source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "srv_pipe_internal.h"
  32 #include "../librpc/gen_ndr/ndr_schannel.h"
  33 #include "../libcli/auth/schannel.h"
  34 #include "../libcli/auth/spnego.h"
  35 #include "dcesrv_ntlmssp.h"
  36 #include "dcesrv_gssapi.h"
  37 #include "dcesrv_spnego.h"
  38 #include "rpc_server.h"
  39 #include "rpc_dce.h"
  40
  41 #undef DBGC_CLASS
  42 #define DBGC_CLASS DBGC_RPC_SRV
  43
  44 /**
  45  * Dump everything from the start of the end up of the provided data
  46  * into a file, but only at debug level >= 50
  47  **/
  48 static void dump_pdu_region(const char *name, int v,
  49                             DATA_BLOB *data, size_t start, size_t end)
  50 {
  51         int fd, i;
  52         char *fname = NULL;
  53         ssize_t sz;
  54
  55         if (DEBUGLEVEL < 50) return;
  56
  57         if (start > data->length || end > data->length || start > end) return;
  58
  59         for (i = 1; i < 100; i++) {
  60                 if (v != -1) {
  61                         fname = talloc_asprintf(talloc_tos(),
  62                                                 "/tmp/%s_%d.%d.prs",
  63                                                 name, v, i);
  64                 } else {
  65                         fname = talloc_asprintf(talloc_tos(),
  66                                                 "/tmp/%s_%d.prs",
  67                                                 name, i);
  68                 }
  69                 if (!fname) {
  70                         return;
  71                 }
  72                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  73                 if (fd != -1 || errno != EEXIST) break;
  74         }
  75         if (fd != -1) {
  76                 sz = write(fd, data->data + start, end - start);
  77                 i = close(fd);
  78                 if ((sz != end - start) || (i != 0) ) {
  79                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  80                                   fname, (unsigned long)sz,
  81                                   (unsigned long)end - start, i));
  82                 } else {
  83                         DEBUG(0,("created %s\n", fname));
  84                 }
  85         }
  86         TALLOC_FREE(fname);
  87 }
  88
  89 static DATA_BLOB generic_session_key(void)
  90 {
  91         return data_blob_const("SystemLibraryDTC", 16);
  92 }
  93
  94 /*******************************************************************
  95  Generate the next PDU to be returned from the data.
  96 ********************************************************************/
  97
  98 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
  99                                    struct pipe_auth_data *auth,
 100                                    uint32_t call_id,
 101                                    DATA_BLOB *rdata,
 102                                    size_t data_sent_length,
 103                                    DATA_BLOB *frag,
 104                                    size_t *pdu_size)
 105 {
 106         union dcerpc_payload u;
 107         uint8_t pfc_flags;
 108         size_t data_left;
 109         size_t data_to_send;
 110         size_t frag_len;
 111         size_t pad_len = 0;
 112         size_t auth_len = 0;
 113         NTSTATUS status;
 114
 115         ZERO_STRUCT(u.response);
 116
 117         /* Set up rpc packet pfc flags. */
 118         if (data_sent_length == 0) {
 119                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 120         } else {
 121                 pfc_flags = 0;
 122         }
 123
 124         /* Work out how much we can fit in a single PDU. */
 125         data_left = rdata->length - data_sent_length;
 126
 127         /* Ensure there really is data left to send. */
 128         if (!data_left) {
 129                 DEBUG(0, ("No data left to send !\n"));
 130                 return NT_STATUS_BUFFER_TOO_SMALL;
 131         }
 132
 133         status = dcerpc_guess_sizes(auth,
 134                                     DCERPC_RESPONSE_LENGTH,
 135                                     data_left,
 136                                     RPC_MAX_PDU_FRAG_LEN,
 137                                     SERVER_NDR_PADDING_SIZE,
 138                                     &data_to_send, &frag_len,
 139                                     &auth_len, &pad_len);
 140         if (!NT_STATUS_IS_OK(status)) {
 141                 return status;
 142         }
 143
 144         /* Set up the alloc hint. This should be the data left to send. */
 145         u.response.alloc_hint = data_left;
 146
 147         /* Work out if this PDU will be the last. */
 148         if (data_sent_length + data_to_send >= rdata->length) {
 149                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 150         }
 151
 152         /* Prepare data to be NDR encoded. */
 153         u.response.stub_and_verifier =
 154                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 155
 156         /* Store the packet in the data stream. */
 157         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 158                                           pfc_flags, auth_len, call_id,
 159                                           &u, frag);
 160         if (!NT_STATUS_IS_OK(status)) {
 161                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 162                 return status;
 163         }
 164
 165         if (auth_len) {
 166                 /* Set the proper length on the pdu, including padding.
 167                  * Only needed if an auth trailer will be appended. */
 168                 dcerpc_set_frag_length(frag, frag->length
 169                                                 + pad_len
 170                                                 + DCERPC_AUTH_TRAILER_LENGTH
 171                                                 + auth_len);
 172         }
 173
 174         if (auth_len) {
 175                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 176                 if (!NT_STATUS_IS_OK(status)) {
 177                         data_blob_free(frag);
 178                         return status;
 179                 }
 180         }
 181
 182         *pdu_size = data_to_send;
 183         return NT_STATUS_OK;
 184 }
 185
 186 /*******************************************************************
 187  Generate the next PDU to be returned from the data in p->rdata.
 188 ********************************************************************/
 189
 190 bool create_next_pdu(struct pipes_struct *p)
 191 {
 192         size_t pdu_size = 0;
 193         NTSTATUS status;
 194
 195         /*
 196          * If we're in the fault state, keep returning fault PDU's until
 197          * the pipe gets closed. JRA.
 198          */
 199         if (p->fault_state) {
 200                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 201                 return true;
 202         }
 203
 204         status = create_next_packet(p->mem_ctx, &p->auth,
 205                                     p->call_id, &p->out_data.rdata,
 206                                     p->out_data.data_sent_length,
 207                                     &p->out_data.frag, &pdu_size);
 208         if (!NT_STATUS_IS_OK(status)) {
 209                 DEBUG(0, ("Failed to create packet with error %s, "
 210                           "(auth level %u / type %u)\n",
 211                           nt_errstr(status),
 212                           (unsigned int)p->auth.auth_level,
 213                           (unsigned int)p->auth.auth_type));
 214                 return false;
 215         }
 216
 217         /* Setup the counts for this PDU. */
 218         p->out_data.data_sent_length += pdu_size;
 219         p->out_data.current_pdu_sent = 0;
 220         return true;
 221 }
 222
 223
 224 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 225
 226 /*******************************************************************
 227  Marshall a bind_nak pdu.
 228 *******************************************************************/
 229
 230 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 231 {
 232         NTSTATUS status;
 233         union dcerpc_payload u;
 234
 235         /* Free any memory in the current return data buffer. */
 236         pipe_init_outgoing_data(p);
 237
 238         /*
 239          * Initialize a bind_nak header.
 240          */
 241
 242         ZERO_STRUCT(u);
 243
 244         u.bind_nak.reject_reason  = 0;
 245
 246         /*
 247          * Marshall directly into the outgoing PDU space. We
 248          * must do this as we need to set to the bind response
 249          * header and are never sending more than one PDU here.
 250          */
 251
 252         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 253                                           DCERPC_PKT_BIND_NAK,
 254                                           DCERPC_PFC_FLAG_FIRST |
 255                                                 DCERPC_PFC_FLAG_LAST,
 256                                           0,
 257                                           pkt->call_id,
 258                                           &u,
 259                                           &p->out_data.frag);
 260         if (!NT_STATUS_IS_OK(status)) {
 261                 return False;
 262         }
 263
 264         p->out_data.data_sent_length = 0;
 265         p->out_data.current_pdu_sent = 0;
 266
 267         TALLOC_FREE(p->auth.auth_ctx);
 268         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 269         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 270         p->pipe_bound = False;
 271
 272         return True;
 273 }
 274
 275 /*******************************************************************
 276  Marshall a fault pdu.
 277 *******************************************************************/
 278
 279 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 280 {
 281         NTSTATUS status;
 282         union dcerpc_payload u;
 283
 284         /* Free any memory in the current return data buffer. */
 285         pipe_init_outgoing_data(p);
 286
 287         /*
 288          * Initialize a fault header.
 289          */
 290
 291         ZERO_STRUCT(u);
 292
 293         u.fault.status          = NT_STATUS_V(fault_status);
 294         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 295
 296         /*
 297          * Marshall directly into the outgoing PDU space. We
 298          * must do this as we need to set to the bind response
 299          * header and are never sending more than one PDU here.
 300          */
 301
 302         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 303                                           DCERPC_PKT_FAULT,
 304                                           DCERPC_PFC_FLAG_FIRST |
 305                                            DCERPC_PFC_FLAG_LAST |
 306                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 307                                           0,
 308                                           p->call_id,
 309                                           &u,
 310                                           &p->out_data.frag);
 311         if (!NT_STATUS_IS_OK(status)) {
 312                 return False;
 313         }
 314
 315         p->out_data.data_sent_length = 0;
 316         p->out_data.current_pdu_sent = 0;
 317
 318         return True;
 319 }
 320
 321 /*******************************************************************
 322  Ensure a bind request has the correct abstract & transfer interface.
 323  Used to reject unknown binds from Win2k.
 324 *******************************************************************/
 325
 326 static bool check_bind_req(struct pipes_struct *p,
 327                            struct ndr_syntax_id* abstract,
 328                            struct ndr_syntax_id* transfer,
 329                            uint32 context_id)
 330 {
 331         struct pipe_rpc_fns *context_fns;
 332
 333         DEBUG(3,("check_bind_req for %s\n",
 334                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 335
 336         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 337         if (rpc_srv_pipe_exists_by_id(abstract) &&
 338            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 339                 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 340                         rpc_srv_get_pipe_cli_name(abstract),
 341                         rpc_srv_get_pipe_srv_name(abstract)));
 342         } else {
 343                 return false;
 344         }
 345
 346         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 347         if (context_fns == NULL) {
 348                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 349                 return False;
 350         }
 351
 352         context_fns->next = context_fns->prev = NULL;
 353         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 354         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 355         context_fns->context_id = context_id;
 356
 357         /* add to the list of open contexts */
 358
 359         DLIST_ADD( p->contexts, context_fns );
 360
 361         return True;
 362 }
 363
 364 /**
 365  * Is a named pipe known?
 366  * @param[in] cli_filename      The pipe name requested by the client
 367  * @result                      Do we want to serve this?
 368  */
 369 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
 370 {
 371         const char *pipename = cli_filename;
 372         NTSTATUS status;
 373
 374         if (strnequal(pipename, "\\PIPE\\", 6)) {
 375                 pipename += 5;
 376         }
 377
 378         if (*pipename == '\\') {
 379                 pipename += 1;
 380         }
 381
 382         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 383                 DEBUG(10, ("refusing spoolss access\n"));
 384                 return false;
 385         }
 386
 387         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 388                 return true;
 389         }
 390
 391         status = smb_probe_module("rpc", pipename);
 392         if (!NT_STATUS_IS_OK(status)) {
 393                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
 394                 return false;
 395         }
 396         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 397
 398         /*
 399          * Scan the list again for the interface id
 400          */
 401         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 402                 return true;
 403         }
 404
 405         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 406                    pipename));
 407
 408         return false;
 409 }
 410
 411 /*******************************************************************
 412  Handle the first part of a SPNEGO bind auth.
 413 *******************************************************************/
 414
 415 static bool pipe_spnego_auth_bind(struct pipes_struct *p,
 416                                   TALLOC_CTX *mem_ctx,
 417                                   struct dcerpc_auth *auth_info,
 418                                   DATA_BLOB *response)
 419 {
 420         struct spnego_context *spnego_ctx;
 421         NTSTATUS status;
 422
 423         status = spnego_server_auth_start(p,
 424                                           (auth_info->auth_level ==
 425                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 426                                           (auth_info->auth_level ==
 427                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 428                                           true,
 429                                           &auth_info->credentials,
 430                                           response,
 431                                           &spnego_ctx);
 432         if (!NT_STATUS_IS_OK(status)) {
 433                 DEBUG(0, ("Failed SPNEGO negotiate (%s)\n",
 434                           nt_errstr(status)));
 435                 return false;
 436         }
 437
 438         /* Make sure data is bound to the memctx, to be freed the caller */
 439         talloc_steal(mem_ctx, response->data);
 440
 441         p->auth.auth_ctx = spnego_ctx;
 442         p->auth.auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 443
 444         DEBUG(10, ("SPNEGO auth started\n"));
 445
 446         return true;
 447 }
 448
 449 /*******************************************************************
 450  Handle an schannel bind auth.
 451 *******************************************************************/
 452
 453 static bool pipe_schannel_auth_bind(struct pipes_struct *p,
 454                                     TALLOC_CTX *mem_ctx,
 455                                     struct dcerpc_auth *auth_info,
 456                                     DATA_BLOB *response)
 457 {
 458         struct NL_AUTH_MESSAGE neg;
 459         struct NL_AUTH_MESSAGE reply;
 460         bool ret;
 461         NTSTATUS status;
 462         struct netlogon_creds_CredentialState *creds;
 463         enum ndr_err_code ndr_err;
 464         struct schannel_state *schannel_auth;
 465
 466         ndr_err = ndr_pull_struct_blob(
 467                         &auth_info->credentials, mem_ctx, &neg,
 468                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
 469         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 470                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
 471                 return false;
 472         }
 473
 474         if (DEBUGLEVEL >= 10) {
 475                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
 476         }
 477
 478         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
 479                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
 480                 return false;
 481         }
 482
 483         /*
 484          * The neg.oem_netbios_computer.a key here must match the remote computer name
 485          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
 486          * operations that use credentials.
 487          */
 488
 489         become_root();
 490         status = schannel_get_creds_state(p, lp_private_dir(),
 491                                             neg.oem_netbios_computer.a, &creds);
 492         unbecome_root();
 493
 494         if (!NT_STATUS_IS_OK(status)) {
 495                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
 496                 return False;
 497         }
 498
 499         schannel_auth = talloc(p, struct schannel_state);
 500         if (!schannel_auth) {
 501                 TALLOC_FREE(creds);
 502                 return False;
 503         }
 504
 505         schannel_auth->state = SCHANNEL_STATE_START;
 506         schannel_auth->seq_num = 0;
 507         schannel_auth->initiator = false;
 508         schannel_auth->creds = creds;
 509
 510         /*
 511          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
 512          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
 513          * struct of the person who opened the pipe. I need to test this further. JRA.
 514          *
 515          * VL. As we are mapping this to guest set the generic key
 516          * "SystemLibraryDTC" key here. It's a bit difficult to test against
 517          * W2k3, as it does not allow schannel binds against SAMR and LSA
 518          * anymore.
 519          */
 520
 521         ret = session_info_set_session_key(p->session_info, generic_session_key());
 522
 523         if (!ret) {
 524                 DEBUG(0, ("session_info_set_session_key failed\n"));
 525                 return false;
 526         }
 527
 528         /*** SCHANNEL verifier ***/
 529
 530         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
 531         reply.Flags                             = 0;
 532         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
 533                                                       * this has any meaning
 534                                                       * here - gd */
 535
 536         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
 537                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 538         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 539                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
 540                 return false;
 541         }
 542
 543         if (DEBUGLEVEL >= 10) {
 544                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
 545         }
 546
 547         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
 548                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
 549
 550         /* We're finished with this bind - no more packets. */
 551         p->auth.auth_ctx = schannel_auth;
 552         p->auth.auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
 553
 554         p->pipe_bound = True;
 555
 556         return True;
 557 }
 558
 559 /*******************************************************************
 560  Handle an NTLMSSP bind auth.
 561 *******************************************************************/
 562
 563 static bool pipe_ntlmssp_auth_bind(struct pipes_struct *p,
 564                                    TALLOC_CTX *mem_ctx,
 565                                    struct dcerpc_auth *auth_info,
 566                                    DATA_BLOB *response)
 567 {
 568         struct auth_ntlmssp_state *ntlmssp_state = NULL;
 569         NTSTATUS status;
 570
 571         if (strncmp((char *)auth_info->credentials.data, "NTLMSSP", 7) != 0) {
 572                 DEBUG(0, ("Failed to read NTLMSSP in blob\n"));
 573                 return false;
 574         }
 575
 576         /* We have an NTLMSSP blob. */
 577         status = ntlmssp_server_auth_start(p,
 578                                            (auth_info->auth_level ==
 579                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 580                                            (auth_info->auth_level ==
 581                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 582                                            true,
 583                                            &auth_info->credentials,
 584                                            response,
 585                                            &ntlmssp_state);
 586         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 587                 DEBUG(0, (__location__ ": auth_ntlmssp_start failed: %s\n",
 588                           nt_errstr(status)));
 589                 return false;
 590         }
 591
 592         /* Make sure data is bound to the memctx, to be freed the caller */
 593         talloc_steal(mem_ctx, response->data);
 594
 595         p->auth.auth_ctx = ntlmssp_state;
 596         p->auth.auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 597
 598         DEBUG(10, (__location__ ": NTLMSSP auth started\n"));
 599
 600         return true;
 601 }
 602
 603 /*******************************************************************
 604  Process an NTLMSSP authentication response.
 605  If this function succeeds, the user has been authenticated
 606  and their domain, name and calling workstation stored in
 607  the pipe struct.
 608 *******************************************************************/
 609
 610 static bool pipe_ntlmssp_verify_final(TALLOC_CTX *mem_ctx,
 611                                 struct auth_ntlmssp_state *ntlmssp_ctx,
 612                                 enum dcerpc_AuthLevel auth_level,
 613                                 struct client_address *client_id,
 614                                 struct ndr_syntax_id *syntax,
 615                                 struct auth_serversupplied_info **session_info)
 616 {
 617         NTSTATUS status;
 618         bool ret;
 619
 620         DEBUG(5, (__location__ ": pipe %s checking user details\n",
 621                  get_pipe_name_from_syntax(talloc_tos(), syntax)));
 622
 623         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 624            ensure the underlying NTLMSSP flags are also set. If not we should
 625            refuse the bind. */
 626
 627         status = ntlmssp_server_check_flags(ntlmssp_ctx,
 628                                             (auth_level ==
 629                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 630                                             (auth_level ==
 631                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 632         if (!NT_STATUS_IS_OK(status)) {
 633                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 634                           "security for pipe %s\n",
 635                           get_pipe_name_from_syntax(talloc_tos(), syntax)));
 636                 return false;
 637         }
 638
 639         TALLOC_FREE(*session_info);
 640
 641         status = ntlmssp_server_get_user_info(ntlmssp_ctx,
 642                                                 mem_ctx, session_info);
 643         if (!NT_STATUS_IS_OK(status)) {
 644                 DEBUG(0, (__location__ ": failed to obtain the server info "
 645                           "for authenticated user: %s\n", nt_errstr(status)));
 646                 return false;
 647         }
 648
 649         if ((*session_info)->security_token == NULL) {
 650                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 651                 return false;
 652         }
 653
 654         /*
 655          * We're an authenticated bind over smb, so the session key needs to
 656          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 657          * does. See the RPC-SAMBA3SESSIONKEY.
 658          */
 659
 660         ret = session_info_set_session_key((*session_info), generic_session_key());
 661         if (!ret) {
 662                 DEBUG(0, ("Failed to set session key!\n"));
 663                 return false;
 664         }
 665
 666         return true;
 667 }
 668
 669 /*******************************************************************
 670  Handle a GSSAPI bind auth.
 671 *******************************************************************/
 672
 673 static bool pipe_gssapi_auth_bind(struct pipes_struct *p,
 674                                   TALLOC_CTX *mem_ctx,
 675                                   struct dcerpc_auth *auth_info,
 676                                   DATA_BLOB *response)
 677 {
 678         NTSTATUS status;
 679         struct gse_context *gse_ctx = NULL;
 680
 681         status = gssapi_server_auth_start(p,
 682                                           (auth_info->auth_level ==
 683                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 684                                           (auth_info->auth_level ==
 685                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 686                                           true,
 687                                           &auth_info->credentials,
 688                                           response,
 689                                           &gse_ctx);
 690         if (!NT_STATUS_IS_OK(status)) {
 691                 DEBUG(0, ("Failed to init dcerpc gssapi server (%s)\n",
 692                           nt_errstr(status)));
 693                 goto err;
 694         }
 695
 696         /* Make sure data is bound to the memctx, to be freed the caller */
 697         talloc_steal(mem_ctx, response->data);
 698
 699         p->auth.auth_ctx = gse_ctx;
 700         p->auth.auth_type = DCERPC_AUTH_TYPE_KRB5;
 701
 702         DEBUG(10, ("KRB5 auth started\n"));
 703
 704         return true;
 705
 706 err:
 707         TALLOC_FREE(gse_ctx);
 708         return false;
 709 }
 710
 711 static NTSTATUS pipe_gssapi_verify_final(TALLOC_CTX *mem_ctx,
 712                                          struct gse_context *gse_ctx,
 713                                          struct client_address *client_id,
 714                                          struct auth_serversupplied_info **session_info)
 715 {
 716         NTSTATUS status;
 717         bool bret;
 718
 719         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 720            ensure the underlying flags are also set. If not we should
 721            refuse the bind. */
 722
 723         status = gssapi_server_check_flags(gse_ctx);
 724         if (!NT_STATUS_IS_OK(status)) {
 725                 DEBUG(0, ("Requested Security Layers not honored!\n"));
 726                 return status;
 727         }
 728
 729         status = gssapi_server_get_user_info(gse_ctx, mem_ctx,
 730                                              client_id, session_info);
 731         if (!NT_STATUS_IS_OK(status)) {
 732                 DEBUG(0, (__location__ ": failed to obtain the server info "
 733                           "for authenticated user: %s\n", nt_errstr(status)));
 734                 return status;
 735         }
 736
 737         if ((*session_info)->security_token == NULL) {
 738                 status = create_local_token(*session_info);
 739                 if (!NT_STATUS_IS_OK(status)) {
 740                         DEBUG(1, ("Failed to create local user token (%s)\n",
 741                                   nt_errstr(status)));
 742                         status = NT_STATUS_ACCESS_DENIED;
 743                         return status;
 744                 }
 745         }
 746
 747         /* TODO: this is what the ntlmssp code does with the session_key, check
 748          * it is ok with gssapi too */
 749         /*
 750          * We're an authenticated bind over smb, so the session key needs to
 751          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 752          * does. See the RPC-SAMBA3SESSIONKEY.
 753          */
 754
 755         bret = session_info_set_session_key((*session_info), generic_session_key());
 756         if (!bret) {
 757                 return NT_STATUS_ACCESS_DENIED;
 758         }
 759
 760         return NT_STATUS_OK;
 761 }
 762
 763 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 764 {
 765         enum spnego_mech auth_type;
 766         struct auth_ntlmssp_state *ntlmssp_ctx;
 767         struct spnego_context *spnego_ctx;
 768         struct gse_context *gse_ctx;
 769         void *mech_ctx;
 770         NTSTATUS status;
 771
 772         switch (p->auth.auth_type) {
 773         case DCERPC_AUTH_TYPE_NTLMSSP:
 774                 ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 775                                                     struct auth_ntlmssp_state);
 776                 if (!pipe_ntlmssp_verify_final(p, ntlmssp_ctx,
 777                                                 p->auth.auth_level,
 778                                                 p->client_id, &p->syntax,
 779                                                 &p->session_info)) {
 780                         return NT_STATUS_ACCESS_DENIED;
 781                 }
 782                 break;
 783         case DCERPC_AUTH_TYPE_KRB5:
 784                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 785                                                 struct gse_context);
 786                 status = pipe_gssapi_verify_final(p, gse_ctx,
 787                                                   p->client_id,
 788                                                   &p->session_info);
 789                 if (!NT_STATUS_IS_OK(status)) {
 790                         DEBUG(1, ("gssapi bind failed with: %s",
 791                                   nt_errstr(status)));
 792                         return status;
 793                 }
 794                 break;
 795         case DCERPC_AUTH_TYPE_SPNEGO:
 796                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 797                                                    struct spnego_context);
 798                 status = spnego_get_negotiated_mech(spnego_ctx,
 799                                                     &auth_type, &mech_ctx);
 800                 if (!NT_STATUS_IS_OK(status)) {
 801                         DEBUG(0, ("Bad SPNEGO state (%s)\n",
 802                                   nt_errstr(status)));
 803                         return status;
 804                 }
 805                 switch(auth_type) {
 806                 case SPNEGO_KRB5:
 807                         gse_ctx = talloc_get_type_abort(mech_ctx,
 808                                                         struct gse_context);
 809                         status = pipe_gssapi_verify_final(p, gse_ctx,
 810                                                           p->client_id,
 811                                                           &p->session_info);
 812                         if (!NT_STATUS_IS_OK(status)) {
 813                                 DEBUG(1, ("gssapi bind failed with: %s",
 814                                           nt_errstr(status)));
 815                                 return status;
 816                         }
 817                         break;
 818                 case SPNEGO_NTLMSSP:
 819                         ntlmssp_ctx = talloc_get_type_abort(mech_ctx,
 820                                                 struct auth_ntlmssp_state);
 821                         if (!pipe_ntlmssp_verify_final(p, ntlmssp_ctx,
 822                                                         p->auth.auth_level,
 823                                                         p->client_id,
 824                                                         &p->syntax,
 825                                                         &p->session_info)) {
 826                                 return NT_STATUS_ACCESS_DENIED;
 827                         }
 828                         break;
 829                 default:
 830                         DEBUG(0, (__location__ ": incorrect spnego type "
 831                                   "(%d).\n", auth_type));
 832                         return NT_STATUS_ACCESS_DENIED;
 833                 }
 834                 break;
 835         default:
 836                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
 837                           (unsigned int)p->auth.auth_type));
 838                 return NT_STATUS_ACCESS_DENIED;
 839         }
 840
 841         p->pipe_bound = true;
 842
 843         return NT_STATUS_OK;
 844 }
 845
 846 /*******************************************************************
 847  Respond to a pipe bind request.
 848 *******************************************************************/
 849
 850 static bool api_pipe_bind_req(struct pipes_struct *p,
 851                                 struct ncacn_packet *pkt)
 852 {
 853         struct dcerpc_auth auth_info;
 854         uint16 assoc_gid;
 855         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
 856         NTSTATUS status;
 857         struct ndr_syntax_id id;
 858         union dcerpc_payload u;
 859         struct dcerpc_ack_ctx bind_ack_ctx;
 860         DATA_BLOB auth_resp = data_blob_null;
 861         DATA_BLOB auth_blob = data_blob_null;
 862
 863         /* No rebinds on a bound pipe - use alter context. */
 864         if (p->pipe_bound) {
 865                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
 866                          "pipe %s.\n",
 867                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 868                 return setup_bind_nak(p, pkt);
 869         }
 870
 871         if (pkt->u.bind.num_contexts == 0) {
 872                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
 873                 goto err_exit;
 874         }
 875
 876         /*
 877          * Try and find the correct pipe name to ensure
 878          * that this is a pipe name we support.
 879          */
 880         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 881         if (rpc_srv_pipe_exists_by_id(&id)) {
 882                 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 883                         rpc_srv_get_pipe_cli_name(&id),
 884                         rpc_srv_get_pipe_srv_name(&id)));
 885         } else {
 886                 status = smb_probe_module(
 887                         "rpc", get_pipe_name_from_syntax(
 888                                 talloc_tos(),
 889                                 &pkt->u.bind.ctx_list[0].abstract_syntax));
 890
 891                 if (NT_STATUS_IS_ERR(status)) {
 892                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 893                                 get_pipe_name_from_syntax(
 894                                         talloc_tos(),
 895                                         &pkt->u.bind.ctx_list[0].abstract_syntax)));
 896
 897                         return setup_bind_nak(p, pkt);
 898                 }
 899
 900                 if (rpc_srv_get_pipe_interface_by_cli_name(
 901                                 get_pipe_name_from_syntax(talloc_tos(),
 902                                                           &p->syntax),
 903                                 &id)) {
 904                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 905                                 rpc_srv_get_pipe_cli_name(&id),
 906                                 rpc_srv_get_pipe_srv_name(&id)));
 907                 } else {
 908                         DEBUG(0, ("module %s doesn't provide functions for "
 909                                   "pipe %s!\n",
 910                                   get_pipe_name_from_syntax(talloc_tos(),
 911                                                             &p->syntax),
 912                                   get_pipe_name_from_syntax(talloc_tos(),
 913                                                             &p->syntax)));
 914                         return setup_bind_nak(p, pkt);
 915                 }
 916         }
 917
 918         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 919
 920         if (pkt->u.bind.assoc_group_id != 0) {
 921                 assoc_gid = pkt->u.bind.assoc_group_id;
 922         } else {
 923                 assoc_gid = 0x53f0;
 924         }
 925
 926         /*
 927          * Create the bind response struct.
 928          */
 929
 930         /* If the requested abstract synt uuid doesn't match our client pipe,
 931                 reject the bind_ack & set the transfer interface synt to all 0's,
 932                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 933                 unknown to NT4)
 934                 Needed when adding entries to a DACL from NT5 - SK */
 935
 936         if (check_bind_req(p,
 937                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 938                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 939                         pkt->u.bind.ctx_list[0].context_id)) {
 940
 941                 bind_ack_ctx.result = 0;
 942                 bind_ack_ctx.reason = 0;
 943                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 944         } else {
 945                 p->pipe_bound = False;
 946                 /* Rejection reason: abstract syntax not supported */
 947                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 948                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
 949                 bind_ack_ctx.syntax = null_ndr_syntax_id;
 950         }
 951
 952         /*
 953          * Check if this is an authenticated bind request.
 954          */
 955         if (pkt->auth_length) {
 956                 /* Quick length check. Won't catch a bad auth footer,
 957                  * prevents overrun. */
 958
 959                 if (pkt->frag_length < RPC_HEADER_LEN +
 960                                         DCERPC_AUTH_TRAILER_LENGTH +
 961                                         pkt->auth_length) {
 962                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
 963                                 "too long for fragment %u.\n",
 964                                 (unsigned int)pkt->auth_length,
 965                                 (unsigned int)pkt->frag_length));
 966                         goto err_exit;
 967                 }
 968
 969                 /*
 970                  * Decode the authentication verifier.
 971                  */
 972                 status = dcerpc_pull_dcerpc_auth(pkt,
 973                                                  &pkt->u.bind.auth_info,
 974                                                  &auth_info, p->endian);
 975                 if (!NT_STATUS_IS_OK(status)) {
 976                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
 977                         goto err_exit;
 978                 }
 979
 980                 auth_type = auth_info.auth_type;
 981
 982                 /* Work out if we have to sign or seal etc. */
 983                 switch (auth_info.auth_level) {
 984                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 985                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 986                         break;
 987                 case DCERPC_AUTH_LEVEL_PRIVACY:
 988                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 989                         break;
 990                 default:
 991                         DEBUG(0, ("Unexpected auth level (%u).\n",
 992                                 (unsigned int)auth_info.auth_level ));
 993                         goto err_exit;
 994                 }
 995
 996                 switch (auth_type) {
 997                 case DCERPC_AUTH_TYPE_NTLMSSP:
 998                         if (!pipe_ntlmssp_auth_bind(p, pkt,
 999                                                 &auth_info, &auth_resp)) {
1000                                 goto err_exit;
1001                         }
1002                         assoc_gid = 0x7a77;
1003                         break;
1004
1005                 case DCERPC_AUTH_TYPE_SCHANNEL:
1006                         if (!pipe_schannel_auth_bind(p, pkt,
1007                                                 &auth_info, &auth_resp)) {
1008                                 goto err_exit;
1009                         }
1010                         break;
1011
1012                 case DCERPC_AUTH_TYPE_SPNEGO:
1013                         if (!pipe_spnego_auth_bind(p, pkt,
1014                                                 &auth_info, &auth_resp)) {
1015                                 goto err_exit;
1016                         }
1017                         break;
1018
1019                 case DCERPC_AUTH_TYPE_KRB5:
1020                         if (!pipe_gssapi_auth_bind(p, pkt,
1021                                                 &auth_info, &auth_resp)) {
1022                                 goto err_exit;
1023                         }
1024                         break;
1025
1026                 case DCERPC_AUTH_TYPE_NONE:
1027                         break;
1028
1029                 default:
1030                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
1031                         goto err_exit;
1032                 }
1033         }
1034
1035         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
1036                 /* Unauthenticated bind request. */
1037                 /* We're finished - no more packets. */
1038                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
1039                 /* We must set the pipe auth_level here also. */
1040                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1041                 p->pipe_bound = True;
1042                 /* The session key was initialized from the SMB
1043                  * session in make_internal_rpc_pipe_p */
1044         }
1045
1046         ZERO_STRUCT(u.bind_ack);
1047         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1048         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1049         u.bind_ack.assoc_group_id = assoc_gid;
1050
1051         /* name has to be \PIPE\xxxxx */
1052         u.bind_ack.secondary_address =
1053                         talloc_asprintf(pkt, "\\PIPE\\%s",
1054                                         rpc_srv_get_pipe_srv_name(&id));
1055         if (!u.bind_ack.secondary_address) {
1056                 DEBUG(0, ("Out of memory!\n"));
1057                 goto err_exit;
1058         }
1059         u.bind_ack.secondary_address_size =
1060                                 strlen(u.bind_ack.secondary_address) + 1;
1061
1062         u.bind_ack.num_results = 1;
1063         u.bind_ack.ctx_list = &bind_ack_ctx;
1064
1065         /* NOTE: We leave the auth_info empty so we can calculate the padding
1066          * later and then append the auth_info --simo */
1067
1068         /*
1069          * Marshall directly into the outgoing PDU space. We
1070          * must do this as we need to set to the bind response
1071          * header and are never sending more than one PDU here.
1072          */
1073
1074         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1075                                           DCERPC_PKT_BIND_ACK,
1076                                           DCERPC_PFC_FLAG_FIRST |
1077                                                 DCERPC_PFC_FLAG_LAST,
1078                                           auth_resp.length,
1079                                           pkt->call_id,
1080                                           &u,
1081                                           &p->out_data.frag);
1082         if (!NT_STATUS_IS_OK(status)) {
1083                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1084                           nt_errstr(status)));
1085         }
1086
1087         if (auth_resp.length) {
1088
1089                 status = dcerpc_push_dcerpc_auth(pkt,
1090                                                  auth_type,
1091                                                  auth_info.auth_level,
1092                                                  0,
1093                                                  1, /* auth_context_id */
1094                                                  &auth_resp,
1095                                                  &auth_blob);
1096                 if (!NT_STATUS_IS_OK(status)) {
1097                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1098                         goto err_exit;
1099                 }
1100         }
1101
1102         /* Now that we have the auth len store it into the right place in
1103          * the dcerpc header */
1104         dcerpc_set_frag_length(&p->out_data.frag,
1105                                 p->out_data.frag.length + auth_blob.length);
1106
1107         if (auth_blob.length) {
1108
1109                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1110                                         auth_blob.data, auth_blob.length)) {
1111                         DEBUG(0, ("Append of auth info failed.\n"));
1112                         goto err_exit;
1113                 }
1114         }
1115
1116         /*
1117          * Setup the lengths for the initial reply.
1118          */
1119
1120         p->out_data.data_sent_length = 0;
1121         p->out_data.current_pdu_sent = 0;
1122
1123         TALLOC_FREE(auth_blob.data);
1124         return True;
1125
1126   err_exit:
1127
1128         data_blob_free(&p->out_data.frag);
1129         TALLOC_FREE(auth_blob.data);
1130         return setup_bind_nak(p, pkt);
1131 }
1132
1133 /*******************************************************************
1134  This is the "stage3" response after a bind request and reply.
1135 *******************************************************************/
1136
1137 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
1138 {
1139         struct dcerpc_auth auth_info;
1140         DATA_BLOB response = data_blob_null;
1141         struct auth_ntlmssp_state *ntlmssp_ctx;
1142         struct spnego_context *spnego_ctx;
1143         struct gse_context *gse_ctx;
1144         NTSTATUS status;
1145
1146         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
1147
1148         if (pkt->auth_length == 0) {
1149                 DEBUG(0, ("No auth field sent for bind request!\n"));
1150                 goto err;
1151         }
1152
1153         /* Ensure there's enough data for an authenticated request. */
1154         if (pkt->frag_length < RPC_HEADER_LEN
1155                                 + DCERPC_AUTH_TRAILER_LENGTH
1156                                 + pkt->auth_length) {
1157                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
1158                                 "%u is too large.\n",
1159                         (unsigned int)pkt->auth_length));
1160                 goto err;
1161         }
1162
1163         /*
1164          * Decode the authentication verifier response.
1165          */
1166
1167         status = dcerpc_pull_dcerpc_auth(pkt,
1168                                          &pkt->u.auth3.auth_info,
1169                                          &auth_info, p->endian);
1170         if (!NT_STATUS_IS_OK(status)) {
1171                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
1172                 goto err;
1173         }
1174
1175         /* We must NEVER look at auth_info->auth_pad_len here,
1176          * as old Samba client code gets it wrong and sends it
1177          * as zero. JRA.
1178          */
1179
1180         if (auth_info.auth_type != p->auth.auth_type) {
1181                 DEBUG(0, ("Auth type mismatch! Client sent %d, "
1182                           "but auth was started as type %d!\n",
1183                           auth_info.auth_type, p->auth.auth_type));
1184                 goto err;
1185         }
1186
1187         switch (auth_info.auth_type) {
1188         case DCERPC_AUTH_TYPE_NTLMSSP:
1189                 ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1190                                                     struct auth_ntlmssp_state);
1191                 status = ntlmssp_server_step(ntlmssp_ctx,
1192                                              pkt, &auth_info.credentials,
1193                                              &response);
1194                 break;
1195         case DCERPC_AUTH_TYPE_KRB5:
1196                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1197                                                 struct gse_context);
1198                 status = gssapi_server_step(gse_ctx,
1199                                             pkt, &auth_info.credentials,
1200                                             &response);
1201                 break;
1202         case DCERPC_AUTH_TYPE_SPNEGO:
1203                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1204                                                    struct spnego_context);
1205                 status = spnego_server_step(spnego_ctx,
1206                                             pkt, &auth_info.credentials,
1207                                             &response);
1208                 break;
1209         default:
1210                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
1211                           (unsigned int)auth_info.auth_type));
1212                 return false;
1213         }
1214
1215         if (NT_STATUS_EQUAL(status,
1216                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1217             response.length) {
1218                 DEBUG(0, (__location__ ": This was supposed to be the final "
1219                           "leg, but crypto machinery claims a response is "
1220                           "needed, aborting auth!\n"));
1221                 data_blob_free(&response);
1222                 goto err;
1223         }
1224         if (!NT_STATUS_IS_OK(status)) {
1225                 DEBUG(0, ("Auth failed (%s)\n", nt_errstr(status)));
1226                 goto err;
1227         }
1228
1229         /* Now verify auth was indeed successful and extract server info */
1230         status = pipe_auth_verify_final(p);
1231         if (!NT_STATUS_IS_OK(status)) {
1232                 DEBUG(0, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1233                 goto err;
1234         }
1235
1236         return true;
1237
1238 err:
1239
1240         TALLOC_FREE(p->auth.auth_ctx);
1241         return false;
1242 }
1243
1244 /****************************************************************************
1245  Deal with an alter context call. Can be third part of 3 leg auth request for
1246  SPNEGO calls.
1247 ****************************************************************************/
1248
1249 static bool api_pipe_alter_context(struct pipes_struct *p,
1250                                         struct ncacn_packet *pkt)
1251 {
1252         struct dcerpc_auth auth_info;
1253         uint16 assoc_gid;
1254         NTSTATUS status;
1255         union dcerpc_payload u;
1256         struct dcerpc_ack_ctx bind_ack_ctx;
1257         DATA_BLOB auth_resp = data_blob_null;
1258         DATA_BLOB auth_blob = data_blob_null;
1259         int pad_len = 0;
1260         struct auth_ntlmssp_state *ntlmssp_ctx;
1261         struct spnego_context *spnego_ctx;
1262         struct gse_context *gse_ctx;
1263
1264         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1265
1266         if (pkt->u.bind.assoc_group_id != 0) {
1267                 assoc_gid = pkt->u.bind.assoc_group_id;
1268         } else {
1269                 assoc_gid = 0x53f0;
1270         }
1271
1272         /*
1273          * Create the bind response struct.
1274          */
1275
1276         /* If the requested abstract synt uuid doesn't match our client pipe,
1277                 reject the bind_ack & set the transfer interface synt to all 0's,
1278                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1279                 unknown to NT4)
1280                 Needed when adding entries to a DACL from NT5 - SK */
1281
1282         if (check_bind_req(p,
1283                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1284                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1285                         pkt->u.bind.ctx_list[0].context_id)) {
1286
1287                 bind_ack_ctx.result = 0;
1288                 bind_ack_ctx.reason = 0;
1289                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1290         } else {
1291                 p->pipe_bound = False;
1292                 /* Rejection reason: abstract syntax not supported */
1293                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1294                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1295                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1296         }
1297
1298         /*
1299          * Check if this is an authenticated alter context request.
1300          */
1301         if (pkt->auth_length) {
1302                 /* Quick length check. Won't catch a bad auth footer,
1303                  * prevents overrun. */
1304
1305                 if (pkt->frag_length < RPC_HEADER_LEN +
1306                                         DCERPC_AUTH_TRAILER_LENGTH +
1307                                         pkt->auth_length) {
1308                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1309                                 "too long for fragment %u.\n",
1310                                 (unsigned int)pkt->auth_length,
1311                                 (unsigned int)pkt->frag_length ));
1312                         goto err_exit;
1313                 }
1314
1315                 status = dcerpc_pull_dcerpc_auth(pkt,
1316                                                  &pkt->u.bind.auth_info,
1317                                                  &auth_info, p->endian);
1318                 if (!NT_STATUS_IS_OK(status)) {
1319                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1320                         goto err_exit;
1321                 }
1322
1323                 /* We can only finish if the pipe is unbound for now */
1324                 if (p->pipe_bound) {
1325                         DEBUG(0, (__location__ ": Pipe already bound, "
1326                                   "Altering Context not yet supported!\n"));
1327                         goto err_exit;
1328                 }
1329
1330                 if (auth_info.auth_type != p->auth.auth_type) {
1331                         DEBUG(0, ("Auth type mismatch! Client sent %d, "
1332                                   "but auth was started as type %d!\n",
1333                                   auth_info.auth_type, p->auth.auth_type));
1334                         goto err_exit;
1335                 }
1336
1337
1338                 switch (auth_info.auth_type) {
1339                 case DCERPC_AUTH_TYPE_SPNEGO:
1340                         spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1341                                                         struct spnego_context);
1342                         status = spnego_server_step(spnego_ctx,
1343                                                     pkt,
1344                                                     &auth_info.credentials,
1345                                                     &auth_resp);
1346                         break;
1347
1348                 case DCERPC_AUTH_TYPE_KRB5:
1349                         gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1350                                                         struct gse_context);
1351                         status = gssapi_server_step(gse_ctx,
1352                                                     pkt,
1353                                                     &auth_info.credentials,
1354                                                     &auth_resp);
1355                         break;
1356                 case DCERPC_AUTH_TYPE_NTLMSSP:
1357                         ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1358                                                     struct auth_ntlmssp_state);
1359                         status = ntlmssp_server_step(ntlmssp_ctx,
1360                                                      pkt,
1361                                                      &auth_info.credentials,
1362                                                      &auth_resp);
1363                         break;
1364
1365                 default:
1366                         DEBUG(3, (__location__ ": Usupported auth type (%d) "
1367                                   "in alter-context call\n",
1368                                   auth_info.auth_type));
1369                         goto err_exit;
1370                 }
1371
1372                 if (NT_STATUS_IS_OK(status)) {
1373                         /* third leg of auth, verify auth info */
1374                         status = pipe_auth_verify_final(p);
1375                         if (!NT_STATUS_IS_OK(status)) {
1376                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1377                                           nt_errstr(status)));
1378                                 goto err_exit;
1379                         }
1380                 } else if (NT_STATUS_EQUAL(status,
1381                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1382                         DEBUG(10, ("More auth legs required.\n"));
1383                 } else {
1384                         DEBUG(0, ("Auth step returned an error (%s)\n",
1385                                   nt_errstr(status)));
1386                         goto err_exit;
1387                 }
1388         }
1389
1390         ZERO_STRUCT(u.alter_resp);
1391         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1392         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1393         u.alter_resp.assoc_group_id = assoc_gid;
1394
1395         /* secondary address CAN be NULL
1396          * as the specs say it's ignored.
1397          * It MUST be NULL to have the spoolss working.
1398          */
1399         u.alter_resp.secondary_address = "";
1400         u.alter_resp.secondary_address_size = 1;
1401
1402         u.alter_resp.num_results = 1;
1403         u.alter_resp.ctx_list = &bind_ack_ctx;
1404
1405         /* NOTE: We leave the auth_info empty so we can calculate the padding
1406          * later and then append the auth_info --simo */
1407
1408         /*
1409          * Marshall directly into the outgoing PDU space. We
1410          * must do this as we need to set to the bind response
1411          * header and are never sending more than one PDU here.
1412          */
1413
1414         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1415                                           DCERPC_PKT_ALTER_RESP,
1416                                           DCERPC_PFC_FLAG_FIRST |
1417                                                 DCERPC_PFC_FLAG_LAST,
1418                                           auth_resp.length,
1419                                           pkt->call_id,
1420                                           &u,
1421                                           &p->out_data.frag);
1422         if (!NT_STATUS_IS_OK(status)) {
1423                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1424                           nt_errstr(status)));
1425         }
1426
1427         if (auth_resp.length) {
1428
1429                 /* Work out any padding needed before the auth footer. */
1430                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1431                 if (pad_len) {
1432                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1433                         DEBUG(10, ("auth pad_len = %u\n",
1434                                    (unsigned int)pad_len));
1435                 }
1436
1437                 status = dcerpc_push_dcerpc_auth(pkt,
1438                                                  auth_info.auth_type,
1439                                                  auth_info.auth_level,
1440                                                  pad_len,
1441                                                  1, /* auth_context_id */
1442                                                  &auth_resp,
1443                                                  &auth_blob);
1444                 if (!NT_STATUS_IS_OK(status)) {
1445                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1446                         goto err_exit;
1447                 }
1448         }
1449
1450         /* Now that we have the auth len store it into the right place in
1451          * the dcerpc header */
1452         dcerpc_set_frag_length(&p->out_data.frag,
1453                                 p->out_data.frag.length +
1454                                         pad_len + auth_blob.length);
1455
1456         if (auth_resp.length) {
1457                 if (pad_len) {
1458                         char pad[SERVER_NDR_PADDING_SIZE];
1459                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1460                         if (!data_blob_append(p->mem_ctx,
1461                                                 &p->out_data.frag,
1462                                                 pad, pad_len)) {
1463                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1464                                           "%u bytes of pad data.\n",
1465                                           (unsigned int)pad_len));
1466                                 goto err_exit;
1467                         }
1468                 }
1469
1470                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1471                                         auth_blob.data, auth_blob.length)) {
1472                         DEBUG(0, ("Append of auth info failed.\n"));
1473                         goto err_exit;
1474                 }
1475         }
1476
1477         /*
1478          * Setup the lengths for the initial reply.
1479          */
1480
1481         p->out_data.data_sent_length = 0;
1482         p->out_data.current_pdu_sent = 0;
1483
1484         TALLOC_FREE(auth_blob.data);
1485         return True;
1486
1487   err_exit:
1488
1489         data_blob_free(&p->out_data.frag);
1490         TALLOC_FREE(auth_blob.data);
1491         return setup_bind_nak(p, pkt);
1492 }
1493
1494 /****************************************************************************
1495  Find the set of RPC functions associated with this context_id
1496 ****************************************************************************/
1497
1498 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
1499 {
1500         PIPE_RPC_FNS *fns = NULL;
1501
1502         if ( !list ) {
1503                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
1504                 return NULL;
1505         }
1506
1507         for (fns=list; fns; fns=fns->next ) {
1508                 if ( fns->context_id == context_id )
1509                         return fns;
1510         }
1511         return NULL;
1512 }
1513
1514 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1515                        const struct api_struct *api_rpc_cmds, int n_cmds);
1516
1517 /****************************************************************************
1518  Find the correct RPC function to call for this request.
1519  If the pipe is authenticated then become the correct UNIX user
1520  before doing the call.
1521 ****************************************************************************/
1522
1523 static bool api_pipe_request(struct pipes_struct *p,
1524                                 struct ncacn_packet *pkt)
1525 {
1526         bool ret = False;
1527         bool changed_user = False;
1528         PIPE_RPC_FNS *pipe_fns;
1529
1530         if (p->pipe_bound &&
1531             ((p->auth.auth_type == DCERPC_AUTH_TYPE_NTLMSSP) ||
1532              (p->auth.auth_type == DCERPC_AUTH_TYPE_KRB5) ||
1533              (p->auth.auth_type == DCERPC_AUTH_TYPE_SPNEGO))) {
1534                 if(!become_authenticated_pipe_user(p)) {
1535                         data_blob_free(&p->out_data.rdata);
1536                         return False;
1537                 }
1538                 changed_user = True;
1539         }
1540
1541         DEBUG(5, ("Requested \\PIPE\\%s\n",
1542                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1543
1544         /* get the set of RPC functions for this context */
1545
1546         pipe_fns = find_pipe_fns_by_context(p->contexts,
1547                                             pkt->u.request.context_id);
1548
1549         if ( pipe_fns ) {
1550                 TALLOC_CTX *frame = talloc_stackframe();
1551                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds);
1552                 TALLOC_FREE(frame);
1553         }
1554         else {
1555                 DEBUG(0, ("No rpc function table associated with context "
1556                           "[%d] on pipe [%s]\n",
1557                           pkt->u.request.context_id,
1558                           get_pipe_name_from_syntax(talloc_tos(),
1559                                                     &p->syntax)));
1560         }
1561
1562         if (changed_user) {
1563                 unbecome_authenticated_pipe_user();
1564         }
1565
1566         return ret;
1567 }
1568
1569 /*******************************************************************
1570  Calls the underlying RPC function for a named pipe.
1571  ********************************************************************/
1572
1573 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1574                        const struct api_struct *api_rpc_cmds, int n_cmds)
1575 {
1576         int fn_num;
1577         uint32_t offset1;
1578
1579         /* interpret the command */
1580         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1581                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1582                  pkt->u.request.opnum));
1583
1584         if (DEBUGLEVEL >= 50) {
1585                 fstring name;
1586                 slprintf(name, sizeof(name)-1, "in_%s",
1587                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1588                 dump_pdu_region(name, pkt->u.request.opnum,
1589                                 &p->in_data.data, 0,
1590                                 p->in_data.data.length);
1591         }
1592
1593         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1594                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1595                     api_rpc_cmds[fn_num].fn != NULL) {
1596                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1597                                   api_rpc_cmds[fn_num].name));
1598                         break;
1599                 }
1600         }
1601
1602         if (fn_num == n_cmds) {
1603                 /*
1604                  * For an unknown RPC just return a fault PDU but
1605                  * return True to allow RPC's on the pipe to continue
1606                  * and not put the pipe into fault state. JRA.
1607                  */
1608                 DEBUG(4, ("unknown\n"));
1609                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1610                 return True;
1611         }
1612
1613         offset1 = p->out_data.rdata.length;
1614
1615         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1616                 fn_num, api_rpc_cmds[fn_num].fn));
1617         /* do the actual command */
1618         if(!api_rpc_cmds[fn_num].fn(p)) {
1619                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1620                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1621                          api_rpc_cmds[fn_num].name));
1622                 data_blob_free(&p->out_data.rdata);
1623                 return False;
1624         }
1625
1626         if (p->bad_handle_fault_state) {
1627                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1628                 p->bad_handle_fault_state = False;
1629                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
1630                 return True;
1631         }
1632
1633         if (p->rng_fault_state) {
1634                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
1635                 p->rng_fault_state = False;
1636                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1637                 return True;
1638         }
1639
1640         if (DEBUGLEVEL >= 50) {
1641                 fstring name;
1642                 slprintf(name, sizeof(name)-1, "out_%s",
1643                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1644                 dump_pdu_region(name, pkt->u.request.opnum,
1645                                 &p->out_data.rdata, offset1,
1646                                 p->out_data.rdata.length);
1647         }
1648
1649         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1650                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1651
1652         /* Check for buffer underflow in rpc parsing */
1653         if ((DEBUGLEVEL >= 10) &&
1654             (pkt->frag_length < p->in_data.data.length)) {
1655                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1656                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1657                               p->in_data.data.length - pkt->frag_length);
1658         }
1659
1660         return True;
1661 }
1662
1663 /****************************************************************************
1664  Initialise an outgoing packet.
1665 ****************************************************************************/
1666
1667 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1668 {
1669         output_data *o_data = &p->out_data;
1670
1671         /* Reset the offset counters. */
1672         o_data->data_sent_length = 0;
1673         o_data->current_pdu_sent = 0;
1674
1675         data_blob_free(&o_data->frag);
1676
1677         /* Free any memory in the current return data buffer. */
1678         data_blob_free(&o_data->rdata);
1679
1680         return True;
1681 }
1682
1683 /****************************************************************************
1684  Sets the fault state on incoming packets.
1685 ****************************************************************************/
1686
1687 void set_incoming_fault(struct pipes_struct *p)
1688 {
1689         data_blob_free(&p->in_data.data);
1690         p->in_data.pdu_needed_len = 0;
1691         p->in_data.pdu.length = 0;
1692         p->fault_state = True;
1693         DEBUG(10, ("set_incoming_fault: Setting fault state on pipe %s\n",
1694                    get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1695 }
1696
1697 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1698                                     struct ncacn_packet *pkt,
1699                                     DATA_BLOB *raw_pkt)
1700 {
1701         NTSTATUS status;
1702         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1703         size_t pad_len;
1704
1705         DEBUG(10, ("Checking request auth.\n"));
1706
1707         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1708                 hdr_size += 16;
1709         }
1710
1711         /* in case of sealing this function will unseal the data in place */
1712         status = dcerpc_check_auth(auth, pkt,
1713                                    &pkt->u.request.stub_and_verifier,
1714                                    hdr_size, raw_pkt,
1715                                    &pad_len);
1716         if (!NT_STATUS_IS_OK(status)) {
1717                 return status;
1718         }
1719
1720
1721         /* remove padding and auth trailer,
1722          * this way the caller will get just the data */
1723         if (pkt->auth_length) {
1724                 size_t trail_len = pad_len
1725                                         + DCERPC_AUTH_TRAILER_LENGTH
1726                                         + pkt->auth_length;
1727                 if (pkt->u.request.stub_and_verifier.length < trail_len) {
1728                         return NT_STATUS_INFO_LENGTH_MISMATCH;
1729                 }
1730                 pkt->u.request.stub_and_verifier.length -= trail_len;
1731         }
1732
1733         return NT_STATUS_OK;
1734 }
1735
1736 /****************************************************************************
1737  Processes a request pdu. This will do auth processing if needed, and
1738  appends the data into the complete stream if the LAST flag is not set.
1739 ****************************************************************************/
1740
1741 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1742 {
1743         NTSTATUS status;
1744         DATA_BLOB data;
1745
1746         if (!p->pipe_bound) {
1747                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1748                 set_incoming_fault(p);
1749                 return False;
1750         }
1751
1752         /* Store the opnum */
1753         p->opnum = pkt->u.request.opnum;
1754
1755         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1756         if (!NT_STATUS_IS_OK(status)) {
1757                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1758                           nt_errstr(status)));
1759                 set_incoming_fault(p);
1760                 return false;
1761         }
1762
1763         data = pkt->u.request.stub_and_verifier;
1764
1765         /*
1766          * Check the data length doesn't go over the 15Mb limit.
1767          * increased after observing a bug in the Windows NT 4.0 SP6a
1768          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1769          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1770          */
1771
1772         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1773                 DEBUG(0, ("process_request_pdu: "
1774                           "rpc data buffer too large (%u) + (%u)\n",
1775                           (unsigned int)p->in_data.data.length,
1776                           (unsigned int)data.length));
1777                 set_incoming_fault(p);
1778                 return False;
1779         }
1780
1781         /*
1782          * Append the data portion into the buffer and return.
1783          */
1784
1785         if (data.length) {
1786                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1787                                           data.data, data.length)) {
1788                         DEBUG(0, ("Unable to append data size %u "
1789                                   "to parse buffer of size %u.\n",
1790                                   (unsigned int)data.length,
1791                                   (unsigned int)p->in_data.data.length));
1792                         set_incoming_fault(p);
1793                         return False;
1794                 }
1795         }
1796
1797         if (pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1798                 bool ret = False;
1799                 /*
1800                  * Ok - we finally have a complete RPC stream.
1801                  * Call the rpc command to process it.
1802                  */
1803
1804                 /*
1805                  * Process the complete data stream here.
1806                  */
1807                 if (pipe_init_outgoing_data(p)) {
1808                         ret = api_pipe_request(p, pkt);
1809                 }
1810
1811                 return ret;
1812         }
1813
1814         return True;
1815 }
1816
1817 /****************************************************************************
1818  Processes a finished PDU stored in p->in_data.pdu.
1819 ****************************************************************************/
1820
1821 void process_complete_pdu(struct pipes_struct *p)
1822 {
1823         struct ncacn_packet *pkt = NULL;
1824         NTSTATUS status;
1825         bool reply = False;
1826
1827         if(p->fault_state) {
1828                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
1829                           get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1830                 goto done;
1831         }
1832
1833         pkt = talloc(p->mem_ctx, struct ncacn_packet);
1834         if (!pkt) {
1835                 DEBUG(0, ("Out of memory!\n"));
1836                 goto done;
1837         }
1838
1839         /*
1840          * Ensure we're using the corrent endianness for both the
1841          * RPC header flags and the raw data we will be reading from.
1842          */
1843         if (dcerpc_get_endian_flag(&p->in_data.pdu) & DCERPC_DREP_LE) {
1844                 p->endian = RPC_LITTLE_ENDIAN;
1845         } else {
1846                 p->endian = RPC_BIG_ENDIAN;
1847         }
1848         DEBUG(10, ("PDU is in %s Endian format!\n", p->endian?"Big":"Little"));
1849
1850         status = dcerpc_pull_ncacn_packet(pkt, &p->in_data.pdu,
1851                                           pkt, p->endian);
1852         if (!NT_STATUS_IS_OK(status)) {
1853                 DEBUG(0, ("Failed to unmarshal rpc packet: %s!\n",
1854                           nt_errstr(status)));
1855                 goto done;
1856         }
1857
1858         /* Store the call_id */
1859         p->call_id = pkt->call_id;
1860
1861         DEBUG(10, ("Processing packet type %d\n", (int)pkt->ptype));
1862
1863         switch (pkt->ptype) {
1864         case DCERPC_PKT_REQUEST:
1865                 reply = process_request_pdu(p, pkt);
1866                 break;
1867
1868         case DCERPC_PKT_PING: /* CL request - ignore... */
1869                 DEBUG(0, ("process_complete_pdu: Error. "
1870                           "Connectionless packet type %d received on "
1871                           "pipe %s.\n", (int)pkt->ptype,
1872                          get_pipe_name_from_syntax(talloc_tos(),
1873                                                    &p->syntax)));
1874                 break;
1875
1876         case DCERPC_PKT_RESPONSE: /* No responses here. */
1877                 DEBUG(0, ("process_complete_pdu: Error. "
1878                           "DCERPC_PKT_RESPONSE received from client "
1879                           "on pipe %s.\n",
1880                          get_pipe_name_from_syntax(talloc_tos(),
1881                                                    &p->syntax)));
1882                 break;
1883
1884         case DCERPC_PKT_FAULT:
1885         case DCERPC_PKT_WORKING:
1886                 /* CL request - reply to a ping when a call in process. */
1887         case DCERPC_PKT_NOCALL:
1888                 /* CL - server reply to a ping call. */
1889         case DCERPC_PKT_REJECT:
1890         case DCERPC_PKT_ACK:
1891         case DCERPC_PKT_CL_CANCEL:
1892         case DCERPC_PKT_FACK:
1893         case DCERPC_PKT_CANCEL_ACK:
1894                 DEBUG(0, ("process_complete_pdu: Error. "
1895                           "Connectionless packet type %u received on "
1896                           "pipe %s.\n", (unsigned int)pkt->ptype,
1897                          get_pipe_name_from_syntax(talloc_tos(),
1898                                                    &p->syntax)));
1899                 break;
1900
1901         case DCERPC_PKT_BIND:
1902                 /*
1903                  * We assume that a pipe bind is only in one pdu.
1904                  */
1905                 if (pipe_init_outgoing_data(p)) {
1906                         reply = api_pipe_bind_req(p, pkt);
1907                 }
1908                 break;
1909
1910         case DCERPC_PKT_BIND_ACK:
1911         case DCERPC_PKT_BIND_NAK:
1912                 DEBUG(0, ("process_complete_pdu: Error. "
1913                           "DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1914                           "packet type %u received on pipe %s.\n",
1915                           (unsigned int)pkt->ptype,
1916                          get_pipe_name_from_syntax(talloc_tos(),
1917                                                    &p->syntax)));
1918                 break;
1919
1920
1921         case DCERPC_PKT_ALTER:
1922                 /*
1923                  * We assume that a pipe bind is only in one pdu.
1924                  */
1925                 if (pipe_init_outgoing_data(p)) {
1926                         reply = api_pipe_alter_context(p, pkt);
1927                 }
1928                 break;
1929
1930         case DCERPC_PKT_ALTER_RESP:
1931                 DEBUG(0, ("process_complete_pdu: Error. "
1932                           "DCERPC_PKT_ALTER_RESP on pipe %s: "
1933                           "Should only be server -> client.\n",
1934                          get_pipe_name_from_syntax(talloc_tos(),
1935                                                    &p->syntax)));
1936                 break;
1937
1938         case DCERPC_PKT_AUTH3:
1939                 /*
1940                  * The third packet in an auth exchange.
1941                  */
1942                 if (pipe_init_outgoing_data(p)) {
1943                         reply = api_pipe_bind_auth3(p, pkt);
1944                 }
1945                 break;
1946
1947         case DCERPC_PKT_SHUTDOWN:
1948                 DEBUG(0, ("process_complete_pdu: Error. "
1949                           "DCERPC_PKT_SHUTDOWN on pipe %s: "
1950                           "Should only be server -> client.\n",
1951                          get_pipe_name_from_syntax(talloc_tos(),
1952                                                    &p->syntax)));
1953                 break;
1954
1955         case DCERPC_PKT_CO_CANCEL:
1956                 /* For now just free all client data and continue
1957                  * processing. */
1958                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1959                          " Abandoning rpc call.\n"));
1960                 /* As we never do asynchronous RPC serving, we can
1961                  * never cancel a call (as far as I know).
1962                  * If we ever did we'd have to send a cancel_ack reply.
1963                  * For now, just free all client data and continue
1964                  * processing. */
1965                 reply = True;
1966                 break;
1967
1968 #if 0
1969                 /* Enable this if we're doing async rpc. */
1970                 /* We must check the outstanding callid matches. */
1971                 if (pipe_init_outgoing_data(p)) {
1972                         /* Send a cancel_ack PDU reply. */
1973                         /* We should probably check the auth-verifier here. */
1974                         reply = setup_cancel_ack_reply(p, pkt);
1975                 }
1976                 break;
1977 #endif
1978
1979         case DCERPC_PKT_ORPHANED:
1980                 /* We should probably check the auth-verifier here.
1981                  * For now just free all client data and continue
1982                  * processing. */
1983                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
1984                           " Abandoning rpc call.\n"));
1985                 reply = True;
1986                 break;
1987
1988         default:
1989                 DEBUG(0, ("process_complete_pdu: "
1990                           "Unknown rpc type = %u received.\n",
1991                           (unsigned int)pkt->ptype));
1992                 break;
1993         }
1994
1995 done:
1996         if (!reply) {
1997                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on "
1998                          "pipe %s\n", get_pipe_name_from_syntax(talloc_tos(),
1999                                                                 &p->syntax)));
2000                 set_incoming_fault(p);
2001                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2002                 TALLOC_FREE(pkt);
2003         } else {
2004                 /*
2005                  * Reset the lengths. We're ready for a new pdu.
2006                  */
2007                 TALLOC_FREE(p->in_data.pdu.data);
2008                 p->in_data.pdu_needed_len = 0;
2009                 p->in_data.pdu.length = 0;
2010         }
2011
2012         TALLOC_FREE(pkt);
2013 }
2014