source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "srv_pipe_internal.h"
  32 #include "../librpc/gen_ndr/ndr_schannel.h"
  33 #include "../libcli/auth/schannel.h"
  34 #include "../libcli/auth/spnego.h"
  35 #include "../libcli/auth/ntlmssp.h"
  36
  37 #undef DBGC_CLASS
  38 #define DBGC_CLASS DBGC_RPC_SRV
  39
  40 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  41 {
  42         struct auth_ntlmssp_state *a = auth->a_u.auth_ntlmssp_state;
  43
  44         if (a) {
  45                 auth_ntlmssp_end(&a);
  46         }
  47         auth->a_u.auth_ntlmssp_state = NULL;
  48 }
  49
  50 static DATA_BLOB generic_session_key(void)
  51 {
  52         return data_blob("SystemLibraryDTC", 16);
  53 }
  54
  55 /*******************************************************************
  56  Handle NTLMSSP.
  57  ********************************************************************/
  58
  59 static bool add_ntlmssp_auth(pipes_struct *p)
  60 {
  61         enum dcerpc_AuthLevel auth_level = p->auth.auth_level;
  62         DATA_BLOB auth_blob = data_blob_null;
  63         NTSTATUS status;
  64
  65         /* FIXME: Is this right ?
  66          * Keeping only to avoid changing semantics during refactoring
  67          * --simo
  68          */
  69         if (auth_level != DCERPC_AUTH_LEVEL_PRIVACY) {
  70                 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
  71         }
  72
  73         /* Generate the auth blob. */
  74         switch (auth_level) {
  75         case DCERPC_AUTH_LEVEL_PRIVACY:
  76                 /* Data portion is encrypted. */
  77                 status = auth_ntlmssp_seal_packet(
  78                                 p->auth.a_u.auth_ntlmssp_state,
  79                                 (TALLOC_CTX *)p->out_data.frag.data,
  80                                 &p->out_data.frag.data[DCERPC_RESPONSE_LENGTH],
  81                                 p->out_data.frag.length
  82                                         - DCERPC_RESPONSE_LENGTH
  83                                         - DCERPC_AUTH_TRAILER_LENGTH,
  84                                 p->out_data.frag.data,
  85                                 p->out_data.frag.length,
  86                                 &auth_blob);
  87                 break;
  88
  89         case DCERPC_AUTH_LEVEL_INTEGRITY:
  90                 /* Data is signed. */
  91                 status = auth_ntlmssp_sign_packet(
  92                                 p->auth.a_u.auth_ntlmssp_state,
  93                                 (TALLOC_CTX *)p->out_data.frag.data,
  94                                 &p->out_data.frag.data[DCERPC_RESPONSE_LENGTH],
  95                                 p->out_data.frag.length
  96                                         - DCERPC_RESPONSE_LENGTH
  97                                         - DCERPC_AUTH_TRAILER_LENGTH,
  98                                 p->out_data.frag.data,
  99                                 p->out_data.frag.length,
 100                                 &auth_blob);
 101                 break;
 102
 103         default:
 104                 status = NT_STATUS_INTERNAL_ERROR;
 105                 return false;
 106         }
 107
 108         if (!NT_STATUS_IS_OK(status)) {
 109                 DEBUG(0, ("Failed to add NTLMSSP auth blob: %s\n",
 110                         nt_errstr(status)));
 111                 data_blob_free(&p->out_data.frag);
 112                 return false;
 113         }
 114
 115         /* Finally append the auth blob. */
 116         if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
 117                                 auth_blob.data, auth_blob.length)) {
 118                 DEBUG(0, ("Failed to add %u bytes auth blob.\n",
 119                           (unsigned int)auth_blob.length));
 120                 data_blob_free(&p->out_data.frag);
 121                 return False;
 122         }
 123         data_blob_free(&auth_blob);
 124
 125         return true;
 126 }
 127
 128 /*******************************************************************
 129  Append a schannel authenticated fragment.
 130  ********************************************************************/
 131
 132 static bool add_schannel_auth(pipes_struct *p)
 133 {
 134         DATA_BLOB auth_blob = data_blob_null;
 135         NTSTATUS status;
 136
 137         /* Schannel processing. */
 138         switch (p->auth.auth_level) {
 139         case DCERPC_AUTH_LEVEL_PRIVACY:
 140                 status = netsec_outgoing_packet(
 141                                 p->auth.a_u.schannel_auth,
 142                                 (TALLOC_CTX *)p->out_data.frag.data,
 143                                 true,
 144                                 &p->out_data.frag.data[DCERPC_RESPONSE_LENGTH],
 145                                 p->out_data.frag.length
 146                                         - DCERPC_RESPONSE_LENGTH
 147                                         - DCERPC_AUTH_TRAILER_LENGTH,
 148                                 &auth_blob);
 149                 break;
 150
 151         case DCERPC_AUTH_LEVEL_INTEGRITY:
 152                 status = netsec_outgoing_packet(
 153                                 p->auth.a_u.schannel_auth,
 154                                 (TALLOC_CTX *)p->out_data.frag.data,
 155                                 false,
 156                                 &p->out_data.frag.data[DCERPC_RESPONSE_LENGTH],
 157                                 p->out_data.frag.length
 158                                         - DCERPC_RESPONSE_LENGTH
 159                                         - DCERPC_AUTH_TRAILER_LENGTH,
 160                                 &auth_blob);
 161                 break;
 162
 163         default:
 164                 status = NT_STATUS_INTERNAL_ERROR;
 165                 break;
 166         }
 167
 168         if (!NT_STATUS_IS_OK(status)) {
 169                 DEBUG(0, ("Failed to add SCHANNEL auth blob: %s\n",
 170                         nt_errstr(status)));
 171                 data_blob_free(&p->out_data.frag);
 172                 return false;
 173         }
 174
 175         if (DEBUGLEVEL >= 10) {
 176                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &auth_blob);
 177         }
 178
 179         if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
 180                                 auth_blob.data, auth_blob.length)) {
 181                 DEBUG(0, ("Failed to add %u bytes auth blob.\n",
 182                           (unsigned int)auth_blob.length));
 183                 data_blob_free(&p->out_data.frag);
 184                 return false;
 185         }
 186         data_blob_free(&auth_blob);
 187
 188         return true;
 189 }
 190
 191 /*******************************************************************
 192  Generate the next PDU to be returned from the data.
 193 ********************************************************************/
 194
 195 static bool create_next_packet(pipes_struct *p,
 196                                 enum dcerpc_AuthType auth_type,
 197                                 enum dcerpc_AuthLevel auth_level,
 198                                 size_t auth_length)
 199 {
 200         union dcerpc_payload u;
 201         uint8_t pfc_flags;
 202         size_t data_len_left;
 203         size_t data_len;
 204         size_t max_len;
 205         size_t pad_len = 0;
 206         NTSTATUS status;
 207
 208         ZERO_STRUCT(u.response);
 209
 210         /* Set up rpc packet pfc flags. */
 211         if (p->out_data.data_sent_length == 0) {
 212                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 213         } else {
 214                 pfc_flags = 0;
 215         }
 216
 217         /* Work out how much we can fit in a single PDU. */
 218         data_len_left = p->out_data.rdata.length -
 219                                 p->out_data.data_sent_length;
 220
 221         /* Ensure there really is data left to send. */
 222         if (!data_len_left) {
 223                 DEBUG(0, ("No data left to send !\n"));
 224                 return false;
 225         }
 226
 227         /* Max space available - not including padding. */
 228         if (auth_length) {
 229                 max_len = RPC_MAX_PDU_FRAG_LEN
 230                                 - DCERPC_RESPONSE_LENGTH
 231                                 - DCERPC_AUTH_TRAILER_LENGTH
 232                                 - auth_length;
 233         } else {
 234                 max_len = RPC_MAX_PDU_FRAG_LEN - DCERPC_RESPONSE_LENGTH;
 235         }
 236
 237         /*
 238          * The amount we send is the minimum of the max_len
 239          * and the amount left to send.
 240          */
 241         data_len = MIN(data_len_left, max_len);
 242
 243         if (auth_length) {
 244                 /* Work out any padding alignment requirements. */
 245                 pad_len = (DCERPC_RESPONSE_LENGTH + data_len) %
 246                                                 SERVER_NDR_PADDING_SIZE;
 247                 if (pad_len) {
 248                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
 249                         DEBUG(10, ("Padding size is: %d\n", (int)pad_len));
 250                         /* If we're over filling the packet, we need to make
 251                          * space for the padding at the end of the data. */
 252                         if (data_len + pad_len > max_len) {
 253                                 data_len -= SERVER_NDR_PADDING_SIZE;
 254                         }
 255                 }
 256         }
 257
 258         /* Set up the alloc hint. This should be the data left to send. */
 259         u.response.alloc_hint = data_len_left;
 260
 261         /* Work out if this PDU will be the last. */
 262         if (p->out_data.data_sent_length
 263                                 + data_len >= p->out_data.rdata.length) {
 264                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 265         }
 266
 267         /* Prepare data to be NDR encoded. */
 268         u.response.stub_and_verifier =
 269                 data_blob_const(p->out_data.rdata.data +
 270                                 p->out_data.data_sent_length, data_len);
 271
 272         /* Store the packet in the data stream. */
 273         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 274                                           DCERPC_PKT_RESPONSE,
 275                                           pfc_flags,
 276                                           auth_length,
 277                                           p->call_id,
 278                                           &u,
 279                                           &p->out_data.frag);
 280         if (!NT_STATUS_IS_OK(status)) {
 281                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 282                 return false;
 283         }
 284
 285         if (auth_length) {
 286                 DATA_BLOB empty = data_blob_null;
 287                 DATA_BLOB auth_hdr;
 288
 289                 /* Set the proper length on the pdu, including padding.
 290                  * Only needed if an auth trailer will be appended. */
 291                 dcerpc_set_frag_length(&p->out_data.frag,
 292                                         p->out_data.frag.length
 293                                                 + pad_len
 294                                                 + DCERPC_AUTH_TRAILER_LENGTH
 295                                                 + auth_length);
 296
 297                 if (pad_len) {
 298                         size_t offset = p->out_data.frag.length;
 299
 300                         if (!data_blob_realloc(p->mem_ctx,
 301                                                 &p->out_data.frag,
 302                                                 offset + pad_len)) {
 303                                 DEBUG(0, ("Failed to add padding!\n"));
 304                                 data_blob_free(&p->out_data.frag);
 305                                 return false;
 306                         }
 307                         memset(&p->out_data.frag.data[offset], '\0', pad_len);
 308                 }
 309
 310                 /* auth blob is intentionally empty,
 311                  * it will be appended later */
 312                 status = dcerpc_push_dcerpc_auth(p->out_data.frag.data,
 313                                                  auth_type,
 314                                                  auth_level,
 315                                                  pad_len,
 316                                                  1, /* context id. */
 317                                                  &empty,
 318                                                  &auth_hdr);
 319                 if (!NT_STATUS_IS_OK(status)) {
 320                         DEBUG(0, ("Failed to marshall RPC Auth.\n"));
 321                         return false;
 322                 }
 323
 324                 /* Store auth header in the data stream. */
 325                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
 326                                         auth_hdr.data, auth_hdr.length)) {
 327                         DEBUG(0, ("Out of memory.\n"));
 328                         data_blob_free(&p->out_data.frag);
 329                         return false;
 330                 }
 331                 data_blob_free(&auth_hdr);
 332         }
 333
 334         /* Setup the counts for this PDU. */
 335         p->out_data.data_sent_length += data_len;
 336         p->out_data.current_pdu_sent = 0;
 337         return true;
 338 }
 339
 340 /*******************************************************************
 341  Generate the next PDU to be returned from the data in p->rdata.
 342 ********************************************************************/
 343
 344 bool create_next_pdu(pipes_struct *p)
 345 {
 346         enum dcerpc_AuthType auth_type =
 347                 map_pipe_auth_type_to_rpc_auth_type(p->auth.auth_type);
 348
 349         /*
 350          * If we're in the fault state, keep returning fault PDU's until
 351          * the pipe gets closed. JRA.
 352          */
 353         if (p->fault_state) {
 354                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 355                 return true;
 356         }
 357
 358         switch (p->auth.auth_level) {
 359         case DCERPC_AUTH_LEVEL_NONE:
 360         case DCERPC_AUTH_LEVEL_CONNECT:
 361                 /* This is incorrect for auth level connect. Fixme. JRA */
 362
 363                 /* No authentication done. */
 364                 return create_next_packet(p, auth_type,
 365                                           p->auth.auth_level, 0);
 366
 367         case DCERPC_AUTH_LEVEL_CALL:
 368         case DCERPC_AUTH_LEVEL_PACKET:
 369         case DCERPC_AUTH_LEVEL_INTEGRITY:
 370         case DCERPC_AUTH_LEVEL_PRIVACY:
 371
 372                 switch(p->auth.auth_type) {
 373                 case PIPE_AUTH_TYPE_NTLMSSP:
 374                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 375                         if (!create_next_packet(p, auth_type,
 376                                                 p->auth.auth_level,
 377                                                 NTLMSSP_SIG_SIZE)) {
 378                                 return false;
 379                         }
 380                         return add_ntlmssp_auth(p);
 381
 382                 case PIPE_AUTH_TYPE_SCHANNEL:
 383                         if (!create_next_packet(p, auth_type,
 384                                                 p->auth.auth_level,
 385                                                 SCHANNEL_SIG_SIZE)) {
 386                                 return false;
 387                         }
 388                         return add_schannel_auth(p);
 389                 default:
 390                         break;
 391                 }
 392         default:
 393                 break;
 394         }
 395
 396         DEBUG(0, ("Invalid internal auth level %u / type %u\n",
 397                   (unsigned int)p->auth.auth_level,
 398                   (unsigned int)p->auth.auth_type));
 399         return false;
 400 }
 401
 402 /*******************************************************************
 403  Process an NTLMSSP authentication response.
 404  If this function succeeds, the user has been authenticated
 405  and their domain, name and calling workstation stored in
 406  the pipe struct.
 407 *******************************************************************/
 408
 409 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 410 {
 411         DATA_BLOB session_key, reply;
 412         NTSTATUS status;
 413         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
 414         bool ret;
 415
 416         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
 417                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 418
 419         ZERO_STRUCT(reply);
 420
 421         /* this has to be done as root in order to verify the password */
 422         become_root();
 423         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 424         unbecome_root();
 425
 426         /* Don't generate a reply. */
 427         data_blob_free(&reply);
 428
 429         if (!NT_STATUS_IS_OK(status)) {
 430                 return False;
 431         }
 432
 433         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 434            ensure the underlying NTLMSSP flags are also set. If not we should
 435            refuse the bind. */
 436
 437         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
 438                 if (!auth_ntlmssp_negotiated_sign(a)) {
 439                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 440                                 "but client declined signing.\n",
 441                                  get_pipe_name_from_syntax(talloc_tos(),
 442                                                            &p->syntax)));
 443                         return False;
 444                 }
 445         }
 446         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 447                 if (!auth_ntlmssp_negotiated_seal(a)) {
 448                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 449                                 "but client declined sealing.\n",
 450                                  get_pipe_name_from_syntax(talloc_tos(),
 451                                                            &p->syntax)));
 452                         return False;
 453                 }
 454         }
 455
 456         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 457                   "workstation: %s\n",
 458                   auth_ntlmssp_get_username(a),
 459                   auth_ntlmssp_get_domain(a),
 460                   auth_ntlmssp_get_client(a)));
 461
 462         TALLOC_FREE(p->server_info);
 463
 464         status = auth_ntlmssp_server_info(p, a, &p->server_info);
 465         if (!NT_STATUS_IS_OK(status)) {
 466                 DEBUG(0, ("auth_ntlmssp_server_info failed to obtain the server info for authenticated user: %s\n",
 467                           nt_errstr(status)));
 468                 return false;
 469         }
 470
 471         if (p->server_info->ptok == NULL) {
 472                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 473                 return False;
 474         }
 475
 476         /*
 477          * We're an authenticated bind over smb, so the session key needs to
 478          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 479          * does. See the RPC-SAMBA3SESSIONKEY.
 480          */
 481
 482         session_key = generic_session_key();
 483         if (session_key.data == NULL) {
 484                 return False;
 485         }
 486
 487         ret = server_info_set_session_key(p->server_info, session_key);
 488
 489         data_blob_free(&session_key);
 490
 491         return True;
 492 }
 493
 494 /*******************************************************************
 495  This is the "stage3" NTLMSSP response after a bind request and reply.
 496 *******************************************************************/
 497
 498 bool api_pipe_bind_auth3(pipes_struct *p, struct ncacn_packet *pkt)
 499 {
 500         struct dcerpc_auth auth_info;
 501         uint32_t auth_len = pkt->auth_length;
 502         NTSTATUS status;
 503
 504         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 505
 506         if (auth_len == 0) {
 507                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 508                 goto err;
 509         }
 510
 511         /* Ensure there's enough data for an authenticated request. */
 512         if (RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + auth_len >
 513                                 pkt->frag_length) {
 514                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
 515                                 "%u is too large.\n",
 516                         (unsigned int)auth_len ));
 517                 goto err;
 518         }
 519
 520         /*
 521          * Decode the authentication verifier response.
 522          */
 523
 524         status = dcerpc_pull_dcerpc_auth(pkt,
 525                                          &pkt->u.auth3.auth_info,
 526                                          &auth_info);
 527         if (!NT_STATUS_IS_OK(status)) {
 528                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
 529                 goto err;
 530         }
 531
 532         /* We must NEVER look at auth_info->auth_pad_len here,
 533          * as old Samba client code gets it wrong and sends it
 534          * as zero. JRA.
 535          */
 536
 537         if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
 538                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 539                         (unsigned int)auth_info.auth_type ));
 540                 return False;
 541         }
 542
 543         /*
 544          * The following call actually checks the challenge/response data.
 545          * for correctness against the given DOMAIN\user name.
 546          */
 547
 548         if (!pipe_ntlmssp_verify_final(p, &auth_info.credentials)) {
 549                 goto err;
 550         }
 551
 552         p->pipe_bound = True;
 553
 554         return True;
 555
 556  err:
 557
 558         free_pipe_ntlmssp_auth_data(&p->auth);
 559         p->auth.a_u.auth_ntlmssp_state = NULL;
 560
 561         return False;
 562 }
 563
 564 /*******************************************************************
 565  Marshall a bind_nak pdu.
 566 *******************************************************************/
 567
 568 static bool setup_bind_nak(pipes_struct *p, struct ncacn_packet *pkt)
 569 {
 570         NTSTATUS status;
 571         union dcerpc_payload u;
 572
 573         /* Free any memory in the current return data buffer. */
 574         data_blob_free(&p->out_data.rdata);
 575
 576         /*
 577          * Initialize a bind_nak header.
 578          */
 579
 580         ZERO_STRUCT(u);
 581
 582         u.bind_nak.reject_reason  = 0;
 583
 584         /*
 585          * Marshall directly into the outgoing PDU space. We
 586          * must do this as we need to set to the bind response
 587          * header and are never sending more than one PDU here.
 588          */
 589
 590         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 591                                           DCERPC_PKT_BIND_NAK,
 592                                           DCERPC_PFC_FLAG_FIRST |
 593                                                 DCERPC_PFC_FLAG_LAST,
 594                                           0,
 595                                           pkt->call_id,
 596                                           &u,
 597                                           &p->out_data.frag);
 598         if (!NT_STATUS_IS_OK(status)) {
 599                 return False;
 600         }
 601
 602         p->out_data.data_sent_length = 0;
 603         p->out_data.current_pdu_sent = 0;
 604
 605         if (p->auth.auth_data_free_func) {
 606                 (*p->auth.auth_data_free_func)(&p->auth);
 607         }
 608         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 609         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 610         p->pipe_bound = False;
 611
 612         return True;
 613 }
 614
 615 /*******************************************************************
 616  Marshall a fault pdu.
 617 *******************************************************************/
 618
 619 bool setup_fault_pdu(pipes_struct *p, NTSTATUS fault_status)
 620 {
 621         NTSTATUS status;
 622         union dcerpc_payload u;
 623
 624         /* Free any memory in the current return data buffer. */
 625         data_blob_free(&p->out_data.rdata);
 626
 627         /*
 628          * Initialize a fault header.
 629          */
 630
 631         ZERO_STRUCT(u);
 632
 633         u.fault.status          = NT_STATUS_V(fault_status);
 634         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 635
 636         /*
 637          * Marshall directly into the outgoing PDU space. We
 638          * must do this as we need to set to the bind response
 639          * header and are never sending more than one PDU here.
 640          */
 641
 642         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 643                                           DCERPC_PKT_FAULT,
 644                                           DCERPC_PFC_FLAG_FIRST |
 645                                            DCERPC_PFC_FLAG_LAST |
 646                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 647                                           0,
 648                                           p->call_id,
 649                                           &u,
 650                                           &p->out_data.frag);
 651         if (!NT_STATUS_IS_OK(status)) {
 652                 return False;
 653         }
 654
 655         p->out_data.data_sent_length = 0;
 656         p->out_data.current_pdu_sent = 0;
 657
 658         return True;
 659 }
 660
 661 /*******************************************************************
 662  Ensure a bind request has the correct abstract & transfer interface.
 663  Used to reject unknown binds from Win2k.
 664 *******************************************************************/
 665
 666 static bool check_bind_req(struct pipes_struct *p,
 667                            struct ndr_syntax_id* abstract,
 668                            struct ndr_syntax_id* transfer,
 669                            uint32 context_id)
 670 {
 671         struct pipe_rpc_fns *context_fns;
 672
 673         DEBUG(3,("check_bind_req for %s\n",
 674                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 675
 676         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 677         if (rpc_srv_pipe_exists_by_id(abstract) &&
 678            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 679                 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 680                         rpc_srv_get_pipe_cli_name(abstract),
 681                         rpc_srv_get_pipe_srv_name(abstract)));
 682         } else {
 683                 return false;
 684         }
 685
 686         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 687         if (context_fns == NULL) {
 688                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 689                 return False;
 690         }
 691
 692         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 693         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 694         context_fns->context_id = context_id;
 695
 696         /* add to the list of open contexts */
 697
 698         DLIST_ADD( p->contexts, context_fns );
 699
 700         return True;
 701 }
 702
 703 /**
 704  * Is a named pipe known?
 705  * @param[in] cli_filename      The pipe name requested by the client
 706  * @result                      Do we want to serve this?
 707  */
 708 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
 709 {
 710         const char *pipename = cli_filename;
 711         NTSTATUS status;
 712
 713         if (strnequal(pipename, "\\PIPE\\", 6)) {
 714                 pipename += 5;
 715         }
 716
 717         if (*pipename == '\\') {
 718                 pipename += 1;
 719         }
 720
 721         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 722                 DEBUG(10, ("refusing spoolss access\n"));
 723                 return false;
 724         }
 725
 726         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 727                 return true;
 728         }
 729
 730         status = smb_probe_module("rpc", pipename);
 731         if (!NT_STATUS_IS_OK(status)) {
 732                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
 733                 return false;
 734         }
 735         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 736
 737         /*
 738          * Scan the list again for the interface id
 739          */
 740         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 741                 return true;
 742         }
 743
 744         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 745                    pipename));
 746
 747         return false;
 748 }
 749
 750 /*******************************************************************
 751  Handle a SPNEGO krb5 bind auth.
 752 *******************************************************************/
 753
 754 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p,
 755                                            TALLOC_CTX *mem_ctx,
 756                                            struct dcerpc_auth *pauth_info,
 757                                            DATA_BLOB *psecblob,
 758                                            DATA_BLOB *response)
 759 {
 760         return False;
 761 }
 762
 763 /*******************************************************************
 764  Handle the first part of a SPNEGO bind auth.
 765 *******************************************************************/
 766
 767 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p,
 768                                             TALLOC_CTX *mem_ctx,
 769                                             struct dcerpc_auth *pauth_info,
 770                                             DATA_BLOB *response)
 771 {
 772         DATA_BLOB secblob;
 773         DATA_BLOB chal;
 774         char *OIDs[ASN1_MAX_OIDS];
 775         int i;
 776         NTSTATUS status;
 777         bool got_kerberos_mechanism = false;
 778         struct auth_ntlmssp_state *a = NULL;
 779
 780         ZERO_STRUCT(secblob);
 781         ZERO_STRUCT(chal);
 782
 783         if (pauth_info->credentials.data[0] != ASN1_APPLICATION(0)) {
 784                 goto err;
 785         }
 786
 787         /* parse out the OIDs and the first sec blob */
 788         if (!parse_negTokenTarg(pauth_info->credentials, OIDs, &secblob)) {
 789                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
 790                 goto err;
 791         }
 792
 793         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
 794                 got_kerberos_mechanism = true;
 795         }
 796
 797         for (i=0;OIDs[i];i++) {
 798                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
 799                 TALLOC_FREE(OIDs[i]);
 800         }
 801         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
 802
 803         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
 804                 bool ret;
 805                 ret = pipe_spnego_auth_bind_kerberos(p, mem_ctx, pauth_info,
 806                                                      &secblob, response);
 807                 data_blob_free(&secblob);
 808                 return ret;
 809         }
 810
 811         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
 812                 /* Free any previous auth type. */
 813                 free_pipe_ntlmssp_auth_data(&p->auth);
 814         }
 815
 816         if (!got_kerberos_mechanism) {
 817                 /* Initialize the NTLM engine. */
 818                 status = auth_ntlmssp_start(&a);
 819                 if (!NT_STATUS_IS_OK(status)) {
 820                         goto err;
 821                 }
 822
 823                 switch (pauth_info->auth_level) {
 824                         case DCERPC_AUTH_LEVEL_INTEGRITY:
 825                                 auth_ntlmssp_want_sign(a);
 826                                 break;
 827                         case DCERPC_AUTH_LEVEL_PRIVACY:
 828                                 auth_ntlmssp_want_seal(a);
 829                                 break;
 830                         default:
 831                                 break;
 832                 }
 833                 /*
 834                  * Pass the first security blob of data to it.
 835                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
 836                  * which means we need another packet to complete the bind.
 837                  */
 838
 839                 status = auth_ntlmssp_update(a, secblob, &chal);
 840
 841                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 842                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
 843                         goto err;
 844                 }
 845
 846                 /* Generate the response blob we need for step 2 of the bind. */
 847                 *response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
 848         } else {
 849                 /*
 850                  * SPNEGO negotiate down to NTLMSSP. The subsequent
 851                  * code to process follow-up packets is not complete
 852                  * yet. JRA.
 853                  */
 854                 *response = spnego_gen_auth_response(NULL,
 855                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
 856                                         OID_NTLMSSP);
 857         }
 858
 859         /* Make sure data is bound to the memctx, to be freed the caller */
 860         talloc_steal(mem_ctx, response->data);
 861
 862         /* auth_pad_len will be handled by the caller */
 863
 864         p->auth.a_u.auth_ntlmssp_state = a;
 865         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
 866         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
 867
 868         data_blob_free(&secblob);
 869         data_blob_free(&chal);
 870
 871         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
 872         return True;
 873
 874  err:
 875
 876         data_blob_free(&secblob);
 877         data_blob_free(&chal);
 878
 879         p->auth.a_u.auth_ntlmssp_state = NULL;
 880
 881         return False;
 882 }
 883
 884 /*******************************************************************
 885  Handle the second part of a SPNEGO bind auth.
 886 *******************************************************************/
 887
 888 static bool pipe_spnego_auth_bind_continue(pipes_struct *p,
 889                                            TALLOC_CTX *mem_ctx,
 890                                            struct dcerpc_auth *pauth_info,
 891                                            DATA_BLOB *response)
 892 {
 893         DATA_BLOB auth_blob;
 894         DATA_BLOB auth_reply;
 895         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
 896
 897         ZERO_STRUCT(auth_blob);
 898         ZERO_STRUCT(auth_reply);
 899
 900         /*
 901          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
 902          * fail here as 'a' == NULL.
 903          */
 904         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
 905                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
 906                 goto err;
 907         }
 908
 909         if (pauth_info->credentials.data[0] != ASN1_CONTEXT(1)) {
 910                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
 911                 goto err;
 912         }
 913
 914         if (!spnego_parse_auth(pauth_info->credentials, &auth_blob)) {
 915                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
 916                 goto err;
 917         }
 918
 919         /*
 920          * The following call actually checks the challenge/response data.
 921          * for correctness against the given DOMAIN\user name.
 922          */
 923
 924         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
 925                 goto err;
 926         }
 927
 928         data_blob_free(&auth_blob);
 929
 930         /* Generate the spnego "accept completed" blob - no incoming data. */
 931         *response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
 932
 933         /* Make sure data is bound to the memctx, to be freed the caller */
 934         talloc_steal(mem_ctx, response->data);
 935
 936         data_blob_free(&auth_reply);
 937
 938         p->pipe_bound = True;
 939
 940         return True;
 941
 942  err:
 943
 944         data_blob_free(&auth_blob);
 945         data_blob_free(&auth_reply);
 946
 947         free_pipe_ntlmssp_auth_data(&p->auth);
 948         p->auth.a_u.auth_ntlmssp_state = NULL;
 949
 950         return False;
 951 }
 952
 953 /*******************************************************************
 954  Handle an schannel bind auth.
 955 *******************************************************************/
 956
 957 static bool pipe_schannel_auth_bind(pipes_struct *p,
 958                                     TALLOC_CTX *mem_ctx,
 959                                     struct dcerpc_auth *auth_info,
 960                                     DATA_BLOB *response)
 961 {
 962         struct NL_AUTH_MESSAGE neg;
 963         struct NL_AUTH_MESSAGE reply;
 964         bool ret;
 965         NTSTATUS status;
 966         struct netlogon_creds_CredentialState *creds;
 967         DATA_BLOB session_key;
 968         enum ndr_err_code ndr_err;
 969
 970         ndr_err = ndr_pull_struct_blob(
 971                         &auth_info->credentials, mem_ctx, &neg,
 972                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
 973         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 974                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
 975                 return false;
 976         }
 977
 978         if (DEBUGLEVEL >= 10) {
 979                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
 980         }
 981
 982         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
 983                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
 984                 return false;
 985         }
 986
 987         /*
 988          * The neg.oem_netbios_computer.a key here must match the remote computer name
 989          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
 990          * operations that use credentials.
 991          */
 992
 993         become_root();
 994         status = schannel_get_creds_state(p, lp_private_dir(),
 995                                             neg.oem_netbios_computer.a, &creds);
 996         unbecome_root();
 997
 998         if (!NT_STATUS_IS_OK(status)) {
 999                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1000                 return False;
1001         }
1002
1003         p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1004         if (!p->auth.a_u.schannel_auth) {
1005                 TALLOC_FREE(creds);
1006                 return False;
1007         }
1008
1009         p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1010         p->auth.a_u.schannel_auth->seq_num = 0;
1011         p->auth.a_u.schannel_auth->initiator = false;
1012         p->auth.a_u.schannel_auth->creds = creds;
1013
1014         /*
1015          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1016          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1017          * struct of the person who opened the pipe. I need to test this further. JRA.
1018          *
1019          * VL. As we are mapping this to guest set the generic key
1020          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1021          * W2k3, as it does not allow schannel binds against SAMR and LSA
1022          * anymore.
1023          */
1024
1025         session_key = generic_session_key();
1026         if (session_key.data == NULL) {
1027                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1028                           " key\n"));
1029                 return false;
1030         }
1031
1032         ret = server_info_set_session_key(p->server_info, session_key);
1033
1034         data_blob_free(&session_key);
1035
1036         if (!ret) {
1037                 DEBUG(0, ("server_info_set_session_key failed\n"));
1038                 return false;
1039         }
1040
1041         /*** SCHANNEL verifier ***/
1042
1043         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
1044         reply.Flags                             = 0;
1045         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
1046                                                       * this has any meaning
1047                                                       * here - gd */
1048
1049         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
1050                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1051         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1052                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1053                 return false;
1054         }
1055
1056         if (DEBUGLEVEL >= 10) {
1057                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1058         }
1059
1060         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1061                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1062
1063         /* We're finished with this bind - no more packets. */
1064         p->auth.auth_data_free_func = NULL;
1065         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1066
1067         p->pipe_bound = True;
1068
1069         return True;
1070 }
1071
1072 /*******************************************************************
1073  Handle an NTLMSSP bind auth.
1074 *******************************************************************/
1075
1076 static bool pipe_ntlmssp_auth_bind(pipes_struct *p,
1077                                    TALLOC_CTX *mem_ctx,
1078                                    struct dcerpc_auth *auth_info,
1079                                    DATA_BLOB *response)
1080 {
1081         NTSTATUS status;
1082         struct auth_ntlmssp_state *a = NULL;
1083
1084         if (strncmp((char *)auth_info->credentials.data, "NTLMSSP", 7) != 0) {
1085                 DEBUG(0, ("Failed to read NTLMSSP in blob\n"));
1086                 goto err;
1087         }
1088
1089         /* We have an NTLMSSP blob. */
1090         status = auth_ntlmssp_start(&a);
1091         if (!NT_STATUS_IS_OK(status)) {
1092                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1093                         nt_errstr(status) ));
1094                 goto err;
1095         }
1096
1097         switch (auth_info->auth_level) {
1098         case DCERPC_AUTH_LEVEL_INTEGRITY:
1099                 auth_ntlmssp_want_sign(a);
1100                 break;
1101         case DCERPC_AUTH_LEVEL_PRIVACY:
1102                 auth_ntlmssp_want_seal(a);
1103                 break;
1104         default:
1105                 break;
1106         }
1107
1108         status = auth_ntlmssp_update(a, auth_info->credentials, response);
1109         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1110                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1111                         nt_errstr(status) ));
1112                 goto err;
1113         }
1114
1115         /* Make sure data is bound to the memctx, to be freed the caller */
1116         talloc_steal(mem_ctx, response->data);
1117
1118         p->auth.a_u.auth_ntlmssp_state = a;
1119         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1120         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1121
1122         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1123
1124         /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1125         return True;
1126
1127   err:
1128
1129         free_pipe_ntlmssp_auth_data(&p->auth);
1130         p->auth.a_u.auth_ntlmssp_state = NULL;
1131         return False;
1132 }
1133
1134 /*******************************************************************
1135  Respond to a pipe bind request.
1136 *******************************************************************/
1137
1138 bool api_pipe_bind_req(pipes_struct *p, struct ncacn_packet *pkt)
1139 {
1140         struct dcerpc_auth auth_info;
1141         uint16 assoc_gid;
1142         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1143         NTSTATUS status;
1144         struct ndr_syntax_id id;
1145         union dcerpc_payload u;
1146         struct dcerpc_ack_ctx bind_ack_ctx;
1147         DATA_BLOB auth_resp = data_blob_null;
1148         DATA_BLOB auth_blob = data_blob_null;
1149
1150         /* No rebinds on a bound pipe - use alter context. */
1151         if (p->pipe_bound) {
1152                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1153                          "pipe %s.\n",
1154                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1155                 return setup_bind_nak(p, pkt);
1156         }
1157
1158         if (pkt->u.bind.num_contexts == 0) {
1159                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1160                 goto err_exit;
1161         }
1162
1163         /*
1164          * Try and find the correct pipe name to ensure
1165          * that this is a pipe name we support.
1166          */
1167         id = pkt->u.bind.ctx_list[0].abstract_syntax;
1168         if (rpc_srv_pipe_exists_by_id(&id)) {
1169                 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1170                         rpc_srv_get_pipe_cli_name(&id),
1171                         rpc_srv_get_pipe_srv_name(&id)));
1172         } else {
1173                 status = smb_probe_module(
1174                         "rpc", get_pipe_name_from_syntax(
1175                                 talloc_tos(),
1176                                 &pkt->u.bind.ctx_list[0].abstract_syntax));
1177
1178                 if (NT_STATUS_IS_ERR(status)) {
1179                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1180                                 get_pipe_name_from_syntax(
1181                                         talloc_tos(),
1182                                         &pkt->u.bind.ctx_list[0].abstract_syntax)));
1183
1184                         return setup_bind_nak(p, pkt);
1185                 }
1186
1187                 if (rpc_srv_get_pipe_interface_by_cli_name(
1188                                 get_pipe_name_from_syntax(talloc_tos(),
1189                                                           &p->syntax),
1190                                 &id)) {
1191                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1192                                 rpc_srv_get_pipe_cli_name(&id),
1193                                 rpc_srv_get_pipe_srv_name(&id)));
1194                 } else {
1195                         DEBUG(0, ("module %s doesn't provide functions for "
1196                                   "pipe %s!\n",
1197                                   get_pipe_name_from_syntax(talloc_tos(),
1198                                                             &p->syntax),
1199                                   get_pipe_name_from_syntax(talloc_tos(),
1200                                                             &p->syntax)));
1201                         return setup_bind_nak(p, pkt);
1202                 }
1203         }
1204
1205         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1206
1207         if (pkt->u.bind.assoc_group_id != 0) {
1208                 assoc_gid = pkt->u.bind.assoc_group_id;
1209         } else {
1210                 assoc_gid = 0x53f0;
1211         }
1212
1213         /*
1214          * Create the bind response struct.
1215          */
1216
1217         /* If the requested abstract synt uuid doesn't match our client pipe,
1218                 reject the bind_ack & set the transfer interface synt to all 0's,
1219                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1220                 unknown to NT4)
1221                 Needed when adding entries to a DACL from NT5 - SK */
1222
1223         if (check_bind_req(p,
1224                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1225                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1226                         pkt->u.bind.ctx_list[0].context_id)) {
1227
1228                 bind_ack_ctx.result = 0;
1229                 bind_ack_ctx.reason = 0;
1230                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1231         } else {
1232                 p->pipe_bound = False;
1233                 /* Rejection reason: abstract syntax not supported */
1234                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1235                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1236                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1237         }
1238
1239         /*
1240          * Check if this is an authenticated bind request.
1241          */
1242         if (pkt->auth_length) {
1243                 /* Quick length check. Won't catch a bad auth footer,
1244                  * prevents overrun. */
1245
1246                 if (pkt->frag_length < RPC_HEADER_LEN +
1247                                         RPC_HDR_AUTH_LEN +
1248                                         pkt->auth_length) {
1249                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
1250                                 "too long for fragment %u.\n",
1251                                 (unsigned int)pkt->auth_length,
1252                                 (unsigned int)pkt->frag_length));
1253                         goto err_exit;
1254                 }
1255
1256                 /*
1257                  * Decode the authentication verifier.
1258                  */
1259                 status = dcerpc_pull_dcerpc_auth(pkt,
1260                                                  &pkt->u.bind.auth_info,
1261                                                  &auth_info);
1262                 if (!NT_STATUS_IS_OK(status)) {
1263                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1264                         goto err_exit;
1265                 }
1266
1267                 auth_type = auth_info.auth_type;
1268
1269                 /* Work out if we have to sign or seal etc. */
1270                 switch (auth_info.auth_level) {
1271                 case DCERPC_AUTH_LEVEL_INTEGRITY:
1272                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1273                         break;
1274                 case DCERPC_AUTH_LEVEL_PRIVACY:
1275                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1276                         break;
1277                 default:
1278                         DEBUG(0, ("Unexpected auth level (%u).\n",
1279                                 (unsigned int)auth_info.auth_level ));
1280                         goto err_exit;
1281                 }
1282
1283                 switch (auth_type) {
1284                 case DCERPC_AUTH_TYPE_NTLMSSP:
1285                         if (!pipe_ntlmssp_auth_bind(p, pkt,
1286                                                 &auth_info, &auth_resp)) {
1287                                 goto err_exit;
1288                         }
1289                         assoc_gid = 0x7a77;
1290                         break;
1291
1292                 case DCERPC_AUTH_TYPE_SCHANNEL:
1293                         if (!pipe_schannel_auth_bind(p, pkt,
1294                                                 &auth_info, &auth_resp)) {
1295                                 goto err_exit;
1296                         }
1297                         break;
1298
1299                 case DCERPC_AUTH_TYPE_SPNEGO:
1300                         if (!pipe_spnego_auth_bind_negotiate(p, pkt,
1301                                                 &auth_info, &auth_resp)) {
1302                                 goto err_exit;
1303                         }
1304                         break;
1305
1306                 case DCERPC_AUTH_TYPE_NONE:
1307                         break;
1308
1309                 default:
1310                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
1311                         goto err_exit;
1312                 }
1313         }
1314
1315         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
1316                 /* Unauthenticated bind request. */
1317                 /* We're finished - no more packets. */
1318                 p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1319                 /* We must set the pipe auth_level here also. */
1320                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1321                 p->pipe_bound = True;
1322                 /* The session key was initialized from the SMB
1323                  * session in make_internal_rpc_pipe_p */
1324         }
1325
1326         ZERO_STRUCT(u.bind_ack);
1327         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1328         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1329         u.bind_ack.assoc_group_id = assoc_gid;
1330
1331         /* name has to be \PIPE\xxxxx */
1332         u.bind_ack.secondary_address =
1333                         talloc_asprintf(pkt, "\\PIPE\\%s",
1334                                         rpc_srv_get_pipe_srv_name(&id));
1335         if (!u.bind_ack.secondary_address) {
1336                 DEBUG(0, ("Out of memory!\n"));
1337                 goto err_exit;
1338         }
1339         u.bind_ack.secondary_address_size =
1340                                 strlen(u.bind_ack.secondary_address) + 1;
1341
1342         u.bind_ack.num_results = 1;
1343         u.bind_ack.ctx_list = &bind_ack_ctx;
1344
1345         /* NOTE: We leave the auth_info empty so we can calculate the padding
1346          * later and then append the auth_info --simo */
1347
1348         /*
1349          * Marshall directly into the outgoing PDU space. We
1350          * must do this as we need to set to the bind response
1351          * header and are never sending more than one PDU here.
1352          */
1353
1354         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1355                                           DCERPC_PKT_BIND_ACK,
1356                                           DCERPC_PFC_FLAG_FIRST |
1357                                                 DCERPC_PFC_FLAG_LAST,
1358                                           auth_resp.length,
1359                                           pkt->call_id,
1360                                           &u,
1361                                           &p->out_data.frag);
1362         if (!NT_STATUS_IS_OK(status)) {
1363                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1364                           nt_errstr(status)));
1365         }
1366
1367         if (auth_resp.length) {
1368
1369                 status = dcerpc_push_dcerpc_auth(pkt,
1370                                                  auth_type,
1371                                                  auth_info.auth_level,
1372                                                  0,
1373                                                  1, /* auth_context_id */
1374                                                  &auth_resp,
1375                                                  &auth_blob);
1376                 if (!NT_STATUS_IS_OK(status)) {
1377                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1378                         goto err_exit;
1379                 }
1380         }
1381
1382         /* Now that we have the auth len store it into the right place in
1383          * the dcerpc header */
1384         dcerpc_set_frag_length(&p->out_data.frag,
1385                                 p->out_data.frag.length + auth_blob.length);
1386
1387         if (auth_blob.length) {
1388
1389                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1390                                         auth_blob.data, auth_blob.length)) {
1391                         DEBUG(0, ("Append of auth info failed.\n"));
1392                         goto err_exit;
1393                 }
1394         }
1395
1396         /*
1397          * Setup the lengths for the initial reply.
1398          */
1399
1400         p->out_data.data_sent_length = 0;
1401         p->out_data.current_pdu_sent = 0;
1402
1403         TALLOC_FREE(auth_blob.data);
1404         return True;
1405
1406   err_exit:
1407
1408         data_blob_free(&p->out_data.frag);
1409         TALLOC_FREE(auth_blob.data);
1410         return setup_bind_nak(p, pkt);
1411 }
1412
1413 /****************************************************************************
1414  Deal with an alter context call. Can be third part of 3 leg auth request for
1415  SPNEGO calls.
1416 ****************************************************************************/
1417
1418 bool api_pipe_alter_context(pipes_struct *p, struct ncacn_packet *pkt)
1419 {
1420         struct dcerpc_auth auth_info;
1421         uint16 assoc_gid;
1422         NTSTATUS status;
1423         union dcerpc_payload u;
1424         struct dcerpc_ack_ctx bind_ack_ctx;
1425         DATA_BLOB auth_resp = data_blob_null;
1426         DATA_BLOB auth_blob = data_blob_null;
1427         int pad_len = 0;
1428
1429         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1430
1431         if (pkt->u.bind.assoc_group_id != 0) {
1432                 assoc_gid = pkt->u.bind.assoc_group_id;
1433         } else {
1434                 assoc_gid = 0x53f0;
1435         }
1436
1437         /*
1438          * Create the bind response struct.
1439          */
1440
1441         /* If the requested abstract synt uuid doesn't match our client pipe,
1442                 reject the bind_ack & set the transfer interface synt to all 0's,
1443                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1444                 unknown to NT4)
1445                 Needed when adding entries to a DACL from NT5 - SK */
1446
1447         if (check_bind_req(p,
1448                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1449                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1450                         pkt->u.bind.ctx_list[0].context_id)) {
1451
1452                 bind_ack_ctx.result = 0;
1453                 bind_ack_ctx.reason = 0;
1454                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1455         } else {
1456                 p->pipe_bound = False;
1457                 /* Rejection reason: abstract syntax not supported */
1458                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1459                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1460                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1461         }
1462
1463         /*
1464          * Check if this is an authenticated alter context request.
1465          */
1466         if (pkt->auth_length) {
1467                 /* Quick length check. Won't catch a bad auth footer,
1468                  * prevents overrun. */
1469
1470                 if (pkt->frag_length < RPC_HEADER_LEN +
1471                                         RPC_HDR_AUTH_LEN +
1472                                         pkt->auth_length) {
1473                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1474                                 "too long for fragment %u.\n",
1475                                 (unsigned int)pkt->auth_length,
1476                                 (unsigned int)pkt->frag_length ));
1477                         goto err_exit;
1478                 }
1479
1480                 status = dcerpc_pull_dcerpc_auth(pkt,
1481                                                  &pkt->u.bind.auth_info,
1482                                                  &auth_info);
1483                 if (!NT_STATUS_IS_OK(status)) {
1484                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1485                         goto err_exit;
1486                 }
1487
1488
1489                 /*
1490                  * Currently only the SPNEGO auth type uses the alter ctx
1491                  * response in place of the NTLMSSP auth3 type.
1492                  */
1493
1494                 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
1495                         /* We can only finish if the pipe is unbound. */
1496                         if (!p->pipe_bound) {
1497                                 if (!pipe_spnego_auth_bind_continue(p, pkt,
1498                                                 &auth_info, &auth_resp)) {
1499                                         goto err_exit;
1500                                 }
1501
1502                         } else {
1503                                 goto err_exit;
1504                         }
1505                 }
1506         }
1507
1508         ZERO_STRUCT(u.alter_resp);
1509         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1510         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1511         u.alter_resp.assoc_group_id = assoc_gid;
1512
1513         /* secondary address CAN be NULL
1514          * as the specs say it's ignored.
1515          * It MUST be NULL to have the spoolss working.
1516          */
1517         u.alter_resp.secondary_address = "";
1518         u.alter_resp.secondary_address_size = 1;
1519
1520         u.alter_resp.num_results = 1;
1521         u.alter_resp.ctx_list = &bind_ack_ctx;
1522
1523         /* NOTE: We leave the auth_info empty so we can calculate the padding
1524          * later and then append the auth_info --simo */
1525
1526         /*
1527          * Marshall directly into the outgoing PDU space. We
1528          * must do this as we need to set to the bind response
1529          * header and are never sending more than one PDU here.
1530          */
1531
1532         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1533                                           DCERPC_PKT_ALTER_RESP,
1534                                           DCERPC_PFC_FLAG_FIRST |
1535                                                 DCERPC_PFC_FLAG_LAST,
1536                                           auth_resp.length,
1537                                           pkt->call_id,
1538                                           &u,
1539                                           &p->out_data.frag);
1540         if (!NT_STATUS_IS_OK(status)) {
1541                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1542                           nt_errstr(status)));
1543         }
1544
1545         if (auth_resp.length) {
1546
1547                 /* Work out any padding needed before the auth footer. */
1548                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1549                 if (pad_len) {
1550                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1551                         DEBUG(10, ("auth pad_len = %u\n",
1552                                    (unsigned int)pad_len));
1553                 }
1554
1555                 status = dcerpc_push_dcerpc_auth(pkt,
1556                                                  auth_info.auth_type,
1557                                                  auth_info.auth_level,
1558                                                  pad_len,
1559                                                  1, /* auth_context_id */
1560                                                  &auth_resp,
1561                                                  &auth_blob);
1562                 if (!NT_STATUS_IS_OK(status)) {
1563                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1564                         goto err_exit;
1565                 }
1566         }
1567
1568         /* Now that we have the auth len store it into the right place in
1569          * the dcerpc header */
1570         dcerpc_set_frag_length(&p->out_data.frag,
1571                                 p->out_data.frag.length +
1572                                         pad_len + auth_blob.length);
1573
1574         if (auth_resp.length) {
1575                 if (pad_len) {
1576                         char pad[SERVER_NDR_PADDING_SIZE];
1577                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1578                         if (!data_blob_append(p->mem_ctx,
1579                                                 &p->out_data.frag,
1580                                                 pad, pad_len)) {
1581                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1582                                           "%u bytes of pad data.\n",
1583                                           (unsigned int)pad_len));
1584                                 goto err_exit;
1585                         }
1586                 }
1587
1588                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1589                                         auth_blob.data, auth_blob.length)) {
1590                         DEBUG(0, ("Append of auth info failed.\n"));
1591                         goto err_exit;
1592                 }
1593         }
1594
1595         /*
1596          * Setup the lengths for the initial reply.
1597          */
1598
1599         p->out_data.data_sent_length = 0;
1600         p->out_data.current_pdu_sent = 0;
1601
1602         TALLOC_FREE(auth_blob.data);
1603         return True;
1604
1605   err_exit:
1606
1607         data_blob_free(&p->out_data.frag);
1608         TALLOC_FREE(auth_blob.data);
1609         return setup_bind_nak(p, pkt);
1610 }
1611
1612 /****************************************************************************
1613  Find the set of RPC functions associated with this context_id
1614 ****************************************************************************/
1615
1616 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
1617 {
1618         PIPE_RPC_FNS *fns = NULL;
1619
1620         if ( !list ) {
1621                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
1622                 return NULL;
1623         }
1624
1625         for (fns=list; fns; fns=fns->next ) {
1626                 if ( fns->context_id == context_id )
1627                         return fns;
1628         }
1629         return NULL;
1630 }
1631
1632 /****************************************************************************
1633  Memory cleanup.
1634 ****************************************************************************/
1635
1636 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
1637 {
1638         PIPE_RPC_FNS *tmp = list;
1639         PIPE_RPC_FNS *tmp2;
1640
1641         while (tmp) {
1642                 tmp2 = tmp->next;
1643                 SAFE_FREE(tmp);
1644                 tmp = tmp2;
1645         }
1646
1647         return;
1648 }
1649
1650 static bool api_rpcTNP(pipes_struct *p, struct ncacn_packet *pkt,
1651                        const struct api_struct *api_rpc_cmds, int n_cmds);
1652
1653 /****************************************************************************
1654  Find the correct RPC function to call for this request.
1655  If the pipe is authenticated then become the correct UNIX user
1656  before doing the call.
1657 ****************************************************************************/
1658
1659 bool api_pipe_request(pipes_struct *p, struct ncacn_packet *pkt)
1660 {
1661         bool ret = False;
1662         bool changed_user = False;
1663         PIPE_RPC_FNS *pipe_fns;
1664
1665         if (p->pipe_bound &&
1666                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
1667                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
1668                 if(!become_authenticated_pipe_user(p)) {
1669                         data_blob_free(&p->out_data.rdata);
1670                         return False;
1671                 }
1672                 changed_user = True;
1673         }
1674
1675         DEBUG(5, ("Requested \\PIPE\\%s\n",
1676                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1677
1678         /* get the set of RPC functions for this context */
1679
1680         pipe_fns = find_pipe_fns_by_context(p->contexts,
1681                                             pkt->u.request.context_id);
1682
1683         if ( pipe_fns ) {
1684                 TALLOC_CTX *frame = talloc_stackframe();
1685                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds);
1686                 TALLOC_FREE(frame);
1687         }
1688         else {
1689                 DEBUG(0, ("No rpc function table associated with context "
1690                           "[%d] on pipe [%s]\n",
1691                           pkt->u.request.context_id,
1692                           get_pipe_name_from_syntax(talloc_tos(),
1693                                                     &p->syntax)));
1694         }
1695
1696         if (changed_user) {
1697                 unbecome_authenticated_pipe_user();
1698         }
1699
1700         return ret;
1701 }
1702
1703 /*******************************************************************
1704  Calls the underlying RPC function for a named pipe.
1705  ********************************************************************/
1706
1707 static bool api_rpcTNP(pipes_struct *p, struct ncacn_packet *pkt,
1708                        const struct api_struct *api_rpc_cmds, int n_cmds)
1709 {
1710         int fn_num;
1711         uint32_t offset1;
1712
1713         /* interpret the command */
1714         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1715                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1716                  pkt->u.request.opnum));
1717
1718         if (DEBUGLEVEL >= 50) {
1719                 fstring name;
1720                 slprintf(name, sizeof(name)-1, "in_%s",
1721                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1722                 prs_dump(name, pkt->u.request.opnum, &p->in_data.data);
1723         }
1724
1725         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1726                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1727                     api_rpc_cmds[fn_num].fn != NULL) {
1728                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1729                                   api_rpc_cmds[fn_num].name));
1730                         break;
1731                 }
1732         }
1733
1734         if (fn_num == n_cmds) {
1735                 /*
1736                  * For an unknown RPC just return a fault PDU but
1737                  * return True to allow RPC's on the pipe to continue
1738                  * and not put the pipe into fault state. JRA.
1739                  */
1740                 DEBUG(4, ("unknown\n"));
1741                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1742                 return True;
1743         }
1744
1745         offset1 = p->out_data.rdata.length;
1746
1747         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1748                 fn_num, api_rpc_cmds[fn_num].fn));
1749         /* do the actual command */
1750         if(!api_rpc_cmds[fn_num].fn(p)) {
1751                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1752                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
1753                          api_rpc_cmds[fn_num].name));
1754                 data_blob_free(&p->out_data.rdata);
1755                 return False;
1756         }
1757
1758         if (p->bad_handle_fault_state) {
1759                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1760                 p->bad_handle_fault_state = False;
1761                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
1762                 return True;
1763         }
1764
1765         if (p->rng_fault_state) {
1766                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
1767                 p->rng_fault_state = False;
1768                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1769                 return True;
1770         }
1771
1772         if (DEBUGLEVEL >= 50) {
1773                 fstring name;
1774                 slprintf(name, sizeof(name)-1, "out_%s",
1775                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
1776                 prs_dump_region(name, pkt->u.request.opnum,
1777                                 p->out_data.rdata.data,
1778                                 offset1,
1779                                 p->out_data.rdata.length);
1780         }
1781
1782         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1783                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1784
1785         /* Check for buffer underflow in rpc parsing */
1786
1787         if ((DEBUGLEVEL >= 10) &&
1788             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
1789                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
1790                 char *data = (char *)SMB_MALLOC(data_len);
1791
1792                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1793                 if (data) {
1794                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
1795                         SAFE_FREE(data);
1796                 }
1797
1798         }
1799
1800         return True;
1801 }