source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "system/filesys.h"
  32 #include "srv_pipe_internal.h"
  33 #include "../librpc/gen_ndr/ndr_schannel.h"
  34 #include "../libcli/auth/schannel.h"
  35 #include "../libcli/auth/spnego.h"
  36 #include "dcesrv_auth_generic.h"
  37 #include "rpc_server.h"
  38 #include "rpc_dce.h"
  39 #include "smbd/smbd.h"
  40 #include "auth.h"
  41 #include "ntdomain.h"
  42 #include "rpc_server/srv_pipe.h"
  43 #include "rpc_server/rpc_contexts.h"
  44 #include "lib/param/param.h"
  45
  46 #undef DBGC_CLASS
  47 #define DBGC_CLASS DBGC_RPC_SRV
  48
  49 /**
  50  * Dump everything from the start of the end up of the provided data
  51  * into a file, but only at debug level >= 50
  52  **/
  53 static void dump_pdu_region(const char *name, int v,
  54                             DATA_BLOB *data, size_t start, size_t end)
  55 {
  56         int fd, i;
  57         char *fname = NULL;
  58         ssize_t sz;
  59
  60         if (DEBUGLEVEL < 50) return;
  61
  62         if (start > data->length || end > data->length || start > end) return;
  63
  64         for (i = 1; i < 100; i++) {
  65                 if (v != -1) {
  66                         fname = talloc_asprintf(talloc_tos(),
  67                                                 "/tmp/%s_%d.%d.prs",
  68                                                 name, v, i);
  69                 } else {
  70                         fname = talloc_asprintf(talloc_tos(),
  71                                                 "/tmp/%s_%d.prs",
  72                                                 name, i);
  73                 }
  74                 if (!fname) {
  75                         return;
  76                 }
  77                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  78                 if (fd != -1 || errno != EEXIST) break;
  79         }
  80         if (fd != -1) {
  81                 sz = write(fd, data->data + start, end - start);
  82                 i = close(fd);
  83                 if ((sz != end - start) || (i != 0) ) {
  84                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  85                                   fname, (unsigned long)sz,
  86                                   (unsigned long)end - start, i));
  87                 } else {
  88                         DEBUG(0,("created %s\n", fname));
  89                 }
  90         }
  91         TALLOC_FREE(fname);
  92 }
  93
  94 static DATA_BLOB generic_session_key(void)
  95 {
  96         return data_blob_const("SystemLibraryDTC", 16);
  97 }
  98
  99 /*******************************************************************
 100  Generate the next PDU to be returned from the data.
 101 ********************************************************************/
 102
 103 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
 104                                    struct pipe_auth_data *auth,
 105                                    uint32_t call_id,
 106                                    DATA_BLOB *rdata,
 107                                    size_t data_sent_length,
 108                                    DATA_BLOB *frag,
 109                                    size_t *pdu_size)
 110 {
 111         union dcerpc_payload u;
 112         uint8_t pfc_flags;
 113         size_t data_left;
 114         size_t data_to_send;
 115         size_t frag_len;
 116         size_t pad_len = 0;
 117         size_t auth_len = 0;
 118         NTSTATUS status;
 119
 120         ZERO_STRUCT(u.response);
 121
 122         /* Set up rpc packet pfc flags. */
 123         if (data_sent_length == 0) {
 124                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 125         } else {
 126                 pfc_flags = 0;
 127         }
 128
 129         /* Work out how much we can fit in a single PDU. */
 130         data_left = rdata->length - data_sent_length;
 131
 132         /* Ensure there really is data left to send. */
 133         if (!data_left) {
 134                 DEBUG(0, ("No data left to send !\n"));
 135                 return NT_STATUS_BUFFER_TOO_SMALL;
 136         }
 137
 138         status = dcerpc_guess_sizes(auth,
 139                                     DCERPC_RESPONSE_LENGTH,
 140                                     data_left,
 141                                     RPC_MAX_PDU_FRAG_LEN,
 142                                     SERVER_NDR_PADDING_SIZE,
 143                                     &data_to_send, &frag_len,
 144                                     &auth_len, &pad_len);
 145         if (!NT_STATUS_IS_OK(status)) {
 146                 return status;
 147         }
 148
 149         /* Set up the alloc hint. This should be the data left to send. */
 150         u.response.alloc_hint = data_left;
 151
 152         /* Work out if this PDU will be the last. */
 153         if (data_sent_length + data_to_send >= rdata->length) {
 154                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 155         }
 156
 157         /* Prepare data to be NDR encoded. */
 158         u.response.stub_and_verifier =
 159                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 160
 161         /* Store the packet in the data stream. */
 162         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 163                                           pfc_flags, auth_len, call_id,
 164                                           &u, frag);
 165         if (!NT_STATUS_IS_OK(status)) {
 166                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 167                 return status;
 168         }
 169
 170         if (auth_len) {
 171                 /* Set the proper length on the pdu, including padding.
 172                  * Only needed if an auth trailer will be appended. */
 173                 dcerpc_set_frag_length(frag, frag->length
 174                                                 + pad_len
 175                                                 + DCERPC_AUTH_TRAILER_LENGTH
 176                                                 + auth_len);
 177         }
 178
 179         if (auth_len) {
 180                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 181                 if (!NT_STATUS_IS_OK(status)) {
 182                         data_blob_free(frag);
 183                         return status;
 184                 }
 185         }
 186
 187         *pdu_size = data_to_send;
 188         return NT_STATUS_OK;
 189 }
 190
 191 /*******************************************************************
 192  Generate the next PDU to be returned from the data in p->rdata.
 193 ********************************************************************/
 194
 195 bool create_next_pdu(struct pipes_struct *p)
 196 {
 197         size_t pdu_size = 0;
 198         NTSTATUS status;
 199
 200         /*
 201          * If we're in the fault state, keep returning fault PDU's until
 202          * the pipe gets closed. JRA.
 203          */
 204         if (p->fault_state) {
 205                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 206                 return true;
 207         }
 208
 209         status = create_next_packet(p->mem_ctx, &p->auth,
 210                                     p->call_id, &p->out_data.rdata,
 211                                     p->out_data.data_sent_length,
 212                                     &p->out_data.frag, &pdu_size);
 213         if (!NT_STATUS_IS_OK(status)) {
 214                 DEBUG(0, ("Failed to create packet with error %s, "
 215                           "(auth level %u / type %u)\n",
 216                           nt_errstr(status),
 217                           (unsigned int)p->auth.auth_level,
 218                           (unsigned int)p->auth.auth_type));
 219                 return false;
 220         }
 221
 222         /* Setup the counts for this PDU. */
 223         p->out_data.data_sent_length += pdu_size;
 224         p->out_data.current_pdu_sent = 0;
 225         return true;
 226 }
 227
 228
 229 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 230
 231 /*******************************************************************
 232  Marshall a bind_nak pdu.
 233 *******************************************************************/
 234
 235 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 236 {
 237         NTSTATUS status;
 238         union dcerpc_payload u;
 239
 240         /* Free any memory in the current return data buffer. */
 241         pipe_init_outgoing_data(p);
 242
 243         /*
 244          * Initialize a bind_nak header.
 245          */
 246
 247         ZERO_STRUCT(u);
 248
 249         u.bind_nak.reject_reason  = 0;
 250
 251         /*
 252          * Marshall directly into the outgoing PDU space. We
 253          * must do this as we need to set to the bind response
 254          * header and are never sending more than one PDU here.
 255          */
 256
 257         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 258                                           DCERPC_PKT_BIND_NAK,
 259                                           DCERPC_PFC_FLAG_FIRST |
 260                                                 DCERPC_PFC_FLAG_LAST,
 261                                           0,
 262                                           pkt->call_id,
 263                                           &u,
 264                                           &p->out_data.frag);
 265         if (!NT_STATUS_IS_OK(status)) {
 266                 return False;
 267         }
 268
 269         p->out_data.data_sent_length = 0;
 270         p->out_data.current_pdu_sent = 0;
 271
 272         TALLOC_FREE(p->auth.auth_ctx);
 273         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 274         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 275         p->pipe_bound = False;
 276
 277         return True;
 278 }
 279
 280 /*******************************************************************
 281  Marshall a fault pdu.
 282 *******************************************************************/
 283
 284 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 285 {
 286         NTSTATUS status;
 287         union dcerpc_payload u;
 288
 289         /* Free any memory in the current return data buffer. */
 290         pipe_init_outgoing_data(p);
 291
 292         /*
 293          * Initialize a fault header.
 294          */
 295
 296         ZERO_STRUCT(u);
 297
 298         u.fault.status          = NT_STATUS_V(fault_status);
 299         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 300
 301         /*
 302          * Marshall directly into the outgoing PDU space. We
 303          * must do this as we need to set to the bind response
 304          * header and are never sending more than one PDU here.
 305          */
 306
 307         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 308                                           DCERPC_PKT_FAULT,
 309                                           DCERPC_PFC_FLAG_FIRST |
 310                                            DCERPC_PFC_FLAG_LAST |
 311                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 312                                           0,
 313                                           p->call_id,
 314                                           &u,
 315                                           &p->out_data.frag);
 316         if (!NT_STATUS_IS_OK(status)) {
 317                 return False;
 318         }
 319
 320         p->out_data.data_sent_length = 0;
 321         p->out_data.current_pdu_sent = 0;
 322
 323         return True;
 324 }
 325
 326 /*******************************************************************
 327  Ensure a bind request has the correct abstract & transfer interface.
 328  Used to reject unknown binds from Win2k.
 329 *******************************************************************/
 330
 331 static bool check_bind_req(struct pipes_struct *p,
 332                            struct ndr_syntax_id* abstract,
 333                            struct ndr_syntax_id* transfer,
 334                            uint32_t context_id)
 335 {
 336         struct pipe_rpc_fns *context_fns;
 337         bool ok;
 338
 339         DEBUG(3,("check_bind_req for %s\n",
 340                  get_pipe_name_from_syntax(talloc_tos(), abstract)));
 341
 342         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 343         if (rpc_srv_pipe_exists_by_id(abstract) &&
 344            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 345                 DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
 346                           rpc_srv_get_pipe_cli_name(abstract),
 347                           rpc_srv_get_pipe_srv_name(abstract)));
 348         } else {
 349                 return false;
 350         }
 351
 352         ok = init_pipe_handles(p, abstract);
 353         if (!ok) {
 354                 DEBUG(1, ("Failed to init pipe handles!\n"));
 355                 return false;
 356         }
 357
 358         context_fns = talloc(p, struct pipe_rpc_fns);
 359         if (context_fns == NULL) {
 360                 DEBUG(0,("check_bind_req: talloc() failed!\n"));
 361                 return false;
 362         }
 363
 364         context_fns->next = context_fns->prev = NULL;
 365         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 366         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 367         context_fns->context_id = context_id;
 368         context_fns->syntax = *abstract;
 369
 370         /* add to the list of open contexts */
 371
 372         DLIST_ADD( p->contexts, context_fns );
 373
 374         return True;
 375 }
 376
 377 /**
 378  * Is a named pipe known?
 379  * @param[in] cli_filename      The pipe name requested by the client
 380  * @result                      Do we want to serve this?
 381  */
 382 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
 383 {
 384         const char *pipename = cli_filename;
 385         NTSTATUS status;
 386
 387         if (strnequal(pipename, "\\PIPE\\", 6)) {
 388                 pipename += 5;
 389         }
 390
 391         if (*pipename == '\\') {
 392                 pipename += 1;
 393         }
 394
 395         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 396                 DEBUG(10, ("refusing spoolss access\n"));
 397                 return false;
 398         }
 399
 400         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 401                 return true;
 402         }
 403
 404         status = smb_probe_module("rpc", pipename);
 405         if (!NT_STATUS_IS_OK(status)) {
 406                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
 407                 return false;
 408         }
 409         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 410
 411         /*
 412          * Scan the list again for the interface id
 413          */
 414         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 415                 return true;
 416         }
 417
 418         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 419                    pipename));
 420
 421         return false;
 422 }
 423
 424 /*******************************************************************
 425  Handle an schannel bind auth.
 426 *******************************************************************/
 427
 428 static bool pipe_schannel_auth_bind(struct pipes_struct *p,
 429                                     TALLOC_CTX *mem_ctx,
 430                                     struct dcerpc_auth *auth_info,
 431                                     DATA_BLOB *response)
 432 {
 433         struct NL_AUTH_MESSAGE neg;
 434         struct NL_AUTH_MESSAGE reply;
 435         bool ret;
 436         NTSTATUS status;
 437         struct netlogon_creds_CredentialState *creds;
 438         enum ndr_err_code ndr_err;
 439         struct schannel_state *schannel_auth;
 440         struct loadparm_context *lp_ctx;
 441
 442         ndr_err = ndr_pull_struct_blob(
 443                         &auth_info->credentials, mem_ctx, &neg,
 444                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
 445         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 446                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
 447                 return false;
 448         }
 449
 450         if (DEBUGLEVEL >= 10) {
 451                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
 452         }
 453
 454         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
 455                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
 456                 return false;
 457         }
 458
 459         lp_ctx = loadparm_init_s3(p, loadparm_s3_context());
 460         if (!lp_ctx) {
 461                 DEBUG(0,("pipe_schannel_auth_bind: loadparm_init_s3() failed!\n"));
 462                 return false;
 463         }
 464
 465         /*
 466          * The neg.oem_netbios_computer.a key here must match the remote computer name
 467          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
 468          * operations that use credentials.
 469          */
 470
 471         become_root();
 472         status = schannel_get_creds_state(p, lp_ctx,
 473                                             neg.oem_netbios_computer.a, &creds);
 474         unbecome_root();
 475
 476         talloc_unlink(p, lp_ctx);
 477         if (!NT_STATUS_IS_OK(status)) {
 478                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
 479                 return False;
 480         }
 481
 482         schannel_auth = talloc_zero(p, struct schannel_state);
 483         if (!schannel_auth) {
 484                 TALLOC_FREE(creds);
 485                 return False;
 486         }
 487
 488         schannel_auth->state = SCHANNEL_STATE_START;
 489         schannel_auth->initiator = false;
 490         schannel_auth->creds = creds;
 491
 492         /*
 493          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
 494          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
 495          * struct of the person who opened the pipe. I need to test this further. JRA.
 496          *
 497          * VL. As we are mapping this to guest set the generic key
 498          * "SystemLibraryDTC" key here. It's a bit difficult to test against
 499          * W2k3, as it does not allow schannel binds against SAMR and LSA
 500          * anymore.
 501          */
 502
 503         ret = session_info_set_session_key(p->session_info, generic_session_key());
 504
 505         if (!ret) {
 506                 DEBUG(0, ("session_info_set_session_key failed\n"));
 507                 return false;
 508         }
 509
 510         /*** SCHANNEL verifier ***/
 511
 512         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
 513         reply.Flags                             = 0;
 514         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
 515                                                       * this has any meaning
 516                                                       * here - gd */
 517
 518         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
 519                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 520         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 521                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
 522                 return false;
 523         }
 524
 525         if (DEBUGLEVEL >= 10) {
 526                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
 527         }
 528
 529         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
 530                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
 531
 532         /* We're finished with this bind - no more packets. */
 533         p->auth.auth_ctx = schannel_auth;
 534         p->auth.auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
 535
 536         p->pipe_bound = True;
 537
 538         return True;
 539 }
 540
 541 /*******************************************************************
 542  Handle an NTLMSSP bind auth.
 543 *******************************************************************/
 544
 545 static bool pipe_auth_generic_bind(struct pipes_struct *p,
 546                                    TALLOC_CTX *mem_ctx,
 547                                    struct dcerpc_auth *auth_info,
 548                                    DATA_BLOB *response)
 549 {
 550         struct gensec_security *gensec_security = NULL;
 551         NTSTATUS status;
 552
 553         status = auth_generic_server_authtype_start(p,
 554                                                     auth_info->auth_type,
 555                                                     auth_info->auth_level,
 556                                                     &auth_info->credentials,
 557                                                     response,
 558                                                     p->remote_address,
 559                                                     &gensec_security);
 560         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 561                 DEBUG(0, (__location__ ": auth_generic_server_authtype_start failed: %s\n",
 562                           nt_errstr(status)));
 563                 return false;
 564         }
 565
 566         /* Make sure data is bound to the memctx, to be freed the caller */
 567         talloc_steal(mem_ctx, response->data);
 568
 569         p->auth.auth_ctx = gensec_security;
 570         p->auth.auth_type = auth_info->auth_type;
 571
 572         return true;
 573 }
 574
 575 /*******************************************************************
 576  Process an NTLMSSP authentication response.
 577  If this function succeeds, the user has been authenticated
 578  and their domain, name and calling workstation stored in
 579  the pipe struct.
 580 *******************************************************************/
 581
 582 static bool pipe_auth_generic_verify_final(TALLOC_CTX *mem_ctx,
 583                                 struct gensec_security *gensec_security,
 584                                 enum dcerpc_AuthLevel auth_level,
 585                                 struct auth_session_info **session_info)
 586 {
 587         NTSTATUS status;
 588         bool ret;
 589
 590         DEBUG(5, (__location__ ": checking user details\n"));
 591
 592         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 593            ensure the underlying NTLMSSP flags are also set. If not we should
 594            refuse the bind. */
 595
 596         status = auth_generic_server_check_flags(gensec_security,
 597                                             (auth_level ==
 598                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 599                                             (auth_level ==
 600                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 601         if (!NT_STATUS_IS_OK(status)) {
 602                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 603                           "security for rpc connection\n"));
 604                 return false;
 605         }
 606
 607         TALLOC_FREE(*session_info);
 608
 609         status = auth_generic_server_get_user_info(gensec_security,
 610                                                 mem_ctx, session_info);
 611         if (!NT_STATUS_IS_OK(status)) {
 612                 DEBUG(0, (__location__ ": failed to obtain the server info "
 613                           "for authenticated user: %s\n", nt_errstr(status)));
 614                 return false;
 615         }
 616
 617         if ((*session_info)->security_token == NULL) {
 618                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 619                 return false;
 620         }
 621
 622         /*
 623          * We're an authenticated bind over smb, so the session key needs to
 624          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 625          * does. See the RPC-SAMBA3SESSIONKEY.
 626          */
 627
 628         ret = session_info_set_session_key((*session_info), generic_session_key());
 629         if (!ret) {
 630                 DEBUG(0, ("Failed to set session key!\n"));
 631                 return false;
 632         }
 633
 634         return true;
 635 }
 636
 637 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 638 {
 639         struct gensec_security *gensec_security;
 640
 641         switch (p->auth.auth_type) {
 642         case DCERPC_AUTH_TYPE_NTLMSSP:
 643         case DCERPC_AUTH_TYPE_KRB5:
 644         case DCERPC_AUTH_TYPE_SPNEGO:
 645                 gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
 646                                                         struct gensec_security);
 647                 if (!pipe_auth_generic_verify_final(p, gensec_security,
 648                                                 p->auth.auth_level,
 649                                                 &p->session_info)) {
 650                         return NT_STATUS_ACCESS_DENIED;
 651                 }
 652                 break;
 653         default:
 654                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
 655                           (unsigned int)p->auth.auth_type));
 656                 return NT_STATUS_ACCESS_DENIED;
 657         }
 658
 659         p->pipe_bound = true;
 660
 661         return NT_STATUS_OK;
 662 }
 663
 664 /*******************************************************************
 665  Respond to a pipe bind request.
 666 *******************************************************************/
 667
 668 static bool api_pipe_bind_req(struct pipes_struct *p,
 669                                 struct ncacn_packet *pkt)
 670 {
 671         struct dcerpc_auth auth_info;
 672         uint16 assoc_gid;
 673         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
 674         NTSTATUS status;
 675         struct ndr_syntax_id id;
 676         union dcerpc_payload u;
 677         struct dcerpc_ack_ctx bind_ack_ctx;
 678         DATA_BLOB auth_resp = data_blob_null;
 679         DATA_BLOB auth_blob = data_blob_null;
 680
 681         /* No rebinds on a bound pipe - use alter context. */
 682         if (p->pipe_bound) {
 683                 DEBUG(2,("Rejecting bind request on bound rpc connection\n"));
 684                 return setup_bind_nak(p, pkt);
 685         }
 686
 687         if (pkt->u.bind.num_contexts == 0) {
 688                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
 689                 goto err_exit;
 690         }
 691
 692         /*
 693          * Try and find the correct pipe name to ensure
 694          * that this is a pipe name we support.
 695          */
 696         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 697         if (rpc_srv_pipe_exists_by_id(&id)) {
 698                 DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 699                           rpc_srv_get_pipe_cli_name(&id),
 700                           rpc_srv_get_pipe_srv_name(&id)));
 701         } else {
 702                 status = smb_probe_module(
 703                         "rpc", get_pipe_name_from_syntax(
 704                                 talloc_tos(),
 705                                 &id));
 706
 707                 if (NT_STATUS_IS_ERR(status)) {
 708                         DEBUG(3,("api_pipe_bind_req: Unknown rpc service name "
 709                                  "%s in bind request.\n",
 710                                  get_pipe_name_from_syntax(talloc_tos(), &id)));
 711
 712                         return setup_bind_nak(p, pkt);
 713                 }
 714
 715                 if (rpc_srv_get_pipe_interface_by_cli_name(
 716                                 get_pipe_name_from_syntax(talloc_tos(),
 717                                                           &id),
 718                                 &id)) {
 719                         DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 720                                   rpc_srv_get_pipe_cli_name(&id),
 721                                   rpc_srv_get_pipe_srv_name(&id)));
 722                 } else {
 723                         DEBUG(0, ("module %s doesn't provide functions for "
 724                                   "pipe %s!\n",
 725                                   get_pipe_name_from_syntax(talloc_tos(), &id),
 726                                   get_pipe_name_from_syntax(talloc_tos(), &id)));
 727                         return setup_bind_nak(p, pkt);
 728                 }
 729         }
 730
 731         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 732
 733         if (pkt->u.bind.assoc_group_id != 0) {
 734                 assoc_gid = pkt->u.bind.assoc_group_id;
 735         } else {
 736                 assoc_gid = 0x53f0;
 737         }
 738
 739         /*
 740          * Create the bind response struct.
 741          */
 742
 743         /* If the requested abstract synt uuid doesn't match our client pipe,
 744                 reject the bind_ack & set the transfer interface synt to all 0's,
 745                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 746                 unknown to NT4)
 747                 Needed when adding entries to a DACL from NT5 - SK */
 748
 749         if (check_bind_req(p,
 750                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 751                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 752                         pkt->u.bind.ctx_list[0].context_id)) {
 753
 754                 bind_ack_ctx.result = 0;
 755                 bind_ack_ctx.reason = 0;
 756                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 757         } else {
 758                 p->pipe_bound = False;
 759                 /* Rejection reason: abstract syntax not supported */
 760                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 761                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
 762                 bind_ack_ctx.syntax = null_ndr_syntax_id;
 763         }
 764
 765         /*
 766          * Check if this is an authenticated bind request.
 767          */
 768         if (pkt->auth_length) {
 769                 /* Quick length check. Won't catch a bad auth footer,
 770                  * prevents overrun. */
 771
 772                 if (pkt->frag_length < RPC_HEADER_LEN +
 773                                         DCERPC_AUTH_TRAILER_LENGTH +
 774                                         pkt->auth_length) {
 775                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
 776                                 "too long for fragment %u.\n",
 777                                 (unsigned int)pkt->auth_length,
 778                                 (unsigned int)pkt->frag_length));
 779                         goto err_exit;
 780                 }
 781
 782                 /*
 783                  * Decode the authentication verifier.
 784                  */
 785                 status = dcerpc_pull_dcerpc_auth(pkt,
 786                                                  &pkt->u.bind.auth_info,
 787                                                  &auth_info, p->endian);
 788                 if (!NT_STATUS_IS_OK(status)) {
 789                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
 790                         goto err_exit;
 791                 }
 792
 793                 auth_type = auth_info.auth_type;
 794
 795                 /* Work out if we have to sign or seal etc. */
 796                 switch (auth_info.auth_level) {
 797                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 798                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 799                         break;
 800                 case DCERPC_AUTH_LEVEL_PRIVACY:
 801                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 802                         break;
 803                 case DCERPC_AUTH_LEVEL_CONNECT:
 804                         p->auth.auth_level = DCERPC_AUTH_LEVEL_CONNECT;
 805                         break;
 806                 default:
 807                         DEBUG(0, ("Unexpected auth level (%u).\n",
 808                                 (unsigned int)auth_info.auth_level ));
 809                         goto err_exit;
 810                 }
 811
 812                 switch (auth_type) {
 813                 case DCERPC_AUTH_TYPE_NTLMSSP:
 814                         if (!pipe_auth_generic_bind(p, pkt,
 815                                                     &auth_info, &auth_resp)) {
 816                                 goto err_exit;
 817                         }
 818                         assoc_gid = 0x7a77;
 819                         break;
 820
 821                 case DCERPC_AUTH_TYPE_SCHANNEL:
 822                         if (!pipe_schannel_auth_bind(p, pkt,
 823                                                 &auth_info, &auth_resp)) {
 824                                 goto err_exit;
 825                         }
 826                         break;
 827
 828                 case DCERPC_AUTH_TYPE_SPNEGO:
 829                 case DCERPC_AUTH_TYPE_KRB5:
 830                         if (!pipe_auth_generic_bind(p, pkt,
 831                                                     &auth_info, &auth_resp)) {
 832                                 goto err_exit;
 833                         }
 834                         break;
 835
 836                 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
 837                         if (p->transport == NCALRPC && p->ncalrpc_as_system) {
 838                                 TALLOC_FREE(p->session_info);
 839
 840                                 status = make_session_info_system(p,
 841                                                                   &p->session_info);
 842                                 if (!NT_STATUS_IS_OK(status)) {
 843                                         goto err_exit;
 844                                 }
 845
 846                                 auth_resp = data_blob_talloc(pkt,
 847                                                              "NCALRPC_AUTH_OK",
 848                                                              15);
 849
 850                                 p->auth.auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
 851                                 p->pipe_bound = true;
 852                         } else {
 853                                 goto err_exit;
 854                         }
 855                         break;
 856
 857                 case DCERPC_AUTH_TYPE_NONE:
 858                         break;
 859
 860                 default:
 861                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
 862                         goto err_exit;
 863                 }
 864         }
 865
 866         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
 867                 /* Unauthenticated bind request. */
 868                 /* We're finished - no more packets. */
 869                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 870                 /* We must set the pipe auth_level here also. */
 871                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 872                 p->pipe_bound = True;
 873                 /* The session key was initialized from the SMB
 874                  * session in make_internal_rpc_pipe_p */
 875         }
 876
 877         ZERO_STRUCT(u.bind_ack);
 878         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
 879         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
 880         u.bind_ack.assoc_group_id = assoc_gid;
 881
 882         /* name has to be \PIPE\xxxxx */
 883         u.bind_ack.secondary_address =
 884                         talloc_asprintf(pkt, "\\PIPE\\%s",
 885                                         rpc_srv_get_pipe_srv_name(&id));
 886         if (!u.bind_ack.secondary_address) {
 887                 DEBUG(0, ("Out of memory!\n"));
 888                 goto err_exit;
 889         }
 890         u.bind_ack.secondary_address_size =
 891                                 strlen(u.bind_ack.secondary_address) + 1;
 892
 893         u.bind_ack.num_results = 1;
 894         u.bind_ack.ctx_list = &bind_ack_ctx;
 895
 896         /* NOTE: We leave the auth_info empty so we can calculate the padding
 897          * later and then append the auth_info --simo */
 898
 899         /*
 900          * Marshall directly into the outgoing PDU space. We
 901          * must do this as we need to set to the bind response
 902          * header and are never sending more than one PDU here.
 903          */
 904
 905         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 906                                           DCERPC_PKT_BIND_ACK,
 907                                           DCERPC_PFC_FLAG_FIRST |
 908                                                 DCERPC_PFC_FLAG_LAST,
 909                                           auth_resp.length,
 910                                           pkt->call_id,
 911                                           &u,
 912                                           &p->out_data.frag);
 913         if (!NT_STATUS_IS_OK(status)) {
 914                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
 915                           nt_errstr(status)));
 916         }
 917
 918         if (auth_resp.length) {
 919
 920                 status = dcerpc_push_dcerpc_auth(pkt,
 921                                                  auth_type,
 922                                                  auth_info.auth_level,
 923                                                  0,
 924                                                  1, /* auth_context_id */
 925                                                  &auth_resp,
 926                                                  &auth_blob);
 927                 if (!NT_STATUS_IS_OK(status)) {
 928                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
 929                         goto err_exit;
 930                 }
 931         }
 932
 933         /* Now that we have the auth len store it into the right place in
 934          * the dcerpc header */
 935         dcerpc_set_frag_length(&p->out_data.frag,
 936                                 p->out_data.frag.length + auth_blob.length);
 937
 938         if (auth_blob.length) {
 939
 940                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
 941                                         auth_blob.data, auth_blob.length)) {
 942                         DEBUG(0, ("Append of auth info failed.\n"));
 943                         goto err_exit;
 944                 }
 945         }
 946
 947         /*
 948          * Setup the lengths for the initial reply.
 949          */
 950
 951         p->out_data.data_sent_length = 0;
 952         p->out_data.current_pdu_sent = 0;
 953
 954         TALLOC_FREE(auth_blob.data);
 955         return True;
 956
 957   err_exit:
 958
 959         data_blob_free(&p->out_data.frag);
 960         TALLOC_FREE(auth_blob.data);
 961         return setup_bind_nak(p, pkt);
 962 }
 963
 964 /*******************************************************************
 965  This is the "stage3" response after a bind request and reply.
 966 *******************************************************************/
 967
 968 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
 969 {
 970         struct dcerpc_auth auth_info;
 971         DATA_BLOB response = data_blob_null;
 972         struct gensec_security *gensec_security;
 973         NTSTATUS status;
 974
 975         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 976
 977         if (pkt->auth_length == 0) {
 978                 DEBUG(0, ("No auth field sent for bind request!\n"));
 979                 goto err;
 980         }
 981
 982         /* Ensure there's enough data for an authenticated request. */
 983         if (pkt->frag_length < RPC_HEADER_LEN
 984                                 + DCERPC_AUTH_TRAILER_LENGTH
 985                                 + pkt->auth_length) {
 986                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
 987                                 "%u is too large.\n",
 988                         (unsigned int)pkt->auth_length));
 989                 goto err;
 990         }
 991
 992         /*
 993          * Decode the authentication verifier response.
 994          */
 995
 996         status = dcerpc_pull_dcerpc_auth(pkt,
 997                                          &pkt->u.auth3.auth_info,
 998                                          &auth_info, p->endian);
 999         if (!NT_STATUS_IS_OK(status)) {
1000                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
1001                 goto err;
1002         }
1003
1004         /* We must NEVER look at auth_info->auth_pad_len here,
1005          * as old Samba client code gets it wrong and sends it
1006          * as zero. JRA.
1007          */
1008
1009         if (auth_info.auth_type != p->auth.auth_type) {
1010                 DEBUG(0, ("Auth type mismatch! Client sent %d, "
1011                           "but auth was started as type %d!\n",
1012                           auth_info.auth_type, p->auth.auth_type));
1013                 goto err;
1014         }
1015
1016         switch (auth_info.auth_type) {
1017         case DCERPC_AUTH_TYPE_NTLMSSP:
1018         case DCERPC_AUTH_TYPE_KRB5:
1019         case DCERPC_AUTH_TYPE_SPNEGO:
1020                 gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
1021                                                     struct gensec_security);
1022                 status = auth_generic_server_step(gensec_security,
1023                                              pkt, &auth_info.credentials,
1024                                              &response);
1025                 break;
1026         default:
1027                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
1028                           (unsigned int)auth_info.auth_type));
1029                 return false;
1030         }
1031
1032         if (NT_STATUS_EQUAL(status,
1033                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1034             response.length) {
1035                 DEBUG(0, (__location__ ": This was supposed to be the final "
1036                           "leg, but crypto machinery claims a response is "
1037                           "needed, aborting auth!\n"));
1038                 data_blob_free(&response);
1039                 goto err;
1040         }
1041         if (!NT_STATUS_IS_OK(status)) {
1042                 DEBUG(0, ("Auth failed (%s)\n", nt_errstr(status)));
1043                 goto err;
1044         }
1045
1046         /* Now verify auth was indeed successful and extract server info */
1047         status = pipe_auth_verify_final(p);
1048         if (!NT_STATUS_IS_OK(status)) {
1049                 DEBUG(0, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1050                 goto err;
1051         }
1052
1053         return true;
1054
1055 err:
1056
1057         TALLOC_FREE(p->auth.auth_ctx);
1058         return false;
1059 }
1060
1061 /****************************************************************************
1062  Deal with an alter context call. Can be third part of 3 leg auth request for
1063  SPNEGO calls.
1064 ****************************************************************************/
1065
1066 static bool api_pipe_alter_context(struct pipes_struct *p,
1067                                         struct ncacn_packet *pkt)
1068 {
1069         struct dcerpc_auth auth_info;
1070         uint16 assoc_gid;
1071         NTSTATUS status;
1072         union dcerpc_payload u;
1073         struct dcerpc_ack_ctx bind_ack_ctx;
1074         DATA_BLOB auth_resp = data_blob_null;
1075         DATA_BLOB auth_blob = data_blob_null;
1076         int pad_len = 0;
1077         struct gensec_security *gensec_security;
1078
1079         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1080
1081         if (pkt->u.bind.assoc_group_id != 0) {
1082                 assoc_gid = pkt->u.bind.assoc_group_id;
1083         } else {
1084                 assoc_gid = 0x53f0;
1085         }
1086
1087         /*
1088          * Create the bind response struct.
1089          */
1090
1091         /* If the requested abstract synt uuid doesn't match our client pipe,
1092                 reject the bind_ack & set the transfer interface synt to all 0's,
1093                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1094                 unknown to NT4)
1095                 Needed when adding entries to a DACL from NT5 - SK */
1096
1097         if (check_bind_req(p,
1098                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1099                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1100                         pkt->u.bind.ctx_list[0].context_id)) {
1101
1102                 bind_ack_ctx.result = 0;
1103                 bind_ack_ctx.reason = 0;
1104                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1105         } else {
1106                 p->pipe_bound = False;
1107                 /* Rejection reason: abstract syntax not supported */
1108                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1109                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1110                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1111         }
1112
1113         /*
1114          * Check if this is an authenticated alter context request.
1115          */
1116         if (pkt->auth_length) {
1117                 /* Quick length check. Won't catch a bad auth footer,
1118                  * prevents overrun. */
1119
1120                 if (pkt->frag_length < RPC_HEADER_LEN +
1121                                         DCERPC_AUTH_TRAILER_LENGTH +
1122                                         pkt->auth_length) {
1123                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1124                                 "too long for fragment %u.\n",
1125                                 (unsigned int)pkt->auth_length,
1126                                 (unsigned int)pkt->frag_length ));
1127                         goto err_exit;
1128                 }
1129
1130                 status = dcerpc_pull_dcerpc_auth(pkt,
1131                                                  &pkt->u.bind.auth_info,
1132                                                  &auth_info, p->endian);
1133                 if (!NT_STATUS_IS_OK(status)) {
1134                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1135                         goto err_exit;
1136                 }
1137
1138                 /* We can only finish if the pipe is unbound for now */
1139                 if (p->pipe_bound) {
1140                         DEBUG(0, (__location__ ": Pipe already bound, "
1141                                   "Altering Context not yet supported!\n"));
1142                         goto err_exit;
1143                 }
1144
1145                 if (auth_info.auth_type != p->auth.auth_type) {
1146                         DEBUG(0, ("Auth type mismatch! Client sent %d, "
1147                                   "but auth was started as type %d!\n",
1148                                   auth_info.auth_type, p->auth.auth_type));
1149                         goto err_exit;
1150                 }
1151
1152
1153                 switch (auth_info.auth_type) {
1154                 case DCERPC_AUTH_TYPE_SPNEGO:
1155                 case DCERPC_AUTH_TYPE_KRB5:
1156                 case DCERPC_AUTH_TYPE_NTLMSSP:
1157                         gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
1158                                                     struct gensec_security);
1159                         status = auth_generic_server_step(gensec_security,
1160                                                      pkt,
1161                                                      &auth_info.credentials,
1162                                                      &auth_resp);
1163                         break;
1164
1165                 default:
1166                         DEBUG(3, (__location__ ": Usupported auth type (%d) "
1167                                   "in alter-context call\n",
1168                                   auth_info.auth_type));
1169                         goto err_exit;
1170                 }
1171
1172                 if (NT_STATUS_IS_OK(status)) {
1173                         /* third leg of auth, verify auth info */
1174                         status = pipe_auth_verify_final(p);
1175                         if (!NT_STATUS_IS_OK(status)) {
1176                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1177                                           nt_errstr(status)));
1178                                 goto err_exit;
1179                         }
1180                 } else if (NT_STATUS_EQUAL(status,
1181                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1182                         DEBUG(10, ("More auth legs required.\n"));
1183                 } else {
1184                         DEBUG(0, ("Auth step returned an error (%s)\n",
1185                                   nt_errstr(status)));
1186                         goto err_exit;
1187                 }
1188         }
1189
1190         ZERO_STRUCT(u.alter_resp);
1191         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1192         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1193         u.alter_resp.assoc_group_id = assoc_gid;
1194
1195         /* secondary address CAN be NULL
1196          * as the specs say it's ignored.
1197          * It MUST be NULL to have the spoolss working.
1198          */
1199         u.alter_resp.secondary_address = "";
1200         u.alter_resp.secondary_address_size = 1;
1201
1202         u.alter_resp.num_results = 1;
1203         u.alter_resp.ctx_list = &bind_ack_ctx;
1204
1205         /* NOTE: We leave the auth_info empty so we can calculate the padding
1206          * later and then append the auth_info --simo */
1207
1208         /*
1209          * Marshall directly into the outgoing PDU space. We
1210          * must do this as we need to set to the bind response
1211          * header and are never sending more than one PDU here.
1212          */
1213
1214         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1215                                           DCERPC_PKT_ALTER_RESP,
1216                                           DCERPC_PFC_FLAG_FIRST |
1217                                                 DCERPC_PFC_FLAG_LAST,
1218                                           auth_resp.length,
1219                                           pkt->call_id,
1220                                           &u,
1221                                           &p->out_data.frag);
1222         if (!NT_STATUS_IS_OK(status)) {
1223                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1224                           nt_errstr(status)));
1225         }
1226
1227         if (auth_resp.length) {
1228
1229                 /* Work out any padding needed before the auth footer. */
1230                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1231                 if (pad_len) {
1232                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1233                         DEBUG(10, ("auth pad_len = %u\n",
1234                                    (unsigned int)pad_len));
1235                 }
1236
1237                 status = dcerpc_push_dcerpc_auth(pkt,
1238                                                  auth_info.auth_type,
1239                                                  auth_info.auth_level,
1240                                                  pad_len,
1241                                                  1, /* auth_context_id */
1242                                                  &auth_resp,
1243                                                  &auth_blob);
1244                 if (!NT_STATUS_IS_OK(status)) {
1245                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1246                         goto err_exit;
1247                 }
1248         }
1249
1250         /* Now that we have the auth len store it into the right place in
1251          * the dcerpc header */
1252         dcerpc_set_frag_length(&p->out_data.frag,
1253                                 p->out_data.frag.length +
1254                                         pad_len + auth_blob.length);
1255
1256         if (auth_resp.length) {
1257                 if (pad_len) {
1258                         char pad[SERVER_NDR_PADDING_SIZE];
1259                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1260                         if (!data_blob_append(p->mem_ctx,
1261                                                 &p->out_data.frag,
1262                                                 pad, pad_len)) {
1263                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1264                                           "%u bytes of pad data.\n",
1265                                           (unsigned int)pad_len));
1266                                 goto err_exit;
1267                         }
1268                 }
1269
1270                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1271                                         auth_blob.data, auth_blob.length)) {
1272                         DEBUG(0, ("Append of auth info failed.\n"));
1273                         goto err_exit;
1274                 }
1275         }
1276
1277         /*
1278          * Setup the lengths for the initial reply.
1279          */
1280
1281         p->out_data.data_sent_length = 0;
1282         p->out_data.current_pdu_sent = 0;
1283
1284         TALLOC_FREE(auth_blob.data);
1285         return True;
1286
1287   err_exit:
1288
1289         data_blob_free(&p->out_data.frag);
1290         TALLOC_FREE(auth_blob.data);
1291         return setup_bind_nak(p, pkt);
1292 }
1293
1294 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1295                        const struct api_struct *api_rpc_cmds, int n_cmds,
1296                        const struct ndr_syntax_id *syntax);
1297
1298 /****************************************************************************
1299  Find the correct RPC function to call for this request.
1300  If the pipe is authenticated then become the correct UNIX user
1301  before doing the call.
1302 ****************************************************************************/
1303
1304 static bool api_pipe_request(struct pipes_struct *p,
1305                                 struct ncacn_packet *pkt)
1306 {
1307         bool ret = False;
1308         struct pipe_rpc_fns *pipe_fns;
1309
1310         if (!p->pipe_bound) {
1311                 DEBUG(1, ("Pipe not bound!\n"));
1312                 data_blob_free(&p->out_data.rdata);
1313                 return false;
1314         }
1315
1316         if (!become_authenticated_pipe_user(p->session_info)) {
1317                 DEBUG(1, ("Failed to become pipe user!\n"));
1318                 data_blob_free(&p->out_data.rdata);
1319                 return false;
1320         }
1321
1322         /* get the set of RPC functions for this context */
1323
1324         pipe_fns = find_pipe_fns_by_context(p->contexts,
1325                                             pkt->u.request.context_id);
1326
1327         if ( pipe_fns ) {
1328                 TALLOC_CTX *frame = talloc_stackframe();
1329
1330                 DEBUG(5, ("Requested %s rpc service\n",
1331                           get_pipe_name_from_syntax(talloc_tos(), &pipe_fns->syntax)));
1332
1333                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds,
1334                                  &pipe_fns->syntax);
1335
1336                 TALLOC_FREE(frame);
1337         }
1338         else {
1339                 DEBUG(0, ("No rpc function table associated with context "
1340                           "[%d]\n",
1341                           pkt->u.request.context_id));
1342         }
1343
1344         unbecome_authenticated_pipe_user();
1345
1346         return ret;
1347 }
1348
1349 /*******************************************************************
1350  Calls the underlying RPC function for a named pipe.
1351  ********************************************************************/
1352
1353 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1354                        const struct api_struct *api_rpc_cmds, int n_cmds,
1355                        const struct ndr_syntax_id *syntax)
1356 {
1357         int fn_num;
1358         uint32_t offset1;
1359
1360         /* interpret the command */
1361         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1362                  get_pipe_name_from_syntax(talloc_tos(), syntax),
1363                  pkt->u.request.opnum));
1364
1365         if (DEBUGLEVEL >= 50) {
1366                 fstring name;
1367                 slprintf(name, sizeof(name)-1, "in_%s",
1368                          get_pipe_name_from_syntax(talloc_tos(), syntax));
1369                 dump_pdu_region(name, pkt->u.request.opnum,
1370                                 &p->in_data.data, 0,
1371                                 p->in_data.data.length);
1372         }
1373
1374         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1375                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1376                     api_rpc_cmds[fn_num].fn != NULL) {
1377                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1378                                   api_rpc_cmds[fn_num].name));
1379                         break;
1380                 }
1381         }
1382
1383         if (fn_num == n_cmds) {
1384                 /*
1385                  * For an unknown RPC just return a fault PDU but
1386                  * return True to allow RPC's on the pipe to continue
1387                  * and not put the pipe into fault state. JRA.
1388                  */
1389                 DEBUG(4, ("unknown\n"));
1390                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1391                 return True;
1392         }
1393
1394         offset1 = p->out_data.rdata.length;
1395
1396         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1397                 fn_num, api_rpc_cmds[fn_num].fn));
1398         /* do the actual command */
1399         if(!api_rpc_cmds[fn_num].fn(p)) {
1400                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1401                          get_pipe_name_from_syntax(talloc_tos(), syntax),
1402                          api_rpc_cmds[fn_num].name));
1403                 data_blob_free(&p->out_data.rdata);
1404                 return False;
1405         }
1406
1407         if (p->bad_handle_fault_state) {
1408                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1409                 p->bad_handle_fault_state = False;
1410                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
1411                 return True;
1412         }
1413
1414         if (p->rng_fault_state) {
1415                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
1416                 p->rng_fault_state = False;
1417                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1418                 return True;
1419         }
1420
1421         if (DEBUGLEVEL >= 50) {
1422                 fstring name;
1423                 slprintf(name, sizeof(name)-1, "out_%s",
1424                          get_pipe_name_from_syntax(talloc_tos(), syntax));
1425                 dump_pdu_region(name, pkt->u.request.opnum,
1426                                 &p->out_data.rdata, offset1,
1427                                 p->out_data.rdata.length);
1428         }
1429
1430         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1431                  get_pipe_name_from_syntax(talloc_tos(), syntax)));
1432
1433         /* Check for buffer underflow in rpc parsing */
1434         if ((DEBUGLEVEL >= 10) &&
1435             (pkt->frag_length < p->in_data.data.length)) {
1436                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1437                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1438                               p->in_data.data.length - pkt->frag_length);
1439         }
1440
1441         return True;
1442 }
1443
1444 /****************************************************************************
1445  Initialise an outgoing packet.
1446 ****************************************************************************/
1447
1448 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1449 {
1450         output_data *o_data = &p->out_data;
1451
1452         /* Reset the offset counters. */
1453         o_data->data_sent_length = 0;
1454         o_data->current_pdu_sent = 0;
1455
1456         data_blob_free(&o_data->frag);
1457
1458         /* Free any memory in the current return data buffer. */
1459         data_blob_free(&o_data->rdata);
1460
1461         return True;
1462 }
1463
1464 /****************************************************************************
1465  Sets the fault state on incoming packets.
1466 ****************************************************************************/
1467
1468 void set_incoming_fault(struct pipes_struct *p)
1469 {
1470         data_blob_free(&p->in_data.data);
1471         p->in_data.pdu_needed_len = 0;
1472         p->in_data.pdu.length = 0;
1473         p->fault_state = True;
1474
1475         DEBUG(10, ("Setting fault state\n"));
1476 }
1477
1478 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1479                                     struct ncacn_packet *pkt,
1480                                     DATA_BLOB *raw_pkt)
1481 {
1482         NTSTATUS status;
1483         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1484         size_t pad_len;
1485
1486         DEBUG(10, ("Checking request auth.\n"));
1487
1488         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1489                 hdr_size += 16;
1490         }
1491
1492         /* in case of sealing this function will unseal the data in place */
1493         status = dcerpc_check_auth(auth, pkt,
1494                                    &pkt->u.request.stub_and_verifier,
1495                                    hdr_size, raw_pkt,
1496                                    &pad_len);
1497         if (!NT_STATUS_IS_OK(status)) {
1498                 return status;
1499         }
1500
1501
1502         /* remove padding and auth trailer,
1503          * this way the caller will get just the data */
1504         if (pkt->auth_length) {
1505                 size_t trail_len = pad_len
1506                                         + DCERPC_AUTH_TRAILER_LENGTH
1507                                         + pkt->auth_length;
1508                 if (pkt->u.request.stub_and_verifier.length < trail_len) {
1509                         return NT_STATUS_INFO_LENGTH_MISMATCH;
1510                 }
1511                 pkt->u.request.stub_and_verifier.length -= trail_len;
1512         }
1513
1514         return NT_STATUS_OK;
1515 }
1516
1517 /****************************************************************************
1518  Processes a request pdu. This will do auth processing if needed, and
1519  appends the data into the complete stream if the LAST flag is not set.
1520 ****************************************************************************/
1521
1522 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1523 {
1524         NTSTATUS status;
1525         DATA_BLOB data;
1526
1527         if (!p->pipe_bound) {
1528                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1529                 set_incoming_fault(p);
1530                 return False;
1531         }
1532
1533         /* Store the opnum */
1534         p->opnum = pkt->u.request.opnum;
1535
1536         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1537         if (!NT_STATUS_IS_OK(status)) {
1538                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1539                           nt_errstr(status)));
1540                 set_incoming_fault(p);
1541                 return false;
1542         }
1543
1544         data = pkt->u.request.stub_and_verifier;
1545
1546         /*
1547          * Check the data length doesn't go over the 15Mb limit.
1548          * increased after observing a bug in the Windows NT 4.0 SP6a
1549          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1550          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1551          */
1552
1553         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1554                 DEBUG(0, ("process_request_pdu: "
1555                           "rpc data buffer too large (%u) + (%u)\n",
1556                           (unsigned int)p->in_data.data.length,
1557                           (unsigned int)data.length));
1558                 set_incoming_fault(p);
1559                 return False;
1560         }
1561
1562         /*
1563          * Append the data portion into the buffer and return.
1564          */
1565
1566         if (data.length) {
1567                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1568                                           data.data, data.length)) {
1569                         DEBUG(0, ("Unable to append data size %u "
1570                                   "to parse buffer of size %u.\n",
1571                                   (unsigned int)data.length,
1572                                   (unsigned int)p->in_data.data.length));
1573                         set_incoming_fault(p);
1574                         return False;
1575                 }
1576         }
1577
1578         if (pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1579                 bool ret = False;
1580                 /*
1581                  * Ok - we finally have a complete RPC stream.
1582                  * Call the rpc command to process it.
1583                  */
1584
1585                 /*
1586                  * Process the complete data stream here.
1587                  */
1588                 if (pipe_init_outgoing_data(p)) {
1589                         ret = api_pipe_request(p, pkt);
1590                 }
1591
1592                 return ret;
1593         }
1594
1595         return True;
1596 }
1597
1598 /****************************************************************************
1599  Processes a finished PDU stored in p->in_data.pdu.
1600 ****************************************************************************/
1601
1602 void process_complete_pdu(struct pipes_struct *p)
1603 {
1604         struct ncacn_packet *pkt = NULL;
1605         NTSTATUS status;
1606         bool reply = False;
1607
1608         if(p->fault_state) {
1609                 DEBUG(10,("RPC connection in fault state.\n"));
1610                 goto done;
1611         }
1612
1613         pkt = talloc(p->mem_ctx, struct ncacn_packet);
1614         if (!pkt) {
1615                 DEBUG(0, ("Out of memory!\n"));
1616                 goto done;
1617         }
1618
1619         /*
1620          * Ensure we're using the corrent endianness for both the
1621          * RPC header flags and the raw data we will be reading from.
1622          */
1623         if (dcerpc_get_endian_flag(&p->in_data.pdu) & DCERPC_DREP_LE) {
1624                 p->endian = RPC_LITTLE_ENDIAN;
1625         } else {
1626                 p->endian = RPC_BIG_ENDIAN;
1627         }
1628         DEBUG(10, ("PDU is in %s Endian format!\n", p->endian?"Big":"Little"));
1629
1630         status = dcerpc_pull_ncacn_packet(pkt, &p->in_data.pdu,
1631                                           pkt, p->endian);
1632         if (!NT_STATUS_IS_OK(status)) {
1633                 DEBUG(0, ("Failed to unmarshal rpc packet: %s!\n",
1634                           nt_errstr(status)));
1635                 goto done;
1636         }
1637
1638         /* Store the call_id */
1639         p->call_id = pkt->call_id;
1640
1641         DEBUG(10, ("Processing packet type %u\n", (unsigned int)pkt->ptype));
1642
1643         switch (pkt->ptype) {
1644         case DCERPC_PKT_REQUEST:
1645                 reply = process_request_pdu(p, pkt);
1646                 break;
1647
1648         case DCERPC_PKT_PING: /* CL request - ignore... */
1649                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1650                           (unsigned int)pkt->ptype));
1651                 break;
1652
1653         case DCERPC_PKT_RESPONSE: /* No responses here. */
1654                 DEBUG(0, ("Error - DCERPC_PKT_RESPONSE received from client"));
1655                 break;
1656
1657         case DCERPC_PKT_FAULT:
1658         case DCERPC_PKT_WORKING:
1659                 /* CL request - reply to a ping when a call in process. */
1660         case DCERPC_PKT_NOCALL:
1661                 /* CL - server reply to a ping call. */
1662         case DCERPC_PKT_REJECT:
1663         case DCERPC_PKT_ACK:
1664         case DCERPC_PKT_CL_CANCEL:
1665         case DCERPC_PKT_FACK:
1666         case DCERPC_PKT_CANCEL_ACK:
1667                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1668                           (unsigned int)pkt->ptype));
1669                 break;
1670
1671         case DCERPC_PKT_BIND:
1672                 /*
1673                  * We assume that a pipe bind is only in one pdu.
1674                  */
1675                 if (pipe_init_outgoing_data(p)) {
1676                         reply = api_pipe_bind_req(p, pkt);
1677                 }
1678                 break;
1679
1680         case DCERPC_PKT_BIND_ACK:
1681         case DCERPC_PKT_BIND_NAK:
1682                 DEBUG(0, ("Error - DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1683                           "packet type %u received.\n",
1684                           (unsigned int)pkt->ptype));
1685                 break;
1686
1687
1688         case DCERPC_PKT_ALTER:
1689                 /*
1690                  * We assume that a pipe bind is only in one pdu.
1691                  */
1692                 if (pipe_init_outgoing_data(p)) {
1693                         reply = api_pipe_alter_context(p, pkt);
1694                 }
1695                 break;
1696
1697         case DCERPC_PKT_ALTER_RESP:
1698                 DEBUG(0, ("Error - DCERPC_PKT_ALTER_RESP received: "
1699                           "Should only be server -> client.\n"));
1700                 break;
1701
1702         case DCERPC_PKT_AUTH3:
1703                 /*
1704                  * The third packet in an auth exchange.
1705                  */
1706                 if (pipe_init_outgoing_data(p)) {
1707                         reply = api_pipe_bind_auth3(p, pkt);
1708                 }
1709                 break;
1710
1711         case DCERPC_PKT_SHUTDOWN:
1712                 DEBUG(0, ("Error - DCERPC_PKT_SHUTDOWN received: "
1713                           "Should only be server -> client.\n"));
1714                 break;
1715
1716         case DCERPC_PKT_CO_CANCEL:
1717                 /* For now just free all client data and continue
1718                  * processing. */
1719                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1720                          " Abandoning rpc call.\n"));
1721                 /* As we never do asynchronous RPC serving, we can
1722                  * never cancel a call (as far as I know).
1723                  * If we ever did we'd have to send a cancel_ack reply.
1724                  * For now, just free all client data and continue
1725                  * processing. */
1726                 reply = True;
1727                 break;
1728
1729 #if 0
1730                 /* Enable this if we're doing async rpc. */
1731                 /* We must check the outstanding callid matches. */
1732                 if (pipe_init_outgoing_data(p)) {
1733                         /* Send a cancel_ack PDU reply. */
1734                         /* We should probably check the auth-verifier here. */
1735                         reply = setup_cancel_ack_reply(p, pkt);
1736                 }
1737                 break;
1738 #endif
1739
1740         case DCERPC_PKT_ORPHANED:
1741                 /* We should probably check the auth-verifier here.
1742                  * For now just free all client data and continue
1743                  * processing. */
1744                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
1745                           " Abandoning rpc call.\n"));
1746                 reply = True;
1747                 break;
1748
1749         default:
1750                 DEBUG(0, ("process_complete_pdu: "
1751                           "Unknown rpc type = %u received.\n",
1752                           (unsigned int)pkt->ptype));
1753                 break;
1754         }
1755
1756 done:
1757         if (!reply) {
1758                 DEBUG(3,("DCE/RPC fault sent!"));
1759                 set_incoming_fault(p);
1760                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1761                 TALLOC_FREE(pkt);
1762         } else {
1763                 /*
1764                  * Reset the lengths. We're ready for a new pdu.
1765                  */
1766                 TALLOC_FREE(p->in_data.pdu.data);
1767                 p->in_data.pdu_needed_len = 0;
1768                 p->in_data.pdu.length = 0;
1769         }
1770
1771         TALLOC_FREE(pkt);
1772 }
1773