source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 2 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, write to the Free Software
  18  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  19  */
  20
  21 /*  this module apparently provides an implementation of DCE/RPC over a
  22  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  23  *  documentation are available (in on-line form) from the X-Open group.
  24  *
  25  *  this module should provide a level of abstraction between SMB
  26  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  27  *  data copies, and network traffic.
  28  *
  29  */
  30
  31 #include "includes.h"
  32
  33 extern struct pipe_id_info pipe_names[];
  34 extern struct current_user current_user;
  35
  36 #undef DBGC_CLASS
  37 #define DBGC_CLASS DBGC_RPC_SRV
  38
  39 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  40 {
  41         AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
  42
  43         if (a) {
  44                 auth_ntlmssp_end(&a);
  45         }
  46         auth->a_u.auth_ntlmssp_state = NULL;
  47 }
  48
  49 /*******************************************************************
  50  Generate the next PDU to be returned from the data in p->rdata.
  51  Handle NTLMSSP.
  52  ********************************************************************/
  53
  54 static BOOL create_next_pdu_ntlmssp(pipes_struct *p)
  55 {
  56         RPC_HDR_RESP hdr_resp;
  57         uint32 ss_padding_len = 0;
  58         uint32 data_space_available;
  59         uint32 data_len_left;
  60         uint32 data_len;
  61         prs_struct outgoing_pdu;
  62         NTSTATUS status;
  63         DATA_BLOB auth_blob;
  64         RPC_HDR_AUTH auth_info;
  65         uint8 auth_type, auth_level;
  66         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
  67
  68         /*
  69          * If we're in the fault state, keep returning fault PDU's until
  70          * the pipe gets closed. JRA.
  71          */
  72
  73         if(p->fault_state) {
  74                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
  75                 return True;
  76         }
  77
  78         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  79
  80         /* Change the incoming request header to a response. */
  81         p->hdr.pkt_type = RPC_RESPONSE;
  82
  83         /* Set up rpc header flags. */
  84         if (p->out_data.data_sent_length == 0) {
  85                 p->hdr.flags = RPC_FLG_FIRST;
  86         } else {
  87                 p->hdr.flags = 0;
  88         }
  89
  90         /*
  91          * Work out how much we can fit in a single PDU.
  92          */
  93
  94         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
  95
  96         /*
  97          * Ensure there really is data left to send.
  98          */
  99
 100         if(!data_len_left) {
 101                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 102                 return False;
 103         }
 104
 105         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 106                                         RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 107
 108         /*
 109          * The amount we send is the minimum of the available
 110          * space and the amount left to send.
 111          */
 112
 113         data_len = MIN(data_len_left, data_space_available);
 114
 115         /*
 116          * Set up the alloc hint. This should be the data left to
 117          * send.
 118          */
 119
 120         hdr_resp.alloc_hint = data_len_left;
 121
 122         /*
 123          * Work out if this PDU will be the last.
 124          */
 125
 126         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 127                 p->hdr.flags |= RPC_FLG_LAST;
 128                 if (data_len_left % 8) {
 129                         ss_padding_len = 8 - (data_len_left % 8);
 130                         DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 131                                 ss_padding_len ));
 132                 }
 133         }
 134
 135         /*
 136          * Set up the header lengths.
 137          */
 138
 139         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 140                         data_len + ss_padding_len +
 141                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 142         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 143
 144
 145         /*
 146          * Init the parse struct to point at the outgoing
 147          * data.
 148          */
 149
 150         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 151         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 152
 153         /* Store the header in the data stream. */
 154         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 155                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 156                 prs_mem_free(&outgoing_pdu);
 157                 return False;
 158         }
 159
 160         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 161                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 162                 prs_mem_free(&outgoing_pdu);
 163                 return False;
 164         }
 165
 166         /* Copy the data into the PDU. */
 167
 168         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 169                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 170                 prs_mem_free(&outgoing_pdu);
 171                 return False;
 172         }
 173
 174         /* Copy the sign/seal padding data. */
 175         if (ss_padding_len) {
 176                 char pad[8];
 177
 178                 memset(pad, '\0', 8);
 179                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 180                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 181                                         (unsigned int)ss_padding_len));
 182                         prs_mem_free(&outgoing_pdu);
 183                         return False;
 184                 }
 185         }
 186
 187
 188         /* Now write out the auth header and null blob. */
 189         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 190                 auth_type = RPC_NTLMSSP_AUTH_TYPE;
 191         } else {
 192                 auth_type = RPC_SPNEGO_AUTH_TYPE;
 193         }
 194         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 195                 auth_level = RPC_AUTH_LEVEL_PRIVACY;
 196         } else {
 197                 auth_level = RPC_AUTH_LEVEL_INTEGRITY;
 198         }
 199
 200         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 201         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 202                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 203                 prs_mem_free(&outgoing_pdu);
 204                 return False;
 205         }
 206
 207         /* Generate the sign blob. */
 208
 209         switch (p->auth.auth_level) {
 210                 case PIPE_AUTH_LEVEL_PRIVACY:
 211                         /* Data portion is encrypted. */
 212                         status = ntlmssp_seal_packet(a->ntlmssp_state,
 213                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 214                                                         data_len + ss_padding_len,
 215                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 216                                                         (size_t)prs_offset(&outgoing_pdu),
 217                                                         &auth_blob);
 218                         if (!NT_STATUS_IS_OK(status)) {
 219                                 data_blob_free(&auth_blob);
 220                                 prs_mem_free(&outgoing_pdu);
 221                                 return False;
 222                         }
 223                         break;
 224                 case PIPE_AUTH_LEVEL_INTEGRITY:
 225                         /* Data is signed. */
 226                         status = ntlmssp_sign_packet(a->ntlmssp_state,
 227                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 228                                                         data_len + ss_padding_len,
 229                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 230                                                         (size_t)prs_offset(&outgoing_pdu),
 231                                                         &auth_blob);
 232                         if (!NT_STATUS_IS_OK(status)) {
 233                                 data_blob_free(&auth_blob);
 234                                 prs_mem_free(&outgoing_pdu);
 235                                 return False;
 236                         }
 237                         break;
 238                 default:
 239                         prs_mem_free(&outgoing_pdu);
 240                         return False;
 241         }
 242
 243         /* Append the auth blob. */
 244         if (!prs_copy_data_in(&outgoing_pdu, (char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
 245                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 246                                 (unsigned int)NTLMSSP_SIG_SIZE));
 247                 data_blob_free(&auth_blob);
 248                 prs_mem_free(&outgoing_pdu);
 249                 return False;
 250         }
 251
 252         data_blob_free(&auth_blob);
 253
 254         /*
 255          * Setup the counts for this PDU.
 256          */
 257
 258         p->out_data.data_sent_length += data_len;
 259         p->out_data.current_pdu_len = p->hdr.frag_len;
 260         p->out_data.current_pdu_sent = 0;
 261
 262         prs_mem_free(&outgoing_pdu);
 263         return True;
 264 }
 265
 266 /*******************************************************************
 267  Generate the next PDU to be returned from the data in p->rdata.
 268  Return an schannel authenticated fragment.
 269  ********************************************************************/
 270
 271 static BOOL create_next_pdu_schannel(pipes_struct *p)
 272 {
 273         RPC_HDR_RESP hdr_resp;
 274         uint32 ss_padding_len = 0;
 275         uint32 data_len;
 276         uint32 data_space_available;
 277         uint32 data_len_left;
 278         prs_struct outgoing_pdu;
 279         uint32 data_pos;
 280
 281         /*
 282          * If we're in the fault state, keep returning fault PDU's until
 283          * the pipe gets closed. JRA.
 284          */
 285
 286         if(p->fault_state) {
 287                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 288                 return True;
 289         }
 290
 291         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 292
 293         /* Change the incoming request header to a response. */
 294         p->hdr.pkt_type = RPC_RESPONSE;
 295
 296         /* Set up rpc header flags. */
 297         if (p->out_data.data_sent_length == 0) {
 298                 p->hdr.flags = RPC_FLG_FIRST;
 299         } else {
 300                 p->hdr.flags = 0;
 301         }
 302
 303         /*
 304          * Work out how much we can fit in a single PDU.
 305          */
 306
 307         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 308
 309         /*
 310          * Ensure there really is data left to send.
 311          */
 312
 313         if(!data_len_left) {
 314                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 315                 return False;
 316         }
 317
 318         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 319                                         RPC_HDR_AUTH_LEN - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 320
 321         /*
 322          * The amount we send is the minimum of the available
 323          * space and the amount left to send.
 324          */
 325
 326         data_len = MIN(data_len_left, data_space_available);
 327
 328         /*
 329          * Set up the alloc hint. This should be the data left to
 330          * send.
 331          */
 332
 333         hdr_resp.alloc_hint = data_len_left;
 334
 335         /*
 336          * Work out if this PDU will be the last.
 337          */
 338
 339         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 340                 p->hdr.flags |= RPC_FLG_LAST;
 341                 if (data_len_left % 8) {
 342                         ss_padding_len = 8 - (data_len_left % 8);
 343                         DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 344                                 ss_padding_len ));
 345                 }
 346         }
 347
 348         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 349                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 350         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 351
 352         /*
 353          * Init the parse struct to point at the outgoing
 354          * data.
 355          */
 356
 357         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 358         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 359
 360         /* Store the header in the data stream. */
 361         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 362                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 363                 prs_mem_free(&outgoing_pdu);
 364                 return False;
 365         }
 366
 367         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 368                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 369                 prs_mem_free(&outgoing_pdu);
 370                 return False;
 371         }
 372
 373         /* Store the current offset. */
 374         data_pos = prs_offset(&outgoing_pdu);
 375
 376         /* Copy the data into the PDU. */
 377
 378         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 379                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 380                 prs_mem_free(&outgoing_pdu);
 381                 return False;
 382         }
 383
 384         /* Copy the sign/seal padding data. */
 385         if (ss_padding_len) {
 386                 char pad[8];
 387                 memset(pad, '\0', 8);
 388                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 389                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 390                         prs_mem_free(&outgoing_pdu);
 391                         return False;
 392                 }
 393         }
 394
 395         {
 396                 /*
 397                  * Schannel processing.
 398                  */
 399                 char *data;
 400                 RPC_HDR_AUTH auth_info;
 401                 RPC_AUTH_SCHANNEL_CHK verf;
 402
 403                 data = prs_data_p(&outgoing_pdu) + data_pos;
 404                 /* Check it's the type of reply we were expecting to decode */
 405
 406                 init_rpc_hdr_auth(&auth_info,
 407                                 RPC_SCHANNEL_AUTH_TYPE,
 408                                 p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY ?
 409                                         RPC_AUTH_LEVEL_PRIVACY : RPC_AUTH_LEVEL_INTEGRITY,
 410                                 ss_padding_len, 1);
 411
 412                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 413                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 414                         prs_mem_free(&outgoing_pdu);
 415                         return False;
 416                 }
 417
 418                 schannel_encode(p->auth.a_u.schannel_auth,
 419                               p->auth.auth_level,
 420                               SENDER_IS_ACCEPTOR,
 421                               &verf, data, data_len + ss_padding_len);
 422
 423                 if (!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 424                                 &verf, &outgoing_pdu, 0)) {
 425                         prs_mem_free(&outgoing_pdu);
 426                         return False;
 427                 }
 428
 429                 p->auth.a_u.schannel_auth->seq_num++;
 430         }
 431
 432         /*
 433          * Setup the counts for this PDU.
 434          */
 435
 436         p->out_data.data_sent_length += data_len;
 437         p->out_data.current_pdu_len = p->hdr.frag_len;
 438         p->out_data.current_pdu_sent = 0;
 439
 440         prs_mem_free(&outgoing_pdu);
 441         return True;
 442 }
 443
 444 /*******************************************************************
 445  Generate the next PDU to be returned from the data in p->rdata.
 446  No authentication done.
 447 ********************************************************************/
 448
 449 static BOOL create_next_pdu_noauth(pipes_struct *p)
 450 {
 451         RPC_HDR_RESP hdr_resp;
 452         uint32 data_len;
 453         uint32 data_space_available;
 454         uint32 data_len_left;
 455         prs_struct outgoing_pdu;
 456
 457         /*
 458          * If we're in the fault state, keep returning fault PDU's until
 459          * the pipe gets closed. JRA.
 460          */
 461
 462         if(p->fault_state) {
 463                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 464                 return True;
 465         }
 466
 467         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 468
 469         /* Change the incoming request header to a response. */
 470         p->hdr.pkt_type = RPC_RESPONSE;
 471
 472         /* Set up rpc header flags. */
 473         if (p->out_data.data_sent_length == 0) {
 474                 p->hdr.flags = RPC_FLG_FIRST;
 475         } else {
 476                 p->hdr.flags = 0;
 477         }
 478
 479         /*
 480          * Work out how much we can fit in a single PDU.
 481          */
 482
 483         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 484
 485         /*
 486          * Ensure there really is data left to send.
 487          */
 488
 489         if(!data_len_left) {
 490                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 491                 return False;
 492         }
 493
 494         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 495
 496         /*
 497          * The amount we send is the minimum of the available
 498          * space and the amount left to send.
 499          */
 500
 501         data_len = MIN(data_len_left, data_space_available);
 502
 503         /*
 504          * Set up the alloc hint. This should be the data left to
 505          * send.
 506          */
 507
 508         hdr_resp.alloc_hint = data_len_left;
 509
 510         /*
 511          * Work out if this PDU will be the last.
 512          */
 513
 514         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 515                 p->hdr.flags |= RPC_FLG_LAST;
 516         }
 517
 518         /*
 519          * Set up the header lengths.
 520          */
 521
 522         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 523         p->hdr.auth_len = 0;
 524
 525         /*
 526          * Init the parse struct to point at the outgoing
 527          * data.
 528          */
 529
 530         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 531         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 532
 533         /* Store the header in the data stream. */
 534         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 535                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 536                 prs_mem_free(&outgoing_pdu);
 537                 return False;
 538         }
 539
 540         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 541                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 542                 prs_mem_free(&outgoing_pdu);
 543                 return False;
 544         }
 545
 546         /* Copy the data into the PDU. */
 547
 548         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 549                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 550                 prs_mem_free(&outgoing_pdu);
 551                 return False;
 552         }
 553
 554         /*
 555          * Setup the counts for this PDU.
 556          */
 557
 558         p->out_data.data_sent_length += data_len;
 559         p->out_data.current_pdu_len = p->hdr.frag_len;
 560         p->out_data.current_pdu_sent = 0;
 561
 562         prs_mem_free(&outgoing_pdu);
 563         return True;
 564 }
 565
 566 /*******************************************************************
 567  Generate the next PDU to be returned from the data in p->rdata.
 568 ********************************************************************/
 569
 570 BOOL create_next_pdu(pipes_struct *p)
 571 {
 572         switch(p->auth.auth_level) {
 573                 case PIPE_AUTH_LEVEL_NONE:
 574                 case PIPE_AUTH_LEVEL_CONNECT:
 575                         /* This is incorrect for auth level connect. Fixme. JRA */
 576                         return create_next_pdu_noauth(p);
 577
 578                 default:
 579                         switch(p->auth.auth_type) {
 580                                 case PIPE_AUTH_TYPE_NTLMSSP:
 581                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 582                                         return create_next_pdu_ntlmssp(p);
 583                                 case PIPE_AUTH_TYPE_SCHANNEL:
 584                                         return create_next_pdu_schannel(p);
 585                                 default:
 586                                         break;
 587                         }
 588         }
 589
 590         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 591                         (unsigned int)p->auth.auth_level,
 592                         (unsigned int)p->auth.auth_type));
 593         return False;
 594 }
 595
 596 /*******************************************************************
 597  Process an NTLMSSP authentication response.
 598  If this function succeeds, the user has been authenticated
 599  and their domain, name and calling workstation stored in
 600  the pipe struct.
 601 *******************************************************************/
 602
 603 static BOOL pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 604 {
 605         DATA_BLOB reply;
 606         NTSTATUS status;
 607         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
 608
 609         DEBUG(5,("pipe_ntlmssp_verify_final: checking user details\n"));
 610
 611         ZERO_STRUCT(reply);
 612
 613         memset(p->user_name, '\0', sizeof(p->user_name));
 614         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 615         memset(p->domain, '\0', sizeof(p->domain));
 616         memset(p->wks, '\0', sizeof(p->wks));
 617
 618         /* Set up for non-authenticated user. */
 619         TALLOC_FREE(p->pipe_user.nt_user_token);
 620         p->pipe_user.ut.ngroups = 0;
 621         SAFE_FREE( p->pipe_user.ut.groups);
 622
 623         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 624
 625         /* Don't generate a reply. */
 626         data_blob_free(&reply);
 627
 628         if (!NT_STATUS_IS_OK(status)) {
 629                 return False;
 630         }
 631
 632         fstrcpy(p->user_name, a->ntlmssp_state->user);
 633         fstrcpy(p->pipe_user_name, a->server_info->unix_name);
 634         fstrcpy(p->domain, a->ntlmssp_state->domain);
 635         fstrcpy(p->wks, a->ntlmssp_state->workstation);
 636
 637         DEBUG(5,("pipe_ntlmssp_verify_final: OK: user: %s domain: %s workstation: %s\n",
 638                 p->user_name, p->domain, p->wks));
 639
 640         /*
 641          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 642          */
 643
 644         p->pipe_user.ut.uid = a->server_info->uid;
 645         p->pipe_user.ut.gid = a->server_info->gid;
 646
 647         /*
 648          * Copy the session key from the ntlmssp state.
 649          */
 650
 651         data_blob_free(&p->session_key);
 652         p->session_key = data_blob(a->ntlmssp_state->session_key.data, a->ntlmssp_state->session_key.length);
 653         if (!p->session_key.data) {
 654                 return False;
 655         }
 656
 657         p->pipe_user.ut.ngroups = a->server_info->n_groups;
 658         if (p->pipe_user.ut.ngroups) {
 659                 if (!(p->pipe_user.ut.groups = memdup(a->server_info->groups,
 660                                                 sizeof(gid_t) * p->pipe_user.ut.ngroups))) {
 661                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 662                         return False;
 663                 }
 664         }
 665
 666         if (a->server_info->ptok) {
 667                 p->pipe_user.nt_user_token =
 668                         dup_nt_token(NULL, a->server_info->ptok);
 669         } else {
 670                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 671                 p->pipe_user.nt_user_token = NULL;
 672                 return False;
 673         }
 674
 675         return True;
 676 }
 677
 678 /*******************************************************************
 679  The switch table for the pipe names and the functions to handle them.
 680 *******************************************************************/
 681
 682 struct rpc_table {
 683         struct {
 684                 const char *clnt;
 685                 const char *srv;
 686         } pipe;
 687         struct api_struct *cmds;
 688         int n_cmds;
 689 };
 690
 691 static struct rpc_table *rpc_lookup;
 692 static int rpc_lookup_size;
 693
 694 /*******************************************************************
 695  This is the "stage3" NTLMSSP response after a bind request and reply.
 696 *******************************************************************/
 697
 698 BOOL api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 699 {
 700         RPC_HDR_AUTH auth_info;
 701         uint32 pad;
 702         DATA_BLOB blob;
 703
 704         ZERO_STRUCT(blob);
 705
 706         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 707
 708         if (p->hdr.auth_len == 0) {
 709                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 710                 goto err;
 711         }
 712
 713         /* 4 bytes padding. */
 714         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 715                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 716                 goto err;
 717         }
 718
 719         /*
 720          * Decode the authentication verifier response.
 721          */
 722
 723         if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 724                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
 725                 goto err;
 726         }
 727
 728         if (auth_info.auth_type != RPC_NTLMSSP_AUTH_TYPE) {
 729                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 730                         (unsigned int)auth_info.auth_type ));
 731                 return False;
 732         }
 733
 734         blob = data_blob(NULL,p->hdr.auth_len);
 735
 736         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 737                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 738                         (unsigned int)p->hdr.auth_len ));
 739                 goto err;
 740         }
 741
 742         /*
 743          * The following call actually checks the challenge/response data.
 744          * for correctness against the given DOMAIN\user name.
 745          */
 746
 747         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 748                 goto err;
 749         }
 750
 751         data_blob_free(&blob);
 752
 753         p->pipe_bound = True;
 754
 755         return True;
 756
 757  err:
 758
 759         data_blob_free(&blob);
 760         free_pipe_ntlmssp_auth_data(&p->auth);
 761         p->auth.a_u.auth_ntlmssp_state = NULL;
 762
 763         return False;
 764 }
 765
 766 /*******************************************************************
 767  Marshall a bind_nak pdu.
 768 *******************************************************************/
 769
 770 static BOOL setup_bind_nak(pipes_struct *p)
 771 {
 772         prs_struct outgoing_rpc;
 773         RPC_HDR nak_hdr;
 774         uint16 zero = 0;
 775
 776         /* Free any memory in the current return data buffer. */
 777         prs_mem_free(&p->out_data.rdata);
 778
 779         /*
 780          * Marshall directly into the outgoing PDU space. We
 781          * must do this as we need to set to the bind response
 782          * header and are never sending more than one PDU here.
 783          */
 784
 785         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 786         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 787
 788         /*
 789          * Initialize a bind_nak header.
 790          */
 791
 792         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 793                 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 794
 795         /*
 796          * Marshall the header into the outgoing PDU.
 797          */
 798
 799         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 800                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 801                 prs_mem_free(&outgoing_rpc);
 802                 return False;
 803         }
 804
 805         /*
 806          * Now add the reject reason.
 807          */
 808
 809         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 810                 prs_mem_free(&outgoing_rpc);
 811                 return False;
 812         }
 813
 814         p->out_data.data_sent_length = 0;
 815         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 816         p->out_data.current_pdu_sent = 0;
 817
 818         if (p->auth.auth_data_free_func) {
 819                 (*p->auth.auth_data_free_func)(&p->auth);
 820         }
 821         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
 822         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 823         p->pipe_bound = False;
 824
 825         return True;
 826 }
 827
 828 /*******************************************************************
 829  Marshall a fault pdu.
 830 *******************************************************************/
 831
 832 BOOL setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 833 {
 834         prs_struct outgoing_pdu;
 835         RPC_HDR fault_hdr;
 836         RPC_HDR_RESP hdr_resp;
 837         RPC_HDR_FAULT fault_resp;
 838
 839         /* Free any memory in the current return data buffer. */
 840         prs_mem_free(&p->out_data.rdata);
 841
 842         /*
 843          * Marshall directly into the outgoing PDU space. We
 844          * must do this as we need to set to the bind response
 845          * header and are never sending more than one PDU here.
 846          */
 847
 848         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 849         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 850
 851         /*
 852          * Initialize a fault header.
 853          */
 854
 855         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 856             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 857
 858         /*
 859          * Initialize the HDR_RESP and FAULT parts of the PDU.
 860          */
 861
 862         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 863
 864         fault_resp.status = status;
 865         fault_resp.reserved = 0;
 866
 867         /*
 868          * Marshall the header into the outgoing PDU.
 869          */
 870
 871         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 872                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 873                 prs_mem_free(&outgoing_pdu);
 874                 return False;
 875         }
 876
 877         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 878                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 879                 prs_mem_free(&outgoing_pdu);
 880                 return False;
 881         }
 882
 883         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 884                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 885                 prs_mem_free(&outgoing_pdu);
 886                 return False;
 887         }
 888
 889         p->out_data.data_sent_length = 0;
 890         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 891         p->out_data.current_pdu_sent = 0;
 892
 893         prs_mem_free(&outgoing_pdu);
 894         return True;
 895 }
 896
 897 #if 0
 898 /*******************************************************************
 899  Marshall a cancel_ack pdu.
 900  We should probably check the auth-verifier here.
 901 *******************************************************************/
 902
 903 BOOL setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
 904 {
 905         prs_struct outgoing_pdu;
 906         RPC_HDR ack_reply_hdr;
 907
 908         /* Free any memory in the current return data buffer. */
 909         prs_mem_free(&p->out_data.rdata);
 910
 911         /*
 912          * Marshall directly into the outgoing PDU space. We
 913          * must do this as we need to set to the bind response
 914          * header and are never sending more than one PDU here.
 915          */
 916
 917         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 918         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 919
 920         /*
 921          * Initialize a cancel_ack header.
 922          */
 923
 924         init_rpc_hdr(&ack_reply_hdr, RPC_CANCEL_ACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 925                         p->hdr.call_id, RPC_HEADER_LEN, 0);
 926
 927         /*
 928          * Marshall the header into the outgoing PDU.
 929          */
 930
 931         if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
 932                 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
 933                 prs_mem_free(&outgoing_pdu);
 934                 return False;
 935         }
 936
 937         p->out_data.data_sent_length = 0;
 938         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 939         p->out_data.current_pdu_sent = 0;
 940
 941         prs_mem_free(&outgoing_pdu);
 942         return True;
 943 }
 944 #endif
 945
 946 /*******************************************************************
 947  Ensure a bind request has the correct abstract & transfer interface.
 948  Used to reject unknown binds from Win2k.
 949 *******************************************************************/
 950
 951 BOOL check_bind_req(struct pipes_struct *p, RPC_IFACE* abstract,
 952                     RPC_IFACE* transfer, uint32 context_id)
 953 {
 954         char *pipe_name = p->name;
 955         int i=0;
 956         fstring pname;
 957
 958         fstrcpy(pname,"\\PIPE\\");
 959         fstrcat(pname,pipe_name);
 960
 961         DEBUG(3,("check_bind_req for %s\n", pname));
 962
 963         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 964
 965         for ( i=0; pipe_names[i].client_pipe; i++ ) {
 966                 DEBUG(10,("checking %s\n", pipe_names[i].client_pipe));
 967                 if ( strequal(pipe_names[i].client_pipe, pname)
 968                         && (abstract->version == pipe_names[i].abstr_syntax.version)
 969                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(struct uuid)) == 0)
 970                         && (transfer->version == pipe_names[i].trans_syntax.version)
 971                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(struct uuid)) == 0) ) {
 972                         struct api_struct       *fns = NULL;
 973                         int                     n_fns = 0;
 974                         PIPE_RPC_FNS            *context_fns;
 975
 976                         if ( !(context_fns = SMB_MALLOC_P(PIPE_RPC_FNS)) ) {
 977                                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 978                                 return False;
 979                         }
 980
 981                         /* save the RPC function table associated with this bind */
 982
 983                         get_pipe_fns(i, &fns, &n_fns);
 984
 985                         context_fns->cmds = fns;
 986                         context_fns->n_cmds = n_fns;
 987                         context_fns->context_id = context_id;
 988
 989                         /* add to the list of open contexts */
 990
 991                         DLIST_ADD( p->contexts, context_fns );
 992
 993                         break;
 994                 }
 995         }
 996
 997         if(pipe_names[i].client_pipe == NULL) {
 998                 return False;
 999         }
1000
1001         return True;
1002 }
1003
1004 /*******************************************************************
1005  Register commands to an RPC pipe
1006 *******************************************************************/
1007
1008 NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *srv, const struct api_struct *cmds, int size)
1009 {
1010         struct rpc_table *rpc_entry;
1011
1012         if (!clnt || !srv || !cmds) {
1013                 return NT_STATUS_INVALID_PARAMETER;
1014         }
1015
1016         if (version != SMB_RPC_INTERFACE_VERSION) {
1017                 DEBUG(0,("Can't register rpc commands!\n"
1018                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1019                          ", while this version of samba uses version %d!\n",
1020                          version,SMB_RPC_INTERFACE_VERSION));
1021                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1022         }
1023
1024         /* TODO:
1025          *
1026          * we still need to make sure that don't register the same commands twice!!!
1027          *
1028          * --metze
1029          */
1030
1031         /* We use a temporary variable because this call can fail and
1032            rpc_lookup will still be valid afterwards.  It could then succeed if
1033            called again later */
1034         rpc_lookup_size++;
1035         rpc_entry = SMB_REALLOC_ARRAY(rpc_lookup, struct rpc_table, rpc_lookup_size);
1036         if (NULL == rpc_entry) {
1037                 rpc_lookup_size--;
1038                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1039                 return NT_STATUS_NO_MEMORY;
1040         } else {
1041                 rpc_lookup = rpc_entry;
1042         }
1043
1044         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1045         ZERO_STRUCTP(rpc_entry);
1046         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1047         rpc_entry->pipe.srv = SMB_STRDUP(srv);
1048         rpc_entry->cmds = SMB_REALLOC_ARRAY(rpc_entry->cmds, struct api_struct, rpc_entry->n_cmds + size);
1049         memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds, size * sizeof(struct api_struct));
1050         rpc_entry->n_cmds += size;
1051
1052         return NT_STATUS_OK;
1053 }
1054
1055 /*******************************************************************
1056  Handle a SPNEGO krb5 bind auth.
1057 *******************************************************************/
1058
1059 static BOOL pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1060                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1061 {
1062         return False;
1063 }
1064
1065 /*******************************************************************
1066  Handle the first part of a SPNEGO bind auth.
1067 *******************************************************************/
1068
1069 static BOOL pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1070                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1071 {
1072         DATA_BLOB blob;
1073         DATA_BLOB secblob;
1074         DATA_BLOB response;
1075         DATA_BLOB chal;
1076         char *OIDs[ASN1_MAX_OIDS];
1077         int i;
1078         NTSTATUS status;
1079         BOOL got_kerberos_mechanism = False;
1080         AUTH_NTLMSSP_STATE *a = NULL;
1081         RPC_HDR_AUTH auth_info;
1082
1083         ZERO_STRUCT(secblob);
1084         ZERO_STRUCT(chal);
1085         ZERO_STRUCT(response);
1086
1087         /* Grab the SPNEGO blob. */
1088         blob = data_blob(NULL,p->hdr.auth_len);
1089
1090         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1091                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1092                         (unsigned int)p->hdr.auth_len ));
1093                 goto err;
1094         }
1095
1096         if (blob.data[0] != ASN1_APPLICATION(0)) {
1097                 goto err;
1098         }
1099
1100         /* parse out the OIDs and the first sec blob */
1101         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1102                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1103                 goto err;
1104         }
1105
1106         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1107                 got_kerberos_mechanism = True;
1108         }
1109
1110         for (i=0;OIDs[i];i++) {
1111                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1112                 SAFE_FREE(OIDs[i]);
1113         }
1114         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1115
1116         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || lp_use_kerberos_keytab()) ) {
1117                 BOOL ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1118                 data_blob_free(&secblob);
1119                 data_blob_free(&blob);
1120                 return ret;
1121         }
1122
1123         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1124                 /* Free any previous auth type. */
1125                 free_pipe_ntlmssp_auth_data(&p->auth);
1126         }
1127
1128         /* Initialize the NTLM engine. */
1129         status = auth_ntlmssp_start(&a);
1130         if (!NT_STATUS_IS_OK(status)) {
1131                 goto err;
1132         }
1133
1134         /*
1135          * Pass the first security blob of data to it.
1136          * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1137          * which means we need another packet to complete the bind.
1138          */
1139
1140         status = auth_ntlmssp_update(a, secblob, &chal);
1141
1142         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1143                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1144                 goto err;
1145         }
1146
1147         /* Generate the response blob we need for step 2 of the bind. */
1148         response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1149
1150         /* Copy the blob into the pout_auth parse struct */
1151         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1152         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1153                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1154                 goto err;
1155         }
1156
1157         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1158                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1159                 goto err;
1160         }
1161
1162         p->auth.a_u.auth_ntlmssp_state = a;
1163         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1164         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1165
1166         data_blob_free(&blob);
1167         data_blob_free(&secblob);
1168         data_blob_free(&chal);
1169         data_blob_free(&response);
1170
1171         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1172         return True;
1173
1174  err:
1175
1176         data_blob_free(&blob);
1177         data_blob_free(&secblob);
1178         data_blob_free(&chal);
1179         data_blob_free(&response);
1180
1181         p->auth.a_u.auth_ntlmssp_state = NULL;
1182
1183         return False;
1184 }
1185
1186 /*******************************************************************
1187  Handle the second part of a SPNEGO bind auth.
1188 *******************************************************************/
1189
1190 static BOOL pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1191                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1192 {
1193         RPC_HDR_AUTH auth_info;
1194         DATA_BLOB spnego_blob;
1195         DATA_BLOB auth_blob;
1196         DATA_BLOB auth_reply;
1197         DATA_BLOB response;
1198         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1199
1200         ZERO_STRUCT(spnego_blob);
1201         ZERO_STRUCT(auth_blob);
1202         ZERO_STRUCT(auth_reply);
1203         ZERO_STRUCT(response);
1204
1205         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1206                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1207                 goto err;
1208         }
1209
1210         /* Grab the SPNEGO blob. */
1211         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1212
1213         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1214                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1215                         (unsigned int)p->hdr.auth_len ));
1216                 goto err;
1217         }
1218
1219         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1220                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1221                 goto err;
1222         }
1223
1224         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1225                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1226                 goto err;
1227         }
1228
1229         /*
1230          * The following call actually checks the challenge/response data.
1231          * for correctness against the given DOMAIN\user name.
1232          */
1233
1234         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1235                 goto err;
1236         }
1237
1238         data_blob_free(&spnego_blob);
1239         data_blob_free(&auth_blob);
1240
1241         /* Generate the spnego "accept completed" blob - no incoming data. */
1242         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1243
1244         /* Copy the blob into the pout_auth parse struct */
1245         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1246         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1247                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1248                 goto err;
1249         }
1250
1251         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1252                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1253                 goto err;
1254         }
1255
1256         data_blob_free(&auth_reply);
1257         data_blob_free(&response);
1258
1259         p->pipe_bound = True;
1260
1261         return True;
1262
1263  err:
1264
1265         data_blob_free(&spnego_blob);
1266         data_blob_free(&auth_blob);
1267         data_blob_free(&auth_reply);
1268         data_blob_free(&response);
1269
1270         free_pipe_ntlmssp_auth_data(&p->auth);
1271         p->auth.a_u.auth_ntlmssp_state = NULL;
1272
1273         return False;
1274 }
1275
1276 /*******************************************************************
1277  Handle an schannel bind auth.
1278 *******************************************************************/
1279
1280 static BOOL pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1281                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1282 {
1283         RPC_HDR_AUTH auth_info;
1284         RPC_AUTH_SCHANNEL_NEG neg;
1285         RPC_AUTH_VERIFIER auth_verifier;
1286         BOOL ret;
1287         struct dcinfo *pdcinfo;
1288         uint32 flags;
1289
1290         if (!smb_io_rpc_auth_schannel_neg("", &neg, rpc_in_p, 0)) {
1291                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1292                 return False;
1293         }
1294
1295         /*
1296          * The neg.myname key here must match the remote computer name
1297          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1298          * operations that use credentials.
1299          */
1300
1301         become_root();
1302         ret = secrets_restore_schannel_session_info(p->mem_ctx, neg.myname, &pdcinfo);
1303         unbecome_root();
1304
1305         if (!ret) {
1306                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1307                 return False;
1308         }
1309
1310         p->auth.a_u.schannel_auth = TALLOC_P(p->pipe_state_mem_ctx, struct schannel_auth_struct);
1311         if (!p->auth.a_u.schannel_auth) {
1312                 TALLOC_FREE(pdcinfo);
1313                 return False;
1314         }
1315
1316         memset(p->auth.a_u.schannel_auth->sess_key, 0, sizeof(p->auth.a_u.schannel_auth->sess_key));
1317         memcpy(p->auth.a_u.schannel_auth->sess_key, pdcinfo->sess_key,
1318                         sizeof(pdcinfo->sess_key));
1319
1320         TALLOC_FREE(pdcinfo);
1321
1322         p->auth.a_u.schannel_auth->seq_num = 0;
1323
1324         /*
1325          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1326          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1327          * struct of the person who opened the pipe. I need to test this further. JRA.
1328          */
1329
1330         init_rpc_hdr_auth(&auth_info, RPC_SCHANNEL_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1331         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1332                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1333                 return False;
1334         }
1335
1336         /*** SCHANNEL verifier ***/
1337
1338         init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1339         if(!smb_io_rpc_schannel_verifier("", &auth_verifier, pout_auth, 0)) {
1340                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1341                 return False;
1342         }
1343
1344         prs_align(pout_auth);
1345
1346         flags = 5;
1347         if(!prs_uint32("flags ", pout_auth, 0, &flags)) {
1348                 return False;
1349         }
1350
1351         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1352                 neg.domain, neg.myname));
1353
1354         /* We're finished with this bind - no more packets. */
1355         p->auth.auth_data_free_func = NULL;
1356         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1357
1358         p->pipe_bound = True;
1359
1360         return True;
1361 }
1362
1363 /*******************************************************************
1364  Handle an NTLMSSP bind auth.
1365 *******************************************************************/
1366
1367 static BOOL pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1368                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1369 {
1370         RPC_HDR_AUTH auth_info;
1371         DATA_BLOB blob;
1372         DATA_BLOB response;
1373         NTSTATUS status;
1374         AUTH_NTLMSSP_STATE *a = NULL;
1375
1376         ZERO_STRUCT(blob);
1377         ZERO_STRUCT(response);
1378
1379         /* Grab the NTLMSSP blob. */
1380         blob = data_blob(NULL,p->hdr.auth_len);
1381
1382         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1383                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1384                         (unsigned int)p->hdr.auth_len ));
1385                 goto err;
1386         }
1387
1388         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1389                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1390                 goto err;
1391         }
1392
1393         /* We have an NTLMSSP blob. */
1394         status = auth_ntlmssp_start(&a);
1395         if (!NT_STATUS_IS_OK(status)) {
1396                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1397                         nt_errstr(status) ));
1398                 goto err;
1399         }
1400
1401         status = auth_ntlmssp_update(a, blob, &response);
1402         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1403                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1404                         nt_errstr(status) ));
1405                 goto err;
1406         }
1407
1408         data_blob_free(&blob);
1409
1410         /* Copy the blob into the pout_auth parse struct */
1411         init_rpc_hdr_auth(&auth_info, RPC_NTLMSSP_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1412         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1413                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1414                 goto err;
1415         }
1416
1417         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1418                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1419                 goto err;
1420         }
1421
1422         p->auth.a_u.auth_ntlmssp_state = a;
1423         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1424         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1425
1426         data_blob_free(&blob);
1427         data_blob_free(&response);
1428
1429         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1430
1431         /* We can't set pipe_bound True yet - we need an RPC_AUTH3 response packet... */
1432         return True;
1433
1434   err:
1435
1436         data_blob_free(&blob);
1437         data_blob_free(&response);
1438
1439         free_pipe_ntlmssp_auth_data(&p->auth);
1440         p->auth.a_u.auth_ntlmssp_state = NULL;
1441         return False;
1442 }
1443
1444 /*******************************************************************
1445  Respond to a pipe bind request.
1446 *******************************************************************/
1447
1448 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1449 {
1450         RPC_HDR_BA hdr_ba;
1451         RPC_HDR_RB hdr_rb;
1452         RPC_HDR_AUTH auth_info;
1453         uint16 assoc_gid;
1454         fstring ack_pipe_name;
1455         prs_struct out_hdr_ba;
1456         prs_struct out_auth;
1457         prs_struct outgoing_rpc;
1458         int i = 0;
1459         int auth_len = 0;
1460         unsigned int auth_type = RPC_ANONYMOUS_AUTH_TYPE;
1461
1462         /* No rebinds on a bound pipe - use alter context. */
1463         if (p->pipe_bound) {
1464                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound pipe %s.\n", p->pipe_srv_name));
1465                 return setup_bind_nak(p);
1466         }
1467
1468         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
1469
1470         /*
1471          * Marshall directly into the outgoing PDU space. We
1472          * must do this as we need to set to the bind response
1473          * header and are never sending more than one PDU here.
1474          */
1475
1476         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1477
1478         /*
1479          * Setup the memory to marshall the ba header, and the
1480          * auth footers.
1481          */
1482
1483         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1484                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1485                 prs_mem_free(&outgoing_rpc);
1486                 return False;
1487         }
1488
1489         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1490                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1491                 prs_mem_free(&outgoing_rpc);
1492                 prs_mem_free(&out_hdr_ba);
1493                 return False;
1494         }
1495
1496         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1497
1498         /*
1499          * Try and find the correct pipe name to ensure
1500          * that this is a pipe name we support.
1501          */
1502
1503
1504         for (i = 0; i < rpc_lookup_size; i++) {
1505                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1506                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1507                                 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1508                         fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1509                         break;
1510                 }
1511         }
1512
1513         if (i == rpc_lookup_size) {
1514                 if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) {
1515                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1516                                 p->name ));
1517                         prs_mem_free(&outgoing_rpc);
1518                         prs_mem_free(&out_hdr_ba);
1519                         prs_mem_free(&out_auth);
1520
1521                         return setup_bind_nak(p);
1522                 }
1523
1524                 for (i = 0; i < rpc_lookup_size; i++) {
1525                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1526                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1527                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1528                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1529                                break;
1530                        }
1531                 }
1532
1533                 if (i == rpc_lookup_size) {
1534                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
1535                         goto err_exit;
1536                 }
1537         }
1538
1539         /* decode the bind request */
1540         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1541                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
1542                 goto err_exit;
1543         }
1544
1545         /* name has to be \PIPE\xxxxx */
1546         fstrcpy(ack_pipe_name, "\\PIPE\\");
1547         fstrcat(ack_pipe_name, p->pipe_srv_name);
1548
1549         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1550
1551         /*
1552          * Check if this is an authenticated bind request.
1553          */
1554
1555         if (p->hdr.auth_len) {
1556                 /*
1557                  * Decode the authentication verifier.
1558                  */
1559
1560                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1561                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1562                         goto err_exit;
1563                 }
1564
1565                 auth_type = auth_info.auth_type;
1566
1567                 /* Work out if we have to sign or seal etc. */
1568                 switch (auth_info.auth_level) {
1569                         case RPC_AUTH_LEVEL_INTEGRITY:
1570                                 p->auth.auth_level = PIPE_AUTH_LEVEL_INTEGRITY;
1571                                 break;
1572                         case RPC_AUTH_LEVEL_PRIVACY:
1573                                 p->auth.auth_level = PIPE_AUTH_LEVEL_PRIVACY;
1574                                 break;
1575                         default:
1576                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1577                                         (unsigned int)auth_info.auth_level ));
1578                                 goto err_exit;
1579                 }
1580         } else {
1581                 ZERO_STRUCT(auth_info);
1582         }
1583
1584         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1585
1586         switch(auth_type) {
1587                 case RPC_NTLMSSP_AUTH_TYPE:
1588                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1589                                 goto err_exit;
1590                         }
1591                         assoc_gid = 0x7a77;
1592                         break;
1593
1594                 case RPC_SCHANNEL_AUTH_TYPE:
1595                         if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1596                                 goto err_exit;
1597                         }
1598                         break;
1599
1600                 case RPC_SPNEGO_AUTH_TYPE:
1601                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1602                                 goto err_exit;
1603                         }
1604                         break;
1605
1606                 case RPC_ANONYMOUS_AUTH_TYPE:
1607                         /* Unauthenticated bind request. */
1608                         /* We're finished - no more packets. */
1609                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1610                         /* We must set the pipe auth_level here also. */
1611                         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
1612                         p->pipe_bound = True;
1613                         break;
1614
1615                 default:
1616                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1617                         goto err_exit;
1618         }
1619
1620         /*
1621          * Create the bind response struct.
1622          */
1623
1624         /* If the requested abstract synt uuid doesn't match our client pipe,
1625                 reject the bind_ack & set the transfer interface synt to all 0's,
1626                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1627                 unknown to NT4)
1628                 Needed when adding entries to a DACL from NT5 - SK */
1629
1630         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1631                                 hdr_rb.rpc_context[0].context_id )) {
1632                 init_rpc_hdr_ba(&hdr_ba,
1633                         RPC_MAX_PDU_FRAG_LEN,
1634                         RPC_MAX_PDU_FRAG_LEN,
1635                         assoc_gid,
1636                         ack_pipe_name,
1637                         0x1, 0x0, 0x0,
1638                         &hdr_rb.rpc_context[0].transfer[0]);
1639         } else {
1640                 RPC_IFACE null_interface;
1641                 ZERO_STRUCT(null_interface);
1642                 /* Rejection reason: abstract syntax not supported */
1643                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1644                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1645                                         ack_pipe_name, 0x1, 0x2, 0x1,
1646                                         &null_interface);
1647                 p->pipe_bound = False;
1648         }
1649
1650         /*
1651          * and marshall it.
1652          */
1653
1654         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1655                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1656                 goto err_exit;
1657         }
1658
1659         /*
1660          * Create the header, now we know the length.
1661          */
1662
1663         if (prs_offset(&out_auth)) {
1664                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1665         }
1666
1667         init_rpc_hdr(&p->hdr, RPC_BINDACK, RPC_FLG_FIRST | RPC_FLG_LAST,
1668                         p->hdr.call_id,
1669                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1670                         auth_len);
1671
1672         /*
1673          * Marshall the header into the outgoing PDU.
1674          */
1675
1676         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1677                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1678                 goto err_exit;
1679         }
1680
1681         /*
1682          * Now add the RPC_HDR_BA and any auth needed.
1683          */
1684
1685         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1686                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1687                 goto err_exit;
1688         }
1689
1690         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1691                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1692                 goto err_exit;
1693         }
1694
1695         /*
1696          * Setup the lengths for the initial reply.
1697          */
1698
1699         p->out_data.data_sent_length = 0;
1700         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1701         p->out_data.current_pdu_sent = 0;
1702
1703         prs_mem_free(&out_hdr_ba);
1704         prs_mem_free(&out_auth);
1705
1706         return True;
1707
1708   err_exit:
1709
1710         prs_mem_free(&outgoing_rpc);
1711         prs_mem_free(&out_hdr_ba);
1712         prs_mem_free(&out_auth);
1713         return setup_bind_nak(p);
1714 }
1715
1716 /****************************************************************************
1717  Deal with an alter context call. Can be third part of 3 leg auth request for
1718  SPNEGO calls.
1719 ****************************************************************************/
1720
1721 BOOL api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1722 {
1723         RPC_HDR_BA hdr_ba;
1724         RPC_HDR_RB hdr_rb;
1725         RPC_HDR_AUTH auth_info;
1726         uint16 assoc_gid;
1727         fstring ack_pipe_name;
1728         prs_struct out_hdr_ba;
1729         prs_struct out_auth;
1730         prs_struct outgoing_rpc;
1731         int auth_len = 0;
1732
1733         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
1734
1735         /*
1736          * Marshall directly into the outgoing PDU space. We
1737          * must do this as we need to set to the bind response
1738          * header and are never sending more than one PDU here.
1739          */
1740
1741         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1742
1743         /*
1744          * Setup the memory to marshall the ba header, and the
1745          * auth footers.
1746          */
1747
1748         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1749                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1750                 prs_mem_free(&outgoing_rpc);
1751                 return False;
1752         }
1753
1754         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1755                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1756                 prs_mem_free(&outgoing_rpc);
1757                 prs_mem_free(&out_hdr_ba);
1758                 return False;
1759         }
1760
1761         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1762
1763         /* decode the alter context request */
1764         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1765                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1766                 goto err_exit;
1767         }
1768
1769         /* secondary address CAN be NULL
1770          * as the specs say it's ignored.
1771          * It MUST be NULL to have the spoolss working.
1772          */
1773         fstrcpy(ack_pipe_name,"");
1774
1775         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1776
1777         /*
1778          * Check if this is an authenticated alter context request.
1779          */
1780
1781         if (p->hdr.auth_len != 0) {
1782                 /*
1783                  * Decode the authentication verifier.
1784                  */
1785
1786                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1787                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1788                         goto err_exit;
1789                 }
1790
1791                 /*
1792                  * Currently only the SPNEGO auth type uses the alter ctx
1793                  * response in place of the NTLMSSP auth3 type.
1794                  */
1795
1796                 if (auth_info.auth_type == RPC_SPNEGO_AUTH_TYPE) {
1797                         /* We can only finish if the pipe is unbound. */
1798                         if (!p->pipe_bound) {
1799                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1800                                         goto err_exit;
1801                                 }
1802                         } else {
1803                                 goto err_exit;
1804                         }
1805                 }
1806         } else {
1807                 ZERO_STRUCT(auth_info);
1808         }
1809
1810         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1811
1812         /*
1813          * Create the bind response struct.
1814          */
1815
1816         /* If the requested abstract synt uuid doesn't match our client pipe,
1817                 reject the bind_ack & set the transfer interface synt to all 0's,
1818                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1819                 unknown to NT4)
1820                 Needed when adding entries to a DACL from NT5 - SK */
1821
1822         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1823                                 hdr_rb.rpc_context[0].context_id )) {
1824                 init_rpc_hdr_ba(&hdr_ba,
1825                         RPC_MAX_PDU_FRAG_LEN,
1826                         RPC_MAX_PDU_FRAG_LEN,
1827                         assoc_gid,
1828                         ack_pipe_name,
1829                         0x1, 0x0, 0x0,
1830                         &hdr_rb.rpc_context[0].transfer[0]);
1831         } else {
1832                 RPC_IFACE null_interface;
1833                 ZERO_STRUCT(null_interface);
1834                 /* Rejection reason: abstract syntax not supported */
1835                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1836                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1837                                         ack_pipe_name, 0x1, 0x2, 0x1,
1838                                         &null_interface);
1839                 p->pipe_bound = False;
1840         }
1841
1842         /*
1843          * and marshall it.
1844          */
1845
1846         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1847                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1848                 goto err_exit;
1849         }
1850
1851         /*
1852          * Create the header, now we know the length.
1853          */
1854
1855         if (prs_offset(&out_auth)) {
1856                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1857         }
1858
1859         init_rpc_hdr(&p->hdr, RPC_ALTCONTRESP, RPC_FLG_FIRST | RPC_FLG_LAST,
1860                         p->hdr.call_id,
1861                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1862                         auth_len);
1863
1864         /*
1865          * Marshall the header into the outgoing PDU.
1866          */
1867
1868         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1869                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
1870                 goto err_exit;
1871         }
1872
1873         /*
1874          * Now add the RPC_HDR_BA and any auth needed.
1875          */
1876
1877         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1878                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
1879                 goto err_exit;
1880         }
1881
1882         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1883                 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
1884                 goto err_exit;
1885         }
1886
1887         /*
1888          * Setup the lengths for the initial reply.
1889          */
1890
1891         p->out_data.data_sent_length = 0;
1892         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1893         p->out_data.current_pdu_sent = 0;
1894
1895         prs_mem_free(&out_hdr_ba);
1896         prs_mem_free(&out_auth);
1897
1898         return True;
1899
1900   err_exit:
1901
1902         prs_mem_free(&outgoing_rpc);
1903         prs_mem_free(&out_hdr_ba);
1904         prs_mem_free(&out_auth);
1905         return setup_bind_nak(p);
1906 }
1907
1908 /****************************************************************************
1909  Deal with NTLMSSP sign & seal processing on an RPC request.
1910 ****************************************************************************/
1911
1912 BOOL api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
1913                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
1914 {
1915         RPC_HDR_AUTH auth_info;
1916         uint32 auth_len = p->hdr.auth_len;
1917         uint32 save_offset = prs_offset(rpc_in);
1918         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1919         unsigned char *data = NULL;
1920         size_t data_len;
1921         unsigned char *full_packet_data = NULL;
1922         size_t full_packet_data_len;
1923         DATA_BLOB auth_blob;
1924
1925         *pstatus = NT_STATUS_OK;
1926
1927         if (p->auth.auth_level == PIPE_AUTH_LEVEL_NONE || p->auth.auth_level == PIPE_AUTH_LEVEL_CONNECT) {
1928                 return True;
1929         }
1930
1931         if (!a) {
1932                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1933                 return False;
1934         }
1935
1936         /* Ensure there's enough data for an authenticated request. */
1937         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
1938                         (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
1939                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
1940                         (unsigned int)auth_len ));
1941                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1942                 return False;
1943         }
1944
1945         /*
1946          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
1947          * after the RPC header.
1948          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
1949          * functions as NTLMv2 checks the rpc headers also.
1950          */
1951
1952         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
1953         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
1954
1955         full_packet_data = p->in_data.current_in_pdu;
1956         full_packet_data_len = p->hdr.frag_len - auth_len;
1957
1958         /* Pull the auth header and the following data into a blob. */
1959         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
1960                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
1961                         (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
1962                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1963                 return False;
1964         }
1965
1966         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1967                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1968                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1969                 return False;
1970         }
1971
1972         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
1973         auth_blob.length = auth_len;
1974
1975         switch (p->auth.auth_level) {
1976                 case PIPE_AUTH_LEVEL_PRIVACY:
1977                         /* Data is encrypted. */
1978                         *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
1979                                                         data, data_len,
1980                                                         full_packet_data,
1981                                                         full_packet_data_len,
1982                                                         &auth_blob);
1983                         if (!NT_STATUS_IS_OK(*pstatus)) {
1984                                 return False;
1985                         }
1986                         break;
1987                 case PIPE_AUTH_LEVEL_INTEGRITY:
1988                         /* Data is signed. */
1989                         *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
1990                                                         data, data_len,
1991                                                         full_packet_data,
1992                                                         full_packet_data_len,
1993                                                         &auth_blob);
1994                         if (!NT_STATUS_IS_OK(*pstatus)) {
1995                                 return False;
1996                         }
1997                         break;
1998                 default:
1999                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2000                         return False;
2001         }
2002
2003         /*
2004          * Return the current pointer to the data offset.
2005          */
2006
2007         if(!prs_set_offset(rpc_in, save_offset)) {
2008                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2009                         (unsigned int)save_offset ));
2010                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2011                 return False;
2012         }
2013
2014         /*
2015          * Remember the padding length. We must remove it from the real data
2016          * stream once the sign/seal is done.
2017          */
2018
2019         *p_ss_padding_len = auth_info.auth_pad_len;
2020
2021         return True;
2022 }
2023
2024 /****************************************************************************
2025  Deal with schannel processing on an RPC request.
2026 ****************************************************************************/
2027
2028 BOOL api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2029 {
2030         uint32 data_len;
2031         uint32 auth_len;
2032         uint32 save_offset = prs_offset(rpc_in);
2033         RPC_HDR_AUTH auth_info;
2034         RPC_AUTH_SCHANNEL_CHK schannel_chk;
2035
2036         auth_len = p->hdr.auth_len;
2037
2038         if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
2039                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2040                 return False;
2041         }
2042
2043         /*
2044          * The following is that length of the data we must verify or unseal.
2045          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2046          * preceeding the auth_data.
2047          */
2048
2049         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2050                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2051                         (unsigned int)p->hdr.frag_len,
2052                         (unsigned int)auth_len ));
2053                 return False;
2054         }
2055
2056         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2057                 RPC_HDR_AUTH_LEN - auth_len;
2058
2059         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2060
2061         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2062                 DEBUG(0,("cannot move offset to %u.\n",
2063                          (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2064                 return False;
2065         }
2066
2067         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2068                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2069                 return False;
2070         }
2071
2072         if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
2073                 DEBUG(0,("Invalid auth info %d on schannel\n",
2074                          auth_info.auth_type));
2075                 return False;
2076         }
2077
2078         if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN, &schannel_chk, rpc_in, 0)) {
2079                 DEBUG(0,("failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
2080                 return False;
2081         }
2082
2083         if (!schannel_decode(p->auth.a_u.schannel_auth,
2084                            p->auth.auth_level,
2085                            SENDER_IS_INITIATOR,
2086                            &schannel_chk,
2087                            prs_data_p(rpc_in)+RPC_HDR_REQ_LEN, data_len)) {
2088                 DEBUG(3,("failed to decode PDU\n"));
2089                 return False;
2090         }
2091
2092         /*
2093          * Return the current pointer to the data offset.
2094          */
2095
2096         if(!prs_set_offset(rpc_in, save_offset)) {
2097                 DEBUG(0,("failed to set offset back to %u\n",
2098                          (unsigned int)save_offset ));
2099                 return False;
2100         }
2101
2102         /* The sequence number gets incremented on both send and receive. */
2103         p->auth.a_u.schannel_auth->seq_num++;
2104
2105         /*
2106          * Remember the padding length. We must remove it from the real data
2107          * stream once the sign/seal is done.
2108          */
2109
2110         *p_ss_padding_len = auth_info.auth_pad_len;
2111
2112         return True;
2113 }
2114
2115 /****************************************************************************
2116  Return a user struct for a pipe user.
2117 ****************************************************************************/
2118
2119 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
2120 {
2121         if (p->pipe_bound &&
2122                         (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP ||
2123                         (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2124                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
2125         } else {
2126                 memcpy(user, &current_user, sizeof(struct current_user));
2127         }
2128
2129         return user;
2130 }
2131
2132 /****************************************************************************
2133  Find the set of RPC functions associated with this context_id
2134 ****************************************************************************/
2135
2136 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2137 {
2138         PIPE_RPC_FNS *fns = NULL;
2139         PIPE_RPC_FNS *tmp = NULL;
2140
2141         if ( !list ) {
2142                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2143                 return NULL;
2144         }
2145
2146         for (tmp=list; tmp; tmp=tmp->next ) {
2147                 if ( tmp->context_id == context_id )
2148                         break;
2149         }
2150
2151         fns = tmp;
2152
2153         return fns;
2154 }
2155
2156 /****************************************************************************
2157  Memory cleanup.
2158 ****************************************************************************/
2159
2160 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2161 {
2162         PIPE_RPC_FNS *tmp = list;
2163         PIPE_RPC_FNS *tmp2;
2164
2165         while (tmp) {
2166                 tmp2 = tmp->next;
2167                 SAFE_FREE(tmp);
2168                 tmp = tmp2;
2169         }
2170
2171         return;
2172 }
2173
2174 /****************************************************************************
2175  Find the correct RPC function to call for this request.
2176  If the pipe is authenticated then become the correct UNIX user
2177  before doing the call.
2178 ****************************************************************************/
2179
2180 BOOL api_pipe_request(pipes_struct *p)
2181 {
2182         BOOL ret = False;
2183         BOOL changed_user = False;
2184         PIPE_RPC_FNS *pipe_fns;
2185
2186         if (p->pipe_bound &&
2187                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2188                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2189                 if(!become_authenticated_pipe_user(p)) {
2190                         prs_mem_free(&p->out_data.rdata);
2191                         return False;
2192                 }
2193                 changed_user = True;
2194         }
2195
2196         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
2197
2198         /* get the set of RPC functions for this context */
2199
2200         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2201
2202         if ( pipe_fns ) {
2203                 set_current_rpc_talloc(p->mem_ctx);
2204                 ret = api_rpcTNP(p, p->name, pipe_fns->cmds, pipe_fns->n_cmds);
2205                 set_current_rpc_talloc(NULL);
2206         }
2207         else {
2208                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2209                         p->hdr_req.context_id, p->name));
2210         }
2211
2212         if (changed_user) {
2213                 unbecome_authenticated_pipe_user();
2214         }
2215
2216         return ret;
2217 }
2218
2219 /*******************************************************************
2220  Calls the underlying RPC function for a named pipe.
2221  ********************************************************************/
2222
2223 BOOL api_rpcTNP(pipes_struct *p, const char *rpc_name,
2224                 const struct api_struct *api_rpc_cmds, int n_cmds)
2225 {
2226         int fn_num;
2227         fstring name;
2228         uint32 offset1, offset2;
2229
2230         /* interpret the command */
2231         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
2232
2233         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
2234         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2235
2236         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2237                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2238                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2239                         break;
2240                 }
2241         }
2242
2243         if (fn_num == n_cmds) {
2244                 /*
2245                  * For an unknown RPC just return a fault PDU but
2246                  * return True to allow RPC's on the pipe to continue
2247                  * and not put the pipe into fault state. JRA.
2248                  */
2249                 DEBUG(4, ("unknown\n"));
2250                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
2251                 return True;
2252         }
2253
2254         offset1 = prs_offset(&p->out_data.rdata);
2255
2256         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2257                 fn_num, api_rpc_cmds[fn_num].fn));
2258         /* do the actual command */
2259         if(!api_rpc_cmds[fn_num].fn(p)) {
2260                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
2261                 prs_mem_free(&p->out_data.rdata);
2262                 return False;
2263         }
2264
2265         if (p->bad_handle_fault_state) {
2266                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2267                 p->bad_handle_fault_state = False;
2268                 setup_fault_pdu(p, NT_STATUS(0x1C00001A));
2269                 return True;
2270         }
2271
2272         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
2273         offset2 = prs_offset(&p->out_data.rdata);
2274         prs_set_offset(&p->out_data.rdata, offset1);
2275         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2276         prs_set_offset(&p->out_data.rdata, offset2);
2277
2278         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
2279
2280         /* Check for buffer underflow in rpc parsing */
2281
2282         if ((DEBUGLEVEL >= 10) &&
2283             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2284                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2285                 char *data = SMB_MALLOC(data_len);
2286
2287                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2288                 if (data) {
2289                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2290                         SAFE_FREE(data);
2291                 }
2292
2293         }
2294
2295         return True;
2296 }
2297
2298 /*******************************************************************
2299 *******************************************************************/
2300
2301 void get_pipe_fns( int idx, struct api_struct **fns, int *n_fns )
2302 {
2303         struct api_struct *cmds = NULL;
2304         int               n_cmds = 0;
2305
2306         switch ( idx ) {
2307                 case PI_LSARPC:
2308                         lsa_get_pipe_fns( &cmds, &n_cmds );
2309                         break;
2310                 case PI_LSARPC_DS:
2311                         lsa_ds_get_pipe_fns( &cmds, &n_cmds );
2312                         break;
2313                 case PI_SAMR:
2314                         samr_get_pipe_fns( &cmds, &n_cmds );
2315                         break;
2316                 case PI_NETLOGON:
2317                         netlog_get_pipe_fns( &cmds, &n_cmds );
2318                         break;
2319                 case PI_SRVSVC:
2320                         srvsvc_get_pipe_fns( &cmds, &n_cmds );
2321                         break;
2322                 case PI_WKSSVC:
2323                         wkssvc_get_pipe_fns( &cmds, &n_cmds );
2324                         break;
2325                 case PI_WINREG:
2326                         reg_get_pipe_fns( &cmds, &n_cmds );
2327                         break;
2328                 case PI_SPOOLSS:
2329                         spoolss_get_pipe_fns( &cmds, &n_cmds );
2330                         break;
2331                 case PI_NETDFS:
2332                         netdfs_get_pipe_fns( &cmds, &n_cmds );
2333                         break;
2334                 case PI_SVCCTL:
2335                         svcctl_get_pipe_fns( &cmds, &n_cmds );
2336                         break;
2337                 case PI_EVENTLOG:
2338                         eventlog_get_pipe_fns( &cmds, &n_cmds );
2339                         break;
2340                 case PI_NTSVCS:
2341                         ntsvcs_get_pipe_fns( &cmds, &n_cmds );
2342                         break;
2343 #ifdef DEVELOPER
2344                 case PI_ECHO:
2345                         echo_get_pipe_fns( &cmds, &n_cmds );
2346                         break;
2347 #endif
2348                 default:
2349                         DEBUG(0,("get_pipe_fns: Unknown pipe index! [%d]\n", idx));
2350         }
2351
2352         *fns = cmds;
2353         *n_fns = n_cmds;
2354
2355         return;
2356 }