source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "system/filesys.h"
  32 #include "srv_pipe_internal.h"
  33 #include "../librpc/gen_ndr/ndr_schannel.h"
  34 #include "../libcli/auth/schannel.h"
  35 #include "../libcli/auth/spnego.h"
  36 #include "dcesrv_ntlmssp.h"
  37 #include "dcesrv_gssapi.h"
  38 #include "dcesrv_spnego.h"
  39 #include "rpc_server.h"
  40 #include "rpc_dce.h"
  41 #include "smbd/smbd.h"
  42 #include "auth.h"
  43 #include "ntdomain.h"
  44 #include "rpc_server/srv_pipe.h"
  45
  46 #undef DBGC_CLASS
  47 #define DBGC_CLASS DBGC_RPC_SRV
  48
  49 /**
  50  * Dump everything from the start of the end up of the provided data
  51  * into a file, but only at debug level >= 50
  52  **/
  53 static void dump_pdu_region(const char *name, int v,
  54                             DATA_BLOB *data, size_t start, size_t end)
  55 {
  56         int fd, i;
  57         char *fname = NULL;
  58         ssize_t sz;
  59
  60         if (DEBUGLEVEL < 50) return;
  61
  62         if (start > data->length || end > data->length || start > end) return;
  63
  64         for (i = 1; i < 100; i++) {
  65                 if (v != -1) {
  66                         fname = talloc_asprintf(talloc_tos(),
  67                                                 "/tmp/%s_%d.%d.prs",
  68                                                 name, v, i);
  69                 } else {
  70                         fname = talloc_asprintf(talloc_tos(),
  71                                                 "/tmp/%s_%d.prs",
  72                                                 name, i);
  73                 }
  74                 if (!fname) {
  75                         return;
  76                 }
  77                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  78                 if (fd != -1 || errno != EEXIST) break;
  79         }
  80         if (fd != -1) {
  81                 sz = write(fd, data->data + start, end - start);
  82                 i = close(fd);
  83                 if ((sz != end - start) || (i != 0) ) {
  84                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  85                                   fname, (unsigned long)sz,
  86                                   (unsigned long)end - start, i));
  87                 } else {
  88                         DEBUG(0,("created %s\n", fname));
  89                 }
  90         }
  91         TALLOC_FREE(fname);
  92 }
  93
  94 static DATA_BLOB generic_session_key(void)
  95 {
  96         return data_blob_const("SystemLibraryDTC", 16);
  97 }
  98
  99 /*******************************************************************
 100  Generate the next PDU to be returned from the data.
 101 ********************************************************************/
 102
 103 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
 104                                    struct pipe_auth_data *auth,
 105                                    uint32_t call_id,
 106                                    DATA_BLOB *rdata,
 107                                    size_t data_sent_length,
 108                                    DATA_BLOB *frag,
 109                                    size_t *pdu_size)
 110 {
 111         union dcerpc_payload u;
 112         uint8_t pfc_flags;
 113         size_t data_left;
 114         size_t data_to_send;
 115         size_t frag_len;
 116         size_t pad_len = 0;
 117         size_t auth_len = 0;
 118         NTSTATUS status;
 119
 120         ZERO_STRUCT(u.response);
 121
 122         /* Set up rpc packet pfc flags. */
 123         if (data_sent_length == 0) {
 124                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 125         } else {
 126                 pfc_flags = 0;
 127         }
 128
 129         /* Work out how much we can fit in a single PDU. */
 130         data_left = rdata->length - data_sent_length;
 131
 132         /* Ensure there really is data left to send. */
 133         if (!data_left) {
 134                 DEBUG(0, ("No data left to send !\n"));
 135                 return NT_STATUS_BUFFER_TOO_SMALL;
 136         }
 137
 138         status = dcerpc_guess_sizes(auth,
 139                                     DCERPC_RESPONSE_LENGTH,
 140                                     data_left,
 141                                     RPC_MAX_PDU_FRAG_LEN,
 142                                     SERVER_NDR_PADDING_SIZE,
 143                                     &data_to_send, &frag_len,
 144                                     &auth_len, &pad_len);
 145         if (!NT_STATUS_IS_OK(status)) {
 146                 return status;
 147         }
 148
 149         /* Set up the alloc hint. This should be the data left to send. */
 150         u.response.alloc_hint = data_left;
 151
 152         /* Work out if this PDU will be the last. */
 153         if (data_sent_length + data_to_send >= rdata->length) {
 154                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 155         }
 156
 157         /* Prepare data to be NDR encoded. */
 158         u.response.stub_and_verifier =
 159                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 160
 161         /* Store the packet in the data stream. */
 162         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 163                                           pfc_flags, auth_len, call_id,
 164                                           &u, frag);
 165         if (!NT_STATUS_IS_OK(status)) {
 166                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 167                 return status;
 168         }
 169
 170         if (auth_len) {
 171                 /* Set the proper length on the pdu, including padding.
 172                  * Only needed if an auth trailer will be appended. */
 173                 dcerpc_set_frag_length(frag, frag->length
 174                                                 + pad_len
 175                                                 + DCERPC_AUTH_TRAILER_LENGTH
 176                                                 + auth_len);
 177         }
 178
 179         if (auth_len) {
 180                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 181                 if (!NT_STATUS_IS_OK(status)) {
 182                         data_blob_free(frag);
 183                         return status;
 184                 }
 185         }
 186
 187         *pdu_size = data_to_send;
 188         return NT_STATUS_OK;
 189 }
 190
 191 /*******************************************************************
 192  Generate the next PDU to be returned from the data in p->rdata.
 193 ********************************************************************/
 194
 195 bool create_next_pdu(struct pipes_struct *p)
 196 {
 197         size_t pdu_size = 0;
 198         NTSTATUS status;
 199
 200         /*
 201          * If we're in the fault state, keep returning fault PDU's until
 202          * the pipe gets closed. JRA.
 203          */
 204         if (p->fault_state) {
 205                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 206                 return true;
 207         }
 208
 209         status = create_next_packet(p->mem_ctx, &p->auth,
 210                                     p->call_id, &p->out_data.rdata,
 211                                     p->out_data.data_sent_length,
 212                                     &p->out_data.frag, &pdu_size);
 213         if (!NT_STATUS_IS_OK(status)) {
 214                 DEBUG(0, ("Failed to create packet with error %s, "
 215                           "(auth level %u / type %u)\n",
 216                           nt_errstr(status),
 217                           (unsigned int)p->auth.auth_level,
 218                           (unsigned int)p->auth.auth_type));
 219                 return false;
 220         }
 221
 222         /* Setup the counts for this PDU. */
 223         p->out_data.data_sent_length += pdu_size;
 224         p->out_data.current_pdu_sent = 0;
 225         return true;
 226 }
 227
 228
 229 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 230
 231 /*******************************************************************
 232  Marshall a bind_nak pdu.
 233 *******************************************************************/
 234
 235 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 236 {
 237         NTSTATUS status;
 238         union dcerpc_payload u;
 239
 240         /* Free any memory in the current return data buffer. */
 241         pipe_init_outgoing_data(p);
 242
 243         /*
 244          * Initialize a bind_nak header.
 245          */
 246
 247         ZERO_STRUCT(u);
 248
 249         u.bind_nak.reject_reason  = 0;
 250
 251         /*
 252          * Marshall directly into the outgoing PDU space. We
 253          * must do this as we need to set to the bind response
 254          * header and are never sending more than one PDU here.
 255          */
 256
 257         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 258                                           DCERPC_PKT_BIND_NAK,
 259                                           DCERPC_PFC_FLAG_FIRST |
 260                                                 DCERPC_PFC_FLAG_LAST,
 261                                           0,
 262                                           pkt->call_id,
 263                                           &u,
 264                                           &p->out_data.frag);
 265         if (!NT_STATUS_IS_OK(status)) {
 266                 return False;
 267         }
 268
 269         p->out_data.data_sent_length = 0;
 270         p->out_data.current_pdu_sent = 0;
 271
 272         TALLOC_FREE(p->auth.auth_ctx);
 273         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 274         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 275         p->pipe_bound = False;
 276
 277         return True;
 278 }
 279
 280 /*******************************************************************
 281  Marshall a fault pdu.
 282 *******************************************************************/
 283
 284 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 285 {
 286         NTSTATUS status;
 287         union dcerpc_payload u;
 288
 289         /* Free any memory in the current return data buffer. */
 290         pipe_init_outgoing_data(p);
 291
 292         /*
 293          * Initialize a fault header.
 294          */
 295
 296         ZERO_STRUCT(u);
 297
 298         u.fault.status          = NT_STATUS_V(fault_status);
 299         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 300
 301         /*
 302          * Marshall directly into the outgoing PDU space. We
 303          * must do this as we need to set to the bind response
 304          * header and are never sending more than one PDU here.
 305          */
 306
 307         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 308                                           DCERPC_PKT_FAULT,
 309                                           DCERPC_PFC_FLAG_FIRST |
 310                                            DCERPC_PFC_FLAG_LAST |
 311                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 312                                           0,
 313                                           p->call_id,
 314                                           &u,
 315                                           &p->out_data.frag);
 316         if (!NT_STATUS_IS_OK(status)) {
 317                 return False;
 318         }
 319
 320         p->out_data.data_sent_length = 0;
 321         p->out_data.current_pdu_sent = 0;
 322
 323         return True;
 324 }
 325
 326 /*******************************************************************
 327  Ensure a bind request has the correct abstract & transfer interface.
 328  Used to reject unknown binds from Win2k.
 329 *******************************************************************/
 330
 331 static bool check_bind_req(struct pipes_struct *p,
 332                            struct ndr_syntax_id* abstract,
 333                            struct ndr_syntax_id* transfer,
 334                            uint32 context_id)
 335 {
 336         struct pipe_rpc_fns *context_fns;
 337
 338         DEBUG(3,("check_bind_req for %s\n",
 339                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 340
 341         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 342         if (rpc_srv_pipe_exists_by_id(abstract) &&
 343            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 344                 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 345                         rpc_srv_get_pipe_cli_name(abstract),
 346                         rpc_srv_get_pipe_srv_name(abstract)));
 347         } else {
 348                 return false;
 349         }
 350
 351         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 352         if (context_fns == NULL) {
 353                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 354                 return False;
 355         }
 356
 357         context_fns->next = context_fns->prev = NULL;
 358         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 359         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 360         context_fns->context_id = context_id;
 361
 362         /* add to the list of open contexts */
 363
 364         DLIST_ADD( p->contexts, context_fns );
 365
 366         return True;
 367 }
 368
 369 /**
 370  * Is a named pipe known?
 371  * @param[in] cli_filename      The pipe name requested by the client
 372  * @result                      Do we want to serve this?
 373  */
 374 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
 375 {
 376         const char *pipename = cli_filename;
 377         NTSTATUS status;
 378
 379         if (strnequal(pipename, "\\PIPE\\", 6)) {
 380                 pipename += 5;
 381         }
 382
 383         if (*pipename == '\\') {
 384                 pipename += 1;
 385         }
 386
 387         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 388                 DEBUG(10, ("refusing spoolss access\n"));
 389                 return false;
 390         }
 391
 392         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 393                 return true;
 394         }
 395
 396         status = smb_probe_module("rpc", pipename);
 397         if (!NT_STATUS_IS_OK(status)) {
 398                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
 399                 return false;
 400         }
 401         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 402
 403         /*
 404          * Scan the list again for the interface id
 405          */
 406         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 407                 return true;
 408         }
 409
 410         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 411                    pipename));
 412
 413         return false;
 414 }
 415
 416 /*******************************************************************
 417  Handle the first part of a SPNEGO bind auth.
 418 *******************************************************************/
 419
 420 static bool pipe_spnego_auth_bind(struct pipes_struct *p,
 421                                   TALLOC_CTX *mem_ctx,
 422                                   struct dcerpc_auth *auth_info,
 423                                   DATA_BLOB *response)
 424 {
 425         struct spnego_context *spnego_ctx;
 426         NTSTATUS status;
 427
 428         status = spnego_server_auth_start(p,
 429                                           (auth_info->auth_level ==
 430                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 431                                           (auth_info->auth_level ==
 432                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 433                                           true,
 434                                           &auth_info->credentials,
 435                                           response,
 436                                           &spnego_ctx);
 437         if (!NT_STATUS_IS_OK(status)) {
 438                 DEBUG(0, ("Failed SPNEGO negotiate (%s)\n",
 439                           nt_errstr(status)));
 440                 return false;
 441         }
 442
 443         /* Make sure data is bound to the memctx, to be freed the caller */
 444         talloc_steal(mem_ctx, response->data);
 445
 446         p->auth.auth_ctx = spnego_ctx;
 447         p->auth.auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 448
 449         DEBUG(10, ("SPNEGO auth started\n"));
 450
 451         return true;
 452 }
 453
 454 /*******************************************************************
 455  Handle an schannel bind auth.
 456 *******************************************************************/
 457
 458 static bool pipe_schannel_auth_bind(struct pipes_struct *p,
 459                                     TALLOC_CTX *mem_ctx,
 460                                     struct dcerpc_auth *auth_info,
 461                                     DATA_BLOB *response)
 462 {
 463         struct NL_AUTH_MESSAGE neg;
 464         struct NL_AUTH_MESSAGE reply;
 465         bool ret;
 466         NTSTATUS status;
 467         struct netlogon_creds_CredentialState *creds;
 468         enum ndr_err_code ndr_err;
 469         struct schannel_state *schannel_auth;
 470
 471         ndr_err = ndr_pull_struct_blob(
 472                         &auth_info->credentials, mem_ctx, &neg,
 473                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
 474         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 475                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
 476                 return false;
 477         }
 478
 479         if (DEBUGLEVEL >= 10) {
 480                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
 481         }
 482
 483         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
 484                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
 485                 return false;
 486         }
 487
 488         /*
 489          * The neg.oem_netbios_computer.a key here must match the remote computer name
 490          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
 491          * operations that use credentials.
 492          */
 493
 494         become_root();
 495         status = schannel_get_creds_state(p, lp_private_dir(),
 496                                             neg.oem_netbios_computer.a, &creds);
 497         unbecome_root();
 498
 499         if (!NT_STATUS_IS_OK(status)) {
 500                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
 501                 return False;
 502         }
 503
 504         schannel_auth = talloc(p, struct schannel_state);
 505         if (!schannel_auth) {
 506                 TALLOC_FREE(creds);
 507                 return False;
 508         }
 509
 510         schannel_auth->state = SCHANNEL_STATE_START;
 511         schannel_auth->seq_num = 0;
 512         schannel_auth->initiator = false;
 513         schannel_auth->creds = creds;
 514
 515         /*
 516          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
 517          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
 518          * struct of the person who opened the pipe. I need to test this further. JRA.
 519          *
 520          * VL. As we are mapping this to guest set the generic key
 521          * "SystemLibraryDTC" key here. It's a bit difficult to test against
 522          * W2k3, as it does not allow schannel binds against SAMR and LSA
 523          * anymore.
 524          */
 525
 526         ret = session_info_set_session_key(p->session_info, generic_session_key());
 527
 528         if (!ret) {
 529                 DEBUG(0, ("session_info_set_session_key failed\n"));
 530                 return false;
 531         }
 532
 533         /*** SCHANNEL verifier ***/
 534
 535         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
 536         reply.Flags                             = 0;
 537         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
 538                                                       * this has any meaning
 539                                                       * here - gd */
 540
 541         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
 542                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 543         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 544                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
 545                 return false;
 546         }
 547
 548         if (DEBUGLEVEL >= 10) {
 549                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
 550         }
 551
 552         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
 553                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
 554
 555         /* We're finished with this bind - no more packets. */
 556         p->auth.auth_ctx = schannel_auth;
 557         p->auth.auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
 558
 559         p->pipe_bound = True;
 560
 561         return True;
 562 }
 563
 564 /*******************************************************************
 565  Handle an NTLMSSP bind auth.
 566 *******************************************************************/
 567
 568 static bool pipe_ntlmssp_auth_bind(struct pipes_struct *p,
 569                                    TALLOC_CTX *mem_ctx,
 570                                    struct dcerpc_auth *auth_info,
 571                                    DATA_BLOB *response)
 572 {
 573         struct auth_ntlmssp_state *ntlmssp_state = NULL;
 574         NTSTATUS status;
 575
 576         if (strncmp((char *)auth_info->credentials.data, "NTLMSSP", 7) != 0) {
 577                 DEBUG(0, ("Failed to read NTLMSSP in blob\n"));
 578                 return false;
 579         }
 580
 581         /* We have an NTLMSSP blob. */
 582         status = ntlmssp_server_auth_start(p,
 583                                            (auth_info->auth_level ==
 584                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 585                                            (auth_info->auth_level ==
 586                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 587                                            true,
 588                                            &auth_info->credentials,
 589                                            response,
 590                                            &ntlmssp_state);
 591         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 592                 DEBUG(0, (__location__ ": auth_ntlmssp_start failed: %s\n",
 593                           nt_errstr(status)));
 594                 return false;
 595         }
 596
 597         /* Make sure data is bound to the memctx, to be freed the caller */
 598         talloc_steal(mem_ctx, response->data);
 599
 600         p->auth.auth_ctx = ntlmssp_state;
 601         p->auth.auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 602
 603         DEBUG(10, (__location__ ": NTLMSSP auth started\n"));
 604
 605         return true;
 606 }
 607
 608 /*******************************************************************
 609  Process an NTLMSSP authentication response.
 610  If this function succeeds, the user has been authenticated
 611  and their domain, name and calling workstation stored in
 612  the pipe struct.
 613 *******************************************************************/
 614
 615 static bool pipe_ntlmssp_verify_final(TALLOC_CTX *mem_ctx,
 616                                 struct auth_ntlmssp_state *ntlmssp_ctx,
 617                                 enum dcerpc_AuthLevel auth_level,
 618                                 struct client_address *client_id,
 619                                 struct ndr_syntax_id *syntax,
 620                                 struct auth_serversupplied_info **session_info)
 621 {
 622         NTSTATUS status;
 623         bool ret;
 624
 625         DEBUG(5, (__location__ ": pipe %s checking user details\n",
 626                  get_pipe_name_from_syntax(talloc_tos(), syntax)));
 627
 628         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 629            ensure the underlying NTLMSSP flags are also set. If not we should
 630            refuse the bind. */
 631
 632         status = ntlmssp_server_check_flags(ntlmssp_ctx,
 633                                             (auth_level ==
 634                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 635                                             (auth_level ==
 636                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 637         if (!NT_STATUS_IS_OK(status)) {
 638                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 639                           "security for pipe %s\n",
 640                           get_pipe_name_from_syntax(talloc_tos(), syntax)));
 641                 return false;
 642         }
 643
 644         TALLOC_FREE(*session_info);
 645
 646         status = ntlmssp_server_get_user_info(ntlmssp_ctx,
 647                                                 mem_ctx, session_info);
 648         if (!NT_STATUS_IS_OK(status)) {
 649                 DEBUG(0, (__location__ ": failed to obtain the server info "
 650                           "for authenticated user: %s\n", nt_errstr(status)));
 651                 return false;
 652         }
 653
 654         if ((*session_info)->security_token == NULL) {
 655                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 656                 return false;
 657         }
 658
 659         /*
 660          * We're an authenticated bind over smb, so the session key needs to
 661          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 662          * does. See the RPC-SAMBA3SESSIONKEY.
 663          */
 664
 665         ret = session_info_set_session_key((*session_info), generic_session_key());
 666         if (!ret) {
 667                 DEBUG(0, ("Failed to set session key!\n"));
 668                 return false;
 669         }
 670
 671         return true;
 672 }
 673
 674 /*******************************************************************
 675  Handle a GSSAPI bind auth.
 676 *******************************************************************/
 677
 678 static bool pipe_gssapi_auth_bind(struct pipes_struct *p,
 679                                   TALLOC_CTX *mem_ctx,
 680                                   struct dcerpc_auth *auth_info,
 681                                   DATA_BLOB *response)
 682 {
 683         NTSTATUS status;
 684         struct gse_context *gse_ctx = NULL;
 685
 686         status = gssapi_server_auth_start(p,
 687                                           (auth_info->auth_level ==
 688                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 689                                           (auth_info->auth_level ==
 690                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 691                                           true,
 692                                           &auth_info->credentials,
 693                                           response,
 694                                           &gse_ctx);
 695         if (!NT_STATUS_IS_OK(status)) {
 696                 DEBUG(0, ("Failed to init dcerpc gssapi server (%s)\n",
 697                           nt_errstr(status)));
 698                 goto err;
 699         }
 700
 701         /* Make sure data is bound to the memctx, to be freed the caller */
 702         talloc_steal(mem_ctx, response->data);
 703
 704         p->auth.auth_ctx = gse_ctx;
 705         p->auth.auth_type = DCERPC_AUTH_TYPE_KRB5;
 706
 707         DEBUG(10, ("KRB5 auth started\n"));
 708
 709         return true;
 710
 711 err:
 712         TALLOC_FREE(gse_ctx);
 713         return false;
 714 }
 715
 716 static NTSTATUS pipe_gssapi_verify_final(TALLOC_CTX *mem_ctx,
 717                                          struct gse_context *gse_ctx,
 718                                          struct client_address *client_id,
 719                                          struct auth_serversupplied_info **session_info)
 720 {
 721         NTSTATUS status;
 722         bool bret;
 723
 724         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 725            ensure the underlying flags are also set. If not we should
 726            refuse the bind. */
 727
 728         status = gssapi_server_check_flags(gse_ctx);
 729         if (!NT_STATUS_IS_OK(status)) {
 730                 DEBUG(0, ("Requested Security Layers not honored!\n"));
 731                 return status;
 732         }
 733
 734         status = gssapi_server_get_user_info(gse_ctx, mem_ctx,
 735                                              client_id, session_info);
 736         if (!NT_STATUS_IS_OK(status)) {
 737                 DEBUG(0, (__location__ ": failed to obtain the server info "
 738                           "for authenticated user: %s\n", nt_errstr(status)));
 739                 return status;
 740         }
 741
 742         /*
 743          * We're an authenticated bind over smb, so the session key needs to
 744          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 745          * does. See the RPC-SAMBA3SESSIONKEY.
 746          */
 747
 748         bret = session_info_set_session_key((*session_info), generic_session_key());
 749         if (!bret) {
 750                 return NT_STATUS_ACCESS_DENIED;
 751         }
 752
 753         return NT_STATUS_OK;
 754 }
 755
 756 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 757 {
 758         enum spnego_mech auth_type;
 759         struct auth_ntlmssp_state *ntlmssp_ctx;
 760         struct spnego_context *spnego_ctx;
 761         struct gse_context *gse_ctx;
 762         void *mech_ctx;
 763         NTSTATUS status;
 764
 765         switch (p->auth.auth_type) {
 766         case DCERPC_AUTH_TYPE_NTLMSSP:
 767                 ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 768                                                     struct auth_ntlmssp_state);
 769                 if (!pipe_ntlmssp_verify_final(p, ntlmssp_ctx,
 770                                                 p->auth.auth_level,
 771                                                 p->client_id, &p->syntax,
 772                                                 &p->session_info)) {
 773                         return NT_STATUS_ACCESS_DENIED;
 774                 }
 775                 break;
 776         case DCERPC_AUTH_TYPE_KRB5:
 777                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 778                                                 struct gse_context);
 779                 status = pipe_gssapi_verify_final(p, gse_ctx,
 780                                                   p->client_id,
 781                                                   &p->session_info);
 782                 if (!NT_STATUS_IS_OK(status)) {
 783                         DEBUG(1, ("gssapi bind failed with: %s",
 784                                   nt_errstr(status)));
 785                         return status;
 786                 }
 787                 break;
 788         case DCERPC_AUTH_TYPE_SPNEGO:
 789                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 790                                                    struct spnego_context);
 791                 status = spnego_get_negotiated_mech(spnego_ctx,
 792                                                     &auth_type, &mech_ctx);
 793                 if (!NT_STATUS_IS_OK(status)) {
 794                         DEBUG(0, ("Bad SPNEGO state (%s)\n",
 795                                   nt_errstr(status)));
 796                         return status;
 797                 }
 798                 switch(auth_type) {
 799                 case SPNEGO_KRB5:
 800                         gse_ctx = talloc_get_type_abort(mech_ctx,
 801                                                         struct gse_context);
 802                         status = pipe_gssapi_verify_final(p, gse_ctx,
 803                                                           p->client_id,
 804                                                           &p->session_info);
 805                         if (!NT_STATUS_IS_OK(status)) {
 806                                 DEBUG(1, ("gssapi bind failed with: %s",
 807                                           nt_errstr(status)));
 808                                 return status;
 809                         }
 810                         break;
 811                 case SPNEGO_NTLMSSP:
 812                         ntlmssp_ctx = talloc_get_type_abort(mech_ctx,
 813                                                 struct auth_ntlmssp_state);
 814                         if (!pipe_ntlmssp_verify_final(p, ntlmssp_ctx,
 815                                                         p->auth.auth_level,
 816                                                         p->client_id,
 817                                                         &p->syntax,
 818                                                         &p->session_info)) {
 819                                 return NT_STATUS_ACCESS_DENIED;
 820                         }
 821                         break;
 822                 default:
 823                         DEBUG(0, (__location__ ": incorrect spnego type "
 824                                   "(%d).\n", auth_type));
 825                         return NT_STATUS_ACCESS_DENIED;
 826                 }
 827                 break;
 828         default:
 829                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
 830                           (unsigned int)p->auth.auth_type));
 831                 return NT_STATUS_ACCESS_DENIED;
 832         }
 833
 834         p->pipe_bound = true;
 835
 836         return NT_STATUS_OK;
 837 }
 838
 839 /*******************************************************************
 840  Respond to a pipe bind request.
 841 *******************************************************************/
 842
 843 static bool api_pipe_bind_req(struct pipes_struct *p,
 844                                 struct ncacn_packet *pkt)
 845 {
 846         struct dcerpc_auth auth_info;
 847         uint16 assoc_gid;
 848         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
 849         NTSTATUS status;
 850         struct ndr_syntax_id id;
 851         union dcerpc_payload u;
 852         struct dcerpc_ack_ctx bind_ack_ctx;
 853         DATA_BLOB auth_resp = data_blob_null;
 854         DATA_BLOB auth_blob = data_blob_null;
 855
 856         /* No rebinds on a bound pipe - use alter context. */
 857         if (p->pipe_bound) {
 858                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
 859                          "pipe %s.\n",
 860                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 861                 return setup_bind_nak(p, pkt);
 862         }
 863
 864         if (pkt->u.bind.num_contexts == 0) {
 865                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
 866                 goto err_exit;
 867         }
 868
 869         /*
 870          * Try and find the correct pipe name to ensure
 871          * that this is a pipe name we support.
 872          */
 873         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 874         if (rpc_srv_pipe_exists_by_id(&id)) {
 875                 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 876                         rpc_srv_get_pipe_cli_name(&id),
 877                         rpc_srv_get_pipe_srv_name(&id)));
 878         } else {
 879                 status = smb_probe_module(
 880                         "rpc", get_pipe_name_from_syntax(
 881                                 talloc_tos(),
 882                                 &pkt->u.bind.ctx_list[0].abstract_syntax));
 883
 884                 if (NT_STATUS_IS_ERR(status)) {
 885                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 886                                 get_pipe_name_from_syntax(
 887                                         talloc_tos(),
 888                                         &pkt->u.bind.ctx_list[0].abstract_syntax)));
 889
 890                         return setup_bind_nak(p, pkt);
 891                 }
 892
 893                 if (rpc_srv_get_pipe_interface_by_cli_name(
 894                                 get_pipe_name_from_syntax(talloc_tos(),
 895                                                           &p->syntax),
 896                                 &id)) {
 897                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 898                                 rpc_srv_get_pipe_cli_name(&id),
 899                                 rpc_srv_get_pipe_srv_name(&id)));
 900                 } else {
 901                         DEBUG(0, ("module %s doesn't provide functions for "
 902                                   "pipe %s!\n",
 903                                   get_pipe_name_from_syntax(talloc_tos(),
 904                                                             &p->syntax),
 905                                   get_pipe_name_from_syntax(talloc_tos(),
 906                                                             &p->syntax)));
 907                         return setup_bind_nak(p, pkt);
 908                 }
 909         }
 910
 911         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 912
 913         if (pkt->u.bind.assoc_group_id != 0) {
 914                 assoc_gid = pkt->u.bind.assoc_group_id;
 915         } else {
 916                 assoc_gid = 0x53f0;
 917         }
 918
 919         /*
 920          * Create the bind response struct.
 921          */
 922
 923         /* If the requested abstract synt uuid doesn't match our client pipe,
 924                 reject the bind_ack & set the transfer interface synt to all 0's,
 925                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 926                 unknown to NT4)
 927                 Needed when adding entries to a DACL from NT5 - SK */
 928
 929         if (check_bind_req(p,
 930                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 931                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 932                         pkt->u.bind.ctx_list[0].context_id)) {
 933
 934                 bind_ack_ctx.result = 0;
 935                 bind_ack_ctx.reason = 0;
 936                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 937         } else {
 938                 p->pipe_bound = False;
 939                 /* Rejection reason: abstract syntax not supported */
 940                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 941                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
 942                 bind_ack_ctx.syntax = null_ndr_syntax_id;
 943         }
 944
 945         /*
 946          * Check if this is an authenticated bind request.
 947          */
 948         if (pkt->auth_length) {
 949                 /* Quick length check. Won't catch a bad auth footer,
 950                  * prevents overrun. */
 951
 952                 if (pkt->frag_length < RPC_HEADER_LEN +
 953                                         DCERPC_AUTH_TRAILER_LENGTH +
 954                                         pkt->auth_length) {
 955                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
 956                                 "too long for fragment %u.\n",
 957                                 (unsigned int)pkt->auth_length,
 958                                 (unsigned int)pkt->frag_length));
 959                         goto err_exit;
 960                 }
 961
 962                 /*
 963                  * Decode the authentication verifier.
 964                  */
 965                 status = dcerpc_pull_dcerpc_auth(pkt,
 966                                                  &pkt->u.bind.auth_info,
 967                                                  &auth_info, p->endian);
 968                 if (!NT_STATUS_IS_OK(status)) {
 969                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
 970                         goto err_exit;
 971                 }
 972
 973                 auth_type = auth_info.auth_type;
 974
 975                 /* Work out if we have to sign or seal etc. */
 976                 switch (auth_info.auth_level) {
 977                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 978                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 979                         break;
 980                 case DCERPC_AUTH_LEVEL_PRIVACY:
 981                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 982                         break;
 983                 case DCERPC_AUTH_LEVEL_CONNECT:
 984                         p->auth.auth_level = DCERPC_AUTH_LEVEL_CONNECT;
 985                         break;
 986                 default:
 987                         DEBUG(0, ("Unexpected auth level (%u).\n",
 988                                 (unsigned int)auth_info.auth_level ));
 989                         goto err_exit;
 990                 }
 991
 992                 switch (auth_type) {
 993                 case DCERPC_AUTH_TYPE_NTLMSSP:
 994                         if (!pipe_ntlmssp_auth_bind(p, pkt,
 995                                                 &auth_info, &auth_resp)) {
 996                                 goto err_exit;
 997                         }
 998                         assoc_gid = 0x7a77;
 999                         break;
1000
1001                 case DCERPC_AUTH_TYPE_SCHANNEL:
1002                         if (!pipe_schannel_auth_bind(p, pkt,
1003                                                 &auth_info, &auth_resp)) {
1004                                 goto err_exit;
1005                         }
1006                         break;
1007
1008                 case DCERPC_AUTH_TYPE_SPNEGO:
1009                         if (!pipe_spnego_auth_bind(p, pkt,
1010                                                 &auth_info, &auth_resp)) {
1011                                 goto err_exit;
1012                         }
1013                         break;
1014
1015                 case DCERPC_AUTH_TYPE_KRB5:
1016                         if (!pipe_gssapi_auth_bind(p, pkt,
1017                                                 &auth_info, &auth_resp)) {
1018                                 goto err_exit;
1019                         }
1020                         break;
1021
1022                 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1023                         if (p->transport == NCALRPC && p->ncalrpc_as_system) {
1024                                 TALLOC_FREE(p->session_info);
1025
1026                                 status = make_session_info_system(p,
1027                                                                   &p->session_info);
1028                                 if (!NT_STATUS_IS_OK(status)) {
1029                                         goto err_exit;
1030                                 }
1031
1032                                 auth_resp = data_blob_talloc(pkt,
1033                                                              "NCALRPC_AUTH_OK",
1034                                                              15);
1035
1036                                 p->auth.auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
1037                                 p->pipe_bound = true;
1038                         } else {
1039                                 goto err_exit;
1040                         }
1041                         break;
1042
1043                 case DCERPC_AUTH_TYPE_NONE:
1044                         break;
1045
1046                 default:
1047                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
1048                         goto err_exit;
1049                 }
1050         }
1051
1052         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
1053                 /* Unauthenticated bind request. */
1054                 /* We're finished - no more packets. */
1055                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
1056                 /* We must set the pipe auth_level here also. */
1057                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1058                 p->pipe_bound = True;
1059                 /* The session key was initialized from the SMB
1060                  * session in make_internal_rpc_pipe_p */
1061         }
1062
1063         ZERO_STRUCT(u.bind_ack);
1064         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1065         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1066         u.bind_ack.assoc_group_id = assoc_gid;
1067
1068         /* name has to be \PIPE\xxxxx */
1069         u.bind_ack.secondary_address =
1070                         talloc_asprintf(pkt, "\\PIPE\\%s",
1071                                         rpc_srv_get_pipe_srv_name(&id));
1072         if (!u.bind_ack.secondary_address) {
1073                 DEBUG(0, ("Out of memory!\n"));
1074                 goto err_exit;
1075         }
1076         u.bind_ack.secondary_address_size =
1077                                 strlen(u.bind_ack.secondary_address) + 1;
1078
1079         u.bind_ack.num_results = 1;
1080         u.bind_ack.ctx_list = &bind_ack_ctx;
1081
1082         /* NOTE: We leave the auth_info empty so we can calculate the padding
1083          * later and then append the auth_info --simo */
1084
1085         /*
1086          * Marshall directly into the outgoing PDU space. We
1087          * must do this as we need to set to the bind response
1088          * header and are never sending more than one PDU here.
1089          */
1090
1091         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1092                                           DCERPC_PKT_BIND_ACK,
1093                                           DCERPC_PFC_FLAG_FIRST |
1094                                                 DCERPC_PFC_FLAG_LAST,
1095                                           auth_resp.length,
1096                                           pkt->call_id,
1097                                           &u,
1098                                           &p->out_data.frag);
1099         if (!NT_STATUS_IS_OK(status)) {
1100                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1101                           nt_errstr(status)));
1102         }
1103
1104         if (auth_resp.length) {
1105
1106                 status = dcerpc_push_dcerpc_auth(pkt,
1107                                                  auth_type,
1108                                                  auth_info.auth_level,
1109                                                  0,
1110                                                  1, /* auth_context_id */
1111                                                  &auth_resp,
1112                                                  &auth_blob);
1113                 if (!NT_STATUS_IS_OK(status)) {
1114                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1115                         goto err_exit;
1116                 }
1117         }
1118
1119         /* Now that we have the auth len store it into the right place in
1120          * the dcerpc header */
1121         dcerpc_set_frag_length(&p->out_data.frag,
1122                                 p->out_data.frag.length + auth_blob.length);
1123
1124         if (auth_blob.length) {
1125
1126                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1127                                         auth_blob.data, auth_blob.length)) {
1128                         DEBUG(0, ("Append of auth info failed.\n"));
1129                         goto err_exit;
1130                 }
1131         }
1132
1133         /*
1134          * Setup the lengths for the initial reply.
1135          */
1136
1137         p->out_data.data_sent_length = 0;
1138         p->out_data.current_pdu_sent = 0;
1139
1140         TALLOC_FREE(auth_blob.data);
1141         return True;
1142
1143   err_exit:
1144
1145         data_blob_free(&p->out_data.frag);
1146         TALLOC_FREE(auth_blob.data);
1147         return setup_bind_nak(p, pkt);
1148 }
1149
1150 /*******************************************************************
1151  This is the "stage3" response after a bind request and reply.
1152 *******************************************************************/
1153
1154 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
1155 {
1156         struct dcerpc_auth auth_info;
1157         DATA_BLOB response = data_blob_null;
1158         struct auth_ntlmssp_state *ntlmssp_ctx;
1159         struct spnego_context *spnego_ctx;
1160         struct gse_context *gse_ctx;
1161         NTSTATUS status;
1162
1163         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
1164
1165         if (pkt->auth_length == 0) {
1166                 DEBUG(0, ("No auth field sent for bind request!\n"));
1167                 goto err;
1168         }
1169
1170         /* Ensure there's enough data for an authenticated request. */
1171         if (pkt->frag_length < RPC_HEADER_LEN
1172                                 + DCERPC_AUTH_TRAILER_LENGTH
1173                                 + pkt->auth_length) {
1174                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
1175                                 "%u is too large.\n",
1176                         (unsigned int)pkt->auth_length));
1177                 goto err;
1178         }
1179
1180         /*
1181          * Decode the authentication verifier response.
1182          */
1183
1184         status = dcerpc_pull_dcerpc_auth(pkt,
1185                                          &pkt->u.auth3.auth_info,
1186                                          &auth_info, p->endian);
1187         if (!NT_STATUS_IS_OK(status)) {
1188                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
1189                 goto err;
1190         }
1191
1192         /* We must NEVER look at auth_info->auth_pad_len here,
1193          * as old Samba client code gets it wrong and sends it
1194          * as zero. JRA.
1195          */
1196
1197         if (auth_info.auth_type != p->auth.auth_type) {
1198                 DEBUG(0, ("Auth type mismatch! Client sent %d, "
1199                           "but auth was started as type %d!\n",
1200                           auth_info.auth_type, p->auth.auth_type));
1201                 goto err;
1202         }
1203
1204         switch (auth_info.auth_type) {
1205         case DCERPC_AUTH_TYPE_NTLMSSP:
1206                 ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1207                                                     struct auth_ntlmssp_state);
1208                 status = ntlmssp_server_step(ntlmssp_ctx,
1209                                              pkt, &auth_info.credentials,
1210                                              &response);
1211                 break;
1212         case DCERPC_AUTH_TYPE_KRB5:
1213                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1214                                                 struct gse_context);
1215                 status = gssapi_server_step(gse_ctx,
1216                                             pkt, &auth_info.credentials,
1217                                             &response);
1218                 break;
1219         case DCERPC_AUTH_TYPE_SPNEGO:
1220                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1221                                                    struct spnego_context);
1222                 status = spnego_server_step(spnego_ctx,
1223                                             pkt, &auth_info.credentials,
1224                                             &response);
1225                 break;
1226         default:
1227                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
1228                           (unsigned int)auth_info.auth_type));
1229                 return false;
1230         }
1231
1232         if (NT_STATUS_EQUAL(status,
1233                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1234             response.length) {
1235                 DEBUG(0, (__location__ ": This was supposed to be the final "
1236                           "leg, but crypto machinery claims a response is "
1237                           "needed, aborting auth!\n"));
1238                 data_blob_free(&response);
1239                 goto err;
1240         }
1241         if (!NT_STATUS_IS_OK(status)) {
1242                 DEBUG(0, ("Auth failed (%s)\n", nt_errstr(status)));
1243                 goto err;
1244         }
1245
1246         /* Now verify auth was indeed successful and extract server info */
1247         status = pipe_auth_verify_final(p);
1248         if (!NT_STATUS_IS_OK(status)) {
1249                 DEBUG(0, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1250                 goto err;
1251         }
1252
1253         return true;
1254
1255 err:
1256
1257         TALLOC_FREE(p->auth.auth_ctx);
1258         return false;
1259 }
1260
1261 /****************************************************************************
1262  Deal with an alter context call. Can be third part of 3 leg auth request for
1263  SPNEGO calls.
1264 ****************************************************************************/
1265
1266 static bool api_pipe_alter_context(struct pipes_struct *p,
1267                                         struct ncacn_packet *pkt)
1268 {
1269         struct dcerpc_auth auth_info;
1270         uint16 assoc_gid;
1271         NTSTATUS status;
1272         union dcerpc_payload u;
1273         struct dcerpc_ack_ctx bind_ack_ctx;
1274         DATA_BLOB auth_resp = data_blob_null;
1275         DATA_BLOB auth_blob = data_blob_null;
1276         int pad_len = 0;
1277         struct auth_ntlmssp_state *ntlmssp_ctx;
1278         struct spnego_context *spnego_ctx;
1279         struct gse_context *gse_ctx;
1280
1281         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1282
1283         if (pkt->u.bind.assoc_group_id != 0) {
1284                 assoc_gid = pkt->u.bind.assoc_group_id;
1285         } else {
1286                 assoc_gid = 0x53f0;
1287         }
1288
1289         /*
1290          * Create the bind response struct.
1291          */
1292
1293         /* If the requested abstract synt uuid doesn't match our client pipe,
1294                 reject the bind_ack & set the transfer interface synt to all 0's,
1295                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1296                 unknown to NT4)
1297                 Needed when adding entries to a DACL from NT5 - SK */
1298
1299         if (check_bind_req(p,
1300                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1301                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1302                         pkt->u.bind.ctx_list[0].context_id)) {
1303
1304                 bind_ack_ctx.result = 0;
1305                 bind_ack_ctx.reason = 0;
1306                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1307         } else {
1308                 p->pipe_bound = False;
1309                 /* Rejection reason: abstract syntax not supported */
1310                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1311                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1312                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1313         }
1314
1315         /*
1316          * Check if this is an authenticated alter context request.
1317          */
1318         if (pkt->auth_length) {
1319                 /* Quick length check. Won't catch a bad auth footer,
1320                  * prevents overrun. */
1321
1322                 if (pkt->frag_length < RPC_HEADER_LEN +
1323                                         DCERPC_AUTH_TRAILER_LENGTH +
1324                                         pkt->auth_length) {
1325                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1326                                 "too long for fragment %u.\n",
1327                                 (unsigned int)pkt->auth_length,
1328                                 (unsigned int)pkt->frag_length ));
1329                         goto err_exit;
1330                 }
1331
1332                 status = dcerpc_pull_dcerpc_auth(pkt,
1333                                                  &pkt->u.bind.auth_info,
1334                                                  &auth_info, p->endian);
1335                 if (!NT_STATUS_IS_OK(status)) {
1336                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1337                         goto err_exit;
1338                 }
1339
1340                 /* We can only finish if the pipe is unbound for now */
1341                 if (p->pipe_bound) {
1342                         DEBUG(0, (__location__ ": Pipe already bound, "
1343                                   "Altering Context not yet supported!\n"));
1344                         goto err_exit;
1345                 }
1346
1347                 if (auth_info.auth_type != p->auth.auth_type) {
1348                         DEBUG(0, ("Auth type mismatch! Client sent %d, "
1349                                   "but auth was started as type %d!\n",
1350                                   auth_info.auth_type, p->auth.auth_type));
1351                         goto err_exit;
1352                 }
1353
1354
1355                 switch (auth_info.auth_type) {
1356                 case DCERPC_AUTH_TYPE_SPNEGO:
1357                         spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1358                                                         struct spnego_context);
1359                         status = spnego_server_step(spnego_ctx,
1360                                                     pkt,
1361                                                     &auth_info.credentials,
1362                                                     &auth_resp);
1363                         break;
1364
1365                 case DCERPC_AUTH_TYPE_KRB5:
1366                         gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1367                                                         struct gse_context);
1368                         status = gssapi_server_step(gse_ctx,
1369                                                     pkt,
1370                                                     &auth_info.credentials,
1371                                                     &auth_resp);
1372                         break;
1373                 case DCERPC_AUTH_TYPE_NTLMSSP:
1374                         ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1375                                                     struct auth_ntlmssp_state);
1376                         status = ntlmssp_server_step(ntlmssp_ctx,
1377                                                      pkt,
1378                                                      &auth_info.credentials,
1379                                                      &auth_resp);
1380                         break;
1381
1382                 default:
1383                         DEBUG(3, (__location__ ": Usupported auth type (%d) "
1384                                   "in alter-context call\n",
1385                                   auth_info.auth_type));
1386                         goto err_exit;
1387                 }
1388
1389                 if (NT_STATUS_IS_OK(status)) {
1390                         /* third leg of auth, verify auth info */
1391                         status = pipe_auth_verify_final(p);
1392                         if (!NT_STATUS_IS_OK(status)) {
1393                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1394                                           nt_errstr(status)));
1395                                 goto err_exit;
1396                         }
1397                 } else if (NT_STATUS_EQUAL(status,
1398                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1399                         DEBUG(10, ("More auth legs required.\n"));
1400                 } else {
1401                         DEBUG(0, ("Auth step returned an error (%s)\n",
1402                                   nt_errstr(status)));
1403                         goto err_exit;
1404                 }
1405         }
1406
1407         ZERO_STRUCT(u.alter_resp);
1408         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1409         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1410         u.alter_resp.assoc_group_id = assoc_gid;
1411
1412         /* secondary address CAN be NULL
1413          * as the specs say it's ignored.
1414          * It MUST be NULL to have the spoolss working.
1415          */
1416         u.alter_resp.secondary_address = "";
1417         u.alter_resp.secondary_address_size = 1;
1418
1419         u.alter_resp.num_results = 1;
1420         u.alter_resp.ctx_list = &bind_ack_ctx;
1421
1422         /* NOTE: We leave the auth_info empty so we can calculate the padding
1423          * later and then append the auth_info --simo */
1424
1425         /*
1426          * Marshall directly into the outgoing PDU space. We
1427          * must do this as we need to set to the bind response
1428          * header and are never sending more than one PDU here.
1429          */
1430
1431         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1432                                           DCERPC_PKT_ALTER_RESP,
1433                                           DCERPC_PFC_FLAG_FIRST |
1434                                                 DCERPC_PFC_FLAG_LAST,
1435                                           auth_resp.length,
1436                                           pkt->call_id,
1437                                           &u,
1438                                           &p->out_data.frag);
1439         if (!NT_STATUS_IS_OK(status)) {
1440                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1441                           nt_errstr(status)));
1442         }
1443
1444         if (auth_resp.length) {
1445
1446                 /* Work out any padding needed before the auth footer. */
1447                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1448                 if (pad_len) {
1449                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1450                         DEBUG(10, ("auth pad_len = %u\n",
1451                                    (unsigned int)pad_len));
1452                 }
1453
1454                 status = dcerpc_push_dcerpc_auth(pkt,
1455                                                  auth_info.auth_type,
1456                                                  auth_info.auth_level,
1457                                                  pad_len,
1458                                                  1, /* auth_context_id */
1459                                                  &auth_resp,
1460                                                  &auth_blob);
1461                 if (!NT_STATUS_IS_OK(status)) {
1462                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1463                         goto err_exit;
1464                 }
1465         }
1466
1467         /* Now that we have the auth len store it into the right place in
1468          * the dcerpc header */
1469         dcerpc_set_frag_length(&p->out_data.frag,
1470                                 p->out_data.frag.length +
1471                                         pad_len + auth_blob.length);
1472
1473         if (auth_resp.length) {
1474                 if (pad_len) {
1475                         char pad[SERVER_NDR_PADDING_SIZE];
1476                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1477                         if (!data_blob_append(p->mem_ctx,
1478                                                 &p->out_data.frag,
1479                                                 pad, pad_len)) {
1480                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1481                                           "%u bytes of pad data.\n",
1482                                           (unsigned int)pad_len));
1483                                 goto err_exit;
1484                         }
1485                 }
1486
1487                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1488                                         auth_blob.data, auth_blob.length)) {
1489                         DEBUG(0, ("Append of auth info failed.\n"));
1490                         goto err_exit;
1491                 }
1492         }
1493
1494         /*
1495          * Setup the lengths for the initial reply.
1496          */
1497
1498         p->out_data.data_sent_length = 0;
1499         p->out_data.current_pdu_sent = 0;
1500
1501         TALLOC_FREE(auth_blob.data);
1502         return True;
1503
1504   err_exit:
1505
1506         data_blob_free(&p->out_data.frag);
1507         TALLOC_FREE(auth_blob.data);
1508         return setup_bind_nak(p, pkt);
1509 }
1510
1511 /****************************************************************************
1512  Find the set of RPC functions associated with this context_id
1513 ****************************************************************************/
1514
1515 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
1516 {
1517         PIPE_RPC_FNS *fns = NULL;
1518
1519         if ( !list ) {
1520                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
1521                 return NULL;
1522         }
1523
1524         for (fns=list; fns; fns=fns->next ) {
1525                 if ( fns->context_id == context_id )
1526                         return fns;
1527         }
1528         return NULL;
1529 }
1530
1531 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1532                        const struct api_struct *api_rpc_cmds, int n_cmds);
1533
1534 /****************************************************************************
1535  Find the correct RPC function to call for this request.
1536  If the pipe is authenticated then become the correct UNIX user
1537  before doing the call.
1538 ****************************************************************************/
1539
1540 static bool api_pipe_request(struct pipes_struct *p,
1541                                 struct ncacn_packet *pkt)
1542 {
1543         bool ret = False;
1544         bool changed_user = False;
1545         PIPE_RPC_FNS *pipe_fns;
1546
1547         if (p->pipe_bound &&
1548             ((p->auth.auth_type == DCERPC_AUTH_TYPE_NTLMSSP) ||
1549              (p->auth.auth_type == DCERPC_AUTH_TYPE_KRB5) ||
1550              (p->auth.auth_type == DCERPC_AUTH_TYPE_SPNEGO))) {
1551                 if(!become_authenticated_pipe_user(p->session_info)) {
1552                         data_blob_free(&p->out_data.rdata);
1553                         return False;
1554                 }
1555                 changed_user = True;
1556         }
1557
1558         DEBUG(5, ("Requested \\PIPE\\%s\n",
1559                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1560
1561         /* get the set of RPC functions for this context */
1562
1563         pipe_fns = find_pipe_fns_by_context(p->contexts,
1564                                             pkt->u.request.context_id);
1565
1566         if ( pipe_fns ) {
1567                 TALLOC_CTX *frame = talloc_stackframe();
1568                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds);
1569                 TALLOC_FREE(frame);
1570         }
1571         else {
1572                 DEBUG(0, ("No rpc function table associated with context "
1573                           "[%d] on pipe [%s]\n",
1574                           pkt->u.request.context_id,
1575                           get_pipe_name_from_syntax(talloc_tos(),
1576                                                     &p->syntax)));
1577         }
1578
1579         if (changed_user) {
1580                 unbecome_authenticated_pipe_user();
1581         }
1582
1583         return ret;
1584 }
1585
1586 /*******************************************************************
1587  Calls the underlying RPC function for a named pipe.
1588  ********************************************************************/
1589
1590 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1591                        const struct api_struct *api_rpc_cmds, int n_cmds)
1592 {
1593         int fn_num;
1594         uint32_t offset1;
1595
1596         /* interpret the command */
1597         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1598                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1599                  pkt->u.request.opnum));
1600
1601         if (DEBUGLEVEL >= 50) {
1602                 fstring name;
1603                 slprintf(name, sizeof(name)-1, "in_%s",
1604                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1605                 dump_pdu_region(name, pkt->u.request.opnum,
1606                                 &p->in_data.data, 0,
1607                                 p->in_data.data.length);
1608         }
1609
1610         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1611                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1612                     api_rpc_cmds[fn_num].fn != NULL) {
1613                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1614                                   api_rpc_cmds[fn_num].name));
1615                         break;
1616                 }
1617         }
1618
1619         if (fn_num == n_cmds) {
1620                 /*
1621                  * For an unknown RPC just return a fault PDU but
1622                  * return True to allow RPC's on the pipe to continue
1623                  * and not put the pipe into fault state. JRA.
1624                  */
1625                 DEBUG(4, ("unknown\n"));
1626                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1627                 return True;
1628         }
1629
1630         offset1 = p->out_data.rdata.length;
1631
1632         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1633                 fn_num, api_rpc_cmds[fn_num].fn));
1634         /* do the actual command */
1635         if(!api_rpc_cmds[fn_num].fn(p)) {
1636                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1637                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1638                          api_rpc_cmds[fn_num].name));
1639                 data_blob_free(&p->out_data.rdata);
1640                 return False;
1641         }
1642
1643         if (p->bad_handle_fault_state) {
1644                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1645                 p->bad_handle_fault_state = False;
1646                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
1647                 return True;
1648         }
1649
1650         if (p->rng_fault_state) {
1651                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
1652                 p->rng_fault_state = False;
1653                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1654                 return True;
1655         }
1656
1657         if (DEBUGLEVEL >= 50) {
1658                 fstring name;
1659                 slprintf(name, sizeof(name)-1, "out_%s",
1660                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1661                 dump_pdu_region(name, pkt->u.request.opnum,
1662                                 &p->out_data.rdata, offset1,
1663                                 p->out_data.rdata.length);
1664         }
1665
1666         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1667                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1668
1669         /* Check for buffer underflow in rpc parsing */
1670         if ((DEBUGLEVEL >= 10) &&
1671             (pkt->frag_length < p->in_data.data.length)) {
1672                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1673                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1674                               p->in_data.data.length - pkt->frag_length);
1675         }
1676
1677         return True;
1678 }
1679
1680 /****************************************************************************
1681  Initialise an outgoing packet.
1682 ****************************************************************************/
1683
1684 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1685 {
1686         output_data *o_data = &p->out_data;
1687
1688         /* Reset the offset counters. */
1689         o_data->data_sent_length = 0;
1690         o_data->current_pdu_sent = 0;
1691
1692         data_blob_free(&o_data->frag);
1693
1694         /* Free any memory in the current return data buffer. */
1695         data_blob_free(&o_data->rdata);
1696
1697         return True;
1698 }
1699
1700 /****************************************************************************
1701  Sets the fault state on incoming packets.
1702 ****************************************************************************/
1703
1704 void set_incoming_fault(struct pipes_struct *p)
1705 {
1706         data_blob_free(&p->in_data.data);
1707         p->in_data.pdu_needed_len = 0;
1708         p->in_data.pdu.length = 0;
1709         p->fault_state = True;
1710         DEBUG(10, ("set_incoming_fault: Setting fault state on pipe %s\n",
1711                    get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1712 }
1713
1714 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1715                                     struct ncacn_packet *pkt,
1716                                     DATA_BLOB *raw_pkt)
1717 {
1718         NTSTATUS status;
1719         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1720         size_t pad_len;
1721
1722         DEBUG(10, ("Checking request auth.\n"));
1723
1724         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1725                 hdr_size += 16;
1726         }
1727
1728         /* in case of sealing this function will unseal the data in place */
1729         status = dcerpc_check_auth(auth, pkt,
1730                                    &pkt->u.request.stub_and_verifier,
1731                                    hdr_size, raw_pkt,
1732                                    &pad_len);
1733         if (!NT_STATUS_IS_OK(status)) {
1734                 return status;
1735         }
1736
1737
1738         /* remove padding and auth trailer,
1739          * this way the caller will get just the data */
1740         if (pkt->auth_length) {
1741                 size_t trail_len = pad_len
1742                                         + DCERPC_AUTH_TRAILER_LENGTH
1743                                         + pkt->auth_length;
1744                 if (pkt->u.request.stub_and_verifier.length < trail_len) {
1745                         return NT_STATUS_INFO_LENGTH_MISMATCH;
1746                 }
1747                 pkt->u.request.stub_and_verifier.length -= trail_len;
1748         }
1749
1750         return NT_STATUS_OK;
1751 }
1752
1753 /****************************************************************************
1754  Processes a request pdu. This will do auth processing if needed, and
1755  appends the data into the complete stream if the LAST flag is not set.
1756 ****************************************************************************/
1757
1758 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1759 {
1760         NTSTATUS status;
1761         DATA_BLOB data;
1762
1763         if (!p->pipe_bound) {
1764                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1765                 set_incoming_fault(p);
1766                 return False;
1767         }
1768
1769         /* Store the opnum */
1770         p->opnum = pkt->u.request.opnum;
1771
1772         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1773         if (!NT_STATUS_IS_OK(status)) {
1774                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1775                           nt_errstr(status)));
1776                 set_incoming_fault(p);
1777                 return false;
1778         }
1779
1780         data = pkt->u.request.stub_and_verifier;
1781
1782         /*
1783          * Check the data length doesn't go over the 15Mb limit.
1784          * increased after observing a bug in the Windows NT 4.0 SP6a
1785          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1786          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1787          */
1788
1789         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1790                 DEBUG(0, ("process_request_pdu: "
1791                           "rpc data buffer too large (%u) + (%u)\n",
1792                           (unsigned int)p->in_data.data.length,
1793                           (unsigned int)data.length));
1794                 set_incoming_fault(p);
1795                 return False;
1796         }
1797
1798         /*
1799          * Append the data portion into the buffer and return.
1800          */
1801
1802         if (data.length) {
1803                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1804                                           data.data, data.length)) {
1805                         DEBUG(0, ("Unable to append data size %u "
1806                                   "to parse buffer of size %u.\n",
1807                                   (unsigned int)data.length,
1808                                   (unsigned int)p->in_data.data.length));
1809                         set_incoming_fault(p);
1810                         return False;
1811                 }
1812         }
1813
1814         if (pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1815                 bool ret = False;
1816                 /*
1817                  * Ok - we finally have a complete RPC stream.
1818                  * Call the rpc command to process it.
1819                  */
1820
1821                 /*
1822                  * Process the complete data stream here.
1823                  */
1824                 if (pipe_init_outgoing_data(p)) {
1825                         ret = api_pipe_request(p, pkt);
1826                 }
1827
1828                 return ret;
1829         }
1830
1831         return True;
1832 }
1833
1834 /****************************************************************************
1835  Processes a finished PDU stored in p->in_data.pdu.
1836 ****************************************************************************/
1837
1838 void process_complete_pdu(struct pipes_struct *p)
1839 {
1840         struct ncacn_packet *pkt = NULL;
1841         NTSTATUS status;
1842         bool reply = False;
1843
1844         if(p->fault_state) {
1845                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
1846                           get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1847                 goto done;
1848         }
1849
1850         pkt = talloc(p->mem_ctx, struct ncacn_packet);
1851         if (!pkt) {
1852                 DEBUG(0, ("Out of memory!\n"));
1853                 goto done;
1854         }
1855
1856         /*
1857          * Ensure we're using the corrent endianness for both the
1858          * RPC header flags and the raw data we will be reading from.
1859          */
1860         if (dcerpc_get_endian_flag(&p->in_data.pdu) & DCERPC_DREP_LE) {
1861                 p->endian = RPC_LITTLE_ENDIAN;
1862         } else {
1863                 p->endian = RPC_BIG_ENDIAN;
1864         }
1865         DEBUG(10, ("PDU is in %s Endian format!\n", p->endian?"Big":"Little"));
1866
1867         status = dcerpc_pull_ncacn_packet(pkt, &p->in_data.pdu,
1868                                           pkt, p->endian);
1869         if (!NT_STATUS_IS_OK(status)) {
1870                 DEBUG(0, ("Failed to unmarshal rpc packet: %s!\n",
1871                           nt_errstr(status)));
1872                 goto done;
1873         }
1874
1875         /* Store the call_id */
1876         p->call_id = pkt->call_id;
1877
1878         DEBUG(10, ("Processing packet type %d\n", (int)pkt->ptype));
1879
1880         switch (pkt->ptype) {
1881         case DCERPC_PKT_REQUEST:
1882                 reply = process_request_pdu(p, pkt);
1883                 break;
1884
1885         case DCERPC_PKT_PING: /* CL request - ignore... */
1886                 DEBUG(0, ("process_complete_pdu: Error. "
1887                           "Connectionless packet type %d received on "
1888                           "pipe %s.\n", (int)pkt->ptype,
1889                          get_pipe_name_from_syntax(talloc_tos(),
1890                                                    &p->syntax)));
1891                 break;
1892
1893         case DCERPC_PKT_RESPONSE: /* No responses here. */
1894                 DEBUG(0, ("process_complete_pdu: Error. "
1895                           "DCERPC_PKT_RESPONSE received from client "
1896                           "on pipe %s.\n",
1897                          get_pipe_name_from_syntax(talloc_tos(),
1898                                                    &p->syntax)));
1899                 break;
1900
1901         case DCERPC_PKT_FAULT:
1902         case DCERPC_PKT_WORKING:
1903                 /* CL request - reply to a ping when a call in process. */
1904         case DCERPC_PKT_NOCALL:
1905                 /* CL - server reply to a ping call. */
1906         case DCERPC_PKT_REJECT:
1907         case DCERPC_PKT_ACK:
1908         case DCERPC_PKT_CL_CANCEL:
1909         case DCERPC_PKT_FACK:
1910         case DCERPC_PKT_CANCEL_ACK:
1911                 DEBUG(0, ("process_complete_pdu: Error. "
1912                           "Connectionless packet type %u received on "
1913                           "pipe %s.\n", (unsigned int)pkt->ptype,
1914                          get_pipe_name_from_syntax(talloc_tos(),
1915                                                    &p->syntax)));
1916                 break;
1917
1918         case DCERPC_PKT_BIND:
1919                 /*
1920                  * We assume that a pipe bind is only in one pdu.
1921                  */
1922                 if (pipe_init_outgoing_data(p)) {
1923                         reply = api_pipe_bind_req(p, pkt);
1924                 }
1925                 break;
1926
1927         case DCERPC_PKT_BIND_ACK:
1928         case DCERPC_PKT_BIND_NAK:
1929                 DEBUG(0, ("process_complete_pdu: Error. "
1930                           "DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1931                           "packet type %u received on pipe %s.\n",
1932                           (unsigned int)pkt->ptype,
1933                          get_pipe_name_from_syntax(talloc_tos(),
1934                                                    &p->syntax)));
1935                 break;
1936
1937
1938         case DCERPC_PKT_ALTER:
1939                 /*
1940                  * We assume that a pipe bind is only in one pdu.
1941                  */
1942                 if (pipe_init_outgoing_data(p)) {
1943                         reply = api_pipe_alter_context(p, pkt);
1944                 }
1945                 break;
1946
1947         case DCERPC_PKT_ALTER_RESP:
1948                 DEBUG(0, ("process_complete_pdu: Error. "
1949                           "DCERPC_PKT_ALTER_RESP on pipe %s: "
1950                           "Should only be server -> client.\n",
1951                          get_pipe_name_from_syntax(talloc_tos(),
1952                                                    &p->syntax)));
1953                 break;
1954
1955         case DCERPC_PKT_AUTH3:
1956                 /*
1957                  * The third packet in an auth exchange.
1958                  */
1959                 if (pipe_init_outgoing_data(p)) {
1960                         reply = api_pipe_bind_auth3(p, pkt);
1961                 }
1962                 break;
1963
1964         case DCERPC_PKT_SHUTDOWN:
1965                 DEBUG(0, ("process_complete_pdu: Error. "
1966                           "DCERPC_PKT_SHUTDOWN on pipe %s: "
1967                           "Should only be server -> client.\n",
1968                          get_pipe_name_from_syntax(talloc_tos(),
1969                                                    &p->syntax)));
1970                 break;
1971
1972         case DCERPC_PKT_CO_CANCEL:
1973                 /* For now just free all client data and continue
1974                  * processing. */
1975                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1976                          " Abandoning rpc call.\n"));
1977                 /* As we never do asynchronous RPC serving, we can
1978                  * never cancel a call (as far as I know).
1979                  * If we ever did we'd have to send a cancel_ack reply.
1980                  * For now, just free all client data and continue
1981                  * processing. */
1982                 reply = True;
1983                 break;
1984
1985 #if 0
1986                 /* Enable this if we're doing async rpc. */
1987                 /* We must check the outstanding callid matches. */
1988                 if (pipe_init_outgoing_data(p)) {
1989                         /* Send a cancel_ack PDU reply. */
1990                         /* We should probably check the auth-verifier here. */
1991                         reply = setup_cancel_ack_reply(p, pkt);
1992                 }
1993                 break;
1994 #endif
1995
1996         case DCERPC_PKT_ORPHANED:
1997                 /* We should probably check the auth-verifier here.
1998                  * For now just free all client data and continue
1999                  * processing. */
2000                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
2001                           " Abandoning rpc call.\n"));
2002                 reply = True;
2003                 break;
2004
2005         default:
2006                 DEBUG(0, ("process_complete_pdu: "
2007                           "Unknown rpc type = %u received.\n",
2008                           (unsigned int)pkt->ptype));
2009                 break;
2010         }
2011
2012 done:
2013         if (!reply) {
2014                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on "
2015                          "pipe %s\n", get_pipe_name_from_syntax(talloc_tos(),
2016                                                                 &p->syntax)));
2017                 set_incoming_fault(p);
2018                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2019                 TALLOC_FREE(pkt);
2020         } else {
2021                 /*
2022                  * Reset the lengths. We're ready for a new pdu.
2023                  */
2024                 TALLOC_FREE(p->in_data.pdu.data);
2025                 p->in_data.pdu_needed_len = 0;
2026                 p->in_data.pdu.length = 0;
2027         }
2028
2029         TALLOC_FREE(pkt);
2030 }
2031