source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "srv_pipe_internal.h"
  32 #include "../librpc/gen_ndr/ndr_schannel.h"
  33 #include "../libcli/auth/schannel.h"
  34 #include "../libcli/auth/spnego.h"
  35 #include "../libcli/auth/ntlmssp.h"
  36
  37 #undef DBGC_CLASS
  38 #define DBGC_CLASS DBGC_RPC_SRV
  39
  40 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  41 {
  42         struct auth_ntlmssp_state *a = auth->a_u.auth_ntlmssp_state;
  43
  44         if (a) {
  45                 auth_ntlmssp_end(&a);
  46         }
  47         auth->a_u.auth_ntlmssp_state = NULL;
  48 }
  49
  50 static DATA_BLOB generic_session_key(void)
  51 {
  52         return data_blob("SystemLibraryDTC", 16);
  53 }
  54
  55 /*******************************************************************
  56  Generate the next PDU to be returned from the data in p->rdata.
  57  Handle NTLMSSP.
  58  ********************************************************************/
  59
  60 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  61 {
  62         DATA_BLOB hdr;
  63         uint8_t hdr_flags;
  64         RPC_HDR_RESP hdr_resp;
  65         uint32 ss_padding_len = 0;
  66         uint32 data_space_available;
  67         uint32 data_len_left;
  68         uint32 data_len;
  69         NTSTATUS status;
  70         DATA_BLOB auth_blob;
  71         RPC_HDR_AUTH auth_info;
  72         uint8 auth_type, auth_level;
  73         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
  74         TALLOC_CTX *frame;
  75
  76         /*
  77          * If we're in the fault state, keep returning fault PDU's until
  78          * the pipe gets closed. JRA.
  79          */
  80
  81         if(p->fault_state) {
  82                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  83                 return True;
  84         }
  85
  86         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  87
  88         /* Set up rpc header flags. */
  89         if (p->out_data.data_sent_length == 0) {
  90                 hdr_flags = DCERPC_PFC_FLAG_FIRST;
  91         } else {
  92                 hdr_flags = 0;
  93         }
  94
  95         /*
  96          * Work out how much we can fit in a single PDU.
  97          */
  98
  99         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 100
 101         /*
 102          * Ensure there really is data left to send.
 103          */
 104
 105         if(!data_len_left) {
 106                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 107                 return False;
 108         }
 109
 110         /* Space available - not including padding. */
 111         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN -
 112                 RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 113
 114         /*
 115          * The amount we send is the minimum of the available
 116          * space and the amount left to send.
 117          */
 118
 119         data_len = MIN(data_len_left, data_space_available);
 120
 121         /* Work out any padding alignment requirements. */
 122         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 123                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 124                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 125                 DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 126                         ss_padding_len ));
 127                 /* If we're over filling the packet, we need to make space
 128                  * for the padding at the end of the data. */
 129                 if (data_len + ss_padding_len > data_space_available) {
 130                         data_len -= SERVER_NDR_PADDING_SIZE;
 131                 }
 132         }
 133
 134         /*
 135          * Set up the alloc hint. This should be the data left to
 136          * send.
 137          */
 138
 139         hdr_resp.alloc_hint = data_len_left;
 140
 141         /*
 142          * Work out if this PDU will be the last.
 143          */
 144         if (p->out_data.data_sent_length + data_len >=
 145                                         prs_offset(&p->out_data.rdata)) {
 146                 hdr_flags |= DCERPC_PFC_FLAG_LAST;
 147         }
 148
 149         /*
 150          * Init the parse struct to point at the outgoing
 151          * data.
 152          */
 153         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 154
 155         status = dcerpc_push_ncacn_packet_header(
 156                                 prs_get_mem_context(&p->out_data.frag),
 157                                 DCERPC_PKT_RESPONSE,
 158                                 hdr_flags,
 159                                 RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 160                                   data_len + ss_padding_len +
 161                                   RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE,
 162                                 NTLMSSP_SIG_SIZE,
 163                                 p->call_id,
 164                                 &hdr);
 165         if (!NT_STATUS_IS_OK(status)) {
 166                 DEBUG(0, ("Failed to marshall RPC Header.\n"));
 167                 prs_mem_free(&p->out_data.frag);
 168                 return False;
 169         }
 170
 171         /* Store the header in the data stream. */
 172         if (!prs_copy_data_in(&p->out_data.frag,
 173                                 (char *)hdr.data, hdr.length)) {
 174                 DEBUG(0, ("Out of memory.\n"));
 175                 prs_mem_free(&p->out_data.frag);
 176                 return False;
 177         }
 178
 179         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 180                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 181                 prs_mem_free(&p->out_data.frag);
 182                 return False;
 183         }
 184
 185         /* Copy the data into the PDU. */
 186
 187         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 188                                      p->out_data.data_sent_length, data_len)) {
 189                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 190                 prs_mem_free(&p->out_data.frag);
 191                 return False;
 192         }
 193
 194         /* Copy the sign/seal padding data. */
 195         if (ss_padding_len) {
 196                 char pad[SERVER_NDR_PADDING_SIZE];
 197
 198                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 199                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 200                                       ss_padding_len)) {
 201                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 202                                         (unsigned int)ss_padding_len));
 203                         prs_mem_free(&p->out_data.frag);
 204                         return False;
 205                 }
 206         }
 207
 208
 209         /* Now write out the auth header and null blob. */
 210         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 211                 auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 212         } else {
 213                 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 214         }
 215         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 216                 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 217         } else {
 218                 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 219         }
 220
 221         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 222
 223         if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 224                                 &p->out_data.frag, 0)) {
 225                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 226                 prs_mem_free(&p->out_data.frag);
 227                 return False;
 228         }
 229
 230         /* Generate the sign blob. */
 231
 232         frame = talloc_stackframe();
 233         switch (p->auth.auth_level) {
 234                 case DCERPC_AUTH_LEVEL_PRIVACY:
 235                         /* Data portion is encrypted. */
 236                         status = auth_ntlmssp_seal_packet(
 237                                 a, frame,
 238                                 (uint8_t *)prs_data_p(&p->out_data.frag)
 239                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 240                                 data_len + ss_padding_len,
 241                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 242                                 (size_t)prs_offset(&p->out_data.frag),
 243                                 &auth_blob);
 244                         if (!NT_STATUS_IS_OK(status)) {
 245                                 talloc_free(frame);
 246                                 prs_mem_free(&p->out_data.frag);
 247                                 return False;
 248                         }
 249                         break;
 250                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 251                         /* Data is signed. */
 252                         status = auth_ntlmssp_sign_packet(
 253                                 a, frame,
 254                                 (unsigned char *)prs_data_p(&p->out_data.frag)
 255                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 256                                 data_len + ss_padding_len,
 257                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 258                                 (size_t)prs_offset(&p->out_data.frag),
 259                                 &auth_blob);
 260                         if (!NT_STATUS_IS_OK(status)) {
 261                                 talloc_free(frame);
 262                                 prs_mem_free(&p->out_data.frag);
 263                                 return False;
 264                         }
 265                         break;
 266                 default:
 267                         talloc_free(frame);
 268                         prs_mem_free(&p->out_data.frag);
 269                         return False;
 270         }
 271
 272         /* Append the auth blob. */
 273         if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
 274                               NTLMSSP_SIG_SIZE)) {
 275                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 276                                 (unsigned int)NTLMSSP_SIG_SIZE));
 277                 talloc_free(frame);
 278                 prs_mem_free(&p->out_data.frag);
 279                 return False;
 280         }
 281         talloc_free(frame);
 282
 283         /*
 284          * Setup the counts for this PDU.
 285          */
 286
 287         p->out_data.data_sent_length += data_len;
 288         p->out_data.current_pdu_sent = 0;
 289
 290         return True;
 291 }
 292
 293 /*******************************************************************
 294  Generate the next PDU to be returned from the data in p->rdata.
 295  Return an schannel authenticated fragment.
 296  ********************************************************************/
 297
 298 static bool create_next_pdu_schannel(pipes_struct *p)
 299 {
 300         DATA_BLOB hdr;
 301         uint8_t hdr_flags;
 302         RPC_HDR_RESP hdr_resp;
 303         uint32 ss_padding_len = 0;
 304         uint32 data_len;
 305         uint32 data_space_available;
 306         uint32 data_len_left;
 307         uint32 data_pos;
 308         NTSTATUS status;
 309
 310         /*
 311          * If we're in the fault state, keep returning fault PDU's until
 312          * the pipe gets closed. JRA.
 313          */
 314
 315         if(p->fault_state) {
 316                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 317                 return True;
 318         }
 319
 320         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 321
 322         /* Set up rpc header flags. */
 323         if (p->out_data.data_sent_length == 0) {
 324                 hdr_flags = DCERPC_PFC_FLAG_FIRST;
 325         } else {
 326                 hdr_flags = 0;
 327         }
 328
 329         /*
 330          * Work out how much we can fit in a single PDU.
 331          */
 332
 333         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 334
 335         /*
 336          * Ensure there really is data left to send.
 337          */
 338
 339         if(!data_len_left) {
 340                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 341                 return False;
 342         }
 343
 344         /* Space available - not including padding. */
 345         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 346                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
 347                 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 348
 349         /*
 350          * The amount we send is the minimum of the available
 351          * space and the amount left to send.
 352          */
 353
 354         data_len = MIN(data_len_left, data_space_available);
 355
 356         /* Work out any padding alignment requirements. */
 357         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 358                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 359                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 360                 DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 361                         ss_padding_len ));
 362                 /* If we're over filling the packet, we need to make space
 363                  * for the padding at the end of the data. */
 364                 if (data_len + ss_padding_len > data_space_available) {
 365                         data_len -= SERVER_NDR_PADDING_SIZE;
 366                 }
 367         }
 368
 369         /*
 370          * Set up the alloc hint. This should be the data left to
 371          * send.
 372          */
 373
 374         hdr_resp.alloc_hint = data_len_left;
 375
 376         /*
 377          * Work out if this PDU will be the last.
 378          */
 379         if (p->out_data.data_sent_length + data_len >=
 380                                         prs_offset(&p->out_data.rdata)) {
 381                 hdr_flags |= DCERPC_PFC_FLAG_LAST;
 382         }
 383
 384         /*
 385          * Init the parse struct to point at the outgoing
 386          * data.
 387          */
 388         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 389
 390         status = dcerpc_push_ncacn_packet_header(
 391                                 prs_get_mem_context(&p->out_data.frag),
 392                                 DCERPC_PKT_RESPONSE,
 393                                 hdr_flags,
 394                                 RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 395                                   data_len + ss_padding_len +
 396                                   RPC_HDR_AUTH_LEN +
 397                                   RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 398                                 RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 399                                 p->call_id,
 400                                 &hdr);
 401         if (!NT_STATUS_IS_OK(status)) {
 402                 DEBUG(0, ("Failed to marshall RPC Header.\n"));
 403                 prs_mem_free(&p->out_data.frag);
 404                 return False;
 405         }
 406
 407         /* Store the header in the data stream. */
 408         if (!prs_copy_data_in(&p->out_data.frag,
 409                                 (char *)hdr.data, hdr.length)) {
 410                 DEBUG(0, ("Out of memory.\n"));
 411                 prs_mem_free(&p->out_data.frag);
 412                 return False;
 413         }
 414
 415         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 416                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 417                 prs_mem_free(&p->out_data.frag);
 418                 return False;
 419         }
 420
 421         /* Store the current offset. */
 422         data_pos = prs_offset(&p->out_data.frag);
 423
 424         /* Copy the data into the PDU. */
 425
 426         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 427                                      p->out_data.data_sent_length, data_len)) {
 428                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 429                 prs_mem_free(&p->out_data.frag);
 430                 return False;
 431         }
 432
 433         /* Copy the sign/seal padding data. */
 434         if (ss_padding_len) {
 435                 char pad[SERVER_NDR_PADDING_SIZE];
 436                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 437                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 438                                       ss_padding_len)) {
 439                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 440                         prs_mem_free(&p->out_data.frag);
 441                         return False;
 442                 }
 443         }
 444
 445         {
 446                 /*
 447                  * Schannel processing.
 448                  */
 449                 RPC_HDR_AUTH auth_info;
 450                 DATA_BLOB blob;
 451                 uint8_t *data;
 452
 453                 /* Check it's the type of reply we were expecting to decode */
 454
 455                 init_rpc_hdr_auth(&auth_info,
 456                                 DCERPC_AUTH_TYPE_SCHANNEL,
 457                                 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
 458                                         DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
 459                                 ss_padding_len, 1);
 460
 461                 if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 462                                         &p->out_data.frag, 0)) {
 463                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 464                         prs_mem_free(&p->out_data.frag);
 465                         return False;
 466                 }
 467
 468                 data = (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos;
 469
 470                 switch (p->auth.auth_level) {
 471                 case DCERPC_AUTH_LEVEL_PRIVACY:
 472                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 473                                                         talloc_tos(),
 474                                                         true,
 475                                                         data,
 476                                                         data_len + ss_padding_len,
 477                                                         &blob);
 478                         break;
 479                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 480                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 481                                                         talloc_tos(),
 482                                                         false,
 483                                                         data,
 484                                                         data_len + ss_padding_len,
 485                                                         &blob);
 486                         break;
 487                 default:
 488                         status = NT_STATUS_INTERNAL_ERROR;
 489                         break;
 490                 }
 491
 492                 if (!NT_STATUS_IS_OK(status)) {
 493                         DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
 494                                 nt_errstr(status)));
 495                         prs_mem_free(&p->out_data.frag);
 496                         return false;
 497                 }
 498
 499                 /* Finally marshall the blob. */
 500
 501                 if (DEBUGLEVEL >= 10) {
 502                         dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
 503                 }
 504
 505                 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
 506                         prs_mem_free(&p->out_data.frag);
 507                         return false;
 508                 }
 509         }
 510
 511         /*
 512          * Setup the counts for this PDU.
 513          */
 514
 515         p->out_data.data_sent_length += data_len;
 516         p->out_data.current_pdu_sent = 0;
 517
 518         return True;
 519 }
 520
 521 /*******************************************************************
 522  Generate the next PDU to be returned from the data in p->rdata.
 523  No authentication done.
 524 ********************************************************************/
 525
 526 static bool create_next_pdu_noauth(pipes_struct *p)
 527 {
 528         DATA_BLOB hdr;
 529         uint8_t hdr_flags;
 530         NTSTATUS status;
 531         RPC_HDR_RESP hdr_resp;
 532         uint32 data_len;
 533         uint32 data_space_available;
 534         uint32 data_len_left;
 535
 536         /*
 537          * If we're in the fault state, keep returning fault PDU's until
 538          * the pipe gets closed. JRA.
 539          */
 540
 541         if(p->fault_state) {
 542                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 543                 return True;
 544         }
 545
 546         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 547
 548         /* Set up rpc header flags. */
 549         if (p->out_data.data_sent_length == 0) {
 550                 hdr_flags = DCERPC_PFC_FLAG_FIRST;
 551         } else {
 552                 hdr_flags = 0;
 553         }
 554
 555         /*
 556          * Work out how much we can fit in a single PDU.
 557          */
 558
 559         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 560
 561         /*
 562          * Ensure there really is data left to send.
 563          */
 564
 565         if(!data_len_left) {
 566                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 567                 return False;
 568         }
 569
 570         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 571                 - RPC_HDR_RESP_LEN;
 572
 573         /*
 574          * The amount we send is the minimum of the available
 575          * space and the amount left to send.
 576          */
 577
 578         data_len = MIN(data_len_left, data_space_available);
 579
 580         /*
 581          * Set up the alloc hint. This should be the data left to
 582          * send.
 583          */
 584
 585         hdr_resp.alloc_hint = data_len_left;
 586
 587         /*
 588          * Work out if this PDU will be the last.
 589          */
 590         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 591                 hdr_flags |= DCERPC_PFC_FLAG_LAST;
 592         }
 593
 594         /*
 595          * Init the parse struct to point at the outgoing
 596          * data.
 597          */
 598         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 599
 600         status = dcerpc_push_ncacn_packet_header(
 601                                 prs_get_mem_context(&p->out_data.frag),
 602                                 DCERPC_PKT_RESPONSE,
 603                                 hdr_flags,
 604                                 RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len,
 605                                 0,
 606                                 p->call_id,
 607                                 &hdr);
 608         if (!NT_STATUS_IS_OK(status)) {
 609                 DEBUG(0, ("Failed to marshall RPC Header.\n"));
 610                 prs_mem_free(&p->out_data.frag);
 611                 return False;
 612         }
 613
 614         /* Store the header in the data stream. */
 615         if (!prs_copy_data_in(&p->out_data.frag,
 616                                 (char *)hdr.data, hdr.length)) {
 617                 DEBUG(0, ("Out of memory.\n"));
 618                 prs_mem_free(&p->out_data.frag);
 619                 return False;
 620         }
 621
 622         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 623                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 624                 prs_mem_free(&p->out_data.frag);
 625                 return False;
 626         }
 627
 628         /* Copy the data into the PDU. */
 629
 630         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 631                                      p->out_data.data_sent_length, data_len)) {
 632                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 633                 prs_mem_free(&p->out_data.frag);
 634                 return False;
 635         }
 636
 637         /*
 638          * Setup the counts for this PDU.
 639          */
 640
 641         p->out_data.data_sent_length += data_len;
 642         p->out_data.current_pdu_sent = 0;
 643
 644         return True;
 645 }
 646
 647 /*******************************************************************
 648  Generate the next PDU to be returned from the data in p->rdata.
 649 ********************************************************************/
 650
 651 bool create_next_pdu(pipes_struct *p)
 652 {
 653         switch(p->auth.auth_level) {
 654                 case DCERPC_AUTH_LEVEL_NONE:
 655                 case DCERPC_AUTH_LEVEL_CONNECT:
 656                         /* This is incorrect for auth level connect. Fixme. JRA */
 657                         return create_next_pdu_noauth(p);
 658
 659                 default:
 660                         switch(p->auth.auth_type) {
 661                                 case PIPE_AUTH_TYPE_NTLMSSP:
 662                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 663                                         return create_next_pdu_ntlmssp(p);
 664                                 case PIPE_AUTH_TYPE_SCHANNEL:
 665                                         return create_next_pdu_schannel(p);
 666                                 default:
 667                                         break;
 668                         }
 669         }
 670
 671         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 672                         (unsigned int)p->auth.auth_level,
 673                         (unsigned int)p->auth.auth_type));
 674         return False;
 675 }
 676
 677 /*******************************************************************
 678  Process an NTLMSSP authentication response.
 679  If this function succeeds, the user has been authenticated
 680  and their domain, name and calling workstation stored in
 681  the pipe struct.
 682 *******************************************************************/
 683
 684 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 685 {
 686         DATA_BLOB session_key, reply;
 687         NTSTATUS status;
 688         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
 689         bool ret;
 690
 691         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
 692                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 693
 694         ZERO_STRUCT(reply);
 695
 696         /* this has to be done as root in order to verify the password */
 697         become_root();
 698         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 699         unbecome_root();
 700
 701         /* Don't generate a reply. */
 702         data_blob_free(&reply);
 703
 704         if (!NT_STATUS_IS_OK(status)) {
 705                 return False;
 706         }
 707
 708         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 709            ensure the underlying NTLMSSP flags are also set. If not we should
 710            refuse the bind. */
 711
 712         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
 713                 if (!auth_ntlmssp_negotiated_sign(a)) {
 714                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 715                                 "but client declined signing.\n",
 716                                  get_pipe_name_from_syntax(talloc_tos(),
 717                                                            &p->syntax)));
 718                         return False;
 719                 }
 720         }
 721         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 722                 if (!auth_ntlmssp_negotiated_seal(a)) {
 723                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 724                                 "but client declined sealing.\n",
 725                                  get_pipe_name_from_syntax(talloc_tos(),
 726                                                            &p->syntax)));
 727                         return False;
 728                 }
 729         }
 730
 731         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 732                   "workstation: %s\n",
 733                   auth_ntlmssp_get_username(a),
 734                   auth_ntlmssp_get_domain(a),
 735                   auth_ntlmssp_get_client(a)));
 736
 737         TALLOC_FREE(p->server_info);
 738
 739         p->server_info = auth_ntlmssp_server_info(p, a);
 740         if (p->server_info == NULL) {
 741                 DEBUG(0, ("auth_ntlmssp_server_info failed to obtain the server info for authenticated user\n"));
 742                 return false;
 743         }
 744
 745         if (p->server_info->ptok == NULL) {
 746                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 747                 return False;
 748         }
 749
 750         /*
 751          * We're an authenticated bind over smb, so the session key needs to
 752          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 753          * does. See the RPC-SAMBA3SESSIONKEY.
 754          */
 755
 756         session_key = generic_session_key();
 757         if (session_key.data == NULL) {
 758                 return False;
 759         }
 760
 761         ret = server_info_set_session_key(p->server_info, session_key);
 762
 763         data_blob_free(&session_key);
 764
 765         return True;
 766 }
 767
 768 /*******************************************************************
 769  This is the "stage3" NTLMSSP response after a bind request and reply.
 770 *******************************************************************/
 771
 772 bool api_pipe_bind_auth3(pipes_struct *p, struct ncacn_packet *pkt)
 773 {
 774         struct dcerpc_auth auth_info;
 775         uint32_t auth_len = pkt->auth_length;
 776         NTSTATUS status;
 777
 778         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 779
 780         if (auth_len == 0) {
 781                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 782                 goto err;
 783         }
 784
 785         /* Ensure there's enough data for an authenticated request. */
 786         if (RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + auth_len >
 787                                 pkt->frag_length) {
 788                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
 789                                 "%u is too large.\n",
 790                         (unsigned int)auth_len ));
 791                 goto err;
 792         }
 793
 794         /*
 795          * Decode the authentication verifier response.
 796          */
 797
 798         status = dcerpc_pull_dcerpc_auth(pkt,
 799                                          &pkt->u.auth3.auth_info,
 800                                          &auth_info);
 801         if (!NT_STATUS_IS_OK(status)) {
 802                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
 803                 goto err;
 804         }
 805
 806         /* We must NEVER look at auth_info->auth_pad_len here,
 807          * as old Samba client code gets it wrong and sends it
 808          * as zero. JRA.
 809          */
 810
 811         if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
 812                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 813                         (unsigned int)auth_info.auth_type ));
 814                 return False;
 815         }
 816
 817         /*
 818          * The following call actually checks the challenge/response data.
 819          * for correctness against the given DOMAIN\user name.
 820          */
 821
 822         if (!pipe_ntlmssp_verify_final(p, &auth_info.credentials)) {
 823                 goto err;
 824         }
 825
 826         p->pipe_bound = True;
 827
 828         return True;
 829
 830  err:
 831
 832         free_pipe_ntlmssp_auth_data(&p->auth);
 833         p->auth.a_u.auth_ntlmssp_state = NULL;
 834
 835         return False;
 836 }
 837
 838 /*******************************************************************
 839  Marshall a bind_nak pdu.
 840 *******************************************************************/
 841
 842 static bool setup_bind_nak(pipes_struct *p, struct ncacn_packet *pkt)
 843 {
 844         NTSTATUS status;
 845         union dcerpc_payload u;
 846         DATA_BLOB blob;
 847
 848         /* Free any memory in the current return data buffer. */
 849         prs_mem_free(&p->out_data.rdata);
 850
 851         /*
 852          * Marshall directly into the outgoing PDU space. We
 853          * must do this as we need to set to the bind response
 854          * header and are never sending more than one PDU here.
 855          */
 856
 857         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 858
 859         /*
 860          * Initialize a bind_nak header.
 861          */
 862
 863         ZERO_STRUCT(u);
 864
 865         u.bind_nak.reject_reason  = 0;
 866
 867         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 868                                           DCERPC_PKT_BIND_NAK,
 869                                           DCERPC_PFC_FLAG_FIRST |
 870                                                 DCERPC_PFC_FLAG_LAST,
 871                                           0,
 872                                           pkt->call_id,
 873                                           &u,
 874                                           &blob);
 875         if (!NT_STATUS_IS_OK(status)) {
 876                 prs_mem_free(&p->out_data.frag);
 877                 return False;
 878         }
 879
 880         if (!prs_copy_data_in(&p->out_data.frag,
 881                               (char *)blob.data, blob.length)) {
 882                 prs_mem_free(&p->out_data.frag);
 883                 return False;
 884         }
 885
 886         p->out_data.data_sent_length = 0;
 887         p->out_data.current_pdu_sent = 0;
 888
 889         if (p->auth.auth_data_free_func) {
 890                 (*p->auth.auth_data_free_func)(&p->auth);
 891         }
 892         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 893         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 894         p->pipe_bound = False;
 895
 896         return True;
 897 }
 898
 899 /*******************************************************************
 900  Marshall a fault pdu.
 901 *******************************************************************/
 902
 903 bool setup_fault_pdu(pipes_struct *p, NTSTATUS fault_status)
 904 {
 905         NTSTATUS status;
 906         union dcerpc_payload u;
 907         DATA_BLOB blob;
 908
 909         /* Free any memory in the current return data buffer. */
 910         prs_mem_free(&p->out_data.rdata);
 911
 912         /*
 913          * Marshall directly into the outgoing PDU space. We
 914          * must do this as we need to set to the bind response
 915          * header and are never sending more than one PDU here.
 916          */
 917
 918         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 919
 920         /*
 921          * Initialize a fault header.
 922          */
 923
 924         ZERO_STRUCT(u);
 925
 926         u.fault.status          = NT_STATUS_V(fault_status);
 927         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 928
 929         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 930                                           DCERPC_PKT_FAULT,
 931                                           DCERPC_PFC_FLAG_FIRST |
 932                                            DCERPC_PFC_FLAG_LAST |
 933                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 934                                           0,
 935                                           p->call_id,
 936                                           &u,
 937                                           &blob);
 938         if (!NT_STATUS_IS_OK(status)) {
 939                 prs_mem_free(&p->out_data.frag);
 940                 return False;
 941         }
 942
 943         if (!prs_copy_data_in(&p->out_data.frag,
 944                               (char *)blob.data, blob.length)) {
 945                 prs_mem_free(&p->out_data.frag);
 946                 return False;
 947         }
 948
 949         p->out_data.data_sent_length = 0;
 950         p->out_data.current_pdu_sent = 0;
 951
 952         return True;
 953 }
 954
 955 /*******************************************************************
 956  Ensure a bind request has the correct abstract & transfer interface.
 957  Used to reject unknown binds from Win2k.
 958 *******************************************************************/
 959
 960 static bool check_bind_req(struct pipes_struct *p,
 961                            struct ndr_syntax_id* abstract,
 962                            struct ndr_syntax_id* transfer,
 963                            uint32 context_id)
 964 {
 965         struct pipe_rpc_fns *context_fns;
 966
 967         DEBUG(3,("check_bind_req for %s\n",
 968                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 969
 970         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 971         if (rpc_srv_pipe_exists_by_id(abstract) &&
 972            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 973                 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 974                         rpc_srv_get_pipe_cli_name(abstract),
 975                         rpc_srv_get_pipe_srv_name(abstract)));
 976         } else {
 977                 return false;
 978         }
 979
 980         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 981         if (context_fns == NULL) {
 982                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 983                 return False;
 984         }
 985
 986         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 987         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 988         context_fns->context_id = context_id;
 989
 990         /* add to the list of open contexts */
 991
 992         DLIST_ADD( p->contexts, context_fns );
 993
 994         return True;
 995 }
 996
 997 /**
 998  * Is a named pipe known?
 999  * @param[in] cli_filename      The pipe name requested by the client
1000  * @result                      Do we want to serve this?
1001  */
1002 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1003 {
1004         const char *pipename = cli_filename;
1005         NTSTATUS status;
1006
1007         if (strnequal(pipename, "\\PIPE\\", 6)) {
1008                 pipename += 5;
1009         }
1010
1011         if (*pipename == '\\') {
1012                 pipename += 1;
1013         }
1014
1015         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1016                 DEBUG(10, ("refusing spoolss access\n"));
1017                 return false;
1018         }
1019
1020         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1021                 return true;
1022         }
1023
1024         status = smb_probe_module("rpc", pipename);
1025         if (!NT_STATUS_IS_OK(status)) {
1026                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1027                 return false;
1028         }
1029         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
1030
1031         /*
1032          * Scan the list again for the interface id
1033          */
1034         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1035                 return true;
1036         }
1037
1038         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
1039                    pipename));
1040
1041         return false;
1042 }
1043
1044 /*******************************************************************
1045  Handle a SPNEGO krb5 bind auth.
1046 *******************************************************************/
1047
1048 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p,
1049                                            TALLOC_CTX *mem_ctx,
1050                                            struct dcerpc_auth *pauth_info,
1051                                            DATA_BLOB *psecblob,
1052                                            DATA_BLOB *response)
1053 {
1054         return False;
1055 }
1056
1057 /*******************************************************************
1058  Handle the first part of a SPNEGO bind auth.
1059 *******************************************************************/
1060
1061 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p,
1062                                             TALLOC_CTX *mem_ctx,
1063                                             struct dcerpc_auth *pauth_info,
1064                                             DATA_BLOB *response)
1065 {
1066         DATA_BLOB secblob;
1067         DATA_BLOB chal;
1068         char *OIDs[ASN1_MAX_OIDS];
1069         int i;
1070         NTSTATUS status;
1071         bool got_kerberos_mechanism = false;
1072         struct auth_ntlmssp_state *a = NULL;
1073
1074         ZERO_STRUCT(secblob);
1075         ZERO_STRUCT(chal);
1076
1077         if (pauth_info->credentials.data[0] != ASN1_APPLICATION(0)) {
1078                 goto err;
1079         }
1080
1081         /* parse out the OIDs and the first sec blob */
1082         if (!parse_negTokenTarg(pauth_info->credentials, OIDs, &secblob)) {
1083                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1084                 goto err;
1085         }
1086
1087         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1088                 got_kerberos_mechanism = true;
1089         }
1090
1091         for (i=0;OIDs[i];i++) {
1092                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1093                 TALLOC_FREE(OIDs[i]);
1094         }
1095         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1096
1097         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1098                 bool ret;
1099                 ret = pipe_spnego_auth_bind_kerberos(p, mem_ctx, pauth_info,
1100                                                      &secblob, response);
1101                 data_blob_free(&secblob);
1102                 return ret;
1103         }
1104
1105         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1106                 /* Free any previous auth type. */
1107                 free_pipe_ntlmssp_auth_data(&p->auth);
1108         }
1109
1110         if (!got_kerberos_mechanism) {
1111                 /* Initialize the NTLM engine. */
1112                 status = auth_ntlmssp_start(&a);
1113                 if (!NT_STATUS_IS_OK(status)) {
1114                         goto err;
1115                 }
1116
1117                 switch (pauth_info->auth_level) {
1118                         case DCERPC_AUTH_LEVEL_INTEGRITY:
1119                                 auth_ntlmssp_want_sign(a);
1120                                 break;
1121                         case DCERPC_AUTH_LEVEL_PRIVACY:
1122                                 auth_ntlmssp_want_seal(a);
1123                                 break;
1124                         default:
1125                                 break;
1126                 }
1127                 /*
1128                  * Pass the first security blob of data to it.
1129                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1130                  * which means we need another packet to complete the bind.
1131                  */
1132
1133                 status = auth_ntlmssp_update(a, secblob, &chal);
1134
1135                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1136                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1137                         goto err;
1138                 }
1139
1140                 /* Generate the response blob we need for step 2 of the bind. */
1141                 *response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1142         } else {
1143                 /*
1144                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1145                  * code to process follow-up packets is not complete
1146                  * yet. JRA.
1147                  */
1148                 *response = spnego_gen_auth_response(NULL,
1149                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1150                                         OID_NTLMSSP);
1151         }
1152
1153         /* Make sure data is bound to the memctx, to be freed the caller */
1154         talloc_steal(mem_ctx, response->data);
1155
1156         /* auth_pad_len will be handled by the caller */
1157
1158         p->auth.a_u.auth_ntlmssp_state = a;
1159         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1160         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1161
1162         data_blob_free(&secblob);
1163         data_blob_free(&chal);
1164
1165         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1166         return True;
1167
1168  err:
1169
1170         data_blob_free(&secblob);
1171         data_blob_free(&chal);
1172
1173         p->auth.a_u.auth_ntlmssp_state = NULL;
1174
1175         return False;
1176 }
1177
1178 /*******************************************************************
1179  Handle the second part of a SPNEGO bind auth.
1180 *******************************************************************/
1181
1182 static bool pipe_spnego_auth_bind_continue(pipes_struct *p,
1183                                            uint32_t ss_padding_len,
1184                                            struct dcerpc_auth *pauth_info,
1185                                            prs_struct *pout_auth)
1186 {
1187         RPC_HDR_AUTH auth_info;
1188         DATA_BLOB auth_blob;
1189         DATA_BLOB auth_reply;
1190         DATA_BLOB response;
1191         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
1192
1193         ZERO_STRUCT(auth_blob);
1194         ZERO_STRUCT(auth_reply);
1195         ZERO_STRUCT(response);
1196
1197         /*
1198          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1199          * fail here as 'a' == NULL.
1200          */
1201         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1202                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1203                 goto err;
1204         }
1205
1206         if (pauth_info->credentials.data[0] != ASN1_CONTEXT(1)) {
1207                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1208                 goto err;
1209         }
1210
1211         if (!spnego_parse_auth(pauth_info->credentials, &auth_blob)) {
1212                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1213                 goto err;
1214         }
1215
1216         /*
1217          * The following call actually checks the challenge/response data.
1218          * for correctness against the given DOMAIN\user name.
1219          */
1220
1221         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1222                 goto err;
1223         }
1224
1225         data_blob_free(&auth_blob);
1226
1227         /* Generate the spnego "accept completed" blob - no incoming data. */
1228         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1229
1230         /* FIXME - add auth_pad_len here ! */
1231
1232         /* Copy the blob into the pout_auth parse struct */
1233         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1234                         pauth_info->auth_level, ss_padding_len, 1);
1235         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1236                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1237                 goto err;
1238         }
1239
1240         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1241                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1242                 goto err;
1243         }
1244
1245         data_blob_free(&auth_reply);
1246         data_blob_free(&response);
1247
1248         p->pipe_bound = True;
1249
1250         return True;
1251
1252  err:
1253
1254         data_blob_free(&auth_blob);
1255         data_blob_free(&auth_reply);
1256         data_blob_free(&response);
1257
1258         free_pipe_ntlmssp_auth_data(&p->auth);
1259         p->auth.a_u.auth_ntlmssp_state = NULL;
1260
1261         return False;
1262 }
1263
1264 /*******************************************************************
1265  Handle an schannel bind auth.
1266 *******************************************************************/
1267
1268 static bool pipe_schannel_auth_bind(pipes_struct *p,
1269                                     TALLOC_CTX *mem_ctx,
1270                                     struct dcerpc_auth *auth_info,
1271                                     DATA_BLOB *response)
1272 {
1273         struct NL_AUTH_MESSAGE neg;
1274         struct NL_AUTH_MESSAGE reply;
1275         bool ret;
1276         NTSTATUS status;
1277         struct netlogon_creds_CredentialState *creds;
1278         DATA_BLOB session_key;
1279         enum ndr_err_code ndr_err;
1280
1281         ndr_err = ndr_pull_struct_blob(
1282                         &auth_info->credentials, mem_ctx, &neg,
1283                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1284         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1285                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1286                 return false;
1287         }
1288
1289         if (DEBUGLEVEL >= 10) {
1290                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1291         }
1292
1293         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1294                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1295                 return false;
1296         }
1297
1298         /*
1299          * The neg.oem_netbios_computer.a key here must match the remote computer name
1300          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1301          * operations that use credentials.
1302          */
1303
1304         become_root();
1305         status = schannel_get_creds_state(p, lp_private_dir(),
1306                                             neg.oem_netbios_computer.a, &creds);
1307         unbecome_root();
1308
1309         if (!NT_STATUS_IS_OK(status)) {
1310                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1311                 return False;
1312         }
1313
1314         p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1315         if (!p->auth.a_u.schannel_auth) {
1316                 TALLOC_FREE(creds);
1317                 return False;
1318         }
1319
1320         p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1321         p->auth.a_u.schannel_auth->seq_num = 0;
1322         p->auth.a_u.schannel_auth->initiator = false;
1323         p->auth.a_u.schannel_auth->creds = creds;
1324
1325         /*
1326          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1327          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1328          * struct of the person who opened the pipe. I need to test this further. JRA.
1329          *
1330          * VL. As we are mapping this to guest set the generic key
1331          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1332          * W2k3, as it does not allow schannel binds against SAMR and LSA
1333          * anymore.
1334          */
1335
1336         session_key = generic_session_key();
1337         if (session_key.data == NULL) {
1338                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1339                           " key\n"));
1340                 return false;
1341         }
1342
1343         ret = server_info_set_session_key(p->server_info, session_key);
1344
1345         data_blob_free(&session_key);
1346
1347         if (!ret) {
1348                 DEBUG(0, ("server_info_set_session_key failed\n"));
1349                 return false;
1350         }
1351
1352         /*** SCHANNEL verifier ***/
1353
1354         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
1355         reply.Flags                             = 0;
1356         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
1357                                                       * this has any meaning
1358                                                       * here - gd */
1359
1360         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
1361                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1362         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1363                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1364                 return false;
1365         }
1366
1367         if (DEBUGLEVEL >= 10) {
1368                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1369         }
1370
1371         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1372                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1373
1374         /* We're finished with this bind - no more packets. */
1375         p->auth.auth_data_free_func = NULL;
1376         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1377
1378         p->pipe_bound = True;
1379
1380         return True;
1381 }
1382
1383 /*******************************************************************
1384  Handle an NTLMSSP bind auth.
1385 *******************************************************************/
1386
1387 static bool pipe_ntlmssp_auth_bind(pipes_struct *p,
1388                                    TALLOC_CTX *mem_ctx,
1389                                    struct dcerpc_auth *auth_info,
1390                                    DATA_BLOB *response)
1391 {
1392         NTSTATUS status;
1393         struct auth_ntlmssp_state *a = NULL;
1394
1395         if (strncmp((char *)auth_info->credentials.data, "NTLMSSP", 7) != 0) {
1396                 DEBUG(0, ("Failed to read NTLMSSP in blob\n"));
1397                 goto err;
1398         }
1399
1400         /* We have an NTLMSSP blob. */
1401         status = auth_ntlmssp_start(&a);
1402         if (!NT_STATUS_IS_OK(status)) {
1403                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1404                         nt_errstr(status) ));
1405                 goto err;
1406         }
1407
1408         switch (auth_info->auth_level) {
1409         case DCERPC_AUTH_LEVEL_INTEGRITY:
1410                 auth_ntlmssp_want_sign(a);
1411                 break;
1412         case DCERPC_AUTH_LEVEL_PRIVACY:
1413                 auth_ntlmssp_want_seal(a);
1414                 break;
1415         default:
1416                 break;
1417         }
1418
1419         status = auth_ntlmssp_update(a, auth_info->credentials, response);
1420         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1421                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1422                         nt_errstr(status) ));
1423                 goto err;
1424         }
1425
1426         /* Make sure data is bound to the memctx, to be freed the caller */
1427         talloc_steal(mem_ctx, response->data);
1428
1429         p->auth.a_u.auth_ntlmssp_state = a;
1430         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1431         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1432
1433         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1434
1435         /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1436         return True;
1437
1438   err:
1439
1440         free_pipe_ntlmssp_auth_data(&p->auth);
1441         p->auth.a_u.auth_ntlmssp_state = NULL;
1442         return False;
1443 }
1444
1445 /*******************************************************************
1446  Respond to a pipe bind request.
1447 *******************************************************************/
1448
1449 bool api_pipe_bind_req(pipes_struct *p, struct ncacn_packet *pkt)
1450 {
1451         RPC_HDR hdr;
1452         RPC_HDR_BA hdr_ba;
1453         struct dcerpc_auth auth_info;
1454         uint16 assoc_gid;
1455         fstring ack_pipe_name;
1456         prs_struct out_hdr_ba;
1457         int auth_len = 0;
1458         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1459         uint32_t ss_padding_len = 0;
1460         NTSTATUS status;
1461         struct ndr_syntax_id id;
1462         DATA_BLOB auth_resp = data_blob_null;
1463         DATA_BLOB auth_blob = data_blob_null;
1464
1465         /* No rebinds on a bound pipe - use alter context. */
1466         if (p->pipe_bound) {
1467                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1468                          "pipe %s.\n",
1469                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1470                 return setup_bind_nak(p, pkt);
1471         }
1472
1473         if (pkt->u.bind.num_contexts == 0) {
1474                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1475                 goto err_exit;
1476         }
1477
1478         /*
1479          * Try and find the correct pipe name to ensure
1480          * that this is a pipe name we support.
1481          */
1482         id = pkt->u.bind.ctx_list[0].abstract_syntax;
1483         if (rpc_srv_pipe_exists_by_id(&id)) {
1484                 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1485                         rpc_srv_get_pipe_cli_name(&id),
1486                         rpc_srv_get_pipe_srv_name(&id)));
1487         } else {
1488                 status = smb_probe_module(
1489                         "rpc", get_pipe_name_from_syntax(
1490                                 talloc_tos(),
1491                                 &pkt->u.bind.ctx_list[0].abstract_syntax));
1492
1493                 if (NT_STATUS_IS_ERR(status)) {
1494                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1495                                 get_pipe_name_from_syntax(
1496                                         talloc_tos(),
1497                                         &pkt->u.bind.ctx_list[0].abstract_syntax)));
1498
1499                         return setup_bind_nak(p, pkt);
1500                 }
1501
1502                 if (rpc_srv_get_pipe_interface_by_cli_name(
1503                                 get_pipe_name_from_syntax(talloc_tos(),
1504                                                           &p->syntax),
1505                                 &id)) {
1506                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1507                                 rpc_srv_get_pipe_cli_name(&id),
1508                                 rpc_srv_get_pipe_srv_name(&id)));
1509                 } else {
1510                         DEBUG(0, ("module %s doesn't provide functions for "
1511                                   "pipe %s!\n",
1512                                   get_pipe_name_from_syntax(talloc_tos(),
1513                                                             &p->syntax),
1514                                   get_pipe_name_from_syntax(talloc_tos(),
1515                                                             &p->syntax)));
1516                         return setup_bind_nak(p, pkt);
1517                 }
1518         }
1519
1520         /* name has to be \PIPE\xxxxx */
1521         fstrcpy(ack_pipe_name, "\\PIPE\\");
1522         fstrcat(ack_pipe_name, rpc_srv_get_pipe_srv_name(&id));
1523
1524         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1525
1526         if (pkt->u.bind.assoc_group_id != 0) {
1527                 assoc_gid = pkt->u.bind.assoc_group_id;
1528         } else {
1529                 assoc_gid = 0x53f0;
1530         }
1531
1532         /*
1533          * Marshall directly into the outgoing PDU space. We
1534          * must do this as we need to set to the bind response
1535          * header and are never sending more than one PDU here.
1536          */
1537
1538         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1539
1540         /*
1541          * Setup the memory to marshall the ba header, and the
1542          * auth footers.
1543          */
1544
1545         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1546                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1547                 prs_mem_free(&p->out_data.frag);
1548                 return False;
1549         }
1550
1551         /*
1552          * Create the bind response struct.
1553          */
1554
1555         /* If the requested abstract synt uuid doesn't match our client pipe,
1556                 reject the bind_ack & set the transfer interface synt to all 0's,
1557                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1558                 unknown to NT4)
1559                 Needed when adding entries to a DACL from NT5 - SK */
1560
1561         if (check_bind_req(p,
1562                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1563                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1564                         pkt->u.bind.ctx_list[0].context_id)) {
1565                 init_rpc_hdr_ba(&hdr_ba,
1566                         RPC_MAX_PDU_FRAG_LEN,
1567                         RPC_MAX_PDU_FRAG_LEN,
1568                         assoc_gid,
1569                         ack_pipe_name,
1570                         0x1, 0x0, 0x0,
1571                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0]);
1572         } else {
1573                 /* Rejection reason: abstract syntax not supported */
1574                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1575                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1576                                         ack_pipe_name, 0x1, 0x2, 0x1,
1577                                         &null_ndr_syntax_id);
1578                 p->pipe_bound = False;
1579         }
1580
1581         /*
1582          * and marshall it.
1583          */
1584
1585         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1586                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1587                 goto err_exit;
1588         }
1589
1590         /*
1591          * Check if this is an authenticated bind request.
1592          */
1593
1594         if (pkt->auth_length) {
1595                 /*
1596                  * Decode the authentication verifier.
1597                  */
1598
1599                 /* Work out any padding needed before the auth footer. */
1600                 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
1601                         ss_padding_len = SERVER_NDR_PADDING_SIZE -
1602                                 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
1603                         DEBUG(10,("api_pipe_bind_req: auth pad_len = %u\n",
1604                                 (unsigned int)ss_padding_len ));
1605                 }
1606
1607                 /* Quick length check. Won't catch a bad auth footer,
1608                  * prevents overrun. */
1609
1610                 if (pkt->frag_length < RPC_HEADER_LEN +
1611                                         RPC_HDR_AUTH_LEN +
1612                                         pkt->auth_length) {
1613                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
1614                                 "too long for fragment %u.\n",
1615                                 (unsigned int)pkt->auth_length,
1616                                 (unsigned int)pkt->frag_length));
1617                         goto err_exit;
1618                 }
1619
1620                 status = dcerpc_pull_dcerpc_auth(pkt,
1621                                                  &pkt->u.bind.auth_info,
1622                                                  &auth_info);
1623                 if (!NT_STATUS_IS_OK(status)) {
1624                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1625                         goto err_exit;
1626                 }
1627
1628                 auth_type = auth_info.auth_type;
1629
1630                 /* Work out if we have to sign or seal etc. */
1631                 switch (auth_info.auth_level) {
1632                 case DCERPC_AUTH_LEVEL_INTEGRITY:
1633                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1634                         break;
1635                 case DCERPC_AUTH_LEVEL_PRIVACY:
1636                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1637                         break;
1638                 default:
1639                         DEBUG(0, ("Unexpected auth level (%u).\n",
1640                                 (unsigned int)auth_info.auth_level ));
1641                         goto err_exit;
1642                 }
1643         } else {
1644                 ZERO_STRUCT(auth_info);
1645         }
1646
1647         switch(auth_type) {
1648                 case DCERPC_AUTH_TYPE_NTLMSSP:
1649                         if (!pipe_ntlmssp_auth_bind(p, pkt,
1650                                                 &auth_info, &auth_resp)) {
1651                                 goto err_exit;
1652                         }
1653                         assoc_gid = 0x7a77;
1654                         break;
1655
1656                 case DCERPC_AUTH_TYPE_SCHANNEL:
1657                         if (!pipe_schannel_auth_bind(p, pkt,
1658                                                 &auth_info, &auth_resp)) {
1659                                 goto err_exit;
1660                         }
1661                         break;
1662
1663                 case DCERPC_AUTH_TYPE_SPNEGO:
1664                         if (!pipe_spnego_auth_bind_negotiate(p, pkt,
1665                                                 &auth_info, &auth_resp)) {
1666                                 goto err_exit;
1667                         }
1668                         break;
1669
1670                 case DCERPC_AUTH_TYPE_NONE:
1671                         /* Unauthenticated bind request. */
1672                         /* We're finished - no more packets. */
1673                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1674                         /* We must set the pipe auth_level here also. */
1675                         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1676                         p->pipe_bound = True;
1677                         /* The session key was initialized from the SMB
1678                          * session in make_internal_rpc_pipe_p */
1679                         ss_padding_len = 0;
1680                         break;
1681
1682                 default:
1683                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1684                         goto err_exit;
1685         }
1686         if (auth_resp.length) {
1687                 status = dcerpc_push_dcerpc_auth(pkt,
1688                                                  auth_type,
1689                                                  auth_info.auth_level,
1690                                                  ss_padding_len,
1691                                                  1, /* auth_context_id */
1692                                                  &auth_resp,
1693                                                  &auth_blob);
1694                 if (!NT_STATUS_IS_OK(status)) {
1695                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1696                         goto err_exit;
1697                 }
1698         }
1699
1700         /*
1701          * Create the header, now we know the length.
1702          */
1703
1704         if (auth_blob.length) {
1705                 auth_len = auth_blob.length - RPC_HDR_AUTH_LEN;
1706         }
1707
1708         init_rpc_hdr(&hdr,
1709                         DCERPC_PKT_BIND_ACK,
1710                         DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1711                         pkt->call_id,
1712                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) +
1713                                 ss_padding_len + auth_blob.length,
1714                         auth_len);
1715
1716         /*
1717          * Marshall the header into the outgoing PDU.
1718          */
1719
1720         if (!smb_io_rpc_hdr("", &hdr, &p->out_data.frag, 0)) {
1721                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1722                 goto err_exit;
1723         }
1724
1725         /*
1726          * Now add the RPC_HDR_BA and any auth needed.
1727          */
1728
1729         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1730                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1731                 goto err_exit;
1732         }
1733
1734         if (auth_len) {
1735                 if (ss_padding_len) {
1736                         char pad[SERVER_NDR_PADDING_SIZE];
1737                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1738                         if (!prs_copy_data_in(&p->out_data.frag, pad,
1739                                         ss_padding_len)) {
1740                                 DEBUG(0,("api_pipe_bind_req: failed to add %u "
1741                                         "bytes of pad data.\n",
1742                                         (unsigned int)ss_padding_len));
1743                                 goto err_exit;
1744                         }
1745                 }
1746
1747                 if (!prs_copy_data_in(&p->out_data.frag,
1748                                         (char *)auth_blob.data,
1749                                         auth_blob.length)) {
1750                         DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1751                         goto err_exit;
1752                 }
1753         }
1754
1755         /*
1756          * Setup the lengths for the initial reply.
1757          */
1758
1759         p->out_data.data_sent_length = 0;
1760         p->out_data.current_pdu_sent = 0;
1761
1762         prs_mem_free(&out_hdr_ba);
1763         TALLOC_FREE(auth_blob.data);
1764
1765         return True;
1766
1767   err_exit:
1768
1769         prs_mem_free(&p->out_data.frag);
1770         prs_mem_free(&out_hdr_ba);
1771         TALLOC_FREE(auth_blob.data);
1772         return setup_bind_nak(p, pkt);
1773 }
1774
1775 /****************************************************************************
1776  Deal with an alter context call. Can be third part of 3 leg auth request for
1777  SPNEGO calls.
1778 ****************************************************************************/
1779
1780 bool api_pipe_alter_context(pipes_struct *p, struct ncacn_packet *pkt)
1781 {
1782         RPC_HDR hdr;
1783         RPC_HDR_BA hdr_ba;
1784         struct dcerpc_auth auth_info;
1785         uint16 assoc_gid;
1786         fstring ack_pipe_name;
1787         prs_struct out_hdr_ba;
1788         prs_struct out_auth;
1789         int auth_len = 0;
1790         uint32_t ss_padding_len = 0;
1791         NTSTATUS status;
1792
1793         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1794
1795         /*
1796          * Marshall directly into the outgoing PDU space. We
1797          * must do this as we need to set to the bind response
1798          * header and are never sending more than one PDU here.
1799          */
1800
1801         /*
1802          * Setup the memory to marshall the ba header, and the
1803          * auth footers.
1804          */
1805
1806         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1807                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1808                 prs_mem_free(&p->out_data.frag);
1809                 return False;
1810         }
1811
1812         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1813                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1814                 prs_mem_free(&p->out_data.frag);
1815                 prs_mem_free(&out_hdr_ba);
1816                 return False;
1817         }
1818
1819         /* secondary address CAN be NULL
1820          * as the specs say it's ignored.
1821          * It MUST be NULL to have the spoolss working.
1822          */
1823         fstrcpy(ack_pipe_name,"");
1824
1825         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1826
1827         if (pkt->u.bind.assoc_group_id != 0) {
1828                 assoc_gid = pkt->u.bind.assoc_group_id;
1829         } else {
1830                 assoc_gid = 0x53f0;
1831         }
1832
1833         /*
1834          * Create the bind response struct.
1835          */
1836
1837         /* If the requested abstract synt uuid doesn't match our client pipe,
1838                 reject the bind_ack & set the transfer interface synt to all 0's,
1839                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1840                 unknown to NT4)
1841                 Needed when adding entries to a DACL from NT5 - SK */
1842
1843         if (check_bind_req(p,
1844                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1845                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1846                         pkt->u.bind.ctx_list[0].context_id)) {
1847                 init_rpc_hdr_ba(&hdr_ba,
1848                         RPC_MAX_PDU_FRAG_LEN,
1849                         RPC_MAX_PDU_FRAG_LEN,
1850                         assoc_gid,
1851                         ack_pipe_name,
1852                         0x1, 0x0, 0x0,
1853                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0]);
1854         } else {
1855                 /* Rejection reason: abstract syntax not supported */
1856                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1857                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1858                                         ack_pipe_name, 0x1, 0x2, 0x1,
1859                                         &null_ndr_syntax_id);
1860                 p->pipe_bound = False;
1861         }
1862
1863         /*
1864          * and marshall it.
1865          */
1866
1867         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1868                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1869                 goto err_exit;
1870         }
1871
1872
1873         /*
1874          * Check if this is an authenticated alter context request.
1875          */
1876
1877         if (pkt->auth_length != 0) {
1878                 /*
1879                  * Decode the authentication verifier.
1880                  */
1881
1882                 /* Work out any padding needed before the auth footer. */
1883                 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
1884                         ss_padding_len = SERVER_NDR_PADDING_SIZE -
1885                                 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
1886                         DEBUG(10,("api_pipe_alter_context: auth pad_len = %u\n",
1887                                 (unsigned int)ss_padding_len ));
1888                 }
1889
1890                 /* Quick length check. Won't catch a bad auth footer,
1891                  * prevents overrun. */
1892
1893                 if (pkt->frag_length < RPC_HEADER_LEN +
1894                                         RPC_HDR_AUTH_LEN +
1895                                         pkt->auth_length) {
1896                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1897                                 "too long for fragment %u.\n",
1898                                 (unsigned int)pkt->auth_length,
1899                                 (unsigned int)pkt->frag_length ));
1900                         goto err_exit;
1901                 }
1902
1903                 status = dcerpc_pull_dcerpc_auth(pkt,
1904                                                  &pkt->u.bind.auth_info,
1905                                                  &auth_info);
1906                 if (!NT_STATUS_IS_OK(status)) {
1907                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1908                         goto err_exit;
1909                 }
1910
1911
1912                 /*
1913                  * Currently only the SPNEGO auth type uses the alter ctx
1914                  * response in place of the NTLMSSP auth3 type.
1915                  */
1916
1917                 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
1918                         /* We can only finish if the pipe is unbound. */
1919                         if (!p->pipe_bound) {
1920                                 if (!pipe_spnego_auth_bind_continue(p,
1921                                                     ss_padding_len,
1922                                                     &auth_info, &out_auth)) {
1923                                         goto err_exit;
1924                                 }
1925                         } else {
1926                                 goto err_exit;
1927                         }
1928                 }
1929         } else {
1930                 ZERO_STRUCT(auth_info);
1931         }
1932         /*
1933          * Create the header, now we know the length.
1934          */
1935
1936         if (prs_offset(&out_auth)) {
1937                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1938         }
1939
1940         init_rpc_hdr(&hdr, DCERPC_PKT_ALTER_RESP, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1941                         pkt->call_id,
1942                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1943                         auth_len);
1944
1945         /*
1946          * Marshall the header into the outgoing PDU.
1947          */
1948
1949         if(!smb_io_rpc_hdr("", &hdr, &p->out_data.frag, 0)) {
1950                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
1951                 goto err_exit;
1952         }
1953
1954         /*
1955          * Now add the RPC_HDR_BA and any auth needed.
1956          */
1957
1958         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1959                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
1960                 goto err_exit;
1961         }
1962
1963         if (auth_len) {
1964                 if (ss_padding_len) {
1965                         char pad[SERVER_NDR_PADDING_SIZE];
1966                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1967                         if (!prs_copy_data_in(&p->out_data.frag, pad,
1968                                         ss_padding_len)) {
1969                                 DEBUG(0,("api_pipe_alter_context: failed to add %u "
1970                                         "bytes of pad data.\n",
1971                                         (unsigned int)ss_padding_len));
1972                                 goto err_exit;
1973                         }
1974                 }
1975
1976                 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1977                         DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
1978                         goto err_exit;
1979                 }
1980         }
1981
1982         /*
1983          * Setup the lengths for the initial reply.
1984          */
1985
1986         p->out_data.data_sent_length = 0;
1987         p->out_data.current_pdu_sent = 0;
1988
1989         prs_mem_free(&out_hdr_ba);
1990         prs_mem_free(&out_auth);
1991         return True;
1992
1993   err_exit:
1994
1995         prs_mem_free(&p->out_data.frag);
1996         prs_mem_free(&out_hdr_ba);
1997         prs_mem_free(&out_auth);
1998         return setup_bind_nak(p, pkt);
1999 }
2000
2001 /****************************************************************************
2002  Find the set of RPC functions associated with this context_id
2003 ****************************************************************************/
2004
2005 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2006 {
2007         PIPE_RPC_FNS *fns = NULL;
2008
2009         if ( !list ) {
2010                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2011                 return NULL;
2012         }
2013
2014         for (fns=list; fns; fns=fns->next ) {
2015                 if ( fns->context_id == context_id )
2016                         return fns;
2017         }
2018         return NULL;
2019 }
2020
2021 /****************************************************************************
2022  Memory cleanup.
2023 ****************************************************************************/
2024
2025 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2026 {
2027         PIPE_RPC_FNS *tmp = list;
2028         PIPE_RPC_FNS *tmp2;
2029
2030         while (tmp) {
2031                 tmp2 = tmp->next;
2032                 SAFE_FREE(tmp);
2033                 tmp = tmp2;
2034         }
2035
2036         return;
2037 }
2038
2039 static bool api_rpcTNP(pipes_struct *p, struct ncacn_packet *pkt,
2040                        const struct api_struct *api_rpc_cmds, int n_cmds);
2041
2042 /****************************************************************************
2043  Find the correct RPC function to call for this request.
2044  If the pipe is authenticated then become the correct UNIX user
2045  before doing the call.
2046 ****************************************************************************/
2047
2048 bool api_pipe_request(pipes_struct *p, struct ncacn_packet *pkt)
2049 {
2050         bool ret = False;
2051         bool changed_user = False;
2052         PIPE_RPC_FNS *pipe_fns;
2053
2054         if (p->pipe_bound &&
2055                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2056                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2057                 if(!become_authenticated_pipe_user(p)) {
2058                         prs_mem_free(&p->out_data.rdata);
2059                         return False;
2060                 }
2061                 changed_user = True;
2062         }
2063
2064         DEBUG(5, ("Requested \\PIPE\\%s\n",
2065                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2066
2067         /* get the set of RPC functions for this context */
2068
2069         pipe_fns = find_pipe_fns_by_context(p->contexts,
2070                                             pkt->u.request.context_id);
2071
2072         if ( pipe_fns ) {
2073                 TALLOC_CTX *frame = talloc_stackframe();
2074                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds);
2075                 TALLOC_FREE(frame);
2076         }
2077         else {
2078                 DEBUG(0, ("No rpc function table associated with context "
2079                           "[%d] on pipe [%s]\n",
2080                           pkt->u.request.context_id,
2081                           get_pipe_name_from_syntax(talloc_tos(),
2082                                                     &p->syntax)));
2083         }
2084
2085         if (changed_user) {
2086                 unbecome_authenticated_pipe_user();
2087         }
2088
2089         return ret;
2090 }
2091
2092 /*******************************************************************
2093  Calls the underlying RPC function for a named pipe.
2094  ********************************************************************/
2095
2096 static bool api_rpcTNP(pipes_struct *p, struct ncacn_packet *pkt,
2097                        const struct api_struct *api_rpc_cmds, int n_cmds)
2098 {
2099         int fn_num;
2100         uint32 offset1, offset2;
2101
2102         /* interpret the command */
2103         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2104                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2105                  pkt->u.request.opnum));
2106
2107         if (DEBUGLEVEL >= 50) {
2108                 fstring name;
2109                 slprintf(name, sizeof(name)-1, "in_%s",
2110                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2111                 prs_dump(name, pkt->u.request.opnum, &p->in_data.data);
2112         }
2113
2114         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2115                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
2116                     api_rpc_cmds[fn_num].fn != NULL) {
2117                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
2118                                   api_rpc_cmds[fn_num].name));
2119                         break;
2120                 }
2121         }
2122
2123         if (fn_num == n_cmds) {
2124                 /*
2125                  * For an unknown RPC just return a fault PDU but
2126                  * return True to allow RPC's on the pipe to continue
2127                  * and not put the pipe into fault state. JRA.
2128                  */
2129                 DEBUG(4, ("unknown\n"));
2130                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2131                 return True;
2132         }
2133
2134         offset1 = prs_offset(&p->out_data.rdata);
2135
2136         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2137                 fn_num, api_rpc_cmds[fn_num].fn));
2138         /* do the actual command */
2139         if(!api_rpc_cmds[fn_num].fn(p)) {
2140                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2141                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2142                          api_rpc_cmds[fn_num].name));
2143                 prs_mem_free(&p->out_data.rdata);
2144                 return False;
2145         }
2146
2147         if (p->bad_handle_fault_state) {
2148                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2149                 p->bad_handle_fault_state = False;
2150                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2151                 return True;
2152         }
2153
2154         if (p->rng_fault_state) {
2155                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2156                 p->rng_fault_state = False;
2157                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2158                 return True;
2159         }
2160
2161         offset2 = prs_offset(&p->out_data.rdata);
2162         prs_set_offset(&p->out_data.rdata, offset1);
2163         if (DEBUGLEVEL >= 50) {
2164                 fstring name;
2165                 slprintf(name, sizeof(name)-1, "out_%s",
2166                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2167                 prs_dump(name, pkt->u.request.opnum, &p->out_data.rdata);
2168         }
2169         prs_set_offset(&p->out_data.rdata, offset2);
2170
2171         DEBUG(5,("api_rpcTNP: called %s successfully\n",
2172                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2173
2174         /* Check for buffer underflow in rpc parsing */
2175
2176         if ((DEBUGLEVEL >= 10) &&
2177             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2178                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2179                 char *data = (char *)SMB_MALLOC(data_len);
2180
2181                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2182                 if (data) {
2183                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2184                         SAFE_FREE(data);
2185                 }
2186
2187         }
2188
2189         return True;
2190 }