source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "../libcli/auth/libcli_auth.h"
  32
  33 extern struct current_user current_user;
  34
  35 #undef DBGC_CLASS
  36 #define DBGC_CLASS DBGC_RPC_SRV
  37
  38 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  39 {
  40         AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
  41
  42         if (a) {
  43                 auth_ntlmssp_end(&a);
  44         }
  45         auth->a_u.auth_ntlmssp_state = NULL;
  46 }
  47
  48 static DATA_BLOB generic_session_key(void)
  49 {
  50         return data_blob("SystemLibraryDTC", 16);
  51 }
  52
  53 /*******************************************************************
  54  Generate the next PDU to be returned from the data in p->rdata.
  55  Handle NTLMSSP.
  56  ********************************************************************/
  57
  58 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  59 {
  60         RPC_HDR_RESP hdr_resp;
  61         uint32 ss_padding_len = 0;
  62         uint32 data_space_available;
  63         uint32 data_len_left;
  64         uint32 data_len;
  65         NTSTATUS status;
  66         DATA_BLOB auth_blob;
  67         RPC_HDR_AUTH auth_info;
  68         uint8 auth_type, auth_level;
  69         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
  70
  71         /*
  72          * If we're in the fault state, keep returning fault PDU's until
  73          * the pipe gets closed. JRA.
  74          */
  75
  76         if(p->fault_state) {
  77                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  78                 return True;
  79         }
  80
  81         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  82
  83         /* Change the incoming request header to a response. */
  84         p->hdr.pkt_type = RPC_RESPONSE;
  85
  86         /* Set up rpc header flags. */
  87         if (p->out_data.data_sent_length == 0) {
  88                 p->hdr.flags = RPC_FLG_FIRST;
  89         } else {
  90                 p->hdr.flags = 0;
  91         }
  92
  93         /*
  94          * Work out how much we can fit in a single PDU.
  95          */
  96
  97         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
  98
  99         /*
 100          * Ensure there really is data left to send.
 101          */
 102
 103         if(!data_len_left) {
 104                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 105                 return False;
 106         }
 107
 108         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 109                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 110
 111         /*
 112          * The amount we send is the minimum of the available
 113          * space and the amount left to send.
 114          */
 115
 116         data_len = MIN(data_len_left, data_space_available);
 117
 118         /*
 119          * Set up the alloc hint. This should be the data left to
 120          * send.
 121          */
 122
 123         hdr_resp.alloc_hint = data_len_left;
 124
 125         /*
 126          * Work out if this PDU will be the last.
 127          */
 128
 129         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 130                 p->hdr.flags |= RPC_FLG_LAST;
 131                 if (data_len_left % 8) {
 132                         ss_padding_len = 8 - (data_len_left % 8);
 133                         DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 134                                 ss_padding_len ));
 135                 }
 136         }
 137
 138         /*
 139          * Set up the header lengths.
 140          */
 141
 142         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 143                         data_len + ss_padding_len +
 144                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 145         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 146
 147
 148         /*
 149          * Init the parse struct to point at the outgoing
 150          * data.
 151          */
 152
 153         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 154
 155         /* Store the header in the data stream. */
 156         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 157                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 158                 prs_mem_free(&p->out_data.frag);
 159                 return False;
 160         }
 161
 162         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 163                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 164                 prs_mem_free(&p->out_data.frag);
 165                 return False;
 166         }
 167
 168         /* Copy the data into the PDU. */
 169
 170         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 171                                      p->out_data.data_sent_length, data_len)) {
 172                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 173                 prs_mem_free(&p->out_data.frag);
 174                 return False;
 175         }
 176
 177         /* Copy the sign/seal padding data. */
 178         if (ss_padding_len) {
 179                 char pad[8];
 180
 181                 memset(pad, '\0', 8);
 182                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 183                                       ss_padding_len)) {
 184                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 185                                         (unsigned int)ss_padding_len));
 186                         prs_mem_free(&p->out_data.frag);
 187                         return False;
 188                 }
 189         }
 190
 191
 192         /* Now write out the auth header and null blob. */
 193         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 194                 auth_type = RPC_NTLMSSP_AUTH_TYPE;
 195         } else {
 196                 auth_type = RPC_SPNEGO_AUTH_TYPE;
 197         }
 198         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 199                 auth_level = RPC_AUTH_LEVEL_PRIVACY;
 200         } else {
 201                 auth_level = RPC_AUTH_LEVEL_INTEGRITY;
 202         }
 203
 204         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 205         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &p->out_data.frag,
 206                                 0)) {
 207                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 208                 prs_mem_free(&p->out_data.frag);
 209                 return False;
 210         }
 211
 212         /* Generate the sign blob. */
 213
 214         switch (p->auth.auth_level) {
 215                 case PIPE_AUTH_LEVEL_PRIVACY:
 216                         /* Data portion is encrypted. */
 217                         status = ntlmssp_seal_packet(
 218                                 a->ntlmssp_state,
 219                                 (uint8_t *)prs_data_p(&p->out_data.frag)
 220                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 221                                 data_len + ss_padding_len,
 222                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 223                                 (size_t)prs_offset(&p->out_data.frag),
 224                                 &auth_blob);
 225                         if (!NT_STATUS_IS_OK(status)) {
 226                                 data_blob_free(&auth_blob);
 227                                 prs_mem_free(&p->out_data.frag);
 228                                 return False;
 229                         }
 230                         break;
 231                 case PIPE_AUTH_LEVEL_INTEGRITY:
 232                         /* Data is signed. */
 233                         status = ntlmssp_sign_packet(
 234                                 a->ntlmssp_state,
 235                                 (unsigned char *)prs_data_p(&p->out_data.frag)
 236                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 237                                 data_len + ss_padding_len,
 238                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 239                                 (size_t)prs_offset(&p->out_data.frag),
 240                                 &auth_blob);
 241                         if (!NT_STATUS_IS_OK(status)) {
 242                                 data_blob_free(&auth_blob);
 243                                 prs_mem_free(&p->out_data.frag);
 244                                 return False;
 245                         }
 246                         break;
 247                 default:
 248                         prs_mem_free(&p->out_data.frag);
 249                         return False;
 250         }
 251
 252         /* Append the auth blob. */
 253         if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
 254                               NTLMSSP_SIG_SIZE)) {
 255                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 256                                 (unsigned int)NTLMSSP_SIG_SIZE));
 257                 data_blob_free(&auth_blob);
 258                 prs_mem_free(&p->out_data.frag);
 259                 return False;
 260         }
 261
 262         data_blob_free(&auth_blob);
 263
 264         /*
 265          * Setup the counts for this PDU.
 266          */
 267
 268         p->out_data.data_sent_length += data_len;
 269         p->out_data.current_pdu_sent = 0;
 270
 271         return True;
 272 }
 273
 274 /*******************************************************************
 275  Generate the next PDU to be returned from the data in p->rdata.
 276  Return an schannel authenticated fragment.
 277  ********************************************************************/
 278
 279 static bool create_next_pdu_schannel(pipes_struct *p)
 280 {
 281         RPC_HDR_RESP hdr_resp;
 282         uint32 ss_padding_len = 0;
 283         uint32 data_len;
 284         uint32 data_space_available;
 285         uint32 data_len_left;
 286         uint32 data_pos;
 287
 288         /*
 289          * If we're in the fault state, keep returning fault PDU's until
 290          * the pipe gets closed. JRA.
 291          */
 292
 293         if(p->fault_state) {
 294                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 295                 return True;
 296         }
 297
 298         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 299
 300         /* Change the incoming request header to a response. */
 301         p->hdr.pkt_type = RPC_RESPONSE;
 302
 303         /* Set up rpc header flags. */
 304         if (p->out_data.data_sent_length == 0) {
 305                 p->hdr.flags = RPC_FLG_FIRST;
 306         } else {
 307                 p->hdr.flags = 0;
 308         }
 309
 310         /*
 311          * Work out how much we can fit in a single PDU.
 312          */
 313
 314         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 315
 316         /*
 317          * Ensure there really is data left to send.
 318          */
 319
 320         if(!data_len_left) {
 321                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 322                 return False;
 323         }
 324
 325         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 326                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
 327                 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 328
 329         /*
 330          * The amount we send is the minimum of the available
 331          * space and the amount left to send.
 332          */
 333
 334         data_len = MIN(data_len_left, data_space_available);
 335
 336         /*
 337          * Set up the alloc hint. This should be the data left to
 338          * send.
 339          */
 340
 341         hdr_resp.alloc_hint = data_len_left;
 342
 343         /*
 344          * Work out if this PDU will be the last.
 345          */
 346
 347         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 348                 p->hdr.flags |= RPC_FLG_LAST;
 349                 if (data_len_left % 8) {
 350                         ss_padding_len = 8 - (data_len_left % 8);
 351                         DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 352                                 ss_padding_len ));
 353                 }
 354         }
 355
 356         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 357                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 358         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 359
 360         /*
 361          * Init the parse struct to point at the outgoing
 362          * data.
 363          */
 364
 365         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 366
 367         /* Store the header in the data stream. */
 368         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 369                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 370                 prs_mem_free(&p->out_data.frag);
 371                 return False;
 372         }
 373
 374         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 375                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 376                 prs_mem_free(&p->out_data.frag);
 377                 return False;
 378         }
 379
 380         /* Store the current offset. */
 381         data_pos = prs_offset(&p->out_data.frag);
 382
 383         /* Copy the data into the PDU. */
 384
 385         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 386                                      p->out_data.data_sent_length, data_len)) {
 387                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 388                 prs_mem_free(&p->out_data.frag);
 389                 return False;
 390         }
 391
 392         /* Copy the sign/seal padding data. */
 393         if (ss_padding_len) {
 394                 char pad[8];
 395                 memset(pad, '\0', 8);
 396                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 397                                       ss_padding_len)) {
 398                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 399                         prs_mem_free(&p->out_data.frag);
 400                         return False;
 401                 }
 402         }
 403
 404         {
 405                 /*
 406                  * Schannel processing.
 407                  */
 408                 RPC_HDR_AUTH auth_info;
 409                 RPC_AUTH_SCHANNEL_CHK verf;
 410
 411                 /* Check it's the type of reply we were expecting to decode */
 412
 413                 init_rpc_hdr_auth(&auth_info,
 414                                 RPC_SCHANNEL_AUTH_TYPE,
 415                                 p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY ?
 416                                         RPC_AUTH_LEVEL_PRIVACY : RPC_AUTH_LEVEL_INTEGRITY,
 417                                 ss_padding_len, 1);
 418
 419                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 420                                         &p->out_data.frag, 0)) {
 421                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 422                         prs_mem_free(&p->out_data.frag);
 423                         return False;
 424                 }
 425
 426                 schannel_encode(p->auth.a_u.schannel_auth,
 427                                 p->auth.auth_level, SENDER_IS_ACCEPTOR, &verf,
 428                                 prs_data_p(&p->out_data.frag) + data_pos,
 429                                 data_len + ss_padding_len);
 430
 431                 if (!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 432                                 &verf, &p->out_data.frag, 0)) {
 433                         prs_mem_free(&p->out_data.frag);
 434                         return False;
 435                 }
 436
 437                 p->auth.a_u.schannel_auth->seq_num++;
 438         }
 439
 440         /*
 441          * Setup the counts for this PDU.
 442          */
 443
 444         p->out_data.data_sent_length += data_len;
 445         p->out_data.current_pdu_sent = 0;
 446
 447         return True;
 448 }
 449
 450 /*******************************************************************
 451  Generate the next PDU to be returned from the data in p->rdata.
 452  No authentication done.
 453 ********************************************************************/
 454
 455 static bool create_next_pdu_noauth(pipes_struct *p)
 456 {
 457         RPC_HDR_RESP hdr_resp;
 458         uint32 data_len;
 459         uint32 data_space_available;
 460         uint32 data_len_left;
 461
 462         /*
 463          * If we're in the fault state, keep returning fault PDU's until
 464          * the pipe gets closed. JRA.
 465          */
 466
 467         if(p->fault_state) {
 468                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 469                 return True;
 470         }
 471
 472         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 473
 474         /* Change the incoming request header to a response. */
 475         p->hdr.pkt_type = RPC_RESPONSE;
 476
 477         /* Set up rpc header flags. */
 478         if (p->out_data.data_sent_length == 0) {
 479                 p->hdr.flags = RPC_FLG_FIRST;
 480         } else {
 481                 p->hdr.flags = 0;
 482         }
 483
 484         /*
 485          * Work out how much we can fit in a single PDU.
 486          */
 487
 488         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 489
 490         /*
 491          * Ensure there really is data left to send.
 492          */
 493
 494         if(!data_len_left) {
 495                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 496                 return False;
 497         }
 498
 499         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 500                 - RPC_HDR_RESP_LEN;
 501
 502         /*
 503          * The amount we send is the minimum of the available
 504          * space and the amount left to send.
 505          */
 506
 507         data_len = MIN(data_len_left, data_space_available);
 508
 509         /*
 510          * Set up the alloc hint. This should be the data left to
 511          * send.
 512          */
 513
 514         hdr_resp.alloc_hint = data_len_left;
 515
 516         /*
 517          * Work out if this PDU will be the last.
 518          */
 519
 520         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 521                 p->hdr.flags |= RPC_FLG_LAST;
 522         }
 523
 524         /*
 525          * Set up the header lengths.
 526          */
 527
 528         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 529         p->hdr.auth_len = 0;
 530
 531         /*
 532          * Init the parse struct to point at the outgoing
 533          * data.
 534          */
 535
 536         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 537
 538         /* Store the header in the data stream. */
 539         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 540                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 541                 prs_mem_free(&p->out_data.frag);
 542                 return False;
 543         }
 544
 545         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 546                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 547                 prs_mem_free(&p->out_data.frag);
 548                 return False;
 549         }
 550
 551         /* Copy the data into the PDU. */
 552
 553         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 554                                      p->out_data.data_sent_length, data_len)) {
 555                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 556                 prs_mem_free(&p->out_data.frag);
 557                 return False;
 558         }
 559
 560         /*
 561          * Setup the counts for this PDU.
 562          */
 563
 564         p->out_data.data_sent_length += data_len;
 565         p->out_data.current_pdu_sent = 0;
 566
 567         return True;
 568 }
 569
 570 /*******************************************************************
 571  Generate the next PDU to be returned from the data in p->rdata.
 572 ********************************************************************/
 573
 574 bool create_next_pdu(pipes_struct *p)
 575 {
 576         switch(p->auth.auth_level) {
 577                 case PIPE_AUTH_LEVEL_NONE:
 578                 case PIPE_AUTH_LEVEL_CONNECT:
 579                         /* This is incorrect for auth level connect. Fixme. JRA */
 580                         return create_next_pdu_noauth(p);
 581
 582                 default:
 583                         switch(p->auth.auth_type) {
 584                                 case PIPE_AUTH_TYPE_NTLMSSP:
 585                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 586                                         return create_next_pdu_ntlmssp(p);
 587                                 case PIPE_AUTH_TYPE_SCHANNEL:
 588                                         return create_next_pdu_schannel(p);
 589                                 default:
 590                                         break;
 591                         }
 592         }
 593
 594         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 595                         (unsigned int)p->auth.auth_level,
 596                         (unsigned int)p->auth.auth_type));
 597         return False;
 598 }
 599
 600 /*******************************************************************
 601  Process an NTLMSSP authentication response.
 602  If this function succeeds, the user has been authenticated
 603  and their domain, name and calling workstation stored in
 604  the pipe struct.
 605 *******************************************************************/
 606
 607 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 608 {
 609         DATA_BLOB session_key, reply;
 610         NTSTATUS status;
 611         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
 612         bool ret;
 613
 614         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
 615                  get_pipe_name_from_iface(&p->syntax)));
 616
 617         ZERO_STRUCT(reply);
 618
 619         /* this has to be done as root in order to verify the password */
 620         become_root();
 621         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 622         unbecome_root();
 623
 624         /* Don't generate a reply. */
 625         data_blob_free(&reply);
 626
 627         if (!NT_STATUS_IS_OK(status)) {
 628                 return False;
 629         }
 630
 631         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 632            ensure the underlying NTLMSSP flags are also set. If not we should
 633            refuse the bind. */
 634
 635         if (p->auth.auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
 636                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 637                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 638                                 "but client declined signing.\n",
 639                                 get_pipe_name_from_iface(&p->syntax)));
 640                         return False;
 641                 }
 642         }
 643         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 644                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
 645                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 646                                 "but client declined sealing.\n",
 647                                 get_pipe_name_from_iface(&p->syntax)));
 648                         return False;
 649                 }
 650         }
 651
 652         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 653                   "workstation: %s\n", a->ntlmssp_state->user,
 654                   a->ntlmssp_state->domain, a->ntlmssp_state->workstation));
 655
 656         if (a->server_info->ptok == NULL) {
 657                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 658                 return False;
 659         }
 660
 661         TALLOC_FREE(p->server_info);
 662
 663         p->server_info = copy_serverinfo(p, a->server_info);
 664         if (p->server_info == NULL) {
 665                 DEBUG(0, ("copy_serverinfo failed\n"));
 666                 return false;
 667         }
 668
 669         /*
 670          * We're an authenticated bind over smb, so the session key needs to
 671          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 672          * does. See the RPC-SAMBA3SESSIONKEY.
 673          */
 674
 675         session_key = generic_session_key();
 676         if (session_key.data == NULL) {
 677                 return False;
 678         }
 679
 680         ret = server_info_set_session_key(p->server_info, session_key);
 681
 682         data_blob_free(&session_key);
 683
 684         return True;
 685 }
 686
 687 /*******************************************************************
 688  The switch table for the pipe names and the functions to handle them.
 689 *******************************************************************/
 690
 691 struct rpc_table {
 692         struct {
 693                 const char *clnt;
 694                 const char *srv;
 695         } pipe;
 696         struct ndr_syntax_id rpc_interface;
 697         const struct api_struct *cmds;
 698         int n_cmds;
 699 };
 700
 701 static struct rpc_table *rpc_lookup;
 702 static int rpc_lookup_size;
 703
 704 /*******************************************************************
 705  This is the "stage3" NTLMSSP response after a bind request and reply.
 706 *******************************************************************/
 707
 708 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 709 {
 710         RPC_HDR_AUTH auth_info;
 711         uint32 pad = 0;
 712         DATA_BLOB blob;
 713
 714         ZERO_STRUCT(blob);
 715
 716         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 717
 718         if (p->hdr.auth_len == 0) {
 719                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 720                 goto err;
 721         }
 722
 723         /* 4 bytes padding. */
 724         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 725                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 726                 goto err;
 727         }
 728
 729         /*
 730          * Decode the authentication verifier response.
 731          */
 732
 733         if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 734                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
 735                 goto err;
 736         }
 737
 738         if (auth_info.auth_type != RPC_NTLMSSP_AUTH_TYPE) {
 739                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 740                         (unsigned int)auth_info.auth_type ));
 741                 return False;
 742         }
 743
 744         blob = data_blob(NULL,p->hdr.auth_len);
 745
 746         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 747                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 748                         (unsigned int)p->hdr.auth_len ));
 749                 goto err;
 750         }
 751
 752         /*
 753          * The following call actually checks the challenge/response data.
 754          * for correctness against the given DOMAIN\user name.
 755          */
 756
 757         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 758                 goto err;
 759         }
 760
 761         data_blob_free(&blob);
 762
 763         p->pipe_bound = True;
 764
 765         return True;
 766
 767  err:
 768
 769         data_blob_free(&blob);
 770         free_pipe_ntlmssp_auth_data(&p->auth);
 771         p->auth.a_u.auth_ntlmssp_state = NULL;
 772
 773         return False;
 774 }
 775
 776 /*******************************************************************
 777  Marshall a bind_nak pdu.
 778 *******************************************************************/
 779
 780 static bool setup_bind_nak(pipes_struct *p)
 781 {
 782         RPC_HDR nak_hdr;
 783         uint16 zero = 0;
 784
 785         /* Free any memory in the current return data buffer. */
 786         prs_mem_free(&p->out_data.rdata);
 787
 788         /*
 789          * Marshall directly into the outgoing PDU space. We
 790          * must do this as we need to set to the bind response
 791          * header and are never sending more than one PDU here.
 792          */
 793
 794         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 795
 796         /*
 797          * Initialize a bind_nak header.
 798          */
 799
 800         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 801                 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 802
 803         /*
 804          * Marshall the header into the outgoing PDU.
 805          */
 806
 807         if(!smb_io_rpc_hdr("", &nak_hdr, &p->out_data.frag, 0)) {
 808                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 809                 prs_mem_free(&p->out_data.frag);
 810                 return False;
 811         }
 812
 813         /*
 814          * Now add the reject reason.
 815          */
 816
 817         if(!prs_uint16("reject code", &p->out_data.frag, 0, &zero)) {
 818                 prs_mem_free(&p->out_data.frag);
 819                 return False;
 820         }
 821
 822         p->out_data.data_sent_length = 0;
 823         p->out_data.current_pdu_sent = 0;
 824
 825         if (p->auth.auth_data_free_func) {
 826                 (*p->auth.auth_data_free_func)(&p->auth);
 827         }
 828         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
 829         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 830         p->pipe_bound = False;
 831
 832         return True;
 833 }
 834
 835 /*******************************************************************
 836  Marshall a fault pdu.
 837 *******************************************************************/
 838
 839 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 840 {
 841         RPC_HDR fault_hdr;
 842         RPC_HDR_RESP hdr_resp;
 843         RPC_HDR_FAULT fault_resp;
 844
 845         /* Free any memory in the current return data buffer. */
 846         prs_mem_free(&p->out_data.rdata);
 847
 848         /*
 849          * Marshall directly into the outgoing PDU space. We
 850          * must do this as we need to set to the bind response
 851          * header and are never sending more than one PDU here.
 852          */
 853
 854         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 855
 856         /*
 857          * Initialize a fault header.
 858          */
 859
 860         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 861             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 862
 863         /*
 864          * Initialize the HDR_RESP and FAULT parts of the PDU.
 865          */
 866
 867         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 868
 869         fault_resp.status = status;
 870         fault_resp.reserved = 0;
 871
 872         /*
 873          * Marshall the header into the outgoing PDU.
 874          */
 875
 876         if(!smb_io_rpc_hdr("", &fault_hdr, &p->out_data.frag, 0)) {
 877                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 878                 prs_mem_free(&p->out_data.frag);
 879                 return False;
 880         }
 881
 882         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 883                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 884                 prs_mem_free(&p->out_data.frag);
 885                 return False;
 886         }
 887
 888         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &p->out_data.frag, 0)) {
 889                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 890                 prs_mem_free(&p->out_data.frag);
 891                 return False;
 892         }
 893
 894         p->out_data.data_sent_length = 0;
 895         p->out_data.current_pdu_sent = 0;
 896
 897         return True;
 898 }
 899
 900 #if 0
 901 /*******************************************************************
 902  Marshall a cancel_ack pdu.
 903  We should probably check the auth-verifier here.
 904 *******************************************************************/
 905
 906 bool setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
 907 {
 908         prs_struct outgoing_pdu;
 909         RPC_HDR ack_reply_hdr;
 910
 911         /* Free any memory in the current return data buffer. */
 912         prs_mem_free(&p->out_data.rdata);
 913
 914         /*
 915          * Marshall directly into the outgoing PDU space. We
 916          * must do this as we need to set to the bind response
 917          * header and are never sending more than one PDU here.
 918          */
 919
 920         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 921         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 922
 923         /*
 924          * Initialize a cancel_ack header.
 925          */
 926
 927         init_rpc_hdr(&ack_reply_hdr, RPC_CANCEL_ACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 928                         p->hdr.call_id, RPC_HEADER_LEN, 0);
 929
 930         /*
 931          * Marshall the header into the outgoing PDU.
 932          */
 933
 934         if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
 935                 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
 936                 prs_mem_free(&outgoing_pdu);
 937                 return False;
 938         }
 939
 940         p->out_data.data_sent_length = 0;
 941         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 942         p->out_data.current_pdu_sent = 0;
 943
 944         prs_mem_free(&outgoing_pdu);
 945         return True;
 946 }
 947 #endif
 948
 949 /*******************************************************************
 950  Ensure a bind request has the correct abstract & transfer interface.
 951  Used to reject unknown binds from Win2k.
 952 *******************************************************************/
 953
 954 static bool check_bind_req(struct pipes_struct *p,
 955                            struct ndr_syntax_id* abstract,
 956                            struct ndr_syntax_id* transfer,
 957                            uint32 context_id)
 958 {
 959         int i=0;
 960         struct pipe_rpc_fns *context_fns;
 961
 962         DEBUG(3,("check_bind_req for %s\n",
 963                  get_pipe_name_from_iface(&p->syntax)));
 964
 965         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 966
 967         for (i=0; i<rpc_lookup_size; i++) {
 968                 DEBUGADD(10, ("checking %s\n", rpc_lookup[i].pipe.clnt));
 969                 if (ndr_syntax_id_equal(
 970                             abstract, &rpc_lookup[i].rpc_interface)
 971                     && ndr_syntax_id_equal(
 972                             transfer, &ndr_transfer_syntax)) {
 973                         break;
 974                 }
 975         }
 976
 977         if (i == rpc_lookup_size) {
 978                 return false;
 979         }
 980
 981         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
 982         if (context_fns == NULL) {
 983                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 984                 return False;
 985         }
 986
 987         context_fns->cmds = rpc_lookup[i].cmds;
 988         context_fns->n_cmds = rpc_lookup[i].n_cmds;
 989         context_fns->context_id = context_id;
 990
 991         /* add to the list of open contexts */
 992
 993         DLIST_ADD( p->contexts, context_fns );
 994
 995         return True;
 996 }
 997
 998 /*******************************************************************
 999  Register commands to an RPC pipe
1000 *******************************************************************/
1001
1002 NTSTATUS rpc_srv_register(int version, const char *clnt, const char *srv,
1003                           const struct ndr_interface_table *iface,
1004                           const struct api_struct *cmds, int size)
1005 {
1006         struct rpc_table *rpc_entry;
1007
1008         if (!clnt || !srv || !cmds) {
1009                 return NT_STATUS_INVALID_PARAMETER;
1010         }
1011
1012         if (version != SMB_RPC_INTERFACE_VERSION) {
1013                 DEBUG(0,("Can't register rpc commands!\n"
1014                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1015                          ", while this version of samba uses version %d!\n",
1016                          version,SMB_RPC_INTERFACE_VERSION));
1017                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1018         }
1019
1020         /* TODO:
1021          *
1022          * we still need to make sure that don't register the same commands twice!!!
1023          *
1024          * --metze
1025          */
1026
1027         /* We use a temporary variable because this call can fail and
1028            rpc_lookup will still be valid afterwards.  It could then succeed if
1029            called again later */
1030         rpc_lookup_size++;
1031         rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1032         if (NULL == rpc_entry) {
1033                 rpc_lookup_size--;
1034                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1035                 return NT_STATUS_NO_MEMORY;
1036         } else {
1037                 rpc_lookup = rpc_entry;
1038         }
1039
1040         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1041         ZERO_STRUCTP(rpc_entry);
1042         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1043         rpc_entry->pipe.srv = SMB_STRDUP(srv);
1044         rpc_entry->rpc_interface = iface->syntax_id;
1045         rpc_entry->cmds = cmds;
1046         rpc_entry->n_cmds = size;
1047
1048         return NT_STATUS_OK;
1049 }
1050
1051 /**
1052  * Is a named pipe known?
1053  * @param[in] cli_filename      The pipe name requested by the client
1054  * @result                      Do we want to serve this?
1055  */
1056 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1057 {
1058         const char *pipename = cli_filename;
1059         int i;
1060
1061         if (strnequal(pipename, "\\PIPE\\", 6)) {
1062                 pipename += 5;
1063         }
1064
1065         if (*pipename == '\\') {
1066                 pipename += 1;
1067         }
1068
1069         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1070                 DEBUG(10, ("refusing spoolss access\n"));
1071                 return false;
1072         }
1073
1074         for (i=0; i<rpc_lookup_size; i++) {
1075                 if (strequal(pipename, rpc_lookup[i].pipe.clnt)) {
1076                         *syntax = rpc_lookup[i].rpc_interface;
1077                         return true;
1078                 }
1079         }
1080
1081         DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1082         return false;
1083 }
1084
1085 /*******************************************************************
1086  Handle a SPNEGO krb5 bind auth.
1087 *******************************************************************/
1088
1089 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1090                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1091 {
1092         return False;
1093 }
1094
1095 /*******************************************************************
1096  Handle the first part of a SPNEGO bind auth.
1097 *******************************************************************/
1098
1099 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1100                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1101 {
1102         DATA_BLOB blob;
1103         DATA_BLOB secblob;
1104         DATA_BLOB response;
1105         DATA_BLOB chal;
1106         char *OIDs[ASN1_MAX_OIDS];
1107         int i;
1108         NTSTATUS status;
1109         bool got_kerberos_mechanism = false;
1110         AUTH_NTLMSSP_STATE *a = NULL;
1111         RPC_HDR_AUTH auth_info;
1112
1113         ZERO_STRUCT(secblob);
1114         ZERO_STRUCT(chal);
1115         ZERO_STRUCT(response);
1116
1117         /* Grab the SPNEGO blob. */
1118         blob = data_blob(NULL,p->hdr.auth_len);
1119
1120         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1121                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1122                         (unsigned int)p->hdr.auth_len ));
1123                 goto err;
1124         }
1125
1126         if (blob.data[0] != ASN1_APPLICATION(0)) {
1127                 goto err;
1128         }
1129
1130         /* parse out the OIDs and the first sec blob */
1131         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1132                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1133                 goto err;
1134         }
1135
1136         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1137                 got_kerberos_mechanism = true;
1138         }
1139
1140         for (i=0;OIDs[i];i++) {
1141                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1142                 TALLOC_FREE(OIDs[i]);
1143         }
1144         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1145
1146         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1147                 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1148                 data_blob_free(&secblob);
1149                 data_blob_free(&blob);
1150                 return ret;
1151         }
1152
1153         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1154                 /* Free any previous auth type. */
1155                 free_pipe_ntlmssp_auth_data(&p->auth);
1156         }
1157
1158         if (!got_kerberos_mechanism) {
1159                 /* Initialize the NTLM engine. */
1160                 status = auth_ntlmssp_start(&a);
1161                 if (!NT_STATUS_IS_OK(status)) {
1162                         goto err;
1163                 }
1164
1165                 /*
1166                  * Pass the first security blob of data to it.
1167                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1168                  * which means we need another packet to complete the bind.
1169                  */
1170
1171                 status = auth_ntlmssp_update(a, secblob, &chal);
1172
1173                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1174                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1175                         goto err;
1176                 }
1177
1178                 /* Generate the response blob we need for step 2 of the bind. */
1179                 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1180         } else {
1181                 /*
1182                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1183                  * code to process follow-up packets is not complete
1184                  * yet. JRA.
1185                  */
1186                 response = spnego_gen_auth_response(NULL,
1187                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1188                                         OID_NTLMSSP);
1189         }
1190
1191         /* Copy the blob into the pout_auth parse struct */
1192         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1193         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1194                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1195                 goto err;
1196         }
1197
1198         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1199                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1200                 goto err;
1201         }
1202
1203         p->auth.a_u.auth_ntlmssp_state = a;
1204         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1205         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1206
1207         data_blob_free(&blob);
1208         data_blob_free(&secblob);
1209         data_blob_free(&chal);
1210         data_blob_free(&response);
1211
1212         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1213         return True;
1214
1215  err:
1216
1217         data_blob_free(&blob);
1218         data_blob_free(&secblob);
1219         data_blob_free(&chal);
1220         data_blob_free(&response);
1221
1222         p->auth.a_u.auth_ntlmssp_state = NULL;
1223
1224         return False;
1225 }
1226
1227 /*******************************************************************
1228  Handle the second part of a SPNEGO bind auth.
1229 *******************************************************************/
1230
1231 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1232                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1233 {
1234         RPC_HDR_AUTH auth_info;
1235         DATA_BLOB spnego_blob;
1236         DATA_BLOB auth_blob;
1237         DATA_BLOB auth_reply;
1238         DATA_BLOB response;
1239         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1240
1241         ZERO_STRUCT(spnego_blob);
1242         ZERO_STRUCT(auth_blob);
1243         ZERO_STRUCT(auth_reply);
1244         ZERO_STRUCT(response);
1245
1246         /*
1247          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1248          * fail here as 'a' == NULL.
1249          */
1250         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1251                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1252                 goto err;
1253         }
1254
1255         /* Grab the SPNEGO blob. */
1256         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1257
1258         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1259                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1260                         (unsigned int)p->hdr.auth_len ));
1261                 goto err;
1262         }
1263
1264         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1265                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1266                 goto err;
1267         }
1268
1269         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1270                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1271                 goto err;
1272         }
1273
1274         /*
1275          * The following call actually checks the challenge/response data.
1276          * for correctness against the given DOMAIN\user name.
1277          */
1278
1279         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1280                 goto err;
1281         }
1282
1283         data_blob_free(&spnego_blob);
1284         data_blob_free(&auth_blob);
1285
1286         /* Generate the spnego "accept completed" blob - no incoming data. */
1287         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1288
1289         /* Copy the blob into the pout_auth parse struct */
1290         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1291         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1292                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1293                 goto err;
1294         }
1295
1296         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1297                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1298                 goto err;
1299         }
1300
1301         data_blob_free(&auth_reply);
1302         data_blob_free(&response);
1303
1304         p->pipe_bound = True;
1305
1306         return True;
1307
1308  err:
1309
1310         data_blob_free(&spnego_blob);
1311         data_blob_free(&auth_blob);
1312         data_blob_free(&auth_reply);
1313         data_blob_free(&response);
1314
1315         free_pipe_ntlmssp_auth_data(&p->auth);
1316         p->auth.a_u.auth_ntlmssp_state = NULL;
1317
1318         return False;
1319 }
1320
1321 /*******************************************************************
1322  Handle an schannel bind auth.
1323 *******************************************************************/
1324
1325 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1326                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1327 {
1328         RPC_HDR_AUTH auth_info;
1329         RPC_AUTH_SCHANNEL_NEG neg;
1330         RPC_AUTH_VERIFIER auth_verifier;
1331         bool ret;
1332         NTSTATUS status;
1333         struct netlogon_creds_CredentialState *creds;
1334         uint32 flags;
1335         DATA_BLOB session_key;
1336
1337         if (!smb_io_rpc_auth_schannel_neg("", &neg, rpc_in_p, 0)) {
1338                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1339                 return False;
1340         }
1341
1342         /*
1343          * The neg.myname key here must match the remote computer name
1344          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1345          * operations that use credentials.
1346          */
1347
1348         become_root();
1349         status = schannel_fetch_session_key(p->mem_ctx,
1350                                             neg.myname,
1351                                             &creds);
1352         unbecome_root();
1353
1354         if (!NT_STATUS_IS_OK(status)) {
1355                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1356                 return False;
1357         }
1358
1359         p->auth.a_u.schannel_auth = talloc(p, struct schannel_auth_struct);
1360         if (!p->auth.a_u.schannel_auth) {
1361                 TALLOC_FREE(creds);
1362                 return False;
1363         }
1364
1365         memset(p->auth.a_u.schannel_auth->sess_key, 0, sizeof(p->auth.a_u.schannel_auth->sess_key));
1366         memcpy(p->auth.a_u.schannel_auth->sess_key, creds->session_key,
1367                         sizeof(creds->session_key));
1368
1369         TALLOC_FREE(creds);
1370
1371         p->auth.a_u.schannel_auth->seq_num = 0;
1372
1373         /*
1374          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1375          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1376          * struct of the person who opened the pipe. I need to test this further. JRA.
1377          *
1378          * VL. As we are mapping this to guest set the generic key
1379          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1380          * W2k3, as it does not allow schannel binds against SAMR and LSA
1381          * anymore.
1382          */
1383
1384         session_key = generic_session_key();
1385         if (session_key.data == NULL) {
1386                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1387                           " key\n"));
1388                 return false;
1389         }
1390
1391         ret = server_info_set_session_key(p->server_info, session_key);
1392
1393         data_blob_free(&session_key);
1394
1395         if (!ret) {
1396                 DEBUG(0, ("server_info_set_session_key failed\n"));
1397                 return false;
1398         }
1399
1400         init_rpc_hdr_auth(&auth_info, RPC_SCHANNEL_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1401         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1402                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1403                 return False;
1404         }
1405
1406         /*** SCHANNEL verifier ***/
1407
1408         init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1409         if(!smb_io_rpc_schannel_verifier("", &auth_verifier, pout_auth, 0)) {
1410                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1411                 return False;
1412         }
1413
1414         prs_align(pout_auth);
1415
1416         flags = 5;
1417         if(!prs_uint32("flags ", pout_auth, 0, &flags)) {
1418                 return False;
1419         }
1420
1421         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1422                 neg.domain, neg.myname));
1423
1424         /* We're finished with this bind - no more packets. */
1425         p->auth.auth_data_free_func = NULL;
1426         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1427
1428         p->pipe_bound = True;
1429
1430         return True;
1431 }
1432
1433 /*******************************************************************
1434  Handle an NTLMSSP bind auth.
1435 *******************************************************************/
1436
1437 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1438                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1439 {
1440         RPC_HDR_AUTH auth_info;
1441         DATA_BLOB blob;
1442         DATA_BLOB response;
1443         NTSTATUS status;
1444         AUTH_NTLMSSP_STATE *a = NULL;
1445
1446         ZERO_STRUCT(blob);
1447         ZERO_STRUCT(response);
1448
1449         /* Grab the NTLMSSP blob. */
1450         blob = data_blob(NULL,p->hdr.auth_len);
1451
1452         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1453                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1454                         (unsigned int)p->hdr.auth_len ));
1455                 goto err;
1456         }
1457
1458         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1459                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1460                 goto err;
1461         }
1462
1463         /* We have an NTLMSSP blob. */
1464         status = auth_ntlmssp_start(&a);
1465         if (!NT_STATUS_IS_OK(status)) {
1466                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1467                         nt_errstr(status) ));
1468                 goto err;
1469         }
1470
1471         status = auth_ntlmssp_update(a, blob, &response);
1472         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1473                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1474                         nt_errstr(status) ));
1475                 goto err;
1476         }
1477
1478         data_blob_free(&blob);
1479
1480         /* Copy the blob into the pout_auth parse struct */
1481         init_rpc_hdr_auth(&auth_info, RPC_NTLMSSP_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1482         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1483                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1484                 goto err;
1485         }
1486
1487         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1488                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1489                 goto err;
1490         }
1491
1492         p->auth.a_u.auth_ntlmssp_state = a;
1493         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1494         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1495
1496         data_blob_free(&blob);
1497         data_blob_free(&response);
1498
1499         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1500
1501         /* We can't set pipe_bound True yet - we need an RPC_AUTH3 response packet... */
1502         return True;
1503
1504   err:
1505
1506         data_blob_free(&blob);
1507         data_blob_free(&response);
1508
1509         free_pipe_ntlmssp_auth_data(&p->auth);
1510         p->auth.a_u.auth_ntlmssp_state = NULL;
1511         return False;
1512 }
1513
1514 /*******************************************************************
1515  Respond to a pipe bind request.
1516 *******************************************************************/
1517
1518 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1519 {
1520         RPC_HDR_BA hdr_ba;
1521         RPC_HDR_RB hdr_rb;
1522         RPC_HDR_AUTH auth_info;
1523         uint16 assoc_gid;
1524         fstring ack_pipe_name;
1525         prs_struct out_hdr_ba;
1526         prs_struct out_auth;
1527         int i = 0;
1528         int auth_len = 0;
1529         unsigned int auth_type = RPC_ANONYMOUS_AUTH_TYPE;
1530
1531         /* No rebinds on a bound pipe - use alter context. */
1532         if (p->pipe_bound) {
1533                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1534                          "pipe %s.\n", get_pipe_name_from_iface(&p->syntax)));
1535                 return setup_bind_nak(p);
1536         }
1537
1538         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1539
1540         /*
1541          * Marshall directly into the outgoing PDU space. We
1542          * must do this as we need to set to the bind response
1543          * header and are never sending more than one PDU here.
1544          */
1545
1546         /*
1547          * Setup the memory to marshall the ba header, and the
1548          * auth footers.
1549          */
1550
1551         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1552                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1553                 prs_mem_free(&p->out_data.frag);
1554                 return False;
1555         }
1556
1557         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1558                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1559                 prs_mem_free(&p->out_data.frag);
1560                 prs_mem_free(&out_hdr_ba);
1561                 return False;
1562         }
1563
1564         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1565
1566         ZERO_STRUCT(hdr_rb);
1567
1568         /* decode the bind request */
1569
1570         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1571                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB "
1572                          "struct.\n"));
1573                 goto err_exit;
1574         }
1575
1576         if (hdr_rb.num_contexts == 0) {
1577                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1578                 goto err_exit;
1579         }
1580
1581         /*
1582          * Try and find the correct pipe name to ensure
1583          * that this is a pipe name we support.
1584          */
1585
1586         for (i = 0; i < rpc_lookup_size; i++) {
1587                 if (ndr_syntax_id_equal(&rpc_lookup[i].rpc_interface,
1588                                         &hdr_rb.rpc_context[0].abstract)) {
1589                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1590                                 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1591                         break;
1592                 }
1593         }
1594
1595         if (i == rpc_lookup_size) {
1596                 NTSTATUS status;
1597
1598                 status = smb_probe_module(
1599                         "rpc", get_pipe_name_from_iface(
1600                                 &hdr_rb.rpc_context[0].abstract));
1601
1602                 if (NT_STATUS_IS_ERR(status)) {
1603                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1604                                 get_pipe_name_from_iface(&hdr_rb.rpc_context[0].abstract)));
1605                         prs_mem_free(&p->out_data.frag);
1606                         prs_mem_free(&out_hdr_ba);
1607                         prs_mem_free(&out_auth);
1608
1609                         return setup_bind_nak(p);
1610                 }
1611
1612                 for (i = 0; i < rpc_lookup_size; i++) {
1613                        if (strequal(rpc_lookup[i].pipe.clnt,
1614                                     get_pipe_name_from_iface(&p->syntax))) {
1615                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1616                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1617                                break;
1618                        }
1619                 }
1620
1621                 if (i == rpc_lookup_size) {
1622                         DEBUG(0, ("module %s doesn't provide functions for "
1623                                   "pipe %s!\n",
1624                                   get_pipe_name_from_iface(&p->syntax),
1625                                   get_pipe_name_from_iface(&p->syntax)));
1626                         goto err_exit;
1627                 }
1628         }
1629
1630         /* name has to be \PIPE\xxxxx */
1631         fstrcpy(ack_pipe_name, "\\PIPE\\");
1632         fstrcat(ack_pipe_name, rpc_lookup[i].pipe.srv);
1633
1634         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1635
1636         /*
1637          * Check if this is an authenticated bind request.
1638          */
1639
1640         if (p->hdr.auth_len) {
1641                 /*
1642                  * Decode the authentication verifier.
1643                  */
1644
1645                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1646                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1647                         goto err_exit;
1648                 }
1649
1650                 auth_type = auth_info.auth_type;
1651
1652                 /* Work out if we have to sign or seal etc. */
1653                 switch (auth_info.auth_level) {
1654                         case RPC_AUTH_LEVEL_INTEGRITY:
1655                                 p->auth.auth_level = PIPE_AUTH_LEVEL_INTEGRITY;
1656                                 break;
1657                         case RPC_AUTH_LEVEL_PRIVACY:
1658                                 p->auth.auth_level = PIPE_AUTH_LEVEL_PRIVACY;
1659                                 break;
1660                         default:
1661                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1662                                         (unsigned int)auth_info.auth_level ));
1663                                 goto err_exit;
1664                 }
1665         } else {
1666                 ZERO_STRUCT(auth_info);
1667         }
1668
1669         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1670
1671         switch(auth_type) {
1672                 case RPC_NTLMSSP_AUTH_TYPE:
1673                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1674                                 goto err_exit;
1675                         }
1676                         assoc_gid = 0x7a77;
1677                         break;
1678
1679                 case RPC_SCHANNEL_AUTH_TYPE:
1680                         if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1681                                 goto err_exit;
1682                         }
1683                         break;
1684
1685                 case RPC_SPNEGO_AUTH_TYPE:
1686                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1687                                 goto err_exit;
1688                         }
1689                         break;
1690
1691                 case RPC_ANONYMOUS_AUTH_TYPE:
1692                         /* Unauthenticated bind request. */
1693                         /* We're finished - no more packets. */
1694                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1695                         /* We must set the pipe auth_level here also. */
1696                         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
1697                         p->pipe_bound = True;
1698                         /* The session key was initialized from the SMB
1699                          * session in make_internal_rpc_pipe_p */
1700                         break;
1701
1702                 default:
1703                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1704                         goto err_exit;
1705         }
1706
1707         /*
1708          * Create the bind response struct.
1709          */
1710
1711         /* If the requested abstract synt uuid doesn't match our client pipe,
1712                 reject the bind_ack & set the transfer interface synt to all 0's,
1713                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1714                 unknown to NT4)
1715                 Needed when adding entries to a DACL from NT5 - SK */
1716
1717         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1718                                 hdr_rb.rpc_context[0].context_id )) {
1719                 init_rpc_hdr_ba(&hdr_ba,
1720                         RPC_MAX_PDU_FRAG_LEN,
1721                         RPC_MAX_PDU_FRAG_LEN,
1722                         assoc_gid,
1723                         ack_pipe_name,
1724                         0x1, 0x0, 0x0,
1725                         &hdr_rb.rpc_context[0].transfer[0]);
1726         } else {
1727                 /* Rejection reason: abstract syntax not supported */
1728                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1729                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1730                                         ack_pipe_name, 0x1, 0x2, 0x1,
1731                                         &null_ndr_syntax_id);
1732                 p->pipe_bound = False;
1733         }
1734
1735         /*
1736          * and marshall it.
1737          */
1738
1739         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1740                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1741                 goto err_exit;
1742         }
1743
1744         /*
1745          * Create the header, now we know the length.
1746          */
1747
1748         if (prs_offset(&out_auth)) {
1749                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1750         }
1751
1752         init_rpc_hdr(&p->hdr, RPC_BINDACK, RPC_FLG_FIRST | RPC_FLG_LAST,
1753                         p->hdr.call_id,
1754                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1755                         auth_len);
1756
1757         /*
1758          * Marshall the header into the outgoing PDU.
1759          */
1760
1761         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1762                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1763                 goto err_exit;
1764         }
1765
1766         /*
1767          * Now add the RPC_HDR_BA and any auth needed.
1768          */
1769
1770         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1771                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1772                 goto err_exit;
1773         }
1774
1775         if (auth_len && !prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1776                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1777                 goto err_exit;
1778         }
1779
1780         /*
1781          * Setup the lengths for the initial reply.
1782          */
1783
1784         p->out_data.data_sent_length = 0;
1785         p->out_data.current_pdu_sent = 0;
1786
1787         prs_mem_free(&out_hdr_ba);
1788         prs_mem_free(&out_auth);
1789
1790         return True;
1791
1792   err_exit:
1793
1794         prs_mem_free(&p->out_data.frag);
1795         prs_mem_free(&out_hdr_ba);
1796         prs_mem_free(&out_auth);
1797         return setup_bind_nak(p);
1798 }
1799
1800 /****************************************************************************
1801  Deal with an alter context call. Can be third part of 3 leg auth request for
1802  SPNEGO calls.
1803 ****************************************************************************/
1804
1805 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1806 {
1807         RPC_HDR_BA hdr_ba;
1808         RPC_HDR_RB hdr_rb;
1809         RPC_HDR_AUTH auth_info;
1810         uint16 assoc_gid;
1811         fstring ack_pipe_name;
1812         prs_struct out_hdr_ba;
1813         prs_struct out_auth;
1814         int auth_len = 0;
1815
1816         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1817
1818         /*
1819          * Marshall directly into the outgoing PDU space. We
1820          * must do this as we need to set to the bind response
1821          * header and are never sending more than one PDU here.
1822          */
1823
1824         /*
1825          * Setup the memory to marshall the ba header, and the
1826          * auth footers.
1827          */
1828
1829         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1830                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1831                 prs_mem_free(&p->out_data.frag);
1832                 return False;
1833         }
1834
1835         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1836                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1837                 prs_mem_free(&p->out_data.frag);
1838                 prs_mem_free(&out_hdr_ba);
1839                 return False;
1840         }
1841
1842         ZERO_STRUCT(hdr_rb);
1843
1844         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1845
1846         /* decode the alter context request */
1847         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1848                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1849                 goto err_exit;
1850         }
1851
1852         /* secondary address CAN be NULL
1853          * as the specs say it's ignored.
1854          * It MUST be NULL to have the spoolss working.
1855          */
1856         fstrcpy(ack_pipe_name,"");
1857
1858         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1859
1860         /*
1861          * Check if this is an authenticated alter context request.
1862          */
1863
1864         if (p->hdr.auth_len != 0) {
1865                 /*
1866                  * Decode the authentication verifier.
1867                  */
1868
1869                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1870                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1871                         goto err_exit;
1872                 }
1873
1874                 /*
1875                  * Currently only the SPNEGO auth type uses the alter ctx
1876                  * response in place of the NTLMSSP auth3 type.
1877                  */
1878
1879                 if (auth_info.auth_type == RPC_SPNEGO_AUTH_TYPE) {
1880                         /* We can only finish if the pipe is unbound. */
1881                         if (!p->pipe_bound) {
1882                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1883                                         goto err_exit;
1884                                 }
1885                         } else {
1886                                 goto err_exit;
1887                         }
1888                 }
1889         } else {
1890                 ZERO_STRUCT(auth_info);
1891         }
1892
1893         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1894
1895         /*
1896          * Create the bind response struct.
1897          */
1898
1899         /* If the requested abstract synt uuid doesn't match our client pipe,
1900                 reject the bind_ack & set the transfer interface synt to all 0's,
1901                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1902                 unknown to NT4)
1903                 Needed when adding entries to a DACL from NT5 - SK */
1904
1905         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1906                                 hdr_rb.rpc_context[0].context_id )) {
1907                 init_rpc_hdr_ba(&hdr_ba,
1908                         RPC_MAX_PDU_FRAG_LEN,
1909                         RPC_MAX_PDU_FRAG_LEN,
1910                         assoc_gid,
1911                         ack_pipe_name,
1912                         0x1, 0x0, 0x0,
1913                         &hdr_rb.rpc_context[0].transfer[0]);
1914         } else {
1915                 /* Rejection reason: abstract syntax not supported */
1916                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1917                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1918                                         ack_pipe_name, 0x1, 0x2, 0x1,
1919                                         &null_ndr_syntax_id);
1920                 p->pipe_bound = False;
1921         }
1922
1923         /*
1924          * and marshall it.
1925          */
1926
1927         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1928                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1929                 goto err_exit;
1930         }
1931
1932         /*
1933          * Create the header, now we know the length.
1934          */
1935
1936         if (prs_offset(&out_auth)) {
1937                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1938         }
1939
1940         init_rpc_hdr(&p->hdr, RPC_ALTCONTRESP, RPC_FLG_FIRST | RPC_FLG_LAST,
1941                         p->hdr.call_id,
1942                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1943                         auth_len);
1944
1945         /*
1946          * Marshall the header into the outgoing PDU.
1947          */
1948
1949         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1950                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
1951                 goto err_exit;
1952         }
1953
1954         /*
1955          * Now add the RPC_HDR_BA and any auth needed.
1956          */
1957
1958         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1959                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
1960                 goto err_exit;
1961         }
1962
1963         if (auth_len && !prs_append_prs_data(&p->out_data.frag, &out_auth)) {
1964                 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
1965                 goto err_exit;
1966         }
1967
1968         /*
1969          * Setup the lengths for the initial reply.
1970          */
1971
1972         p->out_data.data_sent_length = 0;
1973         p->out_data.current_pdu_sent = 0;
1974
1975         prs_mem_free(&out_hdr_ba);
1976         prs_mem_free(&out_auth);
1977
1978         return True;
1979
1980   err_exit:
1981
1982         prs_mem_free(&p->out_data.frag);
1983         prs_mem_free(&out_hdr_ba);
1984         prs_mem_free(&out_auth);
1985         return setup_bind_nak(p);
1986 }
1987
1988 /****************************************************************************
1989  Deal with NTLMSSP sign & seal processing on an RPC request.
1990 ****************************************************************************/
1991
1992 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
1993                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
1994 {
1995         RPC_HDR_AUTH auth_info;
1996         uint32 auth_len = p->hdr.auth_len;
1997         uint32 save_offset = prs_offset(rpc_in);
1998         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1999         unsigned char *data = NULL;
2000         size_t data_len;
2001         unsigned char *full_packet_data = NULL;
2002         size_t full_packet_data_len;
2003         DATA_BLOB auth_blob;
2004
2005         *pstatus = NT_STATUS_OK;
2006
2007         if (p->auth.auth_level == PIPE_AUTH_LEVEL_NONE || p->auth.auth_level == PIPE_AUTH_LEVEL_CONNECT) {
2008                 return True;
2009         }
2010
2011         if (!a) {
2012                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2013                 return False;
2014         }
2015
2016         /* Ensure there's enough data for an authenticated request. */
2017         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
2018                         (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
2019                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2020                         (unsigned int)auth_len ));
2021                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2022                 return False;
2023         }
2024
2025         /*
2026          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2027          * after the RPC header.
2028          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2029          * functions as NTLMv2 checks the rpc headers also.
2030          */
2031
2032         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2033         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2034
2035         full_packet_data = p->in_data.current_in_pdu;
2036         full_packet_data_len = p->hdr.frag_len - auth_len;
2037
2038         /* Pull the auth header and the following data into a blob. */
2039         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2040                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
2041                         (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
2042                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2043                 return False;
2044         }
2045
2046         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2047                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
2048                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2049                 return False;
2050         }
2051
2052         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2053         auth_blob.length = auth_len;
2054
2055         switch (p->auth.auth_level) {
2056                 case PIPE_AUTH_LEVEL_PRIVACY:
2057                         /* Data is encrypted. */
2058                         *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
2059                                                         data, data_len,
2060                                                         full_packet_data,
2061                                                         full_packet_data_len,
2062                                                         &auth_blob);
2063                         if (!NT_STATUS_IS_OK(*pstatus)) {
2064                                 return False;
2065                         }
2066                         break;
2067                 case PIPE_AUTH_LEVEL_INTEGRITY:
2068                         /* Data is signed. */
2069                         *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
2070                                                         data, data_len,
2071                                                         full_packet_data,
2072                                                         full_packet_data_len,
2073                                                         &auth_blob);
2074                         if (!NT_STATUS_IS_OK(*pstatus)) {
2075                                 return False;
2076                         }
2077                         break;
2078                 default:
2079                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2080                         return False;
2081         }
2082
2083         /*
2084          * Return the current pointer to the data offset.
2085          */
2086
2087         if(!prs_set_offset(rpc_in, save_offset)) {
2088                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2089                         (unsigned int)save_offset ));
2090                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2091                 return False;
2092         }
2093
2094         /*
2095          * Remember the padding length. We must remove it from the real data
2096          * stream once the sign/seal is done.
2097          */
2098
2099         *p_ss_padding_len = auth_info.auth_pad_len;
2100
2101         return True;
2102 }
2103
2104 /****************************************************************************
2105  Deal with schannel processing on an RPC request.
2106 ****************************************************************************/
2107
2108 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2109 {
2110         uint32 data_len;
2111         uint32 auth_len;
2112         uint32 save_offset = prs_offset(rpc_in);
2113         RPC_HDR_AUTH auth_info;
2114         RPC_AUTH_SCHANNEL_CHK schannel_chk;
2115
2116         auth_len = p->hdr.auth_len;
2117
2118         if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN ||
2119                         auth_len > RPC_HEADER_LEN +
2120                                         RPC_HDR_REQ_LEN +
2121                                         RPC_HDR_AUTH_LEN +
2122                                         auth_len) {
2123                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2124                 return False;
2125         }
2126
2127         /*
2128          * The following is that length of the data we must verify or unseal.
2129          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2130          * preceeding the auth_data.
2131          */
2132
2133         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2134                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2135                         (unsigned int)p->hdr.frag_len,
2136                         (unsigned int)auth_len ));
2137                 return False;
2138         }
2139
2140         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2141                 RPC_HDR_AUTH_LEN - auth_len;
2142
2143         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2144
2145         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2146                 DEBUG(0,("cannot move offset to %u.\n",
2147                          (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2148                 return False;
2149         }
2150
2151         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2152                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2153                 return False;
2154         }
2155
2156         if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
2157                 DEBUG(0,("Invalid auth info %d on schannel\n",
2158                          auth_info.auth_type));
2159                 return False;
2160         }
2161
2162         if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN, &schannel_chk, rpc_in, 0)) {
2163                 DEBUG(0,("failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
2164                 return False;
2165         }
2166
2167         if (!schannel_decode(p->auth.a_u.schannel_auth,
2168                            p->auth.auth_level,
2169                            SENDER_IS_INITIATOR,
2170                            &schannel_chk,
2171                            prs_data_p(rpc_in)+RPC_HDR_REQ_LEN, data_len)) {
2172                 DEBUG(3,("failed to decode PDU\n"));
2173                 return False;
2174         }
2175
2176         /*
2177          * Return the current pointer to the data offset.
2178          */
2179
2180         if(!prs_set_offset(rpc_in, save_offset)) {
2181                 DEBUG(0,("failed to set offset back to %u\n",
2182                          (unsigned int)save_offset ));
2183                 return False;
2184         }
2185
2186         /* The sequence number gets incremented on both send and receive. */
2187         p->auth.a_u.schannel_auth->seq_num++;
2188
2189         /*
2190          * Remember the padding length. We must remove it from the real data
2191          * stream once the sign/seal is done.
2192          */
2193
2194         *p_ss_padding_len = auth_info.auth_pad_len;
2195
2196         return True;
2197 }
2198
2199 /****************************************************************************
2200  Find the set of RPC functions associated with this context_id
2201 ****************************************************************************/
2202
2203 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2204 {
2205         PIPE_RPC_FNS *fns = NULL;
2206
2207         if ( !list ) {
2208                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2209                 return NULL;
2210         }
2211
2212         for (fns=list; fns; fns=fns->next ) {
2213                 if ( fns->context_id == context_id )
2214                         return fns;
2215         }
2216         return NULL;
2217 }
2218
2219 /****************************************************************************
2220  Memory cleanup.
2221 ****************************************************************************/
2222
2223 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2224 {
2225         PIPE_RPC_FNS *tmp = list;
2226         PIPE_RPC_FNS *tmp2;
2227
2228         while (tmp) {
2229                 tmp2 = tmp->next;
2230                 SAFE_FREE(tmp);
2231                 tmp = tmp2;
2232         }
2233
2234         return;
2235 }
2236
2237 static bool api_rpcTNP(pipes_struct *p,
2238                        const struct api_struct *api_rpc_cmds, int n_cmds);
2239
2240 /****************************************************************************
2241  Find the correct RPC function to call for this request.
2242  If the pipe is authenticated then become the correct UNIX user
2243  before doing the call.
2244 ****************************************************************************/
2245
2246 bool api_pipe_request(pipes_struct *p)
2247 {
2248         bool ret = False;
2249         bool changed_user = False;
2250         PIPE_RPC_FNS *pipe_fns;
2251
2252         if (p->pipe_bound &&
2253                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2254                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2255                 if(!become_authenticated_pipe_user(p)) {
2256                         prs_mem_free(&p->out_data.rdata);
2257                         return False;
2258                 }
2259                 changed_user = True;
2260         }
2261
2262         DEBUG(5, ("Requested \\PIPE\\%s\n",
2263                   get_pipe_name_from_iface(&p->syntax)));
2264
2265         /* get the set of RPC functions for this context */
2266
2267         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2268
2269         if ( pipe_fns ) {
2270                 TALLOC_CTX *frame = talloc_stackframe();
2271                 ret = api_rpcTNP(p, pipe_fns->cmds, pipe_fns->n_cmds);
2272                 TALLOC_FREE(frame);
2273         }
2274         else {
2275                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2276                         p->hdr_req.context_id,
2277                         get_pipe_name_from_iface(&p->syntax)));
2278         }
2279
2280         if (changed_user) {
2281                 unbecome_authenticated_pipe_user();
2282         }
2283
2284         return ret;
2285 }
2286
2287 /*******************************************************************
2288  Calls the underlying RPC function for a named pipe.
2289  ********************************************************************/
2290
2291 static bool api_rpcTNP(pipes_struct *p,
2292                        const struct api_struct *api_rpc_cmds, int n_cmds)
2293 {
2294         int fn_num;
2295         uint32 offset1, offset2;
2296
2297         /* interpret the command */
2298         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2299                  get_pipe_name_from_iface(&p->syntax), p->hdr_req.opnum));
2300
2301         if (DEBUGLEVEL >= 50) {
2302                 fstring name;
2303                 slprintf(name, sizeof(name)-1, "in_%s",
2304                          get_pipe_name_from_iface(&p->syntax));
2305                 prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2306         }
2307
2308         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2309                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2310                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2311                         break;
2312                 }
2313         }
2314
2315         if (fn_num == n_cmds) {
2316                 /*
2317                  * For an unknown RPC just return a fault PDU but
2318                  * return True to allow RPC's on the pipe to continue
2319                  * and not put the pipe into fault state. JRA.
2320                  */
2321                 DEBUG(4, ("unknown\n"));
2322                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2323                 return True;
2324         }
2325
2326         offset1 = prs_offset(&p->out_data.rdata);
2327
2328         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2329                 fn_num, api_rpc_cmds[fn_num].fn));
2330         /* do the actual command */
2331         if(!api_rpc_cmds[fn_num].fn(p)) {
2332                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2333                          get_pipe_name_from_iface(&p->syntax),
2334                          api_rpc_cmds[fn_num].name));
2335                 prs_mem_free(&p->out_data.rdata);
2336                 return False;
2337         }
2338
2339         if (p->bad_handle_fault_state) {
2340                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2341                 p->bad_handle_fault_state = False;
2342                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2343                 return True;
2344         }
2345
2346         if (p->rng_fault_state) {
2347                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2348                 p->rng_fault_state = False;
2349                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2350                 return True;
2351         }
2352
2353         offset2 = prs_offset(&p->out_data.rdata);
2354         prs_set_offset(&p->out_data.rdata, offset1);
2355         if (DEBUGLEVEL >= 50) {
2356                 fstring name;
2357                 slprintf(name, sizeof(name)-1, "out_%s",
2358                          get_pipe_name_from_iface(&p->syntax));
2359                 prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2360         }
2361         prs_set_offset(&p->out_data.rdata, offset2);
2362
2363         DEBUG(5,("api_rpcTNP: called %s successfully\n",
2364                  get_pipe_name_from_iface(&p->syntax)));
2365
2366         /* Check for buffer underflow in rpc parsing */
2367
2368         if ((DEBUGLEVEL >= 10) &&
2369             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2370                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2371                 char *data = (char *)SMB_MALLOC(data_len);
2372
2373                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2374                 if (data) {
2375                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2376                         SAFE_FREE(data);
2377                 }
2378
2379         }
2380
2381         return True;
2382 }