source4/rpc_server/dcerpc_server.c

   1 /*
   2    Unix SMB/CIFS implementation.
   3
   4    server side dcerpc core code
   5
   6    Copyright (C) Andrew Tridgell 2003-2005
   7    Copyright (C) Stefan (metze) Metzmacher 2004-2005
   8
   9    This program is free software; you can redistribute it and/or modify
  10    it under the terms of the GNU General Public License as published by
  11    the Free Software Foundation; either version 3 of the License, or
  12    (at your option) any later version.
  13
  14    This program is distributed in the hope that it will be useful,
  15    but WITHOUT ANY WARRANTY; without even the implied warranty of
  16    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17    GNU General Public License for more details.
  18
  19    You should have received a copy of the GNU General Public License
  20    along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21 */
  22
  23 #include "includes.h"
  24 #include "auth/auth.h"
  25 #include "auth/gensec/gensec.h"
  26 #include "../lib/util/dlinklist.h"
  27 #include "rpc_server/dcerpc_server.h"
  28 #include "rpc_server/dcerpc_server_proto.h"
  29 #include "rpc_server/common/proto.h"
  30 #include "librpc/rpc/dcerpc_proto.h"
  31 #include "system/filesys.h"
  32 #include "libcli/security/security.h"
  33 #include "param/param.h"
  34 #include "../lib/tsocket/tsocket.h"
  35 #include "../libcli/named_pipe_auth/npa_tstream.h"
  36 #include "smbd/service_stream.h"
  37 #include "../lib/tsocket/tsocket.h"
  38 #include "lib/socket/socket.h"
  39 #include "smbd/process_model.h"
  40 #include "lib/messaging/irpc.h"
  41 #include "librpc/rpc/rpc_common.h"
  42 #include "lib/util/samba_modules.h"
  43 #include "librpc/gen_ndr/ndr_dcerpc.h"
  44 #include "../lib/util/tevent_ntstatus.h"
  45
  46 static NTSTATUS dcesrv_negotiate_contexts(struct dcesrv_call_state *call,
  47                                 const struct dcerpc_bind *b,
  48                                 struct dcerpc_ack_ctx *ack_ctx_list);
  49
  50 /*
  51   find an association group given a assoc_group_id
  52  */
  53 static struct dcesrv_assoc_group *dcesrv_assoc_group_find(struct dcesrv_context *dce_ctx,
  54                                                           uint32_t id)
  55 {
  56         void *id_ptr;
  57
  58         id_ptr = idr_find(dce_ctx->assoc_groups_idr, id);
  59         if (id_ptr == NULL) {
  60                 return NULL;
  61         }
  62         return talloc_get_type_abort(id_ptr, struct dcesrv_assoc_group);
  63 }
  64
  65 /*
  66   take a reference to an existing association group
  67  */
  68 static struct dcesrv_assoc_group *dcesrv_assoc_group_reference(TALLOC_CTX *mem_ctx,
  69                                                                struct dcesrv_context *dce_ctx,
  70                                                                uint32_t id)
  71 {
  72         struct dcesrv_assoc_group *assoc_group;
  73
  74         assoc_group = dcesrv_assoc_group_find(dce_ctx, id);
  75         if (assoc_group == NULL) {
  76                 DEBUG(2,(__location__ ": Failed to find assoc_group 0x%08x\n", id));
  77                 return NULL;
  78         }
  79         return talloc_reference(mem_ctx, assoc_group);
  80 }
  81
  82 static int dcesrv_assoc_group_destructor(struct dcesrv_assoc_group *assoc_group)
  83 {
  84         int ret;
  85         ret = idr_remove(assoc_group->dce_ctx->assoc_groups_idr, assoc_group->id);
  86         if (ret != 0) {
  87                 DEBUG(0,(__location__ ": Failed to remove assoc_group 0x%08x\n",
  88                          assoc_group->id));
  89         }
  90         return 0;
  91 }
  92
  93 /*
  94   allocate a new association group
  95  */
  96 static struct dcesrv_assoc_group *dcesrv_assoc_group_new(TALLOC_CTX *mem_ctx,
  97                                                          struct dcesrv_context *dce_ctx)
  98 {
  99         struct dcesrv_assoc_group *assoc_group;
 100         int id;
 101
 102         assoc_group = talloc_zero(mem_ctx, struct dcesrv_assoc_group);
 103         if (assoc_group == NULL) {
 104                 return NULL;
 105         }
 106
 107         id = idr_get_new_random(dce_ctx->assoc_groups_idr, assoc_group, UINT16_MAX);
 108         if (id == -1) {
 109                 talloc_free(assoc_group);
 110                 DEBUG(0,(__location__ ": Out of association groups!\n"));
 111                 return NULL;
 112         }
 113
 114         assoc_group->id = id;
 115         assoc_group->dce_ctx = dce_ctx;
 116
 117         talloc_set_destructor(assoc_group, dcesrv_assoc_group_destructor);
 118
 119         return assoc_group;
 120 }
 121
 122
 123 /*
 124   see if two endpoints match
 125 */
 126 static bool endpoints_match(const struct dcerpc_binding *ep1,
 127                             const struct dcerpc_binding *ep2)
 128 {
 129         enum dcerpc_transport_t t1;
 130         enum dcerpc_transport_t t2;
 131         const char *e1;
 132         const char *e2;
 133
 134         t1 = dcerpc_binding_get_transport(ep1);
 135         t2 = dcerpc_binding_get_transport(ep2);
 136
 137         e1 = dcerpc_binding_get_string_option(ep1, "endpoint");
 138         e2 = dcerpc_binding_get_string_option(ep2, "endpoint");
 139
 140         if (t1 != t2) {
 141                 return false;
 142         }
 143
 144         if (!e1 || !e2) {
 145                 return e1 == e2;
 146         }
 147
 148         if (strcasecmp(e1, e2) != 0) {
 149                 return false;
 150         }
 151
 152         return true;
 153 }
 154
 155 /*
 156   find an endpoint in the dcesrv_context
 157 */
 158 static struct dcesrv_endpoint *find_endpoint(struct dcesrv_context *dce_ctx,
 159                                              const struct dcerpc_binding *ep_description)
 160 {
 161         struct dcesrv_endpoint *ep;
 162         for (ep=dce_ctx->endpoint_list; ep; ep=ep->next) {
 163                 if (endpoints_match(ep->ep_description, ep_description)) {
 164                         return ep;
 165                 }
 166         }
 167         return NULL;
 168 }
 169
 170 /*
 171   find a registered context_id from a bind or alter_context
 172 */
 173 static struct dcesrv_connection_context *dcesrv_find_context(struct dcesrv_connection *conn,
 174                                                              uint16_t context_id)
 175 {
 176         struct dcesrv_connection_context *c;
 177         for (c=conn->contexts;c;c=c->next) {
 178                 if (c->context_id == context_id) return c;
 179         }
 180         return NULL;
 181 }
 182
 183 /*
 184   see if a uuid and if_version match to an interface
 185 */
 186 static bool interface_match(const struct dcesrv_interface *if1,
 187                                                         const struct dcesrv_interface *if2)
 188 {
 189         return (if1->syntax_id.if_version == if2->syntax_id.if_version &&
 190                         GUID_equal(&if1->syntax_id.uuid, &if2->syntax_id.uuid));
 191 }
 192
 193 /*
 194   find the interface operations on any endpoint with this binding
 195 */
 196 static const struct dcesrv_interface *find_interface_by_binding(struct dcesrv_context *dce_ctx,
 197                                                                 struct dcerpc_binding *binding,
 198                                                                 const struct dcesrv_interface *iface)
 199 {
 200         struct dcesrv_endpoint *ep;
 201         for (ep=dce_ctx->endpoint_list; ep; ep=ep->next) {
 202                 if (endpoints_match(ep->ep_description, binding)) {
 203                         struct dcesrv_if_list *ifl;
 204                         for (ifl=ep->interface_list; ifl; ifl=ifl->next) {
 205                                 if (interface_match(&(ifl->iface), iface)) {
 206                                         return &(ifl->iface);
 207                                 }
 208                         }
 209                 }
 210         }
 211         return NULL;
 212 }
 213
 214 /*
 215   see if a uuid and if_version match to an interface
 216 */
 217 static bool interface_match_by_uuid(const struct dcesrv_interface *iface,
 218                                     const struct GUID *uuid, uint32_t if_version)
 219 {
 220         return (iface->syntax_id.if_version == if_version &&
 221                         GUID_equal(&iface->syntax_id.uuid, uuid));
 222 }
 223
 224 /*
 225   find the interface operations on an endpoint by uuid
 226 */
 227 const struct dcesrv_interface *find_interface_by_uuid(const struct dcesrv_endpoint *endpoint,
 228                                                       const struct GUID *uuid, uint32_t if_version)
 229 {
 230         struct dcesrv_if_list *ifl;
 231         for (ifl=endpoint->interface_list; ifl; ifl=ifl->next) {
 232                 if (interface_match_by_uuid(&(ifl->iface), uuid, if_version)) {
 233                         return &(ifl->iface);
 234                 }
 235         }
 236         return NULL;
 237 }
 238
 239 /*
 240   find the earlier parts of a fragmented call awaiting reassembily
 241 */
 242 static struct dcesrv_call_state *dcesrv_find_fragmented_call(struct dcesrv_connection *dce_conn, uint32_t call_id)
 243 {
 244         struct dcesrv_call_state *c;
 245         for (c=dce_conn->incoming_fragmented_call_list;c;c=c->next) {
 246                 if (c->pkt.call_id == call_id) {
 247                         return c;
 248                 }
 249         }
 250         return NULL;
 251 }
 252
 253 /*
 254   register an interface on an endpoint
 255
 256   An endpoint is one unix domain socket (for ncalrpc), one TCP port
 257   (for ncacn_ip_tcp) or one (forwarded) named pipe (for ncacn_np).
 258
 259   Each endpoint can have many interfaces such as netlogon, lsa or
 260   samr.  Some have essentially the full set.
 261
 262   This is driven from the set of interfaces listed in each IDL file
 263   via the PIDL generated *__op_init_server() functions.
 264 */
 265 _PUBLIC_ NTSTATUS dcesrv_interface_register(struct dcesrv_context *dce_ctx,
 266                                    const char *ep_name,
 267                                    const struct dcesrv_interface *iface,
 268                                    const struct security_descriptor *sd)
 269 {
 270         struct dcesrv_endpoint *ep;
 271         struct dcesrv_if_list *ifl;
 272         struct dcerpc_binding *binding;
 273         bool add_ep = false;
 274         NTSTATUS status;
 275         enum dcerpc_transport_t transport;
 276         char *ep_string = NULL;
 277         bool use_single_process = true;
 278         const char *ep_process_string;
 279
 280         /*
 281          * If we are not using handles, there is no need for force
 282          * this service into using a single process.
 283          *
 284          * However, due to the way we listen for RPC packets, we can
 285          * only do this if we have a single service per pipe or TCP
 286          * port, so we still force a single combined process for
 287          * ncalrpc.
 288          */
 289         if (iface->flags & DCESRV_INTERFACE_FLAGS_HANDLES_NOT_USED) {
 290                 use_single_process = false;
 291         }
 292
 293         status = dcerpc_parse_binding(dce_ctx, ep_name, &binding);
 294
 295         if (NT_STATUS_IS_ERR(status)) {
 296                 DEBUG(0, ("Trouble parsing binding string '%s'\n", ep_name));
 297                 return status;
 298         }
 299
 300         transport = dcerpc_binding_get_transport(binding);
 301         if (transport == NCACN_IP_TCP) {
 302                 int port;
 303                 char port_str[6];
 304
 305                 /*
 306                  * First check if there is already a port specified, eg
 307                  * for epmapper on ncacn_ip_tcp:[135]
 308                  */
 309                 const char *endpoint
 310                         = dcerpc_binding_get_string_option(binding,
 311                                                            "endpoint");
 312                 if (endpoint == NULL) {
 313                         port = lpcfg_parm_int(dce_ctx->lp_ctx, NULL,
 314                                               "rpc server port", iface->name, 0);
 315
 316                         /*
 317                          * For RPC services that are not set to use a single
 318                          * process, we do not default to using the 'rpc server
 319                          * port' because that would cause a double-bind on
 320                          * that port.
 321                          */
 322                         if (port == 0 && !use_single_process) {
 323                                 port = lpcfg_rpc_server_port(dce_ctx->lp_ctx);
 324                         }
 325                         if (port != 0) {
 326                                 snprintf(port_str, sizeof(port_str), "%u", port);
 327                                 status = dcerpc_binding_set_string_option(binding,
 328                                                                           "endpoint",
 329                                                                           port_str);
 330                                 if (!NT_STATUS_IS_OK(status)) {
 331                                         return status;
 332                                 }
 333                         }
 334                 }
 335         }
 336
 337         /* see if the interface is already registered on the endpoint */
 338         if (find_interface_by_binding(dce_ctx, binding, iface)!=NULL) {
 339                 DEBUG(0,("dcesrv_interface_register: interface '%s' already registered on endpoint '%s'\n",
 340                          iface->name, ep_name));
 341                 return NT_STATUS_OBJECT_NAME_COLLISION;
 342         }
 343
 344         /* check if this endpoint exists
 345          */
 346         ep = find_endpoint(dce_ctx, binding);
 347
 348         if (ep != NULL) {
 349                 /*
 350                  * We want a new port on ncacn_ip_tcp for NETLOGON, so
 351                  * it can be multi-process.  Other processes can also
 352                  * listen on distinct ports, if they have one forced
 353                  * in the code above with eg 'rpc server port:drsuapi = 1027'
 354                  *
 355                  * If we have mulitiple endpoints on port 0, they each
 356                  * get an epemeral port (currently by walking up from
 357                  * 1024).
 358                  *
 359                  * Because one endpoint can only have one process
 360                  * model, we add a new IP_TCP endpoint for each model.
 361                  *
 362                  * This works in conjunction with the forced overwrite
 363                  * of ep->use_single_process below.
 364                  */
 365                 if (ep->use_single_process != use_single_process
 366                     && transport == NCACN_IP_TCP) {
 367                         add_ep = true;
 368                 }
 369         }
 370
 371         if (ep == NULL || add_ep) {
 372                 ep = talloc_zero(dce_ctx, struct dcesrv_endpoint);
 373                 if (!ep) {
 374                         return NT_STATUS_NO_MEMORY;
 375                 }
 376                 ZERO_STRUCTP(ep);
 377                 ep->ep_description = talloc_move(ep, &binding);
 378                 add_ep = true;
 379
 380                 /* add mgmt interface */
 381                 ifl = talloc_zero(ep, struct dcesrv_if_list);
 382                 if (!ifl) {
 383                         return NT_STATUS_NO_MEMORY;
 384                 }
 385
 386                 ifl->iface = dcesrv_get_mgmt_interface();
 387
 388                 DLIST_ADD(ep->interface_list, ifl);
 389         }
 390
 391         /*
 392          * By default don't force into a single process, but if any
 393          * interface on this endpoint on this service uses handles
 394          * (most do), then we must force into single process mode
 395          *
 396          * By overwriting this each time a new interface is added to
 397          * this endpoint, we end up with the most restrictive setting.
 398          */
 399         if (use_single_process) {
 400                 ep->use_single_process = true;
 401         }
 402
 403         /* talloc a new interface list element */
 404         ifl = talloc_zero(ep, struct dcesrv_if_list);
 405         if (!ifl) {
 406                 return NT_STATUS_NO_MEMORY;
 407         }
 408
 409         /* copy the given interface struct to the one on the endpoints interface list */
 410         memcpy(&(ifl->iface),iface, sizeof(struct dcesrv_interface));
 411
 412         /* if we have a security descriptor given,
 413          * we should see if we can set it up on the endpoint
 414          */
 415         if (sd != NULL) {
 416                 /* if there's currently no security descriptor given on the endpoint
 417                  * we try to set it
 418                  */
 419                 if (ep->sd == NULL) {
 420                         ep->sd = security_descriptor_copy(ep, sd);
 421                 }
 422
 423                 /* if now there's no security descriptor given on the endpoint
 424                  * something goes wrong, either we failed to copy the security descriptor
 425                  * or there was already one on the endpoint
 426                  */
 427                 if (ep->sd != NULL) {
 428                         DEBUG(0,("dcesrv_interface_register: interface '%s' failed to setup a security descriptor\n"
 429                                  "                           on endpoint '%s'\n",
 430                                 iface->name, ep_name));
 431                         if (add_ep) free(ep);
 432                         free(ifl);
 433                         return NT_STATUS_OBJECT_NAME_COLLISION;
 434                 }
 435         }
 436
 437         /* finally add the interface on the endpoint */
 438         DLIST_ADD(ep->interface_list, ifl);
 439
 440         /* if it's a new endpoint add it to the dcesrv_context */
 441         if (add_ep) {
 442                 DLIST_ADD(dce_ctx->endpoint_list, ep);
 443         }
 444
 445         /* Re-get the string as we may have set a port */
 446         ep_string = dcerpc_binding_string(dce_ctx, ep->ep_description);
 447
 448         if (use_single_process) {
 449                 ep_process_string = "single process required";
 450         } else {
 451                 ep_process_string = "multi process compatible";
 452         }
 453
 454         DBG_INFO("dcesrv_interface_register: interface '%s' "
 455                  "registered on endpoint '%s' (%s)\n",
 456                  iface->name, ep_string, ep_process_string);
 457         TALLOC_FREE(ep_string);
 458
 459         return NT_STATUS_OK;
 460 }
 461
 462 static NTSTATUS dcesrv_session_info_session_key(struct dcesrv_auth *auth,
 463                                                 DATA_BLOB *session_key)
 464 {
 465         if (auth->session_info == NULL) {
 466                 return NT_STATUS_NO_USER_SESSION_KEY;
 467         }
 468
 469         if (auth->session_info->session_key.length == 0) {
 470                 return NT_STATUS_NO_USER_SESSION_KEY;
 471         }
 472
 473         *session_key = auth->session_info->session_key;
 474         return NT_STATUS_OK;
 475 }
 476
 477 static NTSTATUS dcesrv_remote_session_key(struct dcesrv_auth *auth,
 478                                           DATA_BLOB *session_key)
 479 {
 480         if (auth->auth_type != DCERPC_AUTH_TYPE_NONE) {
 481                 return NT_STATUS_NO_USER_SESSION_KEY;
 482         }
 483
 484         return dcesrv_session_info_session_key(auth, session_key);
 485 }
 486
 487 static NTSTATUS dcesrv_local_fixed_session_key(struct dcesrv_auth *auth,
 488                                                DATA_BLOB *session_key)
 489 {
 490         return dcerpc_generic_session_key(NULL, session_key);
 491 }
 492
 493 /*
 494  * Fetch the authentication session key if available.
 495  *
 496  * This is the key generated by a gensec authentication.
 497  *
 498  */
 499 _PUBLIC_ NTSTATUS dcesrv_auth_session_key(struct dcesrv_call_state *call,
 500                                           DATA_BLOB *session_key)
 501 {
 502         struct dcesrv_auth *auth = call->auth_state;
 503
 504         return dcesrv_session_info_session_key(auth, session_key);
 505 }
 506
 507 /*
 508  * Fetch the transport session key if available.
 509  * Typically this is the SMB session key
 510  * or a fixed key for local transports.
 511  *
 512  * The key is always truncated to 16 bytes.
 513 */
 514 _PUBLIC_ NTSTATUS dcesrv_transport_session_key(struct dcesrv_call_state *call,
 515                                                DATA_BLOB *session_key)
 516 {
 517         struct dcesrv_auth *auth = call->auth_state;
 518         NTSTATUS status;
 519
 520         if (auth->session_key_fn == NULL) {
 521                 return NT_STATUS_NO_USER_SESSION_KEY;
 522         }
 523
 524         status = auth->session_key_fn(auth, session_key);
 525         if (!NT_STATUS_IS_OK(status)) {
 526                 return status;
 527         }
 528
 529         session_key->length = MIN(session_key->length, 16);
 530
 531         return NT_STATUS_OK;
 532 }
 533
 534 static struct dcesrv_auth *dcesrv_auth_create(struct dcesrv_connection *conn)
 535 {
 536         const struct dcesrv_endpoint *ep = conn->endpoint;
 537         enum dcerpc_transport_t transport =
 538                 dcerpc_binding_get_transport(ep->ep_description);
 539         struct dcesrv_auth *auth = NULL;
 540
 541         auth = talloc_zero(conn, struct dcesrv_auth);
 542         if (auth == NULL) {
 543                 return NULL;
 544         }
 545
 546         switch (transport) {
 547         case NCACN_NP:
 548                 auth->session_key_fn = dcesrv_remote_session_key;
 549                 break;
 550         case NCALRPC:
 551         case NCACN_UNIX_STREAM:
 552                 auth->session_key_fn = dcesrv_local_fixed_session_key;
 553                 break;
 554         default:
 555                 /*
 556                  * All other's get a NULL pointer, which
 557                  * results in NT_STATUS_NO_USER_SESSION_KEY
 558                  */
 559                 break;
 560         }
 561
 562         return auth;
 563 }
 564
 565 /*
 566   connect to a dcerpc endpoint
 567 */
 568 static NTSTATUS dcesrv_endpoint_connect(struct dcesrv_context *dce_ctx,
 569                                  TALLOC_CTX *mem_ctx,
 570                                  const struct dcesrv_endpoint *ep,
 571                                  struct auth_session_info *session_info,
 572                                  struct tevent_context *event_ctx,
 573                                  struct imessaging_context *msg_ctx,
 574                                  struct server_id server_id,
 575                                  uint32_t state_flags,
 576                                  struct dcesrv_connection **_p)
 577 {
 578         struct dcesrv_auth *auth = NULL;
 579         struct dcesrv_connection *p;
 580
 581         if (!session_info) {
 582                 return NT_STATUS_ACCESS_DENIED;
 583         }
 584
 585         p = talloc_zero(mem_ctx, struct dcesrv_connection);
 586         NT_STATUS_HAVE_NO_MEMORY(p);
 587
 588         p->dce_ctx = dce_ctx;
 589         p->endpoint = ep;
 590         p->packet_log_dir = lpcfg_lock_directory(dce_ctx->lp_ctx);
 591         p->event_ctx = event_ctx;
 592         p->msg_ctx = msg_ctx;
 593         p->server_id = server_id;
 594         p->state_flags = state_flags;
 595         p->allow_bind = true;
 596         p->max_recv_frag = 5840;
 597         p->max_xmit_frag = 5840;
 598         p->max_total_request_size = DCERPC_NCACN_REQUEST_DEFAULT_MAX_SIZE;
 599
 600         auth = dcesrv_auth_create(p);
 601         if (auth == NULL) {
 602                 talloc_free(p);
 603                 return NT_STATUS_NO_MEMORY;
 604         }
 605
 606         auth->session_info = talloc_reference(auth, session_info);
 607         if (auth->session_info == NULL) {
 608                 talloc_free(p);
 609                 return NT_STATUS_NO_MEMORY;
 610         }
 611
 612         p->default_auth_state = auth;
 613
 614         /*
 615          * For now we only support NDR32.
 616          */
 617         p->preferred_transfer = &ndr_transfer_syntax_ndr;
 618
 619         *_p = p;
 620         return NT_STATUS_OK;
 621 }
 622
 623 /*
 624   move a call from an existing linked list to the specified list. This
 625   prevents bugs where we forget to remove the call from a previous
 626   list when moving it.
 627  */
 628 static void dcesrv_call_set_list(struct dcesrv_call_state *call,
 629                                  enum dcesrv_call_list list)
 630 {
 631         switch (call->list) {
 632         case DCESRV_LIST_NONE:
 633                 break;
 634         case DCESRV_LIST_CALL_LIST:
 635                 DLIST_REMOVE(call->conn->call_list, call);
 636                 break;
 637         case DCESRV_LIST_FRAGMENTED_CALL_LIST:
 638                 DLIST_REMOVE(call->conn->incoming_fragmented_call_list, call);
 639                 break;
 640         case DCESRV_LIST_PENDING_CALL_LIST:
 641                 DLIST_REMOVE(call->conn->pending_call_list, call);
 642                 break;
 643         }
 644         call->list = list;
 645         switch (list) {
 646         case DCESRV_LIST_NONE:
 647                 break;
 648         case DCESRV_LIST_CALL_LIST:
 649                 DLIST_ADD_END(call->conn->call_list, call);
 650                 break;
 651         case DCESRV_LIST_FRAGMENTED_CALL_LIST:
 652                 DLIST_ADD_END(call->conn->incoming_fragmented_call_list, call);
 653                 break;
 654         case DCESRV_LIST_PENDING_CALL_LIST:
 655                 DLIST_ADD_END(call->conn->pending_call_list, call);
 656                 break;
 657         }
 658 }
 659
 660 static void dcesrv_call_disconnect_after(struct dcesrv_call_state *call,
 661                                          const char *reason)
 662 {
 663         if (call->conn->terminate != NULL) {
 664                 return;
 665         }
 666
 667         call->conn->allow_bind = false;
 668         call->conn->allow_alter = false;
 669         call->conn->allow_auth3 = false;
 670         call->conn->allow_request = false;
 671
 672         call->conn->default_auth_state->auth_invalid = true;
 673
 674         call->terminate_reason = talloc_strdup(call, reason);
 675         if (call->terminate_reason == NULL) {
 676                 call->terminate_reason = __location__;
 677         }
 678 }
 679
 680 /*
 681   return a dcerpc bind_nak
 682 */
 683 static NTSTATUS dcesrv_bind_nak(struct dcesrv_call_state *call, uint32_t reason)
 684 {
 685         struct ncacn_packet pkt;
 686         struct dcerpc_bind_nak_version version;
 687         struct data_blob_list_item *rep;
 688         NTSTATUS status;
 689         static const uint8_t _pad[3] = { 0, };
 690
 691         /*
 692          * We add the call to the pending_call_list
 693          * in order to defer the termination.
 694          */
 695         dcesrv_call_disconnect_after(call, "dcesrv_bind_nak");
 696
 697         /* setup a bind_nak */
 698         dcesrv_init_hdr(&pkt, lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
 699         pkt.auth_length = 0;
 700         pkt.call_id = call->pkt.call_id;
 701         pkt.ptype = DCERPC_PKT_BIND_NAK;
 702         pkt.pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
 703         pkt.u.bind_nak.reject_reason = reason;
 704         version.rpc_vers = 5;
 705         version.rpc_vers_minor = 0;
 706         pkt.u.bind_nak.num_versions = 1;
 707         pkt.u.bind_nak.versions = &version;
 708         pkt.u.bind_nak._pad = data_blob_const(_pad, sizeof(_pad));
 709
 710         rep = talloc_zero(call, struct data_blob_list_item);
 711         if (!rep) {
 712                 return NT_STATUS_NO_MEMORY;
 713         }
 714
 715         status = ncacn_push_auth(&rep->blob, call, &pkt, NULL);
 716         if (!NT_STATUS_IS_OK(status)) {
 717                 return status;
 718         }
 719
 720         dcerpc_set_frag_length(&rep->blob, rep->blob.length);
 721
 722         DLIST_ADD_END(call->replies, rep);
 723         dcesrv_call_set_list(call, DCESRV_LIST_CALL_LIST);
 724
 725         if (call->conn->call_list && call->conn->call_list->replies) {
 726                 if (call->conn->transport.report_output_data) {
 727                         call->conn->transport.report_output_data(call->conn);
 728                 }
 729         }
 730
 731         return NT_STATUS_OK;
 732 }
 733
 734 static NTSTATUS dcesrv_fault_disconnect(struct dcesrv_call_state *call,
 735                                  uint32_t fault_code)
 736 {
 737         /*
 738          * We add the call to the pending_call_list
 739          * in order to defer the termination.
 740          */
 741         dcesrv_call_disconnect_after(call, "dcesrv_fault_disconnect");
 742
 743         return dcesrv_fault_with_flags(call, fault_code,
 744                                        DCERPC_PFC_FLAG_DID_NOT_EXECUTE);
 745 }
 746
 747 static int dcesrv_connection_context_destructor(struct dcesrv_connection_context *c)
 748 {
 749         DLIST_REMOVE(c->conn->contexts, c);
 750
 751         if (c->iface && c->iface->unbind) {
 752                 c->iface->unbind(c, c->iface);
 753                 c->iface = NULL;
 754         }
 755
 756         return 0;
 757 }
 758
 759 static void dcesrv_prepare_context_auth(struct dcesrv_call_state *dce_call)
 760 {
 761         struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
 762         const struct dcesrv_endpoint *endpoint = dce_call->conn->endpoint;
 763         enum dcerpc_transport_t transport =
 764                 dcerpc_binding_get_transport(endpoint->ep_description);
 765         struct dcesrv_connection_context *context = dce_call->context;
 766         const struct dcesrv_interface *iface = context->iface;
 767
 768         context->min_auth_level = DCERPC_AUTH_LEVEL_NONE;
 769
 770         if (transport == NCALRPC) {
 771                 context->allow_connect = true;
 772                 return;
 773         }
 774
 775         /*
 776          * allow overwrite per interface
 777          * allow dcerpc auth level connect:<interface>
 778          */
 779         context->allow_connect = lpcfg_allow_dcerpc_auth_level_connect(lp_ctx);
 780         context->allow_connect = lpcfg_parm_bool(lp_ctx, NULL,
 781                                         "allow dcerpc auth level connect",
 782                                         iface->name,
 783                                         context->allow_connect);
 784 }
 785
 786 NTSTATUS dcesrv_interface_bind_require_integrity(struct dcesrv_call_state *dce_call,
 787                                                  const struct dcesrv_interface *iface)
 788 {
 789         if (dce_call->context == NULL) {
 790                 return NT_STATUS_INTERNAL_ERROR;
 791         }
 792
 793         /*
 794          * For connection oriented DCERPC DCERPC_AUTH_LEVEL_PACKET (4)
 795          * has the same behavior as DCERPC_AUTH_LEVEL_INTEGRITY (5).
 796          */
 797         dce_call->context->min_auth_level = DCERPC_AUTH_LEVEL_PACKET;
 798         return NT_STATUS_OK;
 799 }
 800
 801 NTSTATUS dcesrv_interface_bind_require_privacy(struct dcesrv_call_state *dce_call,
 802                                                const struct dcesrv_interface *iface)
 803 {
 804         if (dce_call->context == NULL) {
 805                 return NT_STATUS_INTERNAL_ERROR;
 806         }
 807
 808         dce_call->context->min_auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 809         return NT_STATUS_OK;
 810 }
 811
 812 _PUBLIC_ NTSTATUS dcesrv_interface_bind_reject_connect(struct dcesrv_call_state *dce_call,
 813                                                        const struct dcesrv_interface *iface)
 814 {
 815         struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
 816         const struct dcesrv_endpoint *endpoint = dce_call->conn->endpoint;
 817         enum dcerpc_transport_t transport =
 818                 dcerpc_binding_get_transport(endpoint->ep_description);
 819         struct dcesrv_connection_context *context = dce_call->context;
 820
 821         if (context == NULL) {
 822                 return NT_STATUS_INTERNAL_ERROR;
 823         }
 824
 825         if (transport == NCALRPC) {
 826                 context->allow_connect = true;
 827                 return NT_STATUS_OK;
 828         }
 829
 830         /*
 831          * allow overwrite per interface
 832          * allow dcerpc auth level connect:<interface>
 833          */
 834         context->allow_connect = false;
 835         context->allow_connect = lpcfg_parm_bool(lp_ctx, NULL,
 836                                         "allow dcerpc auth level connect",
 837                                         iface->name,
 838                                         context->allow_connect);
 839         return NT_STATUS_OK;
 840 }
 841
 842 _PUBLIC_ NTSTATUS dcesrv_interface_bind_allow_connect(struct dcesrv_call_state *dce_call,
 843                                                       const struct dcesrv_interface *iface)
 844 {
 845         struct loadparm_context *lp_ctx = dce_call->conn->dce_ctx->lp_ctx;
 846         const struct dcesrv_endpoint *endpoint = dce_call->conn->endpoint;
 847         enum dcerpc_transport_t transport =
 848                 dcerpc_binding_get_transport(endpoint->ep_description);
 849         struct dcesrv_connection_context *context = dce_call->context;
 850
 851         if (context == NULL) {
 852                 return NT_STATUS_INTERNAL_ERROR;
 853         }
 854
 855         if (transport == NCALRPC) {
 856                 context->allow_connect = true;
 857                 return NT_STATUS_OK;
 858         }
 859
 860         /*
 861          * allow overwrite per interface
 862          * allow dcerpc auth level connect:<interface>
 863          */
 864         context->allow_connect = true;
 865         context->allow_connect = lpcfg_parm_bool(lp_ctx, NULL,
 866                                         "allow dcerpc auth level connect",
 867                                         iface->name,
 868                                         context->allow_connect);
 869         return NT_STATUS_OK;
 870 }
 871
 872 struct dcesrv_conn_auth_wait_context {
 873         struct tevent_req *req;
 874         bool done;
 875         NTSTATUS status;
 876 };
 877
 878 struct dcesrv_conn_auth_wait_state {
 879         uint8_t dummy;
 880 };
 881
 882 static struct tevent_req *dcesrv_conn_auth_wait_send(TALLOC_CTX *mem_ctx,
 883                                                      struct tevent_context *ev,
 884                                                      void *private_data)
 885 {
 886         struct dcesrv_conn_auth_wait_context *auth_wait =
 887                 talloc_get_type_abort(private_data,
 888                 struct dcesrv_conn_auth_wait_context);
 889         struct tevent_req *req = NULL;
 890         struct dcesrv_conn_auth_wait_state *state = NULL;
 891
 892         req = tevent_req_create(mem_ctx, &state,
 893                                 struct dcesrv_conn_auth_wait_state);
 894         if (req == NULL) {
 895                 return NULL;
 896         }
 897         auth_wait->req = req;
 898
 899         tevent_req_defer_callback(req, ev);
 900
 901         if (!auth_wait->done) {
 902                 return req;
 903         }
 904
 905         if (tevent_req_nterror(req, auth_wait->status)) {
 906                 return tevent_req_post(req, ev);
 907         }
 908
 909         tevent_req_done(req);
 910         return tevent_req_post(req, ev);
 911 }
 912
 913 static NTSTATUS dcesrv_conn_auth_wait_recv(struct tevent_req *req)
 914 {
 915         return tevent_req_simple_recv_ntstatus(req);
 916 }
 917
 918 static NTSTATUS dcesrv_conn_auth_wait_setup(struct dcesrv_connection *conn)
 919 {
 920         struct dcesrv_conn_auth_wait_context *auth_wait = NULL;
 921
 922         if (conn->wait_send != NULL) {
 923                 return NT_STATUS_INTERNAL_ERROR;
 924         }
 925
 926         auth_wait = talloc_zero(conn, struct dcesrv_conn_auth_wait_context);
 927         if (auth_wait == NULL) {
 928                 return NT_STATUS_NO_MEMORY;
 929         }
 930
 931         conn->wait_private = auth_wait;
 932         conn->wait_send = dcesrv_conn_auth_wait_send;
 933         conn->wait_recv = dcesrv_conn_auth_wait_recv;
 934         return NT_STATUS_OK;
 935 }
 936
 937 static void dcesrv_conn_auth_wait_finished(struct dcesrv_connection *conn,
 938                                            NTSTATUS status)
 939 {
 940         struct dcesrv_conn_auth_wait_context *auth_wait =
 941                 talloc_get_type_abort(conn->wait_private,
 942                 struct dcesrv_conn_auth_wait_context);
 943
 944         auth_wait->done = true;
 945         auth_wait->status = status;
 946
 947         if (auth_wait->req == NULL) {
 948                 return;
 949         }
 950
 951         if (tevent_req_nterror(auth_wait->req, status)) {
 952                 return;
 953         }
 954
 955         tevent_req_done(auth_wait->req);
 956 }
 957
 958 static NTSTATUS dcesrv_auth_reply(struct dcesrv_call_state *call);
 959
 960 static void dcesrv_bind_done(struct tevent_req *subreq);
 961
 962 /*
 963   handle a bind request
 964 */
 965 static NTSTATUS dcesrv_bind(struct dcesrv_call_state *call)
 966 {
 967         struct dcesrv_connection *conn = call->conn;
 968         struct ncacn_packet *pkt = &call->ack_pkt;
 969         NTSTATUS status;
 970         uint32_t extra_flags = 0;
 971         uint16_t max_req = 0;
 972         uint16_t max_rep = 0;
 973         const char *ep_prefix = "";
 974         const char *endpoint = NULL;
 975         struct dcesrv_auth *auth = call->auth_state;
 976         struct dcerpc_ack_ctx *ack_ctx_list = NULL;
 977         struct dcerpc_ack_ctx *ack_features = NULL;
 978         struct tevent_req *subreq = NULL;
 979         size_t i;
 980
 981         status = dcerpc_verify_ncacn_packet_header(&call->pkt,
 982                         DCERPC_PKT_BIND,
 983                         call->pkt.u.bind.auth_info.length,
 984                         0, /* required flags */
 985                         DCERPC_PFC_FLAG_FIRST |
 986                         DCERPC_PFC_FLAG_LAST |
 987                         DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
 988                         0x08 | /* this is not defined, but should be ignored */
 989                         DCERPC_PFC_FLAG_CONC_MPX |
 990                         DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
 991                         DCERPC_PFC_FLAG_MAYBE |
 992                         DCERPC_PFC_FLAG_OBJECT_UUID);
 993         if (!NT_STATUS_IS_OK(status)) {
 994                 return dcesrv_bind_nak(call,
 995                         DCERPC_BIND_NAK_REASON_PROTOCOL_VERSION_NOT_SUPPORTED);
 996         }
 997
 998         /* max_recv_frag and max_xmit_frag result always in the same value! */
 999         max_req = MIN(call->pkt.u.bind.max_xmit_frag,
1000                       call->pkt.u.bind.max_recv_frag);
1001         /*
1002          * The values are between 2048 and 5840 tested against Windows 2012R2
1003          * via ncacn_ip_tcp on port 135.
1004          */
1005         max_req = MAX(2048, max_req);
1006         max_rep = MIN(max_req, call->conn->max_recv_frag);
1007         /* They are truncated to an 8 byte boundary. */
1008         max_rep &= 0xFFF8;
1009
1010         /* max_recv_frag and max_xmit_frag result always in the same value! */
1011         call->conn->max_recv_frag = max_rep;
1012         call->conn->max_xmit_frag = max_rep;
1013
1014         /*
1015           if provided, check the assoc_group is valid
1016          */
1017         if (call->pkt.u.bind.assoc_group_id != 0) {
1018                 call->conn->assoc_group = dcesrv_assoc_group_reference(call->conn,
1019                                                                        call->conn->dce_ctx,
1020                                                                        call->pkt.u.bind.assoc_group_id);
1021         } else {
1022                 call->conn->assoc_group = dcesrv_assoc_group_new(call->conn,
1023                                                                  call->conn->dce_ctx);
1024         }
1025
1026         /*
1027          * The NETLOGON server does not use handles and so
1028          * there is no need to support association groups, but
1029          * we need to give back a number regardless.
1030          *
1031          * We have to do this when it is not run as a single process,
1032          * because then it can't see the other valid association
1033          * groups.  We handle this genericly for all endpoints not
1034          * running in single process mode.
1035          *
1036          * We know which endpoint we are on even before checking the
1037          * iface UUID, so for simplicity we enforce the same policy
1038          * for all interfaces on the endpoint.
1039          *
1040          * This means that where NETLOGON
1041          * shares an endpoint (such as ncalrpc or of 'lsa over
1042          * netlogon' is set) we will still check association groups.
1043          *
1044          */
1045
1046         if (call->conn->assoc_group == NULL &&
1047             !call->conn->endpoint->use_single_process) {
1048                 call->conn->assoc_group
1049                         = dcesrv_assoc_group_new(call->conn,
1050                                                  call->conn->dce_ctx);
1051         }
1052         if (call->conn->assoc_group == NULL) {
1053                 return dcesrv_bind_nak(call, 0);
1054         }
1055
1056         if (call->pkt.u.bind.num_contexts < 1) {
1057                 return dcesrv_bind_nak(call, 0);
1058         }
1059
1060         ack_ctx_list = talloc_zero_array(call, struct dcerpc_ack_ctx,
1061                                          call->pkt.u.bind.num_contexts);
1062         if (ack_ctx_list == NULL) {
1063                 return dcesrv_bind_nak(call, 0);
1064         }
1065
1066         /*
1067          * Set some sane defaults (required by dcesrv_negotiate_contexts()/
1068          * dcesrv_check_or_create_context()) and do some protocol validation
1069          * and set sane defaults.
1070          */
1071         for (i = 0; i < call->pkt.u.bind.num_contexts; i++) {
1072                 const struct dcerpc_ctx_list *c = &call->pkt.u.bind.ctx_list[i];
1073                 struct dcerpc_ack_ctx *a = &ack_ctx_list[i];
1074                 bool is_feature = false;
1075                 uint64_t features = 0;
1076
1077                 if (c->num_transfer_syntaxes == 0) {
1078                         return dcesrv_bind_nak(call, 0);
1079                 }
1080
1081                 a->result = DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION;
1082                 a->reason.value = DCERPC_BIND_ACK_REASON_ABSTRACT_SYNTAX_NOT_SUPPORTED;
1083
1084                 /*
1085                  * It's only treated as bind time feature request, if the first
1086                  * transfer_syntax matches, all others are ignored.
1087                  */
1088                 is_feature = dcerpc_extract_bind_time_features(c->transfer_syntaxes[0],
1089                                                                &features);
1090                 if (!is_feature) {
1091                         continue;
1092                 }
1093
1094                 if (ack_features != NULL) {
1095                         /*
1096                          * Only one bind time feature context is allowed.
1097                          */
1098                         return dcesrv_bind_nak(call, 0);
1099                 }
1100                 ack_features = a;
1101
1102                 a->result = DCERPC_BIND_ACK_RESULT_NEGOTIATE_ACK;
1103                 a->reason.negotiate = 0;
1104                 if (features & DCERPC_BIND_TIME_SECURITY_CONTEXT_MULTIPLEXING) {
1105                         /* not supported yet */
1106                 }
1107                 if (features & DCERPC_BIND_TIME_KEEP_CONNECTION_ON_ORPHAN) {
1108                         a->reason.negotiate |=
1109                                 DCERPC_BIND_TIME_KEEP_CONNECTION_ON_ORPHAN;
1110                 }
1111
1112                 call->conn->bind_time_features = a->reason.negotiate;
1113         }
1114
1115         /*
1116          * Try to negotiate one new presentation context.
1117          *
1118          * Deep in here we locate the iface (by uuid) that the client
1119          * requested, from the list of interfaces on the
1120          * call->conn->endpoint, and call iface->bind() on that iface.
1121          *
1122          * call->conn was set up at the accept() of the socket, and
1123          * call->conn->endpoint has a list of interfaces restricted to
1124          * this port or pipe.
1125          */
1126         status = dcesrv_negotiate_contexts(call, &call->pkt.u.bind, ack_ctx_list);
1127         if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTOCOL_ERROR)) {
1128                 return dcesrv_bind_nak(call, 0);
1129         }
1130         if (!NT_STATUS_IS_OK(status)) {
1131                 return status;
1132         }
1133
1134         /*
1135          * At this point we still don't know which interface (eg
1136          * netlogon, lsa, drsuapi) the caller requested in this bind!
1137          * The most recently added context is available as the first
1138          * element in the linked list at call->conn->contexts, that is
1139          * call->conn->contexts->iface, but they may not have
1140          * requested one at all!
1141          */
1142
1143         if ((call->pkt.pfc_flags & DCERPC_PFC_FLAG_CONC_MPX) &&
1144             (call->state_flags & DCESRV_CALL_STATE_FLAG_MULTIPLEXED)) {
1145                 call->conn->state_flags |= DCESRV_CALL_STATE_FLAG_MULTIPLEXED;
1146                 extra_flags |= DCERPC_PFC_FLAG_CONC_MPX;
1147         }
1148
1149         if (call->state_flags & DCESRV_CALL_STATE_FLAG_PROCESS_PENDING_CALL) {
1150                 call->conn->state_flags |= DCESRV_CALL_STATE_FLAG_PROCESS_PENDING_CALL;
1151         }
1152
1153         /*
1154          * After finding the interface and setting up the NDR
1155          * transport negotiation etc, handle any authentication that
1156          * is being requested.
1157          */
1158         if (!dcesrv_auth_bind(call)) {
1159
1160                 if (auth->auth_level == DCERPC_AUTH_LEVEL_NONE) {
1161                         /*
1162                          * With DCERPC_AUTH_LEVEL_NONE, we get the
1163                          * reject_reason in auth->auth_context_id.
1164                          */
1165                         return dcesrv_bind_nak(call, auth->auth_context_id);
1166                 }
1167
1168                 /*
1169                  * This must a be a temporary failure e.g. talloc or invalid
1170                  * configuration, e.g. no machine account.
1171                  */
1172                 return dcesrv_bind_nak(call,
1173                                 DCERPC_BIND_NAK_REASON_TEMPORARY_CONGESTION);
1174         }
1175
1176         /* setup a bind_ack */
1177         dcesrv_init_hdr(pkt, lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
1178         pkt->auth_length = 0;
1179         pkt->call_id = call->pkt.call_id;
1180         pkt->ptype = DCERPC_PKT_BIND_ACK;
1181         pkt->pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST | extra_flags;
1182         pkt->u.bind_ack.max_xmit_frag = call->conn->max_xmit_frag;
1183         pkt->u.bind_ack.max_recv_frag = call->conn->max_recv_frag;
1184         pkt->u.bind_ack.assoc_group_id = call->conn->assoc_group->id;
1185
1186         endpoint = dcerpc_binding_get_string_option(
1187                                 call->conn->endpoint->ep_description,
1188                                 "endpoint");
1189         if (endpoint == NULL) {
1190                 endpoint = "";
1191         }
1192
1193         if (strncasecmp(endpoint, "\\pipe\\", 6) == 0) {
1194                 /*
1195                  * TODO: check if this is really needed
1196                  *
1197                  * Or if we should fix this in our idl files.
1198                  */
1199                 ep_prefix = "\\PIPE\\";
1200                 endpoint += 6;
1201         }
1202
1203         pkt->u.bind_ack.secondary_address = talloc_asprintf(call, "%s%s",
1204                                                            ep_prefix,
1205                                                            endpoint);
1206         if (pkt->u.bind_ack.secondary_address == NULL) {
1207                 return NT_STATUS_NO_MEMORY;
1208         }
1209         pkt->u.bind_ack.num_results = call->pkt.u.bind.num_contexts;
1210         pkt->u.bind_ack.ctx_list = ack_ctx_list;
1211         pkt->u.bind_ack.auth_info = data_blob_null;
1212
1213         status = dcesrv_auth_prepare_bind_ack(call, pkt);
1214         if (!NT_STATUS_IS_OK(status)) {
1215                 return dcesrv_bind_nak(call, 0);
1216         }
1217
1218         if (auth->auth_finished) {
1219                 return dcesrv_auth_reply(call);
1220         }
1221
1222         subreq = gensec_update_send(call, call->event_ctx,
1223                                     auth->gensec_security,
1224                                     call->in_auth_info.credentials);
1225         if (subreq == NULL) {
1226                 return NT_STATUS_NO_MEMORY;
1227         }
1228         tevent_req_set_callback(subreq, dcesrv_bind_done, call);
1229
1230         return dcesrv_conn_auth_wait_setup(conn);
1231 }
1232
1233 static void dcesrv_bind_done(struct tevent_req *subreq)
1234 {
1235         struct dcesrv_call_state *call =
1236                 tevent_req_callback_data(subreq,
1237                 struct dcesrv_call_state);
1238         struct dcesrv_connection *conn = call->conn;
1239         NTSTATUS status;
1240
1241         status = gensec_update_recv(subreq, call,
1242                                     &call->out_auth_info->credentials);
1243         TALLOC_FREE(subreq);
1244
1245         status = dcesrv_auth_complete(call, status);
1246         if (!NT_STATUS_IS_OK(status)) {
1247                 status = dcesrv_bind_nak(call, 0);
1248                 dcesrv_conn_auth_wait_finished(conn, status);
1249                 return;
1250         }
1251
1252         status = dcesrv_auth_reply(call);
1253         dcesrv_conn_auth_wait_finished(conn, status);
1254         return;
1255 }
1256
1257 static NTSTATUS dcesrv_auth_reply(struct dcesrv_call_state *call)
1258 {
1259         struct ncacn_packet *pkt = &call->ack_pkt;
1260         struct data_blob_list_item *rep = NULL;
1261         NTSTATUS status;
1262
1263         rep = talloc_zero(call, struct data_blob_list_item);
1264         if (!rep) {
1265                 return NT_STATUS_NO_MEMORY;
1266         }
1267
1268         status = ncacn_push_auth(&rep->blob, call, pkt,
1269                                  call->out_auth_info);
1270         if (!NT_STATUS_IS_OK(status)) {
1271                 return status;
1272         }
1273
1274         dcerpc_set_frag_length(&rep->blob, rep->blob.length);
1275
1276         DLIST_ADD_END(call->replies, rep);
1277         dcesrv_call_set_list(call, DCESRV_LIST_CALL_LIST);
1278
1279         if (call->conn->call_list && call->conn->call_list->replies) {
1280                 if (call->conn->transport.report_output_data) {
1281                         call->conn->transport.report_output_data(call->conn);
1282                 }
1283         }
1284
1285         return NT_STATUS_OK;
1286 }
1287
1288
1289 static void dcesrv_auth3_done(struct tevent_req *subreq);
1290
1291 /*
1292   handle a auth3 request
1293 */
1294 static NTSTATUS dcesrv_auth3(struct dcesrv_call_state *call)
1295 {
1296         struct dcesrv_connection *conn = call->conn;
1297         struct dcesrv_auth *auth = call->auth_state;
1298         struct tevent_req *subreq = NULL;
1299         NTSTATUS status;
1300
1301         if (!call->conn->allow_auth3) {
1302                 return dcesrv_fault_disconnect(call, DCERPC_NCA_S_PROTO_ERROR);
1303         }
1304
1305         if (auth->auth_finished) {
1306                 return dcesrv_fault_disconnect(call, DCERPC_NCA_S_PROTO_ERROR);
1307         }
1308
1309         status = dcerpc_verify_ncacn_packet_header(&call->pkt,
1310                         DCERPC_PKT_AUTH3,
1311                         call->pkt.u.auth3.auth_info.length,
1312                         0, /* required flags */
1313                         DCERPC_PFC_FLAG_FIRST |
1314                         DCERPC_PFC_FLAG_LAST |
1315                         DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
1316                         0x08 | /* this is not defined, but should be ignored */
1317                         DCERPC_PFC_FLAG_CONC_MPX |
1318                         DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
1319                         DCERPC_PFC_FLAG_MAYBE |
1320                         DCERPC_PFC_FLAG_OBJECT_UUID);
1321         if (!NT_STATUS_IS_OK(status)) {
1322                 return dcesrv_fault_disconnect(call, DCERPC_NCA_S_PROTO_ERROR);
1323         }
1324
1325         /* handle the auth3 in the auth code */
1326         if (!dcesrv_auth_prepare_auth3(call)) {
1327                 /*
1328                  * we don't send a reply to a auth3 request,
1329                  * except by a fault.
1330                  *
1331                  * In anycase we mark the connection as
1332                  * invalid.
1333                  */
1334                 auth->auth_invalid = true;
1335                 if (call->fault_code != 0) {
1336                         return dcesrv_fault_disconnect(call, call->fault_code);
1337                 }
1338                 TALLOC_FREE(call);
1339                 return NT_STATUS_OK;
1340         }
1341
1342         subreq = gensec_update_send(call, call->event_ctx,
1343                                     auth->gensec_security,
1344                                     call->in_auth_info.credentials);
1345         if (subreq == NULL) {
1346                 return NT_STATUS_NO_MEMORY;
1347         }
1348         tevent_req_set_callback(subreq, dcesrv_auth3_done, call);
1349
1350         return dcesrv_conn_auth_wait_setup(conn);
1351 }
1352
1353 static void dcesrv_auth3_done(struct tevent_req *subreq)
1354 {
1355         struct dcesrv_call_state *call =
1356                 tevent_req_callback_data(subreq,
1357                 struct dcesrv_call_state);
1358         struct dcesrv_connection *conn = call->conn;
1359         struct dcesrv_auth *auth = call->auth_state;
1360         NTSTATUS status;
1361
1362         status = gensec_update_recv(subreq, call,
1363                                     &call->out_auth_info->credentials);
1364         TALLOC_FREE(subreq);
1365
1366         status = dcesrv_auth_complete(call, status);
1367         if (!NT_STATUS_IS_OK(status)) {
1368                 /*
1369                  * we don't send a reply to a auth3 request,
1370                  * except by a fault.
1371                  *
1372                  * In anycase we mark the connection as
1373                  * invalid.
1374                  */
1375                 auth->auth_invalid = true;
1376                 if (call->fault_code != 0) {
1377                         status = dcesrv_fault_disconnect(call, call->fault_code);
1378                         dcesrv_conn_auth_wait_finished(conn, status);
1379                         return;
1380                 }
1381                 TALLOC_FREE(call);
1382                 dcesrv_conn_auth_wait_finished(conn, NT_STATUS_OK);
1383                 return;
1384         }
1385
1386         /*
1387          * we don't send a reply to a auth3 request.
1388          */
1389         TALLOC_FREE(call);
1390         dcesrv_conn_auth_wait_finished(conn, NT_STATUS_OK);
1391         return;
1392 }
1393
1394
1395 static NTSTATUS dcesrv_check_or_create_context(struct dcesrv_call_state *call,
1396                                 const struct dcerpc_bind *b,
1397                                 const struct dcerpc_ctx_list *ctx,
1398                                 struct dcerpc_ack_ctx *ack,
1399                                 bool validate_only,
1400                                 const struct ndr_syntax_id *supported_transfer)
1401 {
1402         uint32_t if_version;
1403         struct dcesrv_connection_context *context;
1404         const struct dcesrv_interface *iface;
1405         struct GUID uuid;
1406         NTSTATUS status;
1407         const struct ndr_syntax_id *selected_transfer = NULL;
1408         size_t i;
1409         bool ok;
1410
1411         if (b == NULL) {
1412                 return NT_STATUS_INTERNAL_ERROR;
1413         }
1414         if (ctx == NULL) {
1415                 return NT_STATUS_INTERNAL_ERROR;
1416         }
1417         if (ctx->num_transfer_syntaxes < 1) {
1418                 return NT_STATUS_INTERNAL_ERROR;
1419         }
1420         if (ack == NULL) {
1421                 return NT_STATUS_INTERNAL_ERROR;
1422         }
1423         if (supported_transfer == NULL) {
1424                 return NT_STATUS_INTERNAL_ERROR;
1425         }
1426
1427         switch (ack->result) {
1428         case DCERPC_BIND_ACK_RESULT_ACCEPTANCE:
1429         case DCERPC_BIND_ACK_RESULT_NEGOTIATE_ACK:
1430                 /*
1431                  * We is already completed.
1432                  */
1433                 return NT_STATUS_OK;
1434         default:
1435                 break;
1436         }
1437
1438         ack->result = DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION;
1439         ack->reason.value = DCERPC_BIND_ACK_REASON_ABSTRACT_SYNTAX_NOT_SUPPORTED;
1440
1441         if_version = ctx->abstract_syntax.if_version;
1442         uuid = ctx->abstract_syntax.uuid;
1443
1444         iface = find_interface_by_uuid(call->conn->endpoint, &uuid, if_version);
1445         if (iface == NULL) {
1446                 char *uuid_str = GUID_string(call, &uuid);
1447                 DEBUG(2,("Request for unknown dcerpc interface %s/%d\n", uuid_str, if_version));
1448                 talloc_free(uuid_str);
1449                 /*
1450                  * We report this only via ack->result
1451                  */
1452                 return NT_STATUS_OK;
1453         }
1454
1455         ack->result = DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION;
1456         ack->reason.value = DCERPC_BIND_ACK_REASON_TRANSFER_SYNTAXES_NOT_SUPPORTED;
1457
1458         if (validate_only) {
1459                 /*
1460                  * We report this only via ack->result
1461                  */
1462                 return NT_STATUS_OK;
1463         }
1464
1465         for (i = 0; i < ctx->num_transfer_syntaxes; i++) {
1466                 /*
1467                  * we only do NDR encoded dcerpc for now.
1468                  */
1469                 ok = ndr_syntax_id_equal(&ctx->transfer_syntaxes[i],
1470                                          supported_transfer);
1471                 if (ok) {
1472                         selected_transfer = supported_transfer;
1473                         break;
1474                 }
1475         }
1476
1477         context = dcesrv_find_context(call->conn, ctx->context_id);
1478         if (context != NULL) {
1479                 ok = ndr_syntax_id_equal(&context->iface->syntax_id,
1480                                          &ctx->abstract_syntax);
1481                 if (!ok) {
1482                         return NT_STATUS_RPC_PROTOCOL_ERROR;
1483                 }
1484
1485                 if (selected_transfer != NULL) {
1486                         ok = ndr_syntax_id_equal(&context->transfer_syntax,
1487                                                  selected_transfer);
1488                         if (!ok) {
1489                                 return NT_STATUS_RPC_PROTOCOL_ERROR;
1490                         }
1491
1492                         ack->result = DCERPC_BIND_ACK_RESULT_ACCEPTANCE;
1493                         ack->reason.value = DCERPC_BIND_ACK_REASON_NOT_SPECIFIED;
1494                         ack->syntax = context->transfer_syntax;
1495                 }
1496
1497                 /*
1498                  * We report this only via ack->result
1499                  */
1500                 return NT_STATUS_OK;
1501         }
1502
1503         if (selected_transfer == NULL) {
1504                 /*
1505                  * We report this only via ack->result
1506                  */
1507                 return NT_STATUS_OK;
1508         }
1509
1510         ack->result = DCERPC_BIND_ACK_RESULT_USER_REJECTION;
1511         ack->reason.value = DCERPC_BIND_ACK_REASON_LOCAL_LIMIT_EXCEEDED;
1512
1513         /* add this context to the list of available context_ids */
1514         context = talloc_zero(call->conn, struct dcesrv_connection_context);
1515         if (context == NULL) {
1516                 return NT_STATUS_NO_MEMORY;
1517         }
1518         context->conn = call->conn;
1519         context->context_id = ctx->context_id;
1520         context->iface = iface;
1521         context->transfer_syntax = *selected_transfer;
1522         context->private_data = NULL;
1523         DLIST_ADD(call->conn->contexts, context);
1524         call->context = context;
1525         talloc_set_destructor(context, dcesrv_connection_context_destructor);
1526
1527         dcesrv_prepare_context_auth(call);
1528
1529         /*
1530          * Multiplex is supported by default
1531          */
1532         call->state_flags |= DCESRV_CALL_STATE_FLAG_MULTIPLEXED;
1533
1534         status = iface->bind(call, iface, if_version);
1535         call->context = NULL;
1536         if (!NT_STATUS_IS_OK(status)) {
1537                 /* we don't want to trigger the iface->unbind() hook */
1538                 context->iface = NULL;
1539                 talloc_free(context);
1540                 /*
1541                  * We report this only via ack->result
1542                  */
1543                 return NT_STATUS_OK;
1544         }
1545
1546         ack->result = DCERPC_BIND_ACK_RESULT_ACCEPTANCE;
1547         ack->reason.value = DCERPC_BIND_ACK_REASON_NOT_SPECIFIED;
1548         ack->syntax = context->transfer_syntax;
1549         return NT_STATUS_OK;
1550 }
1551
1552 static NTSTATUS dcesrv_negotiate_contexts(struct dcesrv_call_state *call,
1553                                 const struct dcerpc_bind *b,
1554                                 struct dcerpc_ack_ctx *ack_ctx_list)
1555 {
1556         NTSTATUS status;
1557         size_t i;
1558         bool validate_only = false;
1559         bool preferred_ndr32;
1560
1561         /*
1562          * Try to negotiate one new presentation context,
1563          * using our preferred transfer syntax.
1564          */
1565         for (i = 0; i < b->num_contexts; i++) {
1566                 const struct dcerpc_ctx_list *c = &b->ctx_list[i];
1567                 struct dcerpc_ack_ctx *a = &ack_ctx_list[i];
1568
1569                 status = dcesrv_check_or_create_context(call, b, c, a,
1570                                                 validate_only,
1571                                                 call->conn->preferred_transfer);
1572                 if (!NT_STATUS_IS_OK(status)) {
1573                         return status;
1574                 }
1575
1576                 if (a->result == DCERPC_BIND_ACK_RESULT_ACCEPTANCE) {
1577                         /*
1578                          * We managed to negotiate one context.
1579                          *
1580                          * => we're done.
1581                          */
1582                         validate_only = true;
1583                 }
1584         }
1585
1586         preferred_ndr32 = ndr_syntax_id_equal(&ndr_transfer_syntax_ndr,
1587                                         call->conn->preferred_transfer);
1588         if (preferred_ndr32) {
1589                 /*
1590                  * We're done.
1591                  */
1592                 return NT_STATUS_OK;
1593         }
1594
1595         /*
1596          * Try to negotiate one new presentation context,
1597          * using NDR 32 as fallback.
1598          */
1599         for (i = 0; i < b->num_contexts; i++) {
1600                 const struct dcerpc_ctx_list *c = &b->ctx_list[i];
1601                 struct dcerpc_ack_ctx *a = &ack_ctx_list[i];
1602
1603                 status = dcesrv_check_or_create_context(call, b, c, a,
1604                                                 validate_only,
1605                                                 &ndr_transfer_syntax_ndr);
1606                 if (!NT_STATUS_IS_OK(status)) {
1607                         return status;
1608                 }
1609
1610                 if (a->result == DCERPC_BIND_ACK_RESULT_ACCEPTANCE) {
1611                         /*
1612                          * We managed to negotiate one context.
1613                          *
1614                          * => we're done.
1615                          */
1616                         validate_only = true;
1617                 }
1618         }
1619
1620         return NT_STATUS_OK;
1621 }
1622
1623 static void dcesrv_alter_done(struct tevent_req *subreq);
1624
1625 /*
1626   handle a alter context request
1627 */
1628 static NTSTATUS dcesrv_alter(struct dcesrv_call_state *call)
1629 {
1630         struct dcesrv_connection *conn = call->conn;
1631         NTSTATUS status;
1632         bool auth_ok = false;
1633         struct ncacn_packet *pkt = &call->ack_pkt;
1634         uint32_t extra_flags = 0;
1635         struct dcesrv_auth *auth = call->auth_state;
1636         struct dcerpc_ack_ctx *ack_ctx_list = NULL;
1637         struct tevent_req *subreq = NULL;
1638         size_t i;
1639
1640         if (!call->conn->allow_alter) {
1641                 return dcesrv_fault_disconnect(call, DCERPC_NCA_S_PROTO_ERROR);
1642         }
1643
1644         status = dcerpc_verify_ncacn_packet_header(&call->pkt,
1645                         DCERPC_PKT_ALTER,
1646                         call->pkt.u.alter.auth_info.length,
1647                         0, /* required flags */
1648                         DCERPC_PFC_FLAG_FIRST |
1649                         DCERPC_PFC_FLAG_LAST |
1650                         DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
1651                         0x08 | /* this is not defined, but should be ignored */
1652                         DCERPC_PFC_FLAG_CONC_MPX |
1653                         DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
1654                         DCERPC_PFC_FLAG_MAYBE |
1655                         DCERPC_PFC_FLAG_OBJECT_UUID);
1656         if (!NT_STATUS_IS_OK(status)) {
1657                 return dcesrv_fault_disconnect(call, DCERPC_NCA_S_PROTO_ERROR);
1658         }
1659
1660         auth_ok = dcesrv_auth_alter(call);
1661         if (!auth_ok) {
1662                 if (call->fault_code != 0) {
1663                         return dcesrv_fault_disconnect(call, call->fault_code);
1664                 }
1665         }
1666
1667         if (call->pkt.u.alter.num_contexts < 1) {
1668                 return dcesrv_fault_disconnect(call, DCERPC_NCA_S_PROTO_ERROR);
1669         }
1670
1671         ack_ctx_list = talloc_zero_array(call, struct dcerpc_ack_ctx,
1672                                          call->pkt.u.alter.num_contexts);
1673         if (ack_ctx_list == NULL) {
1674                 return NT_STATUS_NO_MEMORY;
1675         }
1676
1677         /*
1678          * Set some sane defaults (required by dcesrv_negotiate_contexts()/
1679          * dcesrv_check_or_create_context()) and do some protocol validation
1680          * and set sane defaults.
1681          */
1682         for (i = 0; i < call->pkt.u.alter.num_contexts; i++) {
1683                 const struct dcerpc_ctx_list *c = &call->pkt.u.alter.ctx_list[i];
1684                 struct dcerpc_ack_ctx *a = &ack_ctx_list[i];
1685
1686                 if (c->num_transfer_syntaxes == 0) {
1687                         return dcesrv_fault_disconnect(call,
1688                                         DCERPC_NCA_S_PROTO_ERROR);
1689                 }
1690
1691                 a->result = DCERPC_BIND_ACK_RESULT_PROVIDER_REJECTION;
1692                 a->reason.value = DCERPC_BIND_ACK_REASON_ABSTRACT_SYNTAX_NOT_SUPPORTED;
1693         }
1694
1695         /*
1696          * Try to negotiate one new presentation context.
1697          */
1698         status = dcesrv_negotiate_contexts(call, &call->pkt.u.alter, ack_ctx_list);
1699         if (NT_STATUS_EQUAL(status, NT_STATUS_RPC_PROTOCOL_ERROR)) {
1700                 return dcesrv_fault_disconnect(call, DCERPC_NCA_S_PROTO_ERROR);
1701         }
1702         if (!NT_STATUS_IS_OK(status)) {
1703                 return status;
1704         }
1705
1706         if ((call->pkt.pfc_flags & DCERPC_PFC_FLAG_CONC_MPX) &&
1707             (call->state_flags & DCESRV_CALL_STATE_FLAG_MULTIPLEXED)) {
1708                 call->conn->state_flags |= DCESRV_CALL_STATE_FLAG_MULTIPLEXED;
1709                 extra_flags |= DCERPC_PFC_FLAG_CONC_MPX;
1710         }
1711
1712         if (call->state_flags & DCESRV_CALL_STATE_FLAG_PROCESS_PENDING_CALL) {
1713                 call->conn->state_flags |= DCESRV_CALL_STATE_FLAG_PROCESS_PENDING_CALL;
1714         }
1715
1716         /* handle any authentication that is being requested */
1717         if (!auth_ok) {
1718                 if (call->in_auth_info.auth_type != auth->auth_type) {
1719                         return dcesrv_fault_disconnect(call,
1720                                         DCERPC_FAULT_SEC_PKG_ERROR);
1721                 }
1722                 return dcesrv_fault_disconnect(call, DCERPC_FAULT_ACCESS_DENIED);
1723         }
1724
1725         dcesrv_init_hdr(pkt, lpcfg_rpc_big_endian(call->conn->dce_ctx->lp_ctx));
1726         pkt->auth_length = 0;
1727         pkt->call_id = call->pkt.call_id;
1728         pkt->ptype = DCERPC_PKT_ALTER_RESP;
1729         pkt->pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST | extra_flags;
1730         pkt->u.alter_resp.max_xmit_frag = call->conn->max_xmit_frag;
1731         pkt->u.alter_resp.max_recv_frag = call->conn->max_recv_frag;
1732         pkt->u.alter_resp.assoc_group_id = call->conn->assoc_group->id;
1733         pkt->u.alter_resp.secondary_address = "";
1734         pkt->u.alter_resp.num_results = call->pkt.u.alter.num_contexts;
1735         pkt->u.alter_resp.ctx_list = ack_ctx_list;
1736         pkt->u.alter_resp.auth_info = data_blob_null;
1737
1738         status = dcesrv_auth_prepare_alter_ack(call, pkt);
1739         if (!NT_STATUS_IS_OK(status)) {
1740                 return dcesrv_fault_disconnect(call, DCERPC_FAULT_SEC_PKG_ERROR);
1741         }
1742
1743         if (auth->auth_finished) {
1744                 return dcesrv_auth_reply(call);
1745         }
1746
1747         subreq = gensec_update_send(call, call->event_ctx,
1748                                     auth->gensec_security,
1749                                     call->in_auth_info.credentials);
1750         if (subreq == NULL) {
1751                 return NT_STATUS_NO_MEMORY;
1752         }
1753         tevent_req_set_callback(subreq, dcesrv_alter_done, call);
1754
1755         return dcesrv_conn_auth_wait_setup(conn);
1756 }
1757
1758 static void dcesrv_alter_done(struct tevent_req *subreq)
1759 {
1760         struct dcesrv_call_state *call =
1761                 tevent_req_callback_data(subreq,
1762                 struct dcesrv_call_state);
1763         struct dcesrv_connection *conn = call->conn;
1764         NTSTATUS status;
1765
1766         status = gensec_update_recv(subreq, call,
1767                                     &call->out_auth_info->credentials);
1768         TALLOC_FREE(subreq);
1769
1770         status = dcesrv_auth_complete(call, status);
1771         if (!NT_STATUS_IS_OK(status)) {
1772                 status = dcesrv_fault_disconnect(call, DCERPC_FAULT_SEC_PKG_ERROR);
1773                 dcesrv_conn_auth_wait_finished(conn, status);
1774                 return;
1775         }
1776
1777         status = dcesrv_auth_reply(call);
1778         dcesrv_conn_auth_wait_finished(conn, status);
1779         return;
1780 }
1781
1782 /*
1783   possibly save the call for inspection with ndrdump
1784  */
1785 static void dcesrv_save_call(struct dcesrv_call_state *call, const char *why)
1786 {
1787 #ifdef DEVELOPER
1788         char *fname;
1789         const char *dump_dir;
1790         dump_dir = lpcfg_parm_string(call->conn->dce_ctx->lp_ctx, NULL, "dcesrv", "stubs directory");
1791         if (!dump_dir) {
1792                 return;
1793         }
1794         fname = talloc_asprintf(call, "%s/RPC-%s-%u-%s.dat",
1795                                 dump_dir,
1796                                 call->context->iface->name,
1797                                 call->pkt.u.request.opnum,
1798                                 why);
1799         if (file_save(fname, call->pkt.u.request.stub_and_verifier.data, call->pkt.u.request.stub_and_verifier.length)) {
1800                 DEBUG(0,("RPC SAVED %s\n", fname));
1801         }
1802         talloc_free(fname);
1803 #endif
1804 }
1805
1806 static NTSTATUS dcesrv_check_verification_trailer(struct dcesrv_call_state *call)
1807 {
1808         TALLOC_CTX *frame = talloc_stackframe();
1809         const struct dcesrv_auth *auth = call->auth_state;
1810         const uint32_t bitmask1 = auth->client_hdr_signing ?
1811                 DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING : 0;
1812         const struct dcerpc_sec_vt_pcontext pcontext = {
1813                 .abstract_syntax = call->context->iface->syntax_id,
1814                 .transfer_syntax = call->context->transfer_syntax,
1815         };
1816         const struct dcerpc_sec_vt_header2 header2 =
1817                 dcerpc_sec_vt_header2_from_ncacn_packet(&call->pkt);
1818         enum ndr_err_code ndr_err;
1819         struct dcerpc_sec_verification_trailer *vt = NULL;
1820         NTSTATUS status = NT_STATUS_OK;
1821         bool ok;
1822
1823         SMB_ASSERT(call->pkt.ptype == DCERPC_PKT_REQUEST);
1824
1825         ndr_err = ndr_pop_dcerpc_sec_verification_trailer(call->ndr_pull,
1826                                                           frame, &vt);
1827         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1828                 status = ndr_map_error2ntstatus(ndr_err);
1829                 goto done;
1830         }
1831
1832         ok = dcerpc_sec_verification_trailer_check(vt, &bitmask1,
1833                                                    &pcontext, &header2);
1834         if (!ok) {
1835                 status = NT_STATUS_ACCESS_DENIED;
1836                 goto done;
1837         }
1838 done:
1839         TALLOC_FREE(frame);
1840         return status;
1841 }
1842
1843 /*
1844   handle a dcerpc request packet
1845 */
1846 static NTSTATUS dcesrv_request(struct dcesrv_call_state *call)
1847 {
1848         const struct dcesrv_endpoint *endpoint = call->conn->endpoint;
1849         struct dcesrv_auth *auth = call->auth_state;
1850         enum dcerpc_transport_t transport =
1851                 dcerpc_binding_get_transport(endpoint->ep_description);
1852         struct ndr_pull *pull;
1853         NTSTATUS status;
1854
1855         if (!call->conn->allow_request) {
1856                 return dcesrv_fault_disconnect(call, DCERPC_NCA_S_PROTO_ERROR);
1857         }
1858
1859         /* if authenticated, and the mech we use can't do async replies, don't use them... */
1860         if (auth->gensec_security != NULL &&
1861             !gensec_have_feature(auth->gensec_security, GENSEC_FEATURE_ASYNC_REPLIES)) {
1862                 call->state_flags &= ~DCESRV_CALL_STATE_FLAG_MAY_ASYNC;
1863         }
1864
1865         if (call->context == NULL) {
1866                 return dcesrv_fault_with_flags(call, DCERPC_NCA_S_UNKNOWN_IF,
1867                                         DCERPC_PFC_FLAG_DID_NOT_EXECUTE);
1868         }
1869
1870         switch (auth->auth_level) {
1871         case DCERPC_AUTH_LEVEL_NONE:
1872         case DCERPC_AUTH_LEVEL_PACKET:
1873         case DCERPC_AUTH_LEVEL_INTEGRITY:
1874         case DCERPC_AUTH_LEVEL_PRIVACY:
1875                 break;
1876         default:
1877                 if (!call->context->allow_connect) {
1878                         char *addr;
1879
1880                         addr = tsocket_address_string(call->conn->remote_address,
1881                                                       call);
1882
1883                         DEBUG(2, ("%s: restrict auth_level_connect access "
1884                                   "to [%s] with auth[type=0x%x,level=0x%x] "
1885                                   "on [%s] from [%s]\n",
1886                                   __func__, call->context->iface->name,
1887                                   auth->auth_type,
1888                                   auth->auth_level,
1889                                   derpc_transport_string_by_transport(transport),
1890                                   addr));
1891                         return dcesrv_fault(call, DCERPC_FAULT_ACCESS_DENIED);
1892                 }
1893                 break;
1894         }
1895
1896         if (auth->auth_level < call->context->min_auth_level) {
1897                 char *addr;
1898
1899                 addr = tsocket_address_string(call->conn->remote_address, call);
1900
1901                 DEBUG(2, ("%s: restrict access by min_auth_level[0x%x] "
1902                           "to [%s] with auth[type=0x%x,level=0x%x] "
1903                           "on [%s] from [%s]\n",
1904                           __func__,
1905                           call->context->min_auth_level,
1906                           call->context->iface->name,
1907                           auth->auth_type,
1908                           auth->auth_level,
1909                           derpc_transport_string_by_transport(transport),
1910                           addr));
1911                 return dcesrv_fault(call, DCERPC_FAULT_ACCESS_DENIED);
1912         }
1913
1914         pull = ndr_pull_init_blob(&call->pkt.u.request.stub_and_verifier, call);
1915         NT_STATUS_HAVE_NO_MEMORY(pull);
1916
1917         pull->flags |= LIBNDR_FLAG_REF_ALLOC;
1918
1919         call->ndr_pull  = pull;
1920
1921         if (!(call->pkt.drep[0] & DCERPC_DREP_LE)) {
1922                 pull->flags |= LIBNDR_FLAG_BIGENDIAN;
1923         }
1924
1925         status = dcesrv_check_verification_trailer(call);
1926         if (!NT_STATUS_IS_OK(status)) {
1927                 uint32_t faultcode = DCERPC_FAULT_OTHER;
1928                 if (NT_STATUS_EQUAL(status, NT_STATUS_ACCESS_DENIED)) {
1929                         faultcode = DCERPC_FAULT_ACCESS_DENIED;
1930                 }
1931                 DEBUG(10, ("dcesrv_check_verification_trailer failed: %s\n",
1932                            nt_errstr(status)));
1933                 return dcesrv_fault(call, faultcode);
1934         }
1935
1936         /* unravel the NDR for the packet */
1937         status = call->context->iface->ndr_pull(call, call, pull, &call->r);
1938         if (!NT_STATUS_IS_OK(status)) {
1939                 uint8_t extra_flags = 0;
1940                 if (call->fault_code == DCERPC_FAULT_OP_RNG_ERROR) {
1941                         /* we got an unknown call */
1942                         DEBUG(3,(__location__ ": Unknown RPC call %u on %s\n",
1943                                  call->pkt.u.request.opnum,
1944                                  call->context->iface->name));
1945                         dcesrv_save_call(call, "unknown");
1946                         extra_flags |= DCERPC_PFC_FLAG_DID_NOT_EXECUTE;
1947                 } else {
1948                         dcesrv_save_call(call, "pullfail");
1949                 }
1950                 return dcesrv_fault_with_flags(call, call->fault_code, extra_flags);
1951         }
1952
1953         if (pull->offset != pull->data_size) {
1954                 dcesrv_save_call(call, "extrabytes");
1955                 DEBUG(3,("Warning: %d extra bytes in incoming RPC request\n",
1956                          pull->data_size - pull->offset));
1957         }
1958
1959         /* call the dispatch function */
1960         status = call->context->iface->dispatch(call, call, call->r);
1961         if (!NT_STATUS_IS_OK(status)) {
1962                 DEBUG(5,("dcerpc fault in call %s:%02x - %s\n",
1963                          call->context->iface->name,
1964                          call->pkt.u.request.opnum,
1965                          dcerpc_errstr(pull, call->fault_code)));
1966                 return dcesrv_fault(call, call->fault_code);
1967         }
1968
1969         /* add the call to the pending list */
1970         dcesrv_call_set_list(call, DCESRV_LIST_PENDING_CALL_LIST);
1971
1972         if (call->state_flags & DCESRV_CALL_STATE_FLAG_ASYNC) {
1973                 return NT_STATUS_OK;
1974         }
1975
1976         return dcesrv_reply(call);
1977 }
1978
1979
1980 /*
1981   remove the call from the right list when freed
1982  */
1983 static int dcesrv_call_dequeue(struct dcesrv_call_state *call)
1984 {
1985         dcesrv_call_set_list(call, DCESRV_LIST_NONE);
1986         return 0;
1987 }
1988
1989 _PUBLIC_ const struct tsocket_address *dcesrv_connection_get_local_address(struct dcesrv_connection *conn)
1990 {
1991         return conn->local_address;
1992 }
1993
1994 _PUBLIC_ const struct tsocket_address *dcesrv_connection_get_remote_address(struct dcesrv_connection *conn)
1995 {
1996         return conn->remote_address;
1997 }
1998
1999 /*
2000   process some input to a dcerpc endpoint server.
2001 */
2002 static NTSTATUS dcesrv_process_ncacn_packet(struct dcesrv_connection *dce_conn,
2003                                             struct ncacn_packet *pkt,
2004                                             DATA_BLOB blob)
2005 {
2006         NTSTATUS status;
2007         struct dcesrv_call_state *call;
2008         struct dcesrv_call_state *existing = NULL;
2009
2010         call = talloc_zero(dce_conn, struct dcesrv_call_state);
2011         if (!call) {
2012                 data_blob_free(&blob);
2013                 talloc_free(pkt);
2014                 return NT_STATUS_NO_MEMORY;
2015         }
2016         call->conn              = dce_conn;
2017         call->event_ctx         = dce_conn->event_ctx;
2018         call->msg_ctx           = dce_conn->msg_ctx;
2019         call->state_flags       = call->conn->state_flags;
2020         call->time              = timeval_current();
2021         call->list              = DCESRV_LIST_NONE;
2022
2023         talloc_steal(call, pkt);
2024         talloc_steal(call, blob.data);
2025         call->pkt = *pkt;
2026
2027         call->auth_state = dce_conn->default_auth_state;
2028
2029         talloc_set_destructor(call, dcesrv_call_dequeue);
2030
2031         if (call->conn->allow_bind) {
2032                 /*
2033                  * Only one bind is possible per connection
2034                  */
2035                 call->conn->allow_bind = false;
2036                 return dcesrv_bind(call);
2037         }
2038
2039         /* we have to check the signing here, before combining the
2040            pdus */
2041         if (call->pkt.ptype == DCERPC_PKT_REQUEST) {
2042                 if (!call->conn->allow_request) {
2043                         return dcesrv_fault_disconnect(call,
2044                                         DCERPC_NCA_S_PROTO_ERROR);
2045                 }
2046
2047                 status = dcerpc_verify_ncacn_packet_header(&call->pkt,
2048                                 DCERPC_PKT_REQUEST,
2049                                 call->pkt.u.request.stub_and_verifier.length,
2050                                 0, /* required_flags */
2051                                 DCERPC_PFC_FLAG_FIRST |
2052                                 DCERPC_PFC_FLAG_LAST |
2053                                 DCERPC_PFC_FLAG_PENDING_CANCEL |
2054                                 0x08 | /* this is not defined, but should be ignored */
2055                                 DCERPC_PFC_FLAG_CONC_MPX |
2056                                 DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
2057                                 DCERPC_PFC_FLAG_MAYBE |
2058                                 DCERPC_PFC_FLAG_OBJECT_UUID);
2059                 if (!NT_STATUS_IS_OK(status)) {
2060                         return dcesrv_fault_disconnect(call,
2061                                         DCERPC_NCA_S_PROTO_ERROR);
2062                 }
2063
2064                 if (call->pkt.frag_length > DCERPC_FRAG_MAX_SIZE) {
2065                         /*
2066                          * We don't use dcesrv_fault_disconnect()
2067                          * here, because we don't want to set
2068                          * DCERPC_PFC_FLAG_DID_NOT_EXECUTE
2069                          *
2070                          * Note that we don't check against the negotiated
2071                          * max_recv_frag, but a hard coded value.
2072                          */
2073                         dcesrv_call_disconnect_after(call,
2074                                 "dcesrv_auth_request - frag_length too large");
2075                         return dcesrv_fault(call,
2076                                         DCERPC_NCA_S_PROTO_ERROR);
2077                 }
2078
2079                 if (call->pkt.pfc_flags & DCERPC_PFC_FLAG_FIRST) {
2080                         if (dce_conn->pending_call_list != NULL) {
2081                                 /*
2082                                  * concurrent requests are only allowed
2083                                  * if DCERPC_PFC_FLAG_CONC_MPX was negotiated.
2084                                  */
2085                                 if (!(dce_conn->state_flags & DCESRV_CALL_STATE_FLAG_MULTIPLEXED)) {
2086                                         dcesrv_call_disconnect_after(call,
2087                                                 "dcesrv_auth_request - "
2088                                                 "existing pending call without CONN_MPX");
2089                                         return dcesrv_fault(call,
2090                                                 DCERPC_NCA_S_PROTO_ERROR);
2091                                 }
2092                         }
2093                         /* only one request is possible in the fragmented list */
2094                         if (dce_conn->incoming_fragmented_call_list != NULL) {
2095                                 if (!(dce_conn->state_flags & DCESRV_CALL_STATE_FLAG_MULTIPLEXED)) {
2096                                         /*
2097                                          * Without DCERPC_PFC_FLAG_CONC_MPX
2098                                          * we need to return the FAULT on the
2099                                          * already existing call.
2100                                          *
2101                                          * This is important to get the
2102                                          * call_id and context_id right.
2103                                          */
2104                                         TALLOC_FREE(call);
2105                                         call = dce_conn->incoming_fragmented_call_list;
2106                                 }
2107                                 dcesrv_call_disconnect_after(call,
2108                                         "dcesrv_auth_request - "
2109                                         "existing fragmented call");
2110                                 return dcesrv_fault(call,
2111                                                 DCERPC_NCA_S_PROTO_ERROR);
2112                         }
2113                         if (call->pkt.pfc_flags & DCERPC_PFC_FLAG_PENDING_CANCEL) {
2114                                 return dcesrv_fault_disconnect(call,
2115                                                 DCERPC_FAULT_NO_CALL_ACTIVE);
2116                         }
2117                         call->context = dcesrv_find_context(call->conn,
2118                                                 call->pkt.u.request.context_id);
2119                         if (call->context == NULL) {
2120                                 return dcesrv_fault_with_flags(call, DCERPC_NCA_S_UNKNOWN_IF,
2121                                         DCERPC_PFC_FLAG_DID_NOT_EXECUTE);
2122                         }
2123                 } else {
2124                         const struct dcerpc_request *nr = &call->pkt.u.request;
2125                         const struct dcerpc_request *er = NULL;
2126                         int cmp;
2127
2128                         existing = dcesrv_find_fragmented_call(dce_conn,
2129                                                         call->pkt.call_id);
2130                         if (existing == NULL) {
2131                                 dcesrv_call_disconnect_after(call,
2132                                         "dcesrv_auth_request - "
2133                                         "no existing fragmented call");
2134                                 return dcesrv_fault(call,
2135                                                 DCERPC_NCA_S_PROTO_ERROR);
2136                         }
2137                         er = &existing->pkt.u.request;
2138
2139                         if (call->pkt.ptype != existing->pkt.ptype) {
2140                                 /* trying to play silly buggers are we? */
2141                                 return dcesrv_fault_disconnect(existing,
2142                                                 DCERPC_NCA_S_PROTO_ERROR);
2143                         }
2144                         cmp = memcmp(call->pkt.drep, existing->pkt.drep,
2145                                      sizeof(pkt->drep));
2146                         if (cmp != 0) {
2147                                 return dcesrv_fault_disconnect(existing,
2148                                                 DCERPC_NCA_S_PROTO_ERROR);
2149                         }
2150                         if (nr->context_id != er->context_id)  {
2151                                 return dcesrv_fault_disconnect(existing,
2152                                                 DCERPC_NCA_S_PROTO_ERROR);
2153                         }
2154                         if (nr->opnum != er->opnum)  {
2155                                 return dcesrv_fault_disconnect(existing,
2156                                                 DCERPC_NCA_S_PROTO_ERROR);
2157                         }
2158                 }
2159         }
2160
2161         if (call->pkt.ptype == DCERPC_PKT_REQUEST) {
2162                 bool ok;
2163                 uint8_t payload_offset = DCERPC_REQUEST_LENGTH;
2164
2165                 if (call->pkt.pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
2166                         payload_offset += 16;
2167                 }
2168
2169                 ok = dcesrv_auth_pkt_pull(call, &blob,
2170                                           0, /* required_flags */
2171                                           DCERPC_PFC_FLAG_FIRST |
2172                                           DCERPC_PFC_FLAG_LAST |
2173                                           DCERPC_PFC_FLAG_PENDING_CANCEL |
2174                                           0x08 | /* this is not defined, but should be ignored */
2175                                           DCERPC_PFC_FLAG_CONC_MPX |
2176                                           DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
2177                                           DCERPC_PFC_FLAG_MAYBE |
2178                                           DCERPC_PFC_FLAG_OBJECT_UUID,
2179                                           payload_offset,
2180                                           &call->pkt.u.request.stub_and_verifier);
2181                 if (!ok) {
2182                         /*
2183                          * We don't use dcesrv_fault_disconnect()
2184                          * here, because we don't want to set
2185                          * DCERPC_PFC_FLAG_DID_NOT_EXECUTE
2186                          */
2187                         dcesrv_call_disconnect_after(call,
2188                                                 "dcesrv_auth_request - failed");
2189                         if (call->fault_code == 0) {
2190                                 call->fault_code = DCERPC_FAULT_ACCESS_DENIED;
2191                         }
2192                         return dcesrv_fault(call, call->fault_code);
2193                 }
2194         }
2195
2196         /* see if this is a continued packet */
2197         if (existing != NULL) {
2198                 struct dcerpc_request *er = &existing->pkt.u.request;
2199                 const struct dcerpc_request *nr = &call->pkt.u.request;
2200                 size_t available;
2201                 size_t alloc_size;
2202                 size_t alloc_hint;
2203
2204                 /*
2205                  * Up to 4 MByte are allowed by all fragments
2206                  */
2207                 available = dce_conn->max_total_request_size;
2208                 if (er->stub_and_verifier.length > available) {
2209                         dcesrv_call_disconnect_after(existing,
2210                                 "dcesrv_auth_request - existing payload too large");
2211                         return dcesrv_fault(existing, DCERPC_FAULT_ACCESS_DENIED);
2212                 }
2213                 available -= er->stub_and_verifier.length;
2214                 if (nr->alloc_hint > available) {
2215                         dcesrv_call_disconnect_after(existing,
2216                                 "dcesrv_auth_request - alloc hint too large");
2217                         return dcesrv_fault(existing, DCERPC_FAULT_ACCESS_DENIED);
2218                 }
2219                 if (nr->stub_and_verifier.length > available) {
2220                         dcesrv_call_disconnect_after(existing,
2221                                 "dcesrv_auth_request - new payload too large");
2222                         return dcesrv_fault(existing, DCERPC_FAULT_ACCESS_DENIED);
2223                 }
2224                 alloc_hint = er->stub_and_verifier.length + nr->alloc_hint;
2225                 /* allocate at least 1 byte */
2226                 alloc_hint = MAX(alloc_hint, 1);
2227                 alloc_size = er->stub_and_verifier.length +
2228                              nr->stub_and_verifier.length;
2229                 alloc_size = MAX(alloc_size, alloc_hint);
2230
2231                 er->stub_and_verifier.data =
2232                         talloc_realloc(existing,
2233                                        er->stub_and_verifier.data,
2234                                        uint8_t, alloc_size);
2235                 if (er->stub_and_verifier.data == NULL) {
2236                         TALLOC_FREE(call);
2237                         return dcesrv_fault_with_flags(existing,
2238                                                        DCERPC_FAULT_OUT_OF_RESOURCES,
2239                                                        DCERPC_PFC_FLAG_DID_NOT_EXECUTE);
2240                 }
2241                 memcpy(er->stub_and_verifier.data +
2242                        er->stub_and_verifier.length,
2243                        nr->stub_and_verifier.data,
2244                        nr->stub_and_verifier.length);
2245                 er->stub_and_verifier.length += nr->stub_and_verifier.length;
2246
2247                 existing->pkt.pfc_flags |= (call->pkt.pfc_flags & DCERPC_PFC_FLAG_LAST);
2248
2249                 TALLOC_FREE(call);
2250                 call = existing;
2251         }
2252
2253         /* this may not be the last pdu in the chain - if its isn't then
2254            just put it on the incoming_fragmented_call_list and wait for the rest */
2255         if (call->pkt.ptype == DCERPC_PKT_REQUEST &&
2256             !(call->pkt.pfc_flags & DCERPC_PFC_FLAG_LAST)) {
2257                 /*
2258                  * Up to 4 MByte are allowed by all fragments
2259                  */
2260                 if (call->pkt.u.request.alloc_hint > dce_conn->max_total_request_size) {
2261                         dcesrv_call_disconnect_after(call,
2262                                 "dcesrv_auth_request - initial alloc hint too large");
2263                         return dcesrv_fault(call, DCERPC_FAULT_ACCESS_DENIED);
2264                 }
2265                 dcesrv_call_set_list(call, DCESRV_LIST_FRAGMENTED_CALL_LIST);
2266                 return NT_STATUS_OK;
2267         }
2268
2269         /* This removes any fragments we may have had stashed away */
2270         dcesrv_call_set_list(call, DCESRV_LIST_NONE);
2271
2272         switch (call->pkt.ptype) {
2273         case DCERPC_PKT_BIND:
2274                 status = dcesrv_bind_nak(call,
2275                         DCERPC_BIND_NAK_REASON_NOT_SPECIFIED);
2276                 break;
2277         case DCERPC_PKT_AUTH3:
2278                 status = dcesrv_auth3(call);
2279                 break;
2280         case DCERPC_PKT_ALTER:
2281                 status = dcesrv_alter(call);
2282                 break;
2283         case DCERPC_PKT_REQUEST:
2284                 status = dcesrv_request(call);
2285                 break;
2286         case DCERPC_PKT_CO_CANCEL:
2287         case DCERPC_PKT_ORPHANED:
2288                 /*
2289                  * Window just ignores CO_CANCEL and ORPHANED,
2290                  * so we do...
2291                  */
2292                 status = NT_STATUS_OK;
2293                 TALLOC_FREE(call);
2294                 break;
2295         case DCERPC_PKT_BIND_ACK:
2296         case DCERPC_PKT_BIND_NAK:
2297         case DCERPC_PKT_ALTER_RESP:
2298         case DCERPC_PKT_RESPONSE:
2299         case DCERPC_PKT_FAULT:
2300         case DCERPC_PKT_SHUTDOWN:
2301         default:
2302                 status = dcesrv_fault_disconnect(call, DCERPC_NCA_S_PROTO_ERROR);
2303                 break;
2304         }
2305
2306         /* if we are going to be sending a reply then add
2307            it to the list of pending calls. We add it to the end to keep the call
2308            list in the order we will answer */
2309         if (!NT_STATUS_IS_OK(status)) {
2310                 talloc_free(call);
2311         }
2312
2313         return status;
2314 }
2315
2316 _PUBLIC_ NTSTATUS dcesrv_init_context(TALLOC_CTX *mem_ctx,
2317                                       struct loadparm_context *lp_ctx,
2318                                       const char **endpoint_servers, struct dcesrv_context **_dce_ctx)
2319 {
2320         NTSTATUS status;
2321         struct dcesrv_context *dce_ctx;
2322         int i;
2323
2324         if (!endpoint_servers) {
2325                 DEBUG(0,("dcesrv_init_context: no endpoint servers configured\n"));
2326                 return NT_STATUS_INTERNAL_ERROR;
2327         }
2328
2329         dce_ctx = talloc_zero(mem_ctx, struct dcesrv_context);
2330         NT_STATUS_HAVE_NO_MEMORY(dce_ctx);
2331
2332         if (uid_wrapper_enabled()) {
2333                 setenv("UID_WRAPPER_MYUID", "1", 1);
2334         }
2335         dce_ctx->initial_euid = geteuid();
2336         if (uid_wrapper_enabled()) {
2337                 unsetenv("UID_WRAPPER_MYUID");
2338         }
2339
2340         dce_ctx->endpoint_list  = NULL;
2341         dce_ctx->lp_ctx = lp_ctx;
2342         dce_ctx->assoc_groups_idr = idr_init(dce_ctx);
2343         NT_STATUS_HAVE_NO_MEMORY(dce_ctx->assoc_groups_idr);
2344         dce_ctx->broken_connections = NULL;
2345
2346         for (i=0;endpoint_servers[i];i++) {
2347                 const struct dcesrv_endpoint_server *ep_server;
2348
2349                 ep_server = dcesrv_ep_server_byname(endpoint_servers[i]);
2350                 if (!ep_server) {
2351                         DEBUG(0,("dcesrv_init_context: failed to find endpoint server = '%s'\n", endpoint_servers[i]));
2352                         return NT_STATUS_INTERNAL_ERROR;
2353                 }
2354
2355                 status = ep_server->init_server(dce_ctx, ep_server);
2356                 if (!NT_STATUS_IS_OK(status)) {
2357                         DEBUG(0,("dcesrv_init_context: failed to init endpoint server = '%s': %s\n", endpoint_servers[i],
2358                                 nt_errstr(status)));
2359                         return status;
2360                 }
2361         }
2362
2363         *_dce_ctx = dce_ctx;
2364         return NT_STATUS_OK;
2365 }
2366
2367 /* the list of currently registered DCERPC endpoint servers.
2368  */
2369 static struct ep_server {
2370         struct dcesrv_endpoint_server *ep_server;
2371 } *ep_servers = NULL;
2372 static int num_ep_servers;
2373
2374 /*
2375   register a DCERPC endpoint server.
2376
2377   The 'name' can be later used by other backends to find the operations
2378   structure for this backend.
2379
2380 */
2381 _PUBLIC_ NTSTATUS dcerpc_register_ep_server(const struct dcesrv_endpoint_server *ep_server)
2382 {
2383
2384         if (dcesrv_ep_server_byname(ep_server->name) != NULL) {
2385                 /* its already registered! */
2386                 DEBUG(0,("DCERPC endpoint server '%s' already registered\n",
2387                          ep_server->name));
2388                 return NT_STATUS_OBJECT_NAME_COLLISION;
2389         }
2390
2391         ep_servers = realloc_p(ep_servers, struct ep_server, num_ep_servers+1);
2392         if (!ep_servers) {
2393                 smb_panic("out of memory in dcerpc_register");
2394         }
2395
2396         ep_servers[num_ep_servers].ep_server = smb_xmemdup(ep_server, sizeof(*ep_server));
2397         ep_servers[num_ep_servers].ep_server->name = smb_xstrdup(ep_server->name);
2398
2399         num_ep_servers++;
2400
2401         DEBUG(3,("DCERPC endpoint server '%s' registered\n",
2402                  ep_server->name));
2403
2404         return NT_STATUS_OK;
2405 }
2406
2407 /*
2408   return the operations structure for a named backend of the specified type
2409 */
2410 const struct dcesrv_endpoint_server *dcesrv_ep_server_byname(const char *name)
2411 {
2412         int i;
2413
2414         for (i=0;i<num_ep_servers;i++) {
2415                 if (strcmp(ep_servers[i].ep_server->name, name) == 0) {
2416                         return ep_servers[i].ep_server;
2417                 }
2418         }
2419
2420         return NULL;
2421 }
2422
2423 void dcerpc_server_init(struct loadparm_context *lp_ctx)
2424 {
2425         static bool initialized;
2426 #define _MODULE_PROTO(init) extern NTSTATUS init(TALLOC_CTX *);
2427         STATIC_dcerpc_server_MODULES_PROTO;
2428         init_module_fn static_init[] = { STATIC_dcerpc_server_MODULES };
2429         init_module_fn *shared_init;
2430
2431         if (initialized) {
2432                 return;
2433         }
2434         initialized = true;
2435
2436         shared_init = load_samba_modules(NULL, "dcerpc_server");
2437
2438         run_init_functions(NULL, static_init);
2439         run_init_functions(NULL, shared_init);
2440
2441         talloc_free(shared_init);
2442 }
2443
2444 /*
2445   return the DCERPC module version, and the size of some critical types
2446   This can be used by endpoint server modules to either detect compilation errors, or provide
2447   multiple implementations for different smbd compilation options in one module
2448 */
2449 const struct dcesrv_critical_sizes *dcerpc_module_version(void)
2450 {
2451         static const struct dcesrv_critical_sizes critical_sizes = {
2452                 DCERPC_MODULE_VERSION,
2453                 sizeof(struct dcesrv_context),
2454                 sizeof(struct dcesrv_endpoint),
2455                 sizeof(struct dcesrv_endpoint_server),
2456                 sizeof(struct dcesrv_interface),
2457                 sizeof(struct dcesrv_if_list),
2458                 sizeof(struct dcesrv_connection),
2459                 sizeof(struct dcesrv_call_state),
2460                 sizeof(struct dcesrv_auth),
2461                 sizeof(struct dcesrv_handle)
2462         };
2463
2464         return &critical_sizes;
2465 }
2466
2467 static void dcesrv_terminate_connection(struct dcesrv_connection *dce_conn, const char *reason)
2468 {
2469         struct dcesrv_context *dce_ctx = dce_conn->dce_ctx;
2470         struct stream_connection *srv_conn;
2471         srv_conn = talloc_get_type(dce_conn->transport.private_data,
2472                                    struct stream_connection);
2473
2474         dce_conn->wait_send = NULL;
2475         dce_conn->wait_recv = NULL;
2476         dce_conn->wait_private = NULL;
2477
2478         dce_conn->allow_bind = false;
2479         dce_conn->allow_auth3 = false;
2480         dce_conn->allow_alter = false;
2481         dce_conn->allow_request = false;
2482
2483         dce_conn->default_auth_state->auth_invalid = true;
2484
2485         if (dce_conn->pending_call_list == NULL) {
2486                 char *full_reason = talloc_asprintf(dce_conn, "dcesrv: %s", reason);
2487
2488                 DLIST_REMOVE(dce_ctx->broken_connections, dce_conn);
2489                 stream_terminate_connection(srv_conn, full_reason ? full_reason : reason);
2490                 return;
2491         }
2492
2493         if (dce_conn->terminate != NULL) {
2494                 return;
2495         }
2496
2497         DEBUG(3,("dcesrv: terminating connection due to '%s' deferred due to pending calls\n",
2498                  reason));
2499         dce_conn->terminate = talloc_strdup(dce_conn, reason);
2500         if (dce_conn->terminate == NULL) {
2501                 dce_conn->terminate = "dcesrv: deferred terminating connection - no memory";
2502         }
2503         DLIST_ADD_END(dce_ctx->broken_connections, dce_conn);
2504 }
2505
2506 static void dcesrv_cleanup_broken_connections(struct dcesrv_context *dce_ctx)
2507 {
2508         struct dcesrv_connection *cur, *next;
2509
2510         next = dce_ctx->broken_connections;
2511         while (next != NULL) {
2512                 cur = next;
2513                 next = cur->next;
2514
2515                 if (cur->state_flags & DCESRV_CALL_STATE_FLAG_PROCESS_PENDING_CALL) {
2516                         struct dcesrv_connection_context *context_cur, *context_next;
2517
2518                         context_next = cur->contexts;
2519                         while (context_next != NULL) {
2520                                 context_cur = context_next;
2521                                 context_next = context_cur->next;
2522
2523                                 dcesrv_connection_context_destructor(context_cur);
2524                         }
2525                 }
2526
2527                 dcesrv_terminate_connection(cur, cur->terminate);
2528         }
2529 }
2530
2531 /* We need this include to be able to compile on some plateforms
2532  * (ie. freebsd 7.2) as it seems that <sys/uio.h> is not included
2533  * correctly.
2534  * It has to be that deep because otherwise we have a conflict on
2535  * const struct dcesrv_interface declaration.
2536  * This is mostly due to socket_wrapper defining #define bind swrap_bind
2537  * which conflict with the bind used before.
2538  */
2539 #include "system/network.h"
2540
2541 struct dcesrv_sock_reply_state {
2542         struct dcesrv_connection *dce_conn;
2543         struct dcesrv_call_state *call;
2544         struct iovec iov;
2545 };
2546
2547 static void dcesrv_sock_reply_done(struct tevent_req *subreq);
2548 static void dcesrv_call_terminate_step1(struct tevent_req *subreq);
2549
2550 static void dcesrv_sock_report_output_data(struct dcesrv_connection *dce_conn)
2551 {
2552         struct dcesrv_call_state *call;
2553
2554         call = dce_conn->call_list;
2555         if (!call || !call->replies) {
2556                 return;
2557         }
2558
2559         while (call->replies) {
2560                 struct data_blob_list_item *rep = call->replies;
2561                 struct dcesrv_sock_reply_state *substate;
2562                 struct tevent_req *subreq;
2563
2564                 substate = talloc_zero(call, struct dcesrv_sock_reply_state);
2565                 if (!substate) {
2566                         dcesrv_terminate_connection(dce_conn, "no memory");
2567                         return;
2568                 }
2569
2570                 substate->dce_conn = dce_conn;
2571                 substate->call = NULL;
2572
2573                 DLIST_REMOVE(call->replies, rep);
2574
2575                 if (call->replies == NULL && call->terminate_reason == NULL) {
2576                         substate->call = call;
2577                 }
2578
2579                 substate->iov.iov_base = (void *) rep->blob.data;
2580                 substate->iov.iov_len = rep->blob.length;
2581
2582                 subreq = tstream_writev_queue_send(substate,
2583                                                    dce_conn->event_ctx,
2584                                                    dce_conn->stream,
2585                                                    dce_conn->send_queue,
2586                                                    &substate->iov, 1);
2587                 if (!subreq) {
2588                         dcesrv_terminate_connection(dce_conn, "no memory");
2589                         return;
2590                 }
2591                 tevent_req_set_callback(subreq, dcesrv_sock_reply_done,
2592                                         substate);
2593         }
2594
2595         if (call->terminate_reason != NULL) {
2596                 struct tevent_req *subreq;
2597
2598                 subreq = tevent_queue_wait_send(call,
2599                                                 dce_conn->event_ctx,
2600                                                 dce_conn->send_queue);
2601                 if (!subreq) {
2602                         dcesrv_terminate_connection(dce_conn, __location__);
2603                         return;
2604                 }
2605                 tevent_req_set_callback(subreq, dcesrv_call_terminate_step1,
2606                                         call);
2607         }
2608
2609         DLIST_REMOVE(call->conn->call_list, call);
2610         call->list = DCESRV_LIST_NONE;
2611 }
2612
2613 static void dcesrv_sock_reply_done(struct tevent_req *subreq)
2614 {
2615         struct dcesrv_sock_reply_state *substate = tevent_req_callback_data(subreq,
2616                                                 struct dcesrv_sock_reply_state);
2617         int ret;
2618         int sys_errno;
2619         NTSTATUS status;
2620         struct dcesrv_call_state *call = substate->call;
2621
2622         ret = tstream_writev_queue_recv(subreq, &sys_errno);
2623         TALLOC_FREE(subreq);
2624         if (ret == -1) {
2625                 status = map_nt_error_from_unix_common(sys_errno);
2626                 dcesrv_terminate_connection(substate->dce_conn, nt_errstr(status));
2627                 return;
2628         }
2629
2630         talloc_free(substate);
2631         if (call) {
2632                 talloc_free(call);
2633         }
2634 }
2635
2636 static void dcesrv_call_terminate_step2(struct tevent_req *subreq);
2637
2638 static void dcesrv_call_terminate_step1(struct tevent_req *subreq)
2639 {
2640         struct dcesrv_call_state *call = tevent_req_callback_data(subreq,
2641                                                 struct dcesrv_call_state);
2642         bool ok;
2643         struct timeval tv;
2644
2645         /* make sure we stop send queue before removing subreq */
2646         tevent_queue_stop(call->conn->send_queue);
2647
2648         ok = tevent_queue_wait_recv(subreq);
2649         TALLOC_FREE(subreq);
2650         if (!ok) {
2651                 dcesrv_terminate_connection(call->conn, __location__);
2652                 return;
2653         }
2654
2655         /* disconnect after 200 usecs */
2656         tv = timeval_current_ofs_usec(200);
2657         subreq = tevent_wakeup_send(call, call->conn->event_ctx, tv);
2658         if (subreq == NULL) {
2659                 dcesrv_terminate_connection(call->conn, __location__);
2660                 return;
2661         }
2662         tevent_req_set_callback(subreq, dcesrv_call_terminate_step2,
2663                                 call);
2664 }
2665
2666 static void dcesrv_call_terminate_step2(struct tevent_req *subreq)
2667 {
2668         struct dcesrv_call_state *call = tevent_req_callback_data(subreq,
2669                                                 struct dcesrv_call_state);
2670         bool ok;
2671
2672         ok = tevent_wakeup_recv(subreq);
2673         TALLOC_FREE(subreq);
2674         if (!ok) {
2675                 dcesrv_terminate_connection(call->conn, __location__);
2676                 return;
2677         }
2678
2679         dcesrv_terminate_connection(call->conn, call->terminate_reason);
2680 }
2681
2682 struct dcesrv_socket_context {
2683         const struct dcesrv_endpoint *endpoint;
2684         struct dcesrv_context *dcesrv_ctx;
2685 };
2686
2687
2688 static void dcesrv_read_fragment_done(struct tevent_req *subreq);
2689
2690 static void dcesrv_sock_accept(struct stream_connection *srv_conn)
2691 {
2692         NTSTATUS status;
2693         struct dcesrv_socket_context *dcesrv_sock =
2694                 talloc_get_type(srv_conn->private_data, struct dcesrv_socket_context);
2695         enum dcerpc_transport_t transport =
2696                 dcerpc_binding_get_transport(dcesrv_sock->endpoint->ep_description);
2697         struct dcesrv_connection *dcesrv_conn = NULL;
2698         int ret;
2699         struct tevent_req *subreq;
2700         struct loadparm_context *lp_ctx = dcesrv_sock->dcesrv_ctx->lp_ctx;
2701
2702         dcesrv_cleanup_broken_connections(dcesrv_sock->dcesrv_ctx);
2703
2704         if (!srv_conn->session_info) {
2705                 status = auth_anonymous_session_info(srv_conn,
2706                                                      lp_ctx,
2707                                                      &srv_conn->session_info);
2708                 if (!NT_STATUS_IS_OK(status)) {
2709                         DEBUG(0,("dcesrv_sock_accept: auth_anonymous_session_info failed: %s\n",
2710                                 nt_errstr(status)));
2711                         stream_terminate_connection(srv_conn, nt_errstr(status));
2712                         return;
2713                 }
2714         }
2715
2716         /*
2717          * This fills in dcesrv_conn->endpoint with the endpoint
2718          * associated with the socket.  From this point on we know
2719          * which (group of) services we are handling, but not the
2720          * specific interface.
2721          */
2722
2723         status = dcesrv_endpoint_connect(dcesrv_sock->dcesrv_ctx,
2724                                          srv_conn,
2725                                          dcesrv_sock->endpoint,
2726                                          srv_conn->session_info,
2727                                          srv_conn->event.ctx,
2728                                          srv_conn->msg_ctx,
2729                                          srv_conn->server_id,
2730                                          DCESRV_CALL_STATE_FLAG_MAY_ASYNC,
2731                                          &dcesrv_conn);
2732         if (!NT_STATUS_IS_OK(status)) {
2733                 DEBUG(0,("dcesrv_sock_accept: dcesrv_endpoint_connect failed: %s\n",
2734                         nt_errstr(status)));
2735                 stream_terminate_connection(srv_conn, nt_errstr(status));
2736                 return;
2737         }
2738
2739         dcesrv_conn->transport.private_data             = srv_conn;
2740         dcesrv_conn->transport.report_output_data       = dcesrv_sock_report_output_data;
2741
2742         TALLOC_FREE(srv_conn->event.fde);
2743
2744         dcesrv_conn->send_queue = tevent_queue_create(dcesrv_conn, "dcesrv send queue");
2745         if (!dcesrv_conn->send_queue) {
2746                 status = NT_STATUS_NO_MEMORY;
2747                 DEBUG(0,("dcesrv_sock_accept: tevent_queue_create(%s)\n",
2748                         nt_errstr(status)));
2749                 stream_terminate_connection(srv_conn, nt_errstr(status));
2750                 return;
2751         }
2752
2753         if (transport == NCACN_NP) {
2754                 dcesrv_conn->stream = talloc_move(dcesrv_conn,
2755                                                   &srv_conn->tstream);
2756         } else {
2757                 ret = tstream_bsd_existing_socket(dcesrv_conn,
2758                                                   socket_get_fd(srv_conn->socket),
2759                                                   &dcesrv_conn->stream);
2760                 if (ret == -1) {
2761                         status = map_nt_error_from_unix_common(errno);
2762                         DEBUG(0, ("dcesrv_sock_accept: "
2763                                   "failed to setup tstream: %s\n",
2764                                   nt_errstr(status)));
2765                         stream_terminate_connection(srv_conn, nt_errstr(status));
2766                         return;
2767                 }
2768                 socket_set_flags(srv_conn->socket, SOCKET_FLAG_NOCLOSE);
2769         }
2770
2771         dcesrv_conn->local_address = srv_conn->local_address;
2772         dcesrv_conn->remote_address = srv_conn->remote_address;
2773
2774         if (transport == NCALRPC) {
2775                 uid_t uid;
2776                 gid_t gid;
2777                 int sock_fd;
2778
2779                 sock_fd = socket_get_fd(srv_conn->socket);
2780                 if (sock_fd == -1) {
2781                         stream_terminate_connection(
2782                                 srv_conn, "socket_get_fd failed\n");
2783                         return;
2784                 }
2785
2786                 ret = getpeereid(sock_fd, &uid, &gid);
2787                 if (ret == -1) {
2788                         status = map_nt_error_from_unix_common(errno);
2789                         DEBUG(0, ("dcesrv_sock_accept: "
2790                                   "getpeereid() failed for NCALRPC: %s\n",
2791                                   nt_errstr(status)));
2792                         stream_terminate_connection(srv_conn, nt_errstr(status));
2793                         return;
2794                 }
2795                 if (uid == dcesrv_conn->dce_ctx->initial_euid) {
2796                         struct tsocket_address *r = NULL;
2797
2798                         ret = tsocket_address_unix_from_path(dcesrv_conn,
2799                                                              AS_SYSTEM_MAGIC_PATH_TOKEN,
2800                                                              &r);
2801                         if (ret == -1) {
2802                                 status = map_nt_error_from_unix_common(errno);
2803                                 DEBUG(0, ("dcesrv_sock_accept: "
2804                                           "tsocket_address_unix_from_path() failed for NCALRPC: %s\n",
2805                                           nt_errstr(status)));
2806                                 stream_terminate_connection(srv_conn, nt_errstr(status));
2807                                 return;
2808                         }
2809                         dcesrv_conn->remote_address = r;
2810                 }
2811         }
2812
2813         srv_conn->private_data = dcesrv_conn;
2814
2815         subreq = dcerpc_read_ncacn_packet_send(dcesrv_conn,
2816                                                dcesrv_conn->event_ctx,
2817                                                dcesrv_conn->stream);
2818         if (!subreq) {
2819                 status = NT_STATUS_NO_MEMORY;
2820                 DEBUG(0,("dcesrv_sock_accept: dcerpc_read_fragment_buffer_send(%s)\n",
2821                         nt_errstr(status)));
2822                 stream_terminate_connection(srv_conn, nt_errstr(status));
2823                 return;
2824         }
2825         tevent_req_set_callback(subreq, dcesrv_read_fragment_done, dcesrv_conn);
2826
2827         return;
2828 }
2829
2830 static void dcesrv_conn_wait_done(struct tevent_req *subreq);
2831
2832 static void dcesrv_read_fragment_done(struct tevent_req *subreq)
2833 {
2834         struct dcesrv_connection *dce_conn = tevent_req_callback_data(subreq,
2835                                              struct dcesrv_connection);
2836         struct dcesrv_context *dce_ctx = dce_conn->dce_ctx;
2837         struct ncacn_packet *pkt;
2838         DATA_BLOB buffer;
2839         NTSTATUS status;
2840
2841         if (dce_conn->terminate) {
2842                 /*
2843                  * if the current connection is broken
2844                  * we need to clean it up before any other connection
2845                  */
2846                 dcesrv_terminate_connection(dce_conn, dce_conn->terminate);
2847                 dcesrv_cleanup_broken_connections(dce_ctx);
2848                 return;
2849         }
2850
2851         dcesrv_cleanup_broken_connections(dce_ctx);
2852
2853         status = dcerpc_read_ncacn_packet_recv(subreq, dce_conn,
2854                                                &pkt, &buffer);
2855         TALLOC_FREE(subreq);
2856         if (!NT_STATUS_IS_OK(status)) {
2857                 dcesrv_terminate_connection(dce_conn, nt_errstr(status));
2858                 return;
2859         }
2860
2861         status = dcesrv_process_ncacn_packet(dce_conn, pkt, buffer);
2862         if (!NT_STATUS_IS_OK(status)) {
2863                 dcesrv_terminate_connection(dce_conn, nt_errstr(status));
2864                 return;
2865         }
2866
2867         /*
2868          * This is used to block the connection during
2869          * pending authentication.
2870          */
2871         if (dce_conn->wait_send != NULL) {
2872                 subreq = dce_conn->wait_send(dce_conn,
2873                                              dce_conn->event_ctx,
2874                                              dce_conn->wait_private);
2875                 if (!subreq) {
2876                         status = NT_STATUS_NO_MEMORY;
2877                         dcesrv_terminate_connection(dce_conn, nt_errstr(status));
2878                         return;
2879                 }
2880                 tevent_req_set_callback(subreq, dcesrv_conn_wait_done, dce_conn);
2881                 return;
2882         }
2883
2884         subreq = dcerpc_read_ncacn_packet_send(dce_conn,
2885                                                dce_conn->event_ctx,
2886                                                dce_conn->stream);
2887         if (!subreq) {
2888                 status = NT_STATUS_NO_MEMORY;
2889                 dcesrv_terminate_connection(dce_conn, nt_errstr(status));
2890                 return;
2891         }
2892         tevent_req_set_callback(subreq, dcesrv_read_fragment_done, dce_conn);
2893 }
2894
2895 static void dcesrv_conn_wait_done(struct tevent_req *subreq)
2896 {
2897         struct dcesrv_connection *dce_conn = tevent_req_callback_data(subreq,
2898                                              struct dcesrv_connection);
2899         struct dcesrv_context *dce_ctx = dce_conn->dce_ctx;
2900         NTSTATUS status;
2901
2902         if (dce_conn->terminate) {
2903                 /*
2904                  * if the current connection is broken
2905                  * we need to clean it up before any other connection
2906                  */
2907                 dcesrv_terminate_connection(dce_conn, dce_conn->terminate);
2908                 dcesrv_cleanup_broken_connections(dce_ctx);
2909                 return;
2910         }
2911
2912         dcesrv_cleanup_broken_connections(dce_ctx);
2913
2914         status = dce_conn->wait_recv(subreq);
2915         dce_conn->wait_send = NULL;
2916         dce_conn->wait_recv = NULL;
2917         dce_conn->wait_private = NULL;
2918         TALLOC_FREE(subreq);
2919         if (!NT_STATUS_IS_OK(status)) {
2920                 dcesrv_terminate_connection(dce_conn, nt_errstr(status));
2921                 return;
2922         }
2923
2924         subreq = dcerpc_read_ncacn_packet_send(dce_conn,
2925                                                dce_conn->event_ctx,
2926                                                dce_conn->stream);
2927         if (!subreq) {
2928                 status = NT_STATUS_NO_MEMORY;
2929                 dcesrv_terminate_connection(dce_conn, nt_errstr(status));
2930                 return;
2931         }
2932         tevent_req_set_callback(subreq, dcesrv_read_fragment_done, dce_conn);
2933 }
2934
2935 static void dcesrv_sock_recv(struct stream_connection *conn, uint16_t flags)
2936 {
2937         struct dcesrv_connection *dce_conn = talloc_get_type(conn->private_data,
2938                                              struct dcesrv_connection);
2939         dcesrv_terminate_connection(dce_conn, "dcesrv_sock_recv triggered");
2940 }
2941
2942 static void dcesrv_sock_send(struct stream_connection *conn, uint16_t flags)
2943 {
2944         struct dcesrv_connection *dce_conn = talloc_get_type(conn->private_data,
2945                                              struct dcesrv_connection);
2946         dcesrv_terminate_connection(dce_conn, "dcesrv_sock_send triggered");
2947 }
2948
2949
2950 static const struct stream_server_ops dcesrv_stream_ops = {
2951         .name                   = "rpc",
2952         .accept_connection      = dcesrv_sock_accept,
2953         .recv_handler           = dcesrv_sock_recv,
2954         .send_handler           = dcesrv_sock_send,
2955 };
2956
2957 static NTSTATUS dcesrv_add_ep_unix(struct dcesrv_context *dce_ctx,
2958                                    struct loadparm_context *lp_ctx,
2959                                    struct dcesrv_endpoint *e,
2960                                    struct tevent_context *event_ctx,
2961                                    const struct model_ops *model_ops,
2962                                    void *process_context)
2963 {
2964         struct dcesrv_socket_context *dcesrv_sock;
2965         uint16_t port = 1;
2966         NTSTATUS status;
2967         const char *endpoint;
2968
2969         dcesrv_sock = talloc_zero(event_ctx, struct dcesrv_socket_context);
2970         NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
2971
2972         /* remember the endpoint of this socket */
2973         dcesrv_sock->endpoint           = e;
2974         dcesrv_sock->dcesrv_ctx         = talloc_reference(dcesrv_sock, dce_ctx);
2975
2976         endpoint = dcerpc_binding_get_string_option(e->ep_description, "endpoint");
2977
2978         status = stream_setup_socket(dcesrv_sock, event_ctx, lp_ctx,
2979                                      model_ops, &dcesrv_stream_ops,
2980                                      "unix", endpoint, &port,
2981                                      lpcfg_socket_options(lp_ctx),
2982                                      dcesrv_sock, process_context);
2983         if (!NT_STATUS_IS_OK(status)) {
2984                 DEBUG(0,("service_setup_stream_socket(path=%s) failed - %s\n",
2985                          endpoint, nt_errstr(status)));
2986         }
2987
2988         return status;
2989 }
2990
2991 static NTSTATUS dcesrv_add_ep_ncalrpc(struct dcesrv_context *dce_ctx,
2992                                       struct loadparm_context *lp_ctx,
2993                                       struct dcesrv_endpoint *e,
2994                                       struct tevent_context *event_ctx,
2995                                       const struct model_ops *model_ops,
2996                                       void *process_context)
2997 {
2998         struct dcesrv_socket_context *dcesrv_sock;
2999         uint16_t port = 1;
3000         char *full_path;
3001         NTSTATUS status;
3002         const char *endpoint;
3003
3004         endpoint = dcerpc_binding_get_string_option(e->ep_description, "endpoint");
3005
3006         if (endpoint == NULL) {
3007                 /*
3008                  * No identifier specified: use DEFAULT.
3009                  *
3010                  * TODO: DO NOT hardcode this value anywhere else. Rather, specify
3011                  * no endpoint and let the epmapper worry about it.
3012                  */
3013                 endpoint = "DEFAULT";
3014                 status = dcerpc_binding_set_string_option(e->ep_description,
3015                                                           "endpoint",
3016                                                           endpoint);
3017                 if (!NT_STATUS_IS_OK(status)) {
3018                         DEBUG(0,("dcerpc_binding_set_string_option() failed - %s\n",
3019                                   nt_errstr(status)));
3020                         return status;
3021                 }
3022         }
3023
3024         full_path = talloc_asprintf(dce_ctx, "%s/%s", lpcfg_ncalrpc_dir(lp_ctx),
3025                                     endpoint);
3026
3027         dcesrv_sock = talloc_zero(event_ctx, struct dcesrv_socket_context);
3028         NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
3029
3030         /* remember the endpoint of this socket */
3031         dcesrv_sock->endpoint           = e;
3032         dcesrv_sock->dcesrv_ctx         = talloc_reference(dcesrv_sock, dce_ctx);
3033
3034         status = stream_setup_socket(dcesrv_sock, event_ctx, lp_ctx,
3035                                      model_ops, &dcesrv_stream_ops,
3036                                      "unix", full_path, &port,
3037                                      lpcfg_socket_options(lp_ctx),
3038                                      dcesrv_sock, process_context);
3039         if (!NT_STATUS_IS_OK(status)) {
3040                 DEBUG(0,("service_setup_stream_socket(identifier=%s,path=%s) failed - %s\n",
3041                          endpoint, full_path, nt_errstr(status)));
3042         }
3043         return status;
3044 }
3045
3046 static NTSTATUS dcesrv_add_ep_np(struct dcesrv_context *dce_ctx,
3047                                  struct loadparm_context *lp_ctx,
3048                                  struct dcesrv_endpoint *e,
3049                                  struct tevent_context *event_ctx,
3050                                  const struct model_ops *model_ops,
3051                                  void *process_context)
3052 {
3053         struct dcesrv_socket_context *dcesrv_sock;
3054         NTSTATUS status;
3055         const char *endpoint;
3056
3057         endpoint = dcerpc_binding_get_string_option(e->ep_description, "endpoint");
3058         if (endpoint == NULL) {
3059                 DEBUG(0, ("Endpoint mandatory for named pipes\n"));
3060                 return NT_STATUS_INVALID_PARAMETER;
3061         }
3062
3063         dcesrv_sock = talloc_zero(event_ctx, struct dcesrv_socket_context);
3064         NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
3065
3066         /* remember the endpoint of this socket */
3067         dcesrv_sock->endpoint           = e;
3068         dcesrv_sock->dcesrv_ctx         = talloc_reference(dcesrv_sock, dce_ctx);
3069
3070         status = tstream_setup_named_pipe(dce_ctx, event_ctx, lp_ctx,
3071                                           model_ops, &dcesrv_stream_ops,
3072                                           endpoint,
3073                                           dcesrv_sock, process_context);
3074         if (!NT_STATUS_IS_OK(status)) {
3075                 DEBUG(0,("stream_setup_named_pipe(pipe=%s) failed - %s\n",
3076                          endpoint, nt_errstr(status)));
3077                 return status;
3078         }
3079
3080         return NT_STATUS_OK;
3081 }
3082
3083 /*
3084   add a socket address to the list of events, one event per dcerpc endpoint
3085 */
3086 static NTSTATUS add_socket_rpc_tcp_iface(struct dcesrv_context *dce_ctx,
3087                                          struct dcesrv_endpoint *e,
3088                                          struct tevent_context *event_ctx,
3089                                          const struct model_ops *model_ops,
3090                                          const char *address,
3091                                          void *process_context)
3092 {
3093         struct dcesrv_socket_context *dcesrv_sock;
3094         uint16_t port = 0;
3095         NTSTATUS status;
3096         const char *endpoint;
3097         char port_str[6];
3098
3099         endpoint = dcerpc_binding_get_string_option(e->ep_description, "endpoint");
3100         if (endpoint != NULL) {
3101                 port = atoi(endpoint);
3102         }
3103
3104         dcesrv_sock = talloc_zero(event_ctx, struct dcesrv_socket_context);
3105         NT_STATUS_HAVE_NO_MEMORY(dcesrv_sock);
3106
3107         /* remember the endpoint of this socket */
3108         dcesrv_sock->endpoint           = e;
3109         dcesrv_sock->dcesrv_ctx         = talloc_reference(dcesrv_sock, dce_ctx);
3110
3111         status = stream_setup_socket(dcesrv_sock, event_ctx, dce_ctx->lp_ctx,
3112                                      model_ops, &dcesrv_stream_ops,
3113                                      "ip", address, &port,
3114                                      lpcfg_socket_options(dce_ctx->lp_ctx),
3115                                      dcesrv_sock, process_context);
3116         if (!NT_STATUS_IS_OK(status)) {
3117                 struct dcesrv_if_list *iface;
3118                 DEBUG(0,("service_setup_stream_socket(address=%s,port=%u) for ",
3119                          address, port));
3120                 for (iface = e->interface_list; iface; iface = iface->next) {
3121                         DEBUGADD(0, ("%s ", iface->iface.name));
3122                 }
3123                 DEBUGADD(0, ("failed - %s",
3124                              nt_errstr(status)));
3125                 return status;
3126         }
3127
3128         snprintf(port_str, sizeof(port_str), "%u", port);
3129
3130         status = dcerpc_binding_set_string_option(e->ep_description,
3131                                                   "endpoint", port_str);
3132         if (!NT_STATUS_IS_OK(status)) {
3133                 DEBUG(0,("dcerpc_binding_set_string_option(endpoint, %s) failed - %s\n",
3134                          port_str, nt_errstr(status)));
3135                 return status;
3136         } else {
3137                 struct dcesrv_if_list *iface;
3138                 DEBUG(4,("Successfully listening on ncacn_ip_tcp endpoint [%s]:[%s] for ",
3139                          address, port_str));
3140                 for (iface = e->interface_list; iface; iface = iface->next) {
3141                         DEBUGADD(4, ("%s ", iface->iface.name));
3142                 }
3143                 DEBUGADD(4, ("\n"));
3144         }
3145
3146         return NT_STATUS_OK;
3147 }
3148
3149 #include "lib/socket/netif.h" /* Included here to work around the fact that socket_wrapper redefines bind() */
3150
3151 static NTSTATUS dcesrv_add_ep_tcp(struct dcesrv_context *dce_ctx,
3152                                   struct loadparm_context *lp_ctx,
3153                                   struct dcesrv_endpoint *e,
3154                                   struct tevent_context *event_ctx,
3155                                   const struct model_ops *model_ops,
3156                                   void *process_context)
3157 {
3158         NTSTATUS status;
3159
3160         /* Add TCP/IP sockets */
3161         if (lpcfg_interfaces(lp_ctx) && lpcfg_bind_interfaces_only(lp_ctx)) {
3162                 int num_interfaces;
3163                 int i;
3164                 struct interface *ifaces;
3165
3166                 load_interface_list(dce_ctx, lp_ctx, &ifaces);
3167
3168                 num_interfaces = iface_list_count(ifaces);
3169                 for(i = 0; i < num_interfaces; i++) {
3170                         const char *address = iface_list_n_ip(ifaces, i);
3171                         status = add_socket_rpc_tcp_iface(dce_ctx, e, event_ctx,
3172                                                           model_ops, address,
3173                                                           process_context);
3174                         NT_STATUS_NOT_OK_RETURN(status);
3175                 }
3176         } else {
3177                 char **wcard;
3178                 size_t i;
3179                 size_t num_binds = 0;
3180                 wcard = iface_list_wildcard(dce_ctx);
3181                 NT_STATUS_HAVE_NO_MEMORY(wcard);
3182                 for (i=0; wcard[i]; i++) {
3183                         status = add_socket_rpc_tcp_iface(dce_ctx, e, event_ctx,
3184                                                           model_ops, wcard[i],
3185                                                           process_context);
3186                         if (NT_STATUS_IS_OK(status)) {
3187                                 num_binds++;
3188                         }
3189                 }
3190                 talloc_free(wcard);
3191                 if (num_binds == 0) {
3192                         return NT_STATUS_INVALID_PARAMETER_MIX;
3193                 }
3194         }
3195
3196         return NT_STATUS_OK;
3197 }
3198
3199 NTSTATUS dcesrv_add_ep(struct dcesrv_context *dce_ctx,
3200                        struct loadparm_context *lp_ctx,
3201                        struct dcesrv_endpoint *e,
3202                        struct tevent_context *event_ctx,
3203                        const struct model_ops *model_ops,
3204                        void *process_context)
3205 {
3206         enum dcerpc_transport_t transport =
3207                 dcerpc_binding_get_transport(e->ep_description);
3208
3209         switch (transport) {
3210         case NCACN_UNIX_STREAM:
3211                 return dcesrv_add_ep_unix(dce_ctx, lp_ctx, e, event_ctx,
3212                                           model_ops, process_context);
3213
3214         case NCALRPC:
3215                 return dcesrv_add_ep_ncalrpc(dce_ctx, lp_ctx, e, event_ctx,
3216                                              model_ops, process_context);
3217
3218         case NCACN_IP_TCP:
3219                 return dcesrv_add_ep_tcp(dce_ctx, lp_ctx, e, event_ctx,
3220                                          model_ops, process_context);
3221
3222         case NCACN_NP:
3223                 return dcesrv_add_ep_np(dce_ctx, lp_ctx, e, event_ctx,
3224                                         model_ops, process_context);
3225
3226         default:
3227                 return NT_STATUS_NOT_SUPPORTED;
3228         }
3229 }
3230
3231
3232 /**
3233  * retrieve credentials from a dce_call
3234  */
3235 _PUBLIC_ struct cli_credentials *dcesrv_call_credentials(struct dcesrv_call_state *dce_call)
3236 {
3237         struct dcesrv_auth *auth = dce_call->auth_state;
3238         return auth->session_info->credentials;
3239 }
3240
3241 /**
3242  * returns true if this is an authenticated call
3243  */
3244 _PUBLIC_ bool dcesrv_call_authenticated(struct dcesrv_call_state *dce_call)
3245 {
3246         struct dcesrv_auth *auth = dce_call->auth_state;
3247         enum security_user_level level;
3248         level = security_session_user_level(auth->session_info, NULL);
3249         return level >= SECURITY_USER;
3250 }
3251
3252 /**
3253  * retrieve account_name for a dce_call
3254  */
3255 _PUBLIC_ const char *dcesrv_call_account_name(struct dcesrv_call_state *dce_call)
3256 {
3257         struct dcesrv_auth *auth = dce_call->auth_state;
3258         return auth->session_info->info->account_name;
3259 }
3260
3261 /**
3262  * retrieve session_info from a dce_call
3263  */
3264 _PUBLIC_ struct auth_session_info *dcesrv_call_session_info(struct dcesrv_call_state *dce_call)
3265 {
3266         struct dcesrv_auth *auth = dce_call->auth_state;
3267         return auth->session_info;
3268 }
3269
3270 /**
3271  * retrieve auth type/level from a dce_call
3272  */
3273 _PUBLIC_ void dcesrv_call_auth_info(struct dcesrv_call_state *dce_call,
3274                                     enum dcerpc_AuthType *auth_type,
3275                                     enum dcerpc_AuthLevel *auth_level)
3276 {
3277         struct dcesrv_auth *auth = dce_call->auth_state;
3278
3279         if (auth_type != NULL) {
3280                 *auth_type = auth->auth_type;
3281         }
3282         if (auth_level != NULL) {
3283                 *auth_level = auth->auth_level;
3284         }
3285 }