source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "system/filesys.h"
  32 #include "srv_pipe_internal.h"
  33 #include "../librpc/gen_ndr/ndr_schannel.h"
  34 #include "../libcli/auth/schannel.h"
  35 #include "../libcli/auth/spnego.h"
  36 #include "dcesrv_ntlmssp.h"
  37 #include "dcesrv_gssapi.h"
  38 #include "dcesrv_spnego.h"
  39 #include "rpc_server.h"
  40 #include "rpc_dce.h"
  41 #include "smbd/smbd.h"
  42
  43 #undef DBGC_CLASS
  44 #define DBGC_CLASS DBGC_RPC_SRV
  45
  46 /**
  47  * Dump everything from the start of the end up of the provided data
  48  * into a file, but only at debug level >= 50
  49  **/
  50 static void dump_pdu_region(const char *name, int v,
  51                             DATA_BLOB *data, size_t start, size_t end)
  52 {
  53         int fd, i;
  54         char *fname = NULL;
  55         ssize_t sz;
  56
  57         if (DEBUGLEVEL < 50) return;
  58
  59         if (start > data->length || end > data->length || start > end) return;
  60
  61         for (i = 1; i < 100; i++) {
  62                 if (v != -1) {
  63                         fname = talloc_asprintf(talloc_tos(),
  64                                                 "/tmp/%s_%d.%d.prs",
  65                                                 name, v, i);
  66                 } else {
  67                         fname = talloc_asprintf(talloc_tos(),
  68                                                 "/tmp/%s_%d.prs",
  69                                                 name, i);
  70                 }
  71                 if (!fname) {
  72                         return;
  73                 }
  74                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  75                 if (fd != -1 || errno != EEXIST) break;
  76         }
  77         if (fd != -1) {
  78                 sz = write(fd, data->data + start, end - start);
  79                 i = close(fd);
  80                 if ((sz != end - start) || (i != 0) ) {
  81                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  82                                   fname, (unsigned long)sz,
  83                                   (unsigned long)end - start, i));
  84                 } else {
  85                         DEBUG(0,("created %s\n", fname));
  86                 }
  87         }
  88         TALLOC_FREE(fname);
  89 }
  90
  91 static DATA_BLOB generic_session_key(void)
  92 {
  93         return data_blob_const("SystemLibraryDTC", 16);
  94 }
  95
  96 /*******************************************************************
  97  Generate the next PDU to be returned from the data.
  98 ********************************************************************/
  99
 100 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
 101                                    struct pipe_auth_data *auth,
 102                                    uint32_t call_id,
 103                                    DATA_BLOB *rdata,
 104                                    size_t data_sent_length,
 105                                    DATA_BLOB *frag,
 106                                    size_t *pdu_size)
 107 {
 108         union dcerpc_payload u;
 109         uint8_t pfc_flags;
 110         size_t data_left;
 111         size_t data_to_send;
 112         size_t frag_len;
 113         size_t pad_len = 0;
 114         size_t auth_len = 0;
 115         NTSTATUS status;
 116
 117         ZERO_STRUCT(u.response);
 118
 119         /* Set up rpc packet pfc flags. */
 120         if (data_sent_length == 0) {
 121                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 122         } else {
 123                 pfc_flags = 0;
 124         }
 125
 126         /* Work out how much we can fit in a single PDU. */
 127         data_left = rdata->length - data_sent_length;
 128
 129         /* Ensure there really is data left to send. */
 130         if (!data_left) {
 131                 DEBUG(0, ("No data left to send !\n"));
 132                 return NT_STATUS_BUFFER_TOO_SMALL;
 133         }
 134
 135         status = dcerpc_guess_sizes(auth,
 136                                     DCERPC_RESPONSE_LENGTH,
 137                                     data_left,
 138                                     RPC_MAX_PDU_FRAG_LEN,
 139                                     SERVER_NDR_PADDING_SIZE,
 140                                     &data_to_send, &frag_len,
 141                                     &auth_len, &pad_len);
 142         if (!NT_STATUS_IS_OK(status)) {
 143                 return status;
 144         }
 145
 146         /* Set up the alloc hint. This should be the data left to send. */
 147         u.response.alloc_hint = data_left;
 148
 149         /* Work out if this PDU will be the last. */
 150         if (data_sent_length + data_to_send >= rdata->length) {
 151                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 152         }
 153
 154         /* Prepare data to be NDR encoded. */
 155         u.response.stub_and_verifier =
 156                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 157
 158         /* Store the packet in the data stream. */
 159         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 160                                           pfc_flags, auth_len, call_id,
 161                                           &u, frag);
 162         if (!NT_STATUS_IS_OK(status)) {
 163                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 164                 return status;
 165         }
 166
 167         if (auth_len) {
 168                 /* Set the proper length on the pdu, including padding.
 169                  * Only needed if an auth trailer will be appended. */
 170                 dcerpc_set_frag_length(frag, frag->length
 171                                                 + pad_len
 172                                                 + DCERPC_AUTH_TRAILER_LENGTH
 173                                                 + auth_len);
 174         }
 175
 176         if (auth_len) {
 177                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 178                 if (!NT_STATUS_IS_OK(status)) {
 179                         data_blob_free(frag);
 180                         return status;
 181                 }
 182         }
 183
 184         *pdu_size = data_to_send;
 185         return NT_STATUS_OK;
 186 }
 187
 188 /*******************************************************************
 189  Generate the next PDU to be returned from the data in p->rdata.
 190 ********************************************************************/
 191
 192 bool create_next_pdu(struct pipes_struct *p)
 193 {
 194         size_t pdu_size = 0;
 195         NTSTATUS status;
 196
 197         /*
 198          * If we're in the fault state, keep returning fault PDU's until
 199          * the pipe gets closed. JRA.
 200          */
 201         if (p->fault_state) {
 202                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 203                 return true;
 204         }
 205
 206         status = create_next_packet(p->mem_ctx, &p->auth,
 207                                     p->call_id, &p->out_data.rdata,
 208                                     p->out_data.data_sent_length,
 209                                     &p->out_data.frag, &pdu_size);
 210         if (!NT_STATUS_IS_OK(status)) {
 211                 DEBUG(0, ("Failed to create packet with error %s, "
 212                           "(auth level %u / type %u)\n",
 213                           nt_errstr(status),
 214                           (unsigned int)p->auth.auth_level,
 215                           (unsigned int)p->auth.auth_type));
 216                 return false;
 217         }
 218
 219         /* Setup the counts for this PDU. */
 220         p->out_data.data_sent_length += pdu_size;
 221         p->out_data.current_pdu_sent = 0;
 222         return true;
 223 }
 224
 225
 226 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 227
 228 /*******************************************************************
 229  Marshall a bind_nak pdu.
 230 *******************************************************************/
 231
 232 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 233 {
 234         NTSTATUS status;
 235         union dcerpc_payload u;
 236
 237         /* Free any memory in the current return data buffer. */
 238         pipe_init_outgoing_data(p);
 239
 240         /*
 241          * Initialize a bind_nak header.
 242          */
 243
 244         ZERO_STRUCT(u);
 245
 246         u.bind_nak.reject_reason  = 0;
 247
 248         /*
 249          * Marshall directly into the outgoing PDU space. We
 250          * must do this as we need to set to the bind response
 251          * header and are never sending more than one PDU here.
 252          */
 253
 254         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 255                                           DCERPC_PKT_BIND_NAK,
 256                                           DCERPC_PFC_FLAG_FIRST |
 257                                                 DCERPC_PFC_FLAG_LAST,
 258                                           0,
 259                                           pkt->call_id,
 260                                           &u,
 261                                           &p->out_data.frag);
 262         if (!NT_STATUS_IS_OK(status)) {
 263                 return False;
 264         }
 265
 266         p->out_data.data_sent_length = 0;
 267         p->out_data.current_pdu_sent = 0;
 268
 269         TALLOC_FREE(p->auth.auth_ctx);
 270         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 271         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 272         p->pipe_bound = False;
 273
 274         return True;
 275 }
 276
 277 /*******************************************************************
 278  Marshall a fault pdu.
 279 *******************************************************************/
 280
 281 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 282 {
 283         NTSTATUS status;
 284         union dcerpc_payload u;
 285
 286         /* Free any memory in the current return data buffer. */
 287         pipe_init_outgoing_data(p);
 288
 289         /*
 290          * Initialize a fault header.
 291          */
 292
 293         ZERO_STRUCT(u);
 294
 295         u.fault.status          = NT_STATUS_V(fault_status);
 296         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 297
 298         /*
 299          * Marshall directly into the outgoing PDU space. We
 300          * must do this as we need to set to the bind response
 301          * header and are never sending more than one PDU here.
 302          */
 303
 304         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 305                                           DCERPC_PKT_FAULT,
 306                                           DCERPC_PFC_FLAG_FIRST |
 307                                            DCERPC_PFC_FLAG_LAST |
 308                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 309                                           0,
 310                                           p->call_id,
 311                                           &u,
 312                                           &p->out_data.frag);
 313         if (!NT_STATUS_IS_OK(status)) {
 314                 return False;
 315         }
 316
 317         p->out_data.data_sent_length = 0;
 318         p->out_data.current_pdu_sent = 0;
 319
 320         return True;
 321 }
 322
 323 /*******************************************************************
 324  Ensure a bind request has the correct abstract & transfer interface.
 325  Used to reject unknown binds from Win2k.
 326 *******************************************************************/
 327
 328 static bool check_bind_req(struct pipes_struct *p,
 329                            struct ndr_syntax_id* abstract,
 330                            struct ndr_syntax_id* transfer,
 331                            uint32 context_id)
 332 {
 333         struct pipe_rpc_fns *context_fns;
 334
 335         DEBUG(3,("check_bind_req for %s\n",
 336                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 337
 338         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 339         if (rpc_srv_pipe_exists_by_id(abstract) &&
 340            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 341                 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 342                         rpc_srv_get_pipe_cli_name(abstract),
 343                         rpc_srv_get_pipe_srv_name(abstract)));
 344         } else {
 345                 return false;
 346         }
 347
 348         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 349         if (context_fns == NULL) {
 350                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 351                 return False;
 352         }
 353
 354         context_fns->next = context_fns->prev = NULL;
 355         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 356         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 357         context_fns->context_id = context_id;
 358
 359         /* add to the list of open contexts */
 360
 361         DLIST_ADD( p->contexts, context_fns );
 362
 363         return True;
 364 }
 365
 366 /**
 367  * Is a named pipe known?
 368  * @param[in] cli_filename      The pipe name requested by the client
 369  * @result                      Do we want to serve this?
 370  */
 371 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
 372 {
 373         const char *pipename = cli_filename;
 374         NTSTATUS status;
 375
 376         if (strnequal(pipename, "\\PIPE\\", 6)) {
 377                 pipename += 5;
 378         }
 379
 380         if (*pipename == '\\') {
 381                 pipename += 1;
 382         }
 383
 384         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 385                 DEBUG(10, ("refusing spoolss access\n"));
 386                 return false;
 387         }
 388
 389         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 390                 return true;
 391         }
 392
 393         status = smb_probe_module("rpc", pipename);
 394         if (!NT_STATUS_IS_OK(status)) {
 395                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
 396                 return false;
 397         }
 398         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 399
 400         /*
 401          * Scan the list again for the interface id
 402          */
 403         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 404                 return true;
 405         }
 406
 407         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 408                    pipename));
 409
 410         return false;
 411 }
 412
 413 /*******************************************************************
 414  Handle the first part of a SPNEGO bind auth.
 415 *******************************************************************/
 416
 417 static bool pipe_spnego_auth_bind(struct pipes_struct *p,
 418                                   TALLOC_CTX *mem_ctx,
 419                                   struct dcerpc_auth *auth_info,
 420                                   DATA_BLOB *response)
 421 {
 422         struct spnego_context *spnego_ctx;
 423         NTSTATUS status;
 424
 425         status = spnego_server_auth_start(p,
 426                                           (auth_info->auth_level ==
 427                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 428                                           (auth_info->auth_level ==
 429                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 430                                           true,
 431                                           &auth_info->credentials,
 432                                           response,
 433                                           &spnego_ctx);
 434         if (!NT_STATUS_IS_OK(status)) {
 435                 DEBUG(0, ("Failed SPNEGO negotiate (%s)\n",
 436                           nt_errstr(status)));
 437                 return false;
 438         }
 439
 440         /* Make sure data is bound to the memctx, to be freed the caller */
 441         talloc_steal(mem_ctx, response->data);
 442
 443         p->auth.auth_ctx = spnego_ctx;
 444         p->auth.auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 445
 446         DEBUG(10, ("SPNEGO auth started\n"));
 447
 448         return true;
 449 }
 450
 451 /*******************************************************************
 452  Handle an schannel bind auth.
 453 *******************************************************************/
 454
 455 static bool pipe_schannel_auth_bind(struct pipes_struct *p,
 456                                     TALLOC_CTX *mem_ctx,
 457                                     struct dcerpc_auth *auth_info,
 458                                     DATA_BLOB *response)
 459 {
 460         struct NL_AUTH_MESSAGE neg;
 461         struct NL_AUTH_MESSAGE reply;
 462         bool ret;
 463         NTSTATUS status;
 464         struct netlogon_creds_CredentialState *creds;
 465         enum ndr_err_code ndr_err;
 466         struct schannel_state *schannel_auth;
 467
 468         ndr_err = ndr_pull_struct_blob(
 469                         &auth_info->credentials, mem_ctx, &neg,
 470                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
 471         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 472                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
 473                 return false;
 474         }
 475
 476         if (DEBUGLEVEL >= 10) {
 477                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
 478         }
 479
 480         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
 481                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
 482                 return false;
 483         }
 484
 485         /*
 486          * The neg.oem_netbios_computer.a key here must match the remote computer name
 487          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
 488          * operations that use credentials.
 489          */
 490
 491         become_root();
 492         status = schannel_get_creds_state(p, lp_private_dir(),
 493                                             neg.oem_netbios_computer.a, &creds);
 494         unbecome_root();
 495
 496         if (!NT_STATUS_IS_OK(status)) {
 497                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
 498                 return False;
 499         }
 500
 501         schannel_auth = talloc(p, struct schannel_state);
 502         if (!schannel_auth) {
 503                 TALLOC_FREE(creds);
 504                 return False;
 505         }
 506
 507         schannel_auth->state = SCHANNEL_STATE_START;
 508         schannel_auth->seq_num = 0;
 509         schannel_auth->initiator = false;
 510         schannel_auth->creds = creds;
 511
 512         /*
 513          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
 514          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
 515          * struct of the person who opened the pipe. I need to test this further. JRA.
 516          *
 517          * VL. As we are mapping this to guest set the generic key
 518          * "SystemLibraryDTC" key here. It's a bit difficult to test against
 519          * W2k3, as it does not allow schannel binds against SAMR and LSA
 520          * anymore.
 521          */
 522
 523         ret = session_info_set_session_key(p->session_info, generic_session_key());
 524
 525         if (!ret) {
 526                 DEBUG(0, ("session_info_set_session_key failed\n"));
 527                 return false;
 528         }
 529
 530         /*** SCHANNEL verifier ***/
 531
 532         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
 533         reply.Flags                             = 0;
 534         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
 535                                                       * this has any meaning
 536                                                       * here - gd */
 537
 538         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
 539                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 540         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 541                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
 542                 return false;
 543         }
 544
 545         if (DEBUGLEVEL >= 10) {
 546                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
 547         }
 548
 549         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
 550                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
 551
 552         /* We're finished with this bind - no more packets. */
 553         p->auth.auth_ctx = schannel_auth;
 554         p->auth.auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
 555
 556         p->pipe_bound = True;
 557
 558         return True;
 559 }
 560
 561 /*******************************************************************
 562  Handle an NTLMSSP bind auth.
 563 *******************************************************************/
 564
 565 static bool pipe_ntlmssp_auth_bind(struct pipes_struct *p,
 566                                    TALLOC_CTX *mem_ctx,
 567                                    struct dcerpc_auth *auth_info,
 568                                    DATA_BLOB *response)
 569 {
 570         struct auth_ntlmssp_state *ntlmssp_state = NULL;
 571         NTSTATUS status;
 572
 573         if (strncmp((char *)auth_info->credentials.data, "NTLMSSP", 7) != 0) {
 574                 DEBUG(0, ("Failed to read NTLMSSP in blob\n"));
 575                 return false;
 576         }
 577
 578         /* We have an NTLMSSP blob. */
 579         status = ntlmssp_server_auth_start(p,
 580                                            (auth_info->auth_level ==
 581                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 582                                            (auth_info->auth_level ==
 583                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 584                                            true,
 585                                            &auth_info->credentials,
 586                                            response,
 587                                            &ntlmssp_state);
 588         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 589                 DEBUG(0, (__location__ ": auth_ntlmssp_start failed: %s\n",
 590                           nt_errstr(status)));
 591                 return false;
 592         }
 593
 594         /* Make sure data is bound to the memctx, to be freed the caller */
 595         talloc_steal(mem_ctx, response->data);
 596
 597         p->auth.auth_ctx = ntlmssp_state;
 598         p->auth.auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 599
 600         DEBUG(10, (__location__ ": NTLMSSP auth started\n"));
 601
 602         return true;
 603 }
 604
 605 /*******************************************************************
 606  Process an NTLMSSP authentication response.
 607  If this function succeeds, the user has been authenticated
 608  and their domain, name and calling workstation stored in
 609  the pipe struct.
 610 *******************************************************************/
 611
 612 static bool pipe_ntlmssp_verify_final(TALLOC_CTX *mem_ctx,
 613                                 struct auth_ntlmssp_state *ntlmssp_ctx,
 614                                 enum dcerpc_AuthLevel auth_level,
 615                                 struct client_address *client_id,
 616                                 struct ndr_syntax_id *syntax,
 617                                 struct auth_serversupplied_info **session_info)
 618 {
 619         NTSTATUS status;
 620         bool ret;
 621
 622         DEBUG(5, (__location__ ": pipe %s checking user details\n",
 623                  get_pipe_name_from_syntax(talloc_tos(), syntax)));
 624
 625         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 626            ensure the underlying NTLMSSP flags are also set. If not we should
 627            refuse the bind. */
 628
 629         status = ntlmssp_server_check_flags(ntlmssp_ctx,
 630                                             (auth_level ==
 631                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 632                                             (auth_level ==
 633                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 634         if (!NT_STATUS_IS_OK(status)) {
 635                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 636                           "security for pipe %s\n",
 637                           get_pipe_name_from_syntax(talloc_tos(), syntax)));
 638                 return false;
 639         }
 640
 641         TALLOC_FREE(*session_info);
 642
 643         status = ntlmssp_server_get_user_info(ntlmssp_ctx,
 644                                                 mem_ctx, session_info);
 645         if (!NT_STATUS_IS_OK(status)) {
 646                 DEBUG(0, (__location__ ": failed to obtain the server info "
 647                           "for authenticated user: %s\n", nt_errstr(status)));
 648                 return false;
 649         }
 650
 651         if ((*session_info)->security_token == NULL) {
 652                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 653                 return false;
 654         }
 655
 656         /*
 657          * We're an authenticated bind over smb, so the session key needs to
 658          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 659          * does. See the RPC-SAMBA3SESSIONKEY.
 660          */
 661
 662         ret = session_info_set_session_key((*session_info), generic_session_key());
 663         if (!ret) {
 664                 DEBUG(0, ("Failed to set session key!\n"));
 665                 return false;
 666         }
 667
 668         return true;
 669 }
 670
 671 /*******************************************************************
 672  Handle a GSSAPI bind auth.
 673 *******************************************************************/
 674
 675 static bool pipe_gssapi_auth_bind(struct pipes_struct *p,
 676                                   TALLOC_CTX *mem_ctx,
 677                                   struct dcerpc_auth *auth_info,
 678                                   DATA_BLOB *response)
 679 {
 680         NTSTATUS status;
 681         struct gse_context *gse_ctx = NULL;
 682
 683         status = gssapi_server_auth_start(p,
 684                                           (auth_info->auth_level ==
 685                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 686                                           (auth_info->auth_level ==
 687                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 688                                           true,
 689                                           &auth_info->credentials,
 690                                           response,
 691                                           &gse_ctx);
 692         if (!NT_STATUS_IS_OK(status)) {
 693                 DEBUG(0, ("Failed to init dcerpc gssapi server (%s)\n",
 694                           nt_errstr(status)));
 695                 goto err;
 696         }
 697
 698         /* Make sure data is bound to the memctx, to be freed the caller */
 699         talloc_steal(mem_ctx, response->data);
 700
 701         p->auth.auth_ctx = gse_ctx;
 702         p->auth.auth_type = DCERPC_AUTH_TYPE_KRB5;
 703
 704         DEBUG(10, ("KRB5 auth started\n"));
 705
 706         return true;
 707
 708 err:
 709         TALLOC_FREE(gse_ctx);
 710         return false;
 711 }
 712
 713 static NTSTATUS pipe_gssapi_verify_final(TALLOC_CTX *mem_ctx,
 714                                          struct gse_context *gse_ctx,
 715                                          struct client_address *client_id,
 716                                          struct auth_serversupplied_info **session_info)
 717 {
 718         NTSTATUS status;
 719         bool bret;
 720
 721         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 722            ensure the underlying flags are also set. If not we should
 723            refuse the bind. */
 724
 725         status = gssapi_server_check_flags(gse_ctx);
 726         if (!NT_STATUS_IS_OK(status)) {
 727                 DEBUG(0, ("Requested Security Layers not honored!\n"));
 728                 return status;
 729         }
 730
 731         status = gssapi_server_get_user_info(gse_ctx, mem_ctx,
 732                                              client_id, session_info);
 733         if (!NT_STATUS_IS_OK(status)) {
 734                 DEBUG(0, (__location__ ": failed to obtain the server info "
 735                           "for authenticated user: %s\n", nt_errstr(status)));
 736                 return status;
 737         }
 738
 739         if ((*session_info)->security_token == NULL) {
 740                 status = create_local_token(*session_info);
 741                 if (!NT_STATUS_IS_OK(status)) {
 742                         DEBUG(1, ("Failed to create local user token (%s)\n",
 743                                   nt_errstr(status)));
 744                         status = NT_STATUS_ACCESS_DENIED;
 745                         return status;
 746                 }
 747         }
 748
 749         /* TODO: this is what the ntlmssp code does with the session_key, check
 750          * it is ok with gssapi too */
 751         /*
 752          * We're an authenticated bind over smb, so the session key needs to
 753          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 754          * does. See the RPC-SAMBA3SESSIONKEY.
 755          */
 756
 757         bret = session_info_set_session_key((*session_info), generic_session_key());
 758         if (!bret) {
 759                 return NT_STATUS_ACCESS_DENIED;
 760         }
 761
 762         return NT_STATUS_OK;
 763 }
 764
 765 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 766 {
 767         enum spnego_mech auth_type;
 768         struct auth_ntlmssp_state *ntlmssp_ctx;
 769         struct spnego_context *spnego_ctx;
 770         struct gse_context *gse_ctx;
 771         void *mech_ctx;
 772         NTSTATUS status;
 773
 774         switch (p->auth.auth_type) {
 775         case DCERPC_AUTH_TYPE_NTLMSSP:
 776                 ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 777                                                     struct auth_ntlmssp_state);
 778                 if (!pipe_ntlmssp_verify_final(p, ntlmssp_ctx,
 779                                                 p->auth.auth_level,
 780                                                 p->client_id, &p->syntax,
 781                                                 &p->session_info)) {
 782                         return NT_STATUS_ACCESS_DENIED;
 783                 }
 784                 break;
 785         case DCERPC_AUTH_TYPE_KRB5:
 786                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 787                                                 struct gse_context);
 788                 status = pipe_gssapi_verify_final(p, gse_ctx,
 789                                                   p->client_id,
 790                                                   &p->session_info);
 791                 if (!NT_STATUS_IS_OK(status)) {
 792                         DEBUG(1, ("gssapi bind failed with: %s",
 793                                   nt_errstr(status)));
 794                         return status;
 795                 }
 796                 break;
 797         case DCERPC_AUTH_TYPE_SPNEGO:
 798                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 799                                                    struct spnego_context);
 800                 status = spnego_get_negotiated_mech(spnego_ctx,
 801                                                     &auth_type, &mech_ctx);
 802                 if (!NT_STATUS_IS_OK(status)) {
 803                         DEBUG(0, ("Bad SPNEGO state (%s)\n",
 804                                   nt_errstr(status)));
 805                         return status;
 806                 }
 807                 switch(auth_type) {
 808                 case SPNEGO_KRB5:
 809                         gse_ctx = talloc_get_type_abort(mech_ctx,
 810                                                         struct gse_context);
 811                         status = pipe_gssapi_verify_final(p, gse_ctx,
 812                                                           p->client_id,
 813                                                           &p->session_info);
 814                         if (!NT_STATUS_IS_OK(status)) {
 815                                 DEBUG(1, ("gssapi bind failed with: %s",
 816                                           nt_errstr(status)));
 817                                 return status;
 818                         }
 819                         break;
 820                 case SPNEGO_NTLMSSP:
 821                         ntlmssp_ctx = talloc_get_type_abort(mech_ctx,
 822                                                 struct auth_ntlmssp_state);
 823                         if (!pipe_ntlmssp_verify_final(p, ntlmssp_ctx,
 824                                                         p->auth.auth_level,
 825                                                         p->client_id,
 826                                                         &p->syntax,
 827                                                         &p->session_info)) {
 828                                 return NT_STATUS_ACCESS_DENIED;
 829                         }
 830                         break;
 831                 default:
 832                         DEBUG(0, (__location__ ": incorrect spnego type "
 833                                   "(%d).\n", auth_type));
 834                         return NT_STATUS_ACCESS_DENIED;
 835                 }
 836                 break;
 837         default:
 838                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
 839                           (unsigned int)p->auth.auth_type));
 840                 return NT_STATUS_ACCESS_DENIED;
 841         }
 842
 843         p->pipe_bound = true;
 844
 845         return NT_STATUS_OK;
 846 }
 847
 848 /*******************************************************************
 849  Respond to a pipe bind request.
 850 *******************************************************************/
 851
 852 static bool api_pipe_bind_req(struct pipes_struct *p,
 853                                 struct ncacn_packet *pkt)
 854 {
 855         struct dcerpc_auth auth_info;
 856         uint16 assoc_gid;
 857         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
 858         NTSTATUS status;
 859         struct ndr_syntax_id id;
 860         union dcerpc_payload u;
 861         struct dcerpc_ack_ctx bind_ack_ctx;
 862         DATA_BLOB auth_resp = data_blob_null;
 863         DATA_BLOB auth_blob = data_blob_null;
 864
 865         /* No rebinds on a bound pipe - use alter context. */
 866         if (p->pipe_bound) {
 867                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
 868                          "pipe %s.\n",
 869                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 870                 return setup_bind_nak(p, pkt);
 871         }
 872
 873         if (pkt->u.bind.num_contexts == 0) {
 874                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
 875                 goto err_exit;
 876         }
 877
 878         /*
 879          * Try and find the correct pipe name to ensure
 880          * that this is a pipe name we support.
 881          */
 882         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 883         if (rpc_srv_pipe_exists_by_id(&id)) {
 884                 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 885                         rpc_srv_get_pipe_cli_name(&id),
 886                         rpc_srv_get_pipe_srv_name(&id)));
 887         } else {
 888                 status = smb_probe_module(
 889                         "rpc", get_pipe_name_from_syntax(
 890                                 talloc_tos(),
 891                                 &pkt->u.bind.ctx_list[0].abstract_syntax));
 892
 893                 if (NT_STATUS_IS_ERR(status)) {
 894                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 895                                 get_pipe_name_from_syntax(
 896                                         talloc_tos(),
 897                                         &pkt->u.bind.ctx_list[0].abstract_syntax)));
 898
 899                         return setup_bind_nak(p, pkt);
 900                 }
 901
 902                 if (rpc_srv_get_pipe_interface_by_cli_name(
 903                                 get_pipe_name_from_syntax(talloc_tos(),
 904                                                           &p->syntax),
 905                                 &id)) {
 906                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 907                                 rpc_srv_get_pipe_cli_name(&id),
 908                                 rpc_srv_get_pipe_srv_name(&id)));
 909                 } else {
 910                         DEBUG(0, ("module %s doesn't provide functions for "
 911                                   "pipe %s!\n",
 912                                   get_pipe_name_from_syntax(talloc_tos(),
 913                                                             &p->syntax),
 914                                   get_pipe_name_from_syntax(talloc_tos(),
 915                                                             &p->syntax)));
 916                         return setup_bind_nak(p, pkt);
 917                 }
 918         }
 919
 920         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 921
 922         if (pkt->u.bind.assoc_group_id != 0) {
 923                 assoc_gid = pkt->u.bind.assoc_group_id;
 924         } else {
 925                 assoc_gid = 0x53f0;
 926         }
 927
 928         /*
 929          * Create the bind response struct.
 930          */
 931
 932         /* If the requested abstract synt uuid doesn't match our client pipe,
 933                 reject the bind_ack & set the transfer interface synt to all 0's,
 934                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 935                 unknown to NT4)
 936                 Needed when adding entries to a DACL from NT5 - SK */
 937
 938         if (check_bind_req(p,
 939                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 940                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 941                         pkt->u.bind.ctx_list[0].context_id)) {
 942
 943                 bind_ack_ctx.result = 0;
 944                 bind_ack_ctx.reason = 0;
 945                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 946         } else {
 947                 p->pipe_bound = False;
 948                 /* Rejection reason: abstract syntax not supported */
 949                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 950                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
 951                 bind_ack_ctx.syntax = null_ndr_syntax_id;
 952         }
 953
 954         /*
 955          * Check if this is an authenticated bind request.
 956          */
 957         if (pkt->auth_length) {
 958                 /* Quick length check. Won't catch a bad auth footer,
 959                  * prevents overrun. */
 960
 961                 if (pkt->frag_length < RPC_HEADER_LEN +
 962                                         DCERPC_AUTH_TRAILER_LENGTH +
 963                                         pkt->auth_length) {
 964                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
 965                                 "too long for fragment %u.\n",
 966                                 (unsigned int)pkt->auth_length,
 967                                 (unsigned int)pkt->frag_length));
 968                         goto err_exit;
 969                 }
 970
 971                 /*
 972                  * Decode the authentication verifier.
 973                  */
 974                 status = dcerpc_pull_dcerpc_auth(pkt,
 975                                                  &pkt->u.bind.auth_info,
 976                                                  &auth_info, p->endian);
 977                 if (!NT_STATUS_IS_OK(status)) {
 978                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
 979                         goto err_exit;
 980                 }
 981
 982                 auth_type = auth_info.auth_type;
 983
 984                 /* Work out if we have to sign or seal etc. */
 985                 switch (auth_info.auth_level) {
 986                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 987                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 988                         break;
 989                 case DCERPC_AUTH_LEVEL_PRIVACY:
 990                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 991                         break;
 992                 case DCERPC_AUTH_LEVEL_CONNECT:
 993                         p->auth.auth_level = DCERPC_AUTH_LEVEL_CONNECT;
 994                         break;
 995                 default:
 996                         DEBUG(0, ("Unexpected auth level (%u).\n",
 997                                 (unsigned int)auth_info.auth_level ));
 998                         goto err_exit;
 999                 }
1000
1001                 switch (auth_type) {
1002                 case DCERPC_AUTH_TYPE_NTLMSSP:
1003                         if (!pipe_ntlmssp_auth_bind(p, pkt,
1004                                                 &auth_info, &auth_resp)) {
1005                                 goto err_exit;
1006                         }
1007                         assoc_gid = 0x7a77;
1008                         break;
1009
1010                 case DCERPC_AUTH_TYPE_SCHANNEL:
1011                         if (!pipe_schannel_auth_bind(p, pkt,
1012                                                 &auth_info, &auth_resp)) {
1013                                 goto err_exit;
1014                         }
1015                         break;
1016
1017                 case DCERPC_AUTH_TYPE_SPNEGO:
1018                         if (!pipe_spnego_auth_bind(p, pkt,
1019                                                 &auth_info, &auth_resp)) {
1020                                 goto err_exit;
1021                         }
1022                         break;
1023
1024                 case DCERPC_AUTH_TYPE_KRB5:
1025                         if (!pipe_gssapi_auth_bind(p, pkt,
1026                                                 &auth_info, &auth_resp)) {
1027                                 goto err_exit;
1028                         }
1029                         break;
1030
1031                 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
1032                         if (p->transport == NCALRPC && p->ncalrpc_as_system) {
1033                                 TALLOC_FREE(p->session_info);
1034
1035                                 status = make_session_info_system(p,
1036                                                                   &p->session_info);
1037                                 if (!NT_STATUS_IS_OK(status)) {
1038                                         goto err_exit;
1039                                 }
1040
1041                                 auth_resp = data_blob_talloc(pkt,
1042                                                              "NCALRPC_AUTH_OK",
1043                                                              15);
1044
1045                                 p->auth.auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
1046                                 p->pipe_bound = true;
1047                         } else {
1048                                 goto err_exit;
1049                         }
1050                         break;
1051
1052                 case DCERPC_AUTH_TYPE_NONE:
1053                         break;
1054
1055                 default:
1056                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
1057                         goto err_exit;
1058                 }
1059         }
1060
1061         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
1062                 /* Unauthenticated bind request. */
1063                 /* We're finished - no more packets. */
1064                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
1065                 /* We must set the pipe auth_level here also. */
1066                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1067                 p->pipe_bound = True;
1068                 /* The session key was initialized from the SMB
1069                  * session in make_internal_rpc_pipe_p */
1070         }
1071
1072         ZERO_STRUCT(u.bind_ack);
1073         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1074         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1075         u.bind_ack.assoc_group_id = assoc_gid;
1076
1077         /* name has to be \PIPE\xxxxx */
1078         u.bind_ack.secondary_address =
1079                         talloc_asprintf(pkt, "\\PIPE\\%s",
1080                                         rpc_srv_get_pipe_srv_name(&id));
1081         if (!u.bind_ack.secondary_address) {
1082                 DEBUG(0, ("Out of memory!\n"));
1083                 goto err_exit;
1084         }
1085         u.bind_ack.secondary_address_size =
1086                                 strlen(u.bind_ack.secondary_address) + 1;
1087
1088         u.bind_ack.num_results = 1;
1089         u.bind_ack.ctx_list = &bind_ack_ctx;
1090
1091         /* NOTE: We leave the auth_info empty so we can calculate the padding
1092          * later and then append the auth_info --simo */
1093
1094         /*
1095          * Marshall directly into the outgoing PDU space. We
1096          * must do this as we need to set to the bind response
1097          * header and are never sending more than one PDU here.
1098          */
1099
1100         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1101                                           DCERPC_PKT_BIND_ACK,
1102                                           DCERPC_PFC_FLAG_FIRST |
1103                                                 DCERPC_PFC_FLAG_LAST,
1104                                           auth_resp.length,
1105                                           pkt->call_id,
1106                                           &u,
1107                                           &p->out_data.frag);
1108         if (!NT_STATUS_IS_OK(status)) {
1109                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1110                           nt_errstr(status)));
1111         }
1112
1113         if (auth_resp.length) {
1114
1115                 status = dcerpc_push_dcerpc_auth(pkt,
1116                                                  auth_type,
1117                                                  auth_info.auth_level,
1118                                                  0,
1119                                                  1, /* auth_context_id */
1120                                                  &auth_resp,
1121                                                  &auth_blob);
1122                 if (!NT_STATUS_IS_OK(status)) {
1123                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1124                         goto err_exit;
1125                 }
1126         }
1127
1128         /* Now that we have the auth len store it into the right place in
1129          * the dcerpc header */
1130         dcerpc_set_frag_length(&p->out_data.frag,
1131                                 p->out_data.frag.length + auth_blob.length);
1132
1133         if (auth_blob.length) {
1134
1135                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1136                                         auth_blob.data, auth_blob.length)) {
1137                         DEBUG(0, ("Append of auth info failed.\n"));
1138                         goto err_exit;
1139                 }
1140         }
1141
1142         /*
1143          * Setup the lengths for the initial reply.
1144          */
1145
1146         p->out_data.data_sent_length = 0;
1147         p->out_data.current_pdu_sent = 0;
1148
1149         TALLOC_FREE(auth_blob.data);
1150         return True;
1151
1152   err_exit:
1153
1154         data_blob_free(&p->out_data.frag);
1155         TALLOC_FREE(auth_blob.data);
1156         return setup_bind_nak(p, pkt);
1157 }
1158
1159 /*******************************************************************
1160  This is the "stage3" response after a bind request and reply.
1161 *******************************************************************/
1162
1163 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
1164 {
1165         struct dcerpc_auth auth_info;
1166         DATA_BLOB response = data_blob_null;
1167         struct auth_ntlmssp_state *ntlmssp_ctx;
1168         struct spnego_context *spnego_ctx;
1169         struct gse_context *gse_ctx;
1170         NTSTATUS status;
1171
1172         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
1173
1174         if (pkt->auth_length == 0) {
1175                 DEBUG(0, ("No auth field sent for bind request!\n"));
1176                 goto err;
1177         }
1178
1179         /* Ensure there's enough data for an authenticated request. */
1180         if (pkt->frag_length < RPC_HEADER_LEN
1181                                 + DCERPC_AUTH_TRAILER_LENGTH
1182                                 + pkt->auth_length) {
1183                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
1184                                 "%u is too large.\n",
1185                         (unsigned int)pkt->auth_length));
1186                 goto err;
1187         }
1188
1189         /*
1190          * Decode the authentication verifier response.
1191          */
1192
1193         status = dcerpc_pull_dcerpc_auth(pkt,
1194                                          &pkt->u.auth3.auth_info,
1195                                          &auth_info, p->endian);
1196         if (!NT_STATUS_IS_OK(status)) {
1197                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
1198                 goto err;
1199         }
1200
1201         /* We must NEVER look at auth_info->auth_pad_len here,
1202          * as old Samba client code gets it wrong and sends it
1203          * as zero. JRA.
1204          */
1205
1206         if (auth_info.auth_type != p->auth.auth_type) {
1207                 DEBUG(0, ("Auth type mismatch! Client sent %d, "
1208                           "but auth was started as type %d!\n",
1209                           auth_info.auth_type, p->auth.auth_type));
1210                 goto err;
1211         }
1212
1213         switch (auth_info.auth_type) {
1214         case DCERPC_AUTH_TYPE_NTLMSSP:
1215                 ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1216                                                     struct auth_ntlmssp_state);
1217                 status = ntlmssp_server_step(ntlmssp_ctx,
1218                                              pkt, &auth_info.credentials,
1219                                              &response);
1220                 break;
1221         case DCERPC_AUTH_TYPE_KRB5:
1222                 gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1223                                                 struct gse_context);
1224                 status = gssapi_server_step(gse_ctx,
1225                                             pkt, &auth_info.credentials,
1226                                             &response);
1227                 break;
1228         case DCERPC_AUTH_TYPE_SPNEGO:
1229                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1230                                                    struct spnego_context);
1231                 status = spnego_server_step(spnego_ctx,
1232                                             pkt, &auth_info.credentials,
1233                                             &response);
1234                 break;
1235         default:
1236                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
1237                           (unsigned int)auth_info.auth_type));
1238                 return false;
1239         }
1240
1241         if (NT_STATUS_EQUAL(status,
1242                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1243             response.length) {
1244                 DEBUG(0, (__location__ ": This was supposed to be the final "
1245                           "leg, but crypto machinery claims a response is "
1246                           "needed, aborting auth!\n"));
1247                 data_blob_free(&response);
1248                 goto err;
1249         }
1250         if (!NT_STATUS_IS_OK(status)) {
1251                 DEBUG(0, ("Auth failed (%s)\n", nt_errstr(status)));
1252                 goto err;
1253         }
1254
1255         /* Now verify auth was indeed successful and extract server info */
1256         status = pipe_auth_verify_final(p);
1257         if (!NT_STATUS_IS_OK(status)) {
1258                 DEBUG(0, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1259                 goto err;
1260         }
1261
1262         return true;
1263
1264 err:
1265
1266         TALLOC_FREE(p->auth.auth_ctx);
1267         return false;
1268 }
1269
1270 /****************************************************************************
1271  Deal with an alter context call. Can be third part of 3 leg auth request for
1272  SPNEGO calls.
1273 ****************************************************************************/
1274
1275 static bool api_pipe_alter_context(struct pipes_struct *p,
1276                                         struct ncacn_packet *pkt)
1277 {
1278         struct dcerpc_auth auth_info;
1279         uint16 assoc_gid;
1280         NTSTATUS status;
1281         union dcerpc_payload u;
1282         struct dcerpc_ack_ctx bind_ack_ctx;
1283         DATA_BLOB auth_resp = data_blob_null;
1284         DATA_BLOB auth_blob = data_blob_null;
1285         int pad_len = 0;
1286         struct auth_ntlmssp_state *ntlmssp_ctx;
1287         struct spnego_context *spnego_ctx;
1288         struct gse_context *gse_ctx;
1289
1290         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1291
1292         if (pkt->u.bind.assoc_group_id != 0) {
1293                 assoc_gid = pkt->u.bind.assoc_group_id;
1294         } else {
1295                 assoc_gid = 0x53f0;
1296         }
1297
1298         /*
1299          * Create the bind response struct.
1300          */
1301
1302         /* If the requested abstract synt uuid doesn't match our client pipe,
1303                 reject the bind_ack & set the transfer interface synt to all 0's,
1304                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1305                 unknown to NT4)
1306                 Needed when adding entries to a DACL from NT5 - SK */
1307
1308         if (check_bind_req(p,
1309                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1310                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1311                         pkt->u.bind.ctx_list[0].context_id)) {
1312
1313                 bind_ack_ctx.result = 0;
1314                 bind_ack_ctx.reason = 0;
1315                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1316         } else {
1317                 p->pipe_bound = False;
1318                 /* Rejection reason: abstract syntax not supported */
1319                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1320                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1321                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1322         }
1323
1324         /*
1325          * Check if this is an authenticated alter context request.
1326          */
1327         if (pkt->auth_length) {
1328                 /* Quick length check. Won't catch a bad auth footer,
1329                  * prevents overrun. */
1330
1331                 if (pkt->frag_length < RPC_HEADER_LEN +
1332                                         DCERPC_AUTH_TRAILER_LENGTH +
1333                                         pkt->auth_length) {
1334                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1335                                 "too long for fragment %u.\n",
1336                                 (unsigned int)pkt->auth_length,
1337                                 (unsigned int)pkt->frag_length ));
1338                         goto err_exit;
1339                 }
1340
1341                 status = dcerpc_pull_dcerpc_auth(pkt,
1342                                                  &pkt->u.bind.auth_info,
1343                                                  &auth_info, p->endian);
1344                 if (!NT_STATUS_IS_OK(status)) {
1345                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1346                         goto err_exit;
1347                 }
1348
1349                 /* We can only finish if the pipe is unbound for now */
1350                 if (p->pipe_bound) {
1351                         DEBUG(0, (__location__ ": Pipe already bound, "
1352                                   "Altering Context not yet supported!\n"));
1353                         goto err_exit;
1354                 }
1355
1356                 if (auth_info.auth_type != p->auth.auth_type) {
1357                         DEBUG(0, ("Auth type mismatch! Client sent %d, "
1358                                   "but auth was started as type %d!\n",
1359                                   auth_info.auth_type, p->auth.auth_type));
1360                         goto err_exit;
1361                 }
1362
1363
1364                 switch (auth_info.auth_type) {
1365                 case DCERPC_AUTH_TYPE_SPNEGO:
1366                         spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1367                                                         struct spnego_context);
1368                         status = spnego_server_step(spnego_ctx,
1369                                                     pkt,
1370                                                     &auth_info.credentials,
1371                                                     &auth_resp);
1372                         break;
1373
1374                 case DCERPC_AUTH_TYPE_KRB5:
1375                         gse_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1376                                                         struct gse_context);
1377                         status = gssapi_server_step(gse_ctx,
1378                                                     pkt,
1379                                                     &auth_info.credentials,
1380                                                     &auth_resp);
1381                         break;
1382                 case DCERPC_AUTH_TYPE_NTLMSSP:
1383                         ntlmssp_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1384                                                     struct auth_ntlmssp_state);
1385                         status = ntlmssp_server_step(ntlmssp_ctx,
1386                                                      pkt,
1387                                                      &auth_info.credentials,
1388                                                      &auth_resp);
1389                         break;
1390
1391                 default:
1392                         DEBUG(3, (__location__ ": Usupported auth type (%d) "
1393                                   "in alter-context call\n",
1394                                   auth_info.auth_type));
1395                         goto err_exit;
1396                 }
1397
1398                 if (NT_STATUS_IS_OK(status)) {
1399                         /* third leg of auth, verify auth info */
1400                         status = pipe_auth_verify_final(p);
1401                         if (!NT_STATUS_IS_OK(status)) {
1402                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1403                                           nt_errstr(status)));
1404                                 goto err_exit;
1405                         }
1406                 } else if (NT_STATUS_EQUAL(status,
1407                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1408                         DEBUG(10, ("More auth legs required.\n"));
1409                 } else {
1410                         DEBUG(0, ("Auth step returned an error (%s)\n",
1411                                   nt_errstr(status)));
1412                         goto err_exit;
1413                 }
1414         }
1415
1416         ZERO_STRUCT(u.alter_resp);
1417         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1418         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1419         u.alter_resp.assoc_group_id = assoc_gid;
1420
1421         /* secondary address CAN be NULL
1422          * as the specs say it's ignored.
1423          * It MUST be NULL to have the spoolss working.
1424          */
1425         u.alter_resp.secondary_address = "";
1426         u.alter_resp.secondary_address_size = 1;
1427
1428         u.alter_resp.num_results = 1;
1429         u.alter_resp.ctx_list = &bind_ack_ctx;
1430
1431         /* NOTE: We leave the auth_info empty so we can calculate the padding
1432          * later and then append the auth_info --simo */
1433
1434         /*
1435          * Marshall directly into the outgoing PDU space. We
1436          * must do this as we need to set to the bind response
1437          * header and are never sending more than one PDU here.
1438          */
1439
1440         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1441                                           DCERPC_PKT_ALTER_RESP,
1442                                           DCERPC_PFC_FLAG_FIRST |
1443                                                 DCERPC_PFC_FLAG_LAST,
1444                                           auth_resp.length,
1445                                           pkt->call_id,
1446                                           &u,
1447                                           &p->out_data.frag);
1448         if (!NT_STATUS_IS_OK(status)) {
1449                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1450                           nt_errstr(status)));
1451         }
1452
1453         if (auth_resp.length) {
1454
1455                 /* Work out any padding needed before the auth footer. */
1456                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1457                 if (pad_len) {
1458                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1459                         DEBUG(10, ("auth pad_len = %u\n",
1460                                    (unsigned int)pad_len));
1461                 }
1462
1463                 status = dcerpc_push_dcerpc_auth(pkt,
1464                                                  auth_info.auth_type,
1465                                                  auth_info.auth_level,
1466                                                  pad_len,
1467                                                  1, /* auth_context_id */
1468                                                  &auth_resp,
1469                                                  &auth_blob);
1470                 if (!NT_STATUS_IS_OK(status)) {
1471                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1472                         goto err_exit;
1473                 }
1474         }
1475
1476         /* Now that we have the auth len store it into the right place in
1477          * the dcerpc header */
1478         dcerpc_set_frag_length(&p->out_data.frag,
1479                                 p->out_data.frag.length +
1480                                         pad_len + auth_blob.length);
1481
1482         if (auth_resp.length) {
1483                 if (pad_len) {
1484                         char pad[SERVER_NDR_PADDING_SIZE];
1485                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1486                         if (!data_blob_append(p->mem_ctx,
1487                                                 &p->out_data.frag,
1488                                                 pad, pad_len)) {
1489                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1490                                           "%u bytes of pad data.\n",
1491                                           (unsigned int)pad_len));
1492                                 goto err_exit;
1493                         }
1494                 }
1495
1496                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1497                                         auth_blob.data, auth_blob.length)) {
1498                         DEBUG(0, ("Append of auth info failed.\n"));
1499                         goto err_exit;
1500                 }
1501         }
1502
1503         /*
1504          * Setup the lengths for the initial reply.
1505          */
1506
1507         p->out_data.data_sent_length = 0;
1508         p->out_data.current_pdu_sent = 0;
1509
1510         TALLOC_FREE(auth_blob.data);
1511         return True;
1512
1513   err_exit:
1514
1515         data_blob_free(&p->out_data.frag);
1516         TALLOC_FREE(auth_blob.data);
1517         return setup_bind_nak(p, pkt);
1518 }
1519
1520 /****************************************************************************
1521  Find the set of RPC functions associated with this context_id
1522 ****************************************************************************/
1523
1524 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
1525 {
1526         PIPE_RPC_FNS *fns = NULL;
1527
1528         if ( !list ) {
1529                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
1530                 return NULL;
1531         }
1532
1533         for (fns=list; fns; fns=fns->next ) {
1534                 if ( fns->context_id == context_id )
1535                         return fns;
1536         }
1537         return NULL;
1538 }
1539
1540 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1541                        const struct api_struct *api_rpc_cmds, int n_cmds);
1542
1543 /****************************************************************************
1544  Find the correct RPC function to call for this request.
1545  If the pipe is authenticated then become the correct UNIX user
1546  before doing the call.
1547 ****************************************************************************/
1548
1549 static bool api_pipe_request(struct pipes_struct *p,
1550                                 struct ncacn_packet *pkt)
1551 {
1552         bool ret = False;
1553         bool changed_user = False;
1554         PIPE_RPC_FNS *pipe_fns;
1555
1556         if (p->pipe_bound &&
1557             ((p->auth.auth_type == DCERPC_AUTH_TYPE_NTLMSSP) ||
1558              (p->auth.auth_type == DCERPC_AUTH_TYPE_KRB5) ||
1559              (p->auth.auth_type == DCERPC_AUTH_TYPE_SPNEGO))) {
1560                 if(!become_authenticated_pipe_user(p)) {
1561                         data_blob_free(&p->out_data.rdata);
1562                         return False;
1563                 }
1564                 changed_user = True;
1565         }
1566
1567         DEBUG(5, ("Requested \\PIPE\\%s\n",
1568                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1569
1570         /* get the set of RPC functions for this context */
1571
1572         pipe_fns = find_pipe_fns_by_context(p->contexts,
1573                                             pkt->u.request.context_id);
1574
1575         if ( pipe_fns ) {
1576                 TALLOC_CTX *frame = talloc_stackframe();
1577                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds);
1578                 TALLOC_FREE(frame);
1579         }
1580         else {
1581                 DEBUG(0, ("No rpc function table associated with context "
1582                           "[%d] on pipe [%s]\n",
1583                           pkt->u.request.context_id,
1584                           get_pipe_name_from_syntax(talloc_tos(),
1585                                                     &p->syntax)));
1586         }
1587
1588         if (changed_user) {
1589                 unbecome_authenticated_pipe_user();
1590         }
1591
1592         return ret;
1593 }
1594
1595 /*******************************************************************
1596  Calls the underlying RPC function for a named pipe.
1597  ********************************************************************/
1598
1599 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1600                        const struct api_struct *api_rpc_cmds, int n_cmds)
1601 {
1602         int fn_num;
1603         uint32_t offset1;
1604
1605         /* interpret the command */
1606         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1607                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1608                  pkt->u.request.opnum));
1609
1610         if (DEBUGLEVEL >= 50) {
1611                 fstring name;
1612                 slprintf(name, sizeof(name)-1, "in_%s",
1613                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1614                 dump_pdu_region(name, pkt->u.request.opnum,
1615                                 &p->in_data.data, 0,
1616                                 p->in_data.data.length);
1617         }
1618
1619         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1620                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1621                     api_rpc_cmds[fn_num].fn != NULL) {
1622                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1623                                   api_rpc_cmds[fn_num].name));
1624                         break;
1625                 }
1626         }
1627
1628         if (fn_num == n_cmds) {
1629                 /*
1630                  * For an unknown RPC just return a fault PDU but
1631                  * return True to allow RPC's on the pipe to continue
1632                  * and not put the pipe into fault state. JRA.
1633                  */
1634                 DEBUG(4, ("unknown\n"));
1635                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1636                 return True;
1637         }
1638
1639         offset1 = p->out_data.rdata.length;
1640
1641         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1642                 fn_num, api_rpc_cmds[fn_num].fn));
1643         /* do the actual command */
1644         if(!api_rpc_cmds[fn_num].fn(p)) {
1645                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1646                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1647                          api_rpc_cmds[fn_num].name));
1648                 data_blob_free(&p->out_data.rdata);
1649                 return False;
1650         }
1651
1652         if (p->bad_handle_fault_state) {
1653                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1654                 p->bad_handle_fault_state = False;
1655                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
1656                 return True;
1657         }
1658
1659         if (p->rng_fault_state) {
1660                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
1661                 p->rng_fault_state = False;
1662                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1663                 return True;
1664         }
1665
1666         if (DEBUGLEVEL >= 50) {
1667                 fstring name;
1668                 slprintf(name, sizeof(name)-1, "out_%s",
1669                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1670                 dump_pdu_region(name, pkt->u.request.opnum,
1671                                 &p->out_data.rdata, offset1,
1672                                 p->out_data.rdata.length);
1673         }
1674
1675         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1676                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1677
1678         /* Check for buffer underflow in rpc parsing */
1679         if ((DEBUGLEVEL >= 10) &&
1680             (pkt->frag_length < p->in_data.data.length)) {
1681                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1682                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1683                               p->in_data.data.length - pkt->frag_length);
1684         }
1685
1686         return True;
1687 }
1688
1689 /****************************************************************************
1690  Initialise an outgoing packet.
1691 ****************************************************************************/
1692
1693 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1694 {
1695         output_data *o_data = &p->out_data;
1696
1697         /* Reset the offset counters. */
1698         o_data->data_sent_length = 0;
1699         o_data->current_pdu_sent = 0;
1700
1701         data_blob_free(&o_data->frag);
1702
1703         /* Free any memory in the current return data buffer. */
1704         data_blob_free(&o_data->rdata);
1705
1706         return True;
1707 }
1708
1709 /****************************************************************************
1710  Sets the fault state on incoming packets.
1711 ****************************************************************************/
1712
1713 void set_incoming_fault(struct pipes_struct *p)
1714 {
1715         data_blob_free(&p->in_data.data);
1716         p->in_data.pdu_needed_len = 0;
1717         p->in_data.pdu.length = 0;
1718         p->fault_state = True;
1719         DEBUG(10, ("set_incoming_fault: Setting fault state on pipe %s\n",
1720                    get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1721 }
1722
1723 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1724                                     struct ncacn_packet *pkt,
1725                                     DATA_BLOB *raw_pkt)
1726 {
1727         NTSTATUS status;
1728         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1729         size_t pad_len;
1730
1731         DEBUG(10, ("Checking request auth.\n"));
1732
1733         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1734                 hdr_size += 16;
1735         }
1736
1737         /* in case of sealing this function will unseal the data in place */
1738         status = dcerpc_check_auth(auth, pkt,
1739                                    &pkt->u.request.stub_and_verifier,
1740                                    hdr_size, raw_pkt,
1741                                    &pad_len);
1742         if (!NT_STATUS_IS_OK(status)) {
1743                 return status;
1744         }
1745
1746
1747         /* remove padding and auth trailer,
1748          * this way the caller will get just the data */
1749         if (pkt->auth_length) {
1750                 size_t trail_len = pad_len
1751                                         + DCERPC_AUTH_TRAILER_LENGTH
1752                                         + pkt->auth_length;
1753                 if (pkt->u.request.stub_and_verifier.length < trail_len) {
1754                         return NT_STATUS_INFO_LENGTH_MISMATCH;
1755                 }
1756                 pkt->u.request.stub_and_verifier.length -= trail_len;
1757         }
1758
1759         return NT_STATUS_OK;
1760 }
1761
1762 /****************************************************************************
1763  Processes a request pdu. This will do auth processing if needed, and
1764  appends the data into the complete stream if the LAST flag is not set.
1765 ****************************************************************************/
1766
1767 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1768 {
1769         NTSTATUS status;
1770         DATA_BLOB data;
1771
1772         if (!p->pipe_bound) {
1773                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1774                 set_incoming_fault(p);
1775                 return False;
1776         }
1777
1778         /* Store the opnum */
1779         p->opnum = pkt->u.request.opnum;
1780
1781         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1782         if (!NT_STATUS_IS_OK(status)) {
1783                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1784                           nt_errstr(status)));
1785                 set_incoming_fault(p);
1786                 return false;
1787         }
1788
1789         data = pkt->u.request.stub_and_verifier;
1790
1791         /*
1792          * Check the data length doesn't go over the 15Mb limit.
1793          * increased after observing a bug in the Windows NT 4.0 SP6a
1794          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1795          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1796          */
1797
1798         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1799                 DEBUG(0, ("process_request_pdu: "
1800                           "rpc data buffer too large (%u) + (%u)\n",
1801                           (unsigned int)p->in_data.data.length,
1802                           (unsigned int)data.length));
1803                 set_incoming_fault(p);
1804                 return False;
1805         }
1806
1807         /*
1808          * Append the data portion into the buffer and return.
1809          */
1810
1811         if (data.length) {
1812                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1813                                           data.data, data.length)) {
1814                         DEBUG(0, ("Unable to append data size %u "
1815                                   "to parse buffer of size %u.\n",
1816                                   (unsigned int)data.length,
1817                                   (unsigned int)p->in_data.data.length));
1818                         set_incoming_fault(p);
1819                         return False;
1820                 }
1821         }
1822
1823         if (pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1824                 bool ret = False;
1825                 /*
1826                  * Ok - we finally have a complete RPC stream.
1827                  * Call the rpc command to process it.
1828                  */
1829
1830                 /*
1831                  * Process the complete data stream here.
1832                  */
1833                 if (pipe_init_outgoing_data(p)) {
1834                         ret = api_pipe_request(p, pkt);
1835                 }
1836
1837                 return ret;
1838         }
1839
1840         return True;
1841 }
1842
1843 /****************************************************************************
1844  Processes a finished PDU stored in p->in_data.pdu.
1845 ****************************************************************************/
1846
1847 void process_complete_pdu(struct pipes_struct *p)
1848 {
1849         struct ncacn_packet *pkt = NULL;
1850         NTSTATUS status;
1851         bool reply = False;
1852
1853         if(p->fault_state) {
1854                 DEBUG(10,("process_complete_pdu: pipe %s in fault state.\n",
1855                           get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1856                 goto done;
1857         }
1858
1859         pkt = talloc(p->mem_ctx, struct ncacn_packet);
1860         if (!pkt) {
1861                 DEBUG(0, ("Out of memory!\n"));
1862                 goto done;
1863         }
1864
1865         /*
1866          * Ensure we're using the corrent endianness for both the
1867          * RPC header flags and the raw data we will be reading from.
1868          */
1869         if (dcerpc_get_endian_flag(&p->in_data.pdu) & DCERPC_DREP_LE) {
1870                 p->endian = RPC_LITTLE_ENDIAN;
1871         } else {
1872                 p->endian = RPC_BIG_ENDIAN;
1873         }
1874         DEBUG(10, ("PDU is in %s Endian format!\n", p->endian?"Big":"Little"));
1875
1876         status = dcerpc_pull_ncacn_packet(pkt, &p->in_data.pdu,
1877                                           pkt, p->endian);
1878         if (!NT_STATUS_IS_OK(status)) {
1879                 DEBUG(0, ("Failed to unmarshal rpc packet: %s!\n",
1880                           nt_errstr(status)));
1881                 goto done;
1882         }
1883
1884         /* Store the call_id */
1885         p->call_id = pkt->call_id;
1886
1887         DEBUG(10, ("Processing packet type %d\n", (int)pkt->ptype));
1888
1889         switch (pkt->ptype) {
1890         case DCERPC_PKT_REQUEST:
1891                 reply = process_request_pdu(p, pkt);
1892                 break;
1893
1894         case DCERPC_PKT_PING: /* CL request - ignore... */
1895                 DEBUG(0, ("process_complete_pdu: Error. "
1896                           "Connectionless packet type %d received on "
1897                           "pipe %s.\n", (int)pkt->ptype,
1898                          get_pipe_name_from_syntax(talloc_tos(),
1899                                                    &p->syntax)));
1900                 break;
1901
1902         case DCERPC_PKT_RESPONSE: /* No responses here. */
1903                 DEBUG(0, ("process_complete_pdu: Error. "
1904                           "DCERPC_PKT_RESPONSE received from client "
1905                           "on pipe %s.\n",
1906                          get_pipe_name_from_syntax(talloc_tos(),
1907                                                    &p->syntax)));
1908                 break;
1909
1910         case DCERPC_PKT_FAULT:
1911         case DCERPC_PKT_WORKING:
1912                 /* CL request - reply to a ping when a call in process. */
1913         case DCERPC_PKT_NOCALL:
1914                 /* CL - server reply to a ping call. */
1915         case DCERPC_PKT_REJECT:
1916         case DCERPC_PKT_ACK:
1917         case DCERPC_PKT_CL_CANCEL:
1918         case DCERPC_PKT_FACK:
1919         case DCERPC_PKT_CANCEL_ACK:
1920                 DEBUG(0, ("process_complete_pdu: Error. "
1921                           "Connectionless packet type %u received on "
1922                           "pipe %s.\n", (unsigned int)pkt->ptype,
1923                          get_pipe_name_from_syntax(talloc_tos(),
1924                                                    &p->syntax)));
1925                 break;
1926
1927         case DCERPC_PKT_BIND:
1928                 /*
1929                  * We assume that a pipe bind is only in one pdu.
1930                  */
1931                 if (pipe_init_outgoing_data(p)) {
1932                         reply = api_pipe_bind_req(p, pkt);
1933                 }
1934                 break;
1935
1936         case DCERPC_PKT_BIND_ACK:
1937         case DCERPC_PKT_BIND_NAK:
1938                 DEBUG(0, ("process_complete_pdu: Error. "
1939                           "DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1940                           "packet type %u received on pipe %s.\n",
1941                           (unsigned int)pkt->ptype,
1942                          get_pipe_name_from_syntax(talloc_tos(),
1943                                                    &p->syntax)));
1944                 break;
1945
1946
1947         case DCERPC_PKT_ALTER:
1948                 /*
1949                  * We assume that a pipe bind is only in one pdu.
1950                  */
1951                 if (pipe_init_outgoing_data(p)) {
1952                         reply = api_pipe_alter_context(p, pkt);
1953                 }
1954                 break;
1955
1956         case DCERPC_PKT_ALTER_RESP:
1957                 DEBUG(0, ("process_complete_pdu: Error. "
1958                           "DCERPC_PKT_ALTER_RESP on pipe %s: "
1959                           "Should only be server -> client.\n",
1960                          get_pipe_name_from_syntax(talloc_tos(),
1961                                                    &p->syntax)));
1962                 break;
1963
1964         case DCERPC_PKT_AUTH3:
1965                 /*
1966                  * The third packet in an auth exchange.
1967                  */
1968                 if (pipe_init_outgoing_data(p)) {
1969                         reply = api_pipe_bind_auth3(p, pkt);
1970                 }
1971                 break;
1972
1973         case DCERPC_PKT_SHUTDOWN:
1974                 DEBUG(0, ("process_complete_pdu: Error. "
1975                           "DCERPC_PKT_SHUTDOWN on pipe %s: "
1976                           "Should only be server -> client.\n",
1977                          get_pipe_name_from_syntax(talloc_tos(),
1978                                                    &p->syntax)));
1979                 break;
1980
1981         case DCERPC_PKT_CO_CANCEL:
1982                 /* For now just free all client data and continue
1983                  * processing. */
1984                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1985                          " Abandoning rpc call.\n"));
1986                 /* As we never do asynchronous RPC serving, we can
1987                  * never cancel a call (as far as I know).
1988                  * If we ever did we'd have to send a cancel_ack reply.
1989                  * For now, just free all client data and continue
1990                  * processing. */
1991                 reply = True;
1992                 break;
1993
1994 #if 0
1995                 /* Enable this if we're doing async rpc. */
1996                 /* We must check the outstanding callid matches. */
1997                 if (pipe_init_outgoing_data(p)) {
1998                         /* Send a cancel_ack PDU reply. */
1999                         /* We should probably check the auth-verifier here. */
2000                         reply = setup_cancel_ack_reply(p, pkt);
2001                 }
2002                 break;
2003 #endif
2004
2005         case DCERPC_PKT_ORPHANED:
2006                 /* We should probably check the auth-verifier here.
2007                  * For now just free all client data and continue
2008                  * processing. */
2009                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
2010                           " Abandoning rpc call.\n"));
2011                 reply = True;
2012                 break;
2013
2014         default:
2015                 DEBUG(0, ("process_complete_pdu: "
2016                           "Unknown rpc type = %u received.\n",
2017                           (unsigned int)pkt->ptype));
2018                 break;
2019         }
2020
2021 done:
2022         if (!reply) {
2023                 DEBUG(3,("process_complete_pdu: DCE/RPC fault sent on "
2024                          "pipe %s\n", get_pipe_name_from_syntax(talloc_tos(),
2025                                                                 &p->syntax)));
2026                 set_incoming_fault(p);
2027                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2028                 TALLOC_FREE(pkt);
2029         } else {
2030                 /*
2031                  * Reset the lengths. We're ready for a new pdu.
2032                  */
2033                 TALLOC_FREE(p->in_data.pdu.data);
2034                 p->in_data.pdu_needed_len = 0;
2035                 p->in_data.pdu.length = 0;
2036         }
2037
2038         TALLOC_FREE(pkt);
2039 }
2040