start, end - start);
  84                 i = close(fd);
  85                 if ((sz != end - start) || (i != 0) ) {
  86                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  87                                   fname, (unsigned long)sz,
  88                                   (unsigned long)end - start, i));
  89                 } else {
  90                         DEBUG(0,("created %s\n", fname));
  91                 }
  92         }
  93         TALLOC_FREE(fname);
  94 }
  95
  96 static DATA_BLOB generic_session_key(void)
  97 {
  98         return data_blob_const("SystemLibraryDTC", 16);
  99 }
 100
 101 /*******************************************************************
 102  Generate the next PDU to be returned from the data.
 103 ********************************************************************/
 104
 105 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
 106                                    struct pipe_auth_data *auth,
 107                                    uint32_t call_id,
 108                                    DATA_BLOB *rdata,
 109                                    size_t data_sent_length,
 110                                    DATA_BLOB *frag,
 111                                    size_t *pdu_size)
 112 {
 113         union dcerpc_payload u;
 114         uint8_t pfc_flags;
 115         size_t data_left;
 116         size_t data_to_send;
 117         size_t frag_len;
 118         size_t pad_len = 0;
 119         size_t auth_len = 0;
 120         NTSTATUS status;
 121
 122         ZERO_STRUCT(u.response);
 123
 124         /* Set up rpc packet pfc flags. */
 125         if (data_sent_length == 0) {
 126                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 127         } else {
 128                 pfc_flags = 0;
 129         }
 130
 131         /* Work out how much we can fit in a single PDU. */
 132         data_left = rdata->length - data_sent_length;
 133
 134         /* Ensure there really is data left to send. */
 135         if (!data_left) {
 136                 DEBUG(0, ("No data left to send !\n"));
 137                 return NT_STATUS_BUFFER_TOO_SMALL;
 138         }
 139
 140         status = dcerpc_guess_sizes(auth,
 141                                     DCERPC_RESPONSE_LENGTH,
 142                                     data_left,
 143                                     RPC_MAX_PDU_FRAG_LEN,
 144                                     SERVER_NDR_PADDING_SIZE,
 145                                     &data_to_send, &frag_len,
 146                                     &auth_len, &pad_len);
 147         if (!NT_STATUS_IS_OK(status)) {
 148                 return status;
 149         }
 150
 151         /* Set up the alloc hint. This should be the data left to send. */
 152         u.response.alloc_hint = data_left;
 153
 154         /* Work out if this PDU will be the last. */
 155         if (data_sent_length + data_to_send >= rdata->length) {
 156                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 157         }
 158
 159         /* Prepare data to be NDR encoded. */
 160         u.response.stub_and_verifier =
 161                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 162
 163         /* Store the packet in the data stream. */
 164         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 165                                           pfc_flags, auth_len, call_id,
 166                                           &u, frag);
 167         if (!NT_STATUS_IS_OK(status)) {
 168                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 169                 return status;
 170         }
 171
 172         if (auth_len) {
 173                 /* Set the proper length on the pdu, including padding.
 174                  * Only needed if an auth trailer will be appended. */
 175                 dcerpc_set_frag_length(frag, frag->length
 176                                                 + pad_len
 177                                                 + DCERPC_AUTH_TRAILER_LENGTH
 178                                                 + auth_len);
 179         }
 180
 181         if (auth_len) {
 182                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 183                 if (!NT_STATUS_IS_OK(status)) {
 184                         data_blob_free(frag);
 185                         return status;
 186                 }
 187         }
 188
 189         *pdu_size = data_to_send;
 190         return NT_STATUS_OK;
 191 }
 192
 193 /*******************************************************************
 194  Generate the next PDU to be returned from the data in p->rdata.
 195 ********************************************************************/
 196
 197 bool create_next_pdu(struct pipes_struct *p)
 198 {
 199         size_t pdu_size = 0;
 200         NTSTATUS status;
 201
 202         /*
 203          * If we're in the fault state, keep returning fault PDU's until
 204          * the pipe gets closed. JRA.
 205          */
 206         if (p->fault_state) {
 207                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 208                 return true;
 209         }
 210
 211         status = create_next_packet(p->mem_ctx, &p->auth,
 212                                     p->call_id, &p->out_data.rdata,
 213                                     p->out_data.data_sent_length,
 214                                     &p->out_data.frag, &pdu_size);
 215         if (!NT_STATUS_IS_OK(status)) {
 216                 DEBUG(0, ("Failed to create packet with error %s, "
 217                           "(auth level %u / type %u)\n",
 218                           nt_errstr(status),
 219                           (unsigned int)p->auth.auth_level,
 220                           (unsigned int)p->auth.auth_type));
 221                 return false;
 222         }
 223
 224         /* Setup the counts for this PDU. */
 225         p->out_data.data_sent_length += pdu_size;
 226         p->out_data.current_pdu_sent = 0;
 227         return true;
 228 }
 229
 230
 231 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 232
 233 /*******************************************************************
 234  Marshall a bind_nak pdu.
 235 *******************************************************************/
 236
 237 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 238 {
 239         NTSTATUS status;
 240         union dcerpc_payload u;
 241
 242         /* Free any memory in the current return data buffer. */
 243         pipe_init_outgoing_data(p);
 244
 245         /*
 246          * Initialize a bind_nak header.
 247          */
 248
 249         ZERO_STRUCT(u);
 250
 251         u.bind_nak.reject_reason  = 0;
 252
 253         /*
 254          * Marshall directly into the outgoing PDU space. We
 255          * must do this as we need to set to the bind response
 256          * header and are never sending more than one PDU here.
 257          */
 258
 259         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 260                                           DCERPC_PKT_BIND_NAK,
 261                                           DCERPC_PFC_FLAG_FIRST |
 262                                                 DCERPC_PFC_FLAG_LAST,
 263                                           0,
 264                                           pkt->call_id,
 265                                           &u,
 266                                           &p->out_data.frag);
 267         if (!NT_STATUS_IS_OK(status)) {
 268                 return False;
 269         }
 270
 271         p->out_data.data_sent_length = 0;
 272         p->out_data.current_pdu_sent = 0;
 273
 274         TALLOC_FREE(p->auth.auth_ctx);
 275         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 276         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 277         p->pipe_bound = False;
 278
 279         return True;
 280 }
 281
 282 /*******************************************************************
 283  Marshall a fault pdu.
 284 *******************************************************************/
 285
 286 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 287 {
 288         NTSTATUS status;
 289         union dcerpc_payload u;
 290
 291         /* Free any memory in the current return data buffer. */
 292         pipe_init_outgoing_data(p);
 293
 294         /*
 295          * Initialize a fault header.
 296          */
 297
 298         ZERO_STRUCT(u);
 299
 300         u.fault.status          = NT_STATUS_V(fault_status);
 301         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 302
 303         /*
 304          * Marshall directly into the outgoing PDU space. We
 305          * must do this as we need to set to the bind response
 306          * header and are never sending more than one PDU here.
 307          */
 308
 309         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 310                                           DCERPC_PKT_FAULT,
 311                                           DCERPC_PFC_FLAG_FIRST |
 312                                            DCERPC_PFC_FLAG_LAST |
 313                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 314                                           0,
 315                                           p->call_id,
 316                                           &u,
 317                                           &p->out_data.frag);
 318         if (!NT_STATUS_IS_OK(status)) {
 319                 return False;
 320         }
 321
 322         p->out_data.data_sent_length = 0;
 323         p->out_data.current_pdu_sent = 0;
 324
 325         return True;
 326 }
 327
 328 /*******************************************************************
 329  Ensure a bind request has the correct abstract & transfer interface.
 330  Used to reject unknown binds from Win2k.
 331 *******************************************************************/
 332
 333 static bool check_bind_req(struct pipes_struct *p,
 334                            struct ndr_syntax_id* abstract,
 335                            struct ndr_syntax_id* transfer,
 336                            uint32_t context_id)
 337 {
 338         struct pipe_rpc_fns *context_fns;
 339         bool ok;
 340
 341         DEBUG(3,("check_bind_req for %s\n",
 342                  get_pipe_name_from_syntax(talloc_tos(), abstract)));
 343
 344         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 345         if (rpc_srv_pipe_exists_by_id(abstract) &&
 346            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 347                 DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
 348                           rpc_srv_get_pipe_cli_name(abstract),
 349                           rpc_srv_get_pipe_srv_name(abstract)));
 350         } else {
 351                 return false;
 352         }
 353
 354         ok = init_pipe_handles(p, abstract);
 355         if (!ok) {
 356                 DEBUG(1, ("Failed to init pipe handles!\n"));
 357                 return false;
 358         }
 359
 360         context_fns = talloc(p, struct pipe_rpc_fns);
 361         if (context_fns == NULL) {
 362                 DEBUG(0,("check_bind_req: talloc() failed!\n"));
 363                 return false;
 364         }
 365
 366         context_fns->next = context_fns->prev = NULL;
 367         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 368         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 369         context_fns->context_id = context_id;
 370         context_fns->syntax = *abstract;
 371
 372         /* add to the list of open contexts */
 373
 374         DLIST_ADD( p->contexts, context_fns );
 375
 376         return True;
 377 }
 378
 379 /**
 380  * Is a named pipe known?
 381  * @param[in] cli_filename      The pipe name requested by the client
 382  * @result                      Do we want to serve this?
 383  */
 384 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
 385 {
 386         const char *pipename = cli_filename;
 387         NTSTATUS status;
 388
 389         if (strnequal(pipename, "\\PIPE\\", 6)) {
 390                 pipename += 5;
 391         }
 392
 393         if (*pipename == '\\') {
 394                 pipename += 1;
 395         }
 396
 397         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 398                 DEBUG(10, ("refusing spoolss access\n"));
 399                 return false;
 400         }
 401
 402         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 403                 return true;
 404         }
 405
 406         status = smb_probe_module("rpc", pipename);
 407         if (!NT_STATUS_IS_OK(status)) {
 408                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
 409                 return false;
 410         }
 411         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 412
 413         /*
 414          * Scan the list again for the interface id
 415          */
 416         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 417                 return true;
 418         }
 419
 420         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 421                    pipename));
 422
 423         return false;
 424 }
 425
 426 /*******************************************************************
 427  Handle the first part of a SPNEGO bind auth.
 428 *******************************************************************/
 429
 430 static bool pipe_spnego_auth_bind(struct pipes_struct *p,
 431                                   TALLOC_CTX *mem_ctx,
 432                                   struct dcerpc_auth *auth_info,
 433                                   DATA_BLOB *response)
 434 {
 435         struct spnego_context *spnego_ctx;
 436         NTSTATUS status;
 437
 438         status = spnego_server_auth_start(p,
 439                                           (auth_info->auth_level ==
 440                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 441                                           (auth_info->auth_level ==
 442                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 443                                           true,
 444                                           &auth_info->credentials,
 445                                           response,
 446                                           p->remote_address,
 447                                           &spnego_ctx);
 448         if (!NT_STATUS_IS_OK(status)) {
 449                 DEBUG(0, ("Failed SPNEGO negotiate (%s)\n",
 450                           nt_errstr(status)));
 451                 return false;
 452         }
 453
 454         /* Make sure data is bound to the memctx, to be freed the caller */
 455         talloc_steal(mem_ctx, response->data);
 456
 457         p->auth.auth_ctx = spnego_ctx;
 458         p->auth.auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 459
 460         DEBUG(10, ("SPNEGO auth started\n"));
 461
 462         return true;
 463 }
 464
 465 /*******************************************************************
 466  Handle an schannel bind auth.
 467 *******************************************************************/
 468
 469 static bool pipe_schannel_auth_bind(struct pipes_struct *p,
 470                                     TALLOC_CTX *mem_ctx,
 471                                     struct dcerpc_auth *auth_info,
 472                                     DATA_BLOB *response)
 473 {
 474         struct NL_AUTH_MESSAGE neg;
 475         struct NL_AUTH_MESSAGE reply;
 476         bool ret;
 477         NTSTATUS status;
 478         struct netlogon_creds_CredentialState *creds;
 479         enum ndr_err_code ndr_err;
 480         struct schannel_state *schannel_auth;
 481         struct loadparm_context *lp_ctx;
 482
 483         ndr_err = ndr_pull_struct_blob(
 484                         &auth_info->credentials, mem_ctx, &neg,
 485                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
 486         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 487                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
 488                 return false;
 489         }
 490
 491         if (DEBUGLEVEL >= 10) {
 492                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
 493         }
 494
 495         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
 496                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
 497                 return false;
 498         }
 499
 500         lp_ctx = loadparm_init_s3(p, loadparm_s3_context());
 501         if (!lp_ctx) {
 502                 DEBUG(0,("pipe_schannel_auth_bind: loadparm_init_s3() failed!\n"));
 503                 return false;
 504         }
 505
 506         /*
 507          * The neg.oem_netbios_computer.a key here must match the remote computer name
 508          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
 509          * operations that use credentials.
 510          */
 511
 512         become_root();
 513         status = schannel_get_creds_state(p, lp_ctx,
 514                                             neg.oem_netbios_computer.a, &creds);
 515         unbecome_root();
 516
 517         talloc_unlink(p, lp_ctx);
 518         if (!NT_STATUS_IS_OK(status)) {
 519                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
 520                 return False;
 521         }
 522
 523         schannel_auth = talloc(p, struct schannel_state);
 524         if (!schannel_auth) {
 525                 TALLOC_FREE(creds);
 526                 return False;
 527         }
 528
 529         schannel_auth->state = SCHANNEL_STATE_START;
 530         schannel_auth->seq_num = 0;
 531         schannel_auth->initiator = false;
 532         schannel_auth->creds = creds;
 533
 534         /*
 535          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
 536          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
 537          * struct of the person who opened the pipe. I need to test this further. JRA.
 538          *
 539          * VL. As we are mapping this to guest set the generic key
 540          * "SystemLibraryDTC" key here. It's a bit difficult to test against
 541          * W2k3, as it does not allow schannel binds against SAMR and LSA
 542          * anymore.
 543          */
 544
 545         ret = session_info_set_session_key(p->session_info, generic_session_key());
 546
 547         if (!ret) {
 548                 DEBUG(0, ("session_info_set_session_key failed\n"));
 549                 return false;
 550         }
 551
 552         /*** SCHANNEL verifier ***/
 553
 554         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
 555         reply.Flags                             = 0;
 556         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
 557                                                       * this has any meaning
 558                                                       * here - gd */
 559
 560         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
 561                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 562         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 563                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
 564                 return false;
 565         }
 566
 567         if (DEBUGLEVEL >= 10) {
 568                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
 569         }
 570
 571         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
 572                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
 573
 574         /* We're finished with this bind - no more packets. */
 575         p->auth.auth_ctx = schannel_auth;
 576         p->auth.auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
 577
 578         p->pipe_bound = True;
 579
 580         return True;
 581 }
 582
 583 /*******************************************************************
 584  Handle an NTLMSSP bind auth.
 585 *******************************************************************/
 586
 587 static bool pipe_auth_generic_bind(struct pipes_struct *p,
 588                                    TALLOC_CTX *mem_ctx,
 589                                    struct dcerpc_auth *auth_info,
 590                                    DATA_BLOB *response)
 591 {
 592         struct gensec_security *gensec_security = NULL;
 593         NTSTATUS status;
 594
 595         status = auth_generic_server_authtype_start(p,
 596                                                     auth_info->auth_type,
 597                                                     auth_info->auth_level,
 598                                                     &auth_info->credentials,
 599                                                     response,
 600                                                     p->remote_address,
 601                                                     &gensec_security);
 602         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 603                 DEBUG(0, (__location__ ": auth_generic_server_authtype_start failed: %s\n",
 604                           nt_errstr(status)));
 605                 return false;
 606         }
 607
 608         /* Make sure data is bound to the memctx, to be freed the caller */
 609         talloc_steal(mem_ctx, response->data);
 610
 611         p->auth.auth_ctx = gensec_security;
 612         p->auth.auth_type = auth_info->auth_type;
 613
 614         return true;
 615 }
 616
 617 /*******************************************************************
 618  Process an NTLMSSP authentication response.
 619  If this function succeeds, the user has been authenticated
 620  and their domain, name and calling workstation stored in
 621  the pipe struct.
 622 *******************************************************************/
 623
 624 static bool pipe_auth_generic_verify_final(TALLOC_CTX *mem_ctx,
 625                                 struct gensec_security *gensec_security,
 626                                 enum dcerpc_AuthLevel auth_level,
 627                                 struct auth_session_info **session_info)
 628 {
 629         NTSTATUS status;
 630         bool ret;
 631
 632         DEBUG(5, (__location__ ": checking user details\n"));
 633
 634         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 635            ensure the underlying NTLMSSP flags are also set. If not we should
 636            refuse the bind. */
 637
 638         status = auth_generic_server_check_flags(gensec_security,
 639                                             (auth_level ==
 640                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 641                                             (auth_level ==
 642                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 643         if (!NT_STATUS_IS_OK(status)) {
 644                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 645                           "security for rpc connection\n"));
 646                 return false;
 647         }
 648
 649         TALLOC_FREE(*session_info);
 650
 651         status = auth_generic_server_get_user_info(gensec_security,
 652                                                 mem_ctx, session_info);
 653         if (!NT_STATUS_IS_OK(status)) {
 654                 DEBUG(0, (__location__ ": failed to obtain the server info "
 655                           "for authenticated user: %s\n", nt_errstr(status)));
 656                 return false;
 657         }
 658
 659         if ((*session_info)->security_token == NULL) {
 660                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 661                 return false;
 662         }
 663
 664         /*
 665          * We're an authenticated bind over smb, so the session key needs to
 666          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 667          * does. See the RPC-SAMBA3SESSIONKEY.
 668          */
 669
 670         ret = session_info_set_session_key((*session_info), generic_session_key());
 671         if (!ret) {
 672                 DEBUG(0, ("Failed to set session key!\n"));
 673                 return false;
 674         }
 675
 676         return true;
 677 }
 678
 679 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 680 {
 681         enum spnego_mech auth_type;
 682         struct gensec_security *gensec_security;
 683         struct spnego_context *spnego_ctx;
 684         void *mech_ctx;
 685         NTSTATUS status;
 686
 687         switch (p->auth.auth_type) {
 688         case DCERPC_AUTH_TYPE_NTLMSSP:
 689         case DCERPC_AUTH_TYPE_KRB5:
 690                 gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
 691                                                         struct gensec_security);
 692                 if (!pipe_auth_generic_verify_final(p, gensec_security,
 693                                                 p->auth.auth_level,
 694                                                 &p->session_info)) {
 695                         return NT_STATUS_ACCESS_DENIED;
 696                 }
 697                 break;
 698         case DCERPC_AUTH_TYPE_SPNEGO:
 699                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 700                                                    struct spnego_context);
 701                 status = spnego_get_negotiated_mech(spnego_ctx,
 702                                                     &auth_type, &gensec_security);
 703                 if (!NT_STATUS_IS_OK(status)) {
 704                         DEBUG(0, ("Bad SPNEGO state (%s)\n",
 705                                   nt_errstr(status)));
 706                         return status;
 707                 }
 708                 if (!pipe_auth_generic_verify_final(p, gensec_security,
 709                                                     p->auth.auth_level,
 710                                                     &p->session_info)) {
 711                         return NT_STATUS_ACCESS_DENIED;
 712                 }
 713                 break;
 714         default:
 715                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
 716                           (unsigned int)p->auth.auth_type));
 717                 return NT_STATUS_ACCESS_DENIED;
 718         }
 719
 720         p->pipe_bound = true;
 721
 722         return NT_STATUS_OK;
 723 }
 724
 725 /*******************************************************************
 726  Respond to a pipe bind request.
 727 *******************************************************************/
 728
 729 static bool api_pipe_bind_req(struct pipes_struct *p,
 730                                 struct ncacn_packet *pkt)
 731 {
 732         struct dcerpc_auth auth_info;
 733         uint16 assoc_gid;
 734         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
 735         NTSTATUS status;
 736         struct ndr_syntax_id id;
 737         union dcerpc_payload u;
 738         struct dcerpc_ack_ctx bind_ack_ctx;
 739         DATA_BLOB auth_resp = data_blob_null;
 740         DATA_BLOB auth_blob = data_blob_null;
 741
 742         /* No rebinds on a bound pipe - use alter context. */
 743         if (p->pipe_bound) {
 744                 DEBUG(2,("Rejecting bind request on bound rpc connection\n"));
 745                 return setup_bind_nak(p, pkt);
 746         }
 747
 748         if (pkt->u.bind.num_contexts == 0) {
 749                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
 750                 goto err_exit;
 751         }
 752
 753         /*
 754          * Try and find the correct pipe name to ensure
 755          * that this is a pipe name we support.
 756          */
 757         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 758         if (rpc_srv_pipe_exists_by_id(&id)) {
 759                 DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 760                           rpc_srv_get_pipe_cli_name(&id),
 761                           rpc_srv_get_pipe_srv_name(&id)));
 762         } else {
 763                 status = smb_probe_module(
 764                         "rpc", get_pipe_name_from_syntax(
 765                                 talloc_tos(),
 766                                 &id));
 767
 768                 if (NT_STATUS_IS_ERR(status)) {
 769                         DEBUG(3,("api_pipe_bind_req: Unknown rpc service name "
 770                                  "%s in bind request.\n",
 771                                  get_pipe_name_from_syntax(talloc_tos(), &id)));
 772
 773                         return setup_bind_nak(p, pkt);
 774                 }
 775
 776                 if (rpc_srv_get_pipe_interface_by_cli_name(
 777                                 get_pipe_name_from_syntax(talloc_tos(),
 778                                                           &id),
 779                                 &id)) {
 780                         DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 781                                   rpc_srv_get_pipe_cli_name(&id),
 782                                   rpc_srv_get_pipe_srv_name(&id)));
 783                 } else {
 784                         DEBUG(0, ("module %s doesn't provide functions for "
 785                                   "pipe %s!\n",
 786                                   get_pipe_name_from_syntax(talloc_tos(), &id),
 787                                   get_pipe_name_from_syntax(talloc_tos(), &id)));
 788                         return setup_bind_nak(p, pkt);
 789                 }
 790         }
 791
 792         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 793
 794         if (pkt->u.bind.assoc_group_id != 0) {
 795                 assoc_gid = pkt->u.bind.assoc_group_id;
 796         } else {
 797                 assoc_gid = 0x53f0;
 798         }
 799
 800         /*
 801          * Create the bind response struct.
 802          */
 803
 804         /* If the requested abstract synt uuid doesn't match our client pipe,
 805                 reject the bind_ack & set the transfer interface synt to all 0's,
 806                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 807                 unknown to NT4)
 808                 Needed when adding entries to a DACL from NT5 - SK */
 809
 810         if (check_bind_req(p,
 811                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 812                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 813                         pkt->u.bind.ctx_list[0].context_id)) {
 814
 815                 bind_ack_ctx.result = 0;
 816                 bind_ack_ctx.reason = 0;
 817                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 818         } else {
 819                 p->pipe_bound = False;
 820                 /* Rejection reason: abstract syntax not supported */
 821                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 822                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
 823                 bind_ack_ctx.syntax = null_ndr_syntax_id;
 824         }
 825
 826         /*
 827          * Check if this is an authenticated bind request.
 828          */
 829         if (pkt->auth_length) {
 830                 /* Quick length check. Won't catch a bad auth footer,
 831                  * prevents overrun. */
 832
 833                 if (pkt->frag_length < RPC_HEADER_LEN +
 834                                         DCERPC_AUTH_TRAILER_LENGTH +
 835                                         pkt->auth_length) {
 836                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
 837                                 "too long for fragment %u.\n",
 838                                 (unsigned int)pkt->auth_length,
 839                                 (unsigned int)pkt->frag_length));
 840                         goto err_exit;
 841                 }
 842
 843                 /*
 844                  * Decode the authentication verifier.
 845                  */
 846                 status = dcerpc_pull_dcerpc_auth(pkt,
 847                                                  &pkt->u.bind.auth_info,
 848                                                  &auth_info, p->endian);
 849                 if (!NT_STATUS_IS_OK(status)) {
 850                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
 851                         goto err_exit;
 852                 }
 853
 854                 auth_type = auth_info.auth_type;
 855
 856                 /* Work out if we have to sign or seal etc. */
 857                 switch (auth_info.auth_level) {
 858                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 859                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 860                         break;
 861                 case DCERPC_AUTH_LEVEL_PRIVACY:
 862                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 863                         break;
 864                 case DCERPC_AUTH_LEVEL_CONNECT:
 865                         p->auth.auth_level = DCERPC_AUTH_LEVEL_CONNECT;
 866                         break;
 867                 default:
 868                         DEBUG(0, ("Unexpected auth level (%u).\n",
 869                                 (unsigned int)auth_info.auth_level ));
 870                         goto err_exit;
 871                 }
 872
 873                 switch (auth_type) {
 874                 case DCERPC_AUTH_TYPE_NTLMSSP:
 875                         if (!pipe_auth_generic_bind(p, pkt,
 876                                                     &auth_info, &auth_resp)) {
 877                                 goto err_exit;
 878                         }
 879                         assoc_gid = 0x7a77;
 880                         break;
 881
 882                 case DCERPC_AUTH_TYPE_SCHANNEL:
 883                         if (!pipe_schannel_auth_bind(p, pkt,
 884                                                 &auth_info, &auth_resp)) {
 885                                 goto err_exit;
 886                         }
 887                         break;
 888
 889                 case DCERPC_AUTH_TYPE_SPNEGO:
 890                         if (!pipe_spnego_auth_bind(p, pkt,
 891                                                 &auth_info, &auth_resp)) {
 892                                 goto err_exit;
 893                         }
 894                         break;
 895
 896                 case DCERPC_AUTH_TYPE_KRB5:
 897                         if (!pipe_auth_generic_bind(p, pkt,
 898                                                     &auth_info, &auth_resp)) {
 899                                 goto err_exit;
 900                         }
 901                         break;
 902
 903                 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
 904                         if (p->transport == NCALRPC && p->ncalrpc_as_system) {
 905                                 TALLOC_FREE(p->session_info);
 906
 907                                 status = make_session_info_system(p,
 908                                                                   &p->session_info);
 909                                 if (!NT_STATUS_IS_OK(status)) {
 910                                         goto err_exit;
 911                                 }
 912
 913                                 auth_resp = data_blob_talloc(pkt,
 914                                                              "NCALRPC_AUTH_OK",
 915                                                              15);
 916
 917                                 p->auth.auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
 918                                 p->pipe_bound = true;
 919                         } else {
 920                                 goto err_exit;
 921                         }
 922                         break;
 923
 924                 case DCERPC_AUTH_TYPE_NONE:
 925                         break;
 926
 927                 default:
 928                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
 929                         goto err_exit;
 930                 }
 931         }
 932
 933         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
 934                 /* Unauthenticated bind request. */
 935                 /* We're finished - no more packets. */
 936                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 937                 /* We must set the pipe auth_level here also. */
 938                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 939                 p->pipe_bound = True;
 940                 /* The session key was initialized from the SMB
 941                  * session in make_internal_rpc_pipe_p */
 942         }
 943
 944         ZERO_STRUCT(u.bind_ack);
 945         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
 946         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
 947         u.bind_ack.assoc_group_id = assoc_gid;
 948
 949         /* name has to be \PIPE\xxxxx */
 950         u.bind_ack.secondary_address =
 951                         talloc_asprintf(pkt, "\\PIPE\\%s",
 952                                         rpc_srv_get_pipe_srv_name(&id));
 953         if (!u.bind_ack.secondary_address) {
 954                 DEBUG(0, ("Out of memory!\n"));
 955                 goto err_exit;
 956         }
 957         u.bind_ack.secondary_address_size =
 958                                 strlen(u.bind_ack.secondary_address) + 1;
 959
 960         u.bind_ack.num_results = 1;
 961         u.bind_ack.ctx_list = &bind_ack_ctx;
 962
 963         /* NOTE: We leave the auth_info empty so we can calculate the padding
 964          * later and then append the auth_info --simo */
 965
 966         /*
 967          * Marshall directly into the outgoing PDU space. We
 968          * must do this as we need to set to the bind response
 969          * header and are never sending more than one PDU here.
 970          */
 971
 972         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 973                                           DCERPC_PKT_BIND_ACK,
 974                                           DCERPC_PFC_FLAG_FIRST |
 975                                                 DCERPC_PFC_FLAG_LAST,
 976                                           auth_resp.length,
 977                                           pkt->call_id,
 978                                           &u,
 979                                           &p->out_data.frag);
 980         if (!NT_STATUS_IS_OK(status)) {
 981                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
 982                           nt_errstr(status)));
 983         }
 984
 985         if (auth_resp.length) {
 986
 987                 status = dcerpc_push_dcerpc_auth(pkt,
 988                                                  auth_type,
 989                                                  auth_info.auth_level,
 990                                                  0,
 991                                                  1, /* auth_context_id */
 992                                                  &auth_resp,
 993                                                  &auth_blob);
 994                 if (!NT_STATUS_IS_OK(status)) {
 995                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
 996                         goto err_exit;
 997                 }
 998         }
 999
1000         /* Now that we have the auth len store it into the right place in
1001          * the dcerpc header */
1002         dcerpc_set_frag_length(&p->out_data.frag,
1003                                 p->out_data.frag.length + auth_blob.length);
1004
1005         if (auth_blob.length) {
1006
1007                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1008                                         auth_blob.data, auth_blob.length)) {
1009                         DEBUG(0, ("Append of auth info failed.\n"));
1010                         goto err_exit;
1011                 }
1012         }
1013
1014         /*
1015          * Setup the lengths for the initial reply.
1016          */
1017
1018         p->out_data.data_sent_length = 0;
1019         p->out_data.current_pdu_sent = 0;
1020
1021         TALLOC_FREE(auth_blob.data);
1022         return True;
1023
1024   err_exit:
1025
1026         data_blob_free(&p->out_data.frag);
1027         TALLOC_FREE(auth_blob.data);
1028         return setup_bind_nak(p, pkt);
1029 }
1030
1031 /*******************************************************************
1032  This is the "stage3" response after a bind request and reply.
1033 *******************************************************************/
1034
1035 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
1036 {
1037         struct dcerpc_auth auth_info;
1038         DATA_BLOB response = data_blob_null;
1039         struct gensec_security *gensec_security;
1040         struct spnego_context *spnego_ctx;
1041         NTSTATUS status;
1042
1043         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
1044
1045         if (pkt->auth_length == 0) {
1046                 DEBUG(0, ("No auth field sent for bind request!\n"));
1047                 goto err;
1048         }
1049
1050         /* Ensure there's enough data for an authenticated request. */
1051         if (pkt->frag_length < RPC_HEADER_LEN
1052                                 + DCERPC_AUTH_TRAILER_LENGTH
1053                                 + pkt->auth_length) {
1054                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
1055                                 "%u is too large.\n",
1056                         (unsigned int)pkt->auth_length));
1057                 goto err;
1058         }
1059
1060         /*
1061          * Decode the authentication verifier response.
1062          */
1063
1064         status = dcerpc_pull_dcerpc_auth(pkt,
1065                                          &pkt->u.auth3.auth_info,
1066                                          &auth_info, p->endian);
1067         if (!NT_STATUS_IS_OK(status)) {
1068                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
1069                 goto err;
1070         }
1071
1072         /* We must NEVER look at auth_info->auth_pad_len here,
1073          * as old Samba client code gets it wrong and sends it
1074          * as zero. JRA.
1075          */
1076
1077         if (auth_info.auth_type != p->auth.auth_type) {
1078                 DEBUG(0, ("Auth type mismatch! Client sent %d, "
1079                           "but auth was started as type %d!\n",
1080                           auth_info.auth_type, p->auth.auth_type));
1081                 goto err;
1082         }
1083
1084         switch (auth_info.auth_type) {
1085         case DCERPC_AUTH_TYPE_NTLMSSP:
1086         case DCERPC_AUTH_TYPE_KRB5:
1087                 gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
1088                                                     struct gensec_security);
1089                 status = auth_generic_server_step(gensec_security,
1090                                              pkt, &auth_info.credentials,
1091                                              &response);
1092                 break;
1093         case DCERPC_AUTH_TYPE_SPNEGO:
1094                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1095                                                    struct spnego_context);
1096                 status = spnego_server_step(spnego_ctx,
1097                                             pkt, &auth_info.credentials,
1098                                             &response);
1099                 break;
1100         default:
1101                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
1102                           (unsigned int)auth_info.auth_type));
1103                 return false;
1104         }
1105
1106         if (NT_STATUS_EQUAL(status,
1107                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1108             response.length) {
1109                 DEBUG(0, (__location__ ": This was supposed to be the final "
1110                           "leg, but crypto machinery claims a response is "
1111                           "needed, aborting auth!\n"));
1112                 data_blob_free(&response);
1113                 goto err;
1114         }
1115         if (!NT_STATUS_IS_OK(status)) {
1116                 DEBUG(0, ("Auth failed (%s)\n", nt_errstr(status)));
1117                 goto err;
1118         }
1119
1120         /* Now verify auth was indeed successful and extract server info */
1121         status = pipe_auth_verify_final(p);
1122         if (!NT_STATUS_IS_OK(status)) {
1123                 DEBUG(0, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1124                 goto err;
1125         }
1126
1127         return true;
1128
1129 err:
1130
1131         TALLOC_FREE(p->auth.auth_ctx);
1132         return false;
1133 }
1134
1135 /****************************************************************************
1136  Deal with an alter context call. Can be third part of 3 leg auth request for
1137  SPNEGO calls.
1138 ****************************************************************************/
1139
1140 static bool api_pipe_alter_context(struct pipes_struct *p,
1141                                         struct ncacn_packet *pkt)
1142 {
1143         struct dcerpc_auth auth_info;
1144         uint16 assoc_gid;
1145         NTSTATUS status;
1146         union dcerpc_payload u;
1147         struct dcerpc_ack_ctx bind_ack_ctx;
1148         DATA_BLOB auth_resp = data_blob_null;
1149         DATA_BLOB auth_blob = data_blob_null;
1150         int pad_len = 0;
1151         struct gensec_security *gensec_security;
1152         struct spnego_context *spnego_ctx;
1153
1154         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1155
1156         if (pkt->u.bind.assoc_group_id != 0) {
1157                 assoc_gid = pkt->u.bind.assoc_group_id;
1158         } else {
1159                 assoc_gid = 0x53f0;
1160         }
1161
1162         /*
1163          * Create the bind response struct.
1164          */
1165
1166         /* If the requested abstract synt uuid doesn't match our client pipe,
1167                 reject the bind_ack & set the transfer interface synt to all 0's,
1168                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1169                 unknown to NT4)
1170                 Needed when adding entries to a DACL from NT5 - SK */
1171
1172         if (check_bind_req(p,
1173                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1174                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1175                         pkt->u.bind.ctx_list[0].context_id)) {
1176
1177                 bind_ack_ctx.result = 0;
1178                 bind_ack_ctx.reason = 0;
1179                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1180         } else {
1181                 p->pipe_bound = False;
1182                 /* Rejection reason: abstract syntax not supported */
1183                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1184                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1185                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1186         }
1187
1188         /*
1189          * Check if this is an authenticated alter context request.
1190          */
1191         if (pkt->auth_length) {
1192                 /* Quick length check. Won't catch a bad auth footer,
1193                  * prevents overrun. */
1194
1195                 if (pkt->frag_length < RPC_HEADER_LEN +
1196                                         DCERPC_AUTH_TRAILER_LENGTH +
1197                                         pkt->auth_length) {
1198                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1199                                 "too long for fragment %u.\n",
1200                                 (unsigned int)pkt->auth_length,
1201                                 (unsigned int)pkt->frag_length ));
1202                         goto err_exit;
1203                 }
1204
1205                 status = dcerpc_pull_dcerpc_auth(pkt,
1206                                                  &pkt->u.bind.auth_info,
1207                                                  &auth_info, p->endian);
1208                 if (!NT_STATUS_IS_OK(status)) {
1209                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1210                         goto err_exit;
1211                 }
1212
1213                 /* We can only finish if the pipe is unbound for now */
1214                 if (p->pipe_bound) {
1215                         DEBUG(0, (__location__ ": Pipe already bound, "
1216                                   "Altering Context not yet supported!\n"));
1217                         goto err_exit;
1218                 }
1219
1220                 if (auth_info.auth_type != p->auth.auth_type) {
1221                         DEBUG(0, ("Auth type mismatch! Client sent %d, "
1222                                   "but auth was started as type %d!\n",
1223                                   auth_info.auth_type, p->auth.auth_type));
1224                         goto err_exit;
1225                 }
1226
1227
1228                 switch (auth_info.auth_type) {
1229                 case DCERPC_AUTH_TYPE_SPNEGO:
1230                         spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1231                                                         struct spnego_context);
1232                         status = spnego_server_step(spnego_ctx,
1233                                                     pkt,
1234                                                     &auth_info.credentials,
1235                                                     &auth_resp);
1236                         break;
1237
1238                 case DCERPC_AUTH_TYPE_KRB5:
1239                 case DCERPC_AUTH_TYPE_NTLMSSP:
1240                         gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
1241                                                     struct gensec_security);
1242                         status = auth_generic_server_step(gensec_security,
1243                                                      pkt,
1244                                                      &auth_info.credentials,
1245                                                      &auth_resp);
1246                         break;
1247
1248                 default:
1249                         DEBUG(3, (__location__ ": Usupported auth type (%d) "
1250                                   "in alter-context call\n",
1251                                   auth_info.auth_type));
1252                         goto err_exit;
1253                 }
1254
1255                 if (NT_STATUS_IS_OK(status)) {
1256                         /* third leg of auth, verify auth info */
1257                         status = pipe_auth_verify_final(p);
1258                         if (!NT_STATUS_IS_OK(status)) {
1259                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1260                                           nt_errstr(status)));
1261                                 goto err_exit;
1262                         }
1263                 } else if (NT_STATUS_EQUAL(status,
1264                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1265                         DEBUG(10, ("More auth legs required.\n"));
1266                 } else {
1267                         DEBUG(0, ("Auth step returned an error (%s)\n",
1268                                   nt_errstr(status)));
1269                         goto err_exit;
1270                 }
1271         }
1272
1273         ZERO_STRUCT(u.alter_resp);
1274         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1275         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1276         u.alter_resp.assoc_group_id = assoc_gid;
1277
1278         /* secondary address CAN be NULL
1279          * as the specs say it's ignored.
1280          * It MUST be NULL to have the spoolss working.
1281          */
1282         u.alter_resp.secondary_address = "";
1283         u.alter_resp.secondary_address_size = 1;
1284
1285         u.alter_resp.num_results = 1;
1286         u.alter_resp.ctx_list = &bind_ack_ctx;
1287
1288         /* NOTE: We leave the auth_info empty so we can calculate the padding
1289          * later and then append the auth_info --simo */
1290
1291         /*
1292          * Marshall directly into the outgoing PDU space. We
1293          * must do this as we need to set to the bind response
1294          * header and are never sending more than one PDU here.
1295          */
1296
1297         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1298                                           DCERPC_PKT_ALTER_RESP,
1299                                           DCERPC_PFC_FLAG_FIRST |
1300                                                 DCERPC_PFC_FLAG_LAST,
1301                                           auth_resp.length,
1302                                           pkt->call_id,
1303                                           &u,
1304                                           &p->out_data.frag);
1305         if (!NT_STATUS_IS_OK(status)) {
1306                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1307                           nt_errstr(status)));
1308         }
1309
1310         if (auth_resp.length) {
1311
1312                 /* Work out any padding needed before the auth footer. */
1313                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1314                 if (pad_len) {
1315                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1316                         DEBUG(10, ("auth pad_len = %u\n",
1317                                    (unsigned int)pad_len));
1318                 }
1319
1320                 status = dcerpc_push_dcerpc_auth(pkt,
1321                                                  auth_info.auth_type,
1322                                                  auth_info.auth_level,
1323                                                  pad_len,
1324                                                  1, /* auth_context_id */
1325                                                  &auth_resp,
1326                                                  &auth_blob);
1327                 if (!NT_STATUS_IS_OK(status)) {
1328                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1329                         goto err_exit;
1330                 }
1331         }
1332
1333         /* Now that we have the auth len store it into the right place in
1334          * the dcerpc header */
1335         dcerpc_set_frag_length(&p->out_data.frag,
1336                                 p->out_data.frag.length +
1337                                         pad_len + auth_blob.length);
1338
1339         if (auth_resp.length) {
1340                 if (pad_len) {
1341                         char pad[SERVER_NDR_PADDING_SIZE];
1342                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1343                         if (!data_blob_append(p->mem_ctx,
1344                                                 &p->out_data.frag,
1345                                                 pad, pad_len)) {
1346                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1347                                           "%u bytes of pad data.\n",
1348                                           (unsigned int)pad_len));
1349                                 goto err_exit;
1350                         }
1351                 }
1352
1353                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1354                                         auth_blob.data, auth_blob.length)) {
1355                         DEBUG(0, ("Append of auth info failed.\n"));
1356                         goto err_exit;
1357                 }
1358         }
1359
1360         /*
1361          * Setup the lengths for the initial reply.
1362          */
1363
1364         p->out_data.data_sent_length = 0;
1365         p->out_data.current_pdu_sent = 0;
1366
1367         TALLOC_FREE(auth_blob.data);
1368         return True;
1369
1370   err_exit:
1371
1372         data_blob_free(&p->out_data.frag);
1373         TALLOC_FREE(auth_blob.data);
1374         return setup_bind_nak(p, pkt);
1375 }
1376
1377 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1378                        const struct api_struct *api_rpc_cmds, int n_cmds,
1379                        const struct ndr_syntax_id *syntax);
1380
1381 /****************************************************************************
1382  Find the correct RPC function to call for this request.
1383  If the pipe is authenticated then become the correct UNIX user
1384  before doing the call.
1385 ****************************************************************************/
1386
1387 static bool api_pipe_request(struct pipes_struct *p,
1388                                 struct ncacn_packet *pkt)
1389 {
1390         bool ret = False;
1391         struct pipe_rpc_fns *pipe_fns;
1392
1393         if (!p->pipe_bound) {
1394                 DEBUG(1, ("Pipe not bound!\n"));
1395                 data_blob_free(&p->out_data.rdata);
1396                 return false;
1397         }
1398
1399         if (!become_authenticated_pipe_user(p->session_info)) {
1400                 DEBUG(1, ("Failed to become pipe user!\n"));
1401                 data_blob_free(&p->out_data.rdata);
1402                 return false;
1403         }
1404
1405         /* get the set of RPC functions for this context */
1406
1407         pipe_fns = find_pipe_fns_by_context(p->contexts,
1408                                             pkt->u.request.context_id);
1409
1410         if ( pipe_fns ) {
1411                 TALLOC_CTX *frame = talloc_stackframe();
1412
1413                 DEBUG(5, ("Requested %s rpc service\n",
1414                           get_pipe_name_from_syntax(talloc_tos(), &pipe_fns->syntax)));
1415
1416                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds,
1417                                  &pipe_fns->syntax);
1418
1419                 TALLOC_FREE(frame);
1420         }
1421         else {
1422                 DEBUG(0, ("No rpc function table associated with context "
1423                           "[%d]\n",
1424                           pkt->u.request.context_id));
1425         }
1426
1427         unbecome_authenticated_pipe_user();
1428
1429         return ret;
1430 }
1431
1432 /*******************************************************************
1433  Calls the underlying RPC function for a named pipe.
1434  ********************************************************************/
1435
1436 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1437                        const struct api_struct *api_rpc_cmds, int n_cmds,
1438                        const struct ndr_syntax_id *syntax)
1439 {
1440         int fn_num;
1441         uint32_t offset1;
1442
1443         /* interpret the command */
1444         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1445                  get_pipe_name_from_syntax(talloc_tos(), syntax),
1446                  pkt->u.request.opnum));
1447
1448         if (DEBUGLEVEL >= 50) {
1449                 fstring name;
1450                 slprintf(name, sizeof(name)-1, "in_%s",
1451                          get_pipe_name_from_syntax(talloc_tos(), syntax));
1452                 dump_pdu_region(name, pkt->u.request.opnum,
1453                                 &p->in_data.data, 0,
1454                                 p->in_data.data.length);
1455         }
1456
1457         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1458                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1459                     api_rpc_cmds[fn_num].fn != NULL) {
1460                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1461                                   api_rpc_cmds[fn_num].name));
1462                         break;
1463                 }
1464         }
1465
1466         if (fn_num == n_cmds) {
1467                 /*
1468                  * For an unknown RPC just return a fault PDU but
1469                  * return True to allow RPC's on the pipe to continue
1470                  * and not put the pipe into fault state. JRA.
1471                  */
1472                 DEBUG(4, ("unknown\n"));
1473                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1474                 return True;
1475         }
1476
1477         offset1 = p->out_data.rdata.length;
1478
1479         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1480                 fn_num, api_rpc_cmds[fn_num].fn));
1481         /* do the actual command */
1482         if(!api_rpc_cmds[fn_num].fn(p)) {
1483                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1484                          get_pipe_name_from_syntax(talloc_tos(), syntax),
1485                          api_rpc_cmds[fn_num].name));
1486                 data_blob_free(&p->out_data.rdata);
1487                 return False;
1488         }
1489
1490         if (p->bad_handle_fault_state) {
1491                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1492                 p->bad_handle_fault_state = False;
1493                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
1494                 return True;
1495         }
1496
1497         if (p->rng_fault_state) {
1498                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
1499                 p->rng_fault_state = False;
1500                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1501                 return True;
1502         }
1503
1504         if (DEBUGLEVEL >= 50) {
1505                 fstring name;
1506                 slprintf(name, sizeof(name)-1, "out_%s",
1507                          get_pipe_name_from_syntax(talloc_tos(), syntax));
1508                 dump_pdu_region(name, pkt->u.request.opnum,
1509                                 &p->out_data.rdata, offset1,
1510                                 p->out_data.rdata.length);
1511         }
1512
1513         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1514                  get_pipe_name_from_syntax(talloc_tos(), syntax)));
1515
1516         /* Check for buffer underflow in rpc parsing */
1517         if ((DEBUGLEVEL >= 10) &&
1518             (pkt->frag_length < p->in_data.data.length)) {
1519                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1520                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1521                               p->in_data.data.length - pkt->frag_length);
1522         }
1523
1524         return True;
1525 }
1526
1527 /****************************************************************************
1528  Initialise an outgoing packet.
1529 ****************************************************************************/
1530
1531 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1532 {
1533         output_data *o_data = &p->out_data;
1534
1535         /* Reset the offset counters. */
1536         o_data->data_sent_length = 0;
1537         o_data->current_pdu_sent = 0;
1538
1539         data_blob_free(&o_data->frag);
1540
1541         /* Free any memory in the current return data buffer. */
1542         data_blob_free(&o_data->rdata);
1543
1544         return True;
1545 }
1546
1547 /****************************************************************************
1548  Sets the fault state on incoming packets.
1549 ****************************************************************************/
1550
1551 void set_incoming_fault(struct pipes_struct *p)
1552 {
1553         data_blob_free(&p->in_data.data);
1554         p->in_data.pdu_needed_len = 0;
1555         p->in_data.pdu.length = 0;
1556         p->fault_state = True;
1557
1558         DEBUG(10, ("Setting fault state\n"));
1559 }
1560
1561 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1562                                     struct ncacn_packet *pkt,
1563                                     DATA_BLOB *raw_pkt)
1564 {
1565         NTSTATUS status;
1566         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1567         size_t pad_len;
1568
1569         DEBUG(10, ("Checking request auth.\n"));
1570
1571         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1572                 hdr_size += 16;
1573         }
1574
1575         /* in case of sealing this function will unseal the data in place */
1576         status = dcerpc_check_auth(auth, pkt,
1577                                    &pkt->u.request.stub_and_verifier,
1578                                    hdr_size, raw_pkt,
1579                                    &pad_len);
1580         if (!NT_STATUS_IS_OK(status)) {
1581                 return status;
1582         }
1583
1584
1585         /* remove padding and auth trailer,
1586          * this way the caller will get just the data */
1587         if (pkt->auth_length) {
1588                 size_t trail_len = pad_len
1589                                         + DCERPC_AUTH_TRAILER_LENGTH
1590                                         + pkt->auth_length;
1591                 if (pkt->u.request.stub_and_verifier.length < trail_len) {
1592                         return NT_STATUS_INFO_LENGTH_MISMATCH;
1593                 }
1594                 pkt->u.request.stub_and_verifier.length -= trail_len;
1595         }
1596
1597         return NT_STATUS_OK;
1598 }
1599
1600 /****************************************************************************
1601  Processes a request pdu. This will do auth processing if needed, and
1602  appends the data into the complete stream if the LAST flag is not set.
1603 ****************************************************************************/
1604
1605 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1606 {
1607         NTSTATUS status;
1608         DATA_BLOB data;
1609
1610         if (!p->pipe_bound) {
1611                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1612                 set_incoming_fault(p);
1613                 return False;
1614         }
1615
1616         /* Store the opnum */
1617         p->opnum = pkt->u.request.opnum;
1618
1619         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1620         if (!NT_STATUS_IS_OK(status)) {
1621                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1622                           nt_errstr(status)));
1623                 set_incoming_fault(p);
1624                 return false;
1625         }
1626
1627         data = pkt->u.request.stub_and_verifier;
1628
1629         /*
1630          * Check the data length doesn't go over the 15Mb limit.
1631          * increased after observing a bug in the Windows NT 4.0 SP6a
1632          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1633          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1634          */
1635
1636         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1637                 DEBUG(0, ("process_request_pdu: "
1638                           "rpc data buffer too large (%u) + (%u)\n",
1639                           (unsigned int)p->in_data.data.length,
1640                           (unsigned int)data.length));
1641                 set_incoming_fault(p);
1642                 return False;
1643         }
1644
1645         /*
1646          * Append the data portion into the buffer and return.
1647          */
1648
1649         if (data.length) {
1650                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1651                                           data.data, data.length)) {
1652                         DEBUG(0, ("Unable to append data size %u "
1653                                   "to parse buffer of size %u.\n",
1654                                   (unsigned int)data.length,
1655                                   (unsigned int)p->in_data.data.length));
1656                         set_incoming_fault(p);
1657                         return False;
1658                 }
1659         }
1660
1661         if (pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1662                 bool ret = False;
1663                 /*
1664                  * Ok - we finally have a complete RPC stream.
1665                  * Call the rpc command to process it.
1666                  */
1667
1668                 /*
1669                  * Process the complete data stream here.
1670                  */
1671                 if (pipe_init_outgoing_data(p)) {
1672                         ret = api_pipe_request(p, pkt);
1673                 }
1674
1675                 return ret;
1676         }
1677
1678         return True;
1679 }
1680
1681 /****************************************************************************
1682  Processes a finished PDU stored in p->in_data.pdu.
1683 ****************************************************************************/
1684
1685 void process_complete_pdu(struct pipes_struct *p)
1686 {
1687         struct ncacn_packet *pkt = NULL;
1688         NTSTATUS status;
1689         bool reply = False;
1690
1691         if(p->fault_state) {
1692                 DEBUG(10,("RPC connection in fault state.\n"));
1693                 goto done;
1694         }
1695
1696         pkt = talloc(p->mem_ctx, struct ncacn_packet);
1697         if (!pkt) {
1698                 DEBUG(0, ("Out of memory!\n"));
1699                 goto done;
1700         }
1701
1702         /*
1703          * Ensure we're using the corrent endianness for both the
1704          * RPC header flags and the raw data we will be reading from.
1705          */
1706         if (dcerpc_get_endian_flag(&p->in_data.pdu) & DCERPC_DREP_LE) {
1707                 p->endian = RPC_LITTLE_ENDIAN;
1708         } else {
1709                 p->endian = RPC_BIG_ENDIAN;
1710         }
1711         DEBUG(10, ("PDU is in %s Endian format!\n", p->endian?"Big":"Little"));
1712
1713         status = dcerpc_pull_ncacn_packet(pkt, &p->in_data.pdu,
1714                                           pkt, p->endian);
1715         if (!NT_STATUS_IS_OK(status)) {
1716                 DEBUG(0, ("Failed to unmarshal rpc packet: %s!\n",
1717                           nt_errstr(status)));
1718                 goto done;
1719         }
1720
1721         /* Store the call_id */
1722         p->call_id = pkt->call_id;
1723
1724         DEBUG(10, ("Processing packet type %u\n", (unsigned int)pkt->ptype));
1725
1726         switch (pkt->ptype) {
1727         case DCERPC_PKT_REQUEST:
1728                 reply = process_request_pdu(p, pkt);
1729                 break;
1730
1731         case DCERPC_PKT_PING: /* CL request - ignore... */
1732                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1733                           (unsigned int)pkt->ptype));
1734                 break;
1735
1736         case DCERPC_PKT_RESPONSE: /* No responses here. */
1737                 DEBUG(0, ("Error - DCERPC_PKT_RESPONSE received from client"));
1738                 break;
1739
1740         case DCERPC_PKT_FAULT:
1741         case DCERPC_PKT_WORKING:
1742                 /* CL request - reply to a ping when a call in process. */
1743         case DCERPC_PKT_NOCALL:
1744                 /* CL - server reply to a ping call. */
1745         case DCERPC_PKT_REJECT:
1746         case DCERPC_PKT_ACK:
1747         case DCERPC_PKT_CL_CANCEL:
1748         case DCERPC_PKT_FACK:
1749         case DCERPC_PKT_CANCEL_ACK:
1750                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1751                           (unsigned int)pkt->ptype));
1752                 break;
1753
1754         case DCERPC_PKT_BIND:
1755                 /*
1756                  * We assume that a pipe bind is only in one pdu.
1757                  */
1758                 if (pipe_init_outgoing_data(p)) {
1759                         reply = api_pipe_bind_req(p, pkt);
1760                 }
1761                 break;
1762
1763         case DCERPC_PKT_BIND_ACK:
1764         case DCERPC_PKT_BIND_NAK:
1765                 DEBUG(0, ("Error - DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1766                           "packet type %u received.\n",
1767                           (unsigned int)pkt->ptype));
1768                 break;
1769
1770
1771         case DCERPC_PKT_ALTER:
1772                 /*
1773                  * We assume that a pipe bind is only in one pdu.
1774                  */
1775                 if (pipe_init_outgoing_data(p)) {
1776                         reply = api_pipe_alter_context(p, pkt);
1777                 }
1778                 break;
1779
1780         case DCERPC_PKT_ALTER_RESP:
1781                 DEBUG(0, ("Error - DCERPC_PKT_ALTER_RESP received: "
1782                           "Should only be server -> client.\n"));
1783                 break;
1784
1785         case DCERPC_PKT_AUTH3:
1786                 /*
1787                  * The third packet in an auth exchange.
1788                  */
1789                 if (pipe_init_outgoing_data(p)) {
1790                         reply = api_pipe_bind_auth3(p, pkt);
1791                 }
1792                 break;
1793
1794         case DCERPC_PKT_SHUTDOWN:
1795                 DEBUG(0, ("Error - DCERPC_PKT_SHUTDOWN received: "
1796                           "Should only be server -> client.\n"));
1797                 break;
1798
1799         case DCERPC_PKT_CO_CANCEL:
1800                 /* For now just free all client data and continue
1801                  * processing. */
1802                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1803                          " Abandoning rpc call.\n"));
1804                 /* As we never do asynchronous RPC serving, we can
1805                  * never cancel a call (as far as I know).
1806                  * If we ever did we'd have to send a cancel_ack reply.
1807                  * For now, just free all client data and continue
1808                  * processing. */
1809                 reply = True;
1810                 break;
1811
1812 #if 0
1813                 /* Enable this if we're doing async rpc. */
1814                 /* We must check the outstanding callid matches. */
1815                 if (pipe_init_outgoing_data(p)) {
1816                         /* Send a cancel_ack PDU reply. */
1817                         /* We should probably check the auth-verifier here. */
1818                         reply = setup_cancel_ack_reply(p, pkt);
1819                 }
1820                 break;
1821 #endif
1822
1823         case DCERPC_PKT_ORPHANED:
1824                 /* We should probably check the auth-verifier here.
1825                  * For now just free all client data and continue
1826                  * processing. */
1827                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
1828                           " Abandoning rpc call.\n"));
1829                 reply = True;
1830                 break;
1831
1832         default:
1833                 DEBUG(0, ("process_complete_pdu: "
1834                           "Unknown rpc type = %u received.\n",
1835                           (unsigned int)pkt->ptype));
1836                 break;
1837         }
1838
1839 done:
1840         if (!reply) {
1841                 DEBUG(3,("DCE/RPC fault sent!"));
1842                 set_incoming_fault(p);
1843                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1844                 TALLOC_FREE(pkt);
1845         } else {
1846                 /*
1847                  * Reset the lengths. We're ready for a new pdu.
1848                  */
1849                 TALLOC_FREE(p->in_data.pdu.data);
1850                 p->in_data.pdu_needed_len = 0;
1851                 p->in_data.pdu.length = 0;
1852         }
1853
1854         TALLOC_FREE(pkt);
1855 }
1856