source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "system/filesys.h"
  32 #include "srv_pipe_internal.h"
  33 #include "../librpc/gen_ndr/ndr_schannel.h"
  34 #include "../libcli/auth/schannel.h"
  35 #include "../libcli/auth/spnego.h"
  36 #include "dcesrv_auth_generic.h"
  37 #include "rpc_server.h"
  38 #include "rpc_dce.h"
  39 #include "smbd/smbd.h"
  40 #include "auth.h"
  41 #include "ntdomain.h"
  42 #include "rpc_server/srv_pipe.h"
  43 #include "rpc_server/rpc_contexts.h"
  44 #include "lib/param/param.h"
  45
  46 #undef DBGC_CLASS
  47 #define DBGC_CLASS DBGC_RPC_SRV
  48
  49 /**
  50  * Dump everything from the start of the end up of the provided data
  51  * into a file, but only at debug level >= 50
  52  **/
  53 static void dump_pdu_region(const char *name, int v,
  54                             DATA_BLOB *data, size_t start, size_t end)
  55 {
  56         int fd, i;
  57         char *fname = NULL;
  58         ssize_t sz;
  59
  60         if (DEBUGLEVEL < 50) return;
  61
  62         if (start > data->length || end > data->length || start > end) return;
  63
  64         for (i = 1; i < 100; i++) {
  65                 if (v != -1) {
  66                         fname = talloc_asprintf(talloc_tos(),
  67                                                 "/tmp/%s_%d.%d.prs",
  68                                                 name, v, i);
  69                 } else {
  70                         fname = talloc_asprintf(talloc_tos(),
  71                                                 "/tmp/%s_%d.prs",
  72                                                 name, i);
  73                 }
  74                 if (!fname) {
  75                         return;
  76                 }
  77                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  78                 if (fd != -1 || errno != EEXIST) break;
  79         }
  80         if (fd != -1) {
  81                 sz = write(fd, data->data + start, end - start);
  82                 i = close(fd);
  83                 if ((sz != end - start) || (i != 0) ) {
  84                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  85                                   fname, (unsigned long)sz,
  86                                   (unsigned long)end - start, i));
  87                 } else {
  88                         DEBUG(0,("created %s\n", fname));
  89                 }
  90         }
  91         TALLOC_FREE(fname);
  92 }
  93
  94 static DATA_BLOB generic_session_key(void)
  95 {
  96         return data_blob_const("SystemLibraryDTC", 16);
  97 }
  98
  99 /*******************************************************************
 100  Generate the next PDU to be returned from the data.
 101 ********************************************************************/
 102
 103 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
 104                                    struct pipe_auth_data *auth,
 105                                    uint32_t call_id,
 106                                    DATA_BLOB *rdata,
 107                                    size_t data_sent_length,
 108                                    DATA_BLOB *frag,
 109                                    size_t *pdu_size)
 110 {
 111         union dcerpc_payload u;
 112         uint8_t pfc_flags;
 113         size_t data_left;
 114         size_t data_to_send;
 115         size_t frag_len;
 116         size_t pad_len = 0;
 117         size_t auth_len = 0;
 118         NTSTATUS status;
 119
 120         ZERO_STRUCT(u.response);
 121
 122         /* Set up rpc packet pfc flags. */
 123         if (data_sent_length == 0) {
 124                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 125         } else {
 126                 pfc_flags = 0;
 127         }
 128
 129         /* Work out how much we can fit in a single PDU. */
 130         data_left = rdata->length - data_sent_length;
 131
 132         /* Ensure there really is data left to send. */
 133         if (!data_left) {
 134                 DEBUG(0, ("No data left to send !\n"));
 135                 return NT_STATUS_BUFFER_TOO_SMALL;
 136         }
 137
 138         status = dcerpc_guess_sizes(auth,
 139                                     DCERPC_RESPONSE_LENGTH,
 140                                     data_left,
 141                                     RPC_MAX_PDU_FRAG_LEN,
 142                                     SERVER_NDR_PADDING_SIZE,
 143                                     &data_to_send, &frag_len,
 144                                     &auth_len, &pad_len);
 145         if (!NT_STATUS_IS_OK(status)) {
 146                 return status;
 147         }
 148
 149         /* Set up the alloc hint. This should be the data left to send. */
 150         u.response.alloc_hint = data_left;
 151
 152         /* Work out if this PDU will be the last. */
 153         if (data_sent_length + data_to_send >= rdata->length) {
 154                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 155         }
 156
 157         /* Prepare data to be NDR encoded. */
 158         u.response.stub_and_verifier =
 159                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 160
 161         /* Store the packet in the data stream. */
 162         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 163                                           pfc_flags, auth_len, call_id,
 164                                           &u, frag);
 165         if (!NT_STATUS_IS_OK(status)) {
 166                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 167                 return status;
 168         }
 169
 170         if (auth_len) {
 171                 /* Set the proper length on the pdu, including padding.
 172                  * Only needed if an auth trailer will be appended. */
 173                 dcerpc_set_frag_length(frag, frag->length
 174                                                 + pad_len
 175                                                 + DCERPC_AUTH_TRAILER_LENGTH
 176                                                 + auth_len);
 177         }
 178
 179         if (auth_len) {
 180                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 181                 if (!NT_STATUS_IS_OK(status)) {
 182                         data_blob_free(frag);
 183                         return status;
 184                 }
 185         }
 186
 187         *pdu_size = data_to_send;
 188         return NT_STATUS_OK;
 189 }
 190
 191 /*******************************************************************
 192  Generate the next PDU to be returned from the data in p->rdata.
 193 ********************************************************************/
 194
 195 bool create_next_pdu(struct pipes_struct *p)
 196 {
 197         size_t pdu_size = 0;
 198         NTSTATUS status;
 199
 200         /*
 201          * If we're in the fault state, keep returning fault PDU's until
 202          * the pipe gets closed. JRA.
 203          */
 204         if (p->fault_state) {
 205                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 206                 return true;
 207         }
 208
 209         status = create_next_packet(p->mem_ctx, &p->auth,
 210                                     p->call_id, &p->out_data.rdata,
 211                                     p->out_data.data_sent_length,
 212                                     &p->out_data.frag, &pdu_size);
 213         if (!NT_STATUS_IS_OK(status)) {
 214                 DEBUG(0, ("Failed to create packet with error %s, "
 215                           "(auth level %u / type %u)\n",
 216                           nt_errstr(status),
 217                           (unsigned int)p->auth.auth_level,
 218                           (unsigned int)p->auth.auth_type));
 219                 return false;
 220         }
 221
 222         /* Setup the counts for this PDU. */
 223         p->out_data.data_sent_length += pdu_size;
 224         p->out_data.current_pdu_sent = 0;
 225         return true;
 226 }
 227
 228
 229 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 230
 231 /*******************************************************************
 232  Marshall a bind_nak pdu.
 233 *******************************************************************/
 234
 235 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 236 {
 237         NTSTATUS status;
 238         union dcerpc_payload u;
 239
 240         /* Free any memory in the current return data buffer. */
 241         pipe_init_outgoing_data(p);
 242
 243         /*
 244          * Initialize a bind_nak header.
 245          */
 246
 247         ZERO_STRUCT(u);
 248
 249         u.bind_nak.reject_reason  = 0;
 250
 251         /*
 252          * Marshall directly into the outgoing PDU space. We
 253          * must do this as we need to set to the bind response
 254          * header and are never sending more than one PDU here.
 255          */
 256
 257         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 258                                           DCERPC_PKT_BIND_NAK,
 259                                           DCERPC_PFC_FLAG_FIRST |
 260                                                 DCERPC_PFC_FLAG_LAST,
 261                                           0,
 262                                           pkt->call_id,
 263                                           &u,
 264                                           &p->out_data.frag);
 265         if (!NT_STATUS_IS_OK(status)) {
 266                 return False;
 267         }
 268
 269         p->out_data.data_sent_length = 0;
 270         p->out_data.current_pdu_sent = 0;
 271
 272         TALLOC_FREE(p->auth.auth_ctx);
 273         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 274         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 275         p->pipe_bound = False;
 276
 277         return True;
 278 }
 279
 280 /*******************************************************************
 281  Marshall a fault pdu.
 282 *******************************************************************/
 283
 284 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 285 {
 286         NTSTATUS status;
 287         union dcerpc_payload u;
 288
 289         /* Free any memory in the current return data buffer. */
 290         pipe_init_outgoing_data(p);
 291
 292         /*
 293          * Initialize a fault header.
 294          */
 295
 296         ZERO_STRUCT(u);
 297
 298         u.fault.status          = NT_STATUS_V(fault_status);
 299         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 300
 301         /*
 302          * Marshall directly into the outgoing PDU space. We
 303          * must do this as we need to set to the bind response
 304          * header and are never sending more than one PDU here.
 305          */
 306
 307         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 308                                           DCERPC_PKT_FAULT,
 309                                           DCERPC_PFC_FLAG_FIRST |
 310                                            DCERPC_PFC_FLAG_LAST |
 311                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 312                                           0,
 313                                           p->call_id,
 314                                           &u,
 315                                           &p->out_data.frag);
 316         if (!NT_STATUS_IS_OK(status)) {
 317                 return False;
 318         }
 319
 320         p->out_data.data_sent_length = 0;
 321         p->out_data.current_pdu_sent = 0;
 322
 323         return True;
 324 }
 325
 326 /*******************************************************************
 327  Ensure a bind request has the correct abstract & transfer interface.
 328  Used to reject unknown binds from Win2k.
 329 *******************************************************************/
 330
 331 static bool check_bind_req(struct pipes_struct *p,
 332                            struct ndr_syntax_id* abstract,
 333                            struct ndr_syntax_id* transfer,
 334                            uint32_t context_id)
 335 {
 336         struct pipe_rpc_fns *context_fns;
 337         bool ok;
 338
 339         DEBUG(3,("check_bind_req for %s\n",
 340                  get_pipe_name_from_syntax(talloc_tos(), abstract)));
 341
 342         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 343         if (rpc_srv_pipe_exists_by_id(abstract) &&
 344            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax_ndr)) {
 345                 DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
 346                           rpc_srv_get_pipe_cli_name(abstract),
 347                           rpc_srv_get_pipe_srv_name(abstract)));
 348         } else {
 349                 return false;
 350         }
 351
 352         ok = init_pipe_handles(p, abstract);
 353         if (!ok) {
 354                 DEBUG(1, ("Failed to init pipe handles!\n"));
 355                 return false;
 356         }
 357
 358         context_fns = talloc(p, struct pipe_rpc_fns);
 359         if (context_fns == NULL) {
 360                 DEBUG(0,("check_bind_req: talloc() failed!\n"));
 361                 return false;
 362         }
 363
 364         context_fns->next = context_fns->prev = NULL;
 365         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 366         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 367         context_fns->context_id = context_id;
 368         context_fns->syntax = *abstract;
 369
 370         /* add to the list of open contexts */
 371
 372         DLIST_ADD( p->contexts, context_fns );
 373
 374         return True;
 375 }
 376
 377 /**
 378  * Is a named pipe known?
 379  * @param[in] pipename          Just the filename
 380  * @result                      Do we want to serve this?
 381  */
 382 bool is_known_pipename(const char *pipename, struct ndr_syntax_id *syntax)
 383 {
 384         NTSTATUS status;
 385
 386         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 387                 DEBUG(10, ("refusing spoolss access\n"));
 388                 return false;
 389         }
 390
 391         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 392                 return true;
 393         }
 394
 395         status = smb_probe_module("rpc", pipename);
 396         if (!NT_STATUS_IS_OK(status)) {
 397                 DEBUG(10, ("is_known_pipename: %s unknown\n", pipename));
 398                 return false;
 399         }
 400         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 401
 402         /*
 403          * Scan the list again for the interface id
 404          */
 405         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 406                 return true;
 407         }
 408
 409         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 410                    pipename));
 411
 412         return false;
 413 }
 414
 415 /*******************************************************************
 416  Handle an schannel bind auth.
 417 *******************************************************************/
 418
 419 static bool pipe_schannel_auth_bind(struct pipes_struct *p,
 420                                     TALLOC_CTX *mem_ctx,
 421                                     struct dcerpc_auth *auth_info,
 422                                     DATA_BLOB *response)
 423 {
 424         struct NL_AUTH_MESSAGE neg;
 425         struct NL_AUTH_MESSAGE reply;
 426         bool ret;
 427         NTSTATUS status;
 428         struct netlogon_creds_CredentialState *creds;
 429         enum ndr_err_code ndr_err;
 430         struct schannel_state *schannel_auth;
 431         struct loadparm_context *lp_ctx;
 432
 433         ndr_err = ndr_pull_struct_blob(
 434                         &auth_info->credentials, mem_ctx, &neg,
 435                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
 436         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 437                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
 438                 return false;
 439         }
 440
 441         if (DEBUGLEVEL >= 10) {
 442                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
 443         }
 444
 445         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
 446                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
 447                 return false;
 448         }
 449
 450         lp_ctx = loadparm_init_s3(p, loadparm_s3_helpers());
 451         if (!lp_ctx) {
 452                 DEBUG(0,("pipe_schannel_auth_bind: loadparm_init_s3() failed!\n"));
 453                 return false;
 454         }
 455
 456         /*
 457          * The neg.oem_netbios_computer.a key here must match the remote computer name
 458          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
 459          * operations that use credentials.
 460          */
 461
 462         become_root();
 463         status = schannel_get_creds_state(p, lp_ctx,
 464                                             neg.oem_netbios_computer.a, &creds);
 465         unbecome_root();
 466
 467         talloc_unlink(p, lp_ctx);
 468         if (!NT_STATUS_IS_OK(status)) {
 469                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
 470                 return False;
 471         }
 472
 473         schannel_auth = talloc_zero(p, struct schannel_state);
 474         if (!schannel_auth) {
 475                 TALLOC_FREE(creds);
 476                 return False;
 477         }
 478
 479         schannel_auth->state = SCHANNEL_STATE_START;
 480         schannel_auth->initiator = false;
 481         schannel_auth->creds = creds;
 482
 483         /*
 484          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
 485          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
 486          * struct of the person who opened the pipe. I need to test this further. JRA.
 487          *
 488          * VL. As we are mapping this to guest set the generic key
 489          * "SystemLibraryDTC" key here. It's a bit difficult to test against
 490          * W2k3, as it does not allow schannel binds against SAMR and LSA
 491          * anymore.
 492          */
 493
 494         ret = session_info_set_session_key(p->session_info, generic_session_key());
 495
 496         if (!ret) {
 497                 DEBUG(0, ("session_info_set_session_key failed\n"));
 498                 return false;
 499         }
 500
 501         /*** SCHANNEL verifier ***/
 502
 503         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
 504         reply.Flags                             = 0;
 505         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
 506                                                       * this has any meaning
 507                                                       * here - gd */
 508
 509         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
 510                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 511         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 512                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
 513                 return false;
 514         }
 515
 516         if (DEBUGLEVEL >= 10) {
 517                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
 518         }
 519
 520         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
 521                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
 522
 523         /* We're finished with this bind - no more packets. */
 524         p->auth.auth_ctx = schannel_auth;
 525         p->auth.auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
 526
 527         p->pipe_bound = True;
 528
 529         return True;
 530 }
 531
 532 /*******************************************************************
 533  Handle an NTLMSSP bind auth.
 534 *******************************************************************/
 535
 536 static bool pipe_auth_generic_bind(struct pipes_struct *p,
 537                                    TALLOC_CTX *mem_ctx,
 538                                    struct dcerpc_auth *auth_info,
 539                                    DATA_BLOB *response)
 540 {
 541         struct gensec_security *gensec_security = NULL;
 542         NTSTATUS status;
 543
 544         status = auth_generic_server_authtype_start(p,
 545                                                     auth_info->auth_type,
 546                                                     auth_info->auth_level,
 547                                                     &auth_info->credentials,
 548                                                     response,
 549                                                     p->remote_address,
 550                                                     &gensec_security);
 551         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 552                 DEBUG(0, (__location__ ": auth_generic_server_authtype_start failed: %s\n",
 553                           nt_errstr(status)));
 554                 return false;
 555         }
 556
 557         /* Make sure data is bound to the memctx, to be freed the caller */
 558         talloc_steal(mem_ctx, response->data);
 559
 560         p->auth.auth_ctx = gensec_security;
 561         p->auth.auth_type = auth_info->auth_type;
 562
 563         return true;
 564 }
 565
 566 /*******************************************************************
 567  Process an NTLMSSP authentication response.
 568  If this function succeeds, the user has been authenticated
 569  and their domain, name and calling workstation stored in
 570  the pipe struct.
 571 *******************************************************************/
 572
 573 static bool pipe_auth_generic_verify_final(TALLOC_CTX *mem_ctx,
 574                                 struct gensec_security *gensec_security,
 575                                 enum dcerpc_AuthLevel auth_level,
 576                                 struct auth_session_info **session_info)
 577 {
 578         NTSTATUS status;
 579         bool ret;
 580
 581         DEBUG(5, (__location__ ": checking user details\n"));
 582
 583         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 584            ensure the underlying NTLMSSP flags are also set. If not we should
 585            refuse the bind. */
 586
 587         status = auth_generic_server_check_flags(gensec_security,
 588                                             (auth_level ==
 589                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 590                                             (auth_level ==
 591                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 592         if (!NT_STATUS_IS_OK(status)) {
 593                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 594                           "security for rpc connection\n"));
 595                 return false;
 596         }
 597
 598         TALLOC_FREE(*session_info);
 599
 600         status = auth_generic_server_get_user_info(gensec_security,
 601                                                 mem_ctx, session_info);
 602         if (!NT_STATUS_IS_OK(status)) {
 603                 DEBUG(0, (__location__ ": failed to obtain the server info "
 604                           "for authenticated user: %s\n", nt_errstr(status)));
 605                 return false;
 606         }
 607
 608         if ((*session_info)->security_token == NULL) {
 609                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 610                 return false;
 611         }
 612
 613         /*
 614          * We're an authenticated bind over smb, so the session key needs to
 615          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 616          * does. See the RPC-SAMBA3SESSIONKEY.
 617          */
 618
 619         ret = session_info_set_session_key((*session_info), generic_session_key());
 620         if (!ret) {
 621                 DEBUG(0, ("Failed to set session key!\n"));
 622                 return false;
 623         }
 624
 625         return true;
 626 }
 627
 628 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 629 {
 630         struct gensec_security *gensec_security;
 631
 632         switch (p->auth.auth_type) {
 633         case DCERPC_AUTH_TYPE_NTLMSSP:
 634         case DCERPC_AUTH_TYPE_KRB5:
 635         case DCERPC_AUTH_TYPE_SPNEGO:
 636                 gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
 637                                                         struct gensec_security);
 638                 if (!pipe_auth_generic_verify_final(p, gensec_security,
 639                                                 p->auth.auth_level,
 640                                                 &p->session_info)) {
 641                         return NT_STATUS_ACCESS_DENIED;
 642                 }
 643                 break;
 644         default:
 645                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
 646                           (unsigned int)p->auth.auth_type));
 647                 return NT_STATUS_ACCESS_DENIED;
 648         }
 649
 650         p->pipe_bound = true;
 651
 652         return NT_STATUS_OK;
 653 }
 654
 655 /*******************************************************************
 656  Respond to a pipe bind request.
 657 *******************************************************************/
 658
 659 static bool api_pipe_bind_req(struct pipes_struct *p,
 660                                 struct ncacn_packet *pkt)
 661 {
 662         struct dcerpc_auth auth_info;
 663         uint16 assoc_gid;
 664         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
 665         NTSTATUS status;
 666         struct ndr_syntax_id id;
 667         union dcerpc_payload u;
 668         struct dcerpc_ack_ctx bind_ack_ctx;
 669         DATA_BLOB auth_resp = data_blob_null;
 670         DATA_BLOB auth_blob = data_blob_null;
 671
 672         /* No rebinds on a bound pipe - use alter context. */
 673         if (p->pipe_bound) {
 674                 DEBUG(2,("Rejecting bind request on bound rpc connection\n"));
 675                 return setup_bind_nak(p, pkt);
 676         }
 677
 678         if (pkt->u.bind.num_contexts == 0) {
 679                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
 680                 goto err_exit;
 681         }
 682
 683         /*
 684          * Try and find the correct pipe name to ensure
 685          * that this is a pipe name we support.
 686          */
 687         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 688         if (rpc_srv_pipe_exists_by_id(&id)) {
 689                 DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 690                           rpc_srv_get_pipe_cli_name(&id),
 691                           rpc_srv_get_pipe_srv_name(&id)));
 692         } else {
 693                 status = smb_probe_module(
 694                         "rpc", get_pipe_name_from_syntax(
 695                                 talloc_tos(),
 696                                 &id));
 697
 698                 if (NT_STATUS_IS_ERR(status)) {
 699                         DEBUG(3,("api_pipe_bind_req: Unknown rpc service name "
 700                                  "%s in bind request.\n",
 701                                  get_pipe_name_from_syntax(talloc_tos(), &id)));
 702
 703                         return setup_bind_nak(p, pkt);
 704                 }
 705
 706                 if (rpc_srv_get_pipe_interface_by_cli_name(
 707                                 get_pipe_name_from_syntax(talloc_tos(),
 708                                                           &id),
 709                                 &id)) {
 710                         DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 711                                   rpc_srv_get_pipe_cli_name(&id),
 712                                   rpc_srv_get_pipe_srv_name(&id)));
 713                 } else {
 714                         DEBUG(0, ("module %s doesn't provide functions for "
 715                                   "pipe %s!\n",
 716                                   get_pipe_name_from_syntax(talloc_tos(), &id),
 717                                   get_pipe_name_from_syntax(talloc_tos(), &id)));
 718                         return setup_bind_nak(p, pkt);
 719                 }
 720         }
 721
 722         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 723
 724         if (pkt->u.bind.assoc_group_id != 0) {
 725                 assoc_gid = pkt->u.bind.assoc_group_id;
 726         } else {
 727                 assoc_gid = 0x53f0;
 728         }
 729
 730         /*
 731          * Create the bind response struct.
 732          */
 733
 734         /* If the requested abstract synt uuid doesn't match our client pipe,
 735                 reject the bind_ack & set the transfer interface synt to all 0's,
 736                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 737                 unknown to NT4)
 738                 Needed when adding entries to a DACL from NT5 - SK */
 739
 740         if (check_bind_req(p,
 741                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 742                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 743                         pkt->u.bind.ctx_list[0].context_id)) {
 744
 745                 bind_ack_ctx.result = 0;
 746                 bind_ack_ctx.reason = 0;
 747                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 748         } else {
 749                 p->pipe_bound = False;
 750                 /* Rejection reason: abstract syntax not supported */
 751                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 752                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
 753                 bind_ack_ctx.syntax = ndr_syntax_id_null;
 754         }
 755
 756         /*
 757          * Check if this is an authenticated bind request.
 758          */
 759         if (pkt->auth_length) {
 760                 /* Quick length check. Won't catch a bad auth footer,
 761                  * prevents overrun. */
 762
 763                 if (pkt->frag_length < RPC_HEADER_LEN +
 764                                         DCERPC_AUTH_TRAILER_LENGTH +
 765                                         pkt->auth_length) {
 766                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
 767                                 "too long for fragment %u.\n",
 768                                 (unsigned int)pkt->auth_length,
 769                                 (unsigned int)pkt->frag_length));
 770                         goto err_exit;
 771                 }
 772
 773                 /*
 774                  * Decode the authentication verifier.
 775                  */
 776                 status = dcerpc_pull_dcerpc_auth(pkt,
 777                                                  &pkt->u.bind.auth_info,
 778                                                  &auth_info, p->endian);
 779                 if (!NT_STATUS_IS_OK(status)) {
 780                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
 781                         goto err_exit;
 782                 }
 783
 784                 auth_type = auth_info.auth_type;
 785
 786                 /* Work out if we have to sign or seal etc. */
 787                 switch (auth_info.auth_level) {
 788                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 789                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 790                         break;
 791                 case DCERPC_AUTH_LEVEL_PRIVACY:
 792                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 793                         break;
 794                 case DCERPC_AUTH_LEVEL_CONNECT:
 795                         p->auth.auth_level = DCERPC_AUTH_LEVEL_CONNECT;
 796                         break;
 797                 default:
 798                         DEBUG(0, ("Unexpected auth level (%u).\n",
 799                                 (unsigned int)auth_info.auth_level ));
 800                         goto err_exit;
 801                 }
 802
 803                 switch (auth_type) {
 804                 case DCERPC_AUTH_TYPE_NTLMSSP:
 805                         if (!pipe_auth_generic_bind(p, pkt,
 806                                                     &auth_info, &auth_resp)) {
 807                                 goto err_exit;
 808                         }
 809                         assoc_gid = 0x7a77;
 810                         break;
 811
 812                 case DCERPC_AUTH_TYPE_SCHANNEL:
 813                         if (!pipe_schannel_auth_bind(p, pkt,
 814                                                 &auth_info, &auth_resp)) {
 815                                 goto err_exit;
 816                         }
 817                         break;
 818
 819                 case DCERPC_AUTH_TYPE_SPNEGO:
 820                 case DCERPC_AUTH_TYPE_KRB5:
 821                         if (!pipe_auth_generic_bind(p, pkt,
 822                                                     &auth_info, &auth_resp)) {
 823                                 goto err_exit;
 824                         }
 825                         break;
 826
 827                 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
 828                         if (p->transport == NCALRPC && p->ncalrpc_as_system) {
 829                                 TALLOC_FREE(p->session_info);
 830
 831                                 status = make_session_info_system(p,
 832                                                                   &p->session_info);
 833                                 if (!NT_STATUS_IS_OK(status)) {
 834                                         goto err_exit;
 835                                 }
 836
 837                                 auth_resp = data_blob_talloc(pkt,
 838                                                              "NCALRPC_AUTH_OK",
 839                                                              15);
 840
 841                                 p->auth.auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
 842                                 p->pipe_bound = true;
 843                         } else {
 844                                 goto err_exit;
 845                         }
 846                         break;
 847
 848                 case DCERPC_AUTH_TYPE_NONE:
 849                         break;
 850
 851                 default:
 852                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
 853                         goto err_exit;
 854                 }
 855         }
 856
 857         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
 858                 /* Unauthenticated bind request. */
 859                 /* We're finished - no more packets. */
 860                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 861                 /* We must set the pipe auth_level here also. */
 862                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 863                 p->pipe_bound = True;
 864                 /* The session key was initialized from the SMB
 865                  * session in make_internal_rpc_pipe_p */
 866         }
 867
 868         ZERO_STRUCT(u.bind_ack);
 869         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
 870         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
 871         u.bind_ack.assoc_group_id = assoc_gid;
 872
 873         /* name has to be \PIPE\xxxxx */
 874         u.bind_ack.secondary_address =
 875                         talloc_asprintf(pkt, "\\PIPE\\%s",
 876                                         rpc_srv_get_pipe_srv_name(&id));
 877         if (!u.bind_ack.secondary_address) {
 878                 DEBUG(0, ("Out of memory!\n"));
 879                 goto err_exit;
 880         }
 881         u.bind_ack.secondary_address_size =
 882                                 strlen(u.bind_ack.secondary_address) + 1;
 883
 884         u.bind_ack.num_results = 1;
 885         u.bind_ack.ctx_list = &bind_ack_ctx;
 886
 887         /* NOTE: We leave the auth_info empty so we can calculate the padding
 888          * later and then append the auth_info --simo */
 889
 890         /*
 891          * Marshall directly into the outgoing PDU space. We
 892          * must do this as we need to set to the bind response
 893          * header and are never sending more than one PDU here.
 894          */
 895
 896         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 897                                           DCERPC_PKT_BIND_ACK,
 898                                           DCERPC_PFC_FLAG_FIRST |
 899                                                 DCERPC_PFC_FLAG_LAST,
 900                                           auth_resp.length,
 901                                           pkt->call_id,
 902                                           &u,
 903                                           &p->out_data.frag);
 904         if (!NT_STATUS_IS_OK(status)) {
 905                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
 906                           nt_errstr(status)));
 907         }
 908
 909         if (auth_resp.length) {
 910
 911                 status = dcerpc_push_dcerpc_auth(pkt,
 912                                                  auth_type,
 913                                                  auth_info.auth_level,
 914                                                  0,
 915                                                  1, /* auth_context_id */
 916                                                  &auth_resp,
 917                                                  &auth_blob);
 918                 if (!NT_STATUS_IS_OK(status)) {
 919                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
 920                         goto err_exit;
 921                 }
 922         }
 923
 924         /* Now that we have the auth len store it into the right place in
 925          * the dcerpc header */
 926         dcerpc_set_frag_length(&p->out_data.frag,
 927                                 p->out_data.frag.length + auth_blob.length);
 928
 929         if (auth_blob.length) {
 930
 931                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
 932                                         auth_blob.data, auth_blob.length)) {
 933                         DEBUG(0, ("Append of auth info failed.\n"));
 934                         goto err_exit;
 935                 }
 936         }
 937
 938         /*
 939          * Setup the lengths for the initial reply.
 940          */
 941
 942         p->out_data.data_sent_length = 0;
 943         p->out_data.current_pdu_sent = 0;
 944
 945         TALLOC_FREE(auth_blob.data);
 946         return True;
 947
 948   err_exit:
 949
 950         data_blob_free(&p->out_data.frag);
 951         TALLOC_FREE(auth_blob.data);
 952         return setup_bind_nak(p, pkt);
 953 }
 954
 955 /*******************************************************************
 956  This is the "stage3" response after a bind request and reply.
 957 *******************************************************************/
 958
 959 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
 960 {
 961         struct dcerpc_auth auth_info;
 962         DATA_BLOB response = data_blob_null;
 963         struct gensec_security *gensec_security;
 964         NTSTATUS status;
 965
 966         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 967
 968         if (pkt->auth_length == 0) {
 969                 DEBUG(0, ("No auth field sent for bind request!\n"));
 970                 goto err;
 971         }
 972
 973         /* Ensure there's enough data for an authenticated request. */
 974         if (pkt->frag_length < RPC_HEADER_LEN
 975                                 + DCERPC_AUTH_TRAILER_LENGTH
 976                                 + pkt->auth_length) {
 977                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
 978                                 "%u is too large.\n",
 979                         (unsigned int)pkt->auth_length));
 980                 goto err;
 981         }
 982
 983         /*
 984          * Decode the authentication verifier response.
 985          */
 986
 987         status = dcerpc_pull_dcerpc_auth(pkt,
 988                                          &pkt->u.auth3.auth_info,
 989                                          &auth_info, p->endian);
 990         if (!NT_STATUS_IS_OK(status)) {
 991                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
 992                 goto err;
 993         }
 994
 995         /* We must NEVER look at auth_info->auth_pad_len here,
 996          * as old Samba client code gets it wrong and sends it
 997          * as zero. JRA.
 998          */
 999
1000         if (auth_info.auth_type != p->auth.auth_type) {
1001                 DEBUG(0, ("Auth type mismatch! Client sent %d, "
1002                           "but auth was started as type %d!\n",
1003                           auth_info.auth_type, p->auth.auth_type));
1004                 goto err;
1005         }
1006
1007         switch (auth_info.auth_type) {
1008         case DCERPC_AUTH_TYPE_NTLMSSP:
1009         case DCERPC_AUTH_TYPE_KRB5:
1010         case DCERPC_AUTH_TYPE_SPNEGO:
1011                 gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
1012                                                     struct gensec_security);
1013                 status = auth_generic_server_step(gensec_security,
1014                                              pkt, &auth_info.credentials,
1015                                              &response);
1016                 break;
1017         default:
1018                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
1019                           (unsigned int)auth_info.auth_type));
1020                 return false;
1021         }
1022
1023         if (NT_STATUS_EQUAL(status,
1024                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1025             response.length) {
1026                 DEBUG(0, (__location__ ": This was supposed to be the final "
1027                           "leg, but crypto machinery claims a response is "
1028                           "needed, aborting auth!\n"));
1029                 data_blob_free(&response);
1030                 goto err;
1031         }
1032         if (!NT_STATUS_IS_OK(status)) {
1033                 DEBUG(0, ("Auth failed (%s)\n", nt_errstr(status)));
1034                 goto err;
1035         }
1036
1037         /* Now verify auth was indeed successful and extract server info */
1038         status = pipe_auth_verify_final(p);
1039         if (!NT_STATUS_IS_OK(status)) {
1040                 DEBUG(0, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1041                 goto err;
1042         }
1043
1044         return true;
1045
1046 err:
1047
1048         TALLOC_FREE(p->auth.auth_ctx);
1049         return false;
1050 }
1051
1052 /****************************************************************************
1053  Deal with an alter context call. Can be third part of 3 leg auth request for
1054  SPNEGO calls.
1055 ****************************************************************************/
1056
1057 static bool api_pipe_alter_context(struct pipes_struct *p,
1058                                         struct ncacn_packet *pkt)
1059 {
1060         struct dcerpc_auth auth_info;
1061         uint16 assoc_gid;
1062         NTSTATUS status;
1063         union dcerpc_payload u;
1064         struct dcerpc_ack_ctx bind_ack_ctx;
1065         DATA_BLOB auth_resp = data_blob_null;
1066         DATA_BLOB auth_blob = data_blob_null;
1067         int pad_len = 0;
1068         struct gensec_security *gensec_security;
1069
1070         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1071
1072         if (pkt->u.bind.assoc_group_id != 0) {
1073                 assoc_gid = pkt->u.bind.assoc_group_id;
1074         } else {
1075                 assoc_gid = 0x53f0;
1076         }
1077
1078         /*
1079          * Create the bind response struct.
1080          */
1081
1082         /* If the requested abstract synt uuid doesn't match our client pipe,
1083                 reject the bind_ack & set the transfer interface synt to all 0's,
1084                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1085                 unknown to NT4)
1086                 Needed when adding entries to a DACL from NT5 - SK */
1087
1088         if (check_bind_req(p,
1089                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1090                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1091                         pkt->u.bind.ctx_list[0].context_id)) {
1092
1093                 bind_ack_ctx.result = 0;
1094                 bind_ack_ctx.reason = 0;
1095                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1096         } else {
1097                 p->pipe_bound = False;
1098                 /* Rejection reason: abstract syntax not supported */
1099                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1100                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1101                 bind_ack_ctx.syntax = ndr_syntax_id_null;
1102         }
1103
1104         /*
1105          * Check if this is an authenticated alter context request.
1106          */
1107         if (pkt->auth_length) {
1108                 /* Quick length check. Won't catch a bad auth footer,
1109                  * prevents overrun. */
1110
1111                 if (pkt->frag_length < RPC_HEADER_LEN +
1112                                         DCERPC_AUTH_TRAILER_LENGTH +
1113                                         pkt->auth_length) {
1114                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1115                                 "too long for fragment %u.\n",
1116                                 (unsigned int)pkt->auth_length,
1117                                 (unsigned int)pkt->frag_length ));
1118                         goto err_exit;
1119                 }
1120
1121                 status = dcerpc_pull_dcerpc_auth(pkt,
1122                                                  &pkt->u.bind.auth_info,
1123                                                  &auth_info, p->endian);
1124                 if (!NT_STATUS_IS_OK(status)) {
1125                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1126                         goto err_exit;
1127                 }
1128
1129                 /* We can only finish if the pipe is unbound for now */
1130                 if (p->pipe_bound) {
1131                         DEBUG(0, (__location__ ": Pipe already bound, "
1132                                   "Altering Context not yet supported!\n"));
1133                         goto err_exit;
1134                 }
1135
1136                 if (auth_info.auth_type != p->auth.auth_type) {
1137                         DEBUG(0, ("Auth type mismatch! Client sent %d, "
1138                                   "but auth was started as type %d!\n",
1139                                   auth_info.auth_type, p->auth.auth_type));
1140                         goto err_exit;
1141                 }
1142
1143
1144                 switch (auth_info.auth_type) {
1145                 case DCERPC_AUTH_TYPE_SPNEGO:
1146                 case DCERPC_AUTH_TYPE_KRB5:
1147                 case DCERPC_AUTH_TYPE_NTLMSSP:
1148                         gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
1149                                                     struct gensec_security);
1150                         status = auth_generic_server_step(gensec_security,
1151                                                      pkt,
1152                                                      &auth_info.credentials,
1153                                                      &auth_resp);
1154                         break;
1155
1156                 default:
1157                         DEBUG(3, (__location__ ": Usupported auth type (%d) "
1158                                   "in alter-context call\n",
1159                                   auth_info.auth_type));
1160                         goto err_exit;
1161                 }
1162
1163                 if (NT_STATUS_IS_OK(status)) {
1164                         /* third leg of auth, verify auth info */
1165                         status = pipe_auth_verify_final(p);
1166                         if (!NT_STATUS_IS_OK(status)) {
1167                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1168                                           nt_errstr(status)));
1169                                 goto err_exit;
1170                         }
1171                 } else if (NT_STATUS_EQUAL(status,
1172                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1173                         DEBUG(10, ("More auth legs required.\n"));
1174                 } else {
1175                         DEBUG(0, ("Auth step returned an error (%s)\n",
1176                                   nt_errstr(status)));
1177                         goto err_exit;
1178                 }
1179         }
1180
1181         ZERO_STRUCT(u.alter_resp);
1182         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1183         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1184         u.alter_resp.assoc_group_id = assoc_gid;
1185
1186         /* secondary address CAN be NULL
1187          * as the specs say it's ignored.
1188          * It MUST be NULL to have the spoolss working.
1189          */
1190         u.alter_resp.secondary_address = "";
1191         u.alter_resp.secondary_address_size = 1;
1192
1193         u.alter_resp.num_results = 1;
1194         u.alter_resp.ctx_list = &bind_ack_ctx;
1195
1196         /* NOTE: We leave the auth_info empty so we can calculate the padding
1197          * later and then append the auth_info --simo */
1198
1199         /*
1200          * Marshall directly into the outgoing PDU space. We
1201          * must do this as we need to set to the bind response
1202          * header and are never sending more than one PDU here.
1203          */
1204
1205         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1206                                           DCERPC_PKT_ALTER_RESP,
1207                                           DCERPC_PFC_FLAG_FIRST |
1208                                                 DCERPC_PFC_FLAG_LAST,
1209                                           auth_resp.length,
1210                                           pkt->call_id,
1211                                           &u,
1212                                           &p->out_data.frag);
1213         if (!NT_STATUS_IS_OK(status)) {
1214                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1215                           nt_errstr(status)));
1216         }
1217
1218         if (auth_resp.length) {
1219
1220                 /* Work out any padding needed before the auth footer. */
1221                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1222                 if (pad_len) {
1223                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1224                         DEBUG(10, ("auth pad_len = %u\n",
1225                                    (unsigned int)pad_len));
1226                 }
1227
1228                 status = dcerpc_push_dcerpc_auth(pkt,
1229                                                  auth_info.auth_type,
1230                                                  auth_info.auth_level,
1231                                                  pad_len,
1232                                                  1, /* auth_context_id */
1233                                                  &auth_resp,
1234                                                  &auth_blob);
1235                 if (!NT_STATUS_IS_OK(status)) {
1236                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1237                         goto err_exit;
1238                 }
1239         }
1240
1241         /* Now that we have the auth len store it into the right place in
1242          * the dcerpc header */
1243         dcerpc_set_frag_length(&p->out_data.frag,
1244                                 p->out_data.frag.length +
1245                                         pad_len + auth_blob.length);
1246
1247         if (auth_resp.length) {
1248                 if (pad_len) {
1249                         char pad[SERVER_NDR_PADDING_SIZE];
1250                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1251                         if (!data_blob_append(p->mem_ctx,
1252                                                 &p->out_data.frag,
1253                                                 pad, pad_len)) {
1254                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1255                                           "%u bytes of pad data.\n",
1256                                           (unsigned int)pad_len));
1257                                 goto err_exit;
1258                         }
1259                 }
1260
1261                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1262                                         auth_blob.data, auth_blob.length)) {
1263                         DEBUG(0, ("Append of auth info failed.\n"));
1264                         goto err_exit;
1265                 }
1266         }
1267
1268         /*
1269          * Setup the lengths for the initial reply.
1270          */
1271
1272         p->out_data.data_sent_length = 0;
1273         p->out_data.current_pdu_sent = 0;
1274
1275         TALLOC_FREE(auth_blob.data);
1276         return True;
1277
1278   err_exit:
1279
1280         data_blob_free(&p->out_data.frag);
1281         TALLOC_FREE(auth_blob.data);
1282         return setup_bind_nak(p, pkt);
1283 }
1284
1285 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1286                        const struct api_struct *api_rpc_cmds, int n_cmds,
1287                        const struct ndr_syntax_id *syntax);
1288
1289 /****************************************************************************
1290  Find the correct RPC function to call for this request.
1291  If the pipe is authenticated then become the correct UNIX user
1292  before doing the call.
1293 ****************************************************************************/
1294
1295 static bool api_pipe_request(struct pipes_struct *p,
1296                                 struct ncacn_packet *pkt)
1297 {
1298         bool ret = False;
1299         struct pipe_rpc_fns *pipe_fns;
1300
1301         if (!p->pipe_bound) {
1302                 DEBUG(1, ("Pipe not bound!\n"));
1303                 data_blob_free(&p->out_data.rdata);
1304                 return false;
1305         }
1306
1307         if (!become_authenticated_pipe_user(p->session_info)) {
1308                 DEBUG(1, ("Failed to become pipe user!\n"));
1309                 data_blob_free(&p->out_data.rdata);
1310                 return false;
1311         }
1312
1313         /* get the set of RPC functions for this context */
1314
1315         pipe_fns = find_pipe_fns_by_context(p->contexts,
1316                                             pkt->u.request.context_id);
1317
1318         if ( pipe_fns ) {
1319                 TALLOC_CTX *frame = talloc_stackframe();
1320
1321                 DEBUG(5, ("Requested %s rpc service\n",
1322                           get_pipe_name_from_syntax(talloc_tos(), &pipe_fns->syntax)));
1323
1324                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds,
1325                                  &pipe_fns->syntax);
1326
1327                 TALLOC_FREE(frame);
1328         }
1329         else {
1330                 DEBUG(0, ("No rpc function table associated with context "
1331                           "[%d]\n",
1332                           pkt->u.request.context_id));
1333         }
1334
1335         unbecome_authenticated_pipe_user();
1336
1337         return ret;
1338 }
1339
1340 /*******************************************************************
1341  Calls the underlying RPC function for a named pipe.
1342  ********************************************************************/
1343
1344 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1345                        const struct api_struct *api_rpc_cmds, int n_cmds,
1346                        const struct ndr_syntax_id *syntax)
1347 {
1348         int fn_num;
1349         uint32_t offset1;
1350
1351         /* interpret the command */
1352         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1353                  get_pipe_name_from_syntax(talloc_tos(), syntax),
1354                  pkt->u.request.opnum));
1355
1356         if (DEBUGLEVEL >= 50) {
1357                 fstring name;
1358                 slprintf(name, sizeof(name)-1, "in_%s",
1359                          get_pipe_name_from_syntax(talloc_tos(), syntax));
1360                 dump_pdu_region(name, pkt->u.request.opnum,
1361                                 &p->in_data.data, 0,
1362                                 p->in_data.data.length);
1363         }
1364
1365         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1366                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1367                     api_rpc_cmds[fn_num].fn != NULL) {
1368                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1369                                   api_rpc_cmds[fn_num].name));
1370                         break;
1371                 }
1372         }
1373
1374         if (fn_num == n_cmds) {
1375                 /*
1376                  * For an unknown RPC just return a fault PDU but
1377                  * return True to allow RPC's on the pipe to continue
1378                  * and not put the pipe into fault state. JRA.
1379                  */
1380                 DEBUG(4, ("unknown\n"));
1381                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1382                 return True;
1383         }
1384
1385         offset1 = p->out_data.rdata.length;
1386
1387         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1388                 fn_num, api_rpc_cmds[fn_num].fn));
1389         /* do the actual command */
1390         if(!api_rpc_cmds[fn_num].fn(p)) {
1391                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1392                          get_pipe_name_from_syntax(talloc_tos(), syntax),
1393                          api_rpc_cmds[fn_num].name));
1394                 data_blob_free(&p->out_data.rdata);
1395                 return False;
1396         }
1397
1398         if (p->bad_handle_fault_state) {
1399                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1400                 p->bad_handle_fault_state = False;
1401                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
1402                 return True;
1403         }
1404
1405         if (p->rng_fault_state) {
1406                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
1407                 p->rng_fault_state = False;
1408                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1409                 return True;
1410         }
1411
1412         if (DEBUGLEVEL >= 50) {
1413                 fstring name;
1414                 slprintf(name, sizeof(name)-1, "out_%s",
1415                          get_pipe_name_from_syntax(talloc_tos(), syntax));
1416                 dump_pdu_region(name, pkt->u.request.opnum,
1417                                 &p->out_data.rdata, offset1,
1418                                 p->out_data.rdata.length);
1419         }
1420
1421         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1422                  get_pipe_name_from_syntax(talloc_tos(), syntax)));
1423
1424         /* Check for buffer underflow in rpc parsing */
1425         if ((DEBUGLEVEL >= 10) &&
1426             (pkt->frag_length < p->in_data.data.length)) {
1427                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1428                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1429                               p->in_data.data.length - pkt->frag_length);
1430         }
1431
1432         return True;
1433 }
1434
1435 /****************************************************************************
1436  Initialise an outgoing packet.
1437 ****************************************************************************/
1438
1439 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1440 {
1441         output_data *o_data = &p->out_data;
1442
1443         /* Reset the offset counters. */
1444         o_data->data_sent_length = 0;
1445         o_data->current_pdu_sent = 0;
1446
1447         data_blob_free(&o_data->frag);
1448
1449         /* Free any memory in the current return data buffer. */
1450         data_blob_free(&o_data->rdata);
1451
1452         return True;
1453 }
1454
1455 /****************************************************************************
1456  Sets the fault state on incoming packets.
1457 ****************************************************************************/
1458
1459 void set_incoming_fault(struct pipes_struct *p)
1460 {
1461         data_blob_free(&p->in_data.data);
1462         p->in_data.pdu_needed_len = 0;
1463         p->in_data.pdu.length = 0;
1464         p->fault_state = True;
1465
1466         DEBUG(10, ("Setting fault state\n"));
1467 }
1468
1469 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1470                                     struct ncacn_packet *pkt,
1471                                     DATA_BLOB *raw_pkt)
1472 {
1473         NTSTATUS status;
1474         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1475         size_t pad_len;
1476
1477         DEBUG(10, ("Checking request auth.\n"));
1478
1479         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1480                 hdr_size += 16;
1481         }
1482
1483         /* in case of sealing this function will unseal the data in place */
1484         status = dcerpc_check_auth(auth, pkt,
1485                                    &pkt->u.request.stub_and_verifier,
1486                                    hdr_size, raw_pkt,
1487                                    &pad_len);
1488         if (!NT_STATUS_IS_OK(status)) {
1489                 return status;
1490         }
1491
1492
1493         /* remove padding and auth trailer,
1494          * this way the caller will get just the data */
1495         if (pkt->auth_length) {
1496                 size_t trail_len = pad_len
1497                                         + DCERPC_AUTH_TRAILER_LENGTH
1498                                         + pkt->auth_length;
1499                 if (pkt->u.request.stub_and_verifier.length < trail_len) {
1500                         return NT_STATUS_INFO_LENGTH_MISMATCH;
1501                 }
1502                 pkt->u.request.stub_and_verifier.length -= trail_len;
1503         }
1504
1505         return NT_STATUS_OK;
1506 }
1507
1508 /****************************************************************************
1509  Processes a request pdu. This will do auth processing if needed, and
1510  appends the data into the complete stream if the LAST flag is not set.
1511 ****************************************************************************/
1512
1513 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1514 {
1515         NTSTATUS status;
1516         DATA_BLOB data;
1517
1518         if (!p->pipe_bound) {
1519                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1520                 set_incoming_fault(p);
1521                 return False;
1522         }
1523
1524         /* Store the opnum */
1525         p->opnum = pkt->u.request.opnum;
1526
1527         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1528         if (!NT_STATUS_IS_OK(status)) {
1529                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1530                           nt_errstr(status)));
1531                 set_incoming_fault(p);
1532                 return false;
1533         }
1534
1535         data = pkt->u.request.stub_and_verifier;
1536
1537         /*
1538          * Check the data length doesn't go over the 15Mb limit.
1539          * increased after observing a bug in the Windows NT 4.0 SP6a
1540          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1541          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1542          */
1543
1544         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1545                 DEBUG(0, ("process_request_pdu: "
1546                           "rpc data buffer too large (%u) + (%u)\n",
1547                           (unsigned int)p->in_data.data.length,
1548                           (unsigned int)data.length));
1549                 set_incoming_fault(p);
1550                 return False;
1551         }
1552
1553         /*
1554          * Append the data portion into the buffer and return.
1555          */
1556
1557         if (data.length) {
1558                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1559                                           data.data, data.length)) {
1560                         DEBUG(0, ("Unable to append data size %u "
1561                                   "to parse buffer of size %u.\n",
1562                                   (unsigned int)data.length,
1563                                   (unsigned int)p->in_data.data.length));
1564                         set_incoming_fault(p);
1565                         return False;
1566                 }
1567         }
1568
1569         if (pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1570                 bool ret = False;
1571                 /*
1572                  * Ok - we finally have a complete RPC stream.
1573                  * Call the rpc command to process it.
1574                  */
1575
1576                 /*
1577                  * Process the complete data stream here.
1578                  */
1579                 if (pipe_init_outgoing_data(p)) {
1580                         ret = api_pipe_request(p, pkt);
1581                 }
1582
1583                 return ret;
1584         }
1585
1586         return True;
1587 }
1588
1589 /****************************************************************************
1590  Processes a finished PDU stored in p->in_data.pdu.
1591 ****************************************************************************/
1592
1593 void process_complete_pdu(struct pipes_struct *p)
1594 {
1595         struct ncacn_packet *pkt = NULL;
1596         NTSTATUS status;
1597         bool reply = False;
1598
1599         if(p->fault_state) {
1600                 DEBUG(10,("RPC connection in fault state.\n"));
1601                 goto done;
1602         }
1603
1604         pkt = talloc(p->mem_ctx, struct ncacn_packet);
1605         if (!pkt) {
1606                 DEBUG(0, ("Out of memory!\n"));
1607                 goto done;
1608         }
1609
1610         /*
1611          * Ensure we're using the corrent endianness for both the
1612          * RPC header flags and the raw data we will be reading from.
1613          */
1614         if (dcerpc_get_endian_flag(&p->in_data.pdu) & DCERPC_DREP_LE) {
1615                 p->endian = RPC_LITTLE_ENDIAN;
1616         } else {
1617                 p->endian = RPC_BIG_ENDIAN;
1618         }
1619         DEBUG(10, ("PDU is in %s Endian format!\n", p->endian?"Big":"Little"));
1620
1621         status = dcerpc_pull_ncacn_packet(pkt, &p->in_data.pdu,
1622                                           pkt, p->endian);
1623         if (!NT_STATUS_IS_OK(status)) {
1624                 DEBUG(0, ("Failed to unmarshal rpc packet: %s!\n",
1625                           nt_errstr(status)));
1626                 goto done;
1627         }
1628
1629         /* Store the call_id */
1630         p->call_id = pkt->call_id;
1631
1632         DEBUG(10, ("Processing packet type %u\n", (unsigned int)pkt->ptype));
1633
1634         switch (pkt->ptype) {
1635         case DCERPC_PKT_REQUEST:
1636                 reply = process_request_pdu(p, pkt);
1637                 break;
1638
1639         case DCERPC_PKT_PING: /* CL request - ignore... */
1640                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1641                           (unsigned int)pkt->ptype));
1642                 break;
1643
1644         case DCERPC_PKT_RESPONSE: /* No responses here. */
1645                 DEBUG(0, ("Error - DCERPC_PKT_RESPONSE received from client"));
1646                 break;
1647
1648         case DCERPC_PKT_FAULT:
1649         case DCERPC_PKT_WORKING:
1650                 /* CL request - reply to a ping when a call in process. */
1651         case DCERPC_PKT_NOCALL:
1652                 /* CL - server reply to a ping call. */
1653         case DCERPC_PKT_REJECT:
1654         case DCERPC_PKT_ACK:
1655         case DCERPC_PKT_CL_CANCEL:
1656         case DCERPC_PKT_FACK:
1657         case DCERPC_PKT_CANCEL_ACK:
1658                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1659                           (unsigned int)pkt->ptype));
1660                 break;
1661
1662         case DCERPC_PKT_BIND:
1663                 /*
1664                  * We assume that a pipe bind is only in one pdu.
1665                  */
1666                 if (pipe_init_outgoing_data(p)) {
1667                         reply = api_pipe_bind_req(p, pkt);
1668                 }
1669                 break;
1670
1671         case DCERPC_PKT_BIND_ACK:
1672         case DCERPC_PKT_BIND_NAK:
1673                 DEBUG(0, ("Error - DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1674                           "packet type %u received.\n",
1675                           (unsigned int)pkt->ptype));
1676                 break;
1677
1678
1679         case DCERPC_PKT_ALTER:
1680                 /*
1681                  * We assume that a pipe bind is only in one pdu.
1682                  */
1683                 if (pipe_init_outgoing_data(p)) {
1684                         reply = api_pipe_alter_context(p, pkt);
1685                 }
1686                 break;
1687
1688         case DCERPC_PKT_ALTER_RESP:
1689                 DEBUG(0, ("Error - DCERPC_PKT_ALTER_RESP received: "
1690                           "Should only be server -> client.\n"));
1691                 break;
1692
1693         case DCERPC_PKT_AUTH3:
1694                 /*
1695                  * The third packet in an auth exchange.
1696                  */
1697                 if (pipe_init_outgoing_data(p)) {
1698                         reply = api_pipe_bind_auth3(p, pkt);
1699                 }
1700                 break;
1701
1702         case DCERPC_PKT_SHUTDOWN:
1703                 DEBUG(0, ("Error - DCERPC_PKT_SHUTDOWN received: "
1704                           "Should only be server -> client.\n"));
1705                 break;
1706
1707         case DCERPC_PKT_CO_CANCEL:
1708                 /* For now just free all client data and continue
1709                  * processing. */
1710                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1711                          " Abandoning rpc call.\n"));
1712                 /* As we never do asynchronous RPC serving, we can
1713                  * never cancel a call (as far as I know).
1714                  * If we ever did we'd have to send a cancel_ack reply.
1715                  * For now, just free all client data and continue
1716                  * processing. */
1717                 reply = True;
1718                 break;
1719
1720 #if 0
1721                 /* Enable this if we're doing async rpc. */
1722                 /* We must check the outstanding callid matches. */
1723                 if (pipe_init_outgoing_data(p)) {
1724                         /* Send a cancel_ack PDU reply. */
1725                         /* We should probably check the auth-verifier here. */
1726                         reply = setup_cancel_ack_reply(p, pkt);
1727                 }
1728                 break;
1729 #endif
1730
1731         case DCERPC_PKT_ORPHANED:
1732                 /* We should probably check the auth-verifier here.
1733                  * For now just free all client data and continue
1734                  * processing. */
1735                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
1736                           " Abandoning rpc call.\n"));
1737                 reply = True;
1738                 break;
1739
1740         default:
1741                 DEBUG(0, ("process_complete_pdu: "
1742                           "Unknown rpc type = %u received.\n",
1743                           (unsigned int)pkt->ptype));
1744                 break;
1745         }
1746
1747 done:
1748         if (!reply) {
1749                 DEBUG(3,("DCE/RPC fault sent!"));
1750                 set_incoming_fault(p);
1751                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1752                 TALLOC_FREE(pkt);
1753         } else {
1754                 /*
1755                  * Reset the lengths. We're ready for a new pdu.
1756                  */
1757                 TALLOC_FREE(p->in_data.pdu.data);
1758                 p->in_data.pdu_needed_len = 0;
1759                 p->in_data.pdu.length = 0;
1760         }
1761
1762         TALLOC_FREE(pkt);
1763 }
1764