source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19  */
  20
  21 /*  this module apparently provides an implementation of DCE/RPC over a
  22  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  23  *  documentation are available (in on-line form) from the X-Open group.
  24  *
  25  *  this module should provide a level of abstraction between SMB
  26  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  27  *  data copies, and network traffic.
  28  *
  29  */
  30
  31 #include "includes.h"
  32
  33 extern struct pipe_id_info pipe_names[];
  34 extern struct current_user current_user;
  35
  36 #undef DBGC_CLASS
  37 #define DBGC_CLASS DBGC_RPC_SRV
  38
  39 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  40 {
  41         AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
  42
  43         if (a) {
  44                 auth_ntlmssp_end(&a);
  45         }
  46         auth->a_u.auth_ntlmssp_state = NULL;
  47 }
  48
  49 /*******************************************************************
  50  Generate the next PDU to be returned from the data in p->rdata.
  51  Handle NTLMSSP.
  52  ********************************************************************/
  53
  54 static BOOL create_next_pdu_ntlmssp(pipes_struct *p)
  55 {
  56         RPC_HDR_RESP hdr_resp;
  57         uint32 ss_padding_len = 0;
  58         uint32 data_space_available;
  59         uint32 data_len_left;
  60         uint32 data_len;
  61         prs_struct outgoing_pdu;
  62         NTSTATUS status;
  63         DATA_BLOB auth_blob;
  64         RPC_HDR_AUTH auth_info;
  65         uint8 auth_type, auth_level;
  66         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
  67
  68         /*
  69          * If we're in the fault state, keep returning fault PDU's until
  70          * the pipe gets closed. JRA.
  71          */
  72
  73         if(p->fault_state) {
  74                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
  75                 return True;
  76         }
  77
  78         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  79
  80         /* Change the incoming request header to a response. */
  81         p->hdr.pkt_type = RPC_RESPONSE;
  82
  83         /* Set up rpc header flags. */
  84         if (p->out_data.data_sent_length == 0) {
  85                 p->hdr.flags = RPC_FLG_FIRST;
  86         } else {
  87                 p->hdr.flags = 0;
  88         }
  89
  90         /*
  91          * Work out how much we can fit in a single PDU.
  92          */
  93
  94         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
  95
  96         /*
  97          * Ensure there really is data left to send.
  98          */
  99
 100         if(!data_len_left) {
 101                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 102                 return False;
 103         }
 104
 105         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 106                                         RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 107
 108         /*
 109          * The amount we send is the minimum of the available
 110          * space and the amount left to send.
 111          */
 112
 113         data_len = MIN(data_len_left, data_space_available);
 114
 115         /*
 116          * Set up the alloc hint. This should be the data left to
 117          * send.
 118          */
 119
 120         hdr_resp.alloc_hint = data_len_left;
 121
 122         /*
 123          * Work out if this PDU will be the last.
 124          */
 125
 126         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 127                 p->hdr.flags |= RPC_FLG_LAST;
 128                 if (data_len_left % 8) {
 129                         ss_padding_len = 8 - (data_len_left % 8);
 130                         DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 131                                 ss_padding_len ));
 132                 }
 133         }
 134
 135         /*
 136          * Set up the header lengths.
 137          */
 138
 139         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 140                         data_len + ss_padding_len +
 141                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 142         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 143
 144
 145         /*
 146          * Init the parse struct to point at the outgoing
 147          * data.
 148          */
 149
 150         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 151         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 152
 153         /* Store the header in the data stream. */
 154         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 155                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 156                 prs_mem_free(&outgoing_pdu);
 157                 return False;
 158         }
 159
 160         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 161                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 162                 prs_mem_free(&outgoing_pdu);
 163                 return False;
 164         }
 165
 166         /* Copy the data into the PDU. */
 167
 168         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 169                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 170                 prs_mem_free(&outgoing_pdu);
 171                 return False;
 172         }
 173
 174         /* Copy the sign/seal padding data. */
 175         if (ss_padding_len) {
 176                 char pad[8];
 177
 178                 memset(pad, '\0', 8);
 179                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 180                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 181                                         (unsigned int)ss_padding_len));
 182                         prs_mem_free(&outgoing_pdu);
 183                         return False;
 184                 }
 185         }
 186
 187
 188         /* Now write out the auth header and null blob. */
 189         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 190                 auth_type = RPC_NTLMSSP_AUTH_TYPE;
 191         } else {
 192                 auth_type = RPC_SPNEGO_AUTH_TYPE;
 193         }
 194         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 195                 auth_level = RPC_AUTH_LEVEL_PRIVACY;
 196         } else {
 197                 auth_level = RPC_AUTH_LEVEL_INTEGRITY;
 198         }
 199
 200         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 201         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 202                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 203                 prs_mem_free(&outgoing_pdu);
 204                 return False;
 205         }
 206
 207         /* Generate the sign blob. */
 208
 209         switch (p->auth.auth_level) {
 210                 case PIPE_AUTH_LEVEL_PRIVACY:
 211                         /* Data portion is encrypted. */
 212                         status = ntlmssp_seal_packet(a->ntlmssp_state,
 213                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 214                                                         data_len + ss_padding_len,
 215                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 216                                                         (size_t)prs_offset(&outgoing_pdu),
 217                                                         &auth_blob);
 218                         if (!NT_STATUS_IS_OK(status)) {
 219                                 data_blob_free(&auth_blob);
 220                                 prs_mem_free(&outgoing_pdu);
 221                                 return False;
 222                         }
 223                         break;
 224                 case PIPE_AUTH_LEVEL_INTEGRITY:
 225                         /* Data is signed. */
 226                         status = ntlmssp_sign_packet(a->ntlmssp_state,
 227                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 228                                                         data_len + ss_padding_len,
 229                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 230                                                         (size_t)prs_offset(&outgoing_pdu),
 231                                                         &auth_blob);
 232                         if (!NT_STATUS_IS_OK(status)) {
 233                                 data_blob_free(&auth_blob);
 234                                 prs_mem_free(&outgoing_pdu);
 235                                 return False;
 236                         }
 237                         break;
 238                 default:
 239                         prs_mem_free(&outgoing_pdu);
 240                         return False;
 241         }
 242
 243         /* Append the auth blob. */
 244         if (!prs_copy_data_in(&outgoing_pdu, (char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
 245                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 246                                 (unsigned int)NTLMSSP_SIG_SIZE));
 247                 data_blob_free(&auth_blob);
 248                 prs_mem_free(&outgoing_pdu);
 249                 return False;
 250         }
 251
 252         data_blob_free(&auth_blob);
 253
 254         /*
 255          * Setup the counts for this PDU.
 256          */
 257
 258         p->out_data.data_sent_length += data_len;
 259         p->out_data.current_pdu_len = p->hdr.frag_len;
 260         p->out_data.current_pdu_sent = 0;
 261
 262         prs_mem_free(&outgoing_pdu);
 263         return True;
 264 }
 265
 266 /*******************************************************************
 267  Generate the next PDU to be returned from the data in p->rdata.
 268  Return an schannel authenticated fragment.
 269  ********************************************************************/
 270
 271 static BOOL create_next_pdu_schannel(pipes_struct *p)
 272 {
 273         RPC_HDR_RESP hdr_resp;
 274         uint32 ss_padding_len = 0;
 275         uint32 data_len;
 276         uint32 data_space_available;
 277         uint32 data_len_left;
 278         prs_struct outgoing_pdu;
 279         uint32 data_pos;
 280
 281         /*
 282          * If we're in the fault state, keep returning fault PDU's until
 283          * the pipe gets closed. JRA.
 284          */
 285
 286         if(p->fault_state) {
 287                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 288                 return True;
 289         }
 290
 291         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 292
 293         /* Change the incoming request header to a response. */
 294         p->hdr.pkt_type = RPC_RESPONSE;
 295
 296         /* Set up rpc header flags. */
 297         if (p->out_data.data_sent_length == 0) {
 298                 p->hdr.flags = RPC_FLG_FIRST;
 299         } else {
 300                 p->hdr.flags = 0;
 301         }
 302
 303         /*
 304          * Work out how much we can fit in a single PDU.
 305          */
 306
 307         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 308
 309         /*
 310          * Ensure there really is data left to send.
 311          */
 312
 313         if(!data_len_left) {
 314                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 315                 return False;
 316         }
 317
 318         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 319                                         RPC_HDR_AUTH_LEN - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 320
 321         /*
 322          * The amount we send is the minimum of the available
 323          * space and the amount left to send.
 324          */
 325
 326         data_len = MIN(data_len_left, data_space_available);
 327
 328         /*
 329          * Set up the alloc hint. This should be the data left to
 330          * send.
 331          */
 332
 333         hdr_resp.alloc_hint = data_len_left;
 334
 335         /*
 336          * Work out if this PDU will be the last.
 337          */
 338
 339         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 340                 p->hdr.flags |= RPC_FLG_LAST;
 341                 if (data_len_left % 8) {
 342                         ss_padding_len = 8 - (data_len_left % 8);
 343                         DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 344                                 ss_padding_len ));
 345                 }
 346         }
 347
 348         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 349                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 350         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 351
 352         /*
 353          * Init the parse struct to point at the outgoing
 354          * data.
 355          */
 356
 357         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 358         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 359
 360         /* Store the header in the data stream. */
 361         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 362                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 363                 prs_mem_free(&outgoing_pdu);
 364                 return False;
 365         }
 366
 367         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 368                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 369                 prs_mem_free(&outgoing_pdu);
 370                 return False;
 371         }
 372
 373         /* Store the current offset. */
 374         data_pos = prs_offset(&outgoing_pdu);
 375
 376         /* Copy the data into the PDU. */
 377
 378         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 379                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 380                 prs_mem_free(&outgoing_pdu);
 381                 return False;
 382         }
 383
 384         /* Copy the sign/seal padding data. */
 385         if (ss_padding_len) {
 386                 char pad[8];
 387                 memset(pad, '\0', 8);
 388                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 389                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 390                         prs_mem_free(&outgoing_pdu);
 391                         return False;
 392                 }
 393         }
 394
 395         {
 396                 /*
 397                  * Schannel processing.
 398                  */
 399                 char *data;
 400                 RPC_HDR_AUTH auth_info;
 401                 RPC_AUTH_SCHANNEL_CHK verf;
 402
 403                 data = prs_data_p(&outgoing_pdu) + data_pos;
 404                 /* Check it's the type of reply we were expecting to decode */
 405
 406                 init_rpc_hdr_auth(&auth_info,
 407                                 RPC_SCHANNEL_AUTH_TYPE,
 408                                 p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY ?
 409                                         RPC_AUTH_LEVEL_PRIVACY : RPC_AUTH_LEVEL_INTEGRITY,
 410                                 ss_padding_len, 1);
 411
 412                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 413                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 414                         prs_mem_free(&outgoing_pdu);
 415                         return False;
 416                 }
 417
 418                 schannel_encode(p->auth.a_u.schannel_auth,
 419                               p->auth.auth_level,
 420                               SENDER_IS_ACCEPTOR,
 421                               &verf, data, data_len + ss_padding_len);
 422
 423                 if (!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 424                                 &verf, &outgoing_pdu, 0)) {
 425                         prs_mem_free(&outgoing_pdu);
 426                         return False;
 427                 }
 428
 429                 p->auth.a_u.schannel_auth->seq_num++;
 430         }
 431
 432         /*
 433          * Setup the counts for this PDU.
 434          */
 435
 436         p->out_data.data_sent_length += data_len;
 437         p->out_data.current_pdu_len = p->hdr.frag_len;
 438         p->out_data.current_pdu_sent = 0;
 439
 440         prs_mem_free(&outgoing_pdu);
 441         return True;
 442 }
 443
 444 /*******************************************************************
 445  Generate the next PDU to be returned from the data in p->rdata.
 446  No authentication done.
 447 ********************************************************************/
 448
 449 static BOOL create_next_pdu_noauth(pipes_struct *p)
 450 {
 451         RPC_HDR_RESP hdr_resp;
 452         uint32 data_len;
 453         uint32 data_space_available;
 454         uint32 data_len_left;
 455         prs_struct outgoing_pdu;
 456
 457         /*
 458          * If we're in the fault state, keep returning fault PDU's until
 459          * the pipe gets closed. JRA.
 460          */
 461
 462         if(p->fault_state) {
 463                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 464                 return True;
 465         }
 466
 467         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 468
 469         /* Change the incoming request header to a response. */
 470         p->hdr.pkt_type = RPC_RESPONSE;
 471
 472         /* Set up rpc header flags. */
 473         if (p->out_data.data_sent_length == 0) {
 474                 p->hdr.flags = RPC_FLG_FIRST;
 475         } else {
 476                 p->hdr.flags = 0;
 477         }
 478
 479         /*
 480          * Work out how much we can fit in a single PDU.
 481          */
 482
 483         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 484
 485         /*
 486          * Ensure there really is data left to send.
 487          */
 488
 489         if(!data_len_left) {
 490                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 491                 return False;
 492         }
 493
 494         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 495
 496         /*
 497          * The amount we send is the minimum of the available
 498          * space and the amount left to send.
 499          */
 500
 501         data_len = MIN(data_len_left, data_space_available);
 502
 503         /*
 504          * Set up the alloc hint. This should be the data left to
 505          * send.
 506          */
 507
 508         hdr_resp.alloc_hint = data_len_left;
 509
 510         /*
 511          * Work out if this PDU will be the last.
 512          */
 513
 514         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 515                 p->hdr.flags |= RPC_FLG_LAST;
 516         }
 517
 518         /*
 519          * Set up the header lengths.
 520          */
 521
 522         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 523         p->hdr.auth_len = 0;
 524
 525         /*
 526          * Init the parse struct to point at the outgoing
 527          * data.
 528          */
 529
 530         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 531         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 532
 533         /* Store the header in the data stream. */
 534         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 535                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 536                 prs_mem_free(&outgoing_pdu);
 537                 return False;
 538         }
 539
 540         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 541                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 542                 prs_mem_free(&outgoing_pdu);
 543                 return False;
 544         }
 545
 546         /* Copy the data into the PDU. */
 547
 548         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 549                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 550                 prs_mem_free(&outgoing_pdu);
 551                 return False;
 552         }
 553
 554         /*
 555          * Setup the counts for this PDU.
 556          */
 557
 558         p->out_data.data_sent_length += data_len;
 559         p->out_data.current_pdu_len = p->hdr.frag_len;
 560         p->out_data.current_pdu_sent = 0;
 561
 562         prs_mem_free(&outgoing_pdu);
 563         return True;
 564 }
 565
 566 /*******************************************************************
 567  Generate the next PDU to be returned from the data in p->rdata.
 568 ********************************************************************/
 569
 570 BOOL create_next_pdu(pipes_struct *p)
 571 {
 572         switch(p->auth.auth_level) {
 573                 case PIPE_AUTH_LEVEL_NONE:
 574                 case PIPE_AUTH_LEVEL_CONNECT:
 575                         /* This is incorrect for auth level connect. Fixme. JRA */
 576                         return create_next_pdu_noauth(p);
 577
 578                 default:
 579                         switch(p->auth.auth_type) {
 580                                 case PIPE_AUTH_TYPE_NTLMSSP:
 581                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 582                                         return create_next_pdu_ntlmssp(p);
 583                                 case PIPE_AUTH_TYPE_SCHANNEL:
 584                                         return create_next_pdu_schannel(p);
 585                                 default:
 586                                         break;
 587                         }
 588         }
 589
 590         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 591                         (unsigned int)p->auth.auth_level,
 592                         (unsigned int)p->auth.auth_type));
 593         return False;
 594 }
 595
 596 /*******************************************************************
 597  Process an NTLMSSP authentication response.
 598  If this function succeeds, the user has been authenticated
 599  and their domain, name and calling workstation stored in
 600  the pipe struct.
 601 *******************************************************************/
 602
 603 static BOOL pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 604 {
 605         DATA_BLOB reply;
 606         NTSTATUS status;
 607         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
 608
 609         DEBUG(5,("pipe_ntlmssp_verify_final: checking user details\n"));
 610
 611         ZERO_STRUCT(reply);
 612
 613         memset(p->user_name, '\0', sizeof(p->user_name));
 614         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 615         memset(p->domain, '\0', sizeof(p->domain));
 616         memset(p->wks, '\0', sizeof(p->wks));
 617
 618         /* Set up for non-authenticated user. */
 619         delete_nt_token(&p->pipe_user.nt_user_token);
 620         p->pipe_user.ngroups = 0;
 621         SAFE_FREE( p->pipe_user.groups);
 622
 623         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 624
 625         /* Don't generate a reply. */
 626         data_blob_free(&reply);
 627
 628         if (!NT_STATUS_IS_OK(status)) {
 629                 return False;
 630         }
 631
 632         fstrcpy(p->user_name, a->ntlmssp_state->user);
 633         fstrcpy(p->pipe_user_name, a->server_info->unix_name);
 634         fstrcpy(p->domain, a->ntlmssp_state->domain);
 635         fstrcpy(p->wks, a->ntlmssp_state->workstation);
 636
 637         DEBUG(5,("pipe_ntlmssp_verify_final: OK: user: %s domain: %s workstation: %s\n",
 638                 p->user_name, p->domain, p->wks));
 639
 640         /*
 641          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 642          */
 643
 644         p->pipe_user.uid = a->server_info->uid;
 645         p->pipe_user.gid = a->server_info->gid;
 646
 647         /*
 648          * Copy the session key from the ntlmssp state.
 649          */
 650
 651         data_blob_free(&p->session_key);
 652         p->session_key = data_blob(a->ntlmssp_state->session_key.data, a->ntlmssp_state->session_key.length);
 653         if (!p->session_key.data) {
 654                 return False;
 655         }
 656
 657         p->pipe_user.ngroups = a->server_info->n_groups;
 658         if (p->pipe_user.ngroups) {
 659                 if (!(p->pipe_user.groups = memdup(a->server_info->groups, sizeof(gid_t) * p->pipe_user.ngroups))) {
 660                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 661                         return False;
 662                 }
 663         }
 664
 665         if (a->server_info->ptok) {
 666                 p->pipe_user.nt_user_token = dup_nt_token(a->server_info->ptok);
 667         } else {
 668                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 669                 p->pipe_user.nt_user_token = NULL;
 670                 return False;
 671         }
 672
 673         return True;
 674 }
 675
 676 /*******************************************************************
 677  The switch table for the pipe names and the functions to handle them.
 678 *******************************************************************/
 679
 680 struct rpc_table {
 681         struct {
 682                 const char *clnt;
 683                 const char *srv;
 684         } pipe;
 685         struct api_struct *cmds;
 686         int n_cmds;
 687 };
 688
 689 static struct rpc_table *rpc_lookup;
 690 static int rpc_lookup_size;
 691
 692 /*******************************************************************
 693  This is the "stage3" NTLMSSP response after a bind request and reply.
 694 *******************************************************************/
 695
 696 BOOL api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 697 {
 698         RPC_HDR_AUTH auth_info;
 699         uint32 pad;
 700         DATA_BLOB blob;
 701
 702         ZERO_STRUCT(blob);
 703
 704         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 705
 706         if (p->hdr.auth_len == 0) {
 707                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 708                 goto err;
 709         }
 710
 711         /* 4 bytes padding. */
 712         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 713                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 714                 goto err;
 715         }
 716
 717         /*
 718          * Decode the authentication verifier response.
 719          */
 720
 721         if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 722                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
 723                 goto err;
 724         }
 725
 726         if (auth_info.auth_type != RPC_NTLMSSP_AUTH_TYPE) {
 727                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 728                         (unsigned int)auth_info.auth_type ));
 729                 return False;
 730         }
 731
 732         blob = data_blob(NULL,p->hdr.auth_len);
 733
 734         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 735                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 736                         (unsigned int)p->hdr.auth_len ));
 737                 goto err;
 738         }
 739
 740         /*
 741          * The following call actually checks the challenge/response data.
 742          * for correctness against the given DOMAIN\user name.
 743          */
 744
 745         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 746                 goto err;
 747         }
 748
 749         data_blob_free(&blob);
 750
 751         p->pipe_bound = True;
 752
 753         return True;
 754
 755  err:
 756
 757         data_blob_free(&blob);
 758         free_pipe_ntlmssp_auth_data(&p->auth);
 759         p->auth.a_u.auth_ntlmssp_state = NULL;
 760
 761         return False;
 762 }
 763
 764 /*******************************************************************
 765  Marshall a bind_nak pdu.
 766 *******************************************************************/
 767
 768 static BOOL setup_bind_nak(pipes_struct *p)
 769 {
 770         prs_struct outgoing_rpc;
 771         RPC_HDR nak_hdr;
 772         uint16 zero = 0;
 773
 774         /* Free any memory in the current return data buffer. */
 775         prs_mem_free(&p->out_data.rdata);
 776
 777         /*
 778          * Marshall directly into the outgoing PDU space. We
 779          * must do this as we need to set to the bind response
 780          * header and are never sending more than one PDU here.
 781          */
 782
 783         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 784         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 785
 786         /*
 787          * Initialize a bind_nak header.
 788          */
 789
 790         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 791                 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 792
 793         /*
 794          * Marshall the header into the outgoing PDU.
 795          */
 796
 797         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 798                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 799                 prs_mem_free(&outgoing_rpc);
 800                 return False;
 801         }
 802
 803         /*
 804          * Now add the reject reason.
 805          */
 806
 807         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 808                 prs_mem_free(&outgoing_rpc);
 809                 return False;
 810         }
 811
 812         p->out_data.data_sent_length = 0;
 813         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 814         p->out_data.current_pdu_sent = 0;
 815
 816         if (p->auth.auth_data_free_func) {
 817                 (*p->auth.auth_data_free_func)(&p->auth);
 818         }
 819         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
 820         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 821         p->pipe_bound = False;
 822
 823         return True;
 824 }
 825
 826 /*******************************************************************
 827  Marshall a fault pdu.
 828 *******************************************************************/
 829
 830 BOOL setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 831 {
 832         prs_struct outgoing_pdu;
 833         RPC_HDR fault_hdr;
 834         RPC_HDR_RESP hdr_resp;
 835         RPC_HDR_FAULT fault_resp;
 836
 837         /* Free any memory in the current return data buffer. */
 838         prs_mem_free(&p->out_data.rdata);
 839
 840         /*
 841          * Marshall directly into the outgoing PDU space. We
 842          * must do this as we need to set to the bind response
 843          * header and are never sending more than one PDU here.
 844          */
 845
 846         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 847         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 848
 849         /*
 850          * Initialize a fault header.
 851          */
 852
 853         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 854             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 855
 856         /*
 857          * Initialize the HDR_RESP and FAULT parts of the PDU.
 858          */
 859
 860         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 861
 862         fault_resp.status = status;
 863         fault_resp.reserved = 0;
 864
 865         /*
 866          * Marshall the header into the outgoing PDU.
 867          */
 868
 869         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 870                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 871                 prs_mem_free(&outgoing_pdu);
 872                 return False;
 873         }
 874
 875         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 876                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 877                 prs_mem_free(&outgoing_pdu);
 878                 return False;
 879         }
 880
 881         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 882                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 883                 prs_mem_free(&outgoing_pdu);
 884                 return False;
 885         }
 886
 887         p->out_data.data_sent_length = 0;
 888         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 889         p->out_data.current_pdu_sent = 0;
 890
 891         prs_mem_free(&outgoing_pdu);
 892         return True;
 893 }
 894
 895 #if 0
 896 /*******************************************************************
 897  Marshall a cancel_ack pdu.
 898  We should probably check the auth-verifier here.
 899 *******************************************************************/
 900
 901 BOOL setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
 902 {
 903         prs_struct outgoing_pdu;
 904         RPC_HDR ack_reply_hdr;
 905
 906         /* Free any memory in the current return data buffer. */
 907         prs_mem_free(&p->out_data.rdata);
 908
 909         /*
 910          * Marshall directly into the outgoing PDU space. We
 911          * must do this as we need to set to the bind response
 912          * header and are never sending more than one PDU here.
 913          */
 914
 915         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 916         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 917
 918         /*
 919          * Initialize a cancel_ack header.
 920          */
 921
 922         init_rpc_hdr(&ack_reply_hdr, RPC_CANCEL_ACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 923                         p->hdr.call_id, RPC_HEADER_LEN, 0);
 924
 925         /*
 926          * Marshall the header into the outgoing PDU.
 927          */
 928
 929         if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
 930                 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
 931                 prs_mem_free(&outgoing_pdu);
 932                 return False;
 933         }
 934
 935         p->out_data.data_sent_length = 0;
 936         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 937         p->out_data.current_pdu_sent = 0;
 938
 939         prs_mem_free(&outgoing_pdu);
 940         return True;
 941 }
 942 #endif
 943
 944 /*******************************************************************
 945  Ensure a bind request has the correct abstract & transfer interface.
 946  Used to reject unknown binds from Win2k.
 947 *******************************************************************/
 948
 949 BOOL check_bind_req(struct pipes_struct *p, RPC_IFACE* abstract,
 950                     RPC_IFACE* transfer, uint32 context_id)
 951 {
 952         char *pipe_name = p->name;
 953         int i=0;
 954         fstring pname;
 955
 956         fstrcpy(pname,"\\PIPE\\");
 957         fstrcat(pname,pipe_name);
 958
 959         DEBUG(3,("check_bind_req for %s\n", pname));
 960
 961         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 962
 963         for ( i=0; pipe_names[i].client_pipe; i++ ) {
 964                 DEBUG(10,("checking %s\n", pipe_names[i].client_pipe));
 965                 if ( strequal(pipe_names[i].client_pipe, pname)
 966                         && (abstract->version == pipe_names[i].abstr_syntax.version)
 967                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(struct uuid)) == 0)
 968                         && (transfer->version == pipe_names[i].trans_syntax.version)
 969                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(struct uuid)) == 0) ) {
 970                         struct api_struct       *fns = NULL;
 971                         int                     n_fns = 0;
 972                         PIPE_RPC_FNS            *context_fns;
 973
 974                         if ( !(context_fns = SMB_MALLOC_P(PIPE_RPC_FNS)) ) {
 975                                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 976                                 return False;
 977                         }
 978
 979                         /* save the RPC function table associated with this bind */
 980
 981                         get_pipe_fns(i, &fns, &n_fns);
 982
 983                         context_fns->cmds = fns;
 984                         context_fns->n_cmds = n_fns;
 985                         context_fns->context_id = context_id;
 986
 987                         /* add to the list of open contexts */
 988
 989                         DLIST_ADD( p->contexts, context_fns );
 990
 991                         break;
 992                 }
 993         }
 994
 995         if(pipe_names[i].client_pipe == NULL) {
 996                 return False;
 997         }
 998
 999         return True;
1000 }
1001
1002 /*******************************************************************
1003  Register commands to an RPC pipe
1004 *******************************************************************/
1005
1006 NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *srv, const struct api_struct *cmds, int size)
1007 {
1008         struct rpc_table *rpc_entry;
1009
1010         if (!clnt || !srv || !cmds) {
1011                 return NT_STATUS_INVALID_PARAMETER;
1012         }
1013
1014         if (version != SMB_RPC_INTERFACE_VERSION) {
1015                 DEBUG(0,("Can't register rpc commands!\n"
1016                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1017                          ", while this version of samba uses version %d!\n",
1018                          version,SMB_RPC_INTERFACE_VERSION));
1019                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1020         }
1021
1022         /* TODO:
1023          *
1024          * we still need to make sure that don't register the same commands twice!!!
1025          *
1026          * --metze
1027          */
1028
1029         /* We use a temporary variable because this call can fail and
1030            rpc_lookup will still be valid afterwards.  It could then succeed if
1031            called again later */
1032         rpc_lookup_size++;
1033         rpc_entry = SMB_REALLOC_ARRAY(rpc_lookup, struct rpc_table, rpc_lookup_size);
1034         if (NULL == rpc_entry) {
1035                 rpc_lookup_size--;
1036                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1037                 return NT_STATUS_NO_MEMORY;
1038         } else {
1039                 rpc_lookup = rpc_entry;
1040         }
1041
1042         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1043         ZERO_STRUCTP(rpc_entry);
1044         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1045         rpc_entry->pipe.srv = SMB_STRDUP(srv);
1046         rpc_entry->cmds = SMB_REALLOC_ARRAY(rpc_entry->cmds, struct api_struct, rpc_entry->n_cmds + size);
1047         memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds, size * sizeof(struct api_struct));
1048         rpc_entry->n_cmds += size;
1049
1050         return NT_STATUS_OK;
1051 }
1052
1053 /*******************************************************************
1054  Handle a SPNEGO krb5 bind auth.
1055 *******************************************************************/
1056
1057 static BOOL pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1058                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1059 {
1060         return False;
1061 }
1062
1063 /*******************************************************************
1064  Handle the first part of a SPNEGO bind auth.
1065 *******************************************************************/
1066
1067 static BOOL pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1068                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1069 {
1070         DATA_BLOB blob;
1071         DATA_BLOB secblob;
1072         DATA_BLOB response;
1073         DATA_BLOB chal;
1074         char *OIDs[ASN1_MAX_OIDS];
1075         int i;
1076         NTSTATUS status;
1077         BOOL got_kerberos_mechanism = False;
1078         AUTH_NTLMSSP_STATE *a = NULL;
1079         RPC_HDR_AUTH auth_info;
1080
1081         ZERO_STRUCT(secblob);
1082         ZERO_STRUCT(chal);
1083         ZERO_STRUCT(response);
1084
1085         /* Grab the SPNEGO blob. */
1086         blob = data_blob(NULL,p->hdr.auth_len);
1087
1088         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1089                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1090                         (unsigned int)p->hdr.auth_len ));
1091                 goto err;
1092         }
1093
1094         if (blob.data[0] != ASN1_APPLICATION(0)) {
1095                 goto err;
1096         }
1097
1098         /* parse out the OIDs and the first sec blob */
1099         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1100                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1101                 goto err;
1102         }
1103
1104         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1105                 got_kerberos_mechanism = True;
1106         }
1107
1108         for (i=0;OIDs[i];i++) {
1109                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1110                 SAFE_FREE(OIDs[i]);
1111         }
1112         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1113
1114         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || lp_use_kerberos_keytab()) ) {
1115                 BOOL ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1116                 data_blob_free(&secblob);
1117                 data_blob_free(&blob);
1118                 return ret;
1119         }
1120
1121         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1122                 /* Free any previous auth type. */
1123                 free_pipe_ntlmssp_auth_data(&p->auth);
1124         }
1125
1126         /* Initialize the NTLM engine. */
1127         status = auth_ntlmssp_start(&a);
1128         if (!NT_STATUS_IS_OK(status)) {
1129                 goto err;
1130         }
1131
1132         /*
1133          * Pass the first security blob of data to it.
1134          * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1135          * which means we need another packet to complete the bind.
1136          */
1137
1138         status = auth_ntlmssp_update(a, secblob, &chal);
1139
1140         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1141                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1142                 goto err;
1143         }
1144
1145         /* Generate the response blob we need for step 2 of the bind. */
1146         response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1147
1148         /* Copy the blob into the pout_auth parse struct */
1149         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1150         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1151                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1152                 goto err;
1153         }
1154
1155         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1156                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1157                 goto err;
1158         }
1159
1160         p->auth.a_u.auth_ntlmssp_state = a;
1161         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1162         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1163
1164         data_blob_free(&blob);
1165         data_blob_free(&secblob);
1166         data_blob_free(&chal);
1167         data_blob_free(&response);
1168
1169         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1170         return True;
1171
1172  err:
1173
1174         data_blob_free(&blob);
1175         data_blob_free(&secblob);
1176         data_blob_free(&chal);
1177         data_blob_free(&response);
1178
1179         p->auth.a_u.auth_ntlmssp_state = NULL;
1180
1181         return False;
1182 }
1183
1184 /*******************************************************************
1185  Handle the second part of a SPNEGO bind auth.
1186 *******************************************************************/
1187
1188 static BOOL pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1189                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1190 {
1191         DATA_BLOB spnego_blob, auth_blob, auth_reply;
1192         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1193
1194         ZERO_STRUCT(spnego_blob);
1195         ZERO_STRUCT(auth_blob);
1196         ZERO_STRUCT(auth_reply);
1197
1198         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1199                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1200                 goto err;
1201         }
1202
1203         /* Grab the SPNEGO blob. */
1204         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1205
1206         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1207                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1208                         (unsigned int)p->hdr.auth_len ));
1209                 goto err;
1210         }
1211
1212         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1213                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1214                 goto err;
1215         }
1216
1217         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1218                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1219                 goto err;
1220         }
1221
1222         /*
1223          * The following call actually checks the challenge/response data.
1224          * for correctness against the given DOMAIN\user name.
1225          */
1226
1227         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1228                 goto err;
1229         }
1230
1231         data_blob_free(&spnego_blob);
1232         data_blob_free(&auth_blob);
1233         data_blob_free(&auth_reply);
1234
1235         p->pipe_bound = True;
1236
1237         return True;
1238
1239  err:
1240
1241         data_blob_free(&spnego_blob);
1242         data_blob_free(&auth_blob);
1243         data_blob_free(&auth_reply);
1244
1245         free_pipe_ntlmssp_auth_data(&p->auth);
1246         p->auth.a_u.auth_ntlmssp_state = NULL;
1247
1248         return False;
1249 }
1250
1251 /*******************************************************************
1252  Handle an schannel bind auth.
1253 *******************************************************************/
1254
1255 static BOOL pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1256                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1257 {
1258         RPC_HDR_AUTH auth_info;
1259         RPC_AUTH_SCHANNEL_NEG neg;
1260         RPC_AUTH_VERIFIER auth_verifier;
1261         BOOL ret;
1262         struct dcinfo stored_dcinfo;
1263         uint32 flags;
1264
1265         if (!smb_io_rpc_auth_schannel_neg("", &neg, rpc_in_p, 0)) {
1266                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1267                 return False;
1268         }
1269
1270         ZERO_STRUCT(stored_dcinfo);
1271
1272         become_root();
1273         ret = secrets_restore_schannel_session_info(p->mem_ctx, neg.myname, &stored_dcinfo);
1274         unbecome_root();
1275
1276         if (!ret) {
1277                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1278                 return False;
1279         }
1280
1281         p->auth.a_u.schannel_auth = TALLOC_P(p->pipe_state_mem_ctx, struct schannel_auth_struct);
1282         if (!p->auth.a_u.schannel_auth) {
1283                 return False;
1284         }
1285
1286         memset(p->auth.a_u.schannel_auth->sess_key, 0, sizeof(p->auth.a_u.schannel_auth->sess_key));
1287         memcpy(p->auth.a_u.schannel_auth->sess_key, stored_dcinfo.sess_key, sizeof(stored_dcinfo.sess_key));
1288
1289         p->auth.a_u.schannel_auth->seq_num = 0;
1290
1291         /*
1292          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1293          * here ? We do that for NTLMSPP, but the session key is already set up from the vuser
1294          * struct of the person who opened the pipe. I need to test this further. JRA.
1295          */
1296
1297         /* The client opens a second RPC NETLOGON pipe without
1298                 doing a auth2. The credentials for the schannel are
1299                 re-used from the auth2 the client did before. */
1300         p->dc = TALLOC_ZERO_P(p->pipe_state_mem_ctx, struct dcinfo);
1301         if (!p->dc) {
1302                 return False;
1303         }
1304         *p->dc = stored_dcinfo;
1305
1306         init_rpc_hdr_auth(&auth_info, RPC_SCHANNEL_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1307         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1308                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1309                 return False;
1310         }
1311
1312         /*** SCHANNEL verifier ***/
1313
1314         init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1315         if(!smb_io_rpc_schannel_verifier("", &auth_verifier, pout_auth, 0)) {
1316                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1317                 return False;
1318         }
1319
1320         prs_align(pout_auth);
1321
1322         flags = 5;
1323         if(!prs_uint32("flags ", pout_auth, 0, &flags)) {
1324                 return False;
1325         }
1326
1327         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1328                 neg.domain, neg.myname));
1329
1330         /* We're finished with this bind - no more packets. */
1331         p->auth.auth_data_free_func = NULL;
1332         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1333
1334         p->pipe_bound = True;
1335
1336         return True;
1337 }
1338
1339 /*******************************************************************
1340  Handle an NTLMSSP bind auth.
1341 *******************************************************************/
1342
1343 static BOOL pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1344                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1345 {
1346         RPC_HDR_AUTH auth_info;
1347         DATA_BLOB blob;
1348         DATA_BLOB response;
1349         NTSTATUS status;
1350         AUTH_NTLMSSP_STATE *a = NULL;
1351
1352         ZERO_STRUCT(blob);
1353         ZERO_STRUCT(response);
1354
1355         /* Grab the NTLMSSP blob. */
1356         blob = data_blob(NULL,p->hdr.auth_len);
1357
1358         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1359                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1360                         (unsigned int)p->hdr.auth_len ));
1361                 goto err;
1362         }
1363
1364         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1365                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1366                 goto err;
1367         }
1368
1369         /* We have an NTLMSSP blob. */
1370         status = auth_ntlmssp_start(&a);
1371         if (!NT_STATUS_IS_OK(status)) {
1372                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1373                         nt_errstr(status) ));
1374                 goto err;
1375         }
1376
1377         status = auth_ntlmssp_update(a, blob, &response);
1378         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1379                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1380                         nt_errstr(status) ));
1381                 goto err;
1382         }
1383
1384         data_blob_free(&blob);
1385
1386         /* Copy the blob into the pout_auth parse struct */
1387         init_rpc_hdr_auth(&auth_info, RPC_NTLMSSP_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1388         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1389                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1390                 goto err;
1391         }
1392
1393         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1394                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1395                 goto err;
1396         }
1397
1398         p->auth.a_u.auth_ntlmssp_state = a;
1399         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1400         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1401
1402         data_blob_free(&blob);
1403         data_blob_free(&response);
1404
1405         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1406
1407         /* We can't set pipe_bound True yet - we need an RPC_AUTH3 response packet... */
1408         return True;
1409
1410   err:
1411
1412         data_blob_free(&blob);
1413         data_blob_free(&response);
1414
1415         free_pipe_ntlmssp_auth_data(&p->auth);
1416         p->auth.a_u.auth_ntlmssp_state = NULL;
1417         return False;
1418 }
1419
1420 /*******************************************************************
1421  Respond to a pipe bind request.
1422 *******************************************************************/
1423
1424 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1425 {
1426         RPC_HDR_BA hdr_ba;
1427         RPC_HDR_RB hdr_rb;
1428         RPC_HDR_AUTH auth_info;
1429         uint16 assoc_gid;
1430         fstring ack_pipe_name;
1431         prs_struct out_hdr_ba;
1432         prs_struct out_auth;
1433         prs_struct outgoing_rpc;
1434         int i = 0;
1435         int auth_len = 0;
1436         unsigned int auth_type = RPC_ANONYMOUS_AUTH_TYPE;
1437
1438         /* No rebinds on a bound pipe - use alter context. */
1439         if (p->pipe_bound) {
1440                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound pipe %s.\n", p->pipe_srv_name));
1441                 return setup_bind_nak(p);
1442         }
1443
1444         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
1445
1446         /*
1447          * Marshall directly into the outgoing PDU space. We
1448          * must do this as we need to set to the bind response
1449          * header and are never sending more than one PDU here.
1450          */
1451
1452         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1453
1454         /*
1455          * Setup the memory to marshall the ba header, and the
1456          * auth footers.
1457          */
1458
1459         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1460                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1461                 prs_mem_free(&outgoing_rpc);
1462                 return False;
1463         }
1464
1465         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1466                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1467                 prs_mem_free(&outgoing_rpc);
1468                 prs_mem_free(&out_hdr_ba);
1469                 return False;
1470         }
1471
1472         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1473
1474         /*
1475          * Try and find the correct pipe name to ensure
1476          * that this is a pipe name we support.
1477          */
1478
1479
1480         for (i = 0; i < rpc_lookup_size; i++) {
1481                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1482                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1483                                 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1484                         fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1485                         break;
1486                 }
1487         }
1488
1489         if (i == rpc_lookup_size) {
1490                 if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) {
1491                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1492                                 p->name ));
1493                         prs_mem_free(&outgoing_rpc);
1494                         prs_mem_free(&out_hdr_ba);
1495                         prs_mem_free(&out_auth);
1496
1497                         return setup_bind_nak(p);
1498                 }
1499
1500                 for (i = 0; i < rpc_lookup_size; i++) {
1501                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1502                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1503                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1504                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1505                                break;
1506                        }
1507                 }
1508
1509                 if (i == rpc_lookup_size) {
1510                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
1511                         goto err_exit;
1512                 }
1513         }
1514
1515         /* decode the bind request */
1516         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1517                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
1518                 goto err_exit;
1519         }
1520
1521         /* name has to be \PIPE\xxxxx */
1522         fstrcpy(ack_pipe_name, "\\PIPE\\");
1523         fstrcat(ack_pipe_name, p->pipe_srv_name);
1524
1525         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1526
1527         /*
1528          * Check if this is an authenticated bind request.
1529          */
1530
1531         if (p->hdr.auth_len) {
1532                 /*
1533                  * Decode the authentication verifier.
1534                  */
1535
1536                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1537                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1538                         goto err_exit;
1539                 }
1540
1541                 auth_type = auth_info.auth_type;
1542
1543                 /* Work out if we have to sign or seal etc. */
1544                 switch (auth_info.auth_level) {
1545                         case RPC_AUTH_LEVEL_INTEGRITY:
1546                                 p->auth.auth_level = PIPE_AUTH_LEVEL_INTEGRITY;
1547                                 break;
1548                         case RPC_AUTH_LEVEL_PRIVACY:
1549                                 p->auth.auth_level = PIPE_AUTH_LEVEL_PRIVACY;
1550                                 break;
1551                         default:
1552                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1553                                         (unsigned int)auth_info.auth_level ));
1554                                 goto err_exit;
1555                 }
1556         } else {
1557                 ZERO_STRUCT(auth_info);
1558         }
1559
1560         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1561
1562         switch(auth_type) {
1563                 case RPC_NTLMSSP_AUTH_TYPE:
1564                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1565                                 goto err_exit;
1566                         }
1567                         assoc_gid = 0x7a77;
1568                         break;
1569
1570                 case RPC_SCHANNEL_AUTH_TYPE:
1571                         if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1572                                 goto err_exit;
1573                         }
1574                         break;
1575
1576                 case RPC_SPNEGO_AUTH_TYPE:
1577                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1578                                 goto err_exit;
1579                         }
1580                         break;
1581
1582                 case RPC_ANONYMOUS_AUTH_TYPE:
1583                         /* Unauthenticated bind request. */
1584                         /* We're finished - no more packets. */
1585                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1586                         /* We must set the pipe auth_level here also. */
1587                         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
1588                         p->pipe_bound = True;
1589                         break;
1590
1591                 default:
1592                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1593                         goto err_exit;
1594         }
1595
1596         /*
1597          * Create the bind response struct.
1598          */
1599
1600         /* If the requested abstract synt uuid doesn't match our client pipe,
1601                 reject the bind_ack & set the transfer interface synt to all 0's,
1602                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1603                 unknown to NT4)
1604                 Needed when adding entries to a DACL from NT5 - SK */
1605
1606         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1607                                 hdr_rb.rpc_context[0].context_id )) {
1608                 init_rpc_hdr_ba(&hdr_ba,
1609                         RPC_MAX_PDU_FRAG_LEN,
1610                         RPC_MAX_PDU_FRAG_LEN,
1611                         assoc_gid,
1612                         ack_pipe_name,
1613                         0x1, 0x0, 0x0,
1614                         &hdr_rb.rpc_context[0].transfer[0]);
1615         } else {
1616                 RPC_IFACE null_interface;
1617                 ZERO_STRUCT(null_interface);
1618                 /* Rejection reason: abstract syntax not supported */
1619                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1620                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1621                                         ack_pipe_name, 0x1, 0x2, 0x1,
1622                                         &null_interface);
1623                 p->pipe_bound = False;
1624         }
1625
1626         /*
1627          * and marshall it.
1628          */
1629
1630         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1631                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1632                 goto err_exit;
1633         }
1634
1635         /*
1636          * Create the header, now we know the length.
1637          */
1638
1639         if (prs_offset(&out_auth)) {
1640                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1641         }
1642
1643         init_rpc_hdr(&p->hdr, RPC_BINDACK, RPC_FLG_FIRST | RPC_FLG_LAST,
1644                         p->hdr.call_id,
1645                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1646                         auth_len);
1647
1648         /*
1649          * Marshall the header into the outgoing PDU.
1650          */
1651
1652         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1653                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1654                 goto err_exit;
1655         }
1656
1657         /*
1658          * Now add the RPC_HDR_BA and any auth needed.
1659          */
1660
1661         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1662                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1663                 goto err_exit;
1664         }
1665
1666         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1667                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1668                 goto err_exit;
1669         }
1670
1671         /*
1672          * Setup the lengths for the initial reply.
1673          */
1674
1675         p->out_data.data_sent_length = 0;
1676         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1677         p->out_data.current_pdu_sent = 0;
1678
1679         prs_mem_free(&out_hdr_ba);
1680         prs_mem_free(&out_auth);
1681
1682         return True;
1683
1684   err_exit:
1685
1686         prs_mem_free(&outgoing_rpc);
1687         prs_mem_free(&out_hdr_ba);
1688         prs_mem_free(&out_auth);
1689         return setup_bind_nak(p);
1690 }
1691
1692 /****************************************************************************
1693  Deal with an alter context call. Can be third part of 3 leg auth request for
1694  SPNEGO calls.
1695 ****************************************************************************/
1696
1697 BOOL api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1698 {
1699         RPC_HDR_BA hdr_ba;
1700         RPC_HDR_RB hdr_rb;
1701         RPC_HDR_AUTH auth_info;
1702         uint16 assoc_gid;
1703         fstring ack_pipe_name;
1704         prs_struct out_hdr_ba;
1705         prs_struct out_auth;
1706         prs_struct outgoing_rpc;
1707         int auth_len = 0;
1708
1709         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
1710
1711         /*
1712          * Marshall directly into the outgoing PDU space. We
1713          * must do this as we need to set to the bind response
1714          * header and are never sending more than one PDU here.
1715          */
1716
1717         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1718
1719         /*
1720          * Setup the memory to marshall the ba header, and the
1721          * auth footers.
1722          */
1723
1724         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1725                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1726                 prs_mem_free(&outgoing_rpc);
1727                 return False;
1728         }
1729
1730         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1731                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1732                 prs_mem_free(&outgoing_rpc);
1733                 prs_mem_free(&out_hdr_ba);
1734                 return False;
1735         }
1736
1737         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1738
1739         /* decode the alter context request */
1740         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1741                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1742                 goto err_exit;
1743         }
1744
1745         /* secondary address CAN be NULL
1746          * as the specs say it's ignored.
1747          * It MUST be NULL to have the spoolss working.
1748          */
1749         fstrcpy(ack_pipe_name,"");
1750
1751         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1752
1753         /*
1754          * Check if this is an authenticated alter context request.
1755          */
1756
1757         if (p->hdr.auth_len != 0) {
1758                 /*
1759                  * Decode the authentication verifier.
1760                  */
1761
1762                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1763                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1764                         goto err_exit;
1765                 }
1766
1767                 /*
1768                  * Currently only the SPNEGO auth type uses the alter ctx
1769                  * response in place of the NTLMSSP auth3 type.
1770                  */
1771
1772                 if (auth_info.auth_type == RPC_SPNEGO_AUTH_TYPE) {
1773                         /* We can only finish if the pipe is unbound. */
1774                         if (!p->pipe_bound) {
1775                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1776                                         goto err_exit;
1777                                 }
1778                         } else {
1779                                 goto err_exit;
1780                         }
1781                 }
1782         } else {
1783                 ZERO_STRUCT(auth_info);
1784         }
1785
1786         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1787
1788         /*
1789          * Create the bind response struct.
1790          */
1791
1792         /* If the requested abstract synt uuid doesn't match our client pipe,
1793                 reject the bind_ack & set the transfer interface synt to all 0's,
1794                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1795                 unknown to NT4)
1796                 Needed when adding entries to a DACL from NT5 - SK */
1797
1798         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1799                                 hdr_rb.rpc_context[0].context_id )) {
1800                 init_rpc_hdr_ba(&hdr_ba,
1801                         RPC_MAX_PDU_FRAG_LEN,
1802                         RPC_MAX_PDU_FRAG_LEN,
1803                         assoc_gid,
1804                         ack_pipe_name,
1805                         0x1, 0x0, 0x0,
1806                         &hdr_rb.rpc_context[0].transfer[0]);
1807         } else {
1808                 RPC_IFACE null_interface;
1809                 ZERO_STRUCT(null_interface);
1810                 /* Rejection reason: abstract syntax not supported */
1811                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1812                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1813                                         ack_pipe_name, 0x1, 0x2, 0x1,
1814                                         &null_interface);
1815                 p->pipe_bound = False;
1816         }
1817
1818         /*
1819          * and marshall it.
1820          */
1821
1822         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1823                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1824                 goto err_exit;
1825         }
1826
1827         /*
1828          * Create the header, now we know the length.
1829          */
1830
1831         if (prs_offset(&out_auth)) {
1832                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1833         }
1834
1835         init_rpc_hdr(&p->hdr, RPC_ALTCONTRESP, RPC_FLG_FIRST | RPC_FLG_LAST,
1836                         p->hdr.call_id,
1837                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1838                         auth_len);
1839
1840         /*
1841          * Marshall the header into the outgoing PDU.
1842          */
1843
1844         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1845                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
1846                 goto err_exit;
1847         }
1848
1849         /*
1850          * Now add the RPC_HDR_BA and any auth needed.
1851          */
1852
1853         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1854                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
1855                 goto err_exit;
1856         }
1857
1858         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1859                 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
1860                 goto err_exit;
1861         }
1862
1863         /*
1864          * Setup the lengths for the initial reply.
1865          */
1866
1867         p->out_data.data_sent_length = 0;
1868         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1869         p->out_data.current_pdu_sent = 0;
1870
1871         prs_mem_free(&out_hdr_ba);
1872         prs_mem_free(&out_auth);
1873
1874         return True;
1875
1876   err_exit:
1877
1878         prs_mem_free(&outgoing_rpc);
1879         prs_mem_free(&out_hdr_ba);
1880         prs_mem_free(&out_auth);
1881         return setup_bind_nak(p);
1882 }
1883
1884 /****************************************************************************
1885  Deal with NTLMSSP sign & seal processing on an RPC request.
1886 ****************************************************************************/
1887
1888 BOOL api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
1889                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
1890 {
1891         RPC_HDR_AUTH auth_info;
1892         uint32 auth_len = p->hdr.auth_len;
1893         uint32 save_offset = prs_offset(rpc_in);
1894         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1895         unsigned char *data = NULL;
1896         size_t data_len;
1897         unsigned char *full_packet_data = NULL;
1898         size_t full_packet_data_len;
1899         DATA_BLOB auth_blob;
1900
1901         *pstatus = NT_STATUS_OK;
1902
1903         if (p->auth.auth_level == PIPE_AUTH_LEVEL_NONE || p->auth.auth_level == PIPE_AUTH_LEVEL_CONNECT) {
1904                 return True;
1905         }
1906
1907         if (!a) {
1908                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1909                 return False;
1910         }
1911
1912         /* Ensure there's enough data for an authenticated request. */
1913         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
1914                         (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
1915                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
1916                         (unsigned int)auth_len ));
1917                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1918                 return False;
1919         }
1920
1921         /*
1922          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
1923          * after the RPC header.
1924          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
1925          * functions as NTLMv2 checks the rpc headers also.
1926          */
1927
1928         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
1929         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
1930
1931         full_packet_data = p->in_data.current_in_pdu;
1932         full_packet_data_len = p->hdr.frag_len - auth_len;
1933
1934         /* Pull the auth header and the following data into a blob. */
1935         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
1936                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
1937                         (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
1938                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1939                 return False;
1940         }
1941
1942         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1943                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1944                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1945                 return False;
1946         }
1947
1948         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
1949         auth_blob.length = auth_len;
1950
1951         switch (p->auth.auth_level) {
1952                 case PIPE_AUTH_LEVEL_PRIVACY:
1953                         /* Data is encrypted. */
1954                         *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
1955                                                         data, data_len,
1956                                                         full_packet_data,
1957                                                         full_packet_data_len,
1958                                                         &auth_blob);
1959                         if (!NT_STATUS_IS_OK(*pstatus)) {
1960                                 return False;
1961                         }
1962                         break;
1963                 case PIPE_AUTH_LEVEL_INTEGRITY:
1964                         /* Data is signed. */
1965                         *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
1966                                                         data, data_len,
1967                                                         full_packet_data,
1968                                                         full_packet_data_len,
1969                                                         &auth_blob);
1970                         if (!NT_STATUS_IS_OK(*pstatus)) {
1971                                 return False;
1972                         }
1973                         break;
1974                 default:
1975                         *pstatus = NT_STATUS_INVALID_PARAMETER;
1976                         return False;
1977         }
1978
1979         /*
1980          * Return the current pointer to the data offset.
1981          */
1982
1983         if(!prs_set_offset(rpc_in, save_offset)) {
1984                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
1985                         (unsigned int)save_offset ));
1986                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1987                 return False;
1988         }
1989
1990         /*
1991          * Remember the padding length. We must remove it from the real data
1992          * stream once the sign/seal is done.
1993          */
1994
1995         *p_ss_padding_len = auth_info.auth_pad_len;
1996
1997         return True;
1998 }
1999
2000 /****************************************************************************
2001  Deal with schannel processing on an RPC request.
2002 ****************************************************************************/
2003
2004 BOOL api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2005 {
2006         uint32 data_len;
2007         uint32 auth_len;
2008         uint32 save_offset = prs_offset(rpc_in);
2009         RPC_HDR_AUTH auth_info;
2010         RPC_AUTH_SCHANNEL_CHK schannel_chk;
2011
2012         auth_len = p->hdr.auth_len;
2013
2014         if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
2015                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2016                 return False;
2017         }
2018
2019         /*
2020          * The following is that length of the data we must verify or unseal.
2021          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2022          * preceeding the auth_data.
2023          */
2024
2025         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2026                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2027                         (unsigned int)p->hdr.frag_len,
2028                         (unsigned int)auth_len ));
2029                 return False;
2030         }
2031
2032         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2033                 RPC_HDR_AUTH_LEN - auth_len;
2034
2035         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2036
2037         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2038                 DEBUG(0,("cannot move offset to %u.\n",
2039                          (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2040                 return False;
2041         }
2042
2043         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2044                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2045                 return False;
2046         }
2047
2048         if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
2049                 DEBUG(0,("Invalid auth info %d on schannel\n",
2050                          auth_info.auth_type));
2051                 return False;
2052         }
2053
2054         if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN, &schannel_chk, rpc_in, 0)) {
2055                 DEBUG(0,("failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
2056                 return False;
2057         }
2058
2059         if (!schannel_decode(p->auth.a_u.schannel_auth,
2060                            p->auth.auth_level,
2061                            SENDER_IS_INITIATOR,
2062                            &schannel_chk,
2063                            prs_data_p(rpc_in)+RPC_HDR_REQ_LEN, data_len)) {
2064                 DEBUG(3,("failed to decode PDU\n"));
2065                 return False;
2066         }
2067
2068         /*
2069          * Return the current pointer to the data offset.
2070          */
2071
2072         if(!prs_set_offset(rpc_in, save_offset)) {
2073                 DEBUG(0,("failed to set offset back to %u\n",
2074                          (unsigned int)save_offset ));
2075                 return False;
2076         }
2077
2078         /* The sequence number gets incremented on both send and receive. */
2079         p->auth.a_u.schannel_auth->seq_num++;
2080
2081         /*
2082          * Remember the padding length. We must remove it from the real data
2083          * stream once the sign/seal is done.
2084          */
2085
2086         *p_ss_padding_len = auth_info.auth_pad_len;
2087
2088         return True;
2089 }
2090
2091 /****************************************************************************
2092  Return a user struct for a pipe user.
2093 ****************************************************************************/
2094
2095 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
2096 {
2097         if (p->pipe_bound &&
2098                         (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP ||
2099                         (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2100                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
2101         } else {
2102                 memcpy(user, &current_user, sizeof(struct current_user));
2103         }
2104
2105         return user;
2106 }
2107
2108 /****************************************************************************
2109  Find the set of RPC functions associated with this context_id
2110 ****************************************************************************/
2111
2112 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2113 {
2114         PIPE_RPC_FNS *fns = NULL;
2115         PIPE_RPC_FNS *tmp = NULL;
2116
2117         if ( !list ) {
2118                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2119                 return NULL;
2120         }
2121
2122         for (tmp=list; tmp; tmp=tmp->next ) {
2123                 if ( tmp->context_id == context_id )
2124                         break;
2125         }
2126
2127         fns = tmp;
2128
2129         return fns;
2130 }
2131
2132 /****************************************************************************
2133  Memory cleanup.
2134 ****************************************************************************/
2135
2136 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2137 {
2138         PIPE_RPC_FNS *tmp = list;
2139         PIPE_RPC_FNS *tmp2;
2140
2141         while (tmp) {
2142                 tmp2 = tmp->next;
2143                 SAFE_FREE(tmp);
2144                 tmp = tmp2;
2145         }
2146
2147         return;
2148 }
2149
2150 /****************************************************************************
2151  Find the correct RPC function to call for this request.
2152  If the pipe is authenticated then become the correct UNIX user
2153  before doing the call.
2154 ****************************************************************************/
2155
2156 BOOL api_pipe_request(pipes_struct *p)
2157 {
2158         BOOL ret = False;
2159         BOOL changed_user = False;
2160         PIPE_RPC_FNS *pipe_fns;
2161
2162         if (p->pipe_bound &&
2163                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2164                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2165                 if(!become_authenticated_pipe_user(p)) {
2166                         prs_mem_free(&p->out_data.rdata);
2167                         return False;
2168                 }
2169                 changed_user = True;
2170         }
2171
2172         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
2173
2174         /* get the set of RPC functions for this context */
2175
2176         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2177
2178         if ( pipe_fns ) {
2179                 set_current_rpc_talloc(p->mem_ctx);
2180                 ret = api_rpcTNP(p, p->name, pipe_fns->cmds, pipe_fns->n_cmds);
2181                 set_current_rpc_talloc(NULL);
2182         }
2183         else {
2184                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2185                         p->hdr_req.context_id, p->name));
2186         }
2187
2188         if (changed_user) {
2189                 unbecome_authenticated_pipe_user();
2190         }
2191
2192         return ret;
2193 }
2194
2195 /*******************************************************************
2196  Calls the underlying RPC function for a named pipe.
2197  ********************************************************************/
2198
2199 BOOL api_rpcTNP(pipes_struct *p, const char *rpc_name,
2200                 const struct api_struct *api_rpc_cmds, int n_cmds)
2201 {
2202         int fn_num;
2203         fstring name;
2204         uint32 offset1, offset2;
2205
2206         /* interpret the command */
2207         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
2208
2209         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
2210         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2211
2212         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2213                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2214                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2215                         break;
2216                 }
2217         }
2218
2219         if (fn_num == n_cmds) {
2220                 /*
2221                  * For an unknown RPC just return a fault PDU but
2222                  * return True to allow RPC's on the pipe to continue
2223                  * and not put the pipe into fault state. JRA.
2224                  */
2225                 DEBUG(4, ("unknown\n"));
2226                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
2227                 return True;
2228         }
2229
2230         offset1 = prs_offset(&p->out_data.rdata);
2231
2232         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2233                 fn_num, api_rpc_cmds[fn_num].fn));
2234         /* do the actual command */
2235         if(!api_rpc_cmds[fn_num].fn(p)) {
2236                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
2237                 prs_mem_free(&p->out_data.rdata);
2238                 return False;
2239         }
2240
2241         if (p->bad_handle_fault_state) {
2242                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2243                 p->bad_handle_fault_state = False;
2244                 setup_fault_pdu(p, NT_STATUS(0x1C00001A));
2245                 return True;
2246         }
2247
2248         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
2249         offset2 = prs_offset(&p->out_data.rdata);
2250         prs_set_offset(&p->out_data.rdata, offset1);
2251         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2252         prs_set_offset(&p->out_data.rdata, offset2);
2253
2254         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
2255
2256         /* Check for buffer underflow in rpc parsing */
2257
2258         if ((DEBUGLEVEL >= 10) &&
2259             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2260                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2261                 char *data = SMB_MALLOC(data_len);
2262
2263                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2264                 if (data) {
2265                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2266                         SAFE_FREE(data);
2267                 }
2268
2269         }
2270
2271         return True;
2272 }
2273
2274 /*******************************************************************
2275 *******************************************************************/
2276
2277 void get_pipe_fns( int idx, struct api_struct **fns, int *n_fns )
2278 {
2279         struct api_struct *cmds = NULL;
2280         int               n_cmds = 0;
2281
2282         switch ( idx ) {
2283                 case PI_LSARPC:
2284                         lsa_get_pipe_fns( &cmds, &n_cmds );
2285                         break;
2286                 case PI_LSARPC_DS:
2287                         lsa_ds_get_pipe_fns( &cmds, &n_cmds );
2288                         break;
2289                 case PI_SAMR:
2290                         samr_get_pipe_fns( &cmds, &n_cmds );
2291                         break;
2292                 case PI_NETLOGON:
2293                         netlog_get_pipe_fns( &cmds, &n_cmds );
2294                         break;
2295                 case PI_SRVSVC:
2296                         srvsvc_get_pipe_fns( &cmds, &n_cmds );
2297                         break;
2298                 case PI_WKSSVC:
2299                         wkssvc_get_pipe_fns( &cmds, &n_cmds );
2300                         break;
2301                 case PI_WINREG:
2302                         reg_get_pipe_fns( &cmds, &n_cmds );
2303                         break;
2304                 case PI_SPOOLSS:
2305                         spoolss_get_pipe_fns( &cmds, &n_cmds );
2306                         break;
2307                 case PI_NETDFS:
2308                         netdfs_get_pipe_fns( &cmds, &n_cmds );
2309                         break;
2310                 case PI_SVCCTL:
2311                         svcctl_get_pipe_fns( &cmds, &n_cmds );
2312                         break;
2313                 case PI_EVENTLOG:
2314                         eventlog_get_pipe_fns( &cmds, &n_cmds );
2315                         break;
2316                 case PI_NTSVCS:
2317                         ntsvcs_get_pipe_fns( &cmds, &n_cmds );
2318                         break;
2319 #ifdef DEVELOPER
2320                 case PI_ECHO:
2321                         echo_get_pipe_fns( &cmds, &n_cmds );
2322                         break;
2323 #endif
2324                 default:
2325                         DEBUG(0,("get_pipe_fns: Unknown pipe index! [%d]\n", idx));
2326         }
2327
2328         *fns = cmds;
2329         *n_fns = n_cmds;
2330
2331         return;
2332 }