source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "system/filesys.h"
  32 #include "srv_pipe_internal.h"
  33 #include "../librpc/gen_ndr/ndr_schannel.h"
  34 #include "../libcli/auth/schannel.h"
  35 #include "../libcli/auth/spnego.h"
  36 #include "dcesrv_auth_generic.h"
  37 #include "dcesrv_gssapi.h"
  38 #include "dcesrv_spnego.h"
  39 #include "rpc_server.h"
  40 #include "rpc_dce.h"
  41 #include "smbd/smbd.h"
  42 #include "auth.h"
  43 #include "ntdomain.h"
  44 #include "rpc_server/srv_pipe.h"
  45 #include "rpc_server/rpc_contexts.h"
  46 #include "lib/param/param.h"
  47
  48 #undef DBGC_CLASS
  49 #define DBGC_CLASS DBGC_RPC_SRV
  50
  51 /**
  52  * Dump everything from the start of the end up of the provided data
  53  * into a file, but only at debug level >= 50
  54  **/
  55 static void dump_pdu_region(const char *name, int v,
  56                             DATA_BLOB *data, size_t start, size_t end)
  57 {
  58         int fd, i;
  59         char *fname = NULL;
  60         ssize_t sz;
  61
  62         if (DEBUGLEVEL < 50) return;
  63
  64         if (start > data->length || end > data->length || start > end) return;
  65
  66         for (i = 1; i < 100; i++) {
  67                 if (v != -1) {
  68                         fname = talloc_asprintf(talloc_tos(),
  69                                                 "/tmp/%s_%d.%d.prs",
  70                                                 name, v, i);
  71                 } else {
  72                         fname = talloc_asprintf(talloc_tos(),
  73                                                 "/tmp/%s_%d.prs",
  74                                                 name, i);
  75                 }
  76                 if (!fname) {
  77                         return;
  78                 }
  79                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  80                 if (fd != -1 || errno != EEXIST) break;
  81         }
  82         if (fd != -1) {
  83                 sz = write(fd, data->data + start, end - start);
  84                 i = close(fd);
  85                 if ((sz != end - start) || (i != 0) ) {
  86                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  87                                   fname, (unsigned long)sz,
  88                                   (unsigned long)end - start, i));
  89                 } else {
  90                         DEBUG(0,("created %s\n", fname));
  91                 }
  92         }
  93         TALLOC_FREE(fname);
  94 }
  95
  96 static DATA_BLOB generic_session_key(void)
  97 {
  98         return data_blob_const("SystemLibraryDTC", 16);
  99 }
 100
 101 /*******************************************************************
 102  Generate the next PDU to be returned from the data.
 103 ********************************************************************/
 104
 105 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
 106                                    struct pipe_auth_data *auth,
 107                                    uint32_t call_id,
 108                                    DATA_BLOB *rdata,
 109                                    size_t data_sent_length,
 110                                    DATA_BLOB *frag,
 111                                    size_t *pdu_size)
 112 {
 113         union dcerpc_payload u;
 114         uint8_t pfc_flags;
 115         size_t data_left;
 116         size_t data_to_send;
 117         size_t frag_len;
 118         size_t pad_len = 0;
 119         size_t auth_len = 0;
 120         NTSTATUS status;
 121
 122         ZERO_STRUCT(u.response);
 123
 124         /* Set up rpc packet pfc flags. */
 125         if (data_sent_length == 0) {
 126                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 127         } else {
 128                 pfc_flags = 0;
 129         }
 130
 131         /* Work out how much we can fit in a single PDU. */
 132         data_left = rdata->length - data_sent_length;
 133
 134         /* Ensure there really is data left to send. */
 135         if (!data_left) {
 136                 DEBUG(0, ("No data left to send !\n"));
 137                 return NT_STATUS_BUFFER_TOO_SMALL;
 138         }
 139
 140         status = dcerpc_guess_sizes(auth,
 141                                     DCERPC_RESPONSE_LENGTH,
 142                                     data_left,
 143                                     RPC_MAX_PDU_FRAG_LEN,
 144                                     SERVER_NDR_PADDING_SIZE,
 145                                     &data_to_send, &frag_len,
 146                                     &auth_len, &pad_len);
 147         if (!NT_STATUS_IS_OK(status)) {
 148                 return status;
 149         }
 150
 151         /* Set up the alloc hint. This should be the data left to send. */
 152         u.response.alloc_hint = data_left;
 153
 154         /* Work out if this PDU will be the last. */
 155         if (data_sent_length + data_to_send >= rdata->length) {
 156                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 157         }
 158
 159         /* Prepare data to be NDR encoded. */
 160         u.response.stub_and_verifier =
 161                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 162
 163         /* Store the packet in the data stream. */
 164         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 165                                           pfc_flags, auth_len, call_id,
 166                                           &u, frag);
 167         if (!NT_STATUS_IS_OK(status)) {
 168                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 169                 return status;
 170         }
 171
 172         if (auth_len) {
 173                 /* Set the proper length on the pdu, including padding.
 174                  * Only needed if an auth trailer will be appended. */
 175                 dcerpc_set_frag_length(frag, frag->length
 176                                                 + pad_len
 177                                                 + DCERPC_AUTH_TRAILER_LENGTH
 178                                                 + auth_len);
 179         }
 180
 181         if (auth_len) {
 182                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 183                 if (!NT_STATUS_IS_OK(status)) {
 184                         data_blob_free(frag);
 185                         return status;
 186                 }
 187         }
 188
 189         *pdu_size = data_to_send;
 190         return NT_STATUS_OK;
 191 }
 192
 193 /*******************************************************************
 194  Generate the next PDU to be returned from the data in p->rdata.
 195 ********************************************************************/
 196
 197 bool create_next_pdu(struct pipes_struct *p)
 198 {
 199         size_t pdu_size = 0;
 200         NTSTATUS status;
 201
 202         /*
 203          * If we're in the fault state, keep returning fault PDU's until
 204          * the pipe gets closed. JRA.
 205          */
 206         if (p->fault_state) {
 207                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 208                 return true;
 209         }
 210
 211         status = create_next_packet(p->mem_ctx, &p->auth,
 212                                     p->call_id, &p->out_data.rdata,
 213                                     p->out_data.data_sent_length,
 214                                     &p->out_data.frag, &pdu_size);
 215         if (!NT_STATUS_IS_OK(status)) {
 216                 DEBUG(0, ("Failed to create packet with error %s, "
 217                           "(auth level %u / type %u)\n",
 218                           nt_errstr(status),
 219                           (unsigned int)p->auth.auth_level,
 220                           (unsigned int)p->auth.auth_type));
 221                 return false;
 222         }
 223
 224         /* Setup the counts for this PDU. */
 225         p->out_data.data_sent_length += pdu_size;
 226         p->out_data.current_pdu_sent = 0;
 227         return true;
 228 }
 229
 230
 231 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 232
 233 /*******************************************************************
 234  Marshall a bind_nak pdu.
 235 *******************************************************************/
 236
 237 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 238 {
 239         NTSTATUS status;
 240         union dcerpc_payload u;
 241
 242         /* Free any memory in the current return data buffer. */
 243         pipe_init_outgoing_data(p);
 244
 245         /*
 246          * Initialize a bind_nak header.
 247          */
 248
 249         ZERO_STRUCT(u);
 250
 251         u.bind_nak.reject_reason  = 0;
 252
 253         /*
 254          * Marshall directly into the outgoing PDU space. We
 255          * must do this as we need to set to the bind response
 256          * header and are never sending more than one PDU here.
 257          */
 258
 259         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 260                                           DCERPC_PKT_BIND_NAK,
 261                                           DCERPC_PFC_FLAG_FIRST |
 262                                                 DCERPC_PFC_FLAG_LAST,
 263                                           0,
 264                                           pkt->call_id,
 265                                           &u,
 266                                           &p->out_data.frag);
 267         if (!NT_STATUS_IS_OK(status)) {
 268                 return False;
 269         }
 270
 271         p->out_data.data_sent_length = 0;
 272         p->out_data.current_pdu_sent = 0;
 273
 274         TALLOC_FREE(p->auth.auth_ctx);
 275         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 276         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 277         p->pipe_bound = False;
 278
 279         return True;
 280 }
 281
 282 /*******************************************************************
 283  Marshall a fault pdu.
 284 *******************************************************************/
 285
 286 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 287 {
 288         NTSTATUS status;
 289         union dcerpc_payload u;
 290
 291         /* Free any memory in the current return data buffer. */
 292         pipe_init_outgoing_data(p);
 293
 294         /*
 295          * Initialize a fault header.
 296          */
 297
 298         ZERO_STRUCT(u);
 299
 300         u.fault.status          = NT_STATUS_V(fault_status);
 301         u.fault._pad            = data_blob_talloc_zero(p->mem_ctx, 4);
 302
 303         /*
 304          * Marshall directly into the outgoing PDU space. We
 305          * must do this as we need to set to the bind response
 306          * header and are never sending more than one PDU here.
 307          */
 308
 309         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 310                                           DCERPC_PKT_FAULT,
 311                                           DCERPC_PFC_FLAG_FIRST |
 312                                            DCERPC_PFC_FLAG_LAST |
 313                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 314                                           0,
 315                                           p->call_id,
 316                                           &u,
 317                                           &p->out_data.frag);
 318         if (!NT_STATUS_IS_OK(status)) {
 319                 return False;
 320         }
 321
 322         p->out_data.data_sent_length = 0;
 323         p->out_data.current_pdu_sent = 0;
 324
 325         return True;
 326 }
 327
 328 /*******************************************************************
 329  Ensure a bind request has the correct abstract & transfer interface.
 330  Used to reject unknown binds from Win2k.
 331 *******************************************************************/
 332
 333 static bool check_bind_req(struct pipes_struct *p,
 334                            struct ndr_syntax_id* abstract,
 335                            struct ndr_syntax_id* transfer,
 336                            uint32_t context_id)
 337 {
 338         struct pipe_rpc_fns *context_fns;
 339         bool ok;
 340
 341         DEBUG(3,("check_bind_req for %s\n",
 342                  get_pipe_name_from_syntax(talloc_tos(), abstract)));
 343
 344         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 345         if (rpc_srv_pipe_exists_by_id(abstract) &&
 346            ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
 347                 DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
 348                           rpc_srv_get_pipe_cli_name(abstract),
 349                           rpc_srv_get_pipe_srv_name(abstract)));
 350         } else {
 351                 return false;
 352         }
 353
 354         ok = init_pipe_handles(p, abstract);
 355         if (!ok) {
 356                 DEBUG(1, ("Failed to init pipe handles!\n"));
 357                 return false;
 358         }
 359
 360         context_fns = talloc(p, struct pipe_rpc_fns);
 361         if (context_fns == NULL) {
 362                 DEBUG(0,("check_bind_req: talloc() failed!\n"));
 363                 return false;
 364         }
 365
 366         context_fns->next = context_fns->prev = NULL;
 367         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 368         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 369         context_fns->context_id = context_id;
 370         context_fns->syntax = *abstract;
 371
 372         /* add to the list of open contexts */
 373
 374         DLIST_ADD( p->contexts, context_fns );
 375
 376         return True;
 377 }
 378
 379 /**
 380  * Is a named pipe known?
 381  * @param[in] cli_filename      The pipe name requested by the client
 382  * @result                      Do we want to serve this?
 383  */
 384 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
 385 {
 386         const char *pipename = cli_filename;
 387         NTSTATUS status;
 388
 389         if (strnequal(pipename, "\\PIPE\\", 6)) {
 390                 pipename += 5;
 391         }
 392
 393         if (*pipename == '\\') {
 394                 pipename += 1;
 395         }
 396
 397         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 398                 DEBUG(10, ("refusing spoolss access\n"));
 399                 return false;
 400         }
 401
 402         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 403                 return true;
 404         }
 405
 406         status = smb_probe_module("rpc", pipename);
 407         if (!NT_STATUS_IS_OK(status)) {
 408                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
 409                 return false;
 410         }
 411         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 412
 413         /*
 414          * Scan the list again for the interface id
 415          */
 416         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 417                 return true;
 418         }
 419
 420         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 421                    pipename));
 422
 423         return false;
 424 }
 425
 426 /*******************************************************************
 427  Handle the first part of a SPNEGO bind auth.
 428 *******************************************************************/
 429
 430 static bool pipe_spnego_auth_bind(struct pipes_struct *p,
 431                                   TALLOC_CTX *mem_ctx,
 432                                   struct dcerpc_auth *auth_info,
 433                                   DATA_BLOB *response)
 434 {
 435         struct spnego_context *spnego_ctx;
 436         NTSTATUS status;
 437
 438         status = spnego_server_auth_start(p,
 439                                           (auth_info->auth_level ==
 440                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 441                                           (auth_info->auth_level ==
 442                                                 DCERPC_AUTH_LEVEL_PRIVACY),
 443                                           true,
 444                                           &auth_info->credentials,
 445                                           response,
 446                                           p->remote_address,
 447                                           &spnego_ctx);
 448         if (!NT_STATUS_IS_OK(status)) {
 449                 DEBUG(0, ("Failed SPNEGO negotiate (%s)\n",
 450                           nt_errstr(status)));
 451                 return false;
 452         }
 453
 454         /* Make sure data is bound to the memctx, to be freed the caller */
 455         talloc_steal(mem_ctx, response->data);
 456
 457         p->auth.auth_ctx = spnego_ctx;
 458         p->auth.auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 459
 460         DEBUG(10, ("SPNEGO auth started\n"));
 461
 462         return true;
 463 }
 464
 465 /*******************************************************************
 466  Handle an schannel bind auth.
 467 *******************************************************************/
 468
 469 static bool pipe_schannel_auth_bind(struct pipes_struct *p,
 470                                     TALLOC_CTX *mem_ctx,
 471                                     struct dcerpc_auth *auth_info,
 472                                     DATA_BLOB *response)
 473 {
 474         struct NL_AUTH_MESSAGE neg;
 475         struct NL_AUTH_MESSAGE reply;
 476         bool ret;
 477         NTSTATUS status;
 478         struct netlogon_creds_CredentialState *creds;
 479         enum ndr_err_code ndr_err;
 480         struct schannel_state *schannel_auth;
 481         struct loadparm_context *lp_ctx;
 482
 483         ndr_err = ndr_pull_struct_blob(
 484                         &auth_info->credentials, mem_ctx, &neg,
 485                         (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
 486         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 487                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
 488                 return false;
 489         }
 490
 491         if (DEBUGLEVEL >= 10) {
 492                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
 493         }
 494
 495         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
 496                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
 497                 return false;
 498         }
 499
 500         lp_ctx = loadparm_init_s3(p, loadparm_s3_context());
 501         if (!lp_ctx) {
 502                 DEBUG(0,("pipe_schannel_auth_bind: loadparm_init_s3() failed!\n"));
 503                 return false;
 504         }
 505
 506         /*
 507          * The neg.oem_netbios_computer.a key here must match the remote computer name
 508          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
 509          * operations that use credentials.
 510          */
 511
 512         become_root();
 513         status = schannel_get_creds_state(p, lp_ctx,
 514                                             neg.oem_netbios_computer.a, &creds);
 515         unbecome_root();
 516
 517         talloc_unlink(p, lp_ctx);
 518         if (!NT_STATUS_IS_OK(status)) {
 519                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
 520                 return False;
 521         }
 522
 523         schannel_auth = talloc(p, struct schannel_state);
 524         if (!schannel_auth) {
 525                 TALLOC_FREE(creds);
 526                 return False;
 527         }
 528
 529         schannel_auth->state = SCHANNEL_STATE_START;
 530         schannel_auth->seq_num = 0;
 531         schannel_auth->initiator = false;
 532         schannel_auth->creds = creds;
 533
 534         /*
 535          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
 536          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
 537          * struct of the person who opened the pipe. I need to test this further. JRA.
 538          *
 539          * VL. As we are mapping this to guest set the generic key
 540          * "SystemLibraryDTC" key here. It's a bit difficult to test against
 541          * W2k3, as it does not allow schannel binds against SAMR and LSA
 542          * anymore.
 543          */
 544
 545         ret = session_info_set_session_key(p->session_info, generic_session_key());
 546
 547         if (!ret) {
 548                 DEBUG(0, ("session_info_set_session_key failed\n"));
 549                 return false;
 550         }
 551
 552         /*** SCHANNEL verifier ***/
 553
 554         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
 555         reply.Flags                             = 0;
 556         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
 557                                                       * this has any meaning
 558                                                       * here - gd */
 559
 560         ndr_err = ndr_push_struct_blob(response, mem_ctx, &reply,
 561                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
 562         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 563                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
 564                 return false;
 565         }
 566
 567         if (DEBUGLEVEL >= 10) {
 568                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
 569         }
 570
 571         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
 572                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
 573
 574         /* We're finished with this bind - no more packets. */
 575         p->auth.auth_ctx = schannel_auth;
 576         p->auth.auth_type = DCERPC_AUTH_TYPE_SCHANNEL;
 577
 578         p->pipe_bound = True;
 579
 580         return True;
 581 }
 582
 583 /*******************************************************************
 584  Handle an NTLMSSP bind auth.
 585 *******************************************************************/
 586
 587 static bool pipe_auth_generic_bind(struct pipes_struct *p,
 588                                    TALLOC_CTX *mem_ctx,
 589                                    struct dcerpc_auth *auth_info,
 590                                    DATA_BLOB *response)
 591 {
 592         struct gensec_security *gensec_security = NULL;
 593         NTSTATUS status;
 594
 595         status = auth_generic_server_authtype_start(p,
 596                                                     auth_info->auth_type,
 597                                                     auth_info->auth_level,
 598                                                     &auth_info->credentials,
 599                                                     response,
 600                                                     p->remote_address,
 601                                                     &gensec_security);
 602         if (!NT_STATUS_EQUAL(status, NT_STATUS_OK)) {
 603                 DEBUG(0, (__location__ ": auth_generic_server_authtype_start failed: %s\n",
 604                           nt_errstr(status)));
 605                 return false;
 606         }
 607
 608         /* Make sure data is bound to the memctx, to be freed the caller */
 609         talloc_steal(mem_ctx, response->data);
 610
 611         p->auth.auth_ctx = gensec_security;
 612         p->auth.auth_type = auth_info->auth_type;
 613
 614         return true;
 615 }
 616
 617 /*******************************************************************
 618  Process an NTLMSSP authentication response.
 619  If this function succeeds, the user has been authenticated
 620  and their domain, name and calling workstation stored in
 621  the pipe struct.
 622 *******************************************************************/
 623
 624 static bool pipe_auth_generic_verify_final(TALLOC_CTX *mem_ctx,
 625                                 struct gensec_security *gensec_security,
 626                                 enum dcerpc_AuthLevel auth_level,
 627                                 struct auth_session_info **session_info)
 628 {
 629         NTSTATUS status;
 630         bool ret;
 631
 632         DEBUG(5, (__location__ ": checking user details\n"));
 633
 634         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 635            ensure the underlying NTLMSSP flags are also set. If not we should
 636            refuse the bind. */
 637
 638         status = auth_generic_server_check_flags(gensec_security,
 639                                             (auth_level ==
 640                                                 DCERPC_AUTH_LEVEL_INTEGRITY),
 641                                             (auth_level ==
 642                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 643         if (!NT_STATUS_IS_OK(status)) {
 644                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 645                           "security for rpc connection\n"));
 646                 return false;
 647         }
 648
 649         TALLOC_FREE(*session_info);
 650
 651         status = auth_generic_server_get_user_info(gensec_security,
 652                                                 mem_ctx, session_info);
 653         if (!NT_STATUS_IS_OK(status)) {
 654                 DEBUG(0, (__location__ ": failed to obtain the server info "
 655                           "for authenticated user: %s\n", nt_errstr(status)));
 656                 return false;
 657         }
 658
 659         if ((*session_info)->security_token == NULL) {
 660                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 661                 return false;
 662         }
 663
 664         /*
 665          * We're an authenticated bind over smb, so the session key needs to
 666          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 667          * does. See the RPC-SAMBA3SESSIONKEY.
 668          */
 669
 670         ret = session_info_set_session_key((*session_info), generic_session_key());
 671         if (!ret) {
 672                 DEBUG(0, ("Failed to set session key!\n"));
 673                 return false;
 674         }
 675
 676         return true;
 677 }
 678
 679 static NTSTATUS pipe_gssapi_verify_final(TALLOC_CTX *mem_ctx,
 680                                          struct gse_context *gse_ctx,
 681                                          const struct tsocket_address *remote_address,
 682                                          struct auth_session_info **session_info)
 683 {
 684         NTSTATUS status;
 685         bool bret;
 686
 687         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 688            ensure the underlying flags are also set. If not we should
 689            refuse the bind. */
 690
 691         status = gssapi_server_check_flags(gse_ctx);
 692         if (!NT_STATUS_IS_OK(status)) {
 693                 DEBUG(0, ("Requested Security Layers not honored!\n"));
 694                 return status;
 695         }
 696
 697         status = gssapi_server_get_user_info(gse_ctx, mem_ctx,
 698                                              remote_address, session_info);
 699         if (!NT_STATUS_IS_OK(status)) {
 700                 DEBUG(0, (__location__ ": failed to obtain the server info "
 701                           "for authenticated user: %s\n", nt_errstr(status)));
 702                 return status;
 703         }
 704
 705         /*
 706          * We're an authenticated bind over smb, so the session key needs to
 707          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 708          * does. See the RPC-SAMBA3SESSIONKEY.
 709          */
 710
 711         bret = session_info_set_session_key((*session_info), generic_session_key());
 712         if (!bret) {
 713                 return NT_STATUS_ACCESS_DENIED;
 714         }
 715
 716         return NT_STATUS_OK;
 717 }
 718
 719 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 720 {
 721         enum spnego_mech auth_type;
 722         struct gensec_security *gensec_security;
 723         struct spnego_context *spnego_ctx;
 724         struct gse_context *gse_ctx;
 725         void *mech_ctx;
 726         NTSTATUS status;
 727
 728         switch (p->auth.auth_type) {
 729         case DCERPC_AUTH_TYPE_NTLMSSP:
 730         case DCERPC_AUTH_TYPE_KRB5:
 731                 gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
 732                                                         struct gensec_security);
 733                 if (!pipe_auth_generic_verify_final(p, gensec_security,
 734                                                 p->auth.auth_level,
 735                                                 &p->session_info)) {
 736                         return NT_STATUS_ACCESS_DENIED;
 737                 }
 738                 break;
 739         case DCERPC_AUTH_TYPE_SPNEGO:
 740                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
 741                                                    struct spnego_context);
 742                 status = spnego_get_negotiated_mech(spnego_ctx,
 743                                                     &auth_type, &mech_ctx);
 744                 if (!NT_STATUS_IS_OK(status)) {
 745                         DEBUG(0, ("Bad SPNEGO state (%s)\n",
 746                                   nt_errstr(status)));
 747                         return status;
 748                 }
 749                 switch(auth_type) {
 750                 case SPNEGO_KRB5:
 751                         gse_ctx = talloc_get_type_abort(mech_ctx,
 752                                                         struct gse_context);
 753                         status = pipe_gssapi_verify_final(p, gse_ctx,
 754                                                           p->remote_address,
 755                                                           &p->session_info);
 756                         if (!NT_STATUS_IS_OK(status)) {
 757                                 DEBUG(1, ("gssapi bind failed with: %s",
 758                                           nt_errstr(status)));
 759                                 return status;
 760                         }
 761                         break;
 762                 case SPNEGO_NTLMSSP:
 763                         gensec_security = talloc_get_type_abort(mech_ctx,
 764                                                 struct gensec_security);
 765                         if (!pipe_auth_generic_verify_final(p, gensec_security,
 766                                                         p->auth.auth_level,
 767                                                         &p->session_info)) {
 768                                 return NT_STATUS_ACCESS_DENIED;
 769                         }
 770                         break;
 771                 default:
 772                         DEBUG(0, (__location__ ": incorrect spnego type "
 773                                   "(%d).\n", auth_type));
 774                         return NT_STATUS_ACCESS_DENIED;
 775                 }
 776                 break;
 777         default:
 778                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
 779                           (unsigned int)p->auth.auth_type));
 780                 return NT_STATUS_ACCESS_DENIED;
 781         }
 782
 783         p->pipe_bound = true;
 784
 785         return NT_STATUS_OK;
 786 }
 787
 788 /*******************************************************************
 789  Respond to a pipe bind request.
 790 *******************************************************************/
 791
 792 static bool api_pipe_bind_req(struct pipes_struct *p,
 793                                 struct ncacn_packet *pkt)
 794 {
 795         struct dcerpc_auth auth_info;
 796         uint16 assoc_gid;
 797         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
 798         NTSTATUS status;
 799         struct ndr_syntax_id id;
 800         union dcerpc_payload u;
 801         struct dcerpc_ack_ctx bind_ack_ctx;
 802         DATA_BLOB auth_resp = data_blob_null;
 803         DATA_BLOB auth_blob = data_blob_null;
 804
 805         /* No rebinds on a bound pipe - use alter context. */
 806         if (p->pipe_bound) {
 807                 DEBUG(2,("Rejecting bind request on bound rpc connection\n"));
 808                 return setup_bind_nak(p, pkt);
 809         }
 810
 811         if (pkt->u.bind.num_contexts == 0) {
 812                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
 813                 goto err_exit;
 814         }
 815
 816         /*
 817          * Try and find the correct pipe name to ensure
 818          * that this is a pipe name we support.
 819          */
 820         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 821         if (rpc_srv_pipe_exists_by_id(&id)) {
 822                 DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 823                           rpc_srv_get_pipe_cli_name(&id),
 824                           rpc_srv_get_pipe_srv_name(&id)));
 825         } else {
 826                 status = smb_probe_module(
 827                         "rpc", get_pipe_name_from_syntax(
 828                                 talloc_tos(),
 829                                 &id));
 830
 831                 if (NT_STATUS_IS_ERR(status)) {
 832                         DEBUG(3,("api_pipe_bind_req: Unknown rpc service name "
 833                                  "%s in bind request.\n",
 834                                  get_pipe_name_from_syntax(talloc_tos(), &id)));
 835
 836                         return setup_bind_nak(p, pkt);
 837                 }
 838
 839                 if (rpc_srv_get_pipe_interface_by_cli_name(
 840                                 get_pipe_name_from_syntax(talloc_tos(),
 841                                                           &id),
 842                                 &id)) {
 843                         DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 844                                   rpc_srv_get_pipe_cli_name(&id),
 845                                   rpc_srv_get_pipe_srv_name(&id)));
 846                 } else {
 847                         DEBUG(0, ("module %s doesn't provide functions for "
 848                                   "pipe %s!\n",
 849                                   get_pipe_name_from_syntax(talloc_tos(), &id),
 850                                   get_pipe_name_from_syntax(talloc_tos(), &id)));
 851                         return setup_bind_nak(p, pkt);
 852                 }
 853         }
 854
 855         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 856
 857         if (pkt->u.bind.assoc_group_id != 0) {
 858                 assoc_gid = pkt->u.bind.assoc_group_id;
 859         } else {
 860                 assoc_gid = 0x53f0;
 861         }
 862
 863         /*
 864          * Create the bind response struct.
 865          */
 866
 867         /* If the requested abstract synt uuid doesn't match our client pipe,
 868                 reject the bind_ack & set the transfer interface synt to all 0's,
 869                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 870                 unknown to NT4)
 871                 Needed when adding entries to a DACL from NT5 - SK */
 872
 873         if (check_bind_req(p,
 874                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 875                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 876                         pkt->u.bind.ctx_list[0].context_id)) {
 877
 878                 bind_ack_ctx.result = 0;
 879                 bind_ack_ctx.reason = 0;
 880                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 881         } else {
 882                 p->pipe_bound = False;
 883                 /* Rejection reason: abstract syntax not supported */
 884                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 885                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
 886                 bind_ack_ctx.syntax = null_ndr_syntax_id;
 887         }
 888
 889         /*
 890          * Check if this is an authenticated bind request.
 891          */
 892         if (pkt->auth_length) {
 893                 /* Quick length check. Won't catch a bad auth footer,
 894                  * prevents overrun. */
 895
 896                 if (pkt->frag_length < RPC_HEADER_LEN +
 897                                         DCERPC_AUTH_TRAILER_LENGTH +
 898                                         pkt->auth_length) {
 899                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
 900                                 "too long for fragment %u.\n",
 901                                 (unsigned int)pkt->auth_length,
 902                                 (unsigned int)pkt->frag_length));
 903                         goto err_exit;
 904                 }
 905
 906                 /*
 907                  * Decode the authentication verifier.
 908                  */
 909                 status = dcerpc_pull_dcerpc_auth(pkt,
 910                                                  &pkt->u.bind.auth_info,
 911                                                  &auth_info, p->endian);
 912                 if (!NT_STATUS_IS_OK(status)) {
 913                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
 914                         goto err_exit;
 915                 }
 916
 917                 auth_type = auth_info.auth_type;
 918
 919                 /* Work out if we have to sign or seal etc. */
 920                 switch (auth_info.auth_level) {
 921                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 922                         p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 923                         break;
 924                 case DCERPC_AUTH_LEVEL_PRIVACY:
 925                         p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 926                         break;
 927                 case DCERPC_AUTH_LEVEL_CONNECT:
 928                         p->auth.auth_level = DCERPC_AUTH_LEVEL_CONNECT;
 929                         break;
 930                 default:
 931                         DEBUG(0, ("Unexpected auth level (%u).\n",
 932                                 (unsigned int)auth_info.auth_level ));
 933                         goto err_exit;
 934                 }
 935
 936                 switch (auth_type) {
 937                 case DCERPC_AUTH_TYPE_NTLMSSP:
 938                         if (!pipe_auth_generic_bind(p, pkt,
 939                                                     &auth_info, &auth_resp)) {
 940                                 goto err_exit;
 941                         }
 942                         assoc_gid = 0x7a77;
 943                         break;
 944
 945                 case DCERPC_AUTH_TYPE_SCHANNEL:
 946                         if (!pipe_schannel_auth_bind(p, pkt,
 947                                                 &auth_info, &auth_resp)) {
 948                                 goto err_exit;
 949                         }
 950                         break;
 951
 952                 case DCERPC_AUTH_TYPE_SPNEGO:
 953                         if (!pipe_spnego_auth_bind(p, pkt,
 954                                                 &auth_info, &auth_resp)) {
 955                                 goto err_exit;
 956                         }
 957                         break;
 958
 959                 case DCERPC_AUTH_TYPE_KRB5:
 960                         if (!pipe_auth_generic_bind(p, pkt,
 961                                                     &auth_info, &auth_resp)) {
 962                                 goto err_exit;
 963                         }
 964                         break;
 965
 966                 case DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM:
 967                         if (p->transport == NCALRPC && p->ncalrpc_as_system) {
 968                                 TALLOC_FREE(p->session_info);
 969
 970                                 status = make_session_info_system(p,
 971                                                                   &p->session_info);
 972                                 if (!NT_STATUS_IS_OK(status)) {
 973                                         goto err_exit;
 974                                 }
 975
 976                                 auth_resp = data_blob_talloc(pkt,
 977                                                              "NCALRPC_AUTH_OK",
 978                                                              15);
 979
 980                                 p->auth.auth_type = DCERPC_AUTH_TYPE_NCALRPC_AS_SYSTEM;
 981                                 p->pipe_bound = true;
 982                         } else {
 983                                 goto err_exit;
 984                         }
 985                         break;
 986
 987                 case DCERPC_AUTH_TYPE_NONE:
 988                         break;
 989
 990                 default:
 991                         DEBUG(0, ("Unknown auth type %x requested.\n", auth_type));
 992                         goto err_exit;
 993                 }
 994         }
 995
 996         if (auth_type == DCERPC_AUTH_TYPE_NONE) {
 997                 /* Unauthenticated bind request. */
 998                 /* We're finished - no more packets. */
 999                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
1000                 /* We must set the pipe auth_level here also. */
1001                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1002                 p->pipe_bound = True;
1003                 /* The session key was initialized from the SMB
1004                  * session in make_internal_rpc_pipe_p */
1005         }
1006
1007         ZERO_STRUCT(u.bind_ack);
1008         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1009         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1010         u.bind_ack.assoc_group_id = assoc_gid;
1011
1012         /* name has to be \PIPE\xxxxx */
1013         u.bind_ack.secondary_address =
1014                         talloc_asprintf(pkt, "\\PIPE\\%s",
1015                                         rpc_srv_get_pipe_srv_name(&id));
1016         if (!u.bind_ack.secondary_address) {
1017                 DEBUG(0, ("Out of memory!\n"));
1018                 goto err_exit;
1019         }
1020         u.bind_ack.secondary_address_size =
1021                                 strlen(u.bind_ack.secondary_address) + 1;
1022
1023         u.bind_ack.num_results = 1;
1024         u.bind_ack.ctx_list = &bind_ack_ctx;
1025
1026         /* NOTE: We leave the auth_info empty so we can calculate the padding
1027          * later and then append the auth_info --simo */
1028
1029         /*
1030          * Marshall directly into the outgoing PDU space. We
1031          * must do this as we need to set to the bind response
1032          * header and are never sending more than one PDU here.
1033          */
1034
1035         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1036                                           DCERPC_PKT_BIND_ACK,
1037                                           DCERPC_PFC_FLAG_FIRST |
1038                                                 DCERPC_PFC_FLAG_LAST,
1039                                           auth_resp.length,
1040                                           pkt->call_id,
1041                                           &u,
1042                                           &p->out_data.frag);
1043         if (!NT_STATUS_IS_OK(status)) {
1044                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1045                           nt_errstr(status)));
1046         }
1047
1048         if (auth_resp.length) {
1049
1050                 status = dcerpc_push_dcerpc_auth(pkt,
1051                                                  auth_type,
1052                                                  auth_info.auth_level,
1053                                                  0,
1054                                                  1, /* auth_context_id */
1055                                                  &auth_resp,
1056                                                  &auth_blob);
1057                 if (!NT_STATUS_IS_OK(status)) {
1058                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1059                         goto err_exit;
1060                 }
1061         }
1062
1063         /* Now that we have the auth len store it into the right place in
1064          * the dcerpc header */
1065         dcerpc_set_frag_length(&p->out_data.frag,
1066                                 p->out_data.frag.length + auth_blob.length);
1067
1068         if (auth_blob.length) {
1069
1070                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1071                                         auth_blob.data, auth_blob.length)) {
1072                         DEBUG(0, ("Append of auth info failed.\n"));
1073                         goto err_exit;
1074                 }
1075         }
1076
1077         /*
1078          * Setup the lengths for the initial reply.
1079          */
1080
1081         p->out_data.data_sent_length = 0;
1082         p->out_data.current_pdu_sent = 0;
1083
1084         TALLOC_FREE(auth_blob.data);
1085         return True;
1086
1087   err_exit:
1088
1089         data_blob_free(&p->out_data.frag);
1090         TALLOC_FREE(auth_blob.data);
1091         return setup_bind_nak(p, pkt);
1092 }
1093
1094 /*******************************************************************
1095  This is the "stage3" response after a bind request and reply.
1096 *******************************************************************/
1097
1098 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
1099 {
1100         struct dcerpc_auth auth_info;
1101         DATA_BLOB response = data_blob_null;
1102         struct gensec_security *gensec_security;
1103         struct spnego_context *spnego_ctx;
1104         NTSTATUS status;
1105
1106         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
1107
1108         if (pkt->auth_length == 0) {
1109                 DEBUG(0, ("No auth field sent for bind request!\n"));
1110                 goto err;
1111         }
1112
1113         /* Ensure there's enough data for an authenticated request. */
1114         if (pkt->frag_length < RPC_HEADER_LEN
1115                                 + DCERPC_AUTH_TRAILER_LENGTH
1116                                 + pkt->auth_length) {
1117                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
1118                                 "%u is too large.\n",
1119                         (unsigned int)pkt->auth_length));
1120                 goto err;
1121         }
1122
1123         /*
1124          * Decode the authentication verifier response.
1125          */
1126
1127         status = dcerpc_pull_dcerpc_auth(pkt,
1128                                          &pkt->u.auth3.auth_info,
1129                                          &auth_info, p->endian);
1130         if (!NT_STATUS_IS_OK(status)) {
1131                 DEBUG(0, ("Failed to unmarshall dcerpc_auth.\n"));
1132                 goto err;
1133         }
1134
1135         /* We must NEVER look at auth_info->auth_pad_len here,
1136          * as old Samba client code gets it wrong and sends it
1137          * as zero. JRA.
1138          */
1139
1140         if (auth_info.auth_type != p->auth.auth_type) {
1141                 DEBUG(0, ("Auth type mismatch! Client sent %d, "
1142                           "but auth was started as type %d!\n",
1143                           auth_info.auth_type, p->auth.auth_type));
1144                 goto err;
1145         }
1146
1147         switch (auth_info.auth_type) {
1148         case DCERPC_AUTH_TYPE_NTLMSSP:
1149         case DCERPC_AUTH_TYPE_KRB5:
1150                 gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
1151                                                     struct gensec_security);
1152                 status = auth_generic_server_step(gensec_security,
1153                                              pkt, &auth_info.credentials,
1154                                              &response);
1155                 break;
1156         case DCERPC_AUTH_TYPE_SPNEGO:
1157                 spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1158                                                    struct spnego_context);
1159                 status = spnego_server_step(spnego_ctx,
1160                                             pkt, &auth_info.credentials,
1161                                             &response);
1162                 break;
1163         default:
1164                 DEBUG(0, (__location__ ": incorrect auth type (%u).\n",
1165                           (unsigned int)auth_info.auth_type));
1166                 return false;
1167         }
1168
1169         if (NT_STATUS_EQUAL(status,
1170                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1171             response.length) {
1172                 DEBUG(0, (__location__ ": This was supposed to be the final "
1173                           "leg, but crypto machinery claims a response is "
1174                           "needed, aborting auth!\n"));
1175                 data_blob_free(&response);
1176                 goto err;
1177         }
1178         if (!NT_STATUS_IS_OK(status)) {
1179                 DEBUG(0, ("Auth failed (%s)\n", nt_errstr(status)));
1180                 goto err;
1181         }
1182
1183         /* Now verify auth was indeed successful and extract server info */
1184         status = pipe_auth_verify_final(p);
1185         if (!NT_STATUS_IS_OK(status)) {
1186                 DEBUG(0, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1187                 goto err;
1188         }
1189
1190         return true;
1191
1192 err:
1193
1194         TALLOC_FREE(p->auth.auth_ctx);
1195         return false;
1196 }
1197
1198 /****************************************************************************
1199  Deal with an alter context call. Can be third part of 3 leg auth request for
1200  SPNEGO calls.
1201 ****************************************************************************/
1202
1203 static bool api_pipe_alter_context(struct pipes_struct *p,
1204                                         struct ncacn_packet *pkt)
1205 {
1206         struct dcerpc_auth auth_info;
1207         uint16 assoc_gid;
1208         NTSTATUS status;
1209         union dcerpc_payload u;
1210         struct dcerpc_ack_ctx bind_ack_ctx;
1211         DATA_BLOB auth_resp = data_blob_null;
1212         DATA_BLOB auth_blob = data_blob_null;
1213         int pad_len = 0;
1214         struct gensec_security *gensec_security;
1215         struct spnego_context *spnego_ctx;
1216
1217         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1218
1219         if (pkt->u.bind.assoc_group_id != 0) {
1220                 assoc_gid = pkt->u.bind.assoc_group_id;
1221         } else {
1222                 assoc_gid = 0x53f0;
1223         }
1224
1225         /*
1226          * Create the bind response struct.
1227          */
1228
1229         /* If the requested abstract synt uuid doesn't match our client pipe,
1230                 reject the bind_ack & set the transfer interface synt to all 0's,
1231                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1232                 unknown to NT4)
1233                 Needed when adding entries to a DACL from NT5 - SK */
1234
1235         if (check_bind_req(p,
1236                         &pkt->u.bind.ctx_list[0].abstract_syntax,
1237                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
1238                         pkt->u.bind.ctx_list[0].context_id)) {
1239
1240                 bind_ack_ctx.result = 0;
1241                 bind_ack_ctx.reason = 0;
1242                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
1243         } else {
1244                 p->pipe_bound = False;
1245                 /* Rejection reason: abstract syntax not supported */
1246                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1247                 bind_ack_ctx.reason = DCERPC_BIND_REASON_ASYNTAX;
1248                 bind_ack_ctx.syntax = null_ndr_syntax_id;
1249         }
1250
1251         /*
1252          * Check if this is an authenticated alter context request.
1253          */
1254         if (pkt->auth_length) {
1255                 /* Quick length check. Won't catch a bad auth footer,
1256                  * prevents overrun. */
1257
1258                 if (pkt->frag_length < RPC_HEADER_LEN +
1259                                         DCERPC_AUTH_TRAILER_LENGTH +
1260                                         pkt->auth_length) {
1261                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
1262                                 "too long for fragment %u.\n",
1263                                 (unsigned int)pkt->auth_length,
1264                                 (unsigned int)pkt->frag_length ));
1265                         goto err_exit;
1266                 }
1267
1268                 status = dcerpc_pull_dcerpc_auth(pkt,
1269                                                  &pkt->u.bind.auth_info,
1270                                                  &auth_info, p->endian);
1271                 if (!NT_STATUS_IS_OK(status)) {
1272                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1273                         goto err_exit;
1274                 }
1275
1276                 /* We can only finish if the pipe is unbound for now */
1277                 if (p->pipe_bound) {
1278                         DEBUG(0, (__location__ ": Pipe already bound, "
1279                                   "Altering Context not yet supported!\n"));
1280                         goto err_exit;
1281                 }
1282
1283                 if (auth_info.auth_type != p->auth.auth_type) {
1284                         DEBUG(0, ("Auth type mismatch! Client sent %d, "
1285                                   "but auth was started as type %d!\n",
1286                                   auth_info.auth_type, p->auth.auth_type));
1287                         goto err_exit;
1288                 }
1289
1290
1291                 switch (auth_info.auth_type) {
1292                 case DCERPC_AUTH_TYPE_SPNEGO:
1293                         spnego_ctx = talloc_get_type_abort(p->auth.auth_ctx,
1294                                                         struct spnego_context);
1295                         status = spnego_server_step(spnego_ctx,
1296                                                     pkt,
1297                                                     &auth_info.credentials,
1298                                                     &auth_resp);
1299                         break;
1300
1301                 case DCERPC_AUTH_TYPE_KRB5:
1302                 case DCERPC_AUTH_TYPE_NTLMSSP:
1303                         gensec_security = talloc_get_type_abort(p->auth.auth_ctx,
1304                                                     struct gensec_security);
1305                         status = auth_generic_server_step(gensec_security,
1306                                                      pkt,
1307                                                      &auth_info.credentials,
1308                                                      &auth_resp);
1309                         break;
1310
1311                 default:
1312                         DEBUG(3, (__location__ ": Usupported auth type (%d) "
1313                                   "in alter-context call\n",
1314                                   auth_info.auth_type));
1315                         goto err_exit;
1316                 }
1317
1318                 if (NT_STATUS_IS_OK(status)) {
1319                         /* third leg of auth, verify auth info */
1320                         status = pipe_auth_verify_final(p);
1321                         if (!NT_STATUS_IS_OK(status)) {
1322                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1323                                           nt_errstr(status)));
1324                                 goto err_exit;
1325                         }
1326                 } else if (NT_STATUS_EQUAL(status,
1327                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1328                         DEBUG(10, ("More auth legs required.\n"));
1329                 } else {
1330                         DEBUG(0, ("Auth step returned an error (%s)\n",
1331                                   nt_errstr(status)));
1332                         goto err_exit;
1333                 }
1334         }
1335
1336         ZERO_STRUCT(u.alter_resp);
1337         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1338         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1339         u.alter_resp.assoc_group_id = assoc_gid;
1340
1341         /* secondary address CAN be NULL
1342          * as the specs say it's ignored.
1343          * It MUST be NULL to have the spoolss working.
1344          */
1345         u.alter_resp.secondary_address = "";
1346         u.alter_resp.secondary_address_size = 1;
1347
1348         u.alter_resp.num_results = 1;
1349         u.alter_resp.ctx_list = &bind_ack_ctx;
1350
1351         /* NOTE: We leave the auth_info empty so we can calculate the padding
1352          * later and then append the auth_info --simo */
1353
1354         /*
1355          * Marshall directly into the outgoing PDU space. We
1356          * must do this as we need to set to the bind response
1357          * header and are never sending more than one PDU here.
1358          */
1359
1360         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1361                                           DCERPC_PKT_ALTER_RESP,
1362                                           DCERPC_PFC_FLAG_FIRST |
1363                                                 DCERPC_PFC_FLAG_LAST,
1364                                           auth_resp.length,
1365                                           pkt->call_id,
1366                                           &u,
1367                                           &p->out_data.frag);
1368         if (!NT_STATUS_IS_OK(status)) {
1369                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
1370                           nt_errstr(status)));
1371         }
1372
1373         if (auth_resp.length) {
1374
1375                 /* Work out any padding needed before the auth footer. */
1376                 pad_len = p->out_data.frag.length % SERVER_NDR_PADDING_SIZE;
1377                 if (pad_len) {
1378                         pad_len = SERVER_NDR_PADDING_SIZE - pad_len;
1379                         DEBUG(10, ("auth pad_len = %u\n",
1380                                    (unsigned int)pad_len));
1381                 }
1382
1383                 status = dcerpc_push_dcerpc_auth(pkt,
1384                                                  auth_info.auth_type,
1385                                                  auth_info.auth_level,
1386                                                  pad_len,
1387                                                  1, /* auth_context_id */
1388                                                  &auth_resp,
1389                                                  &auth_blob);
1390                 if (!NT_STATUS_IS_OK(status)) {
1391                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1392                         goto err_exit;
1393                 }
1394         }
1395
1396         /* Now that we have the auth len store it into the right place in
1397          * the dcerpc header */
1398         dcerpc_set_frag_length(&p->out_data.frag,
1399                                 p->out_data.frag.length +
1400                                         pad_len + auth_blob.length);
1401
1402         if (auth_resp.length) {
1403                 if (pad_len) {
1404                         char pad[SERVER_NDR_PADDING_SIZE];
1405                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1406                         if (!data_blob_append(p->mem_ctx,
1407                                                 &p->out_data.frag,
1408                                                 pad, pad_len)) {
1409                                 DEBUG(0, ("api_pipe_bind_req: failed to add "
1410                                           "%u bytes of pad data.\n",
1411                                           (unsigned int)pad_len));
1412                                 goto err_exit;
1413                         }
1414                 }
1415
1416                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1417                                         auth_blob.data, auth_blob.length)) {
1418                         DEBUG(0, ("Append of auth info failed.\n"));
1419                         goto err_exit;
1420                 }
1421         }
1422
1423         /*
1424          * Setup the lengths for the initial reply.
1425          */
1426
1427         p->out_data.data_sent_length = 0;
1428         p->out_data.current_pdu_sent = 0;
1429
1430         TALLOC_FREE(auth_blob.data);
1431         return True;
1432
1433   err_exit:
1434
1435         data_blob_free(&p->out_data.frag);
1436         TALLOC_FREE(auth_blob.data);
1437         return setup_bind_nak(p, pkt);
1438 }
1439
1440 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1441                        const struct api_struct *api_rpc_cmds, int n_cmds,
1442                        const struct ndr_syntax_id *syntax);
1443
1444 /****************************************************************************
1445  Find the correct RPC function to call for this request.
1446  If the pipe is authenticated then become the correct UNIX user
1447  before doing the call.
1448 ****************************************************************************/
1449
1450 static bool api_pipe_request(struct pipes_struct *p,
1451                                 struct ncacn_packet *pkt)
1452 {
1453         bool ret = False;
1454         struct pipe_rpc_fns *pipe_fns;
1455
1456         if (!p->pipe_bound) {
1457                 DEBUG(1, ("Pipe not bound!\n"));
1458                 data_blob_free(&p->out_data.rdata);
1459                 return false;
1460         }
1461
1462         if (!become_authenticated_pipe_user(p->session_info)) {
1463                 DEBUG(1, ("Failed to become pipe user!\n"));
1464                 data_blob_free(&p->out_data.rdata);
1465                 return false;
1466         }
1467
1468         /* get the set of RPC functions for this context */
1469
1470         pipe_fns = find_pipe_fns_by_context(p->contexts,
1471                                             pkt->u.request.context_id);
1472
1473         if ( pipe_fns ) {
1474                 TALLOC_CTX *frame = talloc_stackframe();
1475
1476                 DEBUG(5, ("Requested %s rpc service\n",
1477                           get_pipe_name_from_syntax(talloc_tos(), &pipe_fns->syntax)));
1478
1479                 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds,
1480                                  &pipe_fns->syntax);
1481
1482                 TALLOC_FREE(frame);
1483         }
1484         else {
1485                 DEBUG(0, ("No rpc function table associated with context "
1486                           "[%d]\n",
1487                           pkt->u.request.context_id));
1488         }
1489
1490         unbecome_authenticated_pipe_user();
1491
1492         return ret;
1493 }
1494
1495 /*******************************************************************
1496  Calls the underlying RPC function for a named pipe.
1497  ********************************************************************/
1498
1499 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1500                        const struct api_struct *api_rpc_cmds, int n_cmds,
1501                        const struct ndr_syntax_id *syntax)
1502 {
1503         int fn_num;
1504         uint32_t offset1;
1505
1506         /* interpret the command */
1507         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1508                  get_pipe_name_from_syntax(talloc_tos(), syntax),
1509                  pkt->u.request.opnum));
1510
1511         if (DEBUGLEVEL >= 50) {
1512                 fstring name;
1513                 slprintf(name, sizeof(name)-1, "in_%s",
1514                          get_pipe_name_from_syntax(talloc_tos(), syntax));
1515                 dump_pdu_region(name, pkt->u.request.opnum,
1516                                 &p->in_data.data, 0,
1517                                 p->in_data.data.length);
1518         }
1519
1520         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1521                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1522                     api_rpc_cmds[fn_num].fn != NULL) {
1523                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1524                                   api_rpc_cmds[fn_num].name));
1525                         break;
1526                 }
1527         }
1528
1529         if (fn_num == n_cmds) {
1530                 /*
1531                  * For an unknown RPC just return a fault PDU but
1532                  * return True to allow RPC's on the pipe to continue
1533                  * and not put the pipe into fault state. JRA.
1534                  */
1535                 DEBUG(4, ("unknown\n"));
1536                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1537                 return True;
1538         }
1539
1540         offset1 = p->out_data.rdata.length;
1541
1542         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1543                 fn_num, api_rpc_cmds[fn_num].fn));
1544         /* do the actual command */
1545         if(!api_rpc_cmds[fn_num].fn(p)) {
1546                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1547                          get_pipe_name_from_syntax(talloc_tos(), syntax),
1548                          api_rpc_cmds[fn_num].name));
1549                 data_blob_free(&p->out_data.rdata);
1550                 return False;
1551         }
1552
1553         if (p->bad_handle_fault_state) {
1554                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1555                 p->bad_handle_fault_state = False;
1556                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
1557                 return True;
1558         }
1559
1560         if (p->rng_fault_state) {
1561                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
1562                 p->rng_fault_state = False;
1563                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1564                 return True;
1565         }
1566
1567         if (DEBUGLEVEL >= 50) {
1568                 fstring name;
1569                 slprintf(name, sizeof(name)-1, "out_%s",
1570                          get_pipe_name_from_syntax(talloc_tos(), syntax));
1571                 dump_pdu_region(name, pkt->u.request.opnum,
1572                                 &p->out_data.rdata, offset1,
1573                                 p->out_data.rdata.length);
1574         }
1575
1576         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1577                  get_pipe_name_from_syntax(talloc_tos(), syntax)));
1578
1579         /* Check for buffer underflow in rpc parsing */
1580         if ((DEBUGLEVEL >= 10) &&
1581             (pkt->frag_length < p->in_data.data.length)) {
1582                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1583                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1584                               p->in_data.data.length - pkt->frag_length);
1585         }
1586
1587         return True;
1588 }
1589
1590 /****************************************************************************
1591  Initialise an outgoing packet.
1592 ****************************************************************************/
1593
1594 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1595 {
1596         output_data *o_data = &p->out_data;
1597
1598         /* Reset the offset counters. */
1599         o_data->data_sent_length = 0;
1600         o_data->current_pdu_sent = 0;
1601
1602         data_blob_free(&o_data->frag);
1603
1604         /* Free any memory in the current return data buffer. */
1605         data_blob_free(&o_data->rdata);
1606
1607         return True;
1608 }
1609
1610 /****************************************************************************
1611  Sets the fault state on incoming packets.
1612 ****************************************************************************/
1613
1614 void set_incoming_fault(struct pipes_struct *p)
1615 {
1616         data_blob_free(&p->in_data.data);
1617         p->in_data.pdu_needed_len = 0;
1618         p->in_data.pdu.length = 0;
1619         p->fault_state = True;
1620
1621         DEBUG(10, ("Setting fault state\n"));
1622 }
1623
1624 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1625                                     struct ncacn_packet *pkt,
1626                                     DATA_BLOB *raw_pkt)
1627 {
1628         NTSTATUS status;
1629         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1630         size_t pad_len;
1631
1632         DEBUG(10, ("Checking request auth.\n"));
1633
1634         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1635                 hdr_size += 16;
1636         }
1637
1638         /* in case of sealing this function will unseal the data in place */
1639         status = dcerpc_check_auth(auth, pkt,
1640                                    &pkt->u.request.stub_and_verifier,
1641                                    hdr_size, raw_pkt,
1642                                    &pad_len);
1643         if (!NT_STATUS_IS_OK(status)) {
1644                 return status;
1645         }
1646
1647
1648         /* remove padding and auth trailer,
1649          * this way the caller will get just the data */
1650         if (pkt->auth_length) {
1651                 size_t trail_len = pad_len
1652                                         + DCERPC_AUTH_TRAILER_LENGTH
1653                                         + pkt->auth_length;
1654                 if (pkt->u.request.stub_and_verifier.length < trail_len) {
1655                         return NT_STATUS_INFO_LENGTH_MISMATCH;
1656                 }
1657                 pkt->u.request.stub_and_verifier.length -= trail_len;
1658         }
1659
1660         return NT_STATUS_OK;
1661 }
1662
1663 /****************************************************************************
1664  Processes a request pdu. This will do auth processing if needed, and
1665  appends the data into the complete stream if the LAST flag is not set.
1666 ****************************************************************************/
1667
1668 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1669 {
1670         NTSTATUS status;
1671         DATA_BLOB data;
1672
1673         if (!p->pipe_bound) {
1674                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1675                 set_incoming_fault(p);
1676                 return False;
1677         }
1678
1679         /* Store the opnum */
1680         p->opnum = pkt->u.request.opnum;
1681
1682         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1683         if (!NT_STATUS_IS_OK(status)) {
1684                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1685                           nt_errstr(status)));
1686                 set_incoming_fault(p);
1687                 return false;
1688         }
1689
1690         data = pkt->u.request.stub_and_verifier;
1691
1692         /*
1693          * Check the data length doesn't go over the 15Mb limit.
1694          * increased after observing a bug in the Windows NT 4.0 SP6a
1695          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1696          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1697          */
1698
1699         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1700                 DEBUG(0, ("process_request_pdu: "
1701                           "rpc data buffer too large (%u) + (%u)\n",
1702                           (unsigned int)p->in_data.data.length,
1703                           (unsigned int)data.length));
1704                 set_incoming_fault(p);
1705                 return False;
1706         }
1707
1708         /*
1709          * Append the data portion into the buffer and return.
1710          */
1711
1712         if (data.length) {
1713                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1714                                           data.data, data.length)) {
1715                         DEBUG(0, ("Unable to append data size %u "
1716                                   "to parse buffer of size %u.\n",
1717                                   (unsigned int)data.length,
1718                                   (unsigned int)p->in_data.data.length));
1719                         set_incoming_fault(p);
1720                         return False;
1721                 }
1722         }
1723
1724         if (pkt->pfc_flags & DCERPC_PFC_FLAG_LAST) {
1725                 bool ret = False;
1726                 /*
1727                  * Ok - we finally have a complete RPC stream.
1728                  * Call the rpc command to process it.
1729                  */
1730
1731                 /*
1732                  * Process the complete data stream here.
1733                  */
1734                 if (pipe_init_outgoing_data(p)) {
1735                         ret = api_pipe_request(p, pkt);
1736                 }
1737
1738                 return ret;
1739         }
1740
1741         return True;
1742 }
1743
1744 /****************************************************************************
1745  Processes a finished PDU stored in p->in_data.pdu.
1746 ****************************************************************************/
1747
1748 void process_complete_pdu(struct pipes_struct *p)
1749 {
1750         struct ncacn_packet *pkt = NULL;
1751         NTSTATUS status;
1752         bool reply = False;
1753
1754         if(p->fault_state) {
1755                 DEBUG(10,("RPC connection in fault state.\n"));
1756                 goto done;
1757         }
1758
1759         pkt = talloc(p->mem_ctx, struct ncacn_packet);
1760         if (!pkt) {
1761                 DEBUG(0, ("Out of memory!\n"));
1762                 goto done;
1763         }
1764
1765         /*
1766          * Ensure we're using the corrent endianness for both the
1767          * RPC header flags and the raw data we will be reading from.
1768          */
1769         if (dcerpc_get_endian_flag(&p->in_data.pdu) & DCERPC_DREP_LE) {
1770                 p->endian = RPC_LITTLE_ENDIAN;
1771         } else {
1772                 p->endian = RPC_BIG_ENDIAN;
1773         }
1774         DEBUG(10, ("PDU is in %s Endian format!\n", p->endian?"Big":"Little"));
1775
1776         status = dcerpc_pull_ncacn_packet(pkt, &p->in_data.pdu,
1777                                           pkt, p->endian);
1778         if (!NT_STATUS_IS_OK(status)) {
1779                 DEBUG(0, ("Failed to unmarshal rpc packet: %s!\n",
1780                           nt_errstr(status)));
1781                 goto done;
1782         }
1783
1784         /* Store the call_id */
1785         p->call_id = pkt->call_id;
1786
1787         DEBUG(10, ("Processing packet type %u\n", (unsigned int)pkt->ptype));
1788
1789         switch (pkt->ptype) {
1790         case DCERPC_PKT_REQUEST:
1791                 reply = process_request_pdu(p, pkt);
1792                 break;
1793
1794         case DCERPC_PKT_PING: /* CL request - ignore... */
1795                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1796                           (unsigned int)pkt->ptype));
1797                 break;
1798
1799         case DCERPC_PKT_RESPONSE: /* No responses here. */
1800                 DEBUG(0, ("Error - DCERPC_PKT_RESPONSE received from client"));
1801                 break;
1802
1803         case DCERPC_PKT_FAULT:
1804         case DCERPC_PKT_WORKING:
1805                 /* CL request - reply to a ping when a call in process. */
1806         case DCERPC_PKT_NOCALL:
1807                 /* CL - server reply to a ping call. */
1808         case DCERPC_PKT_REJECT:
1809         case DCERPC_PKT_ACK:
1810         case DCERPC_PKT_CL_CANCEL:
1811         case DCERPC_PKT_FACK:
1812         case DCERPC_PKT_CANCEL_ACK:
1813                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1814                           (unsigned int)pkt->ptype));
1815                 break;
1816
1817         case DCERPC_PKT_BIND:
1818                 /*
1819                  * We assume that a pipe bind is only in one pdu.
1820                  */
1821                 if (pipe_init_outgoing_data(p)) {
1822                         reply = api_pipe_bind_req(p, pkt);
1823                 }
1824                 break;
1825
1826         case DCERPC_PKT_BIND_ACK:
1827         case DCERPC_PKT_BIND_NAK:
1828                 DEBUG(0, ("Error - DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1829                           "packet type %u received.\n",
1830                           (unsigned int)pkt->ptype));
1831                 break;
1832
1833
1834         case DCERPC_PKT_ALTER:
1835                 /*
1836                  * We assume that a pipe bind is only in one pdu.
1837                  */
1838                 if (pipe_init_outgoing_data(p)) {
1839                         reply = api_pipe_alter_context(p, pkt);
1840                 }
1841                 break;
1842
1843         case DCERPC_PKT_ALTER_RESP:
1844                 DEBUG(0, ("Error - DCERPC_PKT_ALTER_RESP received: "
1845                           "Should only be server -> client.\n"));
1846                 break;
1847
1848         case DCERPC_PKT_AUTH3:
1849                 /*
1850                  * The third packet in an auth exchange.
1851                  */
1852                 if (pipe_init_outgoing_data(p)) {
1853                         reply = api_pipe_bind_auth3(p, pkt);
1854                 }
1855                 break;
1856
1857         case DCERPC_PKT_SHUTDOWN:
1858                 DEBUG(0, ("Error - DCERPC_PKT_SHUTDOWN received: "
1859                           "Should only be server -> client.\n"));
1860                 break;
1861
1862         case DCERPC_PKT_CO_CANCEL:
1863                 /* For now just free all client data and continue
1864                  * processing. */
1865                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1866                          " Abandoning rpc call.\n"));
1867                 /* As we never do asynchronous RPC serving, we can
1868                  * never cancel a call (as far as I know).
1869                  * If we ever did we'd have to send a cancel_ack reply.
1870                  * For now, just free all client data and continue
1871                  * processing. */
1872                 reply = True;
1873                 break;
1874
1875 #if 0
1876                 /* Enable this if we're doing async rpc. */
1877                 /* We must check the outstanding callid matches. */
1878                 if (pipe_init_outgoing_data(p)) {
1879                         /* Send a cancel_ack PDU reply. */
1880                         /* We should probably check the auth-verifier here. */
1881                         reply = setup_cancel_ack_reply(p, pkt);
1882                 }
1883                 break;
1884 #endif
1885
1886         case DCERPC_PKT_ORPHANED:
1887                 /* We should probably check the auth-verifier here.
1888                  * For now just free all client data and continue
1889                  * processing. */
1890                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
1891                           " Abandoning rpc call.\n"));
1892                 reply = True;
1893                 break;
1894
1895         default:
1896                 DEBUG(0, ("process_complete_pdu: "
1897                           "Unknown rpc type = %u received.\n",
1898                           (unsigned int)pkt->ptype));
1899                 break;
1900         }
1901
1902 done:
1903         if (!reply) {
1904                 DEBUG(3,("DCE/RPC fault sent!"));
1905                 set_incoming_fault(p);
1906                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1907                 TALLOC_FREE(pkt);
1908         } else {
1909                 /*
1910                  * Reset the lengths. We're ready for a new pdu.
1911                  */
1912                 TALLOC_FREE(p->in_data.pdu.data);
1913                 p->in_data.pdu_needed_len = 0;
1914                 p->in_data.pdu.length = 0;
1915         }
1916
1917         TALLOC_FREE(pkt);
1918 }
1919