source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "srv_pipe_internal.h"
  32 #include "../librpc/gen_ndr/ndr_schannel.h"
  33 #include "../libcli/auth/schannel.h"
  34 #include "../libcli/auth/spnego.h"
  35 #include "dcesrv_ntlmssp.h"
  36 #include "dcesrv_gssapi.h"
  37 #include "dcesrv_spnego.h"
  38 #include "rpc_server.h"
  39 #include "rpc_dce.h"
  40
  41 #undef DBGC_CLASS
  42 #define DBGC_CLASS DBGC_RPC_SRV
  43
  44 /**
  45  * Dump everything from the start of the end up of the provided data
  46  * into a file, but only at debug level >= 50
  47  **/
  48 static void dump_pdu_region(const char *name, int v,
  49                             DATA_BLOB *data, size_t start, size_t end)
  50 {
  51         int fd, i;
  52         char *fname = NULL;
  53         ssize_t sz;
  54
  55         if (DEBUGLEVEL < 50) return;
  56
  57         if (start > data->length || end > data->length || start > end) return;
  58
  59         for (i = 1; i < 100; i++) {
  60                 if (v != -1) {
  61                         fname = talloc_asprintf(talloc_tos(),
  62                                                 "/tmp/%s_%d.%d.prs",
  63                                                 name, v, i);
  64                 } else {
  65                         fname = talloc_asprintf(talloc_tos(),
  66                                                 "/tmp/%s_%d.prs",
  67                                                 name, i);
  68                 }
  69                 if (!fname) {
  70                         return;
  71                 }
  72                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  73                 if (fd != -1 || errno != EEXIST) break;
  74         }
  75         if (fd != -1) {
  76                 sz = write(fd, data->data + start, end - start);
  77                 i = close(fd);
  78                 if ((sz != end - start) || (i != 0) ) {
  79                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  80                                   fname, (unsigned long)sz,
  81                                   (unsigned long)end - start, i));
  82                 } else {
  83                         DEBUG(0,("created %s\n", fname));
  84                 }
  85         }
  86         TALLOC_FREE(fname);
  87 }
  88
  89 static void free_pipe_auth_data(struct pipe_auth_data *auth)
  90 {
  91         TALLOC_FREE(auth->auth_ctx);
  92 }
  93
  94 static DATA_BLOB generic_session_key(void)
  95 {
  96         return data_blob("SystemLibraryDTC", 16);
  97 }
  98
  99 /*******************************************************************
 100  Generate the next PDU to be returned from the data.
 101 ********************************************************************/
 102
 103 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
 104                                    struct pipe_auth_data *auth,
 105                                    uint32_t call_id,
 106                                    DATA_BLOB *rdata,
 107                                    size_t data_sent_length,
 108                                    DATA_BLOB *frag,
 109                                    size_t *pdu_size)
 110 {
 111         union dcerpc_payload u;
 112         uint8_t pfc_flags;
 113         size_t data_left;
 114         size_t data_to_send;
 115         size_t frag_len;
 116         size_t pad_len = 0;
 117         size_t auth_len = 0;
 118         NTSTATUS status;
 119
 120         ZERO_STRUCT(u.response);
 121
 122         /* Set up rpc packet pfc flags. */
 123         if (data_sent_length == 0) {
 124                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 125         } else {
 126                 pfc_flags = 0;
 127         }
 128
 129         /* Work out how much we can fit in a single PDU. */
 130         data_left = rdata->length - data_sent_length;
 131
 132         /* Ensure there really is data left to send. */
 133         if (!data_left) {
 134                 DEBUG(0, ("No data left to send !\n"));
 135                 return NT_STATUS_BUFFER_TOO_SMALL;
 136         }
 137
 138         status = dcerpc_guess_sizes(auth,
 139                                     DCERPC_RESPONSE_LENGTH,
 140                                     data_left,
 141                                     RPC_MAX_PDU_FRAG_LEN,
 142                                     SERVER_NDR_PADDING_SIZE,
 143                                     &data_to_send, &frag_len,
 144                                     &auth_len, &pad_len);
 145         if (!NT_STATUS_IS_OK(status)) {
 146                 return status;
 147         }
 148
 149         /* Set up the alloc hint. This should be the data left to send. */
 150         u.response.alloc_hint = data_left;
 151
 152         /* Work out if this PDU will be the last. */
 153         if (data_sent_length + data_to_send >= rdata->length) {
 154                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 155         }
 156
 157         /* Prepare data to be NDR encoded. */
 158         u.response.stub_and_verifier =
 159                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 160
 161         /* Store the packet in the data stream. */
 162         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 163                                           pfc_flags, auth_len, call_id,
 164                                           &u, frag);
 165         if (!NT_STATUS_IS_OK(status)) {
 166                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 167                 return status;
 168         }
 169
 170         if (auth_len) {
 171                 /* Set the proper length on the pdu, including padding.
 172                  * Only needed if an auth trailer will be appended. */
 173                 dcerpc_set_frag_length(frag, frag->length
 174                                                 + pad_len
 175                                                 + DCERPC_AUTH_TRAILER_LENGTH
 176                                                 + auth_len);
 177         }
 178
 179         if (auth_len) {
 180                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 181                 if (!NT_STATUS_IS_OK(status)) {
 182                         data_blob_free(frag);
 183                         return status;
 184                 }
 185         }
 186
 187         *pdu_size = data_to_send;
 188         return NT_STATUS_OK;
 189 }
 190
 191 /*******************************************************************
 192  Generate the next PDU to be returned from the data in p->rdata.
 193 ********************************************************************/
 194
 195 bool create_next_pdu(struct pipes_struct *p)
 196 {
 197         size_t pdu_size = 0;
 198         NTSTATUS status;
 199
 200         /*
 201          * If we're in the fault state, keep returning fault PDU's until
 202          * the pipe gets closed. JRA.
 203          */
 204         if (p->fault_state) {
 205                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 206                 return true;
 207         }
 208
 209         status = create_next_packet(p->mem_ctx, &p->auth,
 210                                     p->call_id, &p->out_data.rdata,
 211                                     p->out_data.data_sent_length,
 212                                     &p->out_data.frag, &pdu_size);
 213         if (!NT_STATUS_IS_OK(status)) {
 214                 DEBUG(0, ("Failed to create packet with error %s, "
 215                           "(auth level %u / type %u)\n",
 216                           nt_errstr(status),
 217                           (unsigned int)p->auth.auth_level,
 218                           (unsigned int)p->auth.auth_type));
 219                 return false;
 220         }
 221
 222         /* Setup the counts for this PDU. */
 223         p->out_data.data_sent_length += pdu_size;
 224         p->out_data.current_pdu_sent = 0;
 225         return true;
 226 }
 227
 228
 229 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 230
 231 /*******************************************************************
 232  Marshall a bind_nak pdu.
 233 *******************************************************************/
 234
 235 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 236 {
 237         NTSTATUS status;
 238         union dcerpc_payload u;
 239
 240         /* Free any memory in the current return data buffer. */
 241         pipe_init_outgoing_data(p);
 242
 243         /*
 244          * Initialize a bind_nak header.
 245          */
 246
 247         ZERO_STRUCT(u);
 248
 249         u.bind_nak.reject_reason  = 0;
 250
 251         /*
 252          * Marshall directly into the outgoing PDU space. We
 253          * must do this as we need to set to the bind response
 254          * header and are never sending more than one PDU here.
 255          */
 256
 257         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 258                                           DCERPC_PKT_BIND_NAK,
 259                                           DCERPC_PFC_FLAG_FIRST |
 260                                                 DCERPC_PFC_FLAG_LAST,
 261                                           0,
 262                                           pkt->call_id,
 263                                           &u,
 264                                           &p->out_data.frag);
 265         if (!NT_STATUS_IS_OK(status)) {
 266                 return False;
 267         }
 268
 269         p->out_data.data_sent_length = 0;
 270         p->out_data.current_pdu_sent = 0;
 271
 272         free_pipe_auth_data(&p->auth);
 273         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 274         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 275         p->pipe_bound = False;
 276
 277         return True;
 278 }
 279
 280 /*******************************************************************
 281  Marshall a fault pdu.
 282 *******************************************************************/
 283
 284 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 285 {
 286         NTSTATUS status;
 287         union dcerpc_payload u;
 288
 289         /* Free any memory in the current return data buffer. */
 290         pipe_init_outgoing_data(p);
 291
 292         /*
 293          * Initialize a fault header.
 294          */
 295
 296         ZERO_STRUCT(u);
 297
 298         u.fault.status          = NT_STATUS_V(fault_status);
 299         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 300
 301         /*
 302          * Marshall directly into the outgoing PDU space. We
 303          * must do this as we need to set to the bind response
 304          * header and are never sending more than one PDU here.
 305          */
 306
 307         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 308                                           DCERPC_PKT_FAULT,
 309                                           DCERPC_PFC_FLAG_FIRST |
 310                                            DCERPC_PFC_FLAG_LAST |
 311                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 312                                           0,
 313                                           p->call_id,
 314                                           &u,
 315                                           &p->out_data.frag);
 316         if (!NT_STATUS_IS_OK(status)) {
 317                 return False;
 318         }
 319
 320         p->out_data.data_sent_length = 0;
 321         p->out_data.current_pdu_sent = 0;
 322
 323         return True;
 324 }
 325
 326 /*******************************************************************
 327  Ensure a bind request has the correct abstract & transfer interface.
 328  Used to reject unknown binds from Win2k.
 329 *******************************************************************/
 330
 331 static bool check_bind_req(struct pipes_struct *p,
 332                            struct ndr_syntax_id* abstract,
 333                            struct ndr_syntax_id* transfer,
 334                            uint32 context_id)
 335 {
 336         struct pipe_rpc_fns *context_fns;
 337
 338         DEBUG(3,("check_bind_req for %s\n",
 339                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 340
 341         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 342         if (rpc_srv_pipe_exists_by_id(abstract) &&
 343            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 344                 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 345                         rpc_srv_get_pipe_cli_name(abstract),
 346                         rpc_srv_get_pipe_srv_name(abstract)));
 347         } else {
 348                 return false;
 349         }
 350
 351         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 352         if (context_fns == NULL) {
 353                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 354                 return False;
 355         }
 356
 357         context_fns->next = context_fns->prev = NULL;
 358         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 359         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 360         context_fns->context_id = context_id;
 361
 362         /* add to the list of open contexts */
 363
 364         DLIST_ADD( p->contexts, context_fns );
 365
 366         return True;
 367 }
 368
 369 /**
 370  * Is a named pipe known?
 371  * @param[in] cli_filename      The pipe name requested by the client
 372  * @result                      Do we want to serve this?
 373  */
 374 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
 375 {
 376         const char *pipename = cli_filename;
 377         NTSTATUS status;
 378
 379         if (strnequal(pipename, "\\PIPE\\", 6)) {
 380                 pipename += 5;
 381         }
 382
 383         if (*pipename == '\\') {
 384                 pipename += 1;
 385         }
 386
 387         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 388                 DEBUG(10, ("refusing spoolss access\n"));
 389                 return false;
 390         }
 391
 392         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 393                 return true;
 394         }
 395
 396         status = smb_probe_module("rpc", pipename);
 397         if (!NT_STATUS_IS_OK(status)) {
 398                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
 399                 return false;
 400         }
 401         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 402
 403         /*
 404          * Scan the list again for the interface id
 405          */
 406         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 407                 return true;
 408         }
 409
 410         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 411                    pipename));
 412
 413         return false;
 414 }
 415
 416 /*******************************************************************
 417  Handle the first part of a SPNEGO bind auth.
 418 *******************************************************************/
 419
 420 static bool pipe_spnego_auth_bind(struct pipes_struct *p,
 421                                   TALLOC_CTX *mem_ctx,
 422                                   struct dcerpc_auth *auth_info,
 423                                   DATA_BLOB *response)
 424 {
 425         struct spnego_context *spnego_ctx;
 426         NTSTATUS status;
 427
 428         status = spnego_server_auth_start(p,
 429                                           (auth_info->auth_level ==
 430                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 431                                           (auth_info->auth_level ==
 432                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 433                                           true,
 434                                           &auth_info->credentials,
 435                                           response,
 436                                           &spnego_ctx);
 437         if (!NT_STATUS_IS_OK(status)) {
 438                 DEBUG(0, ("Failed SPNEGO negotiate (%s)\n",
 439                           nt_errstr(status)));
 440                 return false;
 441         }
 442
 443         /* Make sure data is bound to the memctx, to be freed the caller */
 444         talloc_steal(mem_ctx, response->data);
 445
 446         p->auth.auth_ctx = spnego_ctx;
 447         p->auth.auth_data_free_func = &free_pipe_auth_data;
 448         p->auth.auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 449
 450         DEBUG(10, ("SPNEGO auth started\n"));
 451
 452         return true;
 453 }
 454
 455 /*******************************************************************
 456  Handle an schannel bind auth.
 457 *******************************************************************/
 458
 459 static bool pipe_schannel_auth_bind(struct pipes_struct *p,
 460                                     TALLOC_CTX *mem_ctx,
 461                                     struct dcerpc_auth *auth_info,
 462                                     DATA_BLOB *response)
 463 {
 464         struct NL_AUTH_MESSAGE neg;
 465         struct NL_AUTH_MESSAGE reply;
 466         bool ret;
 467         NTSTATUS status;
 468         struct netlogon_creds_CredentialState *creds;
 469         DATA_BLOB session_key;
 470         enum ndr_err_code ndr_err;
 471         struct schannel_state *schannel_auth;
 472
 473         ndr_err = ndr_pull_struct_blob(
 474                         &auth_info->credentials, mem_ctx, &neg,
 475                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
 476         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 477                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
 478                 return false;
 479         }
 480
 481         if (DEBUGLEVEL >= 10) {
 482                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
 483         }
 484
 485         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
 486                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
 487                 return false;
 488         }
 489
 490         /*
 491          * The neg.oem_netbios_computer.a key here must match the remote computer name
 492          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
 493          * operations that use credentials.
 494          */
 495
 496         become_root();
 497         status = schannel_get_creds_state(p, lp_private_dir(),
 498                                             neg.oem_netbios_computer.a, &creds);
 499         unbecome_root();
 500
 501         if (!NT_STATUS_IS_OK(status)) {
 502                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
 503                 return False;
 504         }
 505
 506         schannel_auth = talloc(p, struct schannel_state);
 507         if (!schannel_auth) {
 508                 TALLOC_FREE(creds);
 509                 return False;
 510         }
 511
 512         schannel_auth->state = SCHANNEL_STATE_START;
 513         schannel_auth->seq_num = 0;
 514         schannel_auth->initiator = false;
 515         schannel_auth->creds = creds;
 516
 517         /*
 518          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
 519          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
 520          * struct of the person who opened the pipe. I need to test this further. JRA.
 521          *
 522          * VL. As we are mapping this to guest set the generic key
 523          * "SystemLibraryDTC" key here. It's a bit difficult to test against
 524          * W2k3, as it does not allow schannel binds against SAMR and LSA
 525          * anymore.
 526          */
 527
 528         session_key = generic_session_key();
 529         if (session_key.data == NULL) {
 530                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
 531                           " key\n"));
 532                 return false;
 533         }
 534
 535         ret = server_info_set_session_key(p->server_info, session_key);
 536
 537         data_blob_free(&session_key);
 538
 539         if (!ret) {
 540                 DEBUG(0, ("server_info_set_session_key failed\n"));
 541                 return false;
 542         }
 543
 544         /*** SCHANNEL verifier ***/
 545
 546         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
 547         reply.Flags                             = 0;
 548         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
 549                                                       * this has any meaning
 550                                                       * here - gd */
 551
 552         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
 553                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 554         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 555                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
 556                 return false;
 557         }
 558
 559         if (DEBUGLEVEL >= 10) {
 560                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
 561         }
 562
 563         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
 564                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
 565
 566         /* We're finished with this bind - no more packets. */
 567         p->auth.auth_ctx = schannel_auth;
 568         p->auth.auth_data_free_func = &free_pipe_auth_data;
 569         p->auth.auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
 570
 571         p->pipe_bound = True;
 572
 573         return True;
 574 }
 575
 576 /*******************************************************************
 577  Handle an NTLMSSP bind auth.
 578 *******************************************************************/
 579
 580 static bool pipe_ntlmssp_auth_bind(struct pipes_struct *p,
 581                                    TALLOC_CTX *mem_ctx,
 582                                    struct dcerpc_auth *auth_info,
 583                                    DATA_BLOB *response)
 584 {
 585         struct auth_ntlmssp_state *ntlmssp_state = NULL;
 586         NTSTATUS status;
 587
 588         if (strncmp((char *)auth_info->credentials.data, "NTLMSSP", 7) != 0) {
 589                 DEBUG(0, ("Failed to read NTLMSSP in blob\n"));
 590                 return false;
 591         }
 592
 593         /* We have an NTLMSSP blob. */
 594         status = ntlmssp_server_auth_start(p,
 595                                            (auth_info->auth_level ==
 596                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 597                                            (auth_info->auth_level ==
 598                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 599                                            true,
 600                                            &auth_info->credentials,
 601                                            response,
 602                                            &ntlmssp_state);
 603         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 604                 DEBUG(0, (__location__ ": auth_ntlmssp_start failed: %s\n",
 605                           nt_errstr(status)));
 606                 return false;
 607         }
 608
 609         /* Make sure data is bound to the memctx, to be freed the caller */
 610         talloc_steal(mem_ctx, response->data);
 611
 612         p->auth.auth_ctx = ntlmssp_state;
 613         p->auth.auth_data_free_func = &free_pipe_auth_data;
 614         p->auth.auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 615
 616         DEBUG(10, (__location__ ": NTLMSSP auth started\n"));
 617
 618         return true;
 619 }
 620
 621 /*******************************************************************
 622  Process an NTLMSSP authentication response.
 623  If this function succeeds, the user has been authenticated
 624  and their domain, name and calling workstation stored in
 625  the pipe struct.
 626 *******************************************************************/
 627
 628 static bool pipe_ntlmssp_verify_final(TALLOC_CTX *mem_ctx,
 629                                 struct auth_ntlmssp_state *ntlmssp_ctx,
 630                                 enum dcerpc_AuthLevel auth_level,
 631                                 struct client_address *client_id,
 632                                 struct ndr_syntax_id *syntax,
 633                                 struct auth_serversupplied_info **server_info)
 634 {
 635         DATA_BLOB session_key;
 636         NTSTATUS status;
 637         bool ret;
 638
 639         DEBUG(5, (__location__ ": pipe %s checking user details\n",
 640                  get_pipe_name_from_syntax(talloc_tos(), syntax)));
 641
 642         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 643            ensure the underlying NTLMSSP flags are also set. If not we should
 644            refuse the bind. */
 645
 646         status = ntlmssp_server_check_flags(ntlmssp_ctx,
 647                                             (auth_level ==
 648                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 649                                             (auth_level ==
 650                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 651         if (!NT_STATUS_IS_OK(status)) {
 652                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 653                           "security for pipe %s\n",
 654                           get_pipe_name_from_syntax(talloc_tos(), syntax)));
 655                 return false;
 656         }
 657
 658         TALLOC_FREE(*server_info);
 659
 660         status = ntlmssp_server_get_user_info(ntlmssp_ctx,
 661                                                 mem_ctx, server_info);
 662         if (!NT_STATUS_IS_OK(status)) {
 663                 DEBUG(0, (__location__ ": failed to obtain the server info "
 664                           "for authenticated user: %s\n", nt_errstr(status)));
 665                 return false;
 666         }
 667
 668         if ((*server_info)->ptok == NULL) {
 669                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 670                 return false;
 671         }
 672
 673         /*
 674          * We're an authenticated bind over smb, so the session key needs to
 675          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 676          * does. See the RPC-SAMBA3SESSIONKEY.
 677          */
 678
 679         session_key = generic_session_key();
 680         if (session_key.data == NULL) {
 681                 return false;
 682         }
 683
 684         ret = server_info_set_session_key((*server_info), session_key);
 685         data_blob_free(&session_key);
 686         if (!ret) {
 687                 DEBUG(0, ("Failed to set session key!\n"));
 688                 return false;
 689         }
 690
 691         return true;
 692 }
 693
 694 /*******************************************************************
 695  Handle a GSSAPI bind auth.
 696 *******************************************************************/
 697
 698 static bool pipe_gssapi_auth_bind(struct pipes_struct *p,
 699                                   TALLOC_CTX *mem_ctx,
 700                                   struct dcerpc_auth *auth_info,
 701                                   DATA_BLOB *response)
 702 {
 703         NTSTATUS status;
 704         struct gse_context *gse_ctx = NULL;
 705
 706         status = gssapi_server_auth_start(p,
 707                                           (auth_info->auth_level ==
 708                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 709                                           (auth_info->auth_level ==
 710                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 711                                           true,
 712                                           &auth_info->credentials,
 713                                           response,
 714                                           &gse_ctx);
 715         if (!NT_STATUS_IS_OK(status)) {
 716                 DEBUG(0, ("Failed to init dcerpc gssapi server (%s)\n",
 717                           nt_errstr(status)));
 718                 goto err;
 719         }
 720
 721         /* Make sure data is bound to the memctx, to be freed the caller */
 722         talloc_steal(mem_ctx, response->data);
 723
 724         p->auth.auth_ctx = gse_ctx;
 725         p->auth.auth_data_free_func = &free_pipe_auth_data;
 726         p->auth.auth_type = DCERPC_AUTH_TYPE_KRB5;
 727
 728         DEBUG(10, ("KRB5 auth started\n"));
 729
 730         return true;
 731
 732 err:
 733         TALLOC_FREE(gse_ctx);
 734         return false;
 735 }
 736
 737 static NTSTATUS pipe_gssapi_verify_final(TALLOC_CTX *mem_ctx,
 738                                          struct gse_context *gse_ctx,
 739                                          struct client_address *client_id,
 740                                          struct auth_serversupplied_info **server_info)
 741 {
 742         DATA_BLOB session_key;
 743         NTSTATUS status;
 744         bool bret;
 745
 746         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 747            ensure the underlying flags are also set. If not we should
 748            refuse the bind. */
 749
 750         status = gssapi_server_check_flags(gse_ctx);
 751         if (!NT_STATUS_IS_OK(status)) {
 752                 DEBUG(0, ("Requested Security Layers not honored!\n"));
 753                 return status;
 754         }
 755
 756         status = gssapi_server_get_user_info(gse_ctx, mem_ctx,
 757                                              client_id, server_info);
 758         if (!NT_STATUS_IS_OK(status)) {
 759                 DEBUG(0, (__location__ ": failed to obtain the server info "
 760                           "for authenticated user: %s\n", nt_errstr(status)));
 761                 return status;
 762         }
 763
 764         if ((*server_info)->ptok == NULL) {
 765                 status = create_local_token(*server_info);
 766                 if (!NT_STATUS_IS_OK(status)) {
 767                         DEBUG(1, ("Failed to create local user token (%s)\n",
 768                                   nt_errstr(status)));
 769                         status = NT_STATUS_ACCESS_DENIED;
 770                         return status;
 771                 }
 772         }
 773
 774         /* TODO: this is what the ntlmssp code does with the session_key, check
 775          * it is ok with gssapi too */
 776         /*
 777          * We're an authenticated bind over smb, so the session key needs to
 778          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 779          * does. See the RPC-SAMBA3SESSIONKEY.
 780          */
 781
 782         session_key = generic_session_key();
 783         if (session_key.data == NULL) {
 784                 return NT_STATUS_ACCESS_DENIED;
 785         }
 786
 787         bret = server_info_set_session_key((*server_info), session_key);
 788         data_blob_free(&session_key);
 789         if (!bret) {
 790                 return NT_STATUS_ACCESS_DENIED;
 791         }
 792
 793         return NT_STATUS_OK;
 794 }
 795
 796 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 797 {
 798         enum spnego_mech auth_type;
 799         struct auth_ntlmssp_state *ntlmssp_ctx;
 800         struct spnego_context *spnego_ctx;
 801         struct gse_context *gse_ctx;
 802         void *mech_ctx;
 803         NTSTATUS status;
 804
 805         switch (p->auth.auth_type) {
 806         case DCERPC_AUTH_TYPE_NTLMSSP:
 807                 ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 808                                                     struct auth_ntlmssp_state);
 809                 if (!pipe_ntlmssp_verify_final(p, ntlmssp_ctx,
 810                                                 p->auth.auth_level,
 811                                                 p->client_id, &p->syntax,
 812                                                 &p->server_info)) {
 813                         return NT_STATUS_ACCESS_DENIED;
 814                 }
 815                 break;
 816         case DCERPC_AUTH_TYPE_KRB5:
 817                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 818                                                 struct gse_context);
 819                 status = pipe_gssapi_verify_final(p, gse_ctx,
 820                                                   p->client_id,
 821                                                   &p->server_info);
 822                 if (!NT_STATUS_IS_OK(status)) {
 823                         DEBUG(1, ("gssapi bind failed with: %s",
 824                                   nt_errstr(status)));
 825                         return status;
 826                 }
 827                 break;
 828         case DCERPC_AUTH_TYPE_SPNEGO:
 829                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 830                                                    struct spnego_context);
 831                 status = spnego_get_negotiated_mech(spnego_ctx,
 832                                                     &auth_type, &mech_ctx);
 833                 if (!NT_STATUS_IS_OK(status)) {
 834                         DEBUG(0, ("Bad SPNEGO state (%s)\n",
 835                                   nt_errstr(status)));
 836                         return status;
 837                 }
 838                 switch(auth_type) {
 839                 case SPNEGO_KRB5:
 840                         gse_ctx = talloc_get_type_abort(mech_ctx,
 841                                                         struct gse_context);
 842                         status = pipe_gssapi_verify_final(p, gse_ctx,
 843                                                           p->client_id,
 844                                                           &p->server_info);
 845                         if (!NT_STATUS_IS_OK(status)) {
 846                                 DEBUG(1, ("gssapi bind failed with: %s",
 847                                           nt_errstr(status)));
 848                                 return status;
 849                         }
 850                         break;
 851                 case SPNEGO_NTLMSSP:
 852                         ntlmssp_ctx = talloc_get_type_abort(mech_ctx,
 853                                                 struct auth_ntlmssp_state);
 854                         if (!pipe_ntlmssp_verify_final(p, ntlmssp_ctx,
 855                                                         p->auth.auth_level,
 856                                                         p->client_id,
 857                                                         &p->syntax,
 858                                                         &p->server_info)) {
 859                                 return NT_STATUS_ACCESS_DENIED;
 860                         }
 861                         break;
 862                 default:
 863                         DEBUG(0, (__location__ ": incorrect spnego type "
 864                                   "(%d).\n", auth_type));
 865                         return NT_STATUS_ACCESS_DENIED;
 866                 }
 867                 break;
 868         default:
 869                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
 870                           (unsigned int)p->auth.auth_type));
 871                 return NT_STATUS_ACCESS_DENIED;
 872         }
 873
 874         p->pipe_bound = true;
 875
 876         return NT_STATUS_OK;
 877 }
 878
 879 /*******************************************************************
 880  Respond to a pipe bind request.
 881 *******************************************************************/
 882
 883 static bool api_pipe_bind_req(struct pipes_struct *p,
 884                                 struct ncacn_packet *pkt)
 885 {
 886         struct dcerpc_auth auth_info;
 887         uint16 assoc_gid;
 888         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
 889         NTSTATUS status;
 890         struct ndr_syntax_id id;
 891         union dcerpc_payload u;
 892         struct dcerpc_ack_ctx bind_ack_ctx;
 893         DATA_BLOB auth_resp = data_blob_null;
 894         DATA_BLOB auth_blob = data_blob_null;
 895
 896         /* No rebinds on a bound pipe - use alter context. */
 897         if (p->pipe_bound) {
 898                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
 899                          "pipe %s.\n",
 900                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 901                 return setup_bind_nak(p, pkt);
 902         }
 903
 904         if (pkt->u.bind.num_contexts == 0) {
 905                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
 906                 goto err_exit;
 907         }
 908
 909         /*
 910          * Try and find the correct pipe name to ensure
 911          * that this is a pipe name we support.
 912          */
 913         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 914         if (rpc_srv_pipe_exists_by_id(&id)) {
 915                 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 916                         rpc_srv_get_pipe_cli_name(&id),
 917                         rpc_srv_get_pipe_srv_name(&id)));
 918         } else {
 919                 status = smb_probe_module(
 920                         "rpc", get_pipe_name_from_syntax(
 921                                 talloc_tos(),
 922                                 &pkt->u.bind.ctx_list[0].abstract_syntax));
 923
 924                 if (NT_STATUS_IS_ERR(status)) {
 925                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 926                                 get_pipe_name_from_syntax(
 927                                         talloc_tos(),
 928                                         &pkt->u.bind.ctx_list[0].abstract_syntax)));
 929
 930                         return setup_bind_nak(p, pkt);
 931                 }
 932
 933                 if (rpc_srv_get_pipe_interface_by_cli_name(
 934                                 get_pipe_name_from_syntax(talloc_tos(),
 935                                                           &p->syntax),
 936                                 &id)) {
 937                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 938                                 rpc_srv_get_pipe_cli_name(&id),
 939                                 rpc_srv_get_pipe_srv_name(&id)));
 940                 } else {
 941                         DEBUG(0, ("module %s doesn't provide functions for "
 942                                   "pipe %s!\n",
 943                                   get_pipe_name_from_syntax(talloc_tos(),
 944                                                             &p->syntax),
 945                                   get_pipe_name_from_syntax(talloc_tos(),
 946                                                             &p->syntax)));
 947                         return setup_bind_nak(p, pkt);
 948                 }
 949         }
 950
 951         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 952
 953         if (pkt->u.bind.assoc_group_id != 0) {
 954                 assoc_gid = pkt->u.bind.assoc_group_id;
 955         } else {
 956                 assoc_gid = 0x53f0;
 957         }
 958
 959         /*
 960          * Create the bind response struct.
 961          */
 962
 963         /* If the requested abstract synt uuid doesn't match our client pipe,
 964                 reject the bind_ack & set the transfer interface synt to all 0's,
 965                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 966                 unknown to NT4)
 967                 Needed when adding entries to a DACL from NT5 - SK */
 968
 969         if (check_bind_req(p,
 970                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 971                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 972                         pkt->u.bind.ctx_list[0].context_id)) {
 973
 974                 bind_ack_ctx.result = 0;
 975                 bind_ack_ctx.reason = 0;
 976                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 977         } else {
 978                 p->pipe_bound = False;
 979                 /* Rejection reason: abstract syntax not supported */
 980                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 981                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
 982                 bind_ack_ctx.syntax = null_ndr_syntax_id;
 983         }
 984
 985         /*
 986          * Check if this is an authenticated bind request.
 987          */
 988         if (pkt->auth_length) {
 989                 /* Quick length check. Won't catch a bad auth footer,
 990                  * prevents overrun. */
 991
 992                 if (pkt->frag_length < RPC_HEADER_LEN +
 993                                         DCERPC_AUTH_TRAILER_LENGTH +
 994                                         pkt->auth_length) {
 995                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
 996                                 "too long for fragment %u.\n",
 997                                 (unsigned int)pkt->auth_length,
 998                                 (unsigned int)pkt->frag_length));
 999                         goto err_exit;
1000                 }
1001
1002                 /*
1003                  * Decode the authentication verifier.
1004                  */
1005                 status = dcerpc_pull_dcerpc_auth(pkt,
1006                                                  &pkt->u.bind.auth_info,
1007                                                  &auth_info, p->endian);
1008                 if (!NT_STATUS_IS_OK(status)) {
1009                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1010                         goto err_exit;
1011                 }
1012
1013                 auth_type = auth_info.auth_type;
1014
1015                 /* Work out if we have to sign or seal etc. */
1016                 switch (auth_info.auth_level) {
1017                 case DCERPC_AUTH_LEVEL_INTEGRITY:
1018                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1019                         break;
1020                 case DCERPC_AUTH_LEVEL_PRIVACY:
1021                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1022                         break;
1023                 default:
1024                         DEBUG(0, ("Unexpected auth level (%u).\n",
1025                                 (unsigned int)auth_info.auth_level ));
1026                         goto err_exit;
1027                 }
1028
1029                 switch (auth_type) {
1030                 case DCERPC_AUTH_TYPE_NTLMSSP:
1031                         if (!pipe_ntlmssp_auth_bind(p, pkt,
1032                                                 &auth_info, &auth_resp)) {
1033                                 goto err_exit;
1034                         }
1035                         assoc_gid = 0x7a77;
1036                         break;
1037
1038                 case DCERPC_AUTH_TYPE_SCHANNEL:
1039                         if (!pipe_schannel_auth_bind(p, pkt,
1040                                                 &auth_info, &auth_resp)) {
1041                                 goto err_exit;
1042                         }
1043                         break;
1044
1045                 case DCERPC_AUTH_TYPE_SPNEGO:
1046                         if (!pipe_spnego_auth_bind(p, pkt,
1047                                                 &auth_info, &auth_resp)) {
1048                                 goto err_exit;
1049                         }
1050                         break;
1051
1052                 case DCERPC_AUTH_TYPE_KRB5:
1053                         if (!pipe_gssapi_auth_bind(p, pkt,
1054                                                 &auth_info, &auth_resp)) {
1055                                 goto err_exit;
1056                         }
1057                         break;
1058
1059                 case DCERPC_AUTH_TYPE_NONE:
1060                         break;
1061
1062                 default:
1063                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
1064                         goto err_exit;
1065                 }
1066         }
1067
1068         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
1069                 /* Unauthenticated bind request. */
1070                 /* We're finished - no more packets. */
1071                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
1072                 /* We must set the pipe auth_level here also. */
1073                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1074                 p->pipe_bound = True;
1075                 /* The session key was initialized from the SMB
1076                  * session in make_internal_rpc_pipe_p */
1077         }
1078
1079         ZERO_STRUCT(u.bind_ack);
1080         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1081         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1082         u.bind_ack.assoc_group_id = assoc_gid;
1083
1084         /* name has to be \PIPE\xxxxx */
1085         u.bind_ack.secondary_address =
1086                         talloc_asprintf(pkt, "\\PIPE\\%s",
1087                                         rpc_srv_get_pipe_srv_name(&id));
1088         if (!u.bind_ack.secondary_address) {
1089                 DEBUG(0, ("Out of memory!\n"));
1090                 goto err_exit;
1091         }
1092         u.bind_ack.secondary_address_size =
1093                                 strlen(u.bind_ack.secondary_address) + 1;
1094
1095         u.bind_ack.num_results = 1;
1096         u.bind_ack.ctx_list = &bind_ack_ctx;
1097
1098         /* NOTE: We leave the auth_info empty so we can calculate the padding
1099          * later and then append the auth_info --simo */
1100
1101         /*
1102          * Marshall directly into the outgoing PDU space. We
1103          * must do this as we need to set to the bind response
1104          * header and are never sending more than one PDU here.
1105          */
1106
1107         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1108                                           DCERPC_PKT_BIND_ACK,
1109                                           DCERPC_PFC_FLAG_FIRST |
1110                                                 DCERPC_PFC_FLAG_LAST,
1111                                           auth_resp.length,
1112                                           pkt->call_id,
1113                                           &u,
1114                                           &p->out_data.frag);
1115         if (!NT_STATUS_IS_OK(status)) {
1116                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1117                           nt_errstr(status)));
1118         }
1119
1120         if (auth_resp.length) {
1121
1122                 status = dcerpc_push_dcerpc_auth(pkt,
1123                                                  auth_type,
1124                                                  auth_info.auth_level,
1125                                                  0,
1126                                                  1, /* auth_context_id */
1127                                                  &auth_resp,
1128                                                  &auth_blob);
1129                 if (!NT_STATUS_IS_OK(status)) {
1130                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1131                         goto err_exit;
1132                 }
1133         }
1134
1135         /* Now that we have the auth len store it into the right place in
1136          * the dcerpc header */
1137         dcerpc_set_frag_length(&p->out_data.frag,
1138                                 p->out_data.frag.length + auth_blob.length);
1139
1140         if (auth_blob.length) {
1141
1142                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1143                                         auth_blob.data, auth_blob.length)) {
1144                         DEBUG(0, ("Append of auth info failed.\n"));
1145                         goto err_exit;
1146                 }
1147         }
1148
1149         /*
1150          * Setup the lengths for the initial reply.
1151          */
1152
1153         p->out_data.data_sent_length = 0;
1154         p->out_data.current_pdu_sent = 0;
1155
1156         TALLOC_FREE(auth_blob.data);
1157         return True;
1158
1159   err_exit:
1160
1161         data_blob_free(&p->out_data.frag);
1162         TALLOC_FREE(auth_blob.data);
1163         return setup_bind_nak(p, pkt);
1164 }
1165
1166 /*******************************************************************
1167  This is the "stage3" response after a bind request and reply.
1168 *******************************************************************/
1169
1170 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
1171 {
1172         struct dcerpc_auth auth_info;
1173         DATA_BLOB response = data_blob_null;
1174         struct auth_ntlmssp_state *ntlmssp_ctx;
1175         struct spnego_context *spnego_ctx;
1176         struct gse_context *gse_ctx;
1177         NTSTATUS status;
1178
1179         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
1180
1181         if (pkt->auth_length == 0) {
1182                 DEBUG(0, ("No auth field sent for bind request!\n"));
1183                 goto err;
1184         }
1185
1186         /* Ensure there's enough data for an authenticated request. */
1187         if (pkt->frag_length < RPC_HEADER_LEN
1188                                 + DCERPC_AUTH_TRAILER_LENGTH
1189                                 + pkt->auth_length) {
1190                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
1191                                 "%u is too large.\n",
1192                         (unsigned int)pkt->auth_length));
1193                 goto err;
1194         }
1195
1196         /*
1197          * Decode the authentication verifier response.
1198          */
1199
1200         status = dcerpc_pull_dcerpc_auth(pkt,
1201                                          &pkt->u.auth3.auth_info,
1202                                          &auth_info, p->endian);
1203         if (!NT_STATUS_IS_OK(status)) {
1204                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
1205                 goto err;
1206         }
1207
1208         /* We must NEVER look at auth_info->auth_pad_len here,
1209          * as old Samba client code gets it wrong and sends it
1210          * as zero. JRA.
1211          */
1212
1213         switch (auth_info.auth_type) {
1214         case DCERPC_AUTH_TYPE_NTLMSSP:
1215                 ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1216                                                     struct auth_ntlmssp_state);
1217                 status = ntlmssp_server_step(ntlmssp_ctx,
1218                                              pkt, &auth_info.credentials,
1219                                              &response);
1220                 break;
1221         case DCERPC_AUTH_TYPE_KRB5:
1222                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1223                                                 struct gse_context);
1224                 status = gssapi_server_step(gse_ctx,
1225                                             pkt, &auth_info.credentials,
1226                                             &response);
1227                 break;
1228         case DCERPC_AUTH_TYPE_SPNEGO:
1229                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1230                                                    struct spnego_context);
1231                 status = spnego_server_step(spnego_ctx,
1232                                             pkt, &auth_info.credentials,
1233                                             &response);
1234                 break;
1235         default:
1236                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
1237                           (unsigned int)auth_info.auth_type));
1238                 return false;
1239         }
1240
1241         if (NT_STATUS_EQUAL(status,
1242                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1243             response.length) {
1244                 DEBUG(0, (__location__ ": This was supposed to be the final "
1245                           "leg, but crypto machinery claims a response is "
1246                           "needed, aborting auth!\n"));
1247                 data_blob_free(&response);
1248                 goto err;
1249         }
1250         if (!NT_STATUS_IS_OK(status)) {
1251                 DEBUG(0, ("Auth failed (%s)\n", nt_errstr(status)));
1252                 goto err;
1253         }
1254
1255         /* Now verify auth was indeed successful and extract server info */
1256         status = pipe_auth_verify_final(p);
1257         if (!NT_STATUS_IS_OK(status)) {
1258                 DEBUG(0, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1259                 goto err;
1260         }
1261
1262         return true;
1263
1264 err:
1265
1266         free_pipe_auth_data(&p->auth);
1267         return false;
1268 }
1269
1270 /****************************************************************************
1271  Deal with an alter context call. Can be third part of 3 leg auth request for
1272  SPNEGO calls.
1273 ****************************************************************************/
1274
1275 static bool api_pipe_alter_context(struct pipes_struct *p,
1276                                         struct ncacn_packet *pkt)
1277 {
1278         struct dcerpc_auth auth_info;
1279         uint16 assoc_gid;
1280         NTSTATUS status;
1281         union dcerpc_payload u;
1282         struct dcerpc_ack_ctx bind_ack_ctx;
1283         DATA_BLOB auth_resp = data_blob_null;
1284         DATA_BLOB auth_blob = data_blob_null;
1285         int pad_len = 0;
1286         struct auth_ntlmssp_state *ntlmssp_ctx;
1287         struct spnego_context *spnego_ctx;
1288         struct gse_context *gse_ctx;
1289
1290         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1291
1292         if (pkt->u.bind.assoc_group_id != 0) {
1293                 assoc_gid = pkt->u.bind.assoc_group_id;
1294         } else {
1295                 assoc_gid = 0x53f0;
1296         }
1297
1298         /*
1299          * Create the bind response struct.
1300          */
1301
1302         /* If the requested abstract synt uuid doesn't match our client pipe,
1303                 reject the bind_ack & set the transfer interface synt to all 0's,
1304                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1305                 unknown to NT4)
1306                 Needed when adding entries to a DACL from NT5 - SK */
1307
1308         if (check_bind_req(p,
1309                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1310                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1311                         pkt->u.bind.ctx_list[0].context_id)) {
1312
1313                 bind_ack_ctx.result = 0;
1314                 bind_ack_ctx.reason = 0;
1315                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1316         } else {
1317                 p->pipe_bound = False;
1318                 /* Rejection reason: abstract syntax not supported */
1319                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1320                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1321                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1322         }
1323
1324         /*
1325          * Check if this is an authenticated alter context request.
1326          */
1327         if (pkt->auth_length) {
1328                 /* Quick length check. Won't catch a bad auth footer,
1329                  * prevents overrun. */
1330
1331                 if (pkt->frag_length < RPC_HEADER_LEN +
1332                                         DCERPC_AUTH_TRAILER_LENGTH +
1333                                         pkt->auth_length) {
1334                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1335                                 "too long for fragment %u.\n",
1336                                 (unsigned int)pkt->auth_length,
1337                                 (unsigned int)pkt->frag_length ));
1338                         goto err_exit;
1339                 }
1340
1341                 status = dcerpc_pull_dcerpc_auth(pkt,
1342                                                  &pkt->u.bind.auth_info,
1343                                                  &auth_info, p->endian);
1344                 if (!NT_STATUS_IS_OK(status)) {
1345                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1346                         goto err_exit;
1347                 }
1348
1349                 /* We can only finish if the pipe is unbound for now */
1350                 if (p->pipe_bound) {
1351                         DEBUG(0, (__location__ ": Pipe already bound, "
1352                                   "Altering Context not yet supported!\n"));
1353                         goto err_exit;
1354                 }
1355
1356                 switch (auth_info.auth_type) {
1357                 case DCERPC_AUTH_TYPE_SPNEGO:
1358                         spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1359                                                         struct spnego_context);
1360                         status = spnego_server_step(spnego_ctx,
1361                                                     pkt,
1362                                                     &auth_info.credentials,
1363                                                     &auth_resp);
1364                         break;
1365
1366                 case DCERPC_AUTH_TYPE_KRB5:
1367                         gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1368                                                         struct gse_context);
1369                         status = gssapi_server_step(gse_ctx,
1370                                                     pkt,
1371                                                     &auth_info.credentials,
1372                                                     &auth_resp);
1373                         break;
1374                 case DCERPC_AUTH_TYPE_NTLMSSP:
1375                         ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1376                                                     struct auth_ntlmssp_state);
1377                         status = ntlmssp_server_step(ntlmssp_ctx,
1378                                                      pkt,
1379                                                      &auth_info.credentials,
1380                                                      &auth_resp);
1381                         break;
1382
1383                 default:
1384                         DEBUG(3, (__location__ ": Usupported auth type (%d) "
1385                                   "in alter-context call\n",
1386                                   auth_info.auth_type));
1387                         goto err_exit;
1388                 }
1389
1390                 if (NT_STATUS_IS_OK(status)) {
1391                         /* third leg of auth, verify auth info */
1392                         status = pipe_auth_verify_final(p);
1393                         if (!NT_STATUS_IS_OK(status)) {
1394                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1395                                           nt_errstr(status)));
1396                                 goto err_exit;
1397                         }
1398                 } else if (NT_STATUS_EQUAL(status,
1399                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1400                         DEBUG(10, ("More auth legs required.\n"));
1401                 } else {
1402                         DEBUG(0, ("Auth step returned an error (%s)\n",
1403                                   nt_errstr(status)));
1404                         goto err_exit;
1405                 }
1406         }
1407
1408         ZERO_STRUCT(u.alter_resp);
1409         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1410         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1411         u.alter_resp.assoc_group_id = assoc_gid;
1412
1413         /* secondary address CAN be NULL
1414          * as the specs say it's ignored.
1415          * It MUST be NULL to have the spoolss working.
1416          */
1417         u.alter_resp.secondary_address = "";
1418         u.alter_resp.secondary_address_size = 1;
1419
1420         u.alter_resp.num_results = 1;
1421         u.alter_resp.ctx_list = &bind_ack_ctx;
1422
1423         /* NOTE: We leave the auth_info empty so we can calculate the padding
1424          * later and then append the auth_info --simo */
1425
1426         /*
1427          * Marshall directly into the outgoing PDU space. We
1428          * must do this as we need to set to the bind response
1429          * header and are never sending more than one PDU here.
1430          */
1431
1432         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1433                                           DCERPC_PKT_ALTER_RESP,
1434                                           DCERPC_PFC_FLAG_FIRST |
1435                                                 DCERPC_PFC_FLAG_LAST,
1436                                           auth_resp.length,
1437                                           pkt->call_id,
1438                                           &u,
1439                                           &p->out_data.frag);
1440         if (!NT_STATUS_IS_OK(status)) {
1441                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1442                           nt_errstr(status)));
1443         }
1444
1445         if (auth_resp.length) {
1446
1447                 /* Work out any padding needed before the auth footer. */
1448                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1449                 if (pad_len) {
1450                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1451                         DEBUG(10, ("auth pad_len = %u\n",
1452                                    (unsigned int)pad_len));
1453                 }
1454
1455                 status = dcerpc_push_dcerpc_auth(pkt,
1456                                                  auth_info.auth_type,
1457                                                  auth_info.auth_level,
1458                                                  pad_len,
1459                                                  1, /* auth_context_id */
1460                                                  &auth_resp,
1461                                                  &auth_blob);
1462                 if (!NT_STATUS_IS_OK(status)) {
1463                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1464                         goto err_exit;
1465                 }
1466         }
1467
1468         /* Now that we have the auth len store it into the right place in
1469          * the dcerpc header */
1470         dcerpc_set_frag_length(&p->out_data.frag,
1471                                 p->out_data.frag.length +
1472                                         pad_len + auth_blob.length);
1473
1474         if (auth_resp.length) {
1475                 if (pad_len) {
1476                         char pad[SERVER_NDR_PADDING_SIZE];
1477                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1478                         if (!data_blob_append(p->mem_ctx,
1479                                                 &p->out_data.frag,
1480                                                 pad, pad_len)) {
1481                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1482                                           "%u bytes of pad data.\n",
1483                                           (unsigned int)pad_len));
1484                                 goto err_exit;
1485                         }
1486                 }
1487
1488                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1489                                         auth_blob.data, auth_blob.length)) {
1490                         DEBUG(0, ("Append of auth info failed.\n"));
1491                         goto err_exit;
1492                 }
1493         }
1494
1495         /*
1496          * Setup the lengths for the initial reply.
1497          */
1498
1499         p->out_data.data_sent_length = 0;
1500         p->out_data.current_pdu_sent = 0;
1501
1502         TALLOC_FREE(auth_blob.data);
1503         return True;
1504
1505   err_exit:
1506
1507         data_blob_free(&p->out_data.frag);
1508         TALLOC_FREE(auth_blob.data);
1509         return setup_bind_nak(p, pkt);
1510 }
1511
1512 /****************************************************************************
1513  Find the set of RPC functions associated with this context_id
1514 ****************************************************************************/
1515
1516 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
1517 {
1518         PIPE_RPC_FNS *fns = NULL;
1519
1520         if ( !list ) {
1521                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
1522                 return NULL;
1523         }
1524
1525         for (fns=list; fns; fns=fns->next ) {
1526                 if ( fns->context_id == context_id )
1527                         return fns;
1528         }
1529         return NULL;
1530 }
1531
1532 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1533                        const struct api_struct *api_rpc_cmds, int n_cmds);
1534
1535 /****************************************************************************
1536  Find the correct RPC function to call for this request.
1537  If the pipe is authenticated then become the correct UNIX user
1538  before doing the call.
1539 ****************************************************************************/
1540
1541 static bool api_pipe_request(struct pipes_struct *p,
1542                                 struct ncacn_packet *pkt)
1543 {
1544         bool ret = False;
1545         bool changed_user = False;
1546         PIPE_RPC_FNS *pipe_fns;
1547
1548         if (p->pipe_bound &&
1549             ((p->auth.auth_type == DCERPC_AUTH_TYPE_NTLMSSP) ||
1550              (p->auth.auth_type == DCERPC_AUTH_TYPE_KRB5) ||
1551              (p->auth.auth_type == DCERPC_AUTH_TYPE_SPNEGO))) {
1552                 if(!become_authenticated_pipe_user(p)) {
1553                         data_blob_free(&p->out_data.rdata);
1554                         return False;
1555                 }
1556                 changed_user = True;
1557         }
1558
1559         DEBUG(5, ("Requested \\PIPE\\%s\n",
1560                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1561
1562         /* get the set of RPC functions for this context */
1563
1564         pipe_fns = find_pipe_fns_by_context(p->contexts,
1565                                             pkt->u.request.context_id);
1566
1567         if ( pipe_fns ) {
1568                 TALLOC_CTX *frame = talloc_stackframe();
1569                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds);
1570                 TALLOC_FREE(frame);
1571         }
1572         else {
1573                 DEBUG(0, ("No rpc function table associated with context "
1574                           "[%d] on pipe [%s]\n",
1575                           pkt->u.request.context_id,
1576                           get_pipe_name_from_syntax(talloc_tos(),
1577                                                     &p->syntax)));
1578         }
1579
1580         if (changed_user) {
1581                 unbecome_authenticated_pipe_user();
1582         }
1583
1584         return ret;
1585 }
1586
1587 /*******************************************************************
1588  Calls the underlying RPC function for a named pipe.
1589  ********************************************************************/
1590
1591 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1592                        const struct api_struct *api_rpc_cmds, int n_cmds)
1593 {
1594         int fn_num;
1595         uint32_t offset1;
1596
1597         /* interpret the command */
1598         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1599                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1600                  pkt->u.request.opnum));
1601
1602         if (DEBUGLEVEL >= 50) {
1603                 fstring name;
1604                 slprintf(name, sizeof(name)-1, "in_%s",
1605                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1606                 dump_pdu_region(name, pkt->u.request.opnum,
1607                                 &p->in_data.data, 0,
1608                                 p->in_data.data.length);
1609         }
1610
1611         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1612                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1613                     api_rpc_cmds[fn_num].fn != NULL) {
1614                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1615                                   api_rpc_cmds[fn_num].name));
1616                         break;
1617                 }
1618         }
1619
1620         if (fn_num == n_cmds) {
1621                 /*
1622                  * For an unknown RPC just return a fault PDU but
1623                  * return True to allow RPC's on the pipe to continue
1624                  * and not put the pipe into fault state. JRA.
1625                  */
1626                 DEBUG(4, ("unknown\n"));
1627                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1628                 return True;
1629         }
1630
1631         offset1 = p->out_data.rdata.length;
1632
1633         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1634                 fn_num, api_rpc_cmds[fn_num].fn));
1635         /* do the actual command */
1636         if(!api_rpc_cmds[fn_num].fn(p)) {
1637                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1638                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1639                          api_rpc_cmds[fn_num].name));
1640                 data_blob_free(&p->out_data.rdata);
1641                 return False;
1642         }
1643
1644         if (p->bad_handle_fault_state) {
1645                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1646                 p->bad_handle_fault_state = False;
1647                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
1648                 return True;
1649         }
1650
1651         if (p->rng_fault_state) {
1652                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
1653                 p->rng_fault_state = False;
1654                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1655                 return True;
1656         }
1657
1658         if (DEBUGLEVEL >= 50) {
1659                 fstring name;
1660                 slprintf(name, sizeof(name)-1, "out_%s",
1661                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1662                 dump_pdu_region(name, pkt->u.request.opnum,
1663                                 &p->out_data.rdata, offset1,
1664                                 p->out_data.rdata.length);
1665         }
1666
1667         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1668                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1669
1670         /* Check for buffer underflow in rpc parsing */
1671         if ((DEBUGLEVEL >= 10) &&
1672             (pkt->frag_length < p->in_data.data.length)) {
1673                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1674                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1675                               p->in_data.data.length - pkt->frag_length);
1676         }
1677
1678         return True;
1679 }
1680
1681 /****************************************************************************
1682  Initialise an outgoing packet.
1683 ****************************************************************************/
1684
1685 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1686 {
1687         output_data *o_data = &p->out_data;
1688
1689         /* Reset the offset counters. */
1690         o_data->data_sent_length = 0;
1691         o_data->current_pdu_sent = 0;
1692
1693         data_blob_free(&o_data->frag);
1694
1695         /* Free any memory in the current return data buffer. */
1696         data_blob_free(&o_data->rdata);
1697
1698         return True;
1699 }
1700
1701 /****************************************************************************
1702  Sets the fault state on incoming packets.
1703 ****************************************************************************/
1704
1705 void set_incoming_fault(struct pipes_struct *p)
1706 {
1707         data_blob_free(&p->in_data.data);
1708         p->in_data.pdu_needed_len = 0;
1709         p->in_data.pdu.length = 0;
1710         p->fault_state = True;
1711         DEBUG(10, ("set_incoming_fault: Setting fault state on pipe %s\n",
1712                    get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1713 }
1714
1715 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1716                                     struct ncacn_packet *pkt,
1717                                     DATA_BLOB *raw_pkt)
1718 {
1719         NTSTATUS status;
1720         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1721         size_t pad_len;
1722
1723         DEBUG(10, ("Checking request auth.\n"));
1724
1725         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1726                 hdr_size += 16;
1727         }
1728
1729         /* in case of sealing this function will unseal the data in place */
1730         status = dcerpc_check_auth(auth, pkt,
1731                                    &pkt->u.request.stub_and_verifier,
1732                                    hdr_size, raw_pkt,
1733                                    &pad_len);
1734         if (!NT_STATUS_IS_OK(status)) {
1735                 return status;
1736         }
1737
1738
1739         /* remove padding and auth trailer,
1740          * this way the caller will get just the data */
1741         if (pkt->auth_length) {
1742                 size_t trail_len = pad_len
1743                                         + DCERPC_AUTH_TRAILER_LENGTH
1744                                         + pkt->auth_length;
1745                 if (pkt->u.request.stub_and_verifier.length < trail_len) {
1746                         return NT_STATUS_INFO_LENGTH_MISMATCH;
1747                 }
1748                 pkt->u.request.stub_and_verifier.length -= trail_len;
1749         }
1750
1751         return NT_STATUS_OK;
1752 }
1753
1754 /****************************************************************************
1755  Processes a request pdu. This will do auth processing if needed, and
1756  appends the data into the complete stream if the LAST flag is not set.
1757 ****************************************************************************/
1758
1759 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1760 {
1761         NTSTATUS status;
1762         DATA_BLOB data;
1763
1764         if (!p->pipe_bound) {
1765                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1766                 set_incoming_fault(p);
1767                 return False;
1768         }
1769
1770         /* Store the opnum */
1771         p->opnum = pkt->u.request.opnum;
1772
1773         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1774         if (!NT_STATUS_IS_OK(status)) {
1775                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1776                           nt_errstr(status)));
1777                 set_incoming_fault(p);
1778                 return false;
1779         }
1780
1781         data = pkt->u.request.stub_and_verifier;
1782
1783         /*
1784          * Check the data length doesn't go over the 15Mb limit.
1785          * increased after observing a bug in the Windows NT 4.0 SP6a
1786          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1787          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1788          */
1789
1790         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1791                 DEBUG(0, ("process_request_pdu: "
1792                           "rpc data buffer too large (%u) + (%u)\n",
1793                           (unsigned int)p->in_data.data.length,
1794                           (unsigned int)data.length));
1795                 set_incoming_fault(p);
1796                 return False;
1797         }
1798
1799         /*
1800          * Append the data portion into the buffer and return.
1801          */
1802
1803         if (data.length) {
1804                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1805                                           data.data, data.length)) {
1806                         DEBUG(0, ("Unable to append data size %u "
1807                                   "to parse buffer of size %u.\n",
1808                                   (unsigned int)data.length,
1809                                   (unsigned int)p->in_data.data.length));
1810                         set_incoming_fault(p);
1811                         return False;
1812                 }
1813         }
1814
1815         if (pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1816                 bool ret = False;
1817                 /*
1818                  * Ok - we finally have a complete RPC stream.
1819                  * Call the rpc command to process it.
1820                  */
1821
1822                 /*
1823                  * Process the complete data stream here.
1824                  */
1825                 if (pipe_init_outgoing_data(p)) {
1826                         ret = api_pipe_request(p, pkt);
1827                 }
1828
1829                 return ret;
1830         }
1831
1832         return True;
1833 }
1834
1835 /****************************************************************************
1836  Processes a finished PDU stored in p->in_data.pdu.
1837 ****************************************************************************/
1838
1839 void process_complete_pdu(struct pipes_struct *p)
1840 {
1841         struct ncacn_packet *pkt = NULL;
1842         NTSTATUS status;
1843         bool reply = False;
1844
1845         if(p->fault_state) {
1846                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
1847                           get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1848                 goto done;
1849         }
1850
1851         pkt = talloc(p->mem_ctx, struct ncacn_packet);
1852         if (!pkt) {
1853                 DEBUG(0, ("Out of memory!\n"));
1854                 goto done;
1855         }
1856
1857         /*
1858          * Ensure we're using the corrent endianness for both the
1859          * RPC header flags and the raw data we will be reading from.
1860          */
1861         if (dcerpc_get_endian_flag(&p->in_data.pdu) & DCERPC_DREP_LE) {
1862                 p->endian = RPC_LITTLE_ENDIAN;
1863         } else {
1864                 p->endian = RPC_BIG_ENDIAN;
1865         }
1866         DEBUG(10, ("PDU is in %s Endian format!\n", p->endian?"Big":"Little"));
1867
1868         status = dcerpc_pull_ncacn_packet(pkt, &p->in_data.pdu,
1869                                           pkt, p->endian);
1870         if (!NT_STATUS_IS_OK(status)) {
1871                 DEBUG(0, ("Failed to unmarshal rpc packet: %s!\n",
1872                           nt_errstr(status)));
1873                 goto done;
1874         }
1875
1876         /* Store the call_id */
1877         p->call_id = pkt->call_id;
1878
1879         DEBUG(10, ("Processing packet type %d\n", (int)pkt->ptype));
1880
1881         switch (pkt->ptype) {
1882         case DCERPC_PKT_REQUEST:
1883                 reply = process_request_pdu(p, pkt);
1884                 break;
1885
1886         case DCERPC_PKT_PING: /* CL request - ignore... */
1887                 DEBUG(0, ("process_complete_pdu: Error. "
1888                           "Connectionless packet type %d received on "
1889                           "pipe %s.\n", (int)pkt->ptype,
1890                          get_pipe_name_from_syntax(talloc_tos(),
1891                                                    &p->syntax)));
1892                 break;
1893
1894         case DCERPC_PKT_RESPONSE: /* No responses here. */
1895                 DEBUG(0, ("process_complete_pdu: Error. "
1896                           "DCERPC_PKT_RESPONSE received from client "
1897                           "on pipe %s.\n",
1898                          get_pipe_name_from_syntax(talloc_tos(),
1899                                                    &p->syntax)));
1900                 break;
1901
1902         case DCERPC_PKT_FAULT:
1903         case DCERPC_PKT_WORKING:
1904                 /* CL request - reply to a ping when a call in process. */
1905         case DCERPC_PKT_NOCALL:
1906                 /* CL - server reply to a ping call. */
1907         case DCERPC_PKT_REJECT:
1908         case DCERPC_PKT_ACK:
1909         case DCERPC_PKT_CL_CANCEL:
1910         case DCERPC_PKT_FACK:
1911         case DCERPC_PKT_CANCEL_ACK:
1912                 DEBUG(0, ("process_complete_pdu: Error. "
1913                           "Connectionless packet type %u received on "
1914                           "pipe %s.\n", (unsigned int)pkt->ptype,
1915                          get_pipe_name_from_syntax(talloc_tos(),
1916                                                    &p->syntax)));
1917                 break;
1918
1919         case DCERPC_PKT_BIND:
1920                 /*
1921                  * We assume that a pipe bind is only in one pdu.
1922                  */
1923                 if (pipe_init_outgoing_data(p)) {
1924                         reply = api_pipe_bind_req(p, pkt);
1925                 }
1926                 break;
1927
1928         case DCERPC_PKT_BIND_ACK:
1929         case DCERPC_PKT_BIND_NAK:
1930                 DEBUG(0, ("process_complete_pdu: Error. "
1931                           "DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1932                           "packet type %u received on pipe %s.\n",
1933                           (unsigned int)pkt->ptype,
1934                          get_pipe_name_from_syntax(talloc_tos(),
1935                                                    &p->syntax)));
1936                 break;
1937
1938
1939         case DCERPC_PKT_ALTER:
1940                 /*
1941                  * We assume that a pipe bind is only in one pdu.
1942                  */
1943                 if (pipe_init_outgoing_data(p)) {
1944                         reply = api_pipe_alter_context(p, pkt);
1945                 }
1946                 break;
1947
1948         case DCERPC_PKT_ALTER_RESP:
1949                 DEBUG(0, ("process_complete_pdu: Error. "
1950                           "DCERPC_PKT_ALTER_RESP on pipe %s: "
1951                           "Should only be server -> client.\n",
1952                          get_pipe_name_from_syntax(talloc_tos(),
1953                                                    &p->syntax)));
1954                 break;
1955
1956         case DCERPC_PKT_AUTH3:
1957                 /*
1958                  * The third packet in an auth exchange.
1959                  */
1960                 if (pipe_init_outgoing_data(p)) {
1961                         reply = api_pipe_bind_auth3(p, pkt);
1962                 }
1963                 break;
1964
1965         case DCERPC_PKT_SHUTDOWN:
1966                 DEBUG(0, ("process_complete_pdu: Error. "
1967                           "DCERPC_PKT_SHUTDOWN on pipe %s: "
1968                           "Should only be server -> client.\n",
1969                          get_pipe_name_from_syntax(talloc_tos(),
1970                                                    &p->syntax)));
1971                 break;
1972
1973         case DCERPC_PKT_CO_CANCEL:
1974                 /* For now just free all client data and continue
1975                  * processing. */
1976                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1977                          " Abandoning rpc call.\n"));
1978                 /* As we never do asynchronous RPC serving, we can
1979                  * never cancel a call (as far as I know).
1980                  * If we ever did we'd have to send a cancel_ack reply.
1981                  * For now, just free all client data and continue
1982                  * processing. */
1983                 reply = True;
1984                 break;
1985
1986 #if 0
1987                 /* Enable this if we're doing async rpc. */
1988                 /* We must check the outstanding callid matches. */
1989                 if (pipe_init_outgoing_data(p)) {
1990                         /* Send a cancel_ack PDU reply. */
1991                         /* We should probably check the auth-verifier here. */
1992                         reply = setup_cancel_ack_reply(p, pkt);
1993                 }
1994                 break;
1995 #endif
1996
1997         case DCERPC_PKT_ORPHANED:
1998                 /* We should probably check the auth-verifier here.
1999                  * For now just free all client data and continue
2000                  * processing. */
2001                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
2002                           " Abandoning rpc call.\n"));
2003                 reply = True;
2004                 break;
2005
2006         default:
2007                 DEBUG(0, ("process_complete_pdu: "
2008                           "Unknown rpc type = %u received.\n",
2009                           (unsigned int)pkt->ptype));
2010                 break;
2011         }
2012
2013 done:
2014         if (!reply) {
2015                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on "
2016                          "pipe %s\n", get_pipe_name_from_syntax(talloc_tos(),
2017                                                                 &p->syntax)));
2018                 set_incoming_fault(p);
2019                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2020                 TALLOC_FREE(pkt);
2021         } else {
2022                 /*
2023                  * Reset the lengths. We're ready for a new pdu.
2024                  */
2025                 TALLOC_FREE(p->in_data.pdu.data);
2026                 p->in_data.pdu_needed_len = 0;
2027                 p->in_data.pdu.length = 0;
2028         }
2029
2030         TALLOC_FREE(pkt);
2031 }
2032