source/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19  */
  20
  21 /*  this module apparently provides an implementation of DCE/RPC over a
  22  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  23  *  documentation are available (in on-line form) from the X-Open group.
  24  *
  25  *  this module should provide a level of abstraction between SMB
  26  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  27  *  data copies, and network traffic.
  28  *
  29  */
  30
  31 #include "includes.h"
  32
  33 extern struct pipe_id_info pipe_names[];
  34 extern struct current_user current_user;
  35
  36 #undef DBGC_CLASS
  37 #define DBGC_CLASS DBGC_RPC_SRV
  38
  39 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  40 {
  41         AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
  42
  43         if (a) {
  44                 auth_ntlmssp_end(&a);
  45         }
  46         auth->a_u.auth_ntlmssp_state = NULL;
  47 }
  48
  49 /*******************************************************************
  50  Generate the next PDU to be returned from the data in p->rdata.
  51  Handle NTLMSSP.
  52  ********************************************************************/
  53
  54 static BOOL create_next_pdu_ntlmssp(pipes_struct *p)
  55 {
  56         RPC_HDR_RESP hdr_resp;
  57         uint32 ss_padding_len = 0;
  58         uint32 data_space_available;
  59         uint32 data_len_left;
  60         uint32 data_len;
  61         prs_struct outgoing_pdu;
  62         NTSTATUS status;
  63         DATA_BLOB auth_blob;
  64         RPC_HDR_AUTH auth_info;
  65         uint8 auth_type, auth_level;
  66         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
  67
  68         /*
  69          * If we're in the fault state, keep returning fault PDU's until
  70          * the pipe gets closed. JRA.
  71          */
  72
  73         if(p->fault_state) {
  74                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
  75                 return True;
  76         }
  77
  78         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  79
  80         /* Change the incoming request header to a response. */
  81         p->hdr.pkt_type = RPC_RESPONSE;
  82
  83         /* Set up rpc header flags. */
  84         if (p->out_data.data_sent_length == 0) {
  85                 p->hdr.flags = RPC_FLG_FIRST;
  86         } else {
  87                 p->hdr.flags = 0;
  88         }
  89
  90         /*
  91          * Work out how much we can fit in a single PDU.
  92          */
  93
  94         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
  95
  96         /*
  97          * Ensure there really is data left to send.
  98          */
  99
 100         if(!data_len_left) {
 101                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 102                 return False;
 103         }
 104
 105         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 106                                         RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 107
 108         /*
 109          * The amount we send is the minimum of the available
 110          * space and the amount left to send.
 111          */
 112
 113         data_len = MIN(data_len_left, data_space_available);
 114
 115         /*
 116          * Set up the alloc hint. This should be the data left to
 117          * send.
 118          */
 119
 120         hdr_resp.alloc_hint = data_len_left;
 121
 122         /*
 123          * Work out if this PDU will be the last.
 124          */
 125
 126         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 127                 p->hdr.flags |= RPC_FLG_LAST;
 128                 if (data_len_left % 8) {
 129                         ss_padding_len = 8 - (data_len_left % 8);
 130                         DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 131                                 ss_padding_len ));
 132                 }
 133         }
 134
 135         /*
 136          * Set up the header lengths.
 137          */
 138
 139         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 140                         data_len + ss_padding_len +
 141                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 142         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 143
 144
 145         /*
 146          * Init the parse struct to point at the outgoing
 147          * data.
 148          */
 149
 150         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 151         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 152
 153         /* Store the header in the data stream. */
 154         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 155                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 156                 prs_mem_free(&outgoing_pdu);
 157                 return False;
 158         }
 159
 160         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 161                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 162                 prs_mem_free(&outgoing_pdu);
 163                 return False;
 164         }
 165
 166         /* Copy the data into the PDU. */
 167
 168         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 169                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 170                 prs_mem_free(&outgoing_pdu);
 171                 return False;
 172         }
 173
 174         /* Copy the sign/seal padding data. */
 175         if (ss_padding_len) {
 176                 char pad[8];
 177
 178                 memset(pad, '\0', 8);
 179                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 180                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 181                                         (unsigned int)ss_padding_len));
 182                         prs_mem_free(&outgoing_pdu);
 183                         return False;
 184                 }
 185         }
 186
 187
 188         /* Now write out the auth header and null blob. */
 189         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 190                 auth_type = RPC_NTLMSSP_AUTH_TYPE;
 191         } else {
 192                 auth_type = RPC_SPNEGO_AUTH_TYPE;
 193         }
 194         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 195                 auth_level = RPC_AUTH_LEVEL_PRIVACY;
 196         } else {
 197                 auth_level = RPC_AUTH_LEVEL_INTEGRITY;
 198         }
 199
 200         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 201         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 202                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 203                 prs_mem_free(&outgoing_pdu);
 204                 return False;
 205         }
 206
 207         /* Generate the sign blob. */
 208
 209         switch (p->auth.auth_level) {
 210                 case PIPE_AUTH_LEVEL_PRIVACY:
 211                         /* Data portion is encrypted. */
 212                         status = ntlmssp_seal_packet(a->ntlmssp_state,
 213                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 214                                                         data_len + ss_padding_len,
 215                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 216                                                         (size_t)prs_offset(&outgoing_pdu),
 217                                                         &auth_blob);
 218                         if (!NT_STATUS_IS_OK(status)) {
 219                                 data_blob_free(&auth_blob);
 220                                 prs_mem_free(&outgoing_pdu);
 221                                 return False;
 222                         }
 223                         break;
 224                 case PIPE_AUTH_LEVEL_INTEGRITY:
 225                         /* Data is signed. */
 226                         status = ntlmssp_sign_packet(a->ntlmssp_state,
 227                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 228                                                         data_len + ss_padding_len,
 229                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 230                                                         (size_t)prs_offset(&outgoing_pdu),
 231                                                         &auth_blob);
 232                         if (!NT_STATUS_IS_OK(status)) {
 233                                 data_blob_free(&auth_blob);
 234                                 prs_mem_free(&outgoing_pdu);
 235                                 return False;
 236                         }
 237                         break;
 238                 default:
 239                         prs_mem_free(&outgoing_pdu);
 240                         return False;
 241         }
 242
 243         /* Append the auth blob. */
 244         if (!prs_copy_data_in(&outgoing_pdu, (char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
 245                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 246                                 (unsigned int)NTLMSSP_SIG_SIZE));
 247                 data_blob_free(&auth_blob);
 248                 prs_mem_free(&outgoing_pdu);
 249                 return False;
 250         }
 251
 252         data_blob_free(&auth_blob);
 253
 254         /*
 255          * Setup the counts for this PDU.
 256          */
 257
 258         p->out_data.data_sent_length += data_len;
 259         p->out_data.current_pdu_len = p->hdr.frag_len;
 260         p->out_data.current_pdu_sent = 0;
 261
 262         prs_mem_free(&outgoing_pdu);
 263         return True;
 264 }
 265
 266 /*******************************************************************
 267  Generate the next PDU to be returned from the data in p->rdata.
 268  Return an schannel authenticated fragment.
 269  ********************************************************************/
 270
 271 static BOOL create_next_pdu_schannel(pipes_struct *p)
 272 {
 273         RPC_HDR_RESP hdr_resp;
 274         uint32 ss_padding_len = 0;
 275         uint32 data_len;
 276         uint32 data_space_available;
 277         uint32 data_len_left;
 278         prs_struct outgoing_pdu;
 279         uint32 data_pos;
 280
 281         /*
 282          * If we're in the fault state, keep returning fault PDU's until
 283          * the pipe gets closed. JRA.
 284          */
 285
 286         if(p->fault_state) {
 287                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 288                 return True;
 289         }
 290
 291         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 292
 293         /* Change the incoming request header to a response. */
 294         p->hdr.pkt_type = RPC_RESPONSE;
 295
 296         /* Set up rpc header flags. */
 297         if (p->out_data.data_sent_length == 0) {
 298                 p->hdr.flags = RPC_FLG_FIRST;
 299         } else {
 300                 p->hdr.flags = 0;
 301         }
 302
 303         /*
 304          * Work out how much we can fit in a single PDU.
 305          */
 306
 307         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 308
 309         /*
 310          * Ensure there really is data left to send.
 311          */
 312
 313         if(!data_len_left) {
 314                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 315                 return False;
 316         }
 317
 318         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 319                                         RPC_HDR_AUTH_LEN - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 320
 321         /*
 322          * The amount we send is the minimum of the available
 323          * space and the amount left to send.
 324          */
 325
 326         data_len = MIN(data_len_left, data_space_available);
 327
 328         /*
 329          * Set up the alloc hint. This should be the data left to
 330          * send.
 331          */
 332
 333         hdr_resp.alloc_hint = data_len_left;
 334
 335         /*
 336          * Work out if this PDU will be the last.
 337          */
 338
 339         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 340                 p->hdr.flags |= RPC_FLG_LAST;
 341                 if (data_len_left % 8) {
 342                         ss_padding_len = 8 - (data_len_left % 8);
 343                         DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 344                                 ss_padding_len ));
 345                 }
 346         }
 347
 348         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 349                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 350         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 351
 352         /*
 353          * Init the parse struct to point at the outgoing
 354          * data.
 355          */
 356
 357         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 358         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 359
 360         /* Store the header in the data stream. */
 361         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 362                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 363                 prs_mem_free(&outgoing_pdu);
 364                 return False;
 365         }
 366
 367         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 368                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 369                 prs_mem_free(&outgoing_pdu);
 370                 return False;
 371         }
 372
 373         /* Store the current offset. */
 374         data_pos = prs_offset(&outgoing_pdu);
 375
 376         /* Copy the data into the PDU. */
 377
 378         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 379                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 380                 prs_mem_free(&outgoing_pdu);
 381                 return False;
 382         }
 383
 384         /* Copy the sign/seal padding data. */
 385         if (ss_padding_len) {
 386                 char pad[8];
 387                 memset(pad, '\0', 8);
 388                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 389                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 390                         prs_mem_free(&outgoing_pdu);
 391                         return False;
 392                 }
 393         }
 394
 395         {
 396                 /*
 397                  * Schannel processing.
 398                  */
 399                 char *data;
 400                 RPC_HDR_AUTH auth_info;
 401                 RPC_AUTH_SCHANNEL_CHK verf;
 402
 403                 data = prs_data_p(&outgoing_pdu) + data_pos;
 404                 /* Check it's the type of reply we were expecting to decode */
 405
 406                 init_rpc_hdr_auth(&auth_info,
 407                                 RPC_SCHANNEL_AUTH_TYPE,
 408                                 p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY ?
 409                                         RPC_AUTH_LEVEL_PRIVACY : RPC_AUTH_LEVEL_INTEGRITY,
 410                                 ss_padding_len, 1);
 411
 412                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 413                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 414                         prs_mem_free(&outgoing_pdu);
 415                         return False;
 416                 }
 417
 418                 schannel_encode(p->auth.a_u.schannel_auth,
 419                               p->auth.auth_level,
 420                               SENDER_IS_ACCEPTOR,
 421                               &verf, data, data_len + ss_padding_len);
 422
 423                 if (!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 424                                 &verf, &outgoing_pdu, 0)) {
 425                         prs_mem_free(&outgoing_pdu);
 426                         return False;
 427                 }
 428
 429                 p->auth.a_u.schannel_auth->seq_num++;
 430         }
 431
 432         /*
 433          * Setup the counts for this PDU.
 434          */
 435
 436         p->out_data.data_sent_length += data_len;
 437         p->out_data.current_pdu_len = p->hdr.frag_len;
 438         p->out_data.current_pdu_sent = 0;
 439
 440         prs_mem_free(&outgoing_pdu);
 441         return True;
 442 }
 443
 444 /*******************************************************************
 445  Generate the next PDU to be returned from the data in p->rdata.
 446  No authentication done.
 447 ********************************************************************/
 448
 449 static BOOL create_next_pdu_noauth(pipes_struct *p)
 450 {
 451         RPC_HDR_RESP hdr_resp;
 452         uint32 data_len;
 453         uint32 data_space_available;
 454         uint32 data_len_left;
 455         prs_struct outgoing_pdu;
 456
 457         /*
 458          * If we're in the fault state, keep returning fault PDU's until
 459          * the pipe gets closed. JRA.
 460          */
 461
 462         if(p->fault_state) {
 463                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 464                 return True;
 465         }
 466
 467         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 468
 469         /* Change the incoming request header to a response. */
 470         p->hdr.pkt_type = RPC_RESPONSE;
 471
 472         /* Set up rpc header flags. */
 473         if (p->out_data.data_sent_length == 0) {
 474                 p->hdr.flags = RPC_FLG_FIRST;
 475         } else {
 476                 p->hdr.flags = 0;
 477         }
 478
 479         /*
 480          * Work out how much we can fit in a single PDU.
 481          */
 482
 483         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 484
 485         /*
 486          * Ensure there really is data left to send.
 487          */
 488
 489         if(!data_len_left) {
 490                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 491                 return False;
 492         }
 493
 494         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 495
 496         /*
 497          * The amount we send is the minimum of the available
 498          * space and the amount left to send.
 499          */
 500
 501         data_len = MIN(data_len_left, data_space_available);
 502
 503         /*
 504          * Set up the alloc hint. This should be the data left to
 505          * send.
 506          */
 507
 508         hdr_resp.alloc_hint = data_len_left;
 509
 510         /*
 511          * Work out if this PDU will be the last.
 512          */
 513
 514         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 515                 p->hdr.flags |= RPC_FLG_LAST;
 516         }
 517
 518         /*
 519          * Set up the header lengths.
 520          */
 521
 522         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 523         p->hdr.auth_len = 0;
 524
 525         /*
 526          * Init the parse struct to point at the outgoing
 527          * data.
 528          */
 529
 530         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 531         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 532
 533         /* Store the header in the data stream. */
 534         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 535                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 536                 prs_mem_free(&outgoing_pdu);
 537                 return False;
 538         }
 539
 540         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 541                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 542                 prs_mem_free(&outgoing_pdu);
 543                 return False;
 544         }
 545
 546         /* Copy the data into the PDU. */
 547
 548         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 549                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 550                 prs_mem_free(&outgoing_pdu);
 551                 return False;
 552         }
 553
 554         /*
 555          * Setup the counts for this PDU.
 556          */
 557
 558         p->out_data.data_sent_length += data_len;
 559         p->out_data.current_pdu_len = p->hdr.frag_len;
 560         p->out_data.current_pdu_sent = 0;
 561
 562         prs_mem_free(&outgoing_pdu);
 563         return True;
 564 }
 565
 566 /*******************************************************************
 567  Generate the next PDU to be returned from the data in p->rdata.
 568 ********************************************************************/
 569
 570 BOOL create_next_pdu(pipes_struct *p)
 571 {
 572         switch(p->auth.auth_level) {
 573                 case PIPE_AUTH_LEVEL_NONE:
 574                 case PIPE_AUTH_LEVEL_CONNECT:
 575                         /* This is incorrect for auth level connect. Fixme. JRA */
 576                         return create_next_pdu_noauth(p);
 577
 578                 default:
 579                         switch(p->auth.auth_type) {
 580                                 case PIPE_AUTH_TYPE_NTLMSSP:
 581                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 582                                         return create_next_pdu_ntlmssp(p);
 583                                 case PIPE_AUTH_TYPE_SCHANNEL:
 584                                         return create_next_pdu_schannel(p);
 585                                 default:
 586                                         break;
 587                         }
 588         }
 589
 590         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 591                         (unsigned int)p->auth.auth_level,
 592                         (unsigned int)p->auth.auth_type));
 593         return False;
 594 }
 595
 596 /*******************************************************************
 597  Process an NTLMSSP authentication response.
 598  If this function succeeds, the user has been authenticated
 599  and their domain, name and calling workstation stored in
 600  the pipe struct.
 601 *******************************************************************/
 602
 603 static BOOL pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 604 {
 605         DATA_BLOB reply;
 606         NTSTATUS status;
 607         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
 608
 609         DEBUG(5,("pipe_ntlmssp_verify_final: checking user details\n"));
 610
 611         ZERO_STRUCT(reply);
 612
 613         memset(p->user_name, '\0', sizeof(p->user_name));
 614         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 615         memset(p->domain, '\0', sizeof(p->domain));
 616         memset(p->wks, '\0', sizeof(p->wks));
 617
 618         /* Set up for non-authenticated user. */
 619         TALLOC_FREE(p->pipe_user.nt_user_token);
 620         p->pipe_user.ut.ngroups = 0;
 621         SAFE_FREE( p->pipe_user.ut.groups);
 622
 623         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 624
 625         /* Don't generate a reply. */
 626         data_blob_free(&reply);
 627
 628         if (!NT_STATUS_IS_OK(status)) {
 629                 return False;
 630         }
 631
 632         fstrcpy(p->user_name, a->ntlmssp_state->user);
 633         fstrcpy(p->pipe_user_name, a->server_info->unix_name);
 634         fstrcpy(p->domain, a->ntlmssp_state->domain);
 635         fstrcpy(p->wks, a->ntlmssp_state->workstation);
 636
 637         DEBUG(5,("pipe_ntlmssp_verify_final: OK: user: %s domain: %s workstation: %s\n",
 638                 p->user_name, p->domain, p->wks));
 639
 640         /*
 641          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 642          */
 643
 644         p->pipe_user.ut.uid = a->server_info->uid;
 645         p->pipe_user.ut.gid = a->server_info->gid;
 646
 647         /*
 648          * Copy the session key from the ntlmssp state.
 649          */
 650
 651         data_blob_free(&p->session_key);
 652         p->session_key = data_blob(a->ntlmssp_state->session_key.data, a->ntlmssp_state->session_key.length);
 653         if (!p->session_key.data) {
 654                 return False;
 655         }
 656
 657         p->pipe_user.ut.ngroups = a->server_info->n_groups;
 658         if (p->pipe_user.ut.ngroups) {
 659                 if (!(p->pipe_user.ut.groups = memdup(a->server_info->groups,
 660                                                 sizeof(gid_t) * p->pipe_user.ut.ngroups))) {
 661                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 662                         return False;
 663                 }
 664         }
 665
 666         if (a->server_info->ptok) {
 667                 p->pipe_user.nt_user_token =
 668                         dup_nt_token(NULL, a->server_info->ptok);
 669         } else {
 670                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 671                 p->pipe_user.nt_user_token = NULL;
 672                 return False;
 673         }
 674
 675         return True;
 676 }
 677
 678 /*******************************************************************
 679  The switch table for the pipe names and the functions to handle them.
 680 *******************************************************************/
 681
 682 struct rpc_table {
 683         struct {
 684                 const char *clnt;
 685                 const char *srv;
 686         } pipe;
 687         struct api_struct *cmds;
 688         int n_cmds;
 689 };
 690
 691 static struct rpc_table *rpc_lookup;
 692 static int rpc_lookup_size;
 693
 694 /*******************************************************************
 695  This is the "stage3" NTLMSSP response after a bind request and reply.
 696 *******************************************************************/
 697
 698 BOOL api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 699 {
 700         RPC_HDR_AUTH auth_info;
 701         uint32 pad;
 702         DATA_BLOB blob;
 703
 704         ZERO_STRUCT(blob);
 705
 706         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 707
 708         if (p->hdr.auth_len == 0) {
 709                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 710                 goto err;
 711         }
 712
 713         /* 4 bytes padding. */
 714         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 715                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 716                 goto err;
 717         }
 718
 719         /*
 720          * Decode the authentication verifier response.
 721          */
 722
 723         if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 724                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
 725                 goto err;
 726         }
 727
 728         if (auth_info.auth_type != RPC_NTLMSSP_AUTH_TYPE) {
 729                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 730                         (unsigned int)auth_info.auth_type ));
 731                 return False;
 732         }
 733
 734         blob = data_blob(NULL,p->hdr.auth_len);
 735
 736         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 737                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 738                         (unsigned int)p->hdr.auth_len ));
 739                 goto err;
 740         }
 741
 742         /*
 743          * The following call actually checks the challenge/response data.
 744          * for correctness against the given DOMAIN\user name.
 745          */
 746
 747         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 748                 goto err;
 749         }
 750
 751         data_blob_free(&blob);
 752
 753         p->pipe_bound = True;
 754
 755         return True;
 756
 757  err:
 758
 759         data_blob_free(&blob);
 760         free_pipe_ntlmssp_auth_data(&p->auth);
 761         p->auth.a_u.auth_ntlmssp_state = NULL;
 762
 763         return False;
 764 }
 765
 766 /*******************************************************************
 767  Marshall a bind_nak pdu.
 768 *******************************************************************/
 769
 770 static BOOL setup_bind_nak(pipes_struct *p)
 771 {
 772         prs_struct outgoing_rpc;
 773         RPC_HDR nak_hdr;
 774         uint16 zero = 0;
 775
 776         /* Free any memory in the current return data buffer. */
 777         prs_mem_free(&p->out_data.rdata);
 778
 779         /*
 780          * Marshall directly into the outgoing PDU space. We
 781          * must do this as we need to set to the bind response
 782          * header and are never sending more than one PDU here.
 783          */
 784
 785         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 786         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 787
 788         /*
 789          * Initialize a bind_nak header.
 790          */
 791
 792         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 793                 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 794
 795         /*
 796          * Marshall the header into the outgoing PDU.
 797          */
 798
 799         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 800                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 801                 prs_mem_free(&outgoing_rpc);
 802                 return False;
 803         }
 804
 805         /*
 806          * Now add the reject reason.
 807          */
 808
 809         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 810                 prs_mem_free(&outgoing_rpc);
 811                 return False;
 812         }
 813
 814         p->out_data.data_sent_length = 0;
 815         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 816         p->out_data.current_pdu_sent = 0;
 817
 818         if (p->auth.auth_data_free_func) {
 819                 (*p->auth.auth_data_free_func)(&p->auth);
 820         }
 821         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
 822         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 823         p->pipe_bound = False;
 824
 825         return True;
 826 }
 827
 828 /*******************************************************************
 829  Marshall a fault pdu.
 830 *******************************************************************/
 831
 832 BOOL setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 833 {
 834         prs_struct outgoing_pdu;
 835         RPC_HDR fault_hdr;
 836         RPC_HDR_RESP hdr_resp;
 837         RPC_HDR_FAULT fault_resp;
 838
 839         /* Free any memory in the current return data buffer. */
 840         prs_mem_free(&p->out_data.rdata);
 841
 842         /*
 843          * Marshall directly into the outgoing PDU space. We
 844          * must do this as we need to set to the bind response
 845          * header and are never sending more than one PDU here.
 846          */
 847
 848         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 849         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 850
 851         /*
 852          * Initialize a fault header.
 853          */
 854
 855         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 856             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 857
 858         /*
 859          * Initialize the HDR_RESP and FAULT parts of the PDU.
 860          */
 861
 862         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 863
 864         fault_resp.status = status;
 865         fault_resp.reserved = 0;
 866
 867         /*
 868          * Marshall the header into the outgoing PDU.
 869          */
 870
 871         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 872                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 873                 prs_mem_free(&outgoing_pdu);
 874                 return False;
 875         }
 876
 877         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 878                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 879                 prs_mem_free(&outgoing_pdu);
 880                 return False;
 881         }
 882
 883         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 884                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 885                 prs_mem_free(&outgoing_pdu);
 886                 return False;
 887         }
 888
 889         p->out_data.data_sent_length = 0;
 890         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 891         p->out_data.current_pdu_sent = 0;
 892
 893         prs_mem_free(&outgoing_pdu);
 894         return True;
 895 }
 896
 897 #if 0
 898 /*******************************************************************
 899  Marshall a cancel_ack pdu.
 900  We should probably check the auth-verifier here.
 901 *******************************************************************/
 902
 903 BOOL setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
 904 {
 905         prs_struct outgoing_pdu;
 906         RPC_HDR ack_reply_hdr;
 907
 908         /* Free any memory in the current return data buffer. */
 909         prs_mem_free(&p->out_data.rdata);
 910
 911         /*
 912          * Marshall directly into the outgoing PDU space. We
 913          * must do this as we need to set to the bind response
 914          * header and are never sending more than one PDU here.
 915          */
 916
 917         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 918         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 919
 920         /*
 921          * Initialize a cancel_ack header.
 922          */
 923
 924         init_rpc_hdr(&ack_reply_hdr, RPC_CANCEL_ACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 925                         p->hdr.call_id, RPC_HEADER_LEN, 0);
 926
 927         /*
 928          * Marshall the header into the outgoing PDU.
 929          */
 930
 931         if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
 932                 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
 933                 prs_mem_free(&outgoing_pdu);
 934                 return False;
 935         }
 936
 937         p->out_data.data_sent_length = 0;
 938         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 939         p->out_data.current_pdu_sent = 0;
 940
 941         prs_mem_free(&outgoing_pdu);
 942         return True;
 943 }
 944 #endif
 945
 946 /*******************************************************************
 947  Ensure a bind request has the correct abstract & transfer interface.
 948  Used to reject unknown binds from Win2k.
 949 *******************************************************************/
 950
 951 BOOL check_bind_req(struct pipes_struct *p, RPC_IFACE* abstract,
 952                     RPC_IFACE* transfer, uint32 context_id)
 953 {
 954         char *pipe_name = p->name;
 955         int i=0;
 956         fstring pname;
 957
 958         fstrcpy(pname,"\\PIPE\\");
 959         fstrcat(pname,pipe_name);
 960
 961         DEBUG(3,("check_bind_req for %s\n", pname));
 962
 963         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 964
 965         for ( i=0; pipe_names[i].client_pipe; i++ ) {
 966                 DEBUG(10,("checking %s\n", pipe_names[i].client_pipe));
 967                 if ( strequal(pipe_names[i].client_pipe, pname)
 968                         && (abstract->version == pipe_names[i].abstr_syntax.version)
 969                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(struct uuid)) == 0)
 970                         && (transfer->version == pipe_names[i].trans_syntax.version)
 971                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(struct uuid)) == 0) ) {
 972                         struct api_struct       *fns = NULL;
 973                         int                     n_fns = 0;
 974                         PIPE_RPC_FNS            *context_fns;
 975
 976                         if ( !(context_fns = SMB_MALLOC_P(PIPE_RPC_FNS)) ) {
 977                                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 978                                 return False;
 979                         }
 980
 981                         /* save the RPC function table associated with this bind */
 982
 983                         get_pipe_fns(i, &fns, &n_fns);
 984
 985                         context_fns->cmds = fns;
 986                         context_fns->n_cmds = n_fns;
 987                         context_fns->context_id = context_id;
 988
 989                         /* add to the list of open contexts */
 990
 991                         DLIST_ADD( p->contexts, context_fns );
 992
 993                         break;
 994                 }
 995         }
 996
 997         if(pipe_names[i].client_pipe == NULL) {
 998                 return False;
 999         }
1000
1001         return True;
1002 }
1003
1004 /*******************************************************************
1005  Register commands to an RPC pipe
1006 *******************************************************************/
1007
1008 NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *srv, const struct api_struct *cmds, int size)
1009 {
1010         struct rpc_table *rpc_entry;
1011
1012         if (!clnt || !srv || !cmds) {
1013                 return NT_STATUS_INVALID_PARAMETER;
1014         }
1015
1016         if (version != SMB_RPC_INTERFACE_VERSION) {
1017                 DEBUG(0,("Can't register rpc commands!\n"
1018                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1019                          ", while this version of samba uses version %d!\n",
1020                          version,SMB_RPC_INTERFACE_VERSION));
1021                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1022         }
1023
1024         /* TODO:
1025          *
1026          * we still need to make sure that don't register the same commands twice!!!
1027          *
1028          * --metze
1029          */
1030
1031         /* We use a temporary variable because this call can fail and
1032            rpc_lookup will still be valid afterwards.  It could then succeed if
1033            called again later */
1034         rpc_lookup_size++;
1035         rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1036         if (NULL == rpc_entry) {
1037                 rpc_lookup_size--;
1038                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1039                 return NT_STATUS_NO_MEMORY;
1040         } else {
1041                 rpc_lookup = rpc_entry;
1042         }
1043
1044         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1045         ZERO_STRUCTP(rpc_entry);
1046         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1047         rpc_entry->pipe.srv = SMB_STRDUP(srv);
1048         rpc_entry->cmds = SMB_REALLOC_ARRAY(rpc_entry->cmds, struct api_struct, rpc_entry->n_cmds + size);
1049         if (!rpc_entry->cmds) {
1050                 return NT_STATUS_NO_MEMORY;
1051         }
1052         memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds, size * sizeof(struct api_struct));
1053         rpc_entry->n_cmds += size;
1054
1055         return NT_STATUS_OK;
1056 }
1057
1058 /*******************************************************************
1059  Handle a SPNEGO krb5 bind auth.
1060 *******************************************************************/
1061
1062 static BOOL pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1063                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1064 {
1065         return False;
1066 }
1067
1068 /*******************************************************************
1069  Handle the first part of a SPNEGO bind auth.
1070 *******************************************************************/
1071
1072 static BOOL pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1073                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1074 {
1075         DATA_BLOB blob;
1076         DATA_BLOB secblob;
1077         DATA_BLOB response;
1078         DATA_BLOB chal;
1079         char *OIDs[ASN1_MAX_OIDS];
1080         int i;
1081         NTSTATUS status;
1082         BOOL got_kerberos_mechanism = False;
1083         AUTH_NTLMSSP_STATE *a = NULL;
1084         RPC_HDR_AUTH auth_info;
1085
1086         ZERO_STRUCT(secblob);
1087         ZERO_STRUCT(chal);
1088         ZERO_STRUCT(response);
1089
1090         /* Grab the SPNEGO blob. */
1091         blob = data_blob(NULL,p->hdr.auth_len);
1092
1093         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1094                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1095                         (unsigned int)p->hdr.auth_len ));
1096                 goto err;
1097         }
1098
1099         if (blob.data[0] != ASN1_APPLICATION(0)) {
1100                 goto err;
1101         }
1102
1103         /* parse out the OIDs and the first sec blob */
1104         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1105                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1106                 goto err;
1107         }
1108
1109         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1110                 got_kerberos_mechanism = True;
1111         }
1112
1113         for (i=0;OIDs[i];i++) {
1114                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1115                 SAFE_FREE(OIDs[i]);
1116         }
1117         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1118
1119         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || lp_use_kerberos_keytab()) ) {
1120                 BOOL ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1121                 data_blob_free(&secblob);
1122                 data_blob_free(&blob);
1123                 return ret;
1124         }
1125
1126         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1127                 /* Free any previous auth type. */
1128                 free_pipe_ntlmssp_auth_data(&p->auth);
1129         }
1130
1131         /* Initialize the NTLM engine. */
1132         status = auth_ntlmssp_start(&a);
1133         if (!NT_STATUS_IS_OK(status)) {
1134                 goto err;
1135         }
1136
1137         /*
1138          * Pass the first security blob of data to it.
1139          * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1140          * which means we need another packet to complete the bind.
1141          */
1142
1143         status = auth_ntlmssp_update(a, secblob, &chal);
1144
1145         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1146                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1147                 goto err;
1148         }
1149
1150         /* Generate the response blob we need for step 2 of the bind. */
1151         response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1152
1153         /* Copy the blob into the pout_auth parse struct */
1154         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1155         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1156                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1157                 goto err;
1158         }
1159
1160         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1161                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1162                 goto err;
1163         }
1164
1165         p->auth.a_u.auth_ntlmssp_state = a;
1166         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1167         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1168
1169         data_blob_free(&blob);
1170         data_blob_free(&secblob);
1171         data_blob_free(&chal);
1172         data_blob_free(&response);
1173
1174         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1175         return True;
1176
1177  err:
1178
1179         data_blob_free(&blob);
1180         data_blob_free(&secblob);
1181         data_blob_free(&chal);
1182         data_blob_free(&response);
1183
1184         p->auth.a_u.auth_ntlmssp_state = NULL;
1185
1186         return False;
1187 }
1188
1189 /*******************************************************************
1190  Handle the second part of a SPNEGO bind auth.
1191 *******************************************************************/
1192
1193 static BOOL pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1194                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1195 {
1196         RPC_HDR_AUTH auth_info;
1197         DATA_BLOB spnego_blob;
1198         DATA_BLOB auth_blob;
1199         DATA_BLOB auth_reply;
1200         DATA_BLOB response;
1201         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1202
1203         ZERO_STRUCT(spnego_blob);
1204         ZERO_STRUCT(auth_blob);
1205         ZERO_STRUCT(auth_reply);
1206         ZERO_STRUCT(response);
1207
1208         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1209                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1210                 goto err;
1211         }
1212
1213         /* Grab the SPNEGO blob. */
1214         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1215
1216         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1217                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1218                         (unsigned int)p->hdr.auth_len ));
1219                 goto err;
1220         }
1221
1222         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1223                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1224                 goto err;
1225         }
1226
1227         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1228                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1229                 goto err;
1230         }
1231
1232         /*
1233          * The following call actually checks the challenge/response data.
1234          * for correctness against the given DOMAIN\user name.
1235          */
1236
1237         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1238                 goto err;
1239         }
1240
1241         data_blob_free(&spnego_blob);
1242         data_blob_free(&auth_blob);
1243
1244         /* Generate the spnego "accept completed" blob - no incoming data. */
1245         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1246
1247         /* Copy the blob into the pout_auth parse struct */
1248         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1249         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1250                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1251                 goto err;
1252         }
1253
1254         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1255                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1256                 goto err;
1257         }
1258
1259         data_blob_free(&auth_reply);
1260         data_blob_free(&response);
1261
1262         p->pipe_bound = True;
1263
1264         return True;
1265
1266  err:
1267
1268         data_blob_free(&spnego_blob);
1269         data_blob_free(&auth_blob);
1270         data_blob_free(&auth_reply);
1271         data_blob_free(&response);
1272
1273         free_pipe_ntlmssp_auth_data(&p->auth);
1274         p->auth.a_u.auth_ntlmssp_state = NULL;
1275
1276         return False;
1277 }
1278
1279 /*******************************************************************
1280  Handle an schannel bind auth.
1281 *******************************************************************/
1282
1283 static BOOL pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1284                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1285 {
1286         RPC_HDR_AUTH auth_info;
1287         RPC_AUTH_SCHANNEL_NEG neg;
1288         RPC_AUTH_VERIFIER auth_verifier;
1289         BOOL ret;
1290         struct dcinfo *pdcinfo;
1291         uint32 flags;
1292
1293         if (!smb_io_rpc_auth_schannel_neg("", &neg, rpc_in_p, 0)) {
1294                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1295                 return False;
1296         }
1297
1298         /*
1299          * The neg.myname key here must match the remote computer name
1300          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1301          * operations that use credentials.
1302          */
1303
1304         become_root();
1305         ret = secrets_restore_schannel_session_info(p->mem_ctx, neg.myname, &pdcinfo);
1306         unbecome_root();
1307
1308         if (!ret) {
1309                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1310                 return False;
1311         }
1312
1313         p->auth.a_u.schannel_auth = TALLOC_P(p->pipe_state_mem_ctx, struct schannel_auth_struct);
1314         if (!p->auth.a_u.schannel_auth) {
1315                 TALLOC_FREE(pdcinfo);
1316                 return False;
1317         }
1318
1319         memset(p->auth.a_u.schannel_auth->sess_key, 0, sizeof(p->auth.a_u.schannel_auth->sess_key));
1320         memcpy(p->auth.a_u.schannel_auth->sess_key, pdcinfo->sess_key,
1321                         sizeof(pdcinfo->sess_key));
1322
1323         TALLOC_FREE(pdcinfo);
1324
1325         p->auth.a_u.schannel_auth->seq_num = 0;
1326
1327         /*
1328          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1329          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1330          * struct of the person who opened the pipe. I need to test this further. JRA.
1331          */
1332
1333         init_rpc_hdr_auth(&auth_info, RPC_SCHANNEL_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1334         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1335                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1336                 return False;
1337         }
1338
1339         /*** SCHANNEL verifier ***/
1340
1341         init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1342         if(!smb_io_rpc_schannel_verifier("", &auth_verifier, pout_auth, 0)) {
1343                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1344                 return False;
1345         }
1346
1347         prs_align(pout_auth);
1348
1349         flags = 5;
1350         if(!prs_uint32("flags ", pout_auth, 0, &flags)) {
1351                 return False;
1352         }
1353
1354         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1355                 neg.domain, neg.myname));
1356
1357         /* We're finished with this bind - no more packets. */
1358         p->auth.auth_data_free_func = NULL;
1359         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1360
1361         p->pipe_bound = True;
1362
1363         return True;
1364 }
1365
1366 /*******************************************************************
1367  Handle an NTLMSSP bind auth.
1368 *******************************************************************/
1369
1370 static BOOL pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1371                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1372 {
1373         RPC_HDR_AUTH auth_info;
1374         DATA_BLOB blob;
1375         DATA_BLOB response;
1376         NTSTATUS status;
1377         AUTH_NTLMSSP_STATE *a = NULL;
1378
1379         ZERO_STRUCT(blob);
1380         ZERO_STRUCT(response);
1381
1382         /* Grab the NTLMSSP blob. */
1383         blob = data_blob(NULL,p->hdr.auth_len);
1384
1385         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1386                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1387                         (unsigned int)p->hdr.auth_len ));
1388                 goto err;
1389         }
1390
1391         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1392                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1393                 goto err;
1394         }
1395
1396         /* We have an NTLMSSP blob. */
1397         status = auth_ntlmssp_start(&a);
1398         if (!NT_STATUS_IS_OK(status)) {
1399                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1400                         nt_errstr(status) ));
1401                 goto err;
1402         }
1403
1404         status = auth_ntlmssp_update(a, blob, &response);
1405         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1406                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1407                         nt_errstr(status) ));
1408                 goto err;
1409         }
1410
1411         data_blob_free(&blob);
1412
1413         /* Copy the blob into the pout_auth parse struct */
1414         init_rpc_hdr_auth(&auth_info, RPC_NTLMSSP_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1415         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1416                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1417                 goto err;
1418         }
1419
1420         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1421                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1422                 goto err;
1423         }
1424
1425         p->auth.a_u.auth_ntlmssp_state = a;
1426         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1427         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1428
1429         data_blob_free(&blob);
1430         data_blob_free(&response);
1431
1432         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1433
1434         /* We can't set pipe_bound True yet - we need an RPC_AUTH3 response packet... */
1435         return True;
1436
1437   err:
1438
1439         data_blob_free(&blob);
1440         data_blob_free(&response);
1441
1442         free_pipe_ntlmssp_auth_data(&p->auth);
1443         p->auth.a_u.auth_ntlmssp_state = NULL;
1444         return False;
1445 }
1446
1447 /*******************************************************************
1448  Respond to a pipe bind request.
1449 *******************************************************************/
1450
1451 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1452 {
1453         RPC_HDR_BA hdr_ba;
1454         RPC_HDR_RB hdr_rb;
1455         RPC_HDR_AUTH auth_info;
1456         uint16 assoc_gid;
1457         fstring ack_pipe_name;
1458         prs_struct out_hdr_ba;
1459         prs_struct out_auth;
1460         prs_struct outgoing_rpc;
1461         int i = 0;
1462         int auth_len = 0;
1463         unsigned int auth_type = RPC_ANONYMOUS_AUTH_TYPE;
1464
1465         /* No rebinds on a bound pipe - use alter context. */
1466         if (p->pipe_bound) {
1467                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound pipe %s.\n", p->pipe_srv_name));
1468                 return setup_bind_nak(p);
1469         }
1470
1471         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
1472
1473         /*
1474          * Marshall directly into the outgoing PDU space. We
1475          * must do this as we need to set to the bind response
1476          * header and are never sending more than one PDU here.
1477          */
1478
1479         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1480
1481         /*
1482          * Setup the memory to marshall the ba header, and the
1483          * auth footers.
1484          */
1485
1486         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1487                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1488                 prs_mem_free(&outgoing_rpc);
1489                 return False;
1490         }
1491
1492         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1493                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1494                 prs_mem_free(&outgoing_rpc);
1495                 prs_mem_free(&out_hdr_ba);
1496                 return False;
1497         }
1498
1499         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1500
1501         /*
1502          * Try and find the correct pipe name to ensure
1503          * that this is a pipe name we support.
1504          */
1505
1506
1507         for (i = 0; i < rpc_lookup_size; i++) {
1508                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1509                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1510                                 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1511                         fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1512                         break;
1513                 }
1514         }
1515
1516         if (i == rpc_lookup_size) {
1517                 if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) {
1518                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1519                                 p->name ));
1520                         prs_mem_free(&outgoing_rpc);
1521                         prs_mem_free(&out_hdr_ba);
1522                         prs_mem_free(&out_auth);
1523
1524                         return setup_bind_nak(p);
1525                 }
1526
1527                 for (i = 0; i < rpc_lookup_size; i++) {
1528                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1529                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1530                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1531                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1532                                break;
1533                        }
1534                 }
1535
1536                 if (i == rpc_lookup_size) {
1537                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
1538                         goto err_exit;
1539                 }
1540         }
1541
1542         /* decode the bind request */
1543         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1544                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
1545                 goto err_exit;
1546         }
1547
1548         /* name has to be \PIPE\xxxxx */
1549         fstrcpy(ack_pipe_name, "\\PIPE\\");
1550         fstrcat(ack_pipe_name, p->pipe_srv_name);
1551
1552         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1553
1554         /*
1555          * Check if this is an authenticated bind request.
1556          */
1557
1558         if (p->hdr.auth_len) {
1559                 /*
1560                  * Decode the authentication verifier.
1561                  */
1562
1563                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1564                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1565                         goto err_exit;
1566                 }
1567
1568                 auth_type = auth_info.auth_type;
1569
1570                 /* Work out if we have to sign or seal etc. */
1571                 switch (auth_info.auth_level) {
1572                         case RPC_AUTH_LEVEL_INTEGRITY:
1573                                 p->auth.auth_level = PIPE_AUTH_LEVEL_INTEGRITY;
1574                                 break;
1575                         case RPC_AUTH_LEVEL_PRIVACY:
1576                                 p->auth.auth_level = PIPE_AUTH_LEVEL_PRIVACY;
1577                                 break;
1578                         default:
1579                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1580                                         (unsigned int)auth_info.auth_level ));
1581                                 goto err_exit;
1582                 }
1583         } else {
1584                 ZERO_STRUCT(auth_info);
1585         }
1586
1587         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1588
1589         switch(auth_type) {
1590                 case RPC_NTLMSSP_AUTH_TYPE:
1591                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1592                                 goto err_exit;
1593                         }
1594                         assoc_gid = 0x7a77;
1595                         break;
1596
1597                 case RPC_SCHANNEL_AUTH_TYPE:
1598                         if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1599                                 goto err_exit;
1600                         }
1601                         break;
1602
1603                 case RPC_SPNEGO_AUTH_TYPE:
1604                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1605                                 goto err_exit;
1606                         }
1607                         break;
1608
1609                 case RPC_ANONYMOUS_AUTH_TYPE:
1610                         /* Unauthenticated bind request. */
1611                         /* We're finished - no more packets. */
1612                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1613                         /* We must set the pipe auth_level here also. */
1614                         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
1615                         p->pipe_bound = True;
1616                         break;
1617
1618                 default:
1619                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1620                         goto err_exit;
1621         }
1622
1623         /*
1624          * Create the bind response struct.
1625          */
1626
1627         /* If the requested abstract synt uuid doesn't match our client pipe,
1628                 reject the bind_ack & set the transfer interface synt to all 0's,
1629                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1630                 unknown to NT4)
1631                 Needed when adding entries to a DACL from NT5 - SK */
1632
1633         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1634                                 hdr_rb.rpc_context[0].context_id )) {
1635                 init_rpc_hdr_ba(&hdr_ba,
1636                         RPC_MAX_PDU_FRAG_LEN,
1637                         RPC_MAX_PDU_FRAG_LEN,
1638                         assoc_gid,
1639                         ack_pipe_name,
1640                         0x1, 0x0, 0x0,
1641                         &hdr_rb.rpc_context[0].transfer[0]);
1642         } else {
1643                 RPC_IFACE null_interface;
1644                 ZERO_STRUCT(null_interface);
1645                 /* Rejection reason: abstract syntax not supported */
1646                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1647                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1648                                         ack_pipe_name, 0x1, 0x2, 0x1,
1649                                         &null_interface);
1650                 p->pipe_bound = False;
1651         }
1652
1653         /*
1654          * and marshall it.
1655          */
1656
1657         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1658                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1659                 goto err_exit;
1660         }
1661
1662         /*
1663          * Create the header, now we know the length.
1664          */
1665
1666         if (prs_offset(&out_auth)) {
1667                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1668         }
1669
1670         init_rpc_hdr(&p->hdr, RPC_BINDACK, RPC_FLG_FIRST | RPC_FLG_LAST,
1671                         p->hdr.call_id,
1672                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1673                         auth_len);
1674
1675         /*
1676          * Marshall the header into the outgoing PDU.
1677          */
1678
1679         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1680                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1681                 goto err_exit;
1682         }
1683
1684         /*
1685          * Now add the RPC_HDR_BA and any auth needed.
1686          */
1687
1688         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1689                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1690                 goto err_exit;
1691         }
1692
1693         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1694                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1695                 goto err_exit;
1696         }
1697
1698         /*
1699          * Setup the lengths for the initial reply.
1700          */
1701
1702         p->out_data.data_sent_length = 0;
1703         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1704         p->out_data.current_pdu_sent = 0;
1705
1706         prs_mem_free(&out_hdr_ba);
1707         prs_mem_free(&out_auth);
1708
1709         return True;
1710
1711   err_exit:
1712
1713         prs_mem_free(&outgoing_rpc);
1714         prs_mem_free(&out_hdr_ba);
1715         prs_mem_free(&out_auth);
1716         return setup_bind_nak(p);
1717 }
1718
1719 /****************************************************************************
1720  Deal with an alter context call. Can be third part of 3 leg auth request for
1721  SPNEGO calls.
1722 ****************************************************************************/
1723
1724 BOOL api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1725 {
1726         RPC_HDR_BA hdr_ba;
1727         RPC_HDR_RB hdr_rb;
1728         RPC_HDR_AUTH auth_info;
1729         uint16 assoc_gid;
1730         fstring ack_pipe_name;
1731         prs_struct out_hdr_ba;
1732         prs_struct out_auth;
1733         prs_struct outgoing_rpc;
1734         int auth_len = 0;
1735
1736         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
1737
1738         /*
1739          * Marshall directly into the outgoing PDU space. We
1740          * must do this as we need to set to the bind response
1741          * header and are never sending more than one PDU here.
1742          */
1743
1744         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1745
1746         /*
1747          * Setup the memory to marshall the ba header, and the
1748          * auth footers.
1749          */
1750
1751         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1752                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1753                 prs_mem_free(&outgoing_rpc);
1754                 return False;
1755         }
1756
1757         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1758                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1759                 prs_mem_free(&outgoing_rpc);
1760                 prs_mem_free(&out_hdr_ba);
1761                 return False;
1762         }
1763
1764         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1765
1766         /* decode the alter context request */
1767         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1768                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1769                 goto err_exit;
1770         }
1771
1772         /* secondary address CAN be NULL
1773          * as the specs say it's ignored.
1774          * It MUST be NULL to have the spoolss working.
1775          */
1776         fstrcpy(ack_pipe_name,"");
1777
1778         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1779
1780         /*
1781          * Check if this is an authenticated alter context request.
1782          */
1783
1784         if (p->hdr.auth_len != 0) {
1785                 /*
1786                  * Decode the authentication verifier.
1787                  */
1788
1789                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1790                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1791                         goto err_exit;
1792                 }
1793
1794                 /*
1795                  * Currently only the SPNEGO auth type uses the alter ctx
1796                  * response in place of the NTLMSSP auth3 type.
1797                  */
1798
1799                 if (auth_info.auth_type == RPC_SPNEGO_AUTH_TYPE) {
1800                         /* We can only finish if the pipe is unbound. */
1801                         if (!p->pipe_bound) {
1802                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1803                                         goto err_exit;
1804                                 }
1805                         } else {
1806                                 goto err_exit;
1807                         }
1808                 }
1809         } else {
1810                 ZERO_STRUCT(auth_info);
1811         }
1812
1813         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1814
1815         /*
1816          * Create the bind response struct.
1817          */
1818
1819         /* If the requested abstract synt uuid doesn't match our client pipe,
1820                 reject the bind_ack & set the transfer interface synt to all 0's,
1821                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1822                 unknown to NT4)
1823                 Needed when adding entries to a DACL from NT5 - SK */
1824
1825         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1826                                 hdr_rb.rpc_context[0].context_id )) {
1827                 init_rpc_hdr_ba(&hdr_ba,
1828                         RPC_MAX_PDU_FRAG_LEN,
1829                         RPC_MAX_PDU_FRAG_LEN,
1830                         assoc_gid,
1831                         ack_pipe_name,
1832                         0x1, 0x0, 0x0,
1833                         &hdr_rb.rpc_context[0].transfer[0]);
1834         } else {
1835                 RPC_IFACE null_interface;
1836                 ZERO_STRUCT(null_interface);
1837                 /* Rejection reason: abstract syntax not supported */
1838                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1839                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1840                                         ack_pipe_name, 0x1, 0x2, 0x1,
1841                                         &null_interface);
1842                 p->pipe_bound = False;
1843         }
1844
1845         /*
1846          * and marshall it.
1847          */
1848
1849         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1850                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1851                 goto err_exit;
1852         }
1853
1854         /*
1855          * Create the header, now we know the length.
1856          */
1857
1858         if (prs_offset(&out_auth)) {
1859                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1860         }
1861
1862         init_rpc_hdr(&p->hdr, RPC_ALTCONTRESP, RPC_FLG_FIRST | RPC_FLG_LAST,
1863                         p->hdr.call_id,
1864                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1865                         auth_len);
1866
1867         /*
1868          * Marshall the header into the outgoing PDU.
1869          */
1870
1871         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1872                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
1873                 goto err_exit;
1874         }
1875
1876         /*
1877          * Now add the RPC_HDR_BA and any auth needed.
1878          */
1879
1880         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1881                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
1882                 goto err_exit;
1883         }
1884
1885         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1886                 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
1887                 goto err_exit;
1888         }
1889
1890         /*
1891          * Setup the lengths for the initial reply.
1892          */
1893
1894         p->out_data.data_sent_length = 0;
1895         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1896         p->out_data.current_pdu_sent = 0;
1897
1898         prs_mem_free(&out_hdr_ba);
1899         prs_mem_free(&out_auth);
1900
1901         return True;
1902
1903   err_exit:
1904
1905         prs_mem_free(&outgoing_rpc);
1906         prs_mem_free(&out_hdr_ba);
1907         prs_mem_free(&out_auth);
1908         return setup_bind_nak(p);
1909 }
1910
1911 /****************************************************************************
1912  Deal with NTLMSSP sign & seal processing on an RPC request.
1913 ****************************************************************************/
1914
1915 BOOL api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
1916                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
1917 {
1918         RPC_HDR_AUTH auth_info;
1919         uint32 auth_len = p->hdr.auth_len;
1920         uint32 save_offset = prs_offset(rpc_in);
1921         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1922         unsigned char *data = NULL;
1923         size_t data_len;
1924         unsigned char *full_packet_data = NULL;
1925         size_t full_packet_data_len;
1926         DATA_BLOB auth_blob;
1927
1928         *pstatus = NT_STATUS_OK;
1929
1930         if (p->auth.auth_level == PIPE_AUTH_LEVEL_NONE || p->auth.auth_level == PIPE_AUTH_LEVEL_CONNECT) {
1931                 return True;
1932         }
1933
1934         if (!a) {
1935                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1936                 return False;
1937         }
1938
1939         /* Ensure there's enough data for an authenticated request. */
1940         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
1941                         (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
1942                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
1943                         (unsigned int)auth_len ));
1944                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1945                 return False;
1946         }
1947
1948         /*
1949          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
1950          * after the RPC header.
1951          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
1952          * functions as NTLMv2 checks the rpc headers also.
1953          */
1954
1955         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
1956         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
1957
1958         full_packet_data = p->in_data.current_in_pdu;
1959         full_packet_data_len = p->hdr.frag_len - auth_len;
1960
1961         /* Pull the auth header and the following data into a blob. */
1962         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
1963                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
1964                         (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
1965                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1966                 return False;
1967         }
1968
1969         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1970                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1971                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1972                 return False;
1973         }
1974
1975         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
1976         auth_blob.length = auth_len;
1977
1978         switch (p->auth.auth_level) {
1979                 case PIPE_AUTH_LEVEL_PRIVACY:
1980                         /* Data is encrypted. */
1981                         *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
1982                                                         data, data_len,
1983                                                         full_packet_data,
1984                                                         full_packet_data_len,
1985                                                         &auth_blob);
1986                         if (!NT_STATUS_IS_OK(*pstatus)) {
1987                                 return False;
1988                         }
1989                         break;
1990                 case PIPE_AUTH_LEVEL_INTEGRITY:
1991                         /* Data is signed. */
1992                         *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
1993                                                         data, data_len,
1994                                                         full_packet_data,
1995                                                         full_packet_data_len,
1996                                                         &auth_blob);
1997                         if (!NT_STATUS_IS_OK(*pstatus)) {
1998                                 return False;
1999                         }
2000                         break;
2001                 default:
2002                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2003                         return False;
2004         }
2005
2006         /*
2007          * Return the current pointer to the data offset.
2008          */
2009
2010         if(!prs_set_offset(rpc_in, save_offset)) {
2011                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2012                         (unsigned int)save_offset ));
2013                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2014                 return False;
2015         }
2016
2017         /*
2018          * Remember the padding length. We must remove it from the real data
2019          * stream once the sign/seal is done.
2020          */
2021
2022         *p_ss_padding_len = auth_info.auth_pad_len;
2023
2024         return True;
2025 }
2026
2027 /****************************************************************************
2028  Deal with schannel processing on an RPC request.
2029 ****************************************************************************/
2030
2031 BOOL api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2032 {
2033         uint32 data_len;
2034         uint32 auth_len;
2035         uint32 save_offset = prs_offset(rpc_in);
2036         RPC_HDR_AUTH auth_info;
2037         RPC_AUTH_SCHANNEL_CHK schannel_chk;
2038
2039         auth_len = p->hdr.auth_len;
2040
2041         if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
2042                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2043                 return False;
2044         }
2045
2046         /*
2047          * The following is that length of the data we must verify or unseal.
2048          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2049          * preceeding the auth_data.
2050          */
2051
2052         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2053                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2054                         (unsigned int)p->hdr.frag_len,
2055                         (unsigned int)auth_len ));
2056                 return False;
2057         }
2058
2059         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2060                 RPC_HDR_AUTH_LEN - auth_len;
2061
2062         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2063
2064         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2065                 DEBUG(0,("cannot move offset to %u.\n",
2066                          (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2067                 return False;
2068         }
2069
2070         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2071                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2072                 return False;
2073         }
2074
2075         if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
2076                 DEBUG(0,("Invalid auth info %d on schannel\n",
2077                          auth_info.auth_type));
2078                 return False;
2079         }
2080
2081         if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN, &schannel_chk, rpc_in, 0)) {
2082                 DEBUG(0,("failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
2083                 return False;
2084         }
2085
2086         if (!schannel_decode(p->auth.a_u.schannel_auth,
2087                            p->auth.auth_level,
2088                            SENDER_IS_INITIATOR,
2089                            &schannel_chk,
2090                            prs_data_p(rpc_in)+RPC_HDR_REQ_LEN, data_len)) {
2091                 DEBUG(3,("failed to decode PDU\n"));
2092                 return False;
2093         }
2094
2095         /*
2096          * Return the current pointer to the data offset.
2097          */
2098
2099         if(!prs_set_offset(rpc_in, save_offset)) {
2100                 DEBUG(0,("failed to set offset back to %u\n",
2101                          (unsigned int)save_offset ));
2102                 return False;
2103         }
2104
2105         /* The sequence number gets incremented on both send and receive. */
2106         p->auth.a_u.schannel_auth->seq_num++;
2107
2108         /*
2109          * Remember the padding length. We must remove it from the real data
2110          * stream once the sign/seal is done.
2111          */
2112
2113         *p_ss_padding_len = auth_info.auth_pad_len;
2114
2115         return True;
2116 }
2117
2118 /****************************************************************************
2119  Return a user struct for a pipe user.
2120 ****************************************************************************/
2121
2122 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
2123 {
2124         if (p->pipe_bound &&
2125                         (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP ||
2126                         (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2127                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
2128         } else {
2129                 memcpy(user, &current_user, sizeof(struct current_user));
2130         }
2131
2132         return user;
2133 }
2134
2135 /****************************************************************************
2136  Find the set of RPC functions associated with this context_id
2137 ****************************************************************************/
2138
2139 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2140 {
2141         PIPE_RPC_FNS *fns = NULL;
2142         PIPE_RPC_FNS *tmp = NULL;
2143
2144         if ( !list ) {
2145                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2146                 return NULL;
2147         }
2148
2149         for (tmp=list; tmp; tmp=tmp->next ) {
2150                 if ( tmp->context_id == context_id )
2151                         break;
2152         }
2153
2154         fns = tmp;
2155
2156         return fns;
2157 }
2158
2159 /****************************************************************************
2160  Memory cleanup.
2161 ****************************************************************************/
2162
2163 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2164 {
2165         PIPE_RPC_FNS *tmp = list;
2166         PIPE_RPC_FNS *tmp2;
2167
2168         while (tmp) {
2169                 tmp2 = tmp->next;
2170                 SAFE_FREE(tmp);
2171                 tmp = tmp2;
2172         }
2173
2174         return;
2175 }
2176
2177 /****************************************************************************
2178  Find the correct RPC function to call for this request.
2179  If the pipe is authenticated then become the correct UNIX user
2180  before doing the call.
2181 ****************************************************************************/
2182
2183 BOOL api_pipe_request(pipes_struct *p)
2184 {
2185         BOOL ret = False;
2186         BOOL changed_user = False;
2187         PIPE_RPC_FNS *pipe_fns;
2188
2189         if (p->pipe_bound &&
2190                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2191                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2192                 if(!become_authenticated_pipe_user(p)) {
2193                         prs_mem_free(&p->out_data.rdata);
2194                         return False;
2195                 }
2196                 changed_user = True;
2197         }
2198
2199         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
2200
2201         /* get the set of RPC functions for this context */
2202
2203         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2204
2205         if ( pipe_fns ) {
2206                 set_current_rpc_talloc(p->mem_ctx);
2207                 ret = api_rpcTNP(p, p->name, pipe_fns->cmds, pipe_fns->n_cmds);
2208                 set_current_rpc_talloc(NULL);
2209         }
2210         else {
2211                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2212                         p->hdr_req.context_id, p->name));
2213         }
2214
2215         if (changed_user) {
2216                 unbecome_authenticated_pipe_user();
2217         }
2218
2219         return ret;
2220 }
2221
2222 /*******************************************************************
2223  Calls the underlying RPC function for a named pipe.
2224  ********************************************************************/
2225
2226 BOOL api_rpcTNP(pipes_struct *p, const char *rpc_name,
2227                 const struct api_struct *api_rpc_cmds, int n_cmds)
2228 {
2229         int fn_num;
2230         fstring name;
2231         uint32 offset1, offset2;
2232
2233         /* interpret the command */
2234         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
2235
2236         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
2237         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2238
2239         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2240                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2241                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2242                         break;
2243                 }
2244         }
2245
2246         if (fn_num == n_cmds) {
2247                 /*
2248                  * For an unknown RPC just return a fault PDU but
2249                  * return True to allow RPC's on the pipe to continue
2250                  * and not put the pipe into fault state. JRA.
2251                  */
2252                 DEBUG(4, ("unknown\n"));
2253                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
2254                 return True;
2255         }
2256
2257         offset1 = prs_offset(&p->out_data.rdata);
2258
2259         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2260                 fn_num, api_rpc_cmds[fn_num].fn));
2261         /* do the actual command */
2262         if(!api_rpc_cmds[fn_num].fn(p)) {
2263                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
2264                 prs_mem_free(&p->out_data.rdata);
2265                 return False;
2266         }
2267
2268         if (p->bad_handle_fault_state) {
2269                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2270                 p->bad_handle_fault_state = False;
2271                 setup_fault_pdu(p, NT_STATUS(0x1C00001A));
2272                 return True;
2273         }
2274
2275         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
2276         offset2 = prs_offset(&p->out_data.rdata);
2277         prs_set_offset(&p->out_data.rdata, offset1);
2278         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2279         prs_set_offset(&p->out_data.rdata, offset2);
2280
2281         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
2282
2283         /* Check for buffer underflow in rpc parsing */
2284
2285         if ((DEBUGLEVEL >= 10) &&
2286             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2287                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2288                 char *data = SMB_MALLOC(data_len);
2289
2290                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2291                 if (data) {
2292                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2293                         SAFE_FREE(data);
2294                 }
2295
2296         }
2297
2298         return True;
2299 }
2300
2301 /*******************************************************************
2302 *******************************************************************/
2303
2304 void get_pipe_fns( int idx, struct api_struct **fns, int *n_fns )
2305 {
2306         struct api_struct *cmds = NULL;
2307         int               n_cmds = 0;
2308
2309         switch ( idx ) {
2310                 case PI_LSARPC:
2311                         lsa_get_pipe_fns( &cmds, &n_cmds );
2312                         break;
2313                 case PI_LSARPC_DS:
2314                         lsa_ds_get_pipe_fns( &cmds, &n_cmds );
2315                         break;
2316                 case PI_SAMR:
2317                         samr_get_pipe_fns( &cmds, &n_cmds );
2318                         break;
2319                 case PI_NETLOGON:
2320                         netlog_get_pipe_fns( &cmds, &n_cmds );
2321                         break;
2322                 case PI_SRVSVC:
2323                         srvsvc_get_pipe_fns( &cmds, &n_cmds );
2324                         break;
2325                 case PI_WKSSVC:
2326                         wkssvc_get_pipe_fns( &cmds, &n_cmds );
2327                         break;
2328                 case PI_WINREG:
2329                         reg_get_pipe_fns( &cmds, &n_cmds );
2330                         break;
2331                 case PI_SPOOLSS:
2332                         spoolss_get_pipe_fns( &cmds, &n_cmds );
2333                         break;
2334                 case PI_NETDFS:
2335                         netdfs_get_pipe_fns( &cmds, &n_cmds );
2336                         break;
2337                 case PI_SVCCTL:
2338                         svcctl_get_pipe_fns( &cmds, &n_cmds );
2339                         break;
2340                 case PI_EVENTLOG:
2341                         eventlog_get_pipe_fns( &cmds, &n_cmds );
2342                         break;
2343                 case PI_NTSVCS:
2344                         ntsvcs_get_pipe_fns( &cmds, &n_cmds );
2345                         break;
2346 #ifdef DEVELOPER
2347                 case PI_ECHO:
2348                         echo_get_pipe_fns( &cmds, &n_cmds );
2349                         break;
2350 #endif
2351                 default:
2352                         DEBUG(0,("get_pipe_fns: Unknown pipe index! [%d]\n", idx));
2353         }
2354
2355         *fns = cmds;
2356         *n_fns = n_cmds;
2357
2358         return;
2359 }