source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "system/filesys.h"
  32 #include "srv_pipe_internal.h"
  33 #include "../librpc/gen_ndr/ndr_schannel.h"
  34 #include "../libcli/auth/schannel.h"
  35 #include "../libcli/auth/spnego.h"
  36 #include "dcesrv_ntlmssp.h"
  37 #include "dcesrv_gssapi.h"
  38 #include "dcesrv_spnego.h"
  39 #include "rpc_server.h"
  40 #include "rpc_dce.h"
  41 #include "smbd/smbd.h"
  42 #include "auth.h"
  43 #include "ntdomain.h"
  44 #include "rpc_server/srv_pipe.h"
  45 #include "rpc_server/rpc_contexts.h"
  46
  47 #undef DBGC_CLASS
  48 #define DBGC_CLASS DBGC_RPC_SRV
  49
  50 /**
  51  * Dump everything from the start of the end up of the provided data
  52  * into a file, but only at debug level >= 50
  53  **/
  54 static void dump_pdu_region(const char *name, int v,
  55                             DATA_BLOB *data, size_t start, size_t end)
  56 {
  57         int fd, i;
  58         char *fname = NULL;
  59         ssize_t sz;
  60
  61         if (DEBUGLEVEL < 50) return;
  62
  63         if (start > data->length || end > data->length || start > end) return;
  64
  65         for (i = 1; i < 100; i++) {
  66                 if (v != -1) {
  67                         fname = talloc_asprintf(talloc_tos(),
  68                                                 "/tmp/%s_%d.%d.prs",
  69                                                 name, v, i);
  70                 } else {
  71                         fname = talloc_asprintf(talloc_tos(),
  72                                                 "/tmp/%s_%d.prs",
  73                                                 name, i);
  74                 }
  75                 if (!fname) {
  76                         return;
  77                 }
  78                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  79                 if (fd != -1 || errno != EEXIST) break;
  80         }
  81         if (fd != -1) {
  82                 sz = write(fd, data->data + start, end - start);
  83                 i = close(fd);
  84                 if ((sz != end - start) || (i != 0) ) {
  85                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  86                                   fname, (unsigned long)sz,
  87                                   (unsigned long)end - start, i));
  88                 } else {
  89                         DEBUG(0,("created %s\n", fname));
  90                 }
  91         }
  92         TALLOC_FREE(fname);
  93 }
  94
  95 static DATA_BLOB generic_session_key(void)
  96 {
  97         return data_blob_const("SystemLibraryDTC", 16);
  98 }
  99
 100 /*******************************************************************
 101  Generate the next PDU to be returned from the data.
 102 ********************************************************************/
 103
 104 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
 105                                    struct pipe_auth_data *auth,
 106                                    uint32_t call_id,
 107                                    DATA_BLOB *rdata,
 108                                    size_t data_sent_length,
 109                                    DATA_BLOB *frag,
 110                                    size_t *pdu_size)
 111 {
 112         union dcerpc_payload u;
 113         uint8_t pfc_flags;
 114         size_t data_left;
 115         size_t data_to_send;
 116         size_t frag_len;
 117         size_t pad_len = 0;
 118         size_t auth_len = 0;
 119         NTSTATUS status;
 120
 121         ZERO_STRUCT(u.response);
 122
 123         /* Set up rpc packet pfc flags. */
 124         if (data_sent_length == 0) {
 125                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 126         } else {
 127                 pfc_flags = 0;
 128         }
 129
 130         /* Work out how much we can fit in a single PDU. */
 131         data_left = rdata->length - data_sent_length;
 132
 133         /* Ensure there really is data left to send. */
 134         if (!data_left) {
 135                 DEBUG(0, ("No data left to send !\n"));
 136                 return NT_STATUS_BUFFER_TOO_SMALL;
 137         }
 138
 139         status = dcerpc_guess_sizes(auth,
 140                                     DCERPC_RESPONSE_LENGTH,
 141                                     data_left,
 142                                     RPC_MAX_PDU_FRAG_LEN,
 143                                     SERVER_NDR_PADDING_SIZE,
 144                                     &data_to_send, &frag_len,
 145                                     &auth_len, &pad_len);
 146         if (!NT_STATUS_IS_OK(status)) {
 147                 return status;
 148         }
 149
 150         /* Set up the alloc hint. This should be the data left to send. */
 151         u.response.alloc_hint = data_left;
 152
 153         /* Work out if this PDU will be the last. */
 154         if (data_sent_length + data_to_send >= rdata->length) {
 155                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 156         }
 157
 158         /* Prepare data to be NDR encoded. */
 159         u.response.stub_and_verifier =
 160                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 161
 162         /* Store the packet in the data stream. */
 163         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 164                                           pfc_flags, auth_len, call_id,
 165                                           &u, frag);
 166         if (!NT_STATUS_IS_OK(status)) {
 167                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 168                 return status;
 169         }
 170
 171         if (auth_len) {
 172                 /* Set the proper length on the pdu, including padding.
 173                  * Only needed if an auth trailer will be appended. */
 174                 dcerpc_set_frag_length(frag, frag->length
 175                                                 + pad_len
 176                                                 + DCERPC_AUTH_TRAILER_LENGTH
 177                                                 + auth_len);
 178         }
 179
 180         if (auth_len) {
 181                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 182                 if (!NT_STATUS_IS_OK(status)) {
 183                         data_blob_free(frag);
 184                         return status;
 185                 }
 186         }
 187
 188         *pdu_size = data_to_send;
 189         return NT_STATUS_OK;
 190 }
 191
 192 /*******************************************************************
 193  Generate the next PDU to be returned from the data in p->rdata.
 194 ********************************************************************/
 195
 196 bool create_next_pdu(struct pipes_struct *p)
 197 {
 198         size_t pdu_size = 0;
 199         NTSTATUS status;
 200
 201         /*
 202          * If we're in the fault state, keep returning fault PDU's until
 203          * the pipe gets closed. JRA.
 204          */
 205         if (p->fault_state) {
 206                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 207                 return true;
 208         }
 209
 210         status = create_next_packet(p->mem_ctx, &p->auth,
 211                                     p->call_id, &p->out_data.rdata,
 212                                     p->out_data.data_sent_length,
 213                                     &p->out_data.frag, &pdu_size);
 214         if (!NT_STATUS_IS_OK(status)) {
 215                 DEBUG(0, ("Failed to create packet with error %s, "
 216                           "(auth level %u / type %u)\n",
 217                           nt_errstr(status),
 218                           (unsigned int)p->auth.auth_level,
 219                           (unsigned int)p->auth.auth_type));
 220                 return false;
 221         }
 222
 223         /* Setup the counts for this PDU. */
 224         p->out_data.data_sent_length += pdu_size;
 225         p->out_data.current_pdu_sent = 0;
 226         return true;
 227 }
 228
 229
 230 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 231
 232 /*******************************************************************
 233  Marshall a bind_nak pdu.
 234 *******************************************************************/
 235
 236 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 237 {
 238         NTSTATUS status;
 239         union dcerpc_payload u;
 240
 241         /* Free any memory in the current return data buffer. */
 242         pipe_init_outgoing_data(p);
 243
 244         /*
 245          * Initialize a bind_nak header.
 246          */
 247
 248         ZERO_STRUCT(u);
 249
 250         u.bind_nak.reject_reason  = 0;
 251
 252         /*
 253          * Marshall directly into the outgoing PDU space. We
 254          * must do this as we need to set to the bind response
 255          * header and are never sending more than one PDU here.
 256          */
 257
 258         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 259                                           DCERPC_PKT_BIND_NAK,
 260                                           DCERPC_PFC_FLAG_FIRST |
 261                                                 DCERPC_PFC_FLAG_LAST,
 262                                           0,
 263                                           pkt->call_id,
 264                                           &u,
 265                                           &p->out_data.frag);
 266         if (!NT_STATUS_IS_OK(status)) {
 267                 return False;
 268         }
 269
 270         p->out_data.data_sent_length = 0;
 271         p->out_data.current_pdu_sent = 0;
 272
 273         TALLOC_FREE(p->auth.auth_ctx);
 274         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 275         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 276         p->pipe_bound = False;
 277
 278         return True;
 279 }
 280
 281 /*******************************************************************
 282  Marshall a fault pdu.
 283 *******************************************************************/
 284
 285 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 286 {
 287         NTSTATUS status;
 288         union dcerpc_payload u;
 289
 290         /* Free any memory in the current return data buffer. */
 291         pipe_init_outgoing_data(p);
 292
 293         /*
 294          * Initialize a fault header.
 295          */
 296
 297         ZERO_STRUCT(u);
 298
 299         u.fault.status          = NT_STATUS_V(fault_status);
 300         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 301
 302         /*
 303          * Marshall directly into the outgoing PDU space. We
 304          * must do this as we need to set to the bind response
 305          * header and are never sending more than one PDU here.
 306          */
 307
 308         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 309                                           DCERPC_PKT_FAULT,
 310                                           DCERPC_PFC_FLAG_FIRST |
 311                                            DCERPC_PFC_FLAG_LAST |
 312                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 313                                           0,
 314                                           p->call_id,
 315                                           &u,
 316                                           &p->out_data.frag);
 317         if (!NT_STATUS_IS_OK(status)) {
 318                 return False;
 319         }
 320
 321         p->out_data.data_sent_length = 0;
 322         p->out_data.current_pdu_sent = 0;
 323
 324         return True;
 325 }
 326
 327 /*******************************************************************
 328  Ensure a bind request has the correct abstract & transfer interface.
 329  Used to reject unknown binds from Win2k.
 330 *******************************************************************/
 331
 332 static bool check_bind_req(struct pipes_struct *p,
 333                            struct ndr_syntax_id* abstract,
 334                            struct ndr_syntax_id* transfer,
 335                            uint32_t context_id)
 336 {
 337         struct pipe_rpc_fns *context_fns;
 338
 339         DEBUG(3,("check_bind_req for %s\n",
 340                  get_pipe_name_from_syntax(talloc_tos(), abstract)));
 341
 342         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 343         if (rpc_srv_pipe_exists_by_id(abstract) &&
 344            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 345                 DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
 346                           rpc_srv_get_pipe_cli_name(abstract),
 347                           rpc_srv_get_pipe_srv_name(abstract)));
 348         } else {
 349                 return false;
 350         }
 351
 352         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 353         if (context_fns == NULL) {
 354                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 355                 return False;
 356         }
 357
 358         context_fns->next = context_fns->prev = NULL;
 359         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 360         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 361         context_fns->context_id = context_id;
 362         context_fns->syntax = *abstract;
 363
 364         /* add to the list of open contexts */
 365
 366         DLIST_ADD( p->contexts, context_fns );
 367
 368         return True;
 369 }
 370
 371 /**
 372  * Is a named pipe known?
 373  * @param[in] cli_filename      The pipe name requested by the client
 374  * @result                      Do we want to serve this?
 375  */
 376 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
 377 {
 378         const char *pipename = cli_filename;
 379         NTSTATUS status;
 380
 381         if (strnequal(pipename, "\\PIPE\\", 6)) {
 382                 pipename += 5;
 383         }
 384
 385         if (*pipename == '\\') {
 386                 pipename += 1;
 387         }
 388
 389         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 390                 DEBUG(10, ("refusing spoolss access\n"));
 391                 return false;
 392         }
 393
 394         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 395                 return true;
 396         }
 397
 398         status = smb_probe_module("rpc", pipename);
 399         if (!NT_STATUS_IS_OK(status)) {
 400                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
 401                 return false;
 402         }
 403         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 404
 405         /*
 406          * Scan the list again for the interface id
 407          */
 408         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 409                 return true;
 410         }
 411
 412         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 413                    pipename));
 414
 415         return false;
 416 }
 417
 418 /*******************************************************************
 419  Handle the first part of a SPNEGO bind auth.
 420 *******************************************************************/
 421
 422 static bool pipe_spnego_auth_bind(struct pipes_struct *p,
 423                                   TALLOC_CTX *mem_ctx,
 424                                   struct dcerpc_auth *auth_info,
 425                                   DATA_BLOB *response)
 426 {
 427         struct spnego_context *spnego_ctx;
 428         NTSTATUS status;
 429
 430         status = spnego_server_auth_start(p,
 431                                           (auth_info->auth_level ==
 432                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 433                                           (auth_info->auth_level ==
 434                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 435                                           true,
 436                                           &auth_info->credentials,
 437                                           response,
 438                                           &spnego_ctx);
 439         if (!NT_STATUS_IS_OK(status)) {
 440                 DEBUG(0, ("Failed SPNEGO negotiate (%s)\n",
 441                           nt_errstr(status)));
 442                 return false;
 443         }
 444
 445         /* Make sure data is bound to the memctx, to be freed the caller */
 446         talloc_steal(mem_ctx, response->data);
 447
 448         p->auth.auth_ctx = spnego_ctx;
 449         p->auth.auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 450
 451         DEBUG(10, ("SPNEGO auth started\n"));
 452
 453         return true;
 454 }
 455
 456 /*******************************************************************
 457  Handle an schannel bind auth.
 458 *******************************************************************/
 459
 460 static bool pipe_schannel_auth_bind(struct pipes_struct *p,
 461                                     TALLOC_CTX *mem_ctx,
 462                                     struct dcerpc_auth *auth_info,
 463                                     DATA_BLOB *response)
 464 {
 465         struct NL_AUTH_MESSAGE neg;
 466         struct NL_AUTH_MESSAGE reply;
 467         bool ret;
 468         NTSTATUS status;
 469         struct netlogon_creds_CredentialState *creds;
 470         enum ndr_err_code ndr_err;
 471         struct schannel_state *schannel_auth;
 472
 473         ndr_err = ndr_pull_struct_blob(
 474                         &auth_info->credentials, mem_ctx, &neg,
 475                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
 476         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 477                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
 478                 return false;
 479         }
 480
 481         if (DEBUGLEVEL >= 10) {
 482                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
 483         }
 484
 485         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
 486                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
 487                 return false;
 488         }
 489
 490         /*
 491          * The neg.oem_netbios_computer.a key here must match the remote computer name
 492          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
 493          * operations that use credentials.
 494          */
 495
 496         become_root();
 497         status = schannel_get_creds_state(p, lp_private_dir(),
 498                                             neg.oem_netbios_computer.a, &creds);
 499         unbecome_root();
 500
 501         if (!NT_STATUS_IS_OK(status)) {
 502                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
 503                 return False;
 504         }
 505
 506         schannel_auth = talloc(p, struct schannel_state);
 507         if (!schannel_auth) {
 508                 TALLOC_FREE(creds);
 509                 return False;
 510         }
 511
 512         schannel_auth->state = SCHANNEL_STATE_START;
 513         schannel_auth->seq_num = 0;
 514         schannel_auth->initiator = false;
 515         schannel_auth->creds = creds;
 516
 517         /*
 518          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
 519          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
 520          * struct of the person who opened the pipe. I need to test this further. JRA.
 521          *
 522          * VL. As we are mapping this to guest set the generic key
 523          * "SystemLibraryDTC" key here. It's a bit difficult to test against
 524          * W2k3, as it does not allow schannel binds against SAMR and LSA
 525          * anymore.
 526          */
 527
 528         ret = session_info_set_session_key(p->session_info, generic_session_key());
 529
 530         if (!ret) {
 531                 DEBUG(0, ("session_info_set_session_key failed\n"));
 532                 return false;
 533         }
 534
 535         /*** SCHANNEL verifier ***/
 536
 537         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
 538         reply.Flags                             = 0;
 539         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
 540                                                       * this has any meaning
 541                                                       * here - gd */
 542
 543         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
 544                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 545         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 546                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
 547                 return false;
 548         }
 549
 550         if (DEBUGLEVEL >= 10) {
 551                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
 552         }
 553
 554         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
 555                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
 556
 557         /* We're finished with this bind - no more packets. */
 558         p->auth.auth_ctx = schannel_auth;
 559         p->auth.auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
 560
 561         p->pipe_bound = True;
 562
 563         return True;
 564 }
 565
 566 /*******************************************************************
 567  Handle an NTLMSSP bind auth.
 568 *******************************************************************/
 569
 570 static bool pipe_ntlmssp_auth_bind(struct pipes_struct *p,
 571                                    TALLOC_CTX *mem_ctx,
 572                                    struct dcerpc_auth *auth_info,
 573                                    DATA_BLOB *response)
 574 {
 575         struct auth_ntlmssp_state *ntlmssp_state = NULL;
 576         NTSTATUS status;
 577
 578         if (strncmp((char *)auth_info->credentials.data, "NTLMSSP", 7) != 0) {
 579                 DEBUG(0, ("Failed to read NTLMSSP in blob\n"));
 580                 return false;
 581         }
 582
 583         /* We have an NTLMSSP blob. */
 584         status = ntlmssp_server_auth_start(p,
 585                                            (auth_info->auth_level ==
 586                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 587                                            (auth_info->auth_level ==
 588                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 589                                            true,
 590                                            &auth_info->credentials,
 591                                            response,
 592                                            &ntlmssp_state);
 593         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 594                 DEBUG(0, (__location__ ": auth_ntlmssp_start failed: %s\n",
 595                           nt_errstr(status)));
 596                 return false;
 597         }
 598
 599         /* Make sure data is bound to the memctx, to be freed the caller */
 600         talloc_steal(mem_ctx, response->data);
 601
 602         p->auth.auth_ctx = ntlmssp_state;
 603         p->auth.auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 604
 605         DEBUG(10, (__location__ ": NTLMSSP auth started\n"));
 606
 607         return true;
 608 }
 609
 610 /*******************************************************************
 611  Process an NTLMSSP authentication response.
 612  If this function succeeds, the user has been authenticated
 613  and their domain, name and calling workstation stored in
 614  the pipe struct.
 615 *******************************************************************/
 616
 617 static bool pipe_ntlmssp_verify_final(TALLOC_CTX *mem_ctx,
 618                                 struct auth_ntlmssp_state *ntlmssp_ctx,
 619                                 enum dcerpc_AuthLevel auth_level,
 620                                 struct client_address *client_id,
 621                                 struct ndr_syntax_id *syntax,
 622                                 struct auth_serversupplied_info **session_info)
 623 {
 624         NTSTATUS status;
 625         bool ret;
 626
 627         DEBUG(5, (__location__ ": pipe %s checking user details\n",
 628                  get_pipe_name_from_syntax(talloc_tos(), syntax)));
 629
 630         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 631            ensure the underlying NTLMSSP flags are also set. If not we should
 632            refuse the bind. */
 633
 634         status = ntlmssp_server_check_flags(ntlmssp_ctx,
 635                                             (auth_level ==
 636                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 637                                             (auth_level ==
 638                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 639         if (!NT_STATUS_IS_OK(status)) {
 640                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 641                           "security for pipe %s\n",
 642                           get_pipe_name_from_syntax(talloc_tos(), syntax)));
 643                 return false;
 644         }
 645
 646         TALLOC_FREE(*session_info);
 647
 648         status = ntlmssp_server_get_user_info(ntlmssp_ctx,
 649                                                 mem_ctx, session_info);
 650         if (!NT_STATUS_IS_OK(status)) {
 651                 DEBUG(0, (__location__ ": failed to obtain the server info "
 652                           "for authenticated user: %s\n", nt_errstr(status)));
 653                 return false;
 654         }
 655
 656         if ((*session_info)->security_token == NULL) {
 657                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 658                 return false;
 659         }
 660
 661         /*
 662          * We're an authenticated bind over smb, so the session key needs to
 663          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 664          * does. See the RPC-SAMBA3SESSIONKEY.
 665          */
 666
 667         ret = session_info_set_session_key((*session_info), generic_session_key());
 668         if (!ret) {
 669                 DEBUG(0, ("Failed to set session key!\n"));
 670                 return false;
 671         }
 672
 673         return true;
 674 }
 675
 676 /*******************************************************************
 677  Handle a GSSAPI bind auth.
 678 *******************************************************************/
 679
 680 static bool pipe_gssapi_auth_bind(struct pipes_struct *p,
 681                                   TALLOC_CTX *mem_ctx,
 682                                   struct dcerpc_auth *auth_info,
 683                                   DATA_BLOB *response)
 684 {
 685         NTSTATUS status;
 686         struct gse_context *gse_ctx = NULL;
 687
 688         status = gssapi_server_auth_start(p,
 689                                           (auth_info->auth_level ==
 690                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 691                                           (auth_info->auth_level ==
 692                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 693                                           true,
 694                                           &auth_info->credentials,
 695                                           response,
 696                                           &gse_ctx);
 697         if (!NT_STATUS_IS_OK(status)) {
 698                 DEBUG(0, ("Failed to init dcerpc gssapi server (%s)\n",
 699                           nt_errstr(status)));
 700                 goto err;
 701         }
 702
 703         /* Make sure data is bound to the memctx, to be freed the caller */
 704         talloc_steal(mem_ctx, response->data);
 705
 706         p->auth.auth_ctx = gse_ctx;
 707         p->auth.auth_type = DCERPC_AUTH_TYPE_KRB5;
 708
 709         DEBUG(10, ("KRB5 auth started\n"));
 710
 711         return true;
 712
 713 err:
 714         TALLOC_FREE(gse_ctx);
 715         return false;
 716 }
 717
 718 static NTSTATUS pipe_gssapi_verify_final(TALLOC_CTX *mem_ctx,
 719                                          struct gse_context *gse_ctx,
 720                                          struct client_address *client_id,
 721                                          struct auth_serversupplied_info **session_info)
 722 {
 723         NTSTATUS status;
 724         bool bret;
 725
 726         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 727            ensure the underlying flags are also set. If not we should
 728            refuse the bind. */
 729
 730         status = gssapi_server_check_flags(gse_ctx);
 731         if (!NT_STATUS_IS_OK(status)) {
 732                 DEBUG(0, ("Requested Security Layers not honored!\n"));
 733                 return status;
 734         }
 735
 736         status = gssapi_server_get_user_info(gse_ctx, mem_ctx,
 737                                              client_id, session_info);
 738         if (!NT_STATUS_IS_OK(status)) {
 739                 DEBUG(0, (__location__ ": failed to obtain the server info "
 740                           "for authenticated user: %s\n", nt_errstr(status)));
 741                 return status;
 742         }
 743
 744         /*
 745          * We're an authenticated bind over smb, so the session key needs to
 746          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 747          * does. See the RPC-SAMBA3SESSIONKEY.
 748          */
 749
 750         bret = session_info_set_session_key((*session_info), generic_session_key());
 751         if (!bret) {
 752                 return NT_STATUS_ACCESS_DENIED;
 753         }
 754
 755         return NT_STATUS_OK;
 756 }
 757
 758 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 759 {
 760         enum spnego_mech auth_type;
 761         struct auth_ntlmssp_state *ntlmssp_ctx;
 762         struct spnego_context *spnego_ctx;
 763         struct gse_context *gse_ctx;
 764         void *mech_ctx;
 765         NTSTATUS status;
 766
 767         switch (p->auth.auth_type) {
 768         case DCERPC_AUTH_TYPE_NTLMSSP:
 769                 ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 770                                                     struct auth_ntlmssp_state);
 771                 if (!pipe_ntlmssp_verify_final(p, ntlmssp_ctx,
 772                                                 p->auth.auth_level,
 773                                                 p->client_id, &p->syntax,
 774                                                 &p->session_info)) {
 775                         return NT_STATUS_ACCESS_DENIED;
 776                 }
 777                 break;
 778         case DCERPC_AUTH_TYPE_KRB5:
 779                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 780                                                 struct gse_context);
 781                 status = pipe_gssapi_verify_final(p, gse_ctx,
 782                                                   p->client_id,
 783                                                   &p->session_info);
 784                 if (!NT_STATUS_IS_OK(status)) {
 785                         DEBUG(1, ("gssapi bind failed with: %s",
 786                                   nt_errstr(status)));
 787                         return status;
 788                 }
 789                 break;
 790         case DCERPC_AUTH_TYPE_SPNEGO:
 791                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 792                                                    struct spnego_context);
 793                 status = spnego_get_negotiated_mech(spnego_ctx,
 794                                                     &auth_type, &mech_ctx);
 795                 if (!NT_STATUS_IS_OK(status)) {
 796                         DEBUG(0, ("Bad SPNEGO state (%s)\n",
 797                                   nt_errstr(status)));
 798                         return status;
 799                 }
 800                 switch(auth_type) {
 801                 case SPNEGO_KRB5:
 802                         gse_ctx = talloc_get_type_abort(mech_ctx,
 803                                                         struct gse_context);
 804                         status = pipe_gssapi_verify_final(p, gse_ctx,
 805                                                           p->client_id,
 806                                                           &p->session_info);
 807                         if (!NT_STATUS_IS_OK(status)) {
 808                                 DEBUG(1, ("gssapi bind failed with: %s",
 809                                           nt_errstr(status)));
 810                                 return status;
 811                         }
 812                         break;
 813                 case SPNEGO_NTLMSSP:
 814                         ntlmssp_ctx = talloc_get_type_abort(mech_ctx,
 815                                                 struct auth_ntlmssp_state);
 816                         if (!pipe_ntlmssp_verify_final(p, ntlmssp_ctx,
 817                                                         p->auth.auth_level,
 818                                                         p->client_id,
 819                                                         &p->syntax,
 820                                                         &p->session_info)) {
 821                                 return NT_STATUS_ACCESS_DENIED;
 822                         }
 823                         break;
 824                 default:
 825                         DEBUG(0, (__location__ ": incorrect spnego type "
 826                                   "(%d).\n", auth_type));
 827                         return NT_STATUS_ACCESS_DENIED;
 828                 }
 829                 break;
 830         default:
 831                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
 832                           (unsigned int)p->auth.auth_type));
 833                 return NT_STATUS_ACCESS_DENIED;
 834         }
 835
 836         p->pipe_bound = true;
 837
 838         return NT_STATUS_OK;
 839 }
 840
 841 /*******************************************************************
 842  Respond to a pipe bind request.
 843 *******************************************************************/
 844
 845 static bool api_pipe_bind_req(struct pipes_struct *p,
 846                                 struct ncacn_packet *pkt)
 847 {
 848         struct dcerpc_auth auth_info;
 849         uint16 assoc_gid;
 850         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
 851         NTSTATUS status;
 852         struct ndr_syntax_id id;
 853         union dcerpc_payload u;
 854         struct dcerpc_ack_ctx bind_ack_ctx;
 855         DATA_BLOB auth_resp = data_blob_null;
 856         DATA_BLOB auth_blob = data_blob_null;
 857
 858         /* No rebinds on a bound pipe - use alter context. */
 859         if (p->pipe_bound) {
 860                 DEBUG(2,("Rejecting bind request on bound rpc connection\n"));
 861                 return setup_bind_nak(p, pkt);
 862         }
 863
 864         if (pkt->u.bind.num_contexts == 0) {
 865                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
 866                 goto err_exit;
 867         }
 868
 869         /*
 870          * Try and find the correct pipe name to ensure
 871          * that this is a pipe name we support.
 872          */
 873         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 874         if (rpc_srv_pipe_exists_by_id(&id)) {
 875                 DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 876                           rpc_srv_get_pipe_cli_name(&id),
 877                           rpc_srv_get_pipe_srv_name(&id)));
 878         } else {
 879                 status = smb_probe_module(
 880                         "rpc", get_pipe_name_from_syntax(
 881                                 talloc_tos(),
 882                                 &id));
 883
 884                 if (NT_STATUS_IS_ERR(status)) {
 885                         DEBUG(3,("api_pipe_bind_req: Unknown rpc service name "
 886                                  "%s in bind request.\n",
 887                                  get_pipe_name_from_syntax(talloc_tos(), &id)));
 888
 889                         return setup_bind_nak(p, pkt);
 890                 }
 891
 892                 if (rpc_srv_get_pipe_interface_by_cli_name(
 893                                 get_pipe_name_from_syntax(talloc_tos(),
 894                                                           &id),
 895                                 &id)) {
 896                         DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 897                                   rpc_srv_get_pipe_cli_name(&id),
 898                                   rpc_srv_get_pipe_srv_name(&id)));
 899                 } else {
 900                         DEBUG(0, ("module %s doesn't provide functions for "
 901                                   "pipe %s!\n",
 902                                   get_pipe_name_from_syntax(talloc_tos(), &id),
 903                                   get_pipe_name_from_syntax(talloc_tos(), &id)));
 904                         return setup_bind_nak(p, pkt);
 905                 }
 906         }
 907
 908         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 909
 910         if (pkt->u.bind.assoc_group_id != 0) {
 911                 assoc_gid = pkt->u.bind.assoc_group_id;
 912         } else {
 913                 assoc_gid = 0x53f0;
 914         }
 915
 916         /*
 917          * Create the bind response struct.
 918          */
 919
 920         /* If the requested abstract synt uuid doesn't match our client pipe,
 921                 reject the bind_ack & set the transfer interface synt to all 0's,
 922                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 923                 unknown to NT4)
 924                 Needed when adding entries to a DACL from NT5 - SK */
 925
 926         if (check_bind_req(p,
 927                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 928                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 929                         pkt->u.bind.ctx_list[0].context_id)) {
 930
 931                 bind_ack_ctx.result = 0;
 932                 bind_ack_ctx.reason = 0;
 933                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 934         } else {
 935                 p->pipe_bound = False;
 936                 /* Rejection reason: abstract syntax not supported */
 937                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 938                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
 939                 bind_ack_ctx.syntax = null_ndr_syntax_id;
 940         }
 941
 942         /*
 943          * Check if this is an authenticated bind request.
 944          */
 945         if (pkt->auth_length) {
 946                 /* Quick length check. Won't catch a bad auth footer,
 947                  * prevents overrun. */
 948
 949                 if (pkt->frag_length < RPC_HEADER_LEN +
 950                                         DCERPC_AUTH_TRAILER_LENGTH +
 951                                         pkt->auth_length) {
 952                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
 953                                 "too long for fragment %u.\n",
 954                                 (unsigned int)pkt->auth_length,
 955                                 (unsigned int)pkt->frag_length));
 956                         goto err_exit;
 957                 }
 958
 959                 /*
 960                  * Decode the authentication verifier.
 961                  */
 962                 status = dcerpc_pull_dcerpc_auth(pkt,
 963                                                  &pkt->u.bind.auth_info,
 964                                                  &auth_info, p->endian);
 965                 if (!NT_STATUS_IS_OK(status)) {
 966                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
 967                         goto err_exit;
 968                 }
 969
 970                 auth_type = auth_info.auth_type;
 971
 972                 /* Work out if we have to sign or seal etc. */
 973                 switch (auth_info.auth_level) {
 974                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 975                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 976                         break;
 977                 case DCERPC_AUTH_LEVEL_PRIVACY:
 978                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 979                         break;
 980                 case DCERPC_AUTH_LEVEL_CONNECT:
 981                         p->auth.auth_level = DCERPC_AUTH_LEVEL_CONNECT;
 982                         break;
 983                 default:
 984                         DEBUG(0, ("Unexpected auth level (%u).\n",
 985                                 (unsigned int)auth_info.auth_level ));
 986                         goto err_exit;
 987                 }
 988
 989                 switch (auth_type) {
 990                 case DCERPC_AUTH_TYPE_NTLMSSP:
 991                         if (!pipe_ntlmssp_auth_bind(p, pkt,
 992                                                 &auth_info, &auth_resp)) {
 993                                 goto err_exit;
 994                         }
 995                         assoc_gid = 0x7a77;
 996                         break;
 997
 998                 case DCERPC_AUTH_TYPE_SCHANNEL:
 999                         if (!pipe_schannel_auth_bind(p, pkt,
1000                                                 &auth_info, &auth_resp)) {
1001                                 goto err_exit;
1002                         }
1003                         break;
1004
1005                 case DCERPC_AUTH_TYPE_SPNEGO:
1006                         if (!pipe_spnego_auth_bind(p, pkt,
1007                                                 &auth_info, &auth_resp)) {
1008                                 goto err_exit;
1009                         }
1010                         break;
1011
1012                 case DCERPC_AUTH_TYPE_KRB5:
1013                         if (!pipe_gssapi_auth_bind(p, pkt,
1014                                                 &auth_info, &auth_resp)) {
1015                                 goto err_exit;
1016                         }
1017                         break;
1018
1019                 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1020                         if (p->transport == NCALRPC && p->ncalrpc_as_system) {
1021                                 TALLOC_FREE(p->session_info);
1022
1023                                 status = make_session_info_system(p,
1024                                                                   &p->session_info);
1025                                 if (!NT_STATUS_IS_OK(status)) {
1026                                         goto err_exit;
1027                                 }
1028
1029                                 auth_resp = data_blob_talloc(pkt,
1030                                                              "NCALRPC_AUTH_OK",
1031                                                              15);
1032
1033                                 p->auth.auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
1034                                 p->pipe_bound = true;
1035                         } else {
1036                                 goto err_exit;
1037                         }
1038                         break;
1039
1040                 case DCERPC_AUTH_TYPE_NONE:
1041                         break;
1042
1043                 default:
1044                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
1045                         goto err_exit;
1046                 }
1047         }
1048
1049         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
1050                 /* Unauthenticated bind request. */
1051                 /* We're finished - no more packets. */
1052                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
1053                 /* We must set the pipe auth_level here also. */
1054                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1055                 p->pipe_bound = True;
1056                 /* The session key was initialized from the SMB
1057                  * session in make_internal_rpc_pipe_p */
1058         }
1059
1060         ZERO_STRUCT(u.bind_ack);
1061         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1062         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1063         u.bind_ack.assoc_group_id = assoc_gid;
1064
1065         /* name has to be \PIPE\xxxxx */
1066         u.bind_ack.secondary_address =
1067                         talloc_asprintf(pkt, "\\PIPE\\%s",
1068                                         rpc_srv_get_pipe_srv_name(&id));
1069         if (!u.bind_ack.secondary_address) {
1070                 DEBUG(0, ("Out of memory!\n"));
1071                 goto err_exit;
1072         }
1073         u.bind_ack.secondary_address_size =
1074                                 strlen(u.bind_ack.secondary_address) + 1;
1075
1076         u.bind_ack.num_results = 1;
1077         u.bind_ack.ctx_list = &bind_ack_ctx;
1078
1079         /* NOTE: We leave the auth_info empty so we can calculate the padding
1080          * later and then append the auth_info --simo */
1081
1082         /*
1083          * Marshall directly into the outgoing PDU space. We
1084          * must do this as we need to set to the bind response
1085          * header and are never sending more than one PDU here.
1086          */
1087
1088         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1089                                           DCERPC_PKT_BIND_ACK,
1090                                           DCERPC_PFC_FLAG_FIRST |
1091                                                 DCERPC_PFC_FLAG_LAST,
1092                                           auth_resp.length,
1093                                           pkt->call_id,
1094                                           &u,
1095                                           &p->out_data.frag);
1096         if (!NT_STATUS_IS_OK(status)) {
1097                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1098                           nt_errstr(status)));
1099         }
1100
1101         if (auth_resp.length) {
1102
1103                 status = dcerpc_push_dcerpc_auth(pkt,
1104                                                  auth_type,
1105                                                  auth_info.auth_level,
1106                                                  0,
1107                                                  1, /* auth_context_id */
1108                                                  &auth_resp,
1109                                                  &auth_blob);
1110                 if (!NT_STATUS_IS_OK(status)) {
1111                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1112                         goto err_exit;
1113                 }
1114         }
1115
1116         /* Now that we have the auth len store it into the right place in
1117          * the dcerpc header */
1118         dcerpc_set_frag_length(&p->out_data.frag,
1119                                 p->out_data.frag.length + auth_blob.length);
1120
1121         if (auth_blob.length) {
1122
1123                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1124                                         auth_blob.data, auth_blob.length)) {
1125                         DEBUG(0, ("Append of auth info failed.\n"));
1126                         goto err_exit;
1127                 }
1128         }
1129
1130         /*
1131          * Setup the lengths for the initial reply.
1132          */
1133
1134         p->out_data.data_sent_length = 0;
1135         p->out_data.current_pdu_sent = 0;
1136
1137         TALLOC_FREE(auth_blob.data);
1138         return True;
1139
1140   err_exit:
1141
1142         data_blob_free(&p->out_data.frag);
1143         TALLOC_FREE(auth_blob.data);
1144         return setup_bind_nak(p, pkt);
1145 }
1146
1147 /*******************************************************************
1148  This is the "stage3" response after a bind request and reply.
1149 *******************************************************************/
1150
1151 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
1152 {
1153         struct dcerpc_auth auth_info;
1154         DATA_BLOB response = data_blob_null;
1155         struct auth_ntlmssp_state *ntlmssp_ctx;
1156         struct spnego_context *spnego_ctx;
1157         struct gse_context *gse_ctx;
1158         NTSTATUS status;
1159
1160         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
1161
1162         if (pkt->auth_length == 0) {
1163                 DEBUG(0, ("No auth field sent for bind request!\n"));
1164                 goto err;
1165         }
1166
1167         /* Ensure there's enough data for an authenticated request. */
1168         if (pkt->frag_length < RPC_HEADER_LEN
1169                                 + DCERPC_AUTH_TRAILER_LENGTH
1170                                 + pkt->auth_length) {
1171                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
1172                                 "%u is too large.\n",
1173                         (unsigned int)pkt->auth_length));
1174                 goto err;
1175         }
1176
1177         /*
1178          * Decode the authentication verifier response.
1179          */
1180
1181         status = dcerpc_pull_dcerpc_auth(pkt,
1182                                          &pkt->u.auth3.auth_info,
1183                                          &auth_info, p->endian);
1184         if (!NT_STATUS_IS_OK(status)) {
1185                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
1186                 goto err;
1187         }
1188
1189         /* We must NEVER look at auth_info->auth_pad_len here,
1190          * as old Samba client code gets it wrong and sends it
1191          * as zero. JRA.
1192          */
1193
1194         if (auth_info.auth_type != p->auth.auth_type) {
1195                 DEBUG(0, ("Auth type mismatch! Client sent %d, "
1196                           "but auth was started as type %d!\n",
1197                           auth_info.auth_type, p->auth.auth_type));
1198                 goto err;
1199         }
1200
1201         switch (auth_info.auth_type) {
1202         case DCERPC_AUTH_TYPE_NTLMSSP:
1203                 ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1204                                                     struct auth_ntlmssp_state);
1205                 status = ntlmssp_server_step(ntlmssp_ctx,
1206                                              pkt, &auth_info.credentials,
1207                                              &response);
1208                 break;
1209         case DCERPC_AUTH_TYPE_KRB5:
1210                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1211                                                 struct gse_context);
1212                 status = gssapi_server_step(gse_ctx,
1213                                             pkt, &auth_info.credentials,
1214                                             &response);
1215                 break;
1216         case DCERPC_AUTH_TYPE_SPNEGO:
1217                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1218                                                    struct spnego_context);
1219                 status = spnego_server_step(spnego_ctx,
1220                                             pkt, &auth_info.credentials,
1221                                             &response);
1222                 break;
1223         default:
1224                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
1225                           (unsigned int)auth_info.auth_type));
1226                 return false;
1227         }
1228
1229         if (NT_STATUS_EQUAL(status,
1230                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1231             response.length) {
1232                 DEBUG(0, (__location__ ": This was supposed to be the final "
1233                           "leg, but crypto machinery claims a response is "
1234                           "needed, aborting auth!\n"));
1235                 data_blob_free(&response);
1236                 goto err;
1237         }
1238         if (!NT_STATUS_IS_OK(status)) {
1239                 DEBUG(0, ("Auth failed (%s)\n", nt_errstr(status)));
1240                 goto err;
1241         }
1242
1243         /* Now verify auth was indeed successful and extract server info */
1244         status = pipe_auth_verify_final(p);
1245         if (!NT_STATUS_IS_OK(status)) {
1246                 DEBUG(0, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1247                 goto err;
1248         }
1249
1250         return true;
1251
1252 err:
1253
1254         TALLOC_FREE(p->auth.auth_ctx);
1255         return false;
1256 }
1257
1258 /****************************************************************************
1259  Deal with an alter context call. Can be third part of 3 leg auth request for
1260  SPNEGO calls.
1261 ****************************************************************************/
1262
1263 static bool api_pipe_alter_context(struct pipes_struct *p,
1264                                         struct ncacn_packet *pkt)
1265 {
1266         struct dcerpc_auth auth_info;
1267         uint16 assoc_gid;
1268         NTSTATUS status;
1269         union dcerpc_payload u;
1270         struct dcerpc_ack_ctx bind_ack_ctx;
1271         DATA_BLOB auth_resp = data_blob_null;
1272         DATA_BLOB auth_blob = data_blob_null;
1273         int pad_len = 0;
1274         struct auth_ntlmssp_state *ntlmssp_ctx;
1275         struct spnego_context *spnego_ctx;
1276         struct gse_context *gse_ctx;
1277
1278         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1279
1280         if (pkt->u.bind.assoc_group_id != 0) {
1281                 assoc_gid = pkt->u.bind.assoc_group_id;
1282         } else {
1283                 assoc_gid = 0x53f0;
1284         }
1285
1286         /*
1287          * Create the bind response struct.
1288          */
1289
1290         /* If the requested abstract synt uuid doesn't match our client pipe,
1291                 reject the bind_ack & set the transfer interface synt to all 0's,
1292                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1293                 unknown to NT4)
1294                 Needed when adding entries to a DACL from NT5 - SK */
1295
1296         if (check_bind_req(p,
1297                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1298                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1299                         pkt->u.bind.ctx_list[0].context_id)) {
1300
1301                 bind_ack_ctx.result = 0;
1302                 bind_ack_ctx.reason = 0;
1303                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1304         } else {
1305                 p->pipe_bound = False;
1306                 /* Rejection reason: abstract syntax not supported */
1307                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1308                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1309                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1310         }
1311
1312         /*
1313          * Check if this is an authenticated alter context request.
1314          */
1315         if (pkt->auth_length) {
1316                 /* Quick length check. Won't catch a bad auth footer,
1317                  * prevents overrun. */
1318
1319                 if (pkt->frag_length < RPC_HEADER_LEN +
1320                                         DCERPC_AUTH_TRAILER_LENGTH +
1321                                         pkt->auth_length) {
1322                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1323                                 "too long for fragment %u.\n",
1324                                 (unsigned int)pkt->auth_length,
1325                                 (unsigned int)pkt->frag_length ));
1326                         goto err_exit;
1327                 }
1328
1329                 status = dcerpc_pull_dcerpc_auth(pkt,
1330                                                  &pkt->u.bind.auth_info,
1331                                                  &auth_info, p->endian);
1332                 if (!NT_STATUS_IS_OK(status)) {
1333                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1334                         goto err_exit;
1335                 }
1336
1337                 /* We can only finish if the pipe is unbound for now */
1338                 if (p->pipe_bound) {
1339                         DEBUG(0, (__location__ ": Pipe already bound, "
1340                                   "Altering Context not yet supported!\n"));
1341                         goto err_exit;
1342                 }
1343
1344                 if (auth_info.auth_type != p->auth.auth_type) {
1345                         DEBUG(0, ("Auth type mismatch! Client sent %d, "
1346                                   "but auth was started as type %d!\n",
1347                                   auth_info.auth_type, p->auth.auth_type));
1348                         goto err_exit;
1349                 }
1350
1351
1352                 switch (auth_info.auth_type) {
1353                 case DCERPC_AUTH_TYPE_SPNEGO:
1354                         spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1355                                                         struct spnego_context);
1356                         status = spnego_server_step(spnego_ctx,
1357                                                     pkt,
1358                                                     &auth_info.credentials,
1359                                                     &auth_resp);
1360                         break;
1361
1362                 case DCERPC_AUTH_TYPE_KRB5:
1363                         gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1364                                                         struct gse_context);
1365                         status = gssapi_server_step(gse_ctx,
1366                                                     pkt,
1367                                                     &auth_info.credentials,
1368                                                     &auth_resp);
1369                         break;
1370                 case DCERPC_AUTH_TYPE_NTLMSSP:
1371                         ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1372                                                     struct auth_ntlmssp_state);
1373                         status = ntlmssp_server_step(ntlmssp_ctx,
1374                                                      pkt,
1375                                                      &auth_info.credentials,
1376                                                      &auth_resp);
1377                         break;
1378
1379                 default:
1380                         DEBUG(3, (__location__ ": Usupported auth type (%d) "
1381                                   "in alter-context call\n",
1382                                   auth_info.auth_type));
1383                         goto err_exit;
1384                 }
1385
1386                 if (NT_STATUS_IS_OK(status)) {
1387                         /* third leg of auth, verify auth info */
1388                         status = pipe_auth_verify_final(p);
1389                         if (!NT_STATUS_IS_OK(status)) {
1390                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1391                                           nt_errstr(status)));
1392                                 goto err_exit;
1393                         }
1394                 } else if (NT_STATUS_EQUAL(status,
1395                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1396                         DEBUG(10, ("More auth legs required.\n"));
1397                 } else {
1398                         DEBUG(0, ("Auth step returned an error (%s)\n",
1399                                   nt_errstr(status)));
1400                         goto err_exit;
1401                 }
1402         }
1403
1404         ZERO_STRUCT(u.alter_resp);
1405         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1406         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1407         u.alter_resp.assoc_group_id = assoc_gid;
1408
1409         /* secondary address CAN be NULL
1410          * as the specs say it's ignored.
1411          * It MUST be NULL to have the spoolss working.
1412          */
1413         u.alter_resp.secondary_address = "";
1414         u.alter_resp.secondary_address_size = 1;
1415
1416         u.alter_resp.num_results = 1;
1417         u.alter_resp.ctx_list = &bind_ack_ctx;
1418
1419         /* NOTE: We leave the auth_info empty so we can calculate the padding
1420          * later and then append the auth_info --simo */
1421
1422         /*
1423          * Marshall directly into the outgoing PDU space. We
1424          * must do this as we need to set to the bind response
1425          * header and are never sending more than one PDU here.
1426          */
1427
1428         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1429                                           DCERPC_PKT_ALTER_RESP,
1430                                           DCERPC_PFC_FLAG_FIRST |
1431                                                 DCERPC_PFC_FLAG_LAST,
1432                                           auth_resp.length,
1433                                           pkt->call_id,
1434                                           &u,
1435                                           &p->out_data.frag);
1436         if (!NT_STATUS_IS_OK(status)) {
1437                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1438                           nt_errstr(status)));
1439         }
1440
1441         if (auth_resp.length) {
1442
1443                 /* Work out any padding needed before the auth footer. */
1444                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1445                 if (pad_len) {
1446                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1447                         DEBUG(10, ("auth pad_len = %u\n",
1448                                    (unsigned int)pad_len));
1449                 }
1450
1451                 status = dcerpc_push_dcerpc_auth(pkt,
1452                                                  auth_info.auth_type,
1453                                                  auth_info.auth_level,
1454                                                  pad_len,
1455                                                  1, /* auth_context_id */
1456                                                  &auth_resp,
1457                                                  &auth_blob);
1458                 if (!NT_STATUS_IS_OK(status)) {
1459                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1460                         goto err_exit;
1461                 }
1462         }
1463
1464         /* Now that we have the auth len store it into the right place in
1465          * the dcerpc header */
1466         dcerpc_set_frag_length(&p->out_data.frag,
1467                                 p->out_data.frag.length +
1468                                         pad_len + auth_blob.length);
1469
1470         if (auth_resp.length) {
1471                 if (pad_len) {
1472                         char pad[SERVER_NDR_PADDING_SIZE];
1473                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1474                         if (!data_blob_append(p->mem_ctx,
1475                                                 &p->out_data.frag,
1476                                                 pad, pad_len)) {
1477                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1478                                           "%u bytes of pad data.\n",
1479                                           (unsigned int)pad_len));
1480                                 goto err_exit;
1481                         }
1482                 }
1483
1484                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1485                                         auth_blob.data, auth_blob.length)) {
1486                         DEBUG(0, ("Append of auth info failed.\n"));
1487                         goto err_exit;
1488                 }
1489         }
1490
1491         /*
1492          * Setup the lengths for the initial reply.
1493          */
1494
1495         p->out_data.data_sent_length = 0;
1496         p->out_data.current_pdu_sent = 0;
1497
1498         TALLOC_FREE(auth_blob.data);
1499         return True;
1500
1501   err_exit:
1502
1503         data_blob_free(&p->out_data.frag);
1504         TALLOC_FREE(auth_blob.data);
1505         return setup_bind_nak(p, pkt);
1506 }
1507
1508 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1509                        const struct api_struct *api_rpc_cmds, int n_cmds);
1510
1511 /****************************************************************************
1512  Find the correct RPC function to call for this request.
1513  If the pipe is authenticated then become the correct UNIX user
1514  before doing the call.
1515 ****************************************************************************/
1516
1517 static bool api_pipe_request(struct pipes_struct *p,
1518                                 struct ncacn_packet *pkt)
1519 {
1520         bool ret = False;
1521         bool changed_user = False;
1522         PIPE_RPC_FNS *pipe_fns;
1523
1524         if (p->pipe_bound &&
1525             ((p->auth.auth_type == DCERPC_AUTH_TYPE_NTLMSSP) ||
1526              (p->auth.auth_type == DCERPC_AUTH_TYPE_KRB5) ||
1527              (p->auth.auth_type == DCERPC_AUTH_TYPE_SPNEGO))) {
1528                 if(!become_authenticated_pipe_user(p->session_info)) {
1529                         data_blob_free(&p->out_data.rdata);
1530                         return False;
1531                 }
1532                 changed_user = True;
1533         }
1534
1535         /* get the set of RPC functions for this context */
1536
1537         pipe_fns = find_pipe_fns_by_context(p->contexts,
1538                                             pkt->u.request.context_id);
1539
1540         if ( pipe_fns ) {
1541                 TALLOC_CTX *frame = talloc_stackframe();
1542
1543                 DEBUG(5, ("Requested %s rpc service\n",
1544                           get_pipe_name_from_syntax(talloc_tos(), &pipe_fns->syntax)));
1545
1546                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds);
1547
1548                 TALLOC_FREE(frame);
1549         }
1550         else {
1551                 DEBUG(0, ("No rpc function table associated with context "
1552                           "[%d]\n",
1553                           pkt->u.request.context_id));
1554         }
1555
1556         if (changed_user) {
1557                 unbecome_authenticated_pipe_user();
1558         }
1559
1560         return ret;
1561 }
1562
1563 /*******************************************************************
1564  Calls the underlying RPC function for a named pipe.
1565  ********************************************************************/
1566
1567 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1568                        const struct api_struct *api_rpc_cmds, int n_cmds)
1569 {
1570         int fn_num;
1571         uint32_t offset1;
1572
1573         /* interpret the command */
1574         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1575                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1576                  pkt->u.request.opnum));
1577
1578         if (DEBUGLEVEL >= 50) {
1579                 fstring name;
1580                 slprintf(name, sizeof(name)-1, "in_%s",
1581                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1582                 dump_pdu_region(name, pkt->u.request.opnum,
1583                                 &p->in_data.data, 0,
1584                                 p->in_data.data.length);
1585         }
1586
1587         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1588                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1589                     api_rpc_cmds[fn_num].fn != NULL) {
1590                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1591                                   api_rpc_cmds[fn_num].name));
1592                         break;
1593                 }
1594         }
1595
1596         if (fn_num == n_cmds) {
1597                 /*
1598                  * For an unknown RPC just return a fault PDU but
1599                  * return True to allow RPC's on the pipe to continue
1600                  * and not put the pipe into fault state. JRA.
1601                  */
1602                 DEBUG(4, ("unknown\n"));
1603                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1604                 return True;
1605         }
1606
1607         offset1 = p->out_data.rdata.length;
1608
1609         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1610                 fn_num, api_rpc_cmds[fn_num].fn));
1611         /* do the actual command */
1612         if(!api_rpc_cmds[fn_num].fn(p)) {
1613                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1614                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1615                          api_rpc_cmds[fn_num].name));
1616                 data_blob_free(&p->out_data.rdata);
1617                 return False;
1618         }
1619
1620         if (p->bad_handle_fault_state) {
1621                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1622                 p->bad_handle_fault_state = False;
1623                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
1624                 return True;
1625         }
1626
1627         if (p->rng_fault_state) {
1628                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
1629                 p->rng_fault_state = False;
1630                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1631                 return True;
1632         }
1633
1634         if (DEBUGLEVEL >= 50) {
1635                 fstring name;
1636                 slprintf(name, sizeof(name)-1, "out_%s",
1637                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1638                 dump_pdu_region(name, pkt->u.request.opnum,
1639                                 &p->out_data.rdata, offset1,
1640                                 p->out_data.rdata.length);
1641         }
1642
1643         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1644                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1645
1646         /* Check for buffer underflow in rpc parsing */
1647         if ((DEBUGLEVEL >= 10) &&
1648             (pkt->frag_length < p->in_data.data.length)) {
1649                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1650                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1651                               p->in_data.data.length - pkt->frag_length);
1652         }
1653
1654         return True;
1655 }
1656
1657 /****************************************************************************
1658  Initialise an outgoing packet.
1659 ****************************************************************************/
1660
1661 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1662 {
1663         output_data *o_data = &p->out_data;
1664
1665         /* Reset the offset counters. */
1666         o_data->data_sent_length = 0;
1667         o_data->current_pdu_sent = 0;
1668
1669         data_blob_free(&o_data->frag);
1670
1671         /* Free any memory in the current return data buffer. */
1672         data_blob_free(&o_data->rdata);
1673
1674         return True;
1675 }
1676
1677 /****************************************************************************
1678  Sets the fault state on incoming packets.
1679 ****************************************************************************/
1680
1681 void set_incoming_fault(struct pipes_struct *p)
1682 {
1683         data_blob_free(&p->in_data.data);
1684         p->in_data.pdu_needed_len = 0;
1685         p->in_data.pdu.length = 0;
1686         p->fault_state = True;
1687         DEBUG(10, ("set_incoming_fault: Setting fault state on pipe %s\n",
1688                    get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1689 }
1690
1691 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1692                                     struct ncacn_packet *pkt,
1693                                     DATA_BLOB *raw_pkt)
1694 {
1695         NTSTATUS status;
1696         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1697         size_t pad_len;
1698
1699         DEBUG(10, ("Checking request auth.\n"));
1700
1701         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1702                 hdr_size += 16;
1703         }
1704
1705         /* in case of sealing this function will unseal the data in place */
1706         status = dcerpc_check_auth(auth, pkt,
1707                                    &pkt->u.request.stub_and_verifier,
1708                                    hdr_size, raw_pkt,
1709                                    &pad_len);
1710         if (!NT_STATUS_IS_OK(status)) {
1711                 return status;
1712         }
1713
1714
1715         /* remove padding and auth trailer,
1716          * this way the caller will get just the data */
1717         if (pkt->auth_length) {
1718                 size_t trail_len = pad_len
1719                                         + DCERPC_AUTH_TRAILER_LENGTH
1720                                         + pkt->auth_length;
1721                 if (pkt->u.request.stub_and_verifier.length < trail_len) {
1722                         return NT_STATUS_INFO_LENGTH_MISMATCH;
1723                 }
1724                 pkt->u.request.stub_and_verifier.length -= trail_len;
1725         }
1726
1727         return NT_STATUS_OK;
1728 }
1729
1730 /****************************************************************************
1731  Processes a request pdu. This will do auth processing if needed, and
1732  appends the data into the complete stream if the LAST flag is not set.
1733 ****************************************************************************/
1734
1735 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1736 {
1737         NTSTATUS status;
1738         DATA_BLOB data;
1739
1740         if (!p->pipe_bound) {
1741                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1742                 set_incoming_fault(p);
1743                 return False;
1744         }
1745
1746         /* Store the opnum */
1747         p->opnum = pkt->u.request.opnum;
1748
1749         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1750         if (!NT_STATUS_IS_OK(status)) {
1751                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1752                           nt_errstr(status)));
1753                 set_incoming_fault(p);
1754                 return false;
1755         }
1756
1757         data = pkt->u.request.stub_and_verifier;
1758
1759         /*
1760          * Check the data length doesn't go over the 15Mb limit.
1761          * increased after observing a bug in the Windows NT 4.0 SP6a
1762          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1763          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1764          */
1765
1766         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1767                 DEBUG(0, ("process_request_pdu: "
1768                           "rpc data buffer too large (%u) + (%u)\n",
1769                           (unsigned int)p->in_data.data.length,
1770                           (unsigned int)data.length));
1771                 set_incoming_fault(p);
1772                 return False;
1773         }
1774
1775         /*
1776          * Append the data portion into the buffer and return.
1777          */
1778
1779         if (data.length) {
1780                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1781                                           data.data, data.length)) {
1782                         DEBUG(0, ("Unable to append data size %u "
1783                                   "to parse buffer of size %u.\n",
1784                                   (unsigned int)data.length,
1785                                   (unsigned int)p->in_data.data.length));
1786                         set_incoming_fault(p);
1787                         return False;
1788                 }
1789         }
1790
1791         if (pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1792                 bool ret = False;
1793                 /*
1794                  * Ok - we finally have a complete RPC stream.
1795                  * Call the rpc command to process it.
1796                  */
1797
1798                 /*
1799                  * Process the complete data stream here.
1800                  */
1801                 if (pipe_init_outgoing_data(p)) {
1802                         ret = api_pipe_request(p, pkt);
1803                 }
1804
1805                 return ret;
1806         }
1807
1808         return True;
1809 }
1810
1811 /****************************************************************************
1812  Processes a finished PDU stored in p->in_data.pdu.
1813 ****************************************************************************/
1814
1815 void process_complete_pdu(struct pipes_struct *p)
1816 {
1817         struct ncacn_packet *pkt = NULL;
1818         NTSTATUS status;
1819         bool reply = False;
1820
1821         if(p->fault_state) {
1822                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
1823                           get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1824                 goto done;
1825         }
1826
1827         pkt = talloc(p->mem_ctx, struct ncacn_packet);
1828         if (!pkt) {
1829                 DEBUG(0, ("Out of memory!\n"));
1830                 goto done;
1831         }
1832
1833         /*
1834          * Ensure we're using the corrent endianness for both the
1835          * RPC header flags and the raw data we will be reading from.
1836          */
1837         if (dcerpc_get_endian_flag(&p->in_data.pdu) & DCERPC_DREP_LE) {
1838                 p->endian = RPC_LITTLE_ENDIAN;
1839         } else {
1840                 p->endian = RPC_BIG_ENDIAN;
1841         }
1842         DEBUG(10, ("PDU is in %s Endian format!\n", p->endian?"Big":"Little"));
1843
1844         status = dcerpc_pull_ncacn_packet(pkt, &p->in_data.pdu,
1845                                           pkt, p->endian);
1846         if (!NT_STATUS_IS_OK(status)) {
1847                 DEBUG(0, ("Failed to unmarshal rpc packet: %s!\n",
1848                           nt_errstr(status)));
1849                 goto done;
1850         }
1851
1852         /* Store the call_id */
1853         p->call_id = pkt->call_id;
1854
1855         DEBUG(10, ("Processing packet type %d\n", (int)pkt->ptype));
1856
1857         switch (pkt->ptype) {
1858         case DCERPC_PKT_REQUEST:
1859                 reply = process_request_pdu(p, pkt);
1860                 break;
1861
1862         case DCERPC_PKT_PING: /* CL request - ignore... */
1863                 DEBUG(0, ("process_complete_pdu: Error. "
1864                           "Connectionless packet type %d received on "
1865                           "pipe %s.\n", (int)pkt->ptype,
1866                          get_pipe_name_from_syntax(talloc_tos(),
1867                                                    &p->syntax)));
1868                 break;
1869
1870         case DCERPC_PKT_RESPONSE: /* No responses here. */
1871                 DEBUG(0, ("process_complete_pdu: Error. "
1872                           "DCERPC_PKT_RESPONSE received from client "
1873                           "on pipe %s.\n",
1874                          get_pipe_name_from_syntax(talloc_tos(),
1875                                                    &p->syntax)));
1876                 break;
1877
1878         case DCERPC_PKT_FAULT:
1879         case DCERPC_PKT_WORKING:
1880                 /* CL request - reply to a ping when a call in process. */
1881         case DCERPC_PKT_NOCALL:
1882                 /* CL - server reply to a ping call. */
1883         case DCERPC_PKT_REJECT:
1884         case DCERPC_PKT_ACK:
1885         case DCERPC_PKT_CL_CANCEL:
1886         case DCERPC_PKT_FACK:
1887         case DCERPC_PKT_CANCEL_ACK:
1888                 DEBUG(0, ("process_complete_pdu: Error. "
1889                           "Connectionless packet type %u received on "
1890                           "pipe %s.\n", (unsigned int)pkt->ptype,
1891                          get_pipe_name_from_syntax(talloc_tos(),
1892                                                    &p->syntax)));
1893                 break;
1894
1895         case DCERPC_PKT_BIND:
1896                 /*
1897                  * We assume that a pipe bind is only in one pdu.
1898                  */
1899                 if (pipe_init_outgoing_data(p)) {
1900                         reply = api_pipe_bind_req(p, pkt);
1901                 }
1902                 break;
1903
1904         case DCERPC_PKT_BIND_ACK:
1905         case DCERPC_PKT_BIND_NAK:
1906                 DEBUG(0, ("process_complete_pdu: Error. "
1907                           "DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1908                           "packet type %u received on pipe %s.\n",
1909                           (unsigned int)pkt->ptype,
1910                          get_pipe_name_from_syntax(talloc_tos(),
1911                                                    &p->syntax)));
1912                 break;
1913
1914
1915         case DCERPC_PKT_ALTER:
1916                 /*
1917                  * We assume that a pipe bind is only in one pdu.
1918                  */
1919                 if (pipe_init_outgoing_data(p)) {
1920                         reply = api_pipe_alter_context(p, pkt);
1921                 }
1922                 break;
1923
1924         case DCERPC_PKT_ALTER_RESP:
1925                 DEBUG(0, ("process_complete_pdu: Error. "
1926                           "DCERPC_PKT_ALTER_RESP on pipe %s: "
1927                           "Should only be server -> client.\n",
1928                          get_pipe_name_from_syntax(talloc_tos(),
1929                                                    &p->syntax)));
1930                 break;
1931
1932         case DCERPC_PKT_AUTH3:
1933                 /*
1934                  * The third packet in an auth exchange.
1935                  */
1936                 if (pipe_init_outgoing_data(p)) {
1937                         reply = api_pipe_bind_auth3(p, pkt);
1938                 }
1939                 break;
1940
1941         case DCERPC_PKT_SHUTDOWN:
1942                 DEBUG(0, ("process_complete_pdu: Error. "
1943                           "DCERPC_PKT_SHUTDOWN on pipe %s: "
1944                           "Should only be server -> client.\n",
1945                          get_pipe_name_from_syntax(talloc_tos(),
1946                                                    &p->syntax)));
1947                 break;
1948
1949         case DCERPC_PKT_CO_CANCEL:
1950                 /* For now just free all client data and continue
1951                  * processing. */
1952                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1953                          " Abandoning rpc call.\n"));
1954                 /* As we never do asynchronous RPC serving, we can
1955                  * never cancel a call (as far as I know).
1956                  * If we ever did we'd have to send a cancel_ack reply.
1957                  * For now, just free all client data and continue
1958                  * processing. */
1959                 reply = True;
1960                 break;
1961
1962 #if 0
1963                 /* Enable this if we're doing async rpc. */
1964                 /* We must check the outstanding callid matches. */
1965                 if (pipe_init_outgoing_data(p)) {
1966                         /* Send a cancel_ack PDU reply. */
1967                         /* We should probably check the auth-verifier here. */
1968                         reply = setup_cancel_ack_reply(p, pkt);
1969                 }
1970                 break;
1971 #endif
1972
1973         case DCERPC_PKT_ORPHANED:
1974                 /* We should probably check the auth-verifier here.
1975                  * For now just free all client data and continue
1976                  * processing. */
1977                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
1978                           " Abandoning rpc call.\n"));
1979                 reply = True;
1980                 break;
1981
1982         default:
1983                 DEBUG(0, ("process_complete_pdu: "
1984                           "Unknown rpc type = %u received.\n",
1985                           (unsigned int)pkt->ptype));
1986                 break;
1987         }
1988
1989 done:
1990         if (!reply) {
1991                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on "
1992                          "pipe %s\n", get_pipe_name_from_syntax(talloc_tos(),
1993                                                                 &p->syntax)));
1994                 set_incoming_fault(p);
1995                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1996                 TALLOC_FREE(pkt);
1997         } else {
1998                 /*
1999                  * Reset the lengths. We're ready for a new pdu.
2000                  */
2001                 TALLOC_FREE(p->in_data.pdu.data);
2002                 p->in_data.pdu_needed_len = 0;
2003                 p->in_data.pdu.length = 0;
2004         }
2005
2006         TALLOC_FREE(pkt);
2007 }
2008