source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "srv_pipe_internal.h"
  32 #include "../librpc/gen_ndr/ndr_schannel.h"
  33 #include "../libcli/auth/schannel.h"
  34 #include "../libcli/auth/spnego.h"
  35 #include "../libcli/auth/ntlmssp.h"
  36
  37 #undef DBGC_CLASS
  38 #define DBGC_CLASS DBGC_RPC_SRV
  39
  40 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  41 {
  42         struct auth_ntlmssp_state *a = auth->a_u.auth_ntlmssp_state;
  43
  44         if (a) {
  45                 auth_ntlmssp_end(&a);
  46         }
  47         auth->a_u.auth_ntlmssp_state = NULL;
  48 }
  49
  50 static DATA_BLOB generic_session_key(void)
  51 {
  52         return data_blob("SystemLibraryDTC", 16);
  53 }
  54
  55 /*******************************************************************
  56  Generate the next PDU to be returned from the data in p->rdata.
  57  Handle NTLMSSP.
  58  ********************************************************************/
  59
  60 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  61 {
  62         DATA_BLOB hdr;
  63         uint8_t hdr_flags;
  64         RPC_HDR_RESP hdr_resp;
  65         uint32 ss_padding_len = 0;
  66         uint32 data_space_available;
  67         uint32 data_len_left;
  68         uint32 data_len;
  69         NTSTATUS status;
  70         DATA_BLOB auth_blob;
  71         RPC_HDR_AUTH auth_info;
  72         uint8 auth_type, auth_level;
  73         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
  74         TALLOC_CTX *frame;
  75
  76         /*
  77          * If we're in the fault state, keep returning fault PDU's until
  78          * the pipe gets closed. JRA.
  79          */
  80
  81         if(p->fault_state) {
  82                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  83                 return True;
  84         }
  85
  86         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  87
  88         /* Set up rpc header flags. */
  89         if (p->out_data.data_sent_length == 0) {
  90                 hdr_flags = DCERPC_PFC_FLAG_FIRST;
  91         } else {
  92                 hdr_flags = 0;
  93         }
  94
  95         /*
  96          * Work out how much we can fit in a single PDU.
  97          */
  98
  99         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 100
 101         /*
 102          * Ensure there really is data left to send.
 103          */
 104
 105         if(!data_len_left) {
 106                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 107                 return False;
 108         }
 109
 110         /* Space available - not including padding. */
 111         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN -
 112                 RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 113
 114         /*
 115          * The amount we send is the minimum of the available
 116          * space and the amount left to send.
 117          */
 118
 119         data_len = MIN(data_len_left, data_space_available);
 120
 121         /* Work out any padding alignment requirements. */
 122         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 123                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 124                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 125                 DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 126                         ss_padding_len ));
 127                 /* If we're over filling the packet, we need to make space
 128                  * for the padding at the end of the data. */
 129                 if (data_len + ss_padding_len > data_space_available) {
 130                         data_len -= SERVER_NDR_PADDING_SIZE;
 131                 }
 132         }
 133
 134         /*
 135          * Set up the alloc hint. This should be the data left to
 136          * send.
 137          */
 138
 139         hdr_resp.alloc_hint = data_len_left;
 140
 141         /*
 142          * Work out if this PDU will be the last.
 143          */
 144         if (p->out_data.data_sent_length + data_len >=
 145                                         prs_offset(&p->out_data.rdata)) {
 146                 hdr_flags |= DCERPC_PFC_FLAG_LAST;
 147         }
 148
 149         /*
 150          * Init the parse struct to point at the outgoing
 151          * data.
 152          */
 153         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 154
 155         status = dcerpc_push_ncacn_packet_header(
 156                                 prs_get_mem_context(&p->out_data.frag),
 157                                 DCERPC_PKT_RESPONSE,
 158                                 hdr_flags,
 159                                 RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 160                                   data_len + ss_padding_len +
 161                                   RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE,
 162                                 NTLMSSP_SIG_SIZE,
 163                                 p->hdr.call_id,
 164                                 &hdr);
 165         if (!NT_STATUS_IS_OK(status)) {
 166                 DEBUG(0, ("Failed to marshall RPC Header.\n"));
 167                 prs_mem_free(&p->out_data.frag);
 168                 return False;
 169         }
 170
 171         /* Store the header in the data stream. */
 172         if (!prs_copy_data_in(&p->out_data.frag,
 173                                 (char *)hdr.data, hdr.length)) {
 174                 DEBUG(0, ("Out of memory.\n"));
 175                 prs_mem_free(&p->out_data.frag);
 176                 return False;
 177         }
 178
 179         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 180                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 181                 prs_mem_free(&p->out_data.frag);
 182                 return False;
 183         }
 184
 185         /* Copy the data into the PDU. */
 186
 187         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 188                                      p->out_data.data_sent_length, data_len)) {
 189                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 190                 prs_mem_free(&p->out_data.frag);
 191                 return False;
 192         }
 193
 194         /* Copy the sign/seal padding data. */
 195         if (ss_padding_len) {
 196                 char pad[SERVER_NDR_PADDING_SIZE];
 197
 198                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 199                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 200                                       ss_padding_len)) {
 201                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 202                                         (unsigned int)ss_padding_len));
 203                         prs_mem_free(&p->out_data.frag);
 204                         return False;
 205                 }
 206         }
 207
 208
 209         /* Now write out the auth header and null blob. */
 210         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 211                 auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 212         } else {
 213                 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 214         }
 215         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 216                 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 217         } else {
 218                 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 219         }
 220
 221         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 222
 223         if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 224                                 &p->out_data.frag, 0)) {
 225                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 226                 prs_mem_free(&p->out_data.frag);
 227                 return False;
 228         }
 229
 230         /* Generate the sign blob. */
 231
 232         frame = talloc_stackframe();
 233         switch (p->auth.auth_level) {
 234                 case DCERPC_AUTH_LEVEL_PRIVACY:
 235                         /* Data portion is encrypted. */
 236                         status = auth_ntlmssp_seal_packet(
 237                                 a, frame,
 238                                 (uint8_t *)prs_data_p(&p->out_data.frag)
 239                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 240                                 data_len + ss_padding_len,
 241                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 242                                 (size_t)prs_offset(&p->out_data.frag),
 243                                 &auth_blob);
 244                         if (!NT_STATUS_IS_OK(status)) {
 245                                 talloc_free(frame);
 246                                 prs_mem_free(&p->out_data.frag);
 247                                 return False;
 248                         }
 249                         break;
 250                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 251                         /* Data is signed. */
 252                         status = auth_ntlmssp_sign_packet(
 253                                 a, frame,
 254                                 (unsigned char *)prs_data_p(&p->out_data.frag)
 255                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 256                                 data_len + ss_padding_len,
 257                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 258                                 (size_t)prs_offset(&p->out_data.frag),
 259                                 &auth_blob);
 260                         if (!NT_STATUS_IS_OK(status)) {
 261                                 talloc_free(frame);
 262                                 prs_mem_free(&p->out_data.frag);
 263                                 return False;
 264                         }
 265                         break;
 266                 default:
 267                         talloc_free(frame);
 268                         prs_mem_free(&p->out_data.frag);
 269                         return False;
 270         }
 271
 272         /* Append the auth blob. */
 273         if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
 274                               NTLMSSP_SIG_SIZE)) {
 275                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 276                                 (unsigned int)NTLMSSP_SIG_SIZE));
 277                 talloc_free(frame);
 278                 prs_mem_free(&p->out_data.frag);
 279                 return False;
 280         }
 281         talloc_free(frame);
 282
 283         /*
 284          * Setup the counts for this PDU.
 285          */
 286
 287         p->out_data.data_sent_length += data_len;
 288         p->out_data.current_pdu_sent = 0;
 289
 290         return True;
 291 }
 292
 293 /*******************************************************************
 294  Generate the next PDU to be returned from the data in p->rdata.
 295  Return an schannel authenticated fragment.
 296  ********************************************************************/
 297
 298 static bool create_next_pdu_schannel(pipes_struct *p)
 299 {
 300         RPC_HDR_RESP hdr_resp;
 301         uint32 ss_padding_len = 0;
 302         uint32 data_len;
 303         uint32 data_space_available;
 304         uint32 data_len_left;
 305         uint32 data_pos;
 306         NTSTATUS status;
 307
 308         /*
 309          * If we're in the fault state, keep returning fault PDU's until
 310          * the pipe gets closed. JRA.
 311          */
 312
 313         if(p->fault_state) {
 314                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 315                 return True;
 316         }
 317
 318         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 319
 320         /* Change the incoming request header to a response. */
 321         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
 322
 323         /* Set up rpc header flags. */
 324         if (p->out_data.data_sent_length == 0) {
 325                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
 326         } else {
 327                 p->hdr.flags = 0;
 328         }
 329
 330         /*
 331          * Work out how much we can fit in a single PDU.
 332          */
 333
 334         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 335
 336         /*
 337          * Ensure there really is data left to send.
 338          */
 339
 340         if(!data_len_left) {
 341                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 342                 return False;
 343         }
 344
 345         /* Space available - not including padding. */
 346         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 347                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
 348                 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 349
 350         /*
 351          * The amount we send is the minimum of the available
 352          * space and the amount left to send.
 353          */
 354
 355         data_len = MIN(data_len_left, data_space_available);
 356
 357         /* Work out any padding alignment requirements. */
 358         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 359                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 360                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 361                 DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 362                         ss_padding_len ));
 363                 /* If we're over filling the packet, we need to make space
 364                  * for the padding at the end of the data. */
 365                 if (data_len + ss_padding_len > data_space_available) {
 366                         data_len -= SERVER_NDR_PADDING_SIZE;
 367                 }
 368         }
 369
 370         /*
 371          * Set up the alloc hint. This should be the data left to
 372          * send.
 373          */
 374
 375         hdr_resp.alloc_hint = data_len_left;
 376
 377         /*
 378          * Work out if this PDU will be the last.
 379          */
 380
 381         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 382                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 383         }
 384
 385         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 386                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 387         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 388
 389         /*
 390          * Init the parse struct to point at the outgoing
 391          * data.
 392          */
 393
 394         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 395
 396         /* Store the header in the data stream. */
 397         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 398                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 399                 prs_mem_free(&p->out_data.frag);
 400                 return False;
 401         }
 402
 403         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 404                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 405                 prs_mem_free(&p->out_data.frag);
 406                 return False;
 407         }
 408
 409         /* Store the current offset. */
 410         data_pos = prs_offset(&p->out_data.frag);
 411
 412         /* Copy the data into the PDU. */
 413
 414         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 415                                      p->out_data.data_sent_length, data_len)) {
 416                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 417                 prs_mem_free(&p->out_data.frag);
 418                 return False;
 419         }
 420
 421         /* Copy the sign/seal padding data. */
 422         if (ss_padding_len) {
 423                 char pad[SERVER_NDR_PADDING_SIZE];
 424                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 425                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 426                                       ss_padding_len)) {
 427                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 428                         prs_mem_free(&p->out_data.frag);
 429                         return False;
 430                 }
 431         }
 432
 433         {
 434                 /*
 435                  * Schannel processing.
 436                  */
 437                 RPC_HDR_AUTH auth_info;
 438                 DATA_BLOB blob;
 439                 uint8_t *data;
 440
 441                 /* Check it's the type of reply we were expecting to decode */
 442
 443                 init_rpc_hdr_auth(&auth_info,
 444                                 DCERPC_AUTH_TYPE_SCHANNEL,
 445                                 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
 446                                         DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
 447                                 ss_padding_len, 1);
 448
 449                 if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 450                                         &p->out_data.frag, 0)) {
 451                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 452                         prs_mem_free(&p->out_data.frag);
 453                         return False;
 454                 }
 455
 456                 data = (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos;
 457
 458                 switch (p->auth.auth_level) {
 459                 case DCERPC_AUTH_LEVEL_PRIVACY:
 460                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 461                                                         talloc_tos(),
 462                                                         true,
 463                                                         data,
 464                                                         data_len + ss_padding_len,
 465                                                         &blob);
 466                         break;
 467                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 468                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 469                                                         talloc_tos(),
 470                                                         false,
 471                                                         data,
 472                                                         data_len + ss_padding_len,
 473                                                         &blob);
 474                         break;
 475                 default:
 476                         status = NT_STATUS_INTERNAL_ERROR;
 477                         break;
 478                 }
 479
 480                 if (!NT_STATUS_IS_OK(status)) {
 481                         DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
 482                                 nt_errstr(status)));
 483                         prs_mem_free(&p->out_data.frag);
 484                         return false;
 485                 }
 486
 487                 /* Finally marshall the blob. */
 488
 489                 if (DEBUGLEVEL >= 10) {
 490                         dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
 491                 }
 492
 493                 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
 494                         prs_mem_free(&p->out_data.frag);
 495                         return false;
 496                 }
 497         }
 498
 499         /*
 500          * Setup the counts for this PDU.
 501          */
 502
 503         p->out_data.data_sent_length += data_len;
 504         p->out_data.current_pdu_sent = 0;
 505
 506         return True;
 507 }
 508
 509 /*******************************************************************
 510  Generate the next PDU to be returned from the data in p->rdata.
 511  No authentication done.
 512 ********************************************************************/
 513
 514 static bool create_next_pdu_noauth(pipes_struct *p)
 515 {
 516         RPC_HDR_RESP hdr_resp;
 517         uint32 data_len;
 518         uint32 data_space_available;
 519         uint32 data_len_left;
 520
 521         /*
 522          * If we're in the fault state, keep returning fault PDU's until
 523          * the pipe gets closed. JRA.
 524          */
 525
 526         if(p->fault_state) {
 527                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 528                 return True;
 529         }
 530
 531         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 532
 533         /* Change the incoming request header to a response. */
 534         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
 535
 536         /* Set up rpc header flags. */
 537         if (p->out_data.data_sent_length == 0) {
 538                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
 539         } else {
 540                 p->hdr.flags = 0;
 541         }
 542
 543         /*
 544          * Work out how much we can fit in a single PDU.
 545          */
 546
 547         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 548
 549         /*
 550          * Ensure there really is data left to send.
 551          */
 552
 553         if(!data_len_left) {
 554                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 555                 return False;
 556         }
 557
 558         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 559                 - RPC_HDR_RESP_LEN;
 560
 561         /*
 562          * The amount we send is the minimum of the available
 563          * space and the amount left to send.
 564          */
 565
 566         data_len = MIN(data_len_left, data_space_available);
 567
 568         /*
 569          * Set up the alloc hint. This should be the data left to
 570          * send.
 571          */
 572
 573         hdr_resp.alloc_hint = data_len_left;
 574
 575         /*
 576          * Work out if this PDU will be the last.
 577          */
 578
 579         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 580                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 581         }
 582
 583         /*
 584          * Set up the header lengths.
 585          */
 586
 587         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 588         p->hdr.auth_len = 0;
 589
 590         /*
 591          * Init the parse struct to point at the outgoing
 592          * data.
 593          */
 594
 595         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 596
 597         /* Store the header in the data stream. */
 598         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 599                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 600                 prs_mem_free(&p->out_data.frag);
 601                 return False;
 602         }
 603
 604         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 605                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 606                 prs_mem_free(&p->out_data.frag);
 607                 return False;
 608         }
 609
 610         /* Copy the data into the PDU. */
 611
 612         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 613                                      p->out_data.data_sent_length, data_len)) {
 614                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 615                 prs_mem_free(&p->out_data.frag);
 616                 return False;
 617         }
 618
 619         /*
 620          * Setup the counts for this PDU.
 621          */
 622
 623         p->out_data.data_sent_length += data_len;
 624         p->out_data.current_pdu_sent = 0;
 625
 626         return True;
 627 }
 628
 629 /*******************************************************************
 630  Generate the next PDU to be returned from the data in p->rdata.
 631 ********************************************************************/
 632
 633 bool create_next_pdu(pipes_struct *p)
 634 {
 635         switch(p->auth.auth_level) {
 636                 case DCERPC_AUTH_LEVEL_NONE:
 637                 case DCERPC_AUTH_LEVEL_CONNECT:
 638                         /* This is incorrect for auth level connect. Fixme. JRA */
 639                         return create_next_pdu_noauth(p);
 640
 641                 default:
 642                         switch(p->auth.auth_type) {
 643                                 case PIPE_AUTH_TYPE_NTLMSSP:
 644                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 645                                         return create_next_pdu_ntlmssp(p);
 646                                 case PIPE_AUTH_TYPE_SCHANNEL:
 647                                         return create_next_pdu_schannel(p);
 648                                 default:
 649                                         break;
 650                         }
 651         }
 652
 653         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 654                         (unsigned int)p->auth.auth_level,
 655                         (unsigned int)p->auth.auth_type));
 656         return False;
 657 }
 658
 659 /*******************************************************************
 660  Process an NTLMSSP authentication response.
 661  If this function succeeds, the user has been authenticated
 662  and their domain, name and calling workstation stored in
 663  the pipe struct.
 664 *******************************************************************/
 665
 666 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 667 {
 668         DATA_BLOB session_key, reply;
 669         NTSTATUS status;
 670         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
 671         bool ret;
 672
 673         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
 674                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 675
 676         ZERO_STRUCT(reply);
 677
 678         /* this has to be done as root in order to verify the password */
 679         become_root();
 680         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 681         unbecome_root();
 682
 683         /* Don't generate a reply. */
 684         data_blob_free(&reply);
 685
 686         if (!NT_STATUS_IS_OK(status)) {
 687                 return False;
 688         }
 689
 690         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 691            ensure the underlying NTLMSSP flags are also set. If not we should
 692            refuse the bind. */
 693
 694         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
 695                 if (!auth_ntlmssp_negotiated_sign(a)) {
 696                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 697                                 "but client declined signing.\n",
 698                                  get_pipe_name_from_syntax(talloc_tos(),
 699                                                            &p->syntax)));
 700                         return False;
 701                 }
 702         }
 703         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 704                 if (!auth_ntlmssp_negotiated_seal(a)) {
 705                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 706                                 "but client declined sealing.\n",
 707                                  get_pipe_name_from_syntax(talloc_tos(),
 708                                                            &p->syntax)));
 709                         return False;
 710                 }
 711         }
 712
 713         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 714                   "workstation: %s\n",
 715                   auth_ntlmssp_get_username(a),
 716                   auth_ntlmssp_get_domain(a),
 717                   auth_ntlmssp_get_client(a)));
 718
 719         TALLOC_FREE(p->server_info);
 720
 721         p->server_info = auth_ntlmssp_server_info(p, a);
 722         if (p->server_info == NULL) {
 723                 DEBUG(0, ("auth_ntlmssp_server_info failed to obtain the server info for authenticated user\n"));
 724                 return false;
 725         }
 726
 727         if (p->server_info->ptok == NULL) {
 728                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 729                 return False;
 730         }
 731
 732         /*
 733          * We're an authenticated bind over smb, so the session key needs to
 734          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 735          * does. See the RPC-SAMBA3SESSIONKEY.
 736          */
 737
 738         session_key = generic_session_key();
 739         if (session_key.data == NULL) {
 740                 return False;
 741         }
 742
 743         ret = server_info_set_session_key(p->server_info, session_key);
 744
 745         data_blob_free(&session_key);
 746
 747         return True;
 748 }
 749
 750 /*******************************************************************
 751  This is the "stage3" NTLMSSP response after a bind request and reply.
 752 *******************************************************************/
 753
 754 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 755 {
 756         struct dcerpc_auth auth_info;
 757         uint32 pad = 0;
 758         DATA_BLOB auth_blob;
 759         uint32_t auth_len = p->hdr.auth_len;
 760         NTSTATUS status;
 761
 762         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 763
 764         if (auth_len == 0) {
 765                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 766                 goto err;
 767         }
 768
 769         /* 4 bytes padding. */
 770         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 771                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 772                 goto err;
 773         }
 774
 775         /* Ensure there's enough data for an authenticated request. */
 776         if (RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + auth_len >
 777                                 p->hdr.frag_len) {
 778                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
 779                                 "%u is too large.\n",
 780                         (unsigned int)auth_len ));
 781                 goto err;
 782         }
 783
 784         /*
 785          * Decode the authentication verifier response.
 786          */
 787
 788         /* Pull the auth header and the following data into a blob. */
 789         /* NB. The offset of the auth_header is relative to the *end*
 790          * of the packet, not the start. Also, the length of the
 791          * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
 792          * as the RPC header isn't included in rpc_in_p. */
 793         if(!prs_set_offset(rpc_in_p,
 794                         p->hdr.frag_len - RPC_HEADER_LEN -
 795                         RPC_HDR_AUTH_LEN - auth_len)) {
 796                 DEBUG(0,("api_pipe_bind_auth3: cannot move "
 797                         "offset to %u.\n",
 798                         (unsigned int)(p->hdr.frag_len -
 799                                 RPC_HDR_AUTH_LEN - auth_len) ));
 800                 goto err;
 801         }
 802
 803         auth_blob = data_blob_const(prs_data_p(rpc_in_p)
 804                                         + prs_offset(rpc_in_p),
 805                                     prs_data_size(rpc_in_p)
 806                                         - prs_offset(rpc_in_p));
 807
 808         status = dcerpc_pull_dcerpc_auth(prs_get_mem_context(rpc_in_p),
 809                                          &auth_blob, &auth_info);
 810         if (!NT_STATUS_IS_OK(status)) {
 811                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
 812                 goto err;
 813         }
 814
 815         /* We must NEVER look at auth_info->auth_pad_len here,
 816          * as old Samba client code gets it wrong and sends it
 817          * as zero. JRA.
 818          */
 819
 820         if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
 821                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 822                         (unsigned int)auth_info.auth_type ));
 823                 return False;
 824         }
 825
 826         /*
 827          * The following call actually checks the challenge/response data.
 828          * for correctness against the given DOMAIN\user name.
 829          */
 830
 831         if (!pipe_ntlmssp_verify_final(p, &auth_info.credentials)) {
 832                 goto err;
 833         }
 834
 835         p->pipe_bound = True;
 836
 837         return True;
 838
 839  err:
 840
 841         free_pipe_ntlmssp_auth_data(&p->auth);
 842         p->auth.a_u.auth_ntlmssp_state = NULL;
 843
 844         return False;
 845 }
 846
 847 /*******************************************************************
 848  Marshall a bind_nak pdu.
 849 *******************************************************************/
 850
 851 static bool setup_bind_nak(pipes_struct *p)
 852 {
 853         NTSTATUS status;
 854         union dcerpc_payload u;
 855         DATA_BLOB blob;
 856
 857         /* Free any memory in the current return data buffer. */
 858         prs_mem_free(&p->out_data.rdata);
 859
 860         /*
 861          * Marshall directly into the outgoing PDU space. We
 862          * must do this as we need to set to the bind response
 863          * header and are never sending more than one PDU here.
 864          */
 865
 866         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 867
 868         /*
 869          * Initialize a bind_nak header.
 870          */
 871
 872         ZERO_STRUCT(u);
 873
 874         u.bind_nak.reject_reason  = 0;
 875
 876         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 877                                           DCERPC_PKT_BIND_NAK,
 878                                           DCERPC_PFC_FLAG_FIRST |
 879                                                 DCERPC_PFC_FLAG_LAST,
 880                                           0,
 881                                           p->hdr.call_id,
 882                                           u,
 883                                           &blob);
 884         if (!NT_STATUS_IS_OK(status)) {
 885                 prs_mem_free(&p->out_data.frag);
 886                 return False;
 887         }
 888
 889         if (!prs_copy_data_in(&p->out_data.frag,
 890                               (char *)blob.data, blob.length)) {
 891                 prs_mem_free(&p->out_data.frag);
 892                 return False;
 893         }
 894
 895         p->out_data.data_sent_length = 0;
 896         p->out_data.current_pdu_sent = 0;
 897
 898         if (p->auth.auth_data_free_func) {
 899                 (*p->auth.auth_data_free_func)(&p->auth);
 900         }
 901         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 902         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 903         p->pipe_bound = False;
 904
 905         return True;
 906 }
 907
 908 /*******************************************************************
 909  Marshall a fault pdu.
 910 *******************************************************************/
 911
 912 bool setup_fault_pdu(pipes_struct *p, NTSTATUS fault_status)
 913 {
 914         NTSTATUS status;
 915         union dcerpc_payload u;
 916         DATA_BLOB blob;
 917
 918         /* Free any memory in the current return data buffer. */
 919         prs_mem_free(&p->out_data.rdata);
 920
 921         /*
 922          * Marshall directly into the outgoing PDU space. We
 923          * must do this as we need to set to the bind response
 924          * header and are never sending more than one PDU here.
 925          */
 926
 927         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 928
 929         /*
 930          * Initialize a fault header.
 931          */
 932
 933         ZERO_STRUCT(u);
 934
 935         u.fault.status          = NT_STATUS_V(fault_status);
 936         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 937
 938         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 939                                           DCERPC_PKT_FAULT,
 940                                           DCERPC_PFC_FLAG_FIRST |
 941                                            DCERPC_PFC_FLAG_LAST |
 942                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 943                                           0,
 944                                           p->hdr.call_id,
 945                                           u,
 946                                           &blob);
 947         if (!NT_STATUS_IS_OK(status)) {
 948                 prs_mem_free(&p->out_data.frag);
 949                 return False;
 950         }
 951
 952         if (!prs_copy_data_in(&p->out_data.frag,
 953                               (char *)blob.data, blob.length)) {
 954                 prs_mem_free(&p->out_data.frag);
 955                 return False;
 956         }
 957
 958         p->out_data.data_sent_length = 0;
 959         p->out_data.current_pdu_sent = 0;
 960
 961         return True;
 962 }
 963
 964 /*******************************************************************
 965  Ensure a bind request has the correct abstract & transfer interface.
 966  Used to reject unknown binds from Win2k.
 967 *******************************************************************/
 968
 969 static bool check_bind_req(struct pipes_struct *p,
 970                            struct ndr_syntax_id* abstract,
 971                            struct ndr_syntax_id* transfer,
 972                            uint32 context_id)
 973 {
 974         struct pipe_rpc_fns *context_fns;
 975
 976         DEBUG(3,("check_bind_req for %s\n",
 977                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 978
 979         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 980         if (rpc_srv_pipe_exists_by_id(abstract) &&
 981            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 982                 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 983                         rpc_srv_get_pipe_cli_name(abstract),
 984                         rpc_srv_get_pipe_srv_name(abstract)));
 985         } else {
 986                 return false;
 987         }
 988
 989         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 990         if (context_fns == NULL) {
 991                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 992                 return False;
 993         }
 994
 995         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 996         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 997         context_fns->context_id = context_id;
 998
 999         /* add to the list of open contexts */
1000
1001         DLIST_ADD( p->contexts, context_fns );
1002
1003         return True;
1004 }
1005
1006 /**
1007  * Is a named pipe known?
1008  * @param[in] cli_filename      The pipe name requested by the client
1009  * @result                      Do we want to serve this?
1010  */
1011 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1012 {
1013         const char *pipename = cli_filename;
1014         NTSTATUS status;
1015
1016         if (strnequal(pipename, "\\PIPE\\", 6)) {
1017                 pipename += 5;
1018         }
1019
1020         if (*pipename == '\\') {
1021                 pipename += 1;
1022         }
1023
1024         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1025                 DEBUG(10, ("refusing spoolss access\n"));
1026                 return false;
1027         }
1028
1029         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1030                 return true;
1031         }
1032
1033         status = smb_probe_module("rpc", pipename);
1034         if (!NT_STATUS_IS_OK(status)) {
1035                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1036                 return false;
1037         }
1038         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
1039
1040         /*
1041          * Scan the list again for the interface id
1042          */
1043         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1044                 return true;
1045         }
1046
1047         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
1048                    pipename));
1049
1050         return false;
1051 }
1052
1053 /*******************************************************************
1054  Handle a SPNEGO krb5 bind auth.
1055 *******************************************************************/
1056
1057 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p,
1058                                            prs_struct *rpc_in_p,
1059                                            struct dcerpc_auth *pauth_info,
1060                                            DATA_BLOB *psecblob,
1061                                            prs_struct *pout_auth)
1062 {
1063         return False;
1064 }
1065
1066 /*******************************************************************
1067  Handle the first part of a SPNEGO bind auth.
1068 *******************************************************************/
1069
1070 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p,
1071                                             prs_struct *rpc_in_p,
1072                                             uint32_t ss_padding_len,
1073                                             struct dcerpc_auth *pauth_info,
1074                                             prs_struct *pout_auth)
1075 {
1076         DATA_BLOB blob;
1077         DATA_BLOB secblob;
1078         DATA_BLOB response;
1079         DATA_BLOB chal;
1080         char *OIDs[ASN1_MAX_OIDS];
1081         int i;
1082         NTSTATUS status;
1083         bool got_kerberos_mechanism = false;
1084         struct auth_ntlmssp_state *a = NULL;
1085
1086         ZERO_STRUCT(secblob);
1087         ZERO_STRUCT(chal);
1088         ZERO_STRUCT(response);
1089
1090         if (pauth_info->credentials.data[0] != ASN1_APPLICATION(0)) {
1091                 goto err;
1092         }
1093
1094         /* parse out the OIDs and the first sec blob */
1095         if (!parse_negTokenTarg(pauth_info->credentials, OIDs, &secblob)) {
1096                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1097                 goto err;
1098         }
1099
1100         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1101                 got_kerberos_mechanism = true;
1102         }
1103
1104         for (i=0;OIDs[i];i++) {
1105                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1106                 TALLOC_FREE(OIDs[i]);
1107         }
1108         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1109
1110         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1111                 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1112                 data_blob_free(&secblob);
1113                 return ret;
1114         }
1115
1116         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1117                 /* Free any previous auth type. */
1118                 free_pipe_ntlmssp_auth_data(&p->auth);
1119         }
1120
1121         if (!got_kerberos_mechanism) {
1122                 /* Initialize the NTLM engine. */
1123                 status = auth_ntlmssp_start(&a);
1124                 if (!NT_STATUS_IS_OK(status)) {
1125                         goto err;
1126                 }
1127
1128                 switch (pauth_info->auth_level) {
1129                         case DCERPC_AUTH_LEVEL_INTEGRITY:
1130                                 auth_ntlmssp_want_sign(a);
1131                                 break;
1132                         case DCERPC_AUTH_LEVEL_PRIVACY:
1133                                 auth_ntlmssp_want_seal(a);
1134                                 break;
1135                         default:
1136                                 break;
1137                 }
1138                 /*
1139                  * Pass the first security blob of data to it.
1140                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1141                  * which means we need another packet to complete the bind.
1142                  */
1143
1144                 status = auth_ntlmssp_update(a, secblob, &chal);
1145
1146                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1147                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1148                         goto err;
1149                 }
1150
1151                 /* Generate the response blob we need for step 2 of the bind. */
1152                 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1153         } else {
1154                 /*
1155                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1156                  * code to process follow-up packets is not complete
1157                  * yet. JRA.
1158                  */
1159                 response = spnego_gen_auth_response(NULL,
1160                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1161                                         OID_NTLMSSP);
1162         }
1163
1164         /* auth_pad_len will be handled by the caller */
1165
1166         status = dcerpc_push_dcerpc_auth(prs_get_mem_context(pout_auth),
1167                                          DCERPC_AUTH_TYPE_SPNEGO,
1168                                          pauth_info->auth_level,
1169                                          ss_padding_len,
1170                                          1, /* auth_context_id */
1171                                          &response,
1172                                          &blob);
1173         if (!NT_STATUS_IS_OK(status)) {
1174                 DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1175                 goto err;
1176         }
1177
1178         /* Copy the blob into the pout_auth parse struct */
1179         if (!prs_copy_data_in(pout_auth, (char *)blob.data, blob.length)) {
1180                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1181                 goto err;
1182         }
1183
1184         p->auth.a_u.auth_ntlmssp_state = a;
1185         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1186         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1187
1188         data_blob_free(&secblob);
1189         data_blob_free(&chal);
1190         data_blob_free(&response);
1191
1192         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1193         return True;
1194
1195  err:
1196
1197         data_blob_free(&secblob);
1198         data_blob_free(&chal);
1199         data_blob_free(&response);
1200
1201         p->auth.a_u.auth_ntlmssp_state = NULL;
1202
1203         return False;
1204 }
1205
1206 /*******************************************************************
1207  Handle the second part of a SPNEGO bind auth.
1208 *******************************************************************/
1209
1210 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1211                                 uint32_t ss_padding_len,
1212                                 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1213 {
1214         RPC_HDR_AUTH auth_info;
1215         DATA_BLOB spnego_blob;
1216         DATA_BLOB auth_blob;
1217         DATA_BLOB auth_reply;
1218         DATA_BLOB response;
1219         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
1220
1221         ZERO_STRUCT(spnego_blob);
1222         ZERO_STRUCT(auth_blob);
1223         ZERO_STRUCT(auth_reply);
1224         ZERO_STRUCT(response);
1225
1226         /*
1227          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1228          * fail here as 'a' == NULL.
1229          */
1230         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1231                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1232                 goto err;
1233         }
1234
1235         /* Grab the SPNEGO blob. */
1236         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1237
1238         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1239                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1240                         (unsigned int)p->hdr.auth_len ));
1241                 goto err;
1242         }
1243
1244         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1245                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1246                 goto err;
1247         }
1248
1249         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1250                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1251                 goto err;
1252         }
1253
1254         /*
1255          * The following call actually checks the challenge/response data.
1256          * for correctness against the given DOMAIN\user name.
1257          */
1258
1259         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1260                 goto err;
1261         }
1262
1263         data_blob_free(&spnego_blob);
1264         data_blob_free(&auth_blob);
1265
1266         /* Generate the spnego "accept completed" blob - no incoming data. */
1267         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1268
1269         /* FIXME - add auth_pad_len here ! */
1270
1271         /* Copy the blob into the pout_auth parse struct */
1272         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1273                         pauth_info->auth_level, ss_padding_len, 1);
1274         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1275                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1276                 goto err;
1277         }
1278
1279         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1280                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1281                 goto err;
1282         }
1283
1284         data_blob_free(&auth_reply);
1285         data_blob_free(&response);
1286
1287         p->pipe_bound = True;
1288
1289         return True;
1290
1291  err:
1292
1293         data_blob_free(&spnego_blob);
1294         data_blob_free(&auth_blob);
1295         data_blob_free(&auth_reply);
1296         data_blob_free(&response);
1297
1298         free_pipe_ntlmssp_auth_data(&p->auth);
1299         p->auth.a_u.auth_ntlmssp_state = NULL;
1300
1301         return False;
1302 }
1303
1304 /*******************************************************************
1305  Handle an schannel bind auth.
1306 *******************************************************************/
1307
1308 static bool pipe_schannel_auth_bind(pipes_struct *p,
1309                                         prs_struct *rpc_in_p,
1310                                         uint32_t ss_padding_len,
1311                                         struct dcerpc_auth *auth_info,
1312                                         prs_struct *pout_auth)
1313 {
1314         DATA_BLOB auth_blob;
1315         struct NL_AUTH_MESSAGE neg;
1316         struct NL_AUTH_MESSAGE reply;
1317         bool ret;
1318         NTSTATUS status;
1319         struct netlogon_creds_CredentialState *creds;
1320         DATA_BLOB session_key;
1321         enum ndr_err_code ndr_err;
1322         DATA_BLOB blob;
1323
1324         ndr_err = ndr_pull_struct_blob(
1325                         &auth_info->credentials,
1326                         prs_get_mem_context(pout_auth), &neg,
1327                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1328         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1329                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1330                 return false;
1331         }
1332
1333         if (DEBUGLEVEL >= 10) {
1334                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1335         }
1336
1337         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1338                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1339                 return false;
1340         }
1341
1342         /*
1343          * The neg.oem_netbios_computer.a key here must match the remote computer name
1344          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1345          * operations that use credentials.
1346          */
1347
1348         become_root();
1349         status = schannel_get_creds_state(p, lp_private_dir(),
1350                                             neg.oem_netbios_computer.a, &creds);
1351         unbecome_root();
1352
1353         if (!NT_STATUS_IS_OK(status)) {
1354                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1355                 return False;
1356         }
1357
1358         p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1359         if (!p->auth.a_u.schannel_auth) {
1360                 TALLOC_FREE(creds);
1361                 return False;
1362         }
1363
1364         p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1365         p->auth.a_u.schannel_auth->seq_num = 0;
1366         p->auth.a_u.schannel_auth->initiator = false;
1367         p->auth.a_u.schannel_auth->creds = creds;
1368
1369         /*
1370          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1371          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1372          * struct of the person who opened the pipe. I need to test this further. JRA.
1373          *
1374          * VL. As we are mapping this to guest set the generic key
1375          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1376          * W2k3, as it does not allow schannel binds against SAMR and LSA
1377          * anymore.
1378          */
1379
1380         session_key = generic_session_key();
1381         if (session_key.data == NULL) {
1382                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1383                           " key\n"));
1384                 return false;
1385         }
1386
1387         ret = server_info_set_session_key(p->server_info, session_key);
1388
1389         data_blob_free(&session_key);
1390
1391         if (!ret) {
1392                 DEBUG(0, ("server_info_set_session_key failed\n"));
1393                 return false;
1394         }
1395
1396         /*** SCHANNEL verifier ***/
1397
1398         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
1399         reply.Flags                             = 0;
1400         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
1401                                                       * this has any meaning
1402                                                       * here - gd */
1403
1404         ndr_err = ndr_push_struct_blob(&auth_blob, talloc_tos(), &reply,
1405                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1406         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1407                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1408                 return false;
1409         }
1410
1411         if (DEBUGLEVEL >= 10) {
1412                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1413         }
1414
1415         status = dcerpc_push_dcerpc_auth(prs_get_mem_context(pout_auth),
1416                                          DCERPC_AUTH_TYPE_SCHANNEL,
1417                                          auth_info->auth_level,
1418                                          ss_padding_len,
1419                                          1, /* auth_context_id */
1420                                          &auth_blob,
1421                                          &blob);
1422         if (!NT_STATUS_IS_OK(status)) {
1423                 DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1424                 return False;
1425         }
1426
1427         if (!prs_copy_data_in(pout_auth, (const char *)blob.data, blob.length)) {
1428                 return false;
1429         }
1430
1431         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1432                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1433
1434         /* We're finished with this bind - no more packets. */
1435         p->auth.auth_data_free_func = NULL;
1436         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1437
1438         p->pipe_bound = True;
1439
1440         return True;
1441 }
1442
1443 /*******************************************************************
1444  Handle an NTLMSSP bind auth.
1445 *******************************************************************/
1446
1447 static bool pipe_ntlmssp_auth_bind(pipes_struct *p,
1448                                         prs_struct *rpc_in_p,
1449                                         uint32_t ss_padding_len,
1450                                         struct dcerpc_auth *auth_info,
1451                                         prs_struct *pout_auth)
1452 {
1453         DATA_BLOB blob;
1454         DATA_BLOB response;
1455         NTSTATUS status;
1456         struct auth_ntlmssp_state *a = NULL;
1457
1458         ZERO_STRUCT(response);
1459
1460         if (strncmp((char *)auth_info->credentials.data, "NTLMSSP", 7) != 0) {
1461                 DEBUG(0, ("Failed to read NTLMSSP in blob\n"));
1462                 goto err;
1463         }
1464
1465         /* We have an NTLMSSP blob. */
1466         status = auth_ntlmssp_start(&a);
1467         if (!NT_STATUS_IS_OK(status)) {
1468                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1469                         nt_errstr(status) ));
1470                 goto err;
1471         }
1472
1473         switch (auth_info->auth_level) {
1474         case DCERPC_AUTH_LEVEL_INTEGRITY:
1475                 auth_ntlmssp_want_sign(a);
1476                 break;
1477         case DCERPC_AUTH_LEVEL_PRIVACY:
1478                 auth_ntlmssp_want_seal(a);
1479                 break;
1480         default:
1481                 break;
1482         }
1483
1484         status = auth_ntlmssp_update(a, auth_info->credentials, &response);
1485         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1486                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1487                         nt_errstr(status) ));
1488                 goto err;
1489         }
1490
1491         status = dcerpc_push_dcerpc_auth(prs_get_mem_context(pout_auth),
1492                                          DCERPC_AUTH_TYPE_NTLMSSP,
1493                                          auth_info->auth_level,
1494                                          ss_padding_len,
1495                                          1, /* auth_context_id */
1496                                          &response,
1497                                          &blob);
1498         if (!NT_STATUS_IS_OK(status)) {
1499                 DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1500                 goto err;
1501         }
1502
1503         /* Copy the blob into the pout_auth parse struct */
1504         if (!prs_copy_data_in(pout_auth, (char *)blob.data, blob.length)) {
1505                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1506                 goto err;
1507         }
1508
1509         p->auth.a_u.auth_ntlmssp_state = a;
1510         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1511         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1512
1513         data_blob_free(&response);
1514
1515         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1516
1517         /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1518         return True;
1519
1520   err:
1521
1522         data_blob_free(&response);
1523
1524         free_pipe_ntlmssp_auth_data(&p->auth);
1525         p->auth.a_u.auth_ntlmssp_state = NULL;
1526         return False;
1527 }
1528
1529 /*******************************************************************
1530  Respond to a pipe bind request.
1531 *******************************************************************/
1532
1533 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1534 {
1535         RPC_HDR_BA hdr_ba;
1536         struct dcerpc_bind rpc_bind;
1537         DATA_BLOB blob_rb;
1538         struct dcerpc_auth auth_info;
1539         DATA_BLOB auth_blob;
1540         uint16 assoc_gid;
1541         fstring ack_pipe_name;
1542         prs_struct out_hdr_ba;
1543         prs_struct out_auth;
1544         int auth_len = 0;
1545         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1546         uint32_t ss_padding_len = 0;
1547         NTSTATUS status;
1548         struct ndr_syntax_id id;
1549
1550         /* No rebinds on a bound pipe - use alter context. */
1551         if (p->pipe_bound) {
1552                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1553                          "pipe %s.\n",
1554                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1555                 return setup_bind_nak(p);
1556         }
1557
1558         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1559
1560         /*
1561          * Marshall directly into the outgoing PDU space. We
1562          * must do this as we need to set to the bind response
1563          * header and are never sending more than one PDU here.
1564          */
1565
1566         /*
1567          * Setup the memory to marshall the ba header, and the
1568          * auth footers.
1569          */
1570
1571         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1572                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1573                 prs_mem_free(&p->out_data.frag);
1574                 return False;
1575         }
1576
1577         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1578                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1579                 prs_mem_free(&p->out_data.frag);
1580                 prs_mem_free(&out_hdr_ba);
1581                 return False;
1582         }
1583
1584         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1585
1586         /* decode the bind request */
1587         blob_rb = data_blob_const(prs_data_p(rpc_in_p),
1588                                   prs_data_size(rpc_in_p));
1589         status = dcerpc_pull_dcerpc_bind(talloc_tos(), &blob_rb, &rpc_bind);
1590         if (!NT_STATUS_IS_OK(status)) {
1591                 goto err_exit;
1592         }
1593
1594         if (rpc_bind.num_contexts == 0) {
1595                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1596                 goto err_exit;
1597         }
1598
1599         /*
1600          * Try and find the correct pipe name to ensure
1601          * that this is a pipe name we support.
1602          */
1603         id = rpc_bind.ctx_list[0].abstract_syntax;
1604         if (rpc_srv_pipe_exists_by_id(&id)) {
1605                 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1606                         rpc_srv_get_pipe_cli_name(&id),
1607                         rpc_srv_get_pipe_srv_name(&id)));
1608         } else {
1609                 status = smb_probe_module(
1610                         "rpc", get_pipe_name_from_syntax(
1611                                 talloc_tos(),
1612                                 &rpc_bind.ctx_list[0].abstract_syntax));
1613
1614                 if (NT_STATUS_IS_ERR(status)) {
1615                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1616                                 get_pipe_name_from_syntax(
1617                                         talloc_tos(),
1618                                         &rpc_bind.ctx_list[0].abstract_syntax)));
1619                         prs_mem_free(&p->out_data.frag);
1620                         prs_mem_free(&out_hdr_ba);
1621                         prs_mem_free(&out_auth);
1622
1623                         return setup_bind_nak(p);
1624                 }
1625
1626                 if (rpc_srv_get_pipe_interface_by_cli_name(
1627                                 get_pipe_name_from_syntax(talloc_tos(),
1628                                                           &p->syntax),
1629                                 &id)) {
1630                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1631                                 rpc_srv_get_pipe_cli_name(&id),
1632                                 rpc_srv_get_pipe_srv_name(&id)));
1633                 } else {
1634                         DEBUG(0, ("module %s doesn't provide functions for "
1635                                   "pipe %s!\n",
1636                                   get_pipe_name_from_syntax(talloc_tos(),
1637                                                             &p->syntax),
1638                                   get_pipe_name_from_syntax(talloc_tos(),
1639                                                             &p->syntax)));
1640                         goto err_exit;
1641                 }
1642         }
1643
1644         /* name has to be \PIPE\xxxxx */
1645         fstrcpy(ack_pipe_name, "\\PIPE\\");
1646         fstrcat(ack_pipe_name, rpc_srv_get_pipe_srv_name(&id));
1647
1648         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1649
1650         if (rpc_bind.assoc_group_id != 0) {
1651                 assoc_gid = rpc_bind.assoc_group_id;
1652         } else {
1653                 assoc_gid = 0x53f0;
1654         }
1655
1656
1657         /*
1658          * Create the bind response struct.
1659          */
1660
1661         /* If the requested abstract synt uuid doesn't match our client pipe,
1662                 reject the bind_ack & set the transfer interface synt to all 0's,
1663                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1664                 unknown to NT4)
1665                 Needed when adding entries to a DACL from NT5 - SK */
1666
1667         if (check_bind_req(p,
1668                         &rpc_bind.ctx_list[0].abstract_syntax,
1669                         &rpc_bind.ctx_list[0].transfer_syntaxes[0],
1670                         rpc_bind.ctx_list[0].context_id)) {
1671                 init_rpc_hdr_ba(&hdr_ba,
1672                         RPC_MAX_PDU_FRAG_LEN,
1673                         RPC_MAX_PDU_FRAG_LEN,
1674                         assoc_gid,
1675                         ack_pipe_name,
1676                         0x1, 0x0, 0x0,
1677                         &rpc_bind.ctx_list[0].transfer_syntaxes[0]);
1678         } else {
1679                 /* Rejection reason: abstract syntax not supported */
1680                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1681                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1682                                         ack_pipe_name, 0x1, 0x2, 0x1,
1683                                         &null_ndr_syntax_id);
1684                 p->pipe_bound = False;
1685         }
1686
1687         /*
1688          * and marshall it.
1689          */
1690
1691         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1692                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1693                 goto err_exit;
1694         }
1695
1696         /*
1697          * Check if this is an authenticated bind request.
1698          */
1699
1700         if (p->hdr.auth_len) {
1701                 /*
1702                  * Decode the authentication verifier.
1703                  */
1704
1705                 /* Work out any padding needed before the auth footer. */
1706                 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
1707                         ss_padding_len = SERVER_NDR_PADDING_SIZE -
1708                                 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
1709                         DEBUG(10,("api_pipe_bind_req: auth pad_len = %u\n",
1710                                 (unsigned int)ss_padding_len ));
1711                 }
1712
1713                 /* Quick length check. Won't catch a bad auth footer,
1714                  * prevents overrun. */
1715
1716                 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
1717                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
1718                                 "too long for fragment %u.\n",
1719                                 (unsigned int)p->hdr.auth_len,
1720                                 (unsigned int)p->hdr.frag_len ));
1721                         goto err_exit;
1722                 }
1723
1724                 /* Pull the auth header and the following data into a blob. */
1725                 /* NB. The offset of the auth_header is relative to the *end*
1726                  * of the packet, not the start. Also, the length of the
1727                  * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
1728                  * as the RPC header isn't included in rpc_in_p. */
1729                 if(!prs_set_offset(rpc_in_p,
1730                                 p->hdr.frag_len - RPC_HEADER_LEN -
1731                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
1732                         DEBUG(0,("api_pipe_bind_req: cannot move "
1733                                 "offset to %u.\n",
1734                                 (unsigned int)(p->hdr.frag_len -
1735                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
1736                         goto err_exit;
1737                 }
1738
1739                 auth_blob = data_blob_const(prs_data_p(rpc_in_p)
1740                                                 + prs_offset(rpc_in_p),
1741                                             prs_data_size(rpc_in_p)
1742                                                 - prs_offset(rpc_in_p));
1743
1744                 status = dcerpc_pull_dcerpc_auth(prs_get_mem_context(rpc_in_p),
1745                                                  &auth_blob, &auth_info);
1746                 if (!NT_STATUS_IS_OK(status)) {
1747                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1748                         goto err_exit;
1749                 }
1750
1751                 auth_type = auth_info.auth_type;
1752
1753                 /* Work out if we have to sign or seal etc. */
1754                 switch (auth_info.auth_level) {
1755                 case DCERPC_AUTH_LEVEL_INTEGRITY:
1756                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1757                         break;
1758                 case DCERPC_AUTH_LEVEL_PRIVACY:
1759                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1760                         break;
1761                 default:
1762                         DEBUG(0, ("Unexpected auth level (%u).\n",
1763                                 (unsigned int)auth_info.auth_level ));
1764                         goto err_exit;
1765                 }
1766         } else {
1767                 ZERO_STRUCT(auth_info);
1768         }
1769
1770         switch(auth_type) {
1771                 case DCERPC_AUTH_TYPE_NTLMSSP:
1772                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p,
1773                                         ss_padding_len, &auth_info, &out_auth)) {
1774                                 goto err_exit;
1775                         }
1776                         assoc_gid = 0x7a77;
1777                         break;
1778
1779                 case DCERPC_AUTH_TYPE_SCHANNEL:
1780                         if (!pipe_schannel_auth_bind(p, rpc_in_p,
1781                                         ss_padding_len, &auth_info, &out_auth)) {
1782                                 goto err_exit;
1783                         }
1784                         break;
1785
1786                 case DCERPC_AUTH_TYPE_SPNEGO:
1787                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p,
1788                                         ss_padding_len, &auth_info, &out_auth)) {
1789                                 goto err_exit;
1790                         }
1791                         break;
1792
1793                 case DCERPC_AUTH_TYPE_NONE:
1794                         /* Unauthenticated bind request. */
1795                         /* We're finished - no more packets. */
1796                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1797                         /* We must set the pipe auth_level here also. */
1798                         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1799                         p->pipe_bound = True;
1800                         /* The session key was initialized from the SMB
1801                          * session in make_internal_rpc_pipe_p */
1802                         ss_padding_len = 0;
1803                         break;
1804
1805                 default:
1806                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1807                         goto err_exit;
1808         }
1809         /*
1810          * Create the header, now we know the length.
1811          */
1812
1813         if (prs_offset(&out_auth)) {
1814                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1815         }
1816
1817         init_rpc_hdr(&p->hdr, DCERPC_PKT_BIND_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1818                         p->hdr.call_id,
1819                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) +
1820                                 ss_padding_len + prs_offset(&out_auth),
1821                         auth_len);
1822
1823         /*
1824          * Marshall the header into the outgoing PDU.
1825          */
1826
1827         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1828                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1829                 goto err_exit;
1830         }
1831
1832         /*
1833          * Now add the RPC_HDR_BA and any auth needed.
1834          */
1835
1836         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1837                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1838                 goto err_exit;
1839         }
1840
1841         if (auth_len) {
1842                 if (ss_padding_len) {
1843                         char pad[SERVER_NDR_PADDING_SIZE];
1844                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1845                         if (!prs_copy_data_in(&p->out_data.frag, pad,
1846                                         ss_padding_len)) {
1847                                 DEBUG(0,("api_pipe_bind_req: failed to add %u "
1848                                         "bytes of pad data.\n",
1849                                         (unsigned int)ss_padding_len));
1850                                 goto err_exit;
1851                         }
1852                 }
1853
1854                 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1855                         DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1856                         goto err_exit;
1857                 }
1858         }
1859
1860         /*
1861          * Setup the lengths for the initial reply.
1862          */
1863
1864         p->out_data.data_sent_length = 0;
1865         p->out_data.current_pdu_sent = 0;
1866
1867         prs_mem_free(&out_hdr_ba);
1868         prs_mem_free(&out_auth);
1869
1870         return True;
1871
1872   err_exit:
1873
1874         prs_mem_free(&p->out_data.frag);
1875         prs_mem_free(&out_hdr_ba);
1876         prs_mem_free(&out_auth);
1877         return setup_bind_nak(p);
1878 }
1879
1880 /****************************************************************************
1881  Deal with an alter context call. Can be third part of 3 leg auth request for
1882  SPNEGO calls.
1883 ****************************************************************************/
1884
1885 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1886 {
1887         RPC_HDR_BA hdr_ba;
1888         struct dcerpc_bind rpc_bind;
1889         DATA_BLOB blob_rb;
1890         RPC_HDR_AUTH auth_info;
1891         uint16 assoc_gid;
1892         fstring ack_pipe_name;
1893         prs_struct out_hdr_ba;
1894         prs_struct out_auth;
1895         int auth_len = 0;
1896         uint32_t ss_padding_len = 0;
1897         NTSTATUS status;
1898
1899         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1900
1901         /*
1902          * Marshall directly into the outgoing PDU space. We
1903          * must do this as we need to set to the bind response
1904          * header and are never sending more than one PDU here.
1905          */
1906
1907         /*
1908          * Setup the memory to marshall the ba header, and the
1909          * auth footers.
1910          */
1911
1912         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1913                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1914                 prs_mem_free(&p->out_data.frag);
1915                 return False;
1916         }
1917
1918         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1919                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1920                 prs_mem_free(&p->out_data.frag);
1921                 prs_mem_free(&out_hdr_ba);
1922                 return False;
1923         }
1924
1925         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1926
1927         /* decode the alter context request */
1928         blob_rb = data_blob_const(prs_data_p(rpc_in_p),
1929                                   prs_data_size(rpc_in_p));
1930         status = dcerpc_pull_dcerpc_bind(talloc_tos(), &blob_rb, &rpc_bind);
1931         if (!NT_STATUS_IS_OK(status)) {
1932                 goto err_exit;
1933         }
1934
1935         /* secondary address CAN be NULL
1936          * as the specs say it's ignored.
1937          * It MUST be NULL to have the spoolss working.
1938          */
1939         fstrcpy(ack_pipe_name,"");
1940
1941         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1942
1943         if (rpc_bind.assoc_group_id != 0) {
1944                 assoc_gid = rpc_bind.assoc_group_id;
1945         } else {
1946                 assoc_gid = 0x53f0;
1947         }
1948
1949         /*
1950          * Create the bind response struct.
1951          */
1952
1953         /* If the requested abstract synt uuid doesn't match our client pipe,
1954                 reject the bind_ack & set the transfer interface synt to all 0's,
1955                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1956                 unknown to NT4)
1957                 Needed when adding entries to a DACL from NT5 - SK */
1958
1959         if (check_bind_req(p,
1960                         &rpc_bind.ctx_list[0].abstract_syntax,
1961                         &rpc_bind.ctx_list[0].transfer_syntaxes[0],
1962                         rpc_bind.ctx_list[0].context_id)) {
1963                 init_rpc_hdr_ba(&hdr_ba,
1964                         RPC_MAX_PDU_FRAG_LEN,
1965                         RPC_MAX_PDU_FRAG_LEN,
1966                         assoc_gid,
1967                         ack_pipe_name,
1968                         0x1, 0x0, 0x0,
1969                         &rpc_bind.ctx_list[0].transfer_syntaxes[0]);
1970         } else {
1971                 /* Rejection reason: abstract syntax not supported */
1972                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1973                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1974                                         ack_pipe_name, 0x1, 0x2, 0x1,
1975                                         &null_ndr_syntax_id);
1976                 p->pipe_bound = False;
1977         }
1978
1979         /*
1980          * and marshall it.
1981          */
1982
1983         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1984                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1985                 goto err_exit;
1986         }
1987
1988
1989         /*
1990          * Check if this is an authenticated alter context request.
1991          */
1992
1993         if (p->hdr.auth_len != 0) {
1994                 /*
1995                  * Decode the authentication verifier.
1996                  */
1997
1998                 /* Work out any padding needed before the auth footer. */
1999                 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
2000                         ss_padding_len = SERVER_NDR_PADDING_SIZE -
2001                                 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
2002                         DEBUG(10,("api_pipe_alter_context: auth pad_len = %u\n",
2003                                 (unsigned int)ss_padding_len ));
2004                 }
2005
2006                 /* Quick length check. Won't catch a bad auth footer,
2007                  * prevents overrun. */
2008
2009                 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
2010                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
2011                                 "too long for fragment %u.\n",
2012                                 (unsigned int)p->hdr.auth_len,
2013                                 (unsigned int)p->hdr.frag_len ));
2014                         goto err_exit;
2015                 }
2016
2017                 /* Pull the auth header and the following data into a blob. */
2018                 /* NB. The offset of the auth_header is relative to the *end*
2019                  * of the packet, not the start. Also, the length of the
2020                  * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2021                  * as the RPC header isn't included in rpc_in_p. */
2022                 if(!prs_set_offset(rpc_in_p,
2023                                 p->hdr.frag_len - RPC_HEADER_LEN -
2024                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
2025                         DEBUG(0,("api_alter_context: cannot move "
2026                                 "offset to %u.\n",
2027                                 (unsigned int)(p->hdr.frag_len -
2028                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
2029                         goto err_exit;
2030                 }
2031
2032                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
2033                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
2034                         goto err_exit;
2035                 }
2036
2037                 /*
2038                  * Currently only the SPNEGO auth type uses the alter ctx
2039                  * response in place of the NTLMSSP auth3 type.
2040                  */
2041
2042                 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
2043                         /* We can only finish if the pipe is unbound. */
2044                         if (!p->pipe_bound) {
2045                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p,
2046                                                 ss_padding_len, &auth_info, &out_auth)) {
2047                                         goto err_exit;
2048                                 }
2049                         } else {
2050                                 goto err_exit;
2051                         }
2052                 }
2053         } else {
2054                 ZERO_STRUCT(auth_info);
2055         }
2056         /*
2057          * Create the header, now we know the length.
2058          */
2059
2060         if (prs_offset(&out_auth)) {
2061                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
2062         }
2063
2064         init_rpc_hdr(&p->hdr, DCERPC_PKT_ALTER_RESP, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
2065                         p->hdr.call_id,
2066                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
2067                         auth_len);
2068
2069         /*
2070          * Marshall the header into the outgoing PDU.
2071          */
2072
2073         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
2074                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
2075                 goto err_exit;
2076         }
2077
2078         /*
2079          * Now add the RPC_HDR_BA and any auth needed.
2080          */
2081
2082         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
2083                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
2084                 goto err_exit;
2085         }
2086
2087         if (auth_len) {
2088                 if (ss_padding_len) {
2089                         char pad[SERVER_NDR_PADDING_SIZE];
2090                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
2091                         if (!prs_copy_data_in(&p->out_data.frag, pad,
2092                                         ss_padding_len)) {
2093                                 DEBUG(0,("api_pipe_alter_context: failed to add %u "
2094                                         "bytes of pad data.\n",
2095                                         (unsigned int)ss_padding_len));
2096                                 goto err_exit;
2097                         }
2098                 }
2099
2100                 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
2101                         DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
2102                         goto err_exit;
2103                 }
2104         }
2105
2106         /*
2107          * Setup the lengths for the initial reply.
2108          */
2109
2110         p->out_data.data_sent_length = 0;
2111         p->out_data.current_pdu_sent = 0;
2112
2113         prs_mem_free(&out_hdr_ba);
2114         prs_mem_free(&out_auth);
2115         return True;
2116
2117   err_exit:
2118
2119         prs_mem_free(&p->out_data.frag);
2120         prs_mem_free(&out_hdr_ba);
2121         prs_mem_free(&out_auth);
2122         return setup_bind_nak(p);
2123 }
2124
2125 /****************************************************************************
2126  Deal with NTLMSSP sign & seal processing on an RPC request.
2127 ****************************************************************************/
2128
2129 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
2130                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
2131 {
2132         RPC_HDR_AUTH auth_info;
2133         uint32 auth_len = p->hdr.auth_len;
2134         uint32 save_offset = prs_offset(rpc_in);
2135         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
2136         unsigned char *data = NULL;
2137         size_t data_len;
2138         unsigned char *full_packet_data = NULL;
2139         size_t full_packet_data_len;
2140         DATA_BLOB auth_blob;
2141
2142         *pstatus = NT_STATUS_OK;
2143
2144         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_NONE || p->auth.auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
2145                 return True;
2146         }
2147
2148         if (!a) {
2149                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2150                 return False;
2151         }
2152
2153         /* Ensure there's enough data for an authenticated request. */
2154         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN
2155                         + auth_len > p->hdr.frag_len) {
2156                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2157                         (unsigned int)auth_len ));
2158                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2159                 return False;
2160         }
2161
2162         /*
2163          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2164          * after the RPC header.
2165          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2166          * functions as NTLMv2 checks the rpc headers also.
2167          * Both of these values include any auth_pad_len bytes.
2168          */
2169
2170         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2171         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2172
2173         full_packet_data = p->in_data.current_in_pdu;
2174         full_packet_data_len = p->hdr.frag_len - auth_len;
2175
2176         /* Pull the auth header and the following data into a blob. */
2177         /* NB. The offset of the auth_header is relative to the *end*
2178          * of the packet, not the start. Also, the length of the
2179          * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2180          * as the RPC header isn't included in rpc_in_p. */
2181         if(!prs_set_offset(rpc_in,
2182                         p->hdr.frag_len - RPC_HEADER_LEN -
2183                         RPC_HDR_AUTH_LEN - auth_len)) {
2184                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move "
2185                         "offset to %u.\n",
2186                         (unsigned int)(p->hdr.frag_len -
2187                                 RPC_HDR_AUTH_LEN - auth_len) ));
2188                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2189                 return False;
2190         }
2191
2192         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2193                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to "
2194                         "unmarshall RPC_HDR_AUTH.\n"));
2195                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2196                 return False;
2197         }
2198
2199         /* Ensure auth_pad_len fits into the packet. */
2200         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2201                         RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2202                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_info.auth_pad_len "
2203                         "too large (%u), auth_len (%u), frag_len = (%u).\n",
2204                         (unsigned int)auth_info.auth_pad_len,
2205                         (unsigned int)auth_len,
2206                         (unsigned int)p->hdr.frag_len ));
2207                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2208                 return False;
2209         }
2210
2211         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2212         auth_blob.length = auth_len;
2213
2214         switch (p->auth.auth_level) {
2215                 case DCERPC_AUTH_LEVEL_PRIVACY:
2216                         /* Data is encrypted. */
2217                         *pstatus = auth_ntlmssp_unseal_packet(a,
2218                                                               data, data_len,
2219                                                               full_packet_data,
2220                                                               full_packet_data_len,
2221                                                               &auth_blob);
2222                         if (!NT_STATUS_IS_OK(*pstatus)) {
2223                                 return False;
2224                         }
2225                         break;
2226                 case DCERPC_AUTH_LEVEL_INTEGRITY:
2227                         /* Data is signed. */
2228                         *pstatus = auth_ntlmssp_check_packet(a,
2229                                                              data, data_len,
2230                                                              full_packet_data,
2231                                                              full_packet_data_len,
2232                                                              &auth_blob);
2233                         if (!NT_STATUS_IS_OK(*pstatus)) {
2234                                 return False;
2235                         }
2236                         break;
2237                 default:
2238                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2239                         return False;
2240         }
2241
2242         /*
2243          * Return the current pointer to the data offset.
2244          */
2245
2246         if(!prs_set_offset(rpc_in, save_offset)) {
2247                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2248                         (unsigned int)save_offset ));
2249                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2250                 return False;
2251         }
2252
2253         /*
2254          * Remember the padding length. We must remove it from the real data
2255          * stream once the sign/seal is done.
2256          */
2257
2258         *p_ss_padding_len = auth_info.auth_pad_len;
2259
2260         return True;
2261 }
2262
2263 /****************************************************************************
2264  Deal with schannel processing on an RPC request.
2265 ****************************************************************************/
2266
2267 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2268 {
2269         uint32 data_len;
2270         uint32 auth_len;
2271         uint32 save_offset = prs_offset(rpc_in);
2272         RPC_HDR_AUTH auth_info;
2273         DATA_BLOB blob;
2274         NTSTATUS status;
2275         uint8_t *data;
2276
2277         auth_len = p->hdr.auth_len;
2278
2279         if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN ||
2280                         auth_len > RPC_HEADER_LEN +
2281                                         RPC_HDR_REQ_LEN +
2282                                         RPC_HDR_AUTH_LEN +
2283                                         auth_len) {
2284                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2285                 return False;
2286         }
2287
2288         /*
2289          * The following is that length of the data we must verify or unseal.
2290          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2291          * preceeding the auth_data, but does include the auth_pad_len bytes.
2292          */
2293
2294         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2295                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2296                         (unsigned int)p->hdr.frag_len,
2297                         (unsigned int)auth_len ));
2298                 return False;
2299         }
2300
2301         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2302                 RPC_HDR_AUTH_LEN - auth_len;
2303
2304         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2305
2306         /* Pull the auth header and the following data into a blob. */
2307         /* NB. The offset of the auth_header is relative to the *end*
2308          * of the packet, not the start. Also, the length of the
2309          * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2310          * as the RPC header isn't included in rpc_in_p. */
2311         if(!prs_set_offset(rpc_in,
2312                         p->hdr.frag_len - RPC_HEADER_LEN -
2313                         RPC_HDR_AUTH_LEN - auth_len)) {
2314                 DEBUG(0,("api_pipe_schannel_process: cannot move "
2315                         "offset to %u.\n",
2316                         (unsigned int)(p->hdr.frag_len -
2317                                 RPC_HDR_AUTH_LEN - auth_len) ));
2318                 return False;
2319         }
2320
2321         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2322                 DEBUG(0,("api_pipe_schannel_process: failed to "
2323                         "unmarshall RPC_HDR_AUTH.\n"));
2324                 return False;
2325         }
2326
2327         /* Ensure auth_pad_len fits into the packet. */
2328         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2329                         RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2330                 DEBUG(0,("api_pipe_schannel_process: auth_info.auth_pad_len "
2331                         "too large (%u), auth_len (%u), frag_len = (%u).\n",
2332                         (unsigned int)auth_info.auth_pad_len,
2333                         (unsigned int)auth_len,
2334                         (unsigned int)p->hdr.frag_len ));
2335                 return False;
2336         }
2337
2338         if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
2339                 DEBUG(0,("Invalid auth info %d on schannel\n",
2340                          auth_info.auth_type));
2341                 return False;
2342         }
2343
2344         blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), auth_len);
2345
2346         if (DEBUGLEVEL >= 10) {
2347                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
2348         }
2349
2350         data = (uint8_t *)prs_data_p(rpc_in)+RPC_HDR_REQ_LEN;
2351
2352         switch (auth_info.auth_level) {
2353         case DCERPC_AUTH_LEVEL_PRIVACY:
2354                 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2355                                                 talloc_tos(),
2356                                                 true,
2357                                                 data,
2358                                                 data_len,
2359                                                 &blob);
2360                 break;
2361         case DCERPC_AUTH_LEVEL_INTEGRITY:
2362                 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2363                                                 talloc_tos(),
2364                                                 false,
2365                                                 data,
2366                                                 data_len,
2367                                                 &blob);
2368                 break;
2369         default:
2370                 status = NT_STATUS_INTERNAL_ERROR;
2371                 break;
2372         }
2373
2374         if (!NT_STATUS_IS_OK(status)) {
2375                 DEBUG(0,("failed to unseal packet: %s\n", nt_errstr(status)));
2376                 return false;
2377         }
2378
2379         /*
2380          * Return the current pointer to the data offset.
2381          */
2382
2383         if(!prs_set_offset(rpc_in, save_offset)) {
2384                 DEBUG(0,("failed to set offset back to %u\n",
2385                          (unsigned int)save_offset ));
2386                 return False;
2387         }
2388
2389         /*
2390          * Remember the padding length. We must remove it from the real data
2391          * stream once the sign/seal is done.
2392          */
2393
2394         *p_ss_padding_len = auth_info.auth_pad_len;
2395
2396         return True;
2397 }
2398
2399 /****************************************************************************
2400  Find the set of RPC functions associated with this context_id
2401 ****************************************************************************/
2402
2403 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2404 {
2405         PIPE_RPC_FNS *fns = NULL;
2406
2407         if ( !list ) {
2408                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2409                 return NULL;
2410         }
2411
2412         for (fns=list; fns; fns=fns->next ) {
2413                 if ( fns->context_id == context_id )
2414                         return fns;
2415         }
2416         return NULL;
2417 }
2418
2419 /****************************************************************************
2420  Memory cleanup.
2421 ****************************************************************************/
2422
2423 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2424 {
2425         PIPE_RPC_FNS *tmp = list;
2426         PIPE_RPC_FNS *tmp2;
2427
2428         while (tmp) {
2429                 tmp2 = tmp->next;
2430                 SAFE_FREE(tmp);
2431                 tmp = tmp2;
2432         }
2433
2434         return;
2435 }
2436
2437 static bool api_rpcTNP(pipes_struct *p,
2438                        const struct api_struct *api_rpc_cmds, int n_cmds);
2439
2440 /****************************************************************************
2441  Find the correct RPC function to call for this request.
2442  If the pipe is authenticated then become the correct UNIX user
2443  before doing the call.
2444 ****************************************************************************/
2445
2446 bool api_pipe_request(pipes_struct *p)
2447 {
2448         bool ret = False;
2449         bool changed_user = False;
2450         PIPE_RPC_FNS *pipe_fns;
2451
2452         if (p->pipe_bound &&
2453                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2454                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2455                 if(!become_authenticated_pipe_user(p)) {
2456                         prs_mem_free(&p->out_data.rdata);
2457                         return False;
2458                 }
2459                 changed_user = True;
2460         }
2461
2462         DEBUG(5, ("Requested \\PIPE\\%s\n",
2463                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2464
2465         /* get the set of RPC functions for this context */
2466
2467         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2468
2469         if ( pipe_fns ) {
2470                 TALLOC_CTX *frame = talloc_stackframe();
2471                 ret = api_rpcTNP(p, pipe_fns->cmds, pipe_fns->n_cmds);
2472                 TALLOC_FREE(frame);
2473         }
2474         else {
2475                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2476                         p->hdr_req.context_id,
2477                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2478         }
2479
2480         if (changed_user) {
2481                 unbecome_authenticated_pipe_user();
2482         }
2483
2484         return ret;
2485 }
2486
2487 /*******************************************************************
2488  Calls the underlying RPC function for a named pipe.
2489  ********************************************************************/
2490
2491 static bool api_rpcTNP(pipes_struct *p,
2492                        const struct api_struct *api_rpc_cmds, int n_cmds)
2493 {
2494         int fn_num;
2495         uint32 offset1, offset2;
2496
2497         /* interpret the command */
2498         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2499                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2500                  p->hdr_req.opnum));
2501
2502         if (DEBUGLEVEL >= 50) {
2503                 fstring name;
2504                 slprintf(name, sizeof(name)-1, "in_%s",
2505                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2506                 prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2507         }
2508
2509         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2510                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2511                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2512                         break;
2513                 }
2514         }
2515
2516         if (fn_num == n_cmds) {
2517                 /*
2518                  * For an unknown RPC just return a fault PDU but
2519                  * return True to allow RPC's on the pipe to continue
2520                  * and not put the pipe into fault state. JRA.
2521                  */
2522                 DEBUG(4, ("unknown\n"));
2523                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2524                 return True;
2525         }
2526
2527         offset1 = prs_offset(&p->out_data.rdata);
2528
2529         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2530                 fn_num, api_rpc_cmds[fn_num].fn));
2531         /* do the actual command */
2532         if(!api_rpc_cmds[fn_num].fn(p)) {
2533                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2534                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2535                          api_rpc_cmds[fn_num].name));
2536                 prs_mem_free(&p->out_data.rdata);
2537                 return False;
2538         }
2539
2540         if (p->bad_handle_fault_state) {
2541                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2542                 p->bad_handle_fault_state = False;
2543                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2544                 return True;
2545         }
2546
2547         if (p->rng_fault_state) {
2548                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2549                 p->rng_fault_state = False;
2550                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2551                 return True;
2552         }
2553
2554         offset2 = prs_offset(&p->out_data.rdata);
2555         prs_set_offset(&p->out_data.rdata, offset1);
2556         if (DEBUGLEVEL >= 50) {
2557                 fstring name;
2558                 slprintf(name, sizeof(name)-1, "out_%s",
2559                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2560                 prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2561         }
2562         prs_set_offset(&p->out_data.rdata, offset2);
2563
2564         DEBUG(5,("api_rpcTNP: called %s successfully\n",
2565                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2566
2567         /* Check for buffer underflow in rpc parsing */
2568
2569         if ((DEBUGLEVEL >= 10) &&
2570             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2571                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2572                 char *data = (char *)SMB_MALLOC(data_len);
2573
2574                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2575                 if (data) {
2576                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2577                         SAFE_FREE(data);
2578                 }
2579
2580         }
2581
2582         return True;
2583 }