source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "system/filesys.h"
  32 #include "srv_pipe_internal.h"
  33 #include "../librpc/gen_ndr/dcerpc.h"
  34 #include "../librpc/rpc/rpc_common.h"
  35 #include "dcesrv_auth_generic.h"
  36 #include "rpc_server.h"
  37 #include "rpc_dce.h"
  38 #include "smbd/smbd.h"
  39 #include "auth.h"
  40 #include "ntdomain.h"
  41 #include "rpc_server/srv_pipe.h"
  42 #include "rpc_server/rpc_contexts.h"
  43 #include "lib/param/param.h"
  44 #include "librpc/ndr/ndr_table.h"
  45 #include "auth/gensec/gensec.h"
  46 #include "librpc/ndr/ndr_dcerpc.h"
  47
  48 #undef DBGC_CLASS
  49 #define DBGC_CLASS DBGC_RPC_SRV
  50
  51 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p);
  52
  53 /**
  54  * Dump everything from the start of the end up of the provided data
  55  * into a file, but only at debug level >= 50
  56  **/
  57 static void dump_pdu_region(const char *name, int v,
  58                             DATA_BLOB *data, size_t start, size_t end)
  59 {
  60         int fd, i;
  61         char *fname = NULL;
  62         ssize_t sz;
  63
  64         if (DEBUGLEVEL < 50) return;
  65
  66         if (start > data->length || end > data->length || start > end) return;
  67
  68         for (i = 1; i < 100; i++) {
  69                 if (v != -1) {
  70                         fname = talloc_asprintf(talloc_tos(),
  71                                                 "/tmp/%s_%d.%d.prs",
  72                                                 name, v, i);
  73                 } else {
  74                         fname = talloc_asprintf(talloc_tos(),
  75                                                 "/tmp/%s_%d.prs",
  76                                                 name, i);
  77                 }
  78                 if (!fname) {
  79                         return;
  80                 }
  81                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  82                 if (fd != -1 || errno != EEXIST) break;
  83         }
  84         if (fd != -1) {
  85                 sz = write(fd, data->data + start, end - start);
  86                 i = close(fd);
  87                 if ((sz != end - start) || (i != 0) ) {
  88                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  89                                   fname, (unsigned long)sz,
  90                                   (unsigned long)end - start, i));
  91                 } else {
  92                         DEBUG(0,("created %s\n", fname));
  93                 }
  94         }
  95         TALLOC_FREE(fname);
  96 }
  97
  98 static DATA_BLOB generic_session_key(void)
  99 {
 100         return data_blob_const("SystemLibraryDTC", 16);
 101 }
 102
 103 /*******************************************************************
 104  Generate the next PDU to be returned from the data.
 105 ********************************************************************/
 106
 107 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
 108                                    struct pipe_auth_data *auth,
 109                                    uint32_t call_id,
 110                                    DATA_BLOB *rdata,
 111                                    size_t data_sent_length,
 112                                    DATA_BLOB *frag,
 113                                    size_t *pdu_size)
 114 {
 115         union dcerpc_payload u;
 116         uint8_t pfc_flags;
 117         size_t data_left;
 118         size_t data_to_send;
 119         size_t frag_len;
 120         size_t pad_len = 0;
 121         size_t auth_len = 0;
 122         NTSTATUS status;
 123
 124         ZERO_STRUCT(u.response);
 125
 126         /* Set up rpc packet pfc flags. */
 127         if (data_sent_length == 0) {
 128                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 129         } else {
 130                 pfc_flags = 0;
 131         }
 132
 133         /* Work out how much we can fit in a single PDU. */
 134         data_left = rdata->length - data_sent_length;
 135
 136         /* Ensure there really is data left to send. */
 137         if (!data_left) {
 138                 DEBUG(0, ("No data left to send !\n"));
 139                 return NT_STATUS_BUFFER_TOO_SMALL;
 140         }
 141
 142         status = dcerpc_guess_sizes(auth,
 143                                     DCERPC_RESPONSE_LENGTH,
 144                                     data_left,
 145                                     RPC_MAX_PDU_FRAG_LEN,
 146                                     SERVER_NDR_PADDING_SIZE,
 147                                     &data_to_send, &frag_len,
 148                                     &auth_len, &pad_len);
 149         if (!NT_STATUS_IS_OK(status)) {
 150                 return status;
 151         }
 152
 153         /* Set up the alloc hint. This should be the data left to send. */
 154         u.response.alloc_hint = data_left;
 155
 156         /* Work out if this PDU will be the last. */
 157         if (data_sent_length + data_to_send >= rdata->length) {
 158                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 159         }
 160
 161         /* Prepare data to be NDR encoded. */
 162         u.response.stub_and_verifier =
 163                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 164
 165         /* Store the packet in the data stream. */
 166         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 167                                           pfc_flags, auth_len, call_id,
 168                                           &u, frag);
 169         if (!NT_STATUS_IS_OK(status)) {
 170                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 171                 return status;
 172         }
 173
 174         if (auth_len) {
 175                 /* Set the proper length on the pdu, including padding.
 176                  * Only needed if an auth trailer will be appended. */
 177                 dcerpc_set_frag_length(frag, frag->length
 178                                                 + pad_len
 179                                                 + DCERPC_AUTH_TRAILER_LENGTH
 180                                                 + auth_len);
 181         }
 182
 183         if (auth_len) {
 184                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 185                 if (!NT_STATUS_IS_OK(status)) {
 186                         data_blob_free(frag);
 187                         return status;
 188                 }
 189         }
 190
 191         *pdu_size = data_to_send;
 192         return NT_STATUS_OK;
 193 }
 194
 195 /*******************************************************************
 196  Generate the next PDU to be returned from the data in p->rdata.
 197 ********************************************************************/
 198
 199 bool create_next_pdu(struct pipes_struct *p)
 200 {
 201         size_t pdu_size = 0;
 202         NTSTATUS status;
 203
 204         /*
 205          * If we're in the fault state, keep returning fault PDU's until
 206          * the pipe gets closed. JRA.
 207          */
 208         if (p->fault_state) {
 209                 setup_fault_pdu(p, NT_STATUS(p->fault_state));
 210                 return true;
 211         }
 212
 213         status = create_next_packet(p->mem_ctx, &p->auth,
 214                                     p->call_id, &p->out_data.rdata,
 215                                     p->out_data.data_sent_length,
 216                                     &p->out_data.frag, &pdu_size);
 217         if (!NT_STATUS_IS_OK(status)) {
 218                 DEBUG(0, ("Failed to create packet with error %s, "
 219                           "(auth level %u / type %u)\n",
 220                           nt_errstr(status),
 221                           (unsigned int)p->auth.auth_level,
 222                           (unsigned int)p->auth.auth_type));
 223                 return false;
 224         }
 225
 226         /* Setup the counts for this PDU. */
 227         p->out_data.data_sent_length += pdu_size;
 228         p->out_data.current_pdu_sent = 0;
 229         return true;
 230 }
 231
 232
 233 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 234
 235 /*******************************************************************
 236  Marshall a bind_nak pdu.
 237 *******************************************************************/
 238
 239 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 240 {
 241         NTSTATUS status;
 242         union dcerpc_payload u;
 243
 244         /* Free any memory in the current return data buffer. */
 245         pipe_init_outgoing_data(p);
 246
 247         /*
 248          * Initialize a bind_nak header.
 249          */
 250
 251         ZERO_STRUCT(u);
 252
 253         u.bind_nak.reject_reason  = 0;
 254
 255         /*
 256          * Marshall directly into the outgoing PDU space. We
 257          * must do this as we need to set to the bind response
 258          * header and are never sending more than one PDU here.
 259          */
 260
 261         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 262                                           DCERPC_PKT_BIND_NAK,
 263                                           DCERPC_PFC_FLAG_FIRST |
 264                                                 DCERPC_PFC_FLAG_LAST,
 265                                           0,
 266                                           pkt->call_id,
 267                                           &u,
 268                                           &p->out_data.frag);
 269         if (!NT_STATUS_IS_OK(status)) {
 270                 return False;
 271         }
 272
 273         p->out_data.data_sent_length = 0;
 274         p->out_data.current_pdu_sent = 0;
 275
 276         TALLOC_FREE(p->auth.auth_ctx);
 277         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 278         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 279         p->pipe_bound = False;
 280
 281         return True;
 282 }
 283
 284 /*******************************************************************
 285  Marshall a fault pdu.
 286 *******************************************************************/
 287
 288 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 289 {
 290         NTSTATUS status;
 291         union dcerpc_payload u;
 292
 293         /* Free any memory in the current return data buffer. */
 294         pipe_init_outgoing_data(p);
 295
 296         /*
 297          * Initialize a fault header.
 298          */
 299
 300         ZERO_STRUCT(u);
 301
 302         u.fault.status          = NT_STATUS_V(fault_status);
 303         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 304
 305         /*
 306          * Marshall directly into the outgoing PDU space. We
 307          * must do this as we need to set to the bind response
 308          * header and are never sending more than one PDU here.
 309          */
 310
 311         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 312                                           DCERPC_PKT_FAULT,
 313                                           DCERPC_PFC_FLAG_FIRST |
 314                                            DCERPC_PFC_FLAG_LAST |
 315                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 316                                           0,
 317                                           p->call_id,
 318                                           &u,
 319                                           &p->out_data.frag);
 320         if (!NT_STATUS_IS_OK(status)) {
 321                 return False;
 322         }
 323
 324         p->out_data.data_sent_length = 0;
 325         p->out_data.current_pdu_sent = 0;
 326
 327         return True;
 328 }
 329
 330 /*******************************************************************
 331  Ensure a bind request has the correct abstract & transfer interface.
 332  Used to reject unknown binds from Win2k.
 333 *******************************************************************/
 334
 335 static bool check_bind_req(struct pipes_struct *p,
 336                            struct ndr_syntax_id* abstract,
 337                            struct ndr_syntax_id* transfer,
 338                            uint32_t context_id)
 339 {
 340         struct pipe_rpc_fns *context_fns;
 341         bool ok;
 342
 343         DEBUG(3,("check_bind_req for %s\n",
 344                  ndr_interface_name(&abstract->uuid,
 345                                     abstract->if_version)));
 346
 347         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 348         if (rpc_srv_pipe_exists_by_id(abstract) &&
 349            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax_ndr)) {
 350                 DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
 351                           rpc_srv_get_pipe_cli_name(abstract),
 352                           rpc_srv_get_pipe_srv_name(abstract)));
 353         } else {
 354                 return false;
 355         }
 356
 357         ok = init_pipe_handles(p, abstract);
 358         if (!ok) {
 359                 DEBUG(1, ("Failed to init pipe handles!\n"));
 360                 return false;
 361         }
 362
 363         context_fns = talloc(p, struct pipe_rpc_fns);
 364         if (context_fns == NULL) {
 365                 DEBUG(0,("check_bind_req: talloc() failed!\n"));
 366                 return false;
 367         }
 368
 369         context_fns->next = context_fns->prev = NULL;
 370         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 371         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 372         context_fns->context_id = context_id;
 373         context_fns->syntax = *abstract;
 374
 375         /* add to the list of open contexts */
 376
 377         DLIST_ADD( p->contexts, context_fns );
 378
 379         return True;
 380 }
 381
 382 /**
 383  * Is a named pipe known?
 384  * @param[in] pipename          Just the filename
 385  * @result                      Do we want to serve this?
 386  */
 387 bool is_known_pipename(const char *pipename, struct ndr_syntax_id *syntax)
 388 {
 389         NTSTATUS status;
 390
 391         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 392                 DEBUG(10, ("refusing spoolss access\n"));
 393                 return false;
 394         }
 395
 396         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 397                 return true;
 398         }
 399
 400         status = smb_probe_module("rpc", pipename);
 401         if (!NT_STATUS_IS_OK(status)) {
 402                 DEBUG(10, ("is_known_pipename: %s unknown\n", pipename));
 403                 return false;
 404         }
 405         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 406
 407         /*
 408          * Scan the list again for the interface id
 409          */
 410         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 411                 return true;
 412         }
 413
 414         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 415                    pipename));
 416
 417         return false;
 418 }
 419
 420 /*******************************************************************
 421  Handle an NTLMSSP bind auth.
 422 *******************************************************************/
 423
 424 static bool pipe_auth_generic_bind(struct pipes_struct *p,
 425                                    struct ncacn_packet *pkt,
 426                                    struct dcerpc_auth *auth_info,
 427                                    DATA_BLOB *response)
 428 {
 429         TALLOC_CTX *mem_ctx = pkt;
 430         struct gensec_security *gensec_security = NULL;
 431         NTSTATUS status;
 432
 433         status = auth_generic_server_authtype_start(p,
 434                                                     auth_info->auth_type,
 435                                                     auth_info->auth_level,
 436                                                     &auth_info->credentials,
 437                                                     response,
 438                                                     p->remote_address,
 439                                                     &gensec_security);
 440         if (!NT_STATUS_IS_OK(status) &&
 441             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED))
 442         {
 443                 DEBUG(0, (__location__ ": auth_generic_server_authtype_start[%u/%u] failed: %s\n",
 444                           auth_info->auth_type, auth_info->auth_level, nt_errstr(status)));
 445                 return false;
 446         }
 447
 448         /* Make sure data is bound to the memctx, to be freed the caller */
 449         talloc_steal(mem_ctx, response->data);
 450
 451         p->auth.auth_ctx = gensec_security;
 452         p->auth.auth_type = auth_info->auth_type;
 453
 454         if (pkt->pfc_flags & DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN) {
 455                 p->auth.client_hdr_signing = true;
 456                 p->auth.hdr_signing = gensec_have_feature(gensec_security,
 457                                                 GENSEC_FEATURE_SIGN_PKT_HEADER);
 458         }
 459
 460         if (p->auth.hdr_signing) {
 461                 gensec_want_feature(gensec_security,
 462                                     GENSEC_FEATURE_SIGN_PKT_HEADER);
 463         }
 464
 465         if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 466                 return true;
 467         }
 468
 469         status = pipe_auth_verify_final(p);
 470         if (!NT_STATUS_IS_OK(status)) {
 471                 DEBUG(0, ("pipe_auth_verify_final failed: %s\n",
 472                           nt_errstr(status)));
 473                 return false;
 474         }
 475
 476         return true;
 477 }
 478
 479 /*******************************************************************
 480  Process an NTLMSSP authentication response.
 481  If this function succeeds, the user has been authenticated
 482  and their domain, name and calling workstation stored in
 483  the pipe struct.
 484 *******************************************************************/
 485
 486 static bool pipe_auth_generic_verify_final(TALLOC_CTX *mem_ctx,
 487                                 struct gensec_security *gensec_security,
 488                                 enum dcerpc_AuthLevel auth_level,
 489                                 struct auth_session_info **session_info)
 490 {
 491         NTSTATUS status;
 492         bool ret;
 493
 494         DEBUG(5, (__location__ ": checking user details\n"));
 495
 496         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 497            ensure the underlying NTLMSSP flags are also set. If not we should
 498            refuse the bind. */
 499
 500         status = auth_generic_server_check_flags(gensec_security,
 501                                             (auth_level ==
 502                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 503                                             (auth_level ==
 504                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 505         if (!NT_STATUS_IS_OK(status)) {
 506                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 507                           "security for rpc connection\n"));
 508                 return false;
 509         }
 510
 511         TALLOC_FREE(*session_info);
 512
 513         status = auth_generic_server_get_user_info(gensec_security,
 514                                                 mem_ctx, session_info);
 515         if (!NT_STATUS_IS_OK(status)) {
 516                 DEBUG(0, (__location__ ": failed to obtain the server info "
 517                           "for authenticated user: %s\n", nt_errstr(status)));
 518                 return false;
 519         }
 520
 521         if ((*session_info)->security_token == NULL) {
 522                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 523                 return false;
 524         }
 525
 526         if ((*session_info)->unix_token == NULL) {
 527                 DEBUG(1, ("Auth module failed to provide unix_token\n"));
 528                 return false;
 529         }
 530
 531         /*
 532          * We're an authenticated bind over smb, so the session key needs to
 533          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 534          * does. See the RPC-SAMBA3SESSIONKEY.
 535          */
 536
 537         ret = session_info_set_session_key((*session_info), generic_session_key());
 538         if (!ret) {
 539                 DEBUG(0, ("Failed to set session key!\n"));
 540                 return false;
 541         }
 542
 543         return true;
 544 }
 545
 546 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 547 {
 548         struct gensec_security *gensec_security;
 549         bool ok;
 550
 551         if (p->auth.auth_type == DCERPC_AUTH_TYPE_NONE) {
 552                 p->pipe_bound = true;
 553                 return NT_STATUS_OK;
 554         }
 555
 556         gensec_security = talloc_get_type(p->auth.auth_ctx,
 557                                           struct gensec_security);
 558         if (gensec_security == NULL) {
 559                 return NT_STATUS_INTERNAL_ERROR;
 560         }
 561
 562         ok = pipe_auth_generic_verify_final(p, gensec_security,
 563                                             p->auth.auth_level,
 564                                             &p->session_info);
 565         if (!ok) {
 566                 return NT_STATUS_ACCESS_DENIED;
 567         }
 568
 569         p->pipe_bound = true;
 570
 571         return NT_STATUS_OK;
 572 }
 573
 574 /*******************************************************************
 575  Respond to a pipe bind request.
 576 *******************************************************************/
 577
 578 static bool api_pipe_bind_req(struct pipes_struct *p,
 579                                 struct ncacn_packet *pkt)
 580 {
 581         struct dcerpc_auth auth_info;
 582         uint16 assoc_gid;
 583         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
 584         NTSTATUS status;
 585         struct ndr_syntax_id id;
 586         uint8_t pfc_flags = 0;
 587         union dcerpc_payload u;
 588         struct dcerpc_ack_ctx bind_ack_ctx;
 589         DATA_BLOB auth_resp = data_blob_null;
 590         DATA_BLOB auth_blob = data_blob_null;
 591         const struct ndr_interface_table *table;
 592
 593         /* No rebinds on a bound pipe - use alter context. */
 594         if (p->pipe_bound) {
 595                 DEBUG(2,("Rejecting bind request on bound rpc connection\n"));
 596                 return setup_bind_nak(p, pkt);
 597         }
 598
 599         if (pkt->u.bind.num_contexts == 0) {
 600                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
 601                 goto err_exit;
 602         }
 603
 604         /*
 605          * Try and find the correct pipe name to ensure
 606          * that this is a pipe name we support.
 607          */
 608         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 609
 610         table = ndr_table_by_uuid(&id.uuid);
 611         if (table == NULL) {
 612                 DEBUG(0,("unknown interface\n"));
 613                 return false;
 614         }
 615
 616         if (rpc_srv_pipe_exists_by_id(&id)) {
 617                 DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 618                           rpc_srv_get_pipe_cli_name(&id),
 619                           rpc_srv_get_pipe_srv_name(&id)));
 620         } else {
 621                 status = smb_probe_module(
 622                         "rpc", dcerpc_default_transport_endpoint(pkt,
 623                                 NCACN_NP, table));
 624
 625                 if (NT_STATUS_IS_ERR(status)) {
 626                         DEBUG(3,("api_pipe_bind_req: Unknown rpc service name "
 627                                  "%s in bind request.\n",
 628                                  ndr_interface_name(&id.uuid,
 629                                                     id.if_version)));
 630
 631                         return setup_bind_nak(p, pkt);
 632                 }
 633
 634                 if (rpc_srv_get_pipe_interface_by_cli_name(
 635                                 dcerpc_default_transport_endpoint(pkt,
 636                                         NCACN_NP, table),
 637                                 &id)) {
 638                         DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 639                                   rpc_srv_get_pipe_cli_name(&id),
 640                                   rpc_srv_get_pipe_srv_name(&id)));
 641                 } else {
 642                         DEBUG(0, ("module %s doesn't provide functions for "
 643                                   "pipe %s!\n",
 644                                   ndr_interface_name(&id.uuid,
 645                                                      id.if_version),
 646                                   ndr_interface_name(&id.uuid,
 647                                                      id.if_version)));
 648                         return setup_bind_nak(p, pkt);
 649                 }
 650         }
 651
 652         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 653
 654         if (pkt->u.bind.assoc_group_id != 0) {
 655                 assoc_gid = pkt->u.bind.assoc_group_id;
 656         } else {
 657                 assoc_gid = 0x53f0;
 658         }
 659
 660         /*
 661          * Create the bind response struct.
 662          */
 663
 664         /* If the requested abstract synt uuid doesn't match our client pipe,
 665                 reject the bind_ack & set the transfer interface synt to all 0's,
 666                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 667                 unknown to NT4)
 668                 Needed when adding entries to a DACL from NT5 - SK */
 669
 670         if (check_bind_req(p,
 671                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 672                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 673                         pkt->u.bind.ctx_list[0].context_id)) {
 674
 675                 bind_ack_ctx.result = 0;
 676                 bind_ack_ctx.reason.value = 0;
 677                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 678         } else {
 679                 p->pipe_bound = False;
 680                 /* Rejection reason: abstract syntax not supported */
 681                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 682                 bind_ack_ctx.reason.value = DCERPC_BIND_REASON_ASYNTAX;
 683                 bind_ack_ctx.syntax = ndr_syntax_id_null;
 684         }
 685
 686         /*
 687          * Check if this is an authenticated bind request.
 688          */
 689         if (pkt->auth_length) {
 690                 /* Quick length check. Won't catch a bad auth footer,
 691                  * prevents overrun. */
 692
 693                 if (pkt->frag_length < RPC_HEADER_LEN +
 694                                         DCERPC_AUTH_TRAILER_LENGTH +
 695                                         pkt->auth_length) {
 696                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
 697                                 "too long for fragment %u.\n",
 698                                 (unsigned int)pkt->auth_length,
 699                                 (unsigned int)pkt->frag_length));
 700                         goto err_exit;
 701                 }
 702
 703                 /*
 704                  * Decode the authentication verifier.
 705                  */
 706                 status = dcerpc_pull_dcerpc_auth(pkt,
 707                                                  &pkt->u.bind.auth_info,
 708                                                  &auth_info, p->endian);
 709                 if (!NT_STATUS_IS_OK(status)) {
 710                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
 711                         goto err_exit;
 712                 }
 713
 714                 auth_type = auth_info.auth_type;
 715
 716                 /* Work out if we have to sign or seal etc. */
 717                 switch (auth_info.auth_level) {
 718                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 719                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 720                         break;
 721                 case DCERPC_AUTH_LEVEL_PRIVACY:
 722                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 723                         break;
 724                 case DCERPC_AUTH_LEVEL_CONNECT:
 725                         p->auth.auth_level = DCERPC_AUTH_LEVEL_CONNECT;
 726                         break;
 727                 default:
 728                         DEBUG(0, ("Unexpected auth level (%u).\n",
 729                                 (unsigned int)auth_info.auth_level ));
 730                         goto err_exit;
 731                 }
 732
 733                 switch (auth_type) {
 734                 case DCERPC_AUTH_TYPE_NONE:
 735                         break;
 736
 737                 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
 738                         if (p->transport == NCALRPC && p->ncalrpc_as_system) {
 739                                 TALLOC_FREE(p->session_info);
 740
 741                                 status = make_session_info_system(p,
 742                                                                   &p->session_info);
 743                                 if (!NT_STATUS_IS_OK(status)) {
 744                                         goto err_exit;
 745                                 }
 746
 747                                 auth_resp = data_blob_talloc(pkt,
 748                                                              "NCALRPC_AUTH_OK",
 749                                                              15);
 750
 751                                 p->auth.auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
 752                                 p->pipe_bound = true;
 753                         } else {
 754                                 goto err_exit;
 755                         }
 756                         break;
 757
 758                 default:
 759                         if (!pipe_auth_generic_bind(p, pkt,
 760                                                     &auth_info, &auth_resp)) {
 761                                 goto err_exit;
 762                         }
 763                         break;
 764                 }
 765         }
 766
 767         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
 768                 /* Unauthenticated bind request. */
 769                 /* We're finished - no more packets. */
 770                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 771                 /* We must set the pipe auth_level here also. */
 772                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 773                 p->pipe_bound = True;
 774                 /* The session key was initialized from the SMB
 775                  * session in make_internal_rpc_pipe_p */
 776         }
 777
 778         ZERO_STRUCT(u.bind_ack);
 779         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
 780         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
 781         u.bind_ack.assoc_group_id = assoc_gid;
 782
 783         /* name has to be \PIPE\xxxxx */
 784         u.bind_ack.secondary_address =
 785                         talloc_asprintf(pkt, "\\PIPE\\%s",
 786                                         rpc_srv_get_pipe_srv_name(&id));
 787         if (!u.bind_ack.secondary_address) {
 788                 DEBUG(0, ("Out of memory!\n"));
 789                 goto err_exit;
 790         }
 791         u.bind_ack.secondary_address_size =
 792                                 strlen(u.bind_ack.secondary_address) + 1;
 793
 794         u.bind_ack.num_results = 1;
 795         u.bind_ack.ctx_list = &bind_ack_ctx;
 796
 797         /* NOTE: We leave the auth_info empty so we can calculate the padding
 798          * later and then append the auth_info --simo */
 799
 800         /*
 801          * Marshall directly into the outgoing PDU space. We
 802          * must do this as we need to set to the bind response
 803          * header and are never sending more than one PDU here.
 804          */
 805
 806         pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
 807
 808         if (p->auth.hdr_signing) {
 809                 pfc_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
 810         }
 811
 812         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 813                                           DCERPC_PKT_BIND_ACK,
 814                                           pfc_flags,
 815                                           auth_resp.length,
 816                                           pkt->call_id,
 817                                           &u,
 818                                           &p->out_data.frag);
 819         if (!NT_STATUS_IS_OK(status)) {
 820                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
 821                           nt_errstr(status)));
 822         }
 823
 824         if (auth_resp.length) {
 825
 826                 status = dcerpc_push_dcerpc_auth(pkt,
 827                                                  auth_type,
 828                                                  auth_info.auth_level,
 829                                                  0,
 830                                                  1, /* auth_context_id */
 831                                                  &auth_resp,
 832                                                  &auth_blob);
 833                 if (!NT_STATUS_IS_OK(status)) {
 834                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
 835                         goto err_exit;
 836                 }
 837         }
 838
 839         /* Now that we have the auth len store it into the right place in
 840          * the dcerpc header */
 841         dcerpc_set_frag_length(&p->out_data.frag,
 842                                 p->out_data.frag.length + auth_blob.length);
 843
 844         if (auth_blob.length) {
 845
 846                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
 847                                         auth_blob.data, auth_blob.length)) {
 848                         DEBUG(0, ("Append of auth info failed.\n"));
 849                         goto err_exit;
 850                 }
 851         }
 852
 853         /*
 854          * Setup the lengths for the initial reply.
 855          */
 856
 857         p->out_data.data_sent_length = 0;
 858         p->out_data.current_pdu_sent = 0;
 859
 860         TALLOC_FREE(auth_blob.data);
 861         return True;
 862
 863   err_exit:
 864
 865         data_blob_free(&p->out_data.frag);
 866         TALLOC_FREE(auth_blob.data);
 867         return setup_bind_nak(p, pkt);
 868 }
 869
 870 /*******************************************************************
 871  This is the "stage3" response after a bind request and reply.
 872 *******************************************************************/
 873
 874 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
 875 {
 876         struct dcerpc_auth auth_info;
 877         DATA_BLOB response = data_blob_null;
 878         struct gensec_security *gensec_security;
 879         NTSTATUS status;
 880
 881         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 882
 883         if (pkt->auth_length == 0) {
 884                 DEBUG(1, ("No auth field sent for bind request!\n"));
 885                 goto err;
 886         }
 887
 888         /* Ensure there's enough data for an authenticated request. */
 889         if (pkt->frag_length < RPC_HEADER_LEN
 890                                 + DCERPC_AUTH_TRAILER_LENGTH
 891                                 + pkt->auth_length) {
 892                         DEBUG(1,("api_pipe_ntlmssp_auth_process: auth_len "
 893                                 "%u is too large.\n",
 894                         (unsigned int)pkt->auth_length));
 895                 goto err;
 896         }
 897
 898         /*
 899          * Decode the authentication verifier response.
 900          */
 901
 902         status = dcerpc_pull_dcerpc_auth(pkt,
 903                                          &pkt->u.auth3.auth_info,
 904                                          &auth_info, p->endian);
 905         if (!NT_STATUS_IS_OK(status)) {
 906                 DEBUG(1, ("Failed to unmarshall dcerpc_auth.\n"));
 907                 goto err;
 908         }
 909
 910         /* We must NEVER look at auth_info->auth_pad_len here,
 911          * as old Samba client code gets it wrong and sends it
 912          * as zero. JRA.
 913          */
 914
 915         if (auth_info.auth_type != p->auth.auth_type) {
 916                 DEBUG(1, ("Auth type mismatch! Client sent %d, "
 917                           "but auth was started as type %d!\n",
 918                           auth_info.auth_type, p->auth.auth_type));
 919                 goto err;
 920         }
 921
 922         gensec_security = talloc_get_type(p->auth.auth_ctx,
 923                                           struct gensec_security);
 924
 925         status = auth_generic_server_step(gensec_security,
 926                                           pkt, &auth_info.credentials,
 927                                           &response);
 928
 929         if (NT_STATUS_EQUAL(status,
 930                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
 931             response.length) {
 932                 DEBUG(1, (__location__ ": This was supposed to be the final "
 933                           "leg, but crypto machinery claims a response is "
 934                           "needed, aborting auth!\n"));
 935                 data_blob_free(&response);
 936                 goto err;
 937         }
 938         if (!NT_STATUS_IS_OK(status)) {
 939                 DEBUG(2, ("Auth failed (%s)\n", nt_errstr(status)));
 940                 goto err;
 941         }
 942
 943         /* Now verify auth was indeed successful and extract server info */
 944         status = pipe_auth_verify_final(p);
 945         if (!NT_STATUS_IS_OK(status)) {
 946                 DEBUG(2, ("Auth Verify failed (%s)\n", nt_errstr(status)));
 947                 goto err;
 948         }
 949
 950         return true;
 951
 952 err:
 953
 954         TALLOC_FREE(p->auth.auth_ctx);
 955         return false;
 956 }
 957
 958 /****************************************************************************
 959  Deal with an alter context call. Can be third part of 3 leg auth request for
 960  SPNEGO calls.
 961 ****************************************************************************/
 962
 963 static bool api_pipe_alter_context(struct pipes_struct *p,
 964                                         struct ncacn_packet *pkt)
 965 {
 966         struct dcerpc_auth auth_info;
 967         uint16 assoc_gid;
 968         NTSTATUS status;
 969         union dcerpc_payload u;
 970         struct dcerpc_ack_ctx bind_ack_ctx;
 971         DATA_BLOB auth_resp = data_blob_null;
 972         DATA_BLOB auth_blob = data_blob_null;
 973         int pad_len = 0;
 974         struct gensec_security *gensec_security;
 975
 976         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
 977
 978         if (pkt->u.bind.assoc_group_id != 0) {
 979                 assoc_gid = pkt->u.bind.assoc_group_id;
 980         } else {
 981                 assoc_gid = 0x53f0;
 982         }
 983
 984         /*
 985          * Create the bind response struct.
 986          */
 987
 988         /* If the requested abstract synt uuid doesn't match our client pipe,
 989                 reject the bind_ack & set the transfer interface synt to all 0's,
 990                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 991                 unknown to NT4)
 992                 Needed when adding entries to a DACL from NT5 - SK */
 993
 994         if (check_bind_req(p,
 995                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 996                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 997                         pkt->u.bind.ctx_list[0].context_id)) {
 998
 999                 bind_ack_ctx.result = 0;
1000                 bind_ack_ctx.reason.value = 0;
1001                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1002         } else {
1003                 p->pipe_bound = False;
1004                 /* Rejection reason: abstract syntax not supported */
1005                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1006                 bind_ack_ctx.reason.value = DCERPC_BIND_REASON_ASYNTAX;
1007                 bind_ack_ctx.syntax = ndr_syntax_id_null;
1008         }
1009
1010         /*
1011          * Check if this is an authenticated alter context request.
1012          */
1013         if (pkt->auth_length) {
1014                 /* Quick length check. Won't catch a bad auth footer,
1015                  * prevents overrun. */
1016
1017                 if (pkt->frag_length < RPC_HEADER_LEN +
1018                                         DCERPC_AUTH_TRAILER_LENGTH +
1019                                         pkt->auth_length) {
1020                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1021                                 "too long for fragment %u.\n",
1022                                 (unsigned int)pkt->auth_length,
1023                                 (unsigned int)pkt->frag_length ));
1024                         goto err_exit;
1025                 }
1026
1027                 status = dcerpc_pull_dcerpc_auth(pkt,
1028                                                  &pkt->u.bind.auth_info,
1029                                                  &auth_info, p->endian);
1030                 if (!NT_STATUS_IS_OK(status)) {
1031                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1032                         goto err_exit;
1033                 }
1034
1035                 /* We can only finish if the pipe is unbound for now */
1036                 if (p->pipe_bound) {
1037                         DEBUG(0, (__location__ ": Pipe already bound, "
1038                                   "Altering Context not yet supported!\n"));
1039                         goto err_exit;
1040                 }
1041
1042                 if (auth_info.auth_type != p->auth.auth_type) {
1043                         DEBUG(0, ("Auth type mismatch! Client sent %d, "
1044                                   "but auth was started as type %d!\n",
1045                                   auth_info.auth_type, p->auth.auth_type));
1046                         goto err_exit;
1047                 }
1048
1049                 gensec_security = talloc_get_type(p->auth.auth_ctx,
1050                                                   struct gensec_security);
1051                 status = auth_generic_server_step(gensec_security,
1052                                                   pkt,
1053                                                   &auth_info.credentials,
1054                                                   &auth_resp);
1055                 if (NT_STATUS_IS_OK(status)) {
1056                         /* third leg of auth, verify auth info */
1057                         status = pipe_auth_verify_final(p);
1058                         if (!NT_STATUS_IS_OK(status)) {
1059                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1060                                           nt_errstr(status)));
1061                                 goto err_exit;
1062                         }
1063                 } else if (NT_STATUS_EQUAL(status,
1064                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1065                         DEBUG(10, ("More auth legs required.\n"));
1066                 } else {
1067                         DEBUG(0, ("Auth step returned an error (%s)\n",
1068                                   nt_errstr(status)));
1069                         goto err_exit;
1070                 }
1071         }
1072
1073         ZERO_STRUCT(u.alter_resp);
1074         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1075         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1076         u.alter_resp.assoc_group_id = assoc_gid;
1077
1078         /* secondary address CAN be NULL
1079          * as the specs say it's ignored.
1080          * It MUST be NULL to have the spoolss working.
1081          */
1082         u.alter_resp.secondary_address = "";
1083         u.alter_resp.secondary_address_size = 1;
1084
1085         u.alter_resp.num_results = 1;
1086         u.alter_resp.ctx_list = &bind_ack_ctx;
1087
1088         /* NOTE: We leave the auth_info empty so we can calculate the padding
1089          * later and then append the auth_info --simo */
1090
1091         /*
1092          * Marshall directly into the outgoing PDU space. We
1093          * must do this as we need to set to the bind response
1094          * header and are never sending more than one PDU here.
1095          */
1096
1097         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1098                                           DCERPC_PKT_ALTER_RESP,
1099                                           DCERPC_PFC_FLAG_FIRST |
1100                                                 DCERPC_PFC_FLAG_LAST,
1101                                           auth_resp.length,
1102                                           pkt->call_id,
1103                                           &u,
1104                                           &p->out_data.frag);
1105         if (!NT_STATUS_IS_OK(status)) {
1106                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1107                           nt_errstr(status)));
1108         }
1109
1110         if (auth_resp.length) {
1111
1112                 /* Work out any padding needed before the auth footer. */
1113                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1114                 if (pad_len) {
1115                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1116                         DEBUG(10, ("auth pad_len = %u\n",
1117                                    (unsigned int)pad_len));
1118                 }
1119
1120                 status = dcerpc_push_dcerpc_auth(pkt,
1121                                                  auth_info.auth_type,
1122                                                  auth_info.auth_level,
1123                                                  pad_len,
1124                                                  1, /* auth_context_id */
1125                                                  &auth_resp,
1126                                                  &auth_blob);
1127                 if (!NT_STATUS_IS_OK(status)) {
1128                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1129                         goto err_exit;
1130                 }
1131         }
1132
1133         /* Now that we have the auth len store it into the right place in
1134          * the dcerpc header */
1135         dcerpc_set_frag_length(&p->out_data.frag,
1136                                 p->out_data.frag.length +
1137                                         pad_len + auth_blob.length);
1138
1139         if (auth_resp.length) {
1140                 if (pad_len) {
1141                         char pad[SERVER_NDR_PADDING_SIZE];
1142                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1143                         if (!data_blob_append(p->mem_ctx,
1144                                                 &p->out_data.frag,
1145                                                 pad, pad_len)) {
1146                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1147                                           "%u bytes of pad data.\n",
1148                                           (unsigned int)pad_len));
1149                                 goto err_exit;
1150                         }
1151                 }
1152
1153                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1154                                         auth_blob.data, auth_blob.length)) {
1155                         DEBUG(0, ("Append of auth info failed.\n"));
1156                         goto err_exit;
1157                 }
1158         }
1159
1160         /*
1161          * Setup the lengths for the initial reply.
1162          */
1163
1164         p->out_data.data_sent_length = 0;
1165         p->out_data.current_pdu_sent = 0;
1166
1167         TALLOC_FREE(auth_blob.data);
1168         return True;
1169
1170   err_exit:
1171
1172         data_blob_free(&p->out_data.frag);
1173         TALLOC_FREE(auth_blob.data);
1174         return setup_bind_nak(p, pkt);
1175 }
1176
1177 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1178                        const struct api_struct *api_rpc_cmds, int n_cmds,
1179                        const struct ndr_syntax_id *syntax);
1180
1181 static bool srv_pipe_check_verification_trailer(struct pipes_struct *p,
1182                                                 struct ncacn_packet *pkt,
1183                                                 struct pipe_rpc_fns *pipe_fns)
1184 {
1185         TALLOC_CTX *frame = talloc_stackframe();
1186         struct dcerpc_sec_verification_trailer *vt = NULL;
1187         const uint32_t bitmask1 =
1188                 p->auth.client_hdr_signing ? DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING : 0;
1189         const struct dcerpc_sec_vt_pcontext pcontext = {
1190                 .abstract_syntax = pipe_fns->syntax,
1191                 .transfer_syntax = ndr_transfer_syntax_ndr,
1192         };
1193         const struct dcerpc_sec_vt_header2 header2 =
1194                dcerpc_sec_vt_header2_from_ncacn_packet(pkt);
1195         struct ndr_pull *ndr;
1196         enum ndr_err_code ndr_err;
1197         bool ret = false;
1198
1199         ndr = ndr_pull_init_blob(&p->in_data.data, frame);
1200         if (ndr == NULL) {
1201                 goto done;
1202         }
1203
1204         ndr_err = ndr_pop_dcerpc_sec_verification_trailer(ndr, frame, &vt);
1205         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1206                 goto done;
1207         }
1208
1209         ret = dcerpc_sec_verification_trailer_check(vt, &bitmask1,
1210                                                     &pcontext, &header2);
1211 done:
1212         TALLOC_FREE(frame);
1213         return ret;
1214 }
1215
1216 /****************************************************************************
1217  Find the correct RPC function to call for this request.
1218  If the pipe is authenticated then become the correct UNIX user
1219  before doing the call.
1220 ****************************************************************************/
1221
1222 static bool api_pipe_request(struct pipes_struct *p,
1223                                 struct ncacn_packet *pkt)
1224 {
1225         TALLOC_CTX *frame = talloc_stackframe();
1226         bool ret = False;
1227         struct pipe_rpc_fns *pipe_fns;
1228
1229         if (!p->pipe_bound) {
1230                 DEBUG(1, ("Pipe not bound!\n"));
1231                 data_blob_free(&p->out_data.rdata);
1232                 TALLOC_FREE(frame);
1233                 return false;
1234         }
1235
1236         /* get the set of RPC functions for this context */
1237         pipe_fns = find_pipe_fns_by_context(p->contexts,
1238                                             pkt->u.request.context_id);
1239         if (pipe_fns == NULL) {
1240                 DEBUG(0, ("No rpc function table associated with context "
1241                           "[%d]\n",
1242                           pkt->u.request.context_id));
1243                 data_blob_free(&p->out_data.rdata);
1244                 TALLOC_FREE(frame);
1245                 return false;
1246         }
1247
1248         if (!srv_pipe_check_verification_trailer(p, pkt, pipe_fns)) {
1249                 DEBUG(1, ("srv_pipe_check_verification_trailer: failed\n"));
1250                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_ACCESS_DENIED));
1251                 data_blob_free(&p->out_data.rdata);
1252                 TALLOC_FREE(frame);
1253                 return true;
1254         }
1255
1256         if (!become_authenticated_pipe_user(p->session_info)) {
1257                 DEBUG(1, ("Failed to become pipe user!\n"));
1258                 data_blob_free(&p->out_data.rdata);
1259                 TALLOC_FREE(frame);
1260                 return false;
1261         }
1262
1263         DEBUG(5, ("Requested %s rpc service\n",
1264                   ndr_interface_name(&pipe_fns->syntax.uuid,
1265                                      pipe_fns->syntax.if_version)));
1266
1267         ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds,
1268                          &pipe_fns->syntax);
1269         unbecome_authenticated_pipe_user();
1270
1271         TALLOC_FREE(frame);
1272         return ret;
1273 }
1274
1275 /*******************************************************************
1276  Calls the underlying RPC function for a named pipe.
1277  ********************************************************************/
1278
1279 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1280                        const struct api_struct *api_rpc_cmds, int n_cmds,
1281                        const struct ndr_syntax_id *syntax)
1282 {
1283         int fn_num;
1284         uint32_t offset1;
1285         const struct ndr_interface_table *table;
1286
1287         /* interpret the command */
1288         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1289                  ndr_interface_name(&syntax->uuid, syntax->if_version),
1290                  pkt->u.request.opnum));
1291
1292         table = ndr_table_by_uuid(&syntax->uuid);
1293         if (table == NULL) {
1294                 DEBUG(0,("unknown interface\n"));
1295                 return false;
1296         }
1297
1298         if (DEBUGLEVEL >= 50) {
1299                 fstring name;
1300                 slprintf(name, sizeof(name)-1, "in_%s",
1301                          dcerpc_default_transport_endpoint(pkt, NCACN_NP, table));
1302                 dump_pdu_region(name, pkt->u.request.opnum,
1303                                 &p->in_data.data, 0,
1304                                 p->in_data.data.length);
1305         }
1306
1307         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1308                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1309                     api_rpc_cmds[fn_num].fn != NULL) {
1310                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1311                                   api_rpc_cmds[fn_num].name));
1312                         break;
1313                 }
1314         }
1315
1316         if (fn_num == n_cmds) {
1317                 /*
1318                  * For an unknown RPC just return a fault PDU but
1319                  * return True to allow RPC's on the pipe to continue
1320                  * and not put the pipe into fault state. JRA.
1321                  */
1322                 DEBUG(4, ("unknown\n"));
1323                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1324                 return True;
1325         }
1326
1327         offset1 = p->out_data.rdata.length;
1328
1329         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1330                 fn_num, api_rpc_cmds[fn_num].fn));
1331         /* do the actual command */
1332         if(!api_rpc_cmds[fn_num].fn(p)) {
1333                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1334                          ndr_interface_name(&syntax->uuid, syntax->if_version),
1335                          api_rpc_cmds[fn_num].name));
1336                 data_blob_free(&p->out_data.rdata);
1337                 return False;
1338         }
1339
1340         if (p->fault_state) {
1341                 DEBUG(4,("api_rpcTNP: fault(%d) return.\n", p->fault_state));
1342                 setup_fault_pdu(p, NT_STATUS(p->fault_state));
1343                 p->fault_state = 0;
1344                 return true;
1345         }
1346
1347         if (DEBUGLEVEL >= 50) {
1348                 fstring name;
1349                 slprintf(name, sizeof(name)-1, "out_%s",
1350                          dcerpc_default_transport_endpoint(pkt, NCACN_NP, table));
1351                 dump_pdu_region(name, pkt->u.request.opnum,
1352                                 &p->out_data.rdata, offset1,
1353                                 p->out_data.rdata.length);
1354         }
1355
1356         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1357                  ndr_interface_name(&syntax->uuid, syntax->if_version)));
1358
1359         /* Check for buffer underflow in rpc parsing */
1360         if ((DEBUGLEVEL >= 10) &&
1361             (pkt->frag_length < p->in_data.data.length)) {
1362                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1363                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1364                               p->in_data.data.length - pkt->frag_length);
1365         }
1366
1367         return True;
1368 }
1369
1370 /****************************************************************************
1371  Initialise an outgoing packet.
1372 ****************************************************************************/
1373
1374 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1375 {
1376         output_data *o_data = &p->out_data;
1377
1378         /* Reset the offset counters. */
1379         o_data->data_sent_length = 0;
1380         o_data->current_pdu_sent = 0;
1381
1382         data_blob_free(&o_data->frag);
1383
1384         /* Free any memory in the current return data buffer. */
1385         data_blob_free(&o_data->rdata);
1386
1387         return True;
1388 }
1389
1390 /****************************************************************************
1391  Sets the fault state on incoming packets.
1392 ****************************************************************************/
1393
1394 void set_incoming_fault(struct pipes_struct *p)
1395 {
1396         data_blob_free(&p->in_data.data);
1397         p->in_data.pdu_needed_len = 0;
1398         p->in_data.pdu.length = 0;
1399         p->fault_state = DCERPC_FAULT_CANT_PERFORM;
1400
1401         DEBUG(10, ("Setting fault state\n"));
1402 }
1403
1404 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1405                                     struct ncacn_packet *pkt,
1406                                     DATA_BLOB *raw_pkt)
1407 {
1408         NTSTATUS status;
1409         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1410         size_t pad_len;
1411
1412         DEBUG(10, ("Checking request auth.\n"));
1413
1414         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1415                 hdr_size += 16;
1416         }
1417
1418         /* in case of sealing this function will unseal the data in place */
1419         status = dcerpc_check_auth(auth, pkt,
1420                                    &pkt->u.request.stub_and_verifier,
1421                                    hdr_size, raw_pkt,
1422                                    &pad_len);
1423         if (!NT_STATUS_IS_OK(status)) {
1424                 return status;
1425         }
1426
1427
1428         /* remove padding and auth trailer,
1429          * this way the caller will get just the data */
1430         if (pkt->auth_length) {
1431                 size_t trail_len = pad_len
1432                                         + DCERPC_AUTH_TRAILER_LENGTH
1433                                         + pkt->auth_length;
1434                 if (pkt->u.request.stub_and_verifier.length < trail_len) {
1435                         return NT_STATUS_INFO_LENGTH_MISMATCH;
1436                 }
1437                 pkt->u.request.stub_and_verifier.length -= trail_len;
1438         }
1439
1440         return NT_STATUS_OK;
1441 }
1442
1443 /****************************************************************************
1444  Processes a request pdu. This will do auth processing if needed, and
1445  appends the data into the complete stream if the LAST flag is not set.
1446 ****************************************************************************/
1447
1448 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1449 {
1450         NTSTATUS status;
1451         DATA_BLOB data;
1452         struct dcerpc_sec_vt_header2 hdr2;
1453
1454         if (!p->pipe_bound) {
1455                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1456                 set_incoming_fault(p);
1457                 return False;
1458         }
1459
1460         hdr2 = dcerpc_sec_vt_header2_from_ncacn_packet(pkt);
1461         if (pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST) {
1462                 p->header2 = hdr2;
1463         } else {
1464                 if (!dcerpc_sec_vt_header2_equal(&hdr2, &p->header2)) {
1465                         set_incoming_fault(p);
1466                         return false;
1467                 }
1468         }
1469
1470         /* Store the opnum */
1471         p->opnum = pkt->u.request.opnum;
1472
1473         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1474         if (!NT_STATUS_IS_OK(status)) {
1475                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1476                           nt_errstr(status)));
1477                 set_incoming_fault(p);
1478                 return false;
1479         }
1480
1481         data = pkt->u.request.stub_and_verifier;
1482
1483         /*
1484          * Check the data length doesn't go over the 15Mb limit.
1485          * increased after observing a bug in the Windows NT 4.0 SP6a
1486          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1487          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1488          */
1489
1490         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1491                 DEBUG(0, ("process_request_pdu: "
1492                           "rpc data buffer too large (%u) + (%u)\n",
1493                           (unsigned int)p->in_data.data.length,
1494                           (unsigned int)data.length));
1495                 set_incoming_fault(p);
1496                 return False;
1497         }
1498
1499         /*
1500          * Append the data portion into the buffer and return.
1501          */
1502
1503         if (data.length) {
1504                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1505                                           data.data, data.length)) {
1506                         DEBUG(0, ("Unable to append data size %u "
1507                                   "to parse buffer of size %u.\n",
1508                                   (unsigned int)data.length,
1509                                   (unsigned int)p->in_data.data.length));
1510                         set_incoming_fault(p);
1511                         return False;
1512                 }
1513         }
1514
1515         if (!(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
1516                 return true;
1517         }
1518
1519         /*
1520          * Ok - we finally have a complete RPC stream.
1521          * Call the rpc command to process it.
1522          */
1523
1524         return api_pipe_request(p, pkt);
1525 }
1526
1527 void process_complete_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1528 {
1529         bool reply = false;
1530
1531         /* Store the call_id */
1532         p->call_id = pkt->call_id;
1533
1534         DEBUG(10, ("Processing packet type %u\n", (unsigned int)pkt->ptype));
1535
1536         if (!pipe_init_outgoing_data(p)) {
1537                 goto done;
1538         }
1539
1540         switch (pkt->ptype) {
1541         case DCERPC_PKT_REQUEST:
1542                 reply = process_request_pdu(p, pkt);
1543                 break;
1544
1545         case DCERPC_PKT_PING: /* CL request - ignore... */
1546                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1547                           (unsigned int)pkt->ptype));
1548                 break;
1549
1550         case DCERPC_PKT_RESPONSE: /* No responses here. */
1551                 DEBUG(0, ("Error - DCERPC_PKT_RESPONSE received from client"));
1552                 break;
1553
1554         case DCERPC_PKT_FAULT:
1555         case DCERPC_PKT_WORKING:
1556                 /* CL request - reply to a ping when a call in process. */
1557         case DCERPC_PKT_NOCALL:
1558                 /* CL - server reply to a ping call. */
1559         case DCERPC_PKT_REJECT:
1560         case DCERPC_PKT_ACK:
1561         case DCERPC_PKT_CL_CANCEL:
1562         case DCERPC_PKT_FACK:
1563         case DCERPC_PKT_CANCEL_ACK:
1564                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1565                           (unsigned int)pkt->ptype));
1566                 break;
1567
1568         case DCERPC_PKT_BIND:
1569                 /*
1570                  * We assume that a pipe bind is only in one pdu.
1571                  */
1572                 reply = api_pipe_bind_req(p, pkt);
1573                 break;
1574
1575         case DCERPC_PKT_BIND_ACK:
1576         case DCERPC_PKT_BIND_NAK:
1577                 DEBUG(0, ("Error - DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1578                           "packet type %u received.\n",
1579                           (unsigned int)pkt->ptype));
1580                 break;
1581
1582
1583         case DCERPC_PKT_ALTER:
1584                 /*
1585                  * We assume that a pipe bind is only in one pdu.
1586                  */
1587                 reply = api_pipe_alter_context(p, pkt);
1588                 break;
1589
1590         case DCERPC_PKT_ALTER_RESP:
1591                 DEBUG(0, ("Error - DCERPC_PKT_ALTER_RESP received: "
1592                           "Should only be server -> client.\n"));
1593                 break;
1594
1595         case DCERPC_PKT_AUTH3:
1596                 /*
1597                  * The third packet in an auth exchange.
1598                  */
1599                 reply = api_pipe_bind_auth3(p, pkt);
1600                 break;
1601
1602         case DCERPC_PKT_SHUTDOWN:
1603                 DEBUG(0, ("Error - DCERPC_PKT_SHUTDOWN received: "
1604                           "Should only be server -> client.\n"));
1605                 break;
1606
1607         case DCERPC_PKT_CO_CANCEL:
1608                 /* For now just free all client data and continue
1609                  * processing. */
1610                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1611                          " Abandoning rpc call.\n"));
1612                 /* As we never do asynchronous RPC serving, we can
1613                  * never cancel a call (as far as I know).
1614                  * If we ever did we'd have to send a cancel_ack reply.
1615                  * For now, just free all client data and continue
1616                  * processing. */
1617                 reply = True;
1618                 break;
1619
1620 #if 0
1621                 /* Enable this if we're doing async rpc. */
1622                 /* We must check the outstanding callid matches. */
1623                 if (pipe_init_outgoing_data(p)) {
1624                         /* Send a cancel_ack PDU reply. */
1625                         /* We should probably check the auth-verifier here. */
1626                         reply = setup_cancel_ack_reply(p, pkt);
1627                 }
1628                 break;
1629 #endif
1630
1631         case DCERPC_PKT_ORPHANED:
1632                 /* We should probably check the auth-verifier here.
1633                  * For now just free all client data and continue
1634                  * processing. */
1635                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
1636                           " Abandoning rpc call.\n"));
1637                 reply = True;
1638                 break;
1639
1640         default:
1641                 DEBUG(0, ("process_complete_pdu: "
1642                           "Unknown rpc type = %u received.\n",
1643                           (unsigned int)pkt->ptype));
1644                 break;
1645         }
1646
1647 done:
1648         if (!reply) {
1649                 DEBUG(3,("DCE/RPC fault sent!"));
1650                 set_incoming_fault(p);
1651                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1652         }
1653         /* pkt and p->in_data.pdu.data freed by caller */
1654 }
1655