source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "srv_pipe_internal.h"
  32 #include "../librpc/gen_ndr/ndr_schannel.h"
  33 #include "../libcli/auth/schannel.h"
  34 #include "../libcli/auth/spnego.h"
  35 #include "dcesrv_ntlmssp.h"
  36 #include "dcesrv_gssapi.h"
  37 #include "dcesrv_spnego.h"
  38 #include "rpc_server.h"
  39 #include "rpc_dce.h"
  40
  41 #undef DBGC_CLASS
  42 #define DBGC_CLASS DBGC_RPC_SRV
  43
  44 /**
  45  * Dump everything from the start of the end up of the provided data
  46  * into a file, but only at debug level >= 50
  47  **/
  48 static void dump_pdu_region(const char *name, int v,
  49                             DATA_BLOB *data, size_t start, size_t end)
  50 {
  51         int fd, i;
  52         char *fname = NULL;
  53         ssize_t sz;
  54
  55         if (DEBUGLEVEL < 50) return;
  56
  57         if (start > data->length || end > data->length || start > end) return;
  58
  59         for (i = 1; i < 100; i++) {
  60                 if (v != -1) {
  61                         fname = talloc_asprintf(talloc_tos(),
  62                                                 "/tmp/%s_%d.%d.prs",
  63                                                 name, v, i);
  64                 } else {
  65                         fname = talloc_asprintf(talloc_tos(),
  66                                                 "/tmp/%s_%d.prs",
  67                                                 name, i);
  68                 }
  69                 if (!fname) {
  70                         return;
  71                 }
  72                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  73                 if (fd != -1 || errno != EEXIST) break;
  74         }
  75         if (fd != -1) {
  76                 sz = write(fd, data->data + start, end - start);
  77                 i = close(fd);
  78                 if ((sz != end - start) || (i != 0) ) {
  79                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  80                                   fname, (unsigned long)sz,
  81                                   (unsigned long)end - start, i));
  82                 } else {
  83                         DEBUG(0,("created %s\n", fname));
  84                 }
  85         }
  86         TALLOC_FREE(fname);
  87 }
  88
  89 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  90 {
  91         TALLOC_FREE(auth->a_u.auth_ntlmssp_state);
  92 }
  93
  94 static void free_pipe_schannel_auth_data(struct pipe_auth_data *auth)
  95 {
  96         TALLOC_FREE(auth->a_u.schannel_auth);
  97 }
  98
  99 static void free_pipe_gssapi_auth_data(struct pipe_auth_data *auth)
 100 {
 101         TALLOC_FREE(auth->a_u.gssapi_state);
 102 }
 103
 104 static void free_pipe_spnego_auth_data(struct pipe_auth_data *auth)
 105 {
 106         TALLOC_FREE(auth->a_u.spnego_state);
 107 }
 108
 109 static void free_pipe_auth_data(struct pipe_auth_data *auth)
 110 {
 111         if (auth->auth_data_free_func) {
 112                 (*auth->auth_data_free_func)(auth);
 113                 auth->auth_data_free_func = NULL;
 114         }
 115 }
 116
 117 static DATA_BLOB generic_session_key(void)
 118 {
 119         return data_blob("SystemLibraryDTC", 16);
 120 }
 121
 122 /*******************************************************************
 123  Generate the next PDU to be returned from the data.
 124 ********************************************************************/
 125
 126 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
 127                                    struct pipe_auth_data *auth,
 128                                    uint32_t call_id,
 129                                    DATA_BLOB *rdata,
 130                                    size_t data_sent_length,
 131                                    DATA_BLOB *frag,
 132                                    size_t *pdu_size)
 133 {
 134         union dcerpc_payload u;
 135         uint8_t pfc_flags;
 136         size_t data_left;
 137         size_t data_to_send;
 138         size_t frag_len;
 139         size_t pad_len = 0;
 140         size_t auth_len = 0;
 141         NTSTATUS status;
 142
 143         ZERO_STRUCT(u.response);
 144
 145         /* Set up rpc packet pfc flags. */
 146         if (data_sent_length == 0) {
 147                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 148         } else {
 149                 pfc_flags = 0;
 150         }
 151
 152         /* Work out how much we can fit in a single PDU. */
 153         data_left = rdata->length - data_sent_length;
 154
 155         /* Ensure there really is data left to send. */
 156         if (!data_left) {
 157                 DEBUG(0, ("No data left to send !\n"));
 158                 return NT_STATUS_BUFFER_TOO_SMALL;
 159         }
 160
 161         status = dcerpc_guess_sizes(auth,
 162                                     DCERPC_RESPONSE_LENGTH,
 163                                     data_left,
 164                                     RPC_MAX_PDU_FRAG_LEN,
 165                                     SERVER_NDR_PADDING_SIZE,
 166                                     &data_to_send, &frag_len,
 167                                     &auth_len, &pad_len);
 168         if (!NT_STATUS_IS_OK(status)) {
 169                 return status;
 170         }
 171
 172         /* Set up the alloc hint. This should be the data left to send. */
 173         u.response.alloc_hint = data_left;
 174
 175         /* Work out if this PDU will be the last. */
 176         if (data_sent_length + data_to_send >= rdata->length) {
 177                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 178         }
 179
 180         /* Prepare data to be NDR encoded. */
 181         u.response.stub_and_verifier =
 182                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 183
 184         /* Store the packet in the data stream. */
 185         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 186                                           pfc_flags, auth_len, call_id,
 187                                           &u, frag);
 188         if (!NT_STATUS_IS_OK(status)) {
 189                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 190                 return status;
 191         }
 192
 193         if (auth_len) {
 194                 /* Set the proper length on the pdu, including padding.
 195                  * Only needed if an auth trailer will be appended. */
 196                 dcerpc_set_frag_length(frag, frag->length
 197                                                 + pad_len
 198                                                 + DCERPC_AUTH_TRAILER_LENGTH
 199                                                 + auth_len);
 200         }
 201
 202         if (auth_len) {
 203                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 204                 if (!NT_STATUS_IS_OK(status)) {
 205                         data_blob_free(frag);
 206                         return status;
 207                 }
 208         }
 209
 210         *pdu_size = data_to_send;
 211         return NT_STATUS_OK;
 212 }
 213
 214 /*******************************************************************
 215  Generate the next PDU to be returned from the data in p->rdata.
 216 ********************************************************************/
 217
 218 bool create_next_pdu(struct pipes_struct *p)
 219 {
 220         size_t pdu_size = 0;
 221         NTSTATUS status;
 222
 223         /*
 224          * If we're in the fault state, keep returning fault PDU's until
 225          * the pipe gets closed. JRA.
 226          */
 227         if (p->fault_state) {
 228                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 229                 return true;
 230         }
 231
 232         status = create_next_packet(p->mem_ctx, &p->auth,
 233                                     p->call_id, &p->out_data.rdata,
 234                                     p->out_data.data_sent_length,
 235                                     &p->out_data.frag, &pdu_size);
 236         if (!NT_STATUS_IS_OK(status)) {
 237                 DEBUG(0, ("Failed to create packet with error %s, "
 238                           "(auth level %u / type %u)\n",
 239                           nt_errstr(status),
 240                           (unsigned int)p->auth.auth_level,
 241                           (unsigned int)p->auth.auth_type));
 242                 return false;
 243         }
 244
 245         /* Setup the counts for this PDU. */
 246         p->out_data.data_sent_length += pdu_size;
 247         p->out_data.current_pdu_sent = 0;
 248         return true;
 249 }
 250
 251
 252 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 253
 254 /*******************************************************************
 255  Marshall a bind_nak pdu.
 256 *******************************************************************/
 257
 258 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 259 {
 260         NTSTATUS status;
 261         union dcerpc_payload u;
 262
 263         /* Free any memory in the current return data buffer. */
 264         pipe_init_outgoing_data(p);
 265
 266         /*
 267          * Initialize a bind_nak header.
 268          */
 269
 270         ZERO_STRUCT(u);
 271
 272         u.bind_nak.reject_reason  = 0;
 273
 274         /*
 275          * Marshall directly into the outgoing PDU space. We
 276          * must do this as we need to set to the bind response
 277          * header and are never sending more than one PDU here.
 278          */
 279
 280         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 281                                           DCERPC_PKT_BIND_NAK,
 282                                           DCERPC_PFC_FLAG_FIRST |
 283                                                 DCERPC_PFC_FLAG_LAST,
 284                                           0,
 285                                           pkt->call_id,
 286                                           &u,
 287                                           &p->out_data.frag);
 288         if (!NT_STATUS_IS_OK(status)) {
 289                 return False;
 290         }
 291
 292         p->out_data.data_sent_length = 0;
 293         p->out_data.current_pdu_sent = 0;
 294
 295         free_pipe_auth_data(&p->auth);
 296         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 297         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 298         p->pipe_bound = False;
 299
 300         return True;
 301 }
 302
 303 /*******************************************************************
 304  Marshall a fault pdu.
 305 *******************************************************************/
 306
 307 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 308 {
 309         NTSTATUS status;
 310         union dcerpc_payload u;
 311
 312         /* Free any memory in the current return data buffer. */
 313         pipe_init_outgoing_data(p);
 314
 315         /*
 316          * Initialize a fault header.
 317          */
 318
 319         ZERO_STRUCT(u);
 320
 321         u.fault.status          = NT_STATUS_V(fault_status);
 322         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 323
 324         /*
 325          * Marshall directly into the outgoing PDU space. We
 326          * must do this as we need to set to the bind response
 327          * header and are never sending more than one PDU here.
 328          */
 329
 330         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 331                                           DCERPC_PKT_FAULT,
 332                                           DCERPC_PFC_FLAG_FIRST |
 333                                            DCERPC_PFC_FLAG_LAST |
 334                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 335                                           0,
 336                                           p->call_id,
 337                                           &u,
 338                                           &p->out_data.frag);
 339         if (!NT_STATUS_IS_OK(status)) {
 340                 return False;
 341         }
 342
 343         p->out_data.data_sent_length = 0;
 344         p->out_data.current_pdu_sent = 0;
 345
 346         return True;
 347 }
 348
 349 /*******************************************************************
 350  Ensure a bind request has the correct abstract & transfer interface.
 351  Used to reject unknown binds from Win2k.
 352 *******************************************************************/
 353
 354 static bool check_bind_req(struct pipes_struct *p,
 355                            struct ndr_syntax_id* abstract,
 356                            struct ndr_syntax_id* transfer,
 357                            uint32 context_id)
 358 {
 359         struct pipe_rpc_fns *context_fns;
 360
 361         DEBUG(3,("check_bind_req for %s\n",
 362                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 363
 364         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 365         if (rpc_srv_pipe_exists_by_id(abstract) &&
 366            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 367                 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 368                         rpc_srv_get_pipe_cli_name(abstract),
 369                         rpc_srv_get_pipe_srv_name(abstract)));
 370         } else {
 371                 return false;
 372         }
 373
 374         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 375         if (context_fns == NULL) {
 376                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 377                 return False;
 378         }
 379
 380         context_fns->next = context_fns->prev = NULL;
 381         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 382         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 383         context_fns->context_id = context_id;
 384
 385         /* add to the list of open contexts */
 386
 387         DLIST_ADD( p->contexts, context_fns );
 388
 389         return True;
 390 }
 391
 392 /**
 393  * Is a named pipe known?
 394  * @param[in] cli_filename      The pipe name requested by the client
 395  * @result                      Do we want to serve this?
 396  */
 397 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
 398 {
 399         const char *pipename = cli_filename;
 400         NTSTATUS status;
 401
 402         if (strnequal(pipename, "\\PIPE\\", 6)) {
 403                 pipename += 5;
 404         }
 405
 406         if (*pipename == '\\') {
 407                 pipename += 1;
 408         }
 409
 410         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 411                 DEBUG(10, ("refusing spoolss access\n"));
 412                 return false;
 413         }
 414
 415         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 416                 return true;
 417         }
 418
 419         status = smb_probe_module("rpc", pipename);
 420         if (!NT_STATUS_IS_OK(status)) {
 421                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
 422                 return false;
 423         }
 424         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 425
 426         /*
 427          * Scan the list again for the interface id
 428          */
 429         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 430                 return true;
 431         }
 432
 433         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 434                    pipename));
 435
 436         return false;
 437 }
 438
 439 /*******************************************************************
 440  Handle the first part of a SPNEGO bind auth.
 441 *******************************************************************/
 442
 443 static bool pipe_spnego_auth_bind(struct pipes_struct *p,
 444                                   TALLOC_CTX *mem_ctx,
 445                                   struct dcerpc_auth *auth_info,
 446                                   DATA_BLOB *response)
 447 {
 448         struct spnego_context *spnego_ctx;
 449         NTSTATUS status;
 450
 451         status = spnego_server_auth_start(p,
 452                                           (auth_info->auth_level ==
 453                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 454                                           (auth_info->auth_level ==
 455                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 456                                           true,
 457                                           &auth_info->credentials,
 458                                           response,
 459                                           &spnego_ctx);
 460         if (!NT_STATUS_IS_OK(status)) {
 461                 DEBUG(0, ("Failed SPNEGO negotiate (%s)\n",
 462                           nt_errstr(status)));
 463                 return false;
 464         }
 465
 466         /* Make sure data is bound to the memctx, to be freed the caller */
 467         talloc_steal(mem_ctx, response->data);
 468
 469         p->auth.a_u.spnego_state = spnego_ctx;
 470         p->auth.auth_data_free_func = &free_pipe_spnego_auth_data;
 471         p->auth.auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 472
 473         DEBUG(10, ("SPNEGO auth started\n"));
 474
 475         return true;
 476 }
 477
 478 /*******************************************************************
 479  Handle an schannel bind auth.
 480 *******************************************************************/
 481
 482 static bool pipe_schannel_auth_bind(struct pipes_struct *p,
 483                                     TALLOC_CTX *mem_ctx,
 484                                     struct dcerpc_auth *auth_info,
 485                                     DATA_BLOB *response)
 486 {
 487         struct NL_AUTH_MESSAGE neg;
 488         struct NL_AUTH_MESSAGE reply;
 489         bool ret;
 490         NTSTATUS status;
 491         struct netlogon_creds_CredentialState *creds;
 492         DATA_BLOB session_key;
 493         enum ndr_err_code ndr_err;
 494
 495         ndr_err = ndr_pull_struct_blob(
 496                         &auth_info->credentials, mem_ctx, &neg,
 497                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
 498         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 499                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
 500                 return false;
 501         }
 502
 503         if (DEBUGLEVEL >= 10) {
 504                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
 505         }
 506
 507         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
 508                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
 509                 return false;
 510         }
 511
 512         /*
 513          * The neg.oem_netbios_computer.a key here must match the remote computer name
 514          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
 515          * operations that use credentials.
 516          */
 517
 518         become_root();
 519         status = schannel_get_creds_state(p, lp_private_dir(),
 520                                             neg.oem_netbios_computer.a, &creds);
 521         unbecome_root();
 522
 523         if (!NT_STATUS_IS_OK(status)) {
 524                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
 525                 return False;
 526         }
 527
 528         p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
 529         if (!p->auth.a_u.schannel_auth) {
 530                 TALLOC_FREE(creds);
 531                 return False;
 532         }
 533
 534         p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
 535         p->auth.a_u.schannel_auth->seq_num = 0;
 536         p->auth.a_u.schannel_auth->initiator = false;
 537         p->auth.a_u.schannel_auth->creds = creds;
 538
 539         /*
 540          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
 541          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
 542          * struct of the person who opened the pipe. I need to test this further. JRA.
 543          *
 544          * VL. As we are mapping this to guest set the generic key
 545          * "SystemLibraryDTC" key here. It's a bit difficult to test against
 546          * W2k3, as it does not allow schannel binds against SAMR and LSA
 547          * anymore.
 548          */
 549
 550         session_key = generic_session_key();
 551         if (session_key.data == NULL) {
 552                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
 553                           " key\n"));
 554                 return false;
 555         }
 556
 557         ret = server_info_set_session_key(p->server_info, session_key);
 558
 559         data_blob_free(&session_key);
 560
 561         if (!ret) {
 562                 DEBUG(0, ("server_info_set_session_key failed\n"));
 563                 return false;
 564         }
 565
 566         /*** SCHANNEL verifier ***/
 567
 568         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
 569         reply.Flags                             = 0;
 570         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
 571                                                       * this has any meaning
 572                                                       * here - gd */
 573
 574         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
 575                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 576         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 577                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
 578                 return false;
 579         }
 580
 581         if (DEBUGLEVEL >= 10) {
 582                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
 583         }
 584
 585         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
 586                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
 587
 588         /* We're finished with this bind - no more packets. */
 589         p->auth.auth_data_free_func = &free_pipe_schannel_auth_data;
 590         p->auth.auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
 591
 592         p->pipe_bound = True;
 593
 594         return True;
 595 }
 596
 597 /*******************************************************************
 598  Handle an NTLMSSP bind auth.
 599 *******************************************************************/
 600
 601 static bool pipe_ntlmssp_auth_bind(struct pipes_struct *p,
 602                                    TALLOC_CTX *mem_ctx,
 603                                    struct dcerpc_auth *auth_info,
 604                                    DATA_BLOB *response)
 605 {
 606         NTSTATUS status;
 607
 608         if (strncmp((char *)auth_info->credentials.data, "NTLMSSP", 7) != 0) {
 609                 DEBUG(0, ("Failed to read NTLMSSP in blob\n"));
 610                 return false;
 611         }
 612
 613         /* We have an NTLMSSP blob. */
 614         status = ntlmssp_server_auth_start(p,
 615                                            (auth_info->auth_level ==
 616                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 617                                            (auth_info->auth_level ==
 618                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 619                                            true,
 620                                            &auth_info->credentials,
 621                                            response,
 622                                            &p->auth.a_u.auth_ntlmssp_state);
 623         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 624                 DEBUG(0, (__location__ ": auth_ntlmssp_start failed: %s\n",
 625                           nt_errstr(status)));
 626                 return false;
 627         }
 628
 629         /* Make sure data is bound to the memctx, to be freed the caller */
 630         talloc_steal(mem_ctx, response->data);
 631
 632         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
 633         p->auth.auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 634
 635         DEBUG(10, (__location__ ": NTLMSSP auth started\n"));
 636
 637         return true;
 638 }
 639
 640 /*******************************************************************
 641  Process an NTLMSSP authentication response.
 642  If this function succeeds, the user has been authenticated
 643  and their domain, name and calling workstation stored in
 644  the pipe struct.
 645 *******************************************************************/
 646
 647 static bool pipe_ntlmssp_verify_final(TALLOC_CTX *mem_ctx,
 648                                 struct auth_ntlmssp_state *ntlmssp_ctx,
 649                                 enum dcerpc_AuthLevel auth_level,
 650                                 struct client_address *client_id,
 651                                 struct ndr_syntax_id *syntax,
 652                                 struct auth_serversupplied_info **server_info)
 653 {
 654         DATA_BLOB session_key;
 655         NTSTATUS status;
 656         bool ret;
 657
 658         DEBUG(5, (__location__ ": pipe %s checking user details\n",
 659                  get_pipe_name_from_syntax(talloc_tos(), syntax)));
 660
 661         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 662            ensure the underlying NTLMSSP flags are also set. If not we should
 663            refuse the bind. */
 664
 665         status = ntlmssp_server_check_flags(ntlmssp_ctx,
 666                                             (auth_level ==
 667                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 668                                             (auth_level ==
 669                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 670         if (!NT_STATUS_IS_OK(status)) {
 671                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 672                           "security for pipe %s\n",
 673                           get_pipe_name_from_syntax(talloc_tos(), syntax)));
 674                 return false;
 675         }
 676
 677         TALLOC_FREE(*server_info);
 678
 679         status = ntlmssp_server_get_user_info(ntlmssp_ctx,
 680                                                 mem_ctx, server_info);
 681         if (!NT_STATUS_IS_OK(status)) {
 682                 DEBUG(0, (__location__ ": failed to obtain the server info "
 683                           "for authenticated user: %s\n", nt_errstr(status)));
 684                 return false;
 685         }
 686
 687         if ((*server_info)->ptok == NULL) {
 688                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 689                 return false;
 690         }
 691
 692         /*
 693          * We're an authenticated bind over smb, so the session key needs to
 694          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 695          * does. See the RPC-SAMBA3SESSIONKEY.
 696          */
 697
 698         session_key = generic_session_key();
 699         if (session_key.data == NULL) {
 700                 return false;
 701         }
 702
 703         ret = server_info_set_session_key((*server_info), session_key);
 704         data_blob_free(&session_key);
 705         if (!ret) {
 706                 DEBUG(0, ("Failed to set session key!\n"));
 707                 return false;
 708         }
 709
 710         return true;
 711 }
 712
 713 /*******************************************************************
 714  Handle a GSSAPI bind auth.
 715 *******************************************************************/
 716
 717 static bool pipe_gssapi_auth_bind(struct pipes_struct *p,
 718                                   TALLOC_CTX *mem_ctx,
 719                                   struct dcerpc_auth *auth_info,
 720                                   DATA_BLOB *response)
 721 {
 722         NTSTATUS status;
 723         struct gse_context *gse_ctx = NULL;
 724
 725         status = gssapi_server_auth_start(p,
 726                                           (auth_info->auth_level ==
 727                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 728                                           (auth_info->auth_level ==
 729                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 730                                           true,
 731                                           &auth_info->credentials,
 732                                           response,
 733                                           &gse_ctx);
 734         if (!NT_STATUS_IS_OK(status)) {
 735                 DEBUG(0, ("Failed to init dcerpc gssapi server (%s)\n",
 736                           nt_errstr(status)));
 737                 goto err;
 738         }
 739
 740         /* Make sure data is bound to the memctx, to be freed the caller */
 741         talloc_steal(mem_ctx, response->data);
 742
 743         p->auth.a_u.gssapi_state = gse_ctx;
 744         p->auth.auth_data_free_func = &free_pipe_gssapi_auth_data;
 745         p->auth.auth_type = DCERPC_AUTH_TYPE_KRB5;
 746
 747         DEBUG(10, ("KRB5 auth started\n"));
 748
 749         return true;
 750
 751 err:
 752         TALLOC_FREE(gse_ctx);
 753         return false;
 754 }
 755
 756 static NTSTATUS pipe_gssapi_verify_final(TALLOC_CTX *mem_ctx,
 757                                          struct gse_context *gse_ctx,
 758                                          struct client_address *client_id,
 759                                          struct auth_serversupplied_info **server_info)
 760 {
 761         DATA_BLOB session_key;
 762         NTSTATUS status;
 763         bool bret;
 764
 765         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 766            ensure the underlying flags are also set. If not we should
 767            refuse the bind. */
 768
 769         status = gssapi_server_check_flags(gse_ctx);
 770         if (!NT_STATUS_IS_OK(status)) {
 771                 DEBUG(0, ("Requested Security Layers not honored!\n"));
 772                 return status;
 773         }
 774
 775         status = gssapi_server_get_user_info(gse_ctx, mem_ctx,
 776                                              client_id, server_info);
 777         if (!NT_STATUS_IS_OK(status)) {
 778                 DEBUG(0, (__location__ ": failed to obtain the server info "
 779                           "for authenticated user: %s\n", nt_errstr(status)));
 780                 return status;
 781         }
 782
 783         if ((*server_info)->ptok == NULL) {
 784                 status = create_local_token(*server_info);
 785                 if (!NT_STATUS_IS_OK(status)) {
 786                         DEBUG(1, ("Failed to create local user token (%s)\n",
 787                                   nt_errstr(status)));
 788                         status = NT_STATUS_ACCESS_DENIED;
 789                         return status;
 790                 }
 791         }
 792
 793         /* TODO: this is what the ntlmssp code does with the session_key, check
 794          * it is ok with gssapi too */
 795         /*
 796          * We're an authenticated bind over smb, so the session key needs to
 797          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 798          * does. See the RPC-SAMBA3SESSIONKEY.
 799          */
 800
 801         session_key = generic_session_key();
 802         if (session_key.data == NULL) {
 803                 return NT_STATUS_ACCESS_DENIED;
 804         }
 805
 806         bret = server_info_set_session_key((*server_info), session_key);
 807         data_blob_free(&session_key);
 808         if (!bret) {
 809                 return NT_STATUS_ACCESS_DENIED;
 810         }
 811
 812         return NT_STATUS_OK;
 813 }
 814
 815 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 816 {
 817         enum spnego_mech auth_type;
 818         struct auth_ntlmssp_state *ntlmssp_ctx;
 819         struct gse_context *gse_ctx;
 820         void *mech_ctx;
 821         NTSTATUS status;
 822
 823         switch (p->auth.auth_type) {
 824         case DCERPC_AUTH_TYPE_NTLMSSP:
 825                 if (!pipe_ntlmssp_verify_final(p,
 826                                         p->auth.a_u.auth_ntlmssp_state,
 827                                         p->auth.auth_level,
 828                                         p->client_id, &p->syntax,
 829                                         &p->server_info)) {
 830                         return NT_STATUS_ACCESS_DENIED;
 831                 }
 832                 break;
 833         case DCERPC_AUTH_TYPE_KRB5:
 834                 status = pipe_gssapi_verify_final(p,
 835                                         p->auth.a_u.gssapi_state,
 836                                         p->client_id,
 837                                         &p->server_info);
 838                 if (!NT_STATUS_IS_OK(status)) {
 839                         DEBUG(1, ("gssapi bind failed with: %s",
 840                                   nt_errstr(status)));
 841                         return status;
 842                 }
 843                 break;
 844         case DCERPC_AUTH_TYPE_SPNEGO:
 845                 status = spnego_get_negotiated_mech(p->auth.a_u.spnego_state,
 846                                                     &auth_type, &mech_ctx);
 847                 if (!NT_STATUS_IS_OK(status)) {
 848                         DEBUG(0, ("Bad SPNEGO state (%s)\n",
 849                                   nt_errstr(status)));
 850                         return status;
 851                 }
 852                 switch(auth_type) {
 853                 case SPNEGO_KRB5:
 854                         gse_ctx = talloc_get_type_abort(mech_ctx,
 855                                                         struct gse_context);
 856                         status = pipe_gssapi_verify_final(p, gse_ctx,
 857                                                           p->client_id,
 858                                                           &p->server_info);
 859                         if (!NT_STATUS_IS_OK(status)) {
 860                                 DEBUG(1, ("gssapi bind failed with: %s",
 861                                           nt_errstr(status)));
 862                                 return status;
 863                         }
 864                         break;
 865                 case SPNEGO_NTLMSSP:
 866                         ntlmssp_ctx = talloc_get_type_abort(mech_ctx,
 867                                                 struct auth_ntlmssp_state);
 868                         if (!pipe_ntlmssp_verify_final(p, ntlmssp_ctx,
 869                                                         p->auth.auth_level,
 870                                                         p->client_id,
 871                                                         &p->syntax,
 872                                                         &p->server_info)) {
 873                                 return NT_STATUS_ACCESS_DENIED;
 874                         }
 875                         break;
 876                 default:
 877                         DEBUG(0, (__location__ ": incorrect spnego type "
 878                                   "(%d).\n", auth_type));
 879                         return NT_STATUS_ACCESS_DENIED;
 880                 }
 881                 break;
 882         default:
 883                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
 884                           (unsigned int)p->auth.auth_type));
 885                 return NT_STATUS_ACCESS_DENIED;
 886         }
 887
 888         p->pipe_bound = true;
 889
 890         return NT_STATUS_OK;
 891 }
 892
 893 /*******************************************************************
 894  Respond to a pipe bind request.
 895 *******************************************************************/
 896
 897 static bool api_pipe_bind_req(struct pipes_struct *p,
 898                                 struct ncacn_packet *pkt)
 899 {
 900         struct dcerpc_auth auth_info;
 901         uint16 assoc_gid;
 902         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
 903         NTSTATUS status;
 904         struct ndr_syntax_id id;
 905         union dcerpc_payload u;
 906         struct dcerpc_ack_ctx bind_ack_ctx;
 907         DATA_BLOB auth_resp = data_blob_null;
 908         DATA_BLOB auth_blob = data_blob_null;
 909
 910         /* No rebinds on a bound pipe - use alter context. */
 911         if (p->pipe_bound) {
 912                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
 913                          "pipe %s.\n",
 914                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 915                 return setup_bind_nak(p, pkt);
 916         }
 917
 918         if (pkt->u.bind.num_contexts == 0) {
 919                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
 920                 goto err_exit;
 921         }
 922
 923         /*
 924          * Try and find the correct pipe name to ensure
 925          * that this is a pipe name we support.
 926          */
 927         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 928         if (rpc_srv_pipe_exists_by_id(&id)) {
 929                 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 930                         rpc_srv_get_pipe_cli_name(&id),
 931                         rpc_srv_get_pipe_srv_name(&id)));
 932         } else {
 933                 status = smb_probe_module(
 934                         "rpc", get_pipe_name_from_syntax(
 935                                 talloc_tos(),
 936                                 &pkt->u.bind.ctx_list[0].abstract_syntax));
 937
 938                 if (NT_STATUS_IS_ERR(status)) {
 939                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 940                                 get_pipe_name_from_syntax(
 941                                         talloc_tos(),
 942                                         &pkt->u.bind.ctx_list[0].abstract_syntax)));
 943
 944                         return setup_bind_nak(p, pkt);
 945                 }
 946
 947                 if (rpc_srv_get_pipe_interface_by_cli_name(
 948                                 get_pipe_name_from_syntax(talloc_tos(),
 949                                                           &p->syntax),
 950                                 &id)) {
 951                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 952                                 rpc_srv_get_pipe_cli_name(&id),
 953                                 rpc_srv_get_pipe_srv_name(&id)));
 954                 } else {
 955                         DEBUG(0, ("module %s doesn't provide functions for "
 956                                   "pipe %s!\n",
 957                                   get_pipe_name_from_syntax(talloc_tos(),
 958                                                             &p->syntax),
 959                                   get_pipe_name_from_syntax(talloc_tos(),
 960                                                             &p->syntax)));
 961                         return setup_bind_nak(p, pkt);
 962                 }
 963         }
 964
 965         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 966
 967         if (pkt->u.bind.assoc_group_id != 0) {
 968                 assoc_gid = pkt->u.bind.assoc_group_id;
 969         } else {
 970                 assoc_gid = 0x53f0;
 971         }
 972
 973         /*
 974          * Create the bind response struct.
 975          */
 976
 977         /* If the requested abstract synt uuid doesn't match our client pipe,
 978                 reject the bind_ack & set the transfer interface synt to all 0's,
 979                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 980                 unknown to NT4)
 981                 Needed when adding entries to a DACL from NT5 - SK */
 982
 983         if (check_bind_req(p,
 984                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 985                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 986                         pkt->u.bind.ctx_list[0].context_id)) {
 987
 988                 bind_ack_ctx.result = 0;
 989                 bind_ack_ctx.reason = 0;
 990                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 991         } else {
 992                 p->pipe_bound = False;
 993                 /* Rejection reason: abstract syntax not supported */
 994                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 995                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
 996                 bind_ack_ctx.syntax = null_ndr_syntax_id;
 997         }
 998
 999         /*
1000          * Check if this is an authenticated bind request.
1001          */
1002         if (pkt->auth_length) {
1003                 /* Quick length check. Won't catch a bad auth footer,
1004                  * prevents overrun. */
1005
1006                 if (pkt->frag_length < RPC_HEADER_LEN +
1007                                         DCERPC_AUTH_TRAILER_LENGTH +
1008                                         pkt->auth_length) {
1009                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
1010                                 "too long for fragment %u.\n",
1011                                 (unsigned int)pkt->auth_length,
1012                                 (unsigned int)pkt->frag_length));
1013                         goto err_exit;
1014                 }
1015
1016                 /*
1017                  * Decode the authentication verifier.
1018                  */
1019                 status = dcerpc_pull_dcerpc_auth(pkt,
1020                                                  &pkt->u.bind.auth_info,
1021                                                  &auth_info, p->endian);
1022                 if (!NT_STATUS_IS_OK(status)) {
1023                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1024                         goto err_exit;
1025                 }
1026
1027                 auth_type = auth_info.auth_type;
1028
1029                 /* Work out if we have to sign or seal etc. */
1030                 switch (auth_info.auth_level) {
1031                 case DCERPC_AUTH_LEVEL_INTEGRITY:
1032                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1033                         break;
1034                 case DCERPC_AUTH_LEVEL_PRIVACY:
1035                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1036                         break;
1037                 default:
1038                         DEBUG(0, ("Unexpected auth level (%u).\n",
1039                                 (unsigned int)auth_info.auth_level ));
1040                         goto err_exit;
1041                 }
1042
1043                 switch (auth_type) {
1044                 case DCERPC_AUTH_TYPE_NTLMSSP:
1045                         if (!pipe_ntlmssp_auth_bind(p, pkt,
1046                                                 &auth_info, &auth_resp)) {
1047                                 goto err_exit;
1048                         }
1049                         assoc_gid = 0x7a77;
1050                         break;
1051
1052                 case DCERPC_AUTH_TYPE_SCHANNEL:
1053                         if (!pipe_schannel_auth_bind(p, pkt,
1054                                                 &auth_info, &auth_resp)) {
1055                                 goto err_exit;
1056                         }
1057                         break;
1058
1059                 case DCERPC_AUTH_TYPE_SPNEGO:
1060                         if (!pipe_spnego_auth_bind(p, pkt,
1061                                                 &auth_info, &auth_resp)) {
1062                                 goto err_exit;
1063                         }
1064                         break;
1065
1066                 case DCERPC_AUTH_TYPE_KRB5:
1067                         if (!pipe_gssapi_auth_bind(p, pkt,
1068                                                 &auth_info, &auth_resp)) {
1069                                 goto err_exit;
1070                         }
1071                         break;
1072
1073                 case DCERPC_AUTH_TYPE_NONE:
1074                         break;
1075
1076                 default:
1077                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
1078                         goto err_exit;
1079                 }
1080         }
1081
1082         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
1083                 /* Unauthenticated bind request. */
1084                 /* We're finished - no more packets. */
1085                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
1086                 /* We must set the pipe auth_level here also. */
1087                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1088                 p->pipe_bound = True;
1089                 /* The session key was initialized from the SMB
1090                  * session in make_internal_rpc_pipe_p */
1091         }
1092
1093         ZERO_STRUCT(u.bind_ack);
1094         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1095         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1096         u.bind_ack.assoc_group_id = assoc_gid;
1097
1098         /* name has to be \PIPE\xxxxx */
1099         u.bind_ack.secondary_address =
1100                         talloc_asprintf(pkt, "\\PIPE\\%s",
1101                                         rpc_srv_get_pipe_srv_name(&id));
1102         if (!u.bind_ack.secondary_address) {
1103                 DEBUG(0, ("Out of memory!\n"));
1104                 goto err_exit;
1105         }
1106         u.bind_ack.secondary_address_size =
1107                                 strlen(u.bind_ack.secondary_address) + 1;
1108
1109         u.bind_ack.num_results = 1;
1110         u.bind_ack.ctx_list = &bind_ack_ctx;
1111
1112         /* NOTE: We leave the auth_info empty so we can calculate the padding
1113          * later and then append the auth_info --simo */
1114
1115         /*
1116          * Marshall directly into the outgoing PDU space. We
1117          * must do this as we need to set to the bind response
1118          * header and are never sending more than one PDU here.
1119          */
1120
1121         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1122                                           DCERPC_PKT_BIND_ACK,
1123                                           DCERPC_PFC_FLAG_FIRST |
1124                                                 DCERPC_PFC_FLAG_LAST,
1125                                           auth_resp.length,
1126                                           pkt->call_id,
1127                                           &u,
1128                                           &p->out_data.frag);
1129         if (!NT_STATUS_IS_OK(status)) {
1130                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1131                           nt_errstr(status)));
1132         }
1133
1134         if (auth_resp.length) {
1135
1136                 status = dcerpc_push_dcerpc_auth(pkt,
1137                                                  auth_type,
1138                                                  auth_info.auth_level,
1139                                                  0,
1140                                                  1, /* auth_context_id */
1141                                                  &auth_resp,
1142                                                  &auth_blob);
1143                 if (!NT_STATUS_IS_OK(status)) {
1144                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1145                         goto err_exit;
1146                 }
1147         }
1148
1149         /* Now that we have the auth len store it into the right place in
1150          * the dcerpc header */
1151         dcerpc_set_frag_length(&p->out_data.frag,
1152                                 p->out_data.frag.length + auth_blob.length);
1153
1154         if (auth_blob.length) {
1155
1156                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1157                                         auth_blob.data, auth_blob.length)) {
1158                         DEBUG(0, ("Append of auth info failed.\n"));
1159                         goto err_exit;
1160                 }
1161         }
1162
1163         /*
1164          * Setup the lengths for the initial reply.
1165          */
1166
1167         p->out_data.data_sent_length = 0;
1168         p->out_data.current_pdu_sent = 0;
1169
1170         TALLOC_FREE(auth_blob.data);
1171         return True;
1172
1173   err_exit:
1174
1175         data_blob_free(&p->out_data.frag);
1176         TALLOC_FREE(auth_blob.data);
1177         return setup_bind_nak(p, pkt);
1178 }
1179
1180 /*******************************************************************
1181  This is the "stage3" response after a bind request and reply.
1182 *******************************************************************/
1183
1184 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
1185 {
1186         struct dcerpc_auth auth_info;
1187         DATA_BLOB response = data_blob_null;
1188         NTSTATUS status;
1189
1190         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
1191
1192         if (pkt->auth_length == 0) {
1193                 DEBUG(0, ("No auth field sent for bind request!\n"));
1194                 goto err;
1195         }
1196
1197         /* Ensure there's enough data for an authenticated request. */
1198         if (pkt->frag_length < RPC_HEADER_LEN
1199                                 + DCERPC_AUTH_TRAILER_LENGTH
1200                                 + pkt->auth_length) {
1201                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
1202                                 "%u is too large.\n",
1203                         (unsigned int)pkt->auth_length));
1204                 goto err;
1205         }
1206
1207         /*
1208          * Decode the authentication verifier response.
1209          */
1210
1211         status = dcerpc_pull_dcerpc_auth(pkt,
1212                                          &pkt->u.auth3.auth_info,
1213                                          &auth_info, p->endian);
1214         if (!NT_STATUS_IS_OK(status)) {
1215                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
1216                 goto err;
1217         }
1218
1219         /* We must NEVER look at auth_info->auth_pad_len here,
1220          * as old Samba client code gets it wrong and sends it
1221          * as zero. JRA.
1222          */
1223
1224         switch (auth_info.auth_type) {
1225         case DCERPC_AUTH_TYPE_NTLMSSP:
1226                 status = ntlmssp_server_step(p->auth.a_u.auth_ntlmssp_state,
1227                                              pkt, &auth_info.credentials,
1228                                              &response);
1229                 break;
1230         case DCERPC_AUTH_TYPE_KRB5:
1231                 status = gssapi_server_step(p->auth.a_u.gssapi_state,
1232                                             pkt, &auth_info.credentials,
1233                                             &response);
1234                 break;
1235         case DCERPC_AUTH_TYPE_SPNEGO:
1236                 status = spnego_server_step(p->auth.a_u.spnego_state,
1237                                             pkt, &auth_info.credentials,
1238                                             &response);
1239                 break;
1240         default:
1241                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
1242                           (unsigned int)auth_info.auth_type));
1243                 return false;
1244         }
1245
1246         if (NT_STATUS_EQUAL(status,
1247                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1248             response.length) {
1249                 DEBUG(0, (__location__ ": This was supposed to be the final "
1250                           "leg, but crypto machinery claims a response is "
1251                           "needed, aborting auth!\n"));
1252                 data_blob_free(&response);
1253                 goto err;
1254         }
1255         if (!NT_STATUS_IS_OK(status)) {
1256                 DEBUG(0, ("Auth failed (%s)\n", nt_errstr(status)));
1257                 goto err;
1258         }
1259
1260         /* Now verify auth was indeed successful and extract server info */
1261         status = pipe_auth_verify_final(p);
1262         if (!NT_STATUS_IS_OK(status)) {
1263                 DEBUG(0, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1264                 goto err;
1265         }
1266
1267         return true;
1268
1269 err:
1270
1271         free_pipe_auth_data(&p->auth);
1272         return false;
1273 }
1274
1275 /****************************************************************************
1276  Deal with an alter context call. Can be third part of 3 leg auth request for
1277  SPNEGO calls.
1278 ****************************************************************************/
1279
1280 static bool api_pipe_alter_context(struct pipes_struct *p,
1281                                         struct ncacn_packet *pkt)
1282 {
1283         struct dcerpc_auth auth_info;
1284         uint16 assoc_gid;
1285         NTSTATUS status;
1286         union dcerpc_payload u;
1287         struct dcerpc_ack_ctx bind_ack_ctx;
1288         DATA_BLOB auth_resp = data_blob_null;
1289         DATA_BLOB auth_blob = data_blob_null;
1290         int pad_len = 0;
1291
1292         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1293
1294         if (pkt->u.bind.assoc_group_id != 0) {
1295                 assoc_gid = pkt->u.bind.assoc_group_id;
1296         } else {
1297                 assoc_gid = 0x53f0;
1298         }
1299
1300         /*
1301          * Create the bind response struct.
1302          */
1303
1304         /* If the requested abstract synt uuid doesn't match our client pipe,
1305                 reject the bind_ack & set the transfer interface synt to all 0's,
1306                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1307                 unknown to NT4)
1308                 Needed when adding entries to a DACL from NT5 - SK */
1309
1310         if (check_bind_req(p,
1311                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1312                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1313                         pkt->u.bind.ctx_list[0].context_id)) {
1314
1315                 bind_ack_ctx.result = 0;
1316                 bind_ack_ctx.reason = 0;
1317                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1318         } else {
1319                 p->pipe_bound = False;
1320                 /* Rejection reason: abstract syntax not supported */
1321                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1322                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1323                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1324         }
1325
1326         /*
1327          * Check if this is an authenticated alter context request.
1328          */
1329         if (pkt->auth_length) {
1330                 /* Quick length check. Won't catch a bad auth footer,
1331                  * prevents overrun. */
1332
1333                 if (pkt->frag_length < RPC_HEADER_LEN +
1334                                         DCERPC_AUTH_TRAILER_LENGTH +
1335                                         pkt->auth_length) {
1336                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1337                                 "too long for fragment %u.\n",
1338                                 (unsigned int)pkt->auth_length,
1339                                 (unsigned int)pkt->frag_length ));
1340                         goto err_exit;
1341                 }
1342
1343                 status = dcerpc_pull_dcerpc_auth(pkt,
1344                                                  &pkt->u.bind.auth_info,
1345                                                  &auth_info, p->endian);
1346                 if (!NT_STATUS_IS_OK(status)) {
1347                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1348                         goto err_exit;
1349                 }
1350
1351                 /* We can only finish if the pipe is unbound for now */
1352                 if (p->pipe_bound) {
1353                         DEBUG(0, (__location__ ": Pipe already bound, "
1354                                   "Altering Context not yet supported!\n"));
1355                         goto err_exit;
1356                 }
1357
1358                 switch (auth_info.auth_type) {
1359                 case DCERPC_AUTH_TYPE_SPNEGO:
1360                         status = spnego_server_step(p->auth.a_u.spnego_state,
1361                                                     pkt,
1362                                                     &auth_info.credentials,
1363                                                     &auth_resp);
1364                         break;
1365
1366                 case DCERPC_AUTH_TYPE_KRB5:
1367                         status = gssapi_server_step(p->auth.a_u.gssapi_state,
1368                                                     pkt,
1369                                                     &auth_info.credentials,
1370                                                     &auth_resp);
1371                         break;
1372                 case DCERPC_AUTH_TYPE_NTLMSSP:
1373                         status = ntlmssp_server_step(p->auth.a_u.auth_ntlmssp_state,
1374                                                      pkt,
1375                                                      &auth_info.credentials,
1376                                                      &auth_resp);
1377                         break;
1378
1379                 default:
1380                         DEBUG(3, (__location__ ": Usupported auth type (%d) "
1381                                   "in alter-context call\n",
1382                                   auth_info.auth_type));
1383                         goto err_exit;
1384                 }
1385
1386                 if (NT_STATUS_IS_OK(status)) {
1387                         /* third leg of auth, verify auth info */
1388                         status = pipe_auth_verify_final(p);
1389                         if (!NT_STATUS_IS_OK(status)) {
1390                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1391                                           nt_errstr(status)));
1392                                 goto err_exit;
1393                         }
1394                 } else if (NT_STATUS_EQUAL(status,
1395                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1396                         DEBUG(10, ("More auth legs required.\n"));
1397                 } else {
1398                         DEBUG(0, ("Auth step returned an error (%s)\n",
1399                                   nt_errstr(status)));
1400                         goto err_exit;
1401                 }
1402         }
1403
1404         ZERO_STRUCT(u.alter_resp);
1405         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1406         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1407         u.alter_resp.assoc_group_id = assoc_gid;
1408
1409         /* secondary address CAN be NULL
1410          * as the specs say it's ignored.
1411          * It MUST be NULL to have the spoolss working.
1412          */
1413         u.alter_resp.secondary_address = "";
1414         u.alter_resp.secondary_address_size = 1;
1415
1416         u.alter_resp.num_results = 1;
1417         u.alter_resp.ctx_list = &bind_ack_ctx;
1418
1419         /* NOTE: We leave the auth_info empty so we can calculate the padding
1420          * later and then append the auth_info --simo */
1421
1422         /*
1423          * Marshall directly into the outgoing PDU space. We
1424          * must do this as we need to set to the bind response
1425          * header and are never sending more than one PDU here.
1426          */
1427
1428         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1429                                           DCERPC_PKT_ALTER_RESP,
1430                                           DCERPC_PFC_FLAG_FIRST |
1431                                                 DCERPC_PFC_FLAG_LAST,
1432                                           auth_resp.length,
1433                                           pkt->call_id,
1434                                           &u,
1435                                           &p->out_data.frag);
1436         if (!NT_STATUS_IS_OK(status)) {
1437                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1438                           nt_errstr(status)));
1439         }
1440
1441         if (auth_resp.length) {
1442
1443                 /* Work out any padding needed before the auth footer. */
1444                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1445                 if (pad_len) {
1446                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1447                         DEBUG(10, ("auth pad_len = %u\n",
1448                                    (unsigned int)pad_len));
1449                 }
1450
1451                 status = dcerpc_push_dcerpc_auth(pkt,
1452                                                  auth_info.auth_type,
1453                                                  auth_info.auth_level,
1454                                                  pad_len,
1455                                                  1, /* auth_context_id */
1456                                                  &auth_resp,
1457                                                  &auth_blob);
1458                 if (!NT_STATUS_IS_OK(status)) {
1459                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1460                         goto err_exit;
1461                 }
1462         }
1463
1464         /* Now that we have the auth len store it into the right place in
1465          * the dcerpc header */
1466         dcerpc_set_frag_length(&p->out_data.frag,
1467                                 p->out_data.frag.length +
1468                                         pad_len + auth_blob.length);
1469
1470         if (auth_resp.length) {
1471                 if (pad_len) {
1472                         char pad[SERVER_NDR_PADDING_SIZE];
1473                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1474                         if (!data_blob_append(p->mem_ctx,
1475                                                 &p->out_data.frag,
1476                                                 pad, pad_len)) {
1477                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1478                                           "%u bytes of pad data.\n",
1479                                           (unsigned int)pad_len));
1480                                 goto err_exit;
1481                         }
1482                 }
1483
1484                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1485                                         auth_blob.data, auth_blob.length)) {
1486                         DEBUG(0, ("Append of auth info failed.\n"));
1487                         goto err_exit;
1488                 }
1489         }
1490
1491         /*
1492          * Setup the lengths for the initial reply.
1493          */
1494
1495         p->out_data.data_sent_length = 0;
1496         p->out_data.current_pdu_sent = 0;
1497
1498         TALLOC_FREE(auth_blob.data);
1499         return True;
1500
1501   err_exit:
1502
1503         data_blob_free(&p->out_data.frag);
1504         TALLOC_FREE(auth_blob.data);
1505         return setup_bind_nak(p, pkt);
1506 }
1507
1508 /****************************************************************************
1509  Find the set of RPC functions associated with this context_id
1510 ****************************************************************************/
1511
1512 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
1513 {
1514         PIPE_RPC_FNS *fns = NULL;
1515
1516         if ( !list ) {
1517                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
1518                 return NULL;
1519         }
1520
1521         for (fns=list; fns; fns=fns->next ) {
1522                 if ( fns->context_id == context_id )
1523                         return fns;
1524         }
1525         return NULL;
1526 }
1527
1528 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1529                        const struct api_struct *api_rpc_cmds, int n_cmds);
1530
1531 /****************************************************************************
1532  Find the correct RPC function to call for this request.
1533  If the pipe is authenticated then become the correct UNIX user
1534  before doing the call.
1535 ****************************************************************************/
1536
1537 static bool api_pipe_request(struct pipes_struct *p,
1538                                 struct ncacn_packet *pkt)
1539 {
1540         bool ret = False;
1541         bool changed_user = False;
1542         PIPE_RPC_FNS *pipe_fns;
1543
1544         if (p->pipe_bound &&
1545             ((p->auth.auth_type == DCERPC_AUTH_TYPE_NTLMSSP) ||
1546              (p->auth.auth_type == DCERPC_AUTH_TYPE_KRB5) ||
1547              (p->auth.auth_type == DCERPC_AUTH_TYPE_SPNEGO))) {
1548                 if(!become_authenticated_pipe_user(p)) {
1549                         data_blob_free(&p->out_data.rdata);
1550                         return False;
1551                 }
1552                 changed_user = True;
1553         }
1554
1555         DEBUG(5, ("Requested \\PIPE\\%s\n",
1556                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1557
1558         /* get the set of RPC functions for this context */
1559
1560         pipe_fns = find_pipe_fns_by_context(p->contexts,
1561                                             pkt->u.request.context_id);
1562
1563         if ( pipe_fns ) {
1564                 TALLOC_CTX *frame = talloc_stackframe();
1565                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds);
1566                 TALLOC_FREE(frame);
1567         }
1568         else {
1569                 DEBUG(0, ("No rpc function table associated with context "
1570                           "[%d] on pipe [%s]\n",
1571                           pkt->u.request.context_id,
1572                           get_pipe_name_from_syntax(talloc_tos(),
1573                                                     &p->syntax)));
1574         }
1575
1576         if (changed_user) {
1577                 unbecome_authenticated_pipe_user();
1578         }
1579
1580         return ret;
1581 }
1582
1583 /*******************************************************************
1584  Calls the underlying RPC function for a named pipe.
1585  ********************************************************************/
1586
1587 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1588                        const struct api_struct *api_rpc_cmds, int n_cmds)
1589 {
1590         int fn_num;
1591         uint32_t offset1;
1592
1593         /* interpret the command */
1594         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1595                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1596                  pkt->u.request.opnum));
1597
1598         if (DEBUGLEVEL >= 50) {
1599                 fstring name;
1600                 slprintf(name, sizeof(name)-1, "in_%s",
1601                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1602                 dump_pdu_region(name, pkt->u.request.opnum,
1603                                 &p->in_data.data, 0,
1604                                 p->in_data.data.length);
1605         }
1606
1607         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1608                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1609                     api_rpc_cmds[fn_num].fn != NULL) {
1610                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1611                                   api_rpc_cmds[fn_num].name));
1612                         break;
1613                 }
1614         }
1615
1616         if (fn_num == n_cmds) {
1617                 /*
1618                  * For an unknown RPC just return a fault PDU but
1619                  * return True to allow RPC's on the pipe to continue
1620                  * and not put the pipe into fault state. JRA.
1621                  */
1622                 DEBUG(4, ("unknown\n"));
1623                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1624                 return True;
1625         }
1626
1627         offset1 = p->out_data.rdata.length;
1628
1629         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1630                 fn_num, api_rpc_cmds[fn_num].fn));
1631         /* do the actual command */
1632         if(!api_rpc_cmds[fn_num].fn(p)) {
1633                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1634                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1635                          api_rpc_cmds[fn_num].name));
1636                 data_blob_free(&p->out_data.rdata);
1637                 return False;
1638         }
1639
1640         if (p->bad_handle_fault_state) {
1641                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1642                 p->bad_handle_fault_state = False;
1643                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
1644                 return True;
1645         }
1646
1647         if (p->rng_fault_state) {
1648                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
1649                 p->rng_fault_state = False;
1650                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1651                 return True;
1652         }
1653
1654         if (DEBUGLEVEL >= 50) {
1655                 fstring name;
1656                 slprintf(name, sizeof(name)-1, "out_%s",
1657                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1658                 dump_pdu_region(name, pkt->u.request.opnum,
1659                                 &p->out_data.rdata, offset1,
1660                                 p->out_data.rdata.length);
1661         }
1662
1663         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1664                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1665
1666         /* Check for buffer underflow in rpc parsing */
1667         if ((DEBUGLEVEL >= 10) &&
1668             (pkt->frag_length < p->in_data.data.length)) {
1669                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1670                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1671                               p->in_data.data.length - pkt->frag_length);
1672         }
1673
1674         return True;
1675 }
1676
1677 /****************************************************************************
1678  Initialise an outgoing packet.
1679 ****************************************************************************/
1680
1681 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1682 {
1683         output_data *o_data = &p->out_data;
1684
1685         /* Reset the offset counters. */
1686         o_data->data_sent_length = 0;
1687         o_data->current_pdu_sent = 0;
1688
1689         data_blob_free(&o_data->frag);
1690
1691         /* Free any memory in the current return data buffer. */
1692         data_blob_free(&o_data->rdata);
1693
1694         return True;
1695 }
1696
1697 /****************************************************************************
1698  Sets the fault state on incoming packets.
1699 ****************************************************************************/
1700
1701 void set_incoming_fault(struct pipes_struct *p)
1702 {
1703         data_blob_free(&p->in_data.data);
1704         p->in_data.pdu_needed_len = 0;
1705         p->in_data.pdu.length = 0;
1706         p->fault_state = True;
1707         DEBUG(10, ("set_incoming_fault: Setting fault state on pipe %s\n",
1708                    get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1709 }
1710
1711 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1712                                     struct ncacn_packet *pkt,
1713                                     DATA_BLOB *raw_pkt)
1714 {
1715         NTSTATUS status;
1716         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1717         size_t pad_len;
1718
1719         DEBUG(10, ("Checking request auth.\n"));
1720
1721         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1722                 hdr_size += 16;
1723         }
1724
1725         /* in case of sealing this function will unseal the data in place */
1726         status = dcerpc_check_auth(auth, pkt,
1727                                    &pkt->u.request.stub_and_verifier,
1728                                    hdr_size, raw_pkt,
1729                                    &pad_len);
1730         if (!NT_STATUS_IS_OK(status)) {
1731                 return status;
1732         }
1733
1734
1735         /* remove padding and auth trailer,
1736          * this way the caller will get just the data */
1737         if (pkt->auth_length) {
1738                 size_t trail_len = pad_len
1739                                         + DCERPC_AUTH_TRAILER_LENGTH
1740                                         + pkt->auth_length;
1741                 if (pkt->u.request.stub_and_verifier.length < trail_len) {
1742                         return NT_STATUS_INFO_LENGTH_MISMATCH;
1743                 }
1744                 pkt->u.request.stub_and_verifier.length -= trail_len;
1745         }
1746
1747         return NT_STATUS_OK;
1748 }
1749
1750 /****************************************************************************
1751  Processes a request pdu. This will do auth processing if needed, and
1752  appends the data into the complete stream if the LAST flag is not set.
1753 ****************************************************************************/
1754
1755 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1756 {
1757         NTSTATUS status;
1758         DATA_BLOB data;
1759
1760         if (!p->pipe_bound) {
1761                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1762                 set_incoming_fault(p);
1763                 return False;
1764         }
1765
1766         /* Store the opnum */
1767         p->opnum = pkt->u.request.opnum;
1768
1769         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1770         if (!NT_STATUS_IS_OK(status)) {
1771                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1772                           nt_errstr(status)));
1773                 set_incoming_fault(p);
1774                 return false;
1775         }
1776
1777         data = pkt->u.request.stub_and_verifier;
1778
1779         /*
1780          * Check the data length doesn't go over the 15Mb limit.
1781          * increased after observing a bug in the Windows NT 4.0 SP6a
1782          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1783          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1784          */
1785
1786         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1787                 DEBUG(0, ("process_request_pdu: "
1788                           "rpc data buffer too large (%u) + (%u)\n",
1789                           (unsigned int)p->in_data.data.length,
1790                           (unsigned int)data.length));
1791                 set_incoming_fault(p);
1792                 return False;
1793         }
1794
1795         /*
1796          * Append the data portion into the buffer and return.
1797          */
1798
1799         if (data.length) {
1800                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1801                                           data.data, data.length)) {
1802                         DEBUG(0, ("Unable to append data size %u "
1803                                   "to parse buffer of size %u.\n",
1804                                   (unsigned int)data.length,
1805                                   (unsigned int)p->in_data.data.length));
1806                         set_incoming_fault(p);
1807                         return False;
1808                 }
1809         }
1810
1811         if (pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1812                 bool ret = False;
1813                 /*
1814                  * Ok - we finally have a complete RPC stream.
1815                  * Call the rpc command to process it.
1816                  */
1817
1818                 /*
1819                  * Process the complete data stream here.
1820                  */
1821                 if (pipe_init_outgoing_data(p)) {
1822                         ret = api_pipe_request(p, pkt);
1823                 }
1824
1825                 return ret;
1826         }
1827
1828         return True;
1829 }
1830
1831 /****************************************************************************
1832  Processes a finished PDU stored in p->in_data.pdu.
1833 ****************************************************************************/
1834
1835 void process_complete_pdu(struct pipes_struct *p)
1836 {
1837         struct ncacn_packet *pkt = NULL;
1838         NTSTATUS status;
1839         bool reply = False;
1840
1841         if(p->fault_state) {
1842                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
1843                           get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1844                 goto done;
1845         }
1846
1847         pkt = talloc(p->mem_ctx, struct ncacn_packet);
1848         if (!pkt) {
1849                 DEBUG(0, ("Out of memory!\n"));
1850                 goto done;
1851         }
1852
1853         /*
1854          * Ensure we're using the corrent endianness for both the
1855          * RPC header flags and the raw data we will be reading from.
1856          */
1857         if (dcerpc_get_endian_flag(&p->in_data.pdu) & DCERPC_DREP_LE) {
1858                 p->endian = RPC_LITTLE_ENDIAN;
1859         } else {
1860                 p->endian = RPC_BIG_ENDIAN;
1861         }
1862         DEBUG(10, ("PDU is in %s Endian format!\n", p->endian?"Big":"Little"));
1863
1864         status = dcerpc_pull_ncacn_packet(pkt, &p->in_data.pdu,
1865                                           pkt, p->endian);
1866         if (!NT_STATUS_IS_OK(status)) {
1867                 DEBUG(0, ("Failed to unmarshal rpc packet: %s!\n",
1868                           nt_errstr(status)));
1869                 goto done;
1870         }
1871
1872         /* Store the call_id */
1873         p->call_id = pkt->call_id;
1874
1875         DEBUG(10, ("Processing packet type %d\n", (int)pkt->ptype));
1876
1877         switch (pkt->ptype) {
1878         case DCERPC_PKT_REQUEST:
1879                 reply = process_request_pdu(p, pkt);
1880                 break;
1881
1882         case DCERPC_PKT_PING: /* CL request - ignore... */
1883                 DEBUG(0, ("process_complete_pdu: Error. "
1884                           "Connectionless packet type %d received on "
1885                           "pipe %s.\n", (int)pkt->ptype,
1886                          get_pipe_name_from_syntax(talloc_tos(),
1887                                                    &p->syntax)));
1888                 break;
1889
1890         case DCERPC_PKT_RESPONSE: /* No responses here. */
1891                 DEBUG(0, ("process_complete_pdu: Error. "
1892                           "DCERPC_PKT_RESPONSE received from client "
1893                           "on pipe %s.\n",
1894                          get_pipe_name_from_syntax(talloc_tos(),
1895                                                    &p->syntax)));
1896                 break;
1897
1898         case DCERPC_PKT_FAULT:
1899         case DCERPC_PKT_WORKING:
1900                 /* CL request - reply to a ping when a call in process. */
1901         case DCERPC_PKT_NOCALL:
1902                 /* CL - server reply to a ping call. */
1903         case DCERPC_PKT_REJECT:
1904         case DCERPC_PKT_ACK:
1905         case DCERPC_PKT_CL_CANCEL:
1906         case DCERPC_PKT_FACK:
1907         case DCERPC_PKT_CANCEL_ACK:
1908                 DEBUG(0, ("process_complete_pdu: Error. "
1909                           "Connectionless packet type %u received on "
1910                           "pipe %s.\n", (unsigned int)pkt->ptype,
1911                          get_pipe_name_from_syntax(talloc_tos(),
1912                                                    &p->syntax)));
1913                 break;
1914
1915         case DCERPC_PKT_BIND:
1916                 /*
1917                  * We assume that a pipe bind is only in one pdu.
1918                  */
1919                 if (pipe_init_outgoing_data(p)) {
1920                         reply = api_pipe_bind_req(p, pkt);
1921                 }
1922                 break;
1923
1924         case DCERPC_PKT_BIND_ACK:
1925         case DCERPC_PKT_BIND_NAK:
1926                 DEBUG(0, ("process_complete_pdu: Error. "
1927                           "DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1928                           "packet type %u received on pipe %s.\n",
1929                           (unsigned int)pkt->ptype,
1930                          get_pipe_name_from_syntax(talloc_tos(),
1931                                                    &p->syntax)));
1932                 break;
1933
1934
1935         case DCERPC_PKT_ALTER:
1936                 /*
1937                  * We assume that a pipe bind is only in one pdu.
1938                  */
1939                 if (pipe_init_outgoing_data(p)) {
1940                         reply = api_pipe_alter_context(p, pkt);
1941                 }
1942                 break;
1943
1944         case DCERPC_PKT_ALTER_RESP:
1945                 DEBUG(0, ("process_complete_pdu: Error. "
1946                           "DCERPC_PKT_ALTER_RESP on pipe %s: "
1947                           "Should only be server -> client.\n",
1948                          get_pipe_name_from_syntax(talloc_tos(),
1949                                                    &p->syntax)));
1950                 break;
1951
1952         case DCERPC_PKT_AUTH3:
1953                 /*
1954                  * The third packet in an auth exchange.
1955                  */
1956                 if (pipe_init_outgoing_data(p)) {
1957                         reply = api_pipe_bind_auth3(p, pkt);
1958                 }
1959                 break;
1960
1961         case DCERPC_PKT_SHUTDOWN:
1962                 DEBUG(0, ("process_complete_pdu: Error. "
1963                           "DCERPC_PKT_SHUTDOWN on pipe %s: "
1964                           "Should only be server -> client.\n",
1965                          get_pipe_name_from_syntax(talloc_tos(),
1966                                                    &p->syntax)));
1967                 break;
1968
1969         case DCERPC_PKT_CO_CANCEL:
1970                 /* For now just free all client data and continue
1971                  * processing. */
1972                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1973                          " Abandoning rpc call.\n"));
1974                 /* As we never do asynchronous RPC serving, we can
1975                  * never cancel a call (as far as I know).
1976                  * If we ever did we'd have to send a cancel_ack reply.
1977                  * For now, just free all client data and continue
1978                  * processing. */
1979                 reply = True;
1980                 break;
1981
1982 #if 0
1983                 /* Enable this if we're doing async rpc. */
1984                 /* We must check the outstanding callid matches. */
1985                 if (pipe_init_outgoing_data(p)) {
1986                         /* Send a cancel_ack PDU reply. */
1987                         /* We should probably check the auth-verifier here. */
1988                         reply = setup_cancel_ack_reply(p, pkt);
1989                 }
1990                 break;
1991 #endif
1992
1993         case DCERPC_PKT_ORPHANED:
1994                 /* We should probably check the auth-verifier here.
1995                  * For now just free all client data and continue
1996                  * processing. */
1997                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
1998                           " Abandoning rpc call.\n"));
1999                 reply = True;
2000                 break;
2001
2002         default:
2003                 DEBUG(0, ("process_complete_pdu: "
2004                           "Unknown rpc type = %u received.\n",
2005                           (unsigned int)pkt->ptype));
2006                 break;
2007         }
2008
2009 done:
2010         if (!reply) {
2011                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on "
2012                          "pipe %s\n", get_pipe_name_from_syntax(talloc_tos(),
2013                                                                 &p->syntax)));
2014                 set_incoming_fault(p);
2015                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2016                 TALLOC_FREE(pkt);
2017         } else {
2018                 /*
2019                  * Reset the lengths. We're ready for a new pdu.
2020                  */
2021                 TALLOC_FREE(p->in_data.pdu.data);
2022                 p->in_data.pdu_needed_len = 0;
2023                 p->in_data.pdu.length = 0;
2024         }
2025
2026         TALLOC_FREE(pkt);
2027 }
2028