source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "system/filesys.h"
  32 #include "srv_pipe_internal.h"
  33 #include "../librpc/gen_ndr/ndr_dcerpc.h"
  34 #include "../librpc/rpc/rpc_common.h"
  35 #include "dcesrv_auth_generic.h"
  36 #include "rpc_server.h"
  37 #include "rpc_dce.h"
  38 #include "smbd/smbd.h"
  39 #include "auth.h"
  40 #include "ntdomain.h"
  41 #include "rpc_server/srv_pipe.h"
  42 #include "rpc_server/rpc_contexts.h"
  43 #include "lib/param/param.h"
  44 #include "librpc/ndr/ndr_table.h"
  45 #include "auth/gensec/gensec.h"
  46 #include "librpc/ndr/ndr_dcerpc.h"
  47 #include "lib/tsocket/tsocket.h"
  48 #include "../librpc/gen_ndr/ndr_samr.h"
  49 #include "../librpc/gen_ndr/ndr_lsa.h"
  50 #include "../librpc/gen_ndr/ndr_netlogon.h"
  51 #include "../librpc/gen_ndr/ndr_epmapper.h"
  52 #include "../librpc/gen_ndr/ndr_echo.h"
  53 #include "../librpc/gen_ndr/ndr_winspool.h"
  54
  55 #undef DBGC_CLASS
  56 #define DBGC_CLASS DBGC_RPC_SRV
  57
  58 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p);
  59
  60 /**
  61  * Dump everything from the start of the end up of the provided data
  62  * into a file, but only at debug level >= 50
  63  **/
  64 static void dump_pdu_region(const char *name, int v,
  65                             DATA_BLOB *data, size_t start, size_t end)
  66 {
  67         int fd, i;
  68         char *fname = NULL;
  69         ssize_t sz;
  70
  71         if (DEBUGLEVEL < 50) return;
  72
  73         if (start > data->length || end > data->length || start > end) return;
  74
  75         for (i = 1; i < 100; i++) {
  76                 if (v != -1) {
  77                         fname = talloc_asprintf(talloc_tos(),
  78                                                 "/tmp/%s_%d.%d.prs",
  79                                                 name, v, i);
  80                 } else {
  81                         fname = talloc_asprintf(talloc_tos(),
  82                                                 "/tmp/%s_%d.prs",
  83                                                 name, i);
  84                 }
  85                 if (!fname) {
  86                         return;
  87                 }
  88                 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
  89                 if (fd != -1 || errno != EEXIST) break;
  90         }
  91         if (fd != -1) {
  92                 sz = write(fd, data->data + start, end - start);
  93                 i = close(fd);
  94                 if ((sz != end - start) || (i != 0) ) {
  95                         DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
  96                                   fname, (unsigned long)sz,
  97                                   (unsigned long)end - start, i));
  98                 } else {
  99                         DEBUG(0,("created %s\n", fname));
 100                 }
 101         }
 102         TALLOC_FREE(fname);
 103 }
 104
 105 static DATA_BLOB generic_session_key(void)
 106 {
 107         return data_blob_const("SystemLibraryDTC", 16);
 108 }
 109
 110 /*******************************************************************
 111  Generate the next PDU to be returned from the data.
 112 ********************************************************************/
 113
 114 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
 115                                    struct pipe_auth_data *auth,
 116                                    uint32_t call_id,
 117                                    DATA_BLOB *rdata,
 118                                    size_t data_sent_length,
 119                                    DATA_BLOB *frag,
 120                                    size_t *pdu_size)
 121 {
 122         union dcerpc_payload u;
 123         uint8_t pfc_flags;
 124         size_t data_left;
 125         size_t data_to_send;
 126         size_t frag_len;
 127         size_t pad_len = 0;
 128         size_t auth_len = 0;
 129         NTSTATUS status;
 130
 131         ZERO_STRUCT(u.response);
 132
 133         /* Set up rpc packet pfc flags. */
 134         if (data_sent_length == 0) {
 135                 pfc_flags = DCERPC_PFC_FLAG_FIRST;
 136         } else {
 137                 pfc_flags = 0;
 138         }
 139
 140         /* Work out how much we can fit in a single PDU. */
 141         data_left = rdata->length - data_sent_length;
 142
 143         /* Ensure there really is data left to send. */
 144         if (!data_left) {
 145                 DEBUG(0, ("No data left to send !\n"));
 146                 return NT_STATUS_BUFFER_TOO_SMALL;
 147         }
 148
 149         status = dcerpc_guess_sizes(auth,
 150                                     DCERPC_RESPONSE_LENGTH,
 151                                     data_left,
 152                                     RPC_MAX_PDU_FRAG_LEN,
 153                                     &data_to_send, &frag_len,
 154                                     &auth_len, &pad_len);
 155         if (!NT_STATUS_IS_OK(status)) {
 156                 return status;
 157         }
 158
 159         /* Set up the alloc hint. This should be the data left to send. */
 160         u.response.alloc_hint = data_left;
 161
 162         /* Work out if this PDU will be the last. */
 163         if (data_sent_length + data_to_send >= rdata->length) {
 164                 pfc_flags |= DCERPC_PFC_FLAG_LAST;
 165         }
 166
 167         /* Prepare data to be NDR encoded. */
 168         u.response.stub_and_verifier =
 169                 data_blob_const(rdata->data + data_sent_length, data_to_send);
 170
 171         /* Store the packet in the data stream. */
 172         status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
 173                                           pfc_flags, auth_len, call_id,
 174                                           &u, frag);
 175         if (!NT_STATUS_IS_OK(status)) {
 176                 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
 177                 return status;
 178         }
 179
 180         if (auth_len) {
 181                 /* Set the proper length on the pdu, including padding.
 182                  * Only needed if an auth trailer will be appended. */
 183                 dcerpc_set_frag_length(frag, frag->length
 184                                                 + pad_len
 185                                                 + DCERPC_AUTH_TRAILER_LENGTH
 186                                                 + auth_len);
 187         }
 188
 189         if (auth_len) {
 190                 status = dcerpc_add_auth_footer(auth, pad_len, frag);
 191                 if (!NT_STATUS_IS_OK(status)) {
 192                         data_blob_free(frag);
 193                         return status;
 194                 }
 195         }
 196
 197         *pdu_size = data_to_send;
 198         return NT_STATUS_OK;
 199 }
 200
 201 /*******************************************************************
 202  Generate the next PDU to be returned from the data in p->rdata.
 203 ********************************************************************/
 204
 205 bool create_next_pdu(struct pipes_struct *p)
 206 {
 207         size_t pdu_size = 0;
 208         NTSTATUS status;
 209
 210         /*
 211          * If we're in the fault state, keep returning fault PDU's until
 212          * the pipe gets closed. JRA.
 213          */
 214         if (p->fault_state) {
 215                 setup_fault_pdu(p, NT_STATUS(p->fault_state));
 216                 return true;
 217         }
 218
 219         status = create_next_packet(p->mem_ctx, &p->auth,
 220                                     p->call_id, &p->out_data.rdata,
 221                                     p->out_data.data_sent_length,
 222                                     &p->out_data.frag, &pdu_size);
 223         if (!NT_STATUS_IS_OK(status)) {
 224                 DEBUG(0, ("Failed to create packet with error %s, "
 225                           "(auth level %u / type %u)\n",
 226                           nt_errstr(status),
 227                           (unsigned int)p->auth.auth_level,
 228                           (unsigned int)p->auth.auth_type));
 229                 return false;
 230         }
 231
 232         /* Setup the counts for this PDU. */
 233         p->out_data.data_sent_length += pdu_size;
 234         p->out_data.current_pdu_sent = 0;
 235         return true;
 236 }
 237
 238
 239 static bool pipe_init_outgoing_data(struct pipes_struct *p);
 240
 241 /*******************************************************************
 242  Marshall a bind_nak pdu.
 243 *******************************************************************/
 244
 245 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
 246 {
 247         NTSTATUS status;
 248         union dcerpc_payload u;
 249
 250         /* Free any memory in the current return data buffer. */
 251         pipe_init_outgoing_data(p);
 252
 253         /*
 254          * Initialize a bind_nak header.
 255          */
 256
 257         ZERO_STRUCT(u);
 258
 259         u.bind_nak.reject_reason  = 0;
 260
 261         /*
 262          * Marshall directly into the outgoing PDU space. We
 263          * must do this as we need to set to the bind response
 264          * header and are never sending more than one PDU here.
 265          */
 266
 267         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 268                                           DCERPC_PKT_BIND_NAK,
 269                                           DCERPC_PFC_FLAG_FIRST |
 270                                                 DCERPC_PFC_FLAG_LAST,
 271                                           0,
 272                                           pkt->call_id,
 273                                           &u,
 274                                           &p->out_data.frag);
 275         if (!NT_STATUS_IS_OK(status)) {
 276                 return False;
 277         }
 278
 279         p->out_data.data_sent_length = 0;
 280         p->out_data.current_pdu_sent = 0;
 281
 282         set_incoming_fault(p);
 283         TALLOC_FREE(p->auth.auth_ctx);
 284         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 285         p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 286         p->pipe_bound = False;
 287         p->allow_bind = false;
 288         p->allow_alter = false;
 289         p->allow_auth3 = false;
 290
 291         return True;
 292 }
 293
 294 /*******************************************************************
 295  Marshall a fault pdu.
 296 *******************************************************************/
 297
 298 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
 299 {
 300         NTSTATUS status;
 301         union dcerpc_payload u;
 302
 303         /* Free any memory in the current return data buffer. */
 304         pipe_init_outgoing_data(p);
 305
 306         /*
 307          * Initialize a fault header.
 308          */
 309
 310         ZERO_STRUCT(u);
 311
 312         u.fault.status          = NT_STATUS_V(fault_status);
 313
 314         /*
 315          * Marshall directly into the outgoing PDU space. We
 316          * must do this as we need to set to the bind response
 317          * header and are never sending more than one PDU here.
 318          */
 319
 320         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 321                                           DCERPC_PKT_FAULT,
 322                                           DCERPC_PFC_FLAG_FIRST |
 323                                            DCERPC_PFC_FLAG_LAST |
 324                                            DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 325                                           0,
 326                                           p->call_id,
 327                                           &u,
 328                                           &p->out_data.frag);
 329         if (!NT_STATUS_IS_OK(status)) {
 330                 return False;
 331         }
 332
 333         p->out_data.data_sent_length = 0;
 334         p->out_data.current_pdu_sent = 0;
 335
 336         return True;
 337 }
 338
 339 /*******************************************************************
 340  Ensure a bind request has the correct abstract & transfer interface.
 341  Used to reject unknown binds from Win2k.
 342 *******************************************************************/
 343
 344 static bool check_bind_req(struct pipes_struct *p,
 345                            struct ndr_syntax_id* abstract,
 346                            struct ndr_syntax_id* transfer,
 347                            uint32_t context_id)
 348 {
 349         struct pipe_rpc_fns *context_fns;
 350         bool ok;
 351         const char *interface_name = NULL;
 352
 353         DEBUG(3,("check_bind_req for %s context_id=%u\n",
 354                  ndr_interface_name(&abstract->uuid,
 355                                     abstract->if_version),
 356                  (unsigned)context_id));
 357
 358         ok = ndr_syntax_id_equal(transfer, &ndr_transfer_syntax_ndr);
 359         if (!ok) {
 360                 DEBUG(1,("check_bind_req unknown transfer syntax for "
 361                          "%s context_id=%u\n",
 362                          ndr_interface_name(&abstract->uuid,
 363                                     abstract->if_version),
 364                          (unsigned)context_id));
 365                 return false;
 366         }
 367
 368         for (context_fns = p->contexts;
 369              context_fns != NULL;
 370              context_fns = context_fns->next)
 371         {
 372                 if (context_fns->context_id != context_id) {
 373                         continue;
 374                 }
 375
 376                 ok = ndr_syntax_id_equal(&context_fns->syntax,
 377                                          abstract);
 378                 if (ok) {
 379                         return true;
 380                 }
 381
 382                 DEBUG(1,("check_bind_req: changing abstract syntax for "
 383                          "%s context_id=%u into %s not supported\n",
 384                          ndr_interface_name(&context_fns->syntax.uuid,
 385                                             context_fns->syntax.if_version),
 386                          (unsigned)context_id,
 387                          ndr_interface_name(&abstract->uuid,
 388                                             abstract->if_version)));
 389                 return false;
 390         }
 391
 392         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 393         if (!rpc_srv_pipe_exists_by_id(abstract)) {
 394                 return false;
 395         }
 396
 397         DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
 398                   rpc_srv_get_pipe_cli_name(abstract),
 399                   rpc_srv_get_pipe_srv_name(abstract)));
 400
 401         ok = init_pipe_handles(p, abstract);
 402         if (!ok) {
 403                 DEBUG(1, ("Failed to init pipe handles!\n"));
 404                 return false;
 405         }
 406
 407         context_fns = talloc_zero(p, struct pipe_rpc_fns);
 408         if (context_fns == NULL) {
 409                 DEBUG(0,("check_bind_req: talloc() failed!\n"));
 410                 return false;
 411         }
 412
 413         interface_name = ndr_interface_name(&abstract->uuid,
 414                                             abstract->if_version);
 415         SMB_ASSERT(interface_name != NULL);
 416
 417         context_fns->next = context_fns->prev = NULL;
 418         context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
 419         context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
 420         context_fns->context_id = context_id;
 421         context_fns->syntax = *abstract;
 422
 423         context_fns->allow_connect = lp_allow_dcerpc_auth_level_connect();
 424         /*
 425          * for the samr, lsarpc and netlogon interfaces we don't allow "connect"
 426          * auth_level by default.
 427          */
 428         ok = ndr_syntax_id_equal(abstract, &ndr_table_samr.syntax_id);
 429         if (ok) {
 430                 context_fns->allow_connect = false;
 431         }
 432         ok = ndr_syntax_id_equal(abstract, &ndr_table_lsarpc.syntax_id);
 433         if (ok) {
 434                 context_fns->allow_connect = false;
 435         }
 436         ok = ndr_syntax_id_equal(abstract, &ndr_table_netlogon.syntax_id);
 437         if (ok) {
 438                 context_fns->allow_connect = false;
 439         }
 440         /*
 441          * for the epmapper and echo interfaces we allow "connect"
 442          * auth_level by default.
 443          */
 444         ok = ndr_syntax_id_equal(abstract, &ndr_table_epmapper.syntax_id);
 445         if (ok) {
 446                 context_fns->allow_connect = true;
 447         }
 448         ok = ndr_syntax_id_equal(abstract, &ndr_table_rpcecho.syntax_id);
 449         if (ok) {
 450                 context_fns->allow_connect = true;
 451         }
 452         /*
 453          * every interface can be modified to allow "connect" auth_level by
 454          * using a parametric option like:
 455          * allow dcerpc auth level connect:<interface>
 456          * e.g.
 457          * allow dcerpc auth level connect:samr = yes
 458          */
 459         context_fns->allow_connect = lp_parm_bool(-1,
 460                 "allow dcerpc auth level connect",
 461                 interface_name, context_fns->allow_connect);
 462
 463         ok = ndr_syntax_id_equal(abstract, &ndr_table_iremotewinspool.syntax_id);
 464         if (ok) {
 465                 context_fns->min_auth_level = DCERPC_AUTH_LEVEL_PACKET;
 466         }
 467
 468         /* add to the list of open contexts */
 469
 470         DLIST_ADD( p->contexts, context_fns );
 471
 472         return True;
 473 }
 474
 475 /**
 476  * Is a named pipe known?
 477  * @param[in] pipename          Just the filename
 478  * @result                      Do we want to serve this?
 479  */
 480 bool is_known_pipename(const char *pipename, struct ndr_syntax_id *syntax)
 481 {
 482         NTSTATUS status;
 483
 484         if (strchr(pipename, '/')) {
 485                 DEBUG(1, ("Refusing open on pipe %s\n", pipename));
 486                 return false;
 487         }
 488
 489         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
 490                 DEBUG(10, ("refusing spoolss access\n"));
 491                 return false;
 492         }
 493
 494         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 495                 return true;
 496         }
 497
 498         status = smb_probe_module("rpc", pipename);
 499         if (!NT_STATUS_IS_OK(status)) {
 500                 DEBUG(10, ("is_known_pipename: %s unknown\n", pipename));
 501                 return false;
 502         }
 503         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
 504
 505         /*
 506          * Scan the list again for the interface id
 507          */
 508         if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
 509                 return true;
 510         }
 511
 512         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
 513                    pipename));
 514
 515         return false;
 516 }
 517
 518 /*******************************************************************
 519  Handle an NTLMSSP bind auth.
 520 *******************************************************************/
 521
 522 static bool pipe_auth_generic_bind(struct pipes_struct *p,
 523                                    struct ncacn_packet *pkt,
 524                                    struct dcerpc_auth *auth_info,
 525                                    const char *service_description,
 526                                    DATA_BLOB *response)
 527 {
 528         TALLOC_CTX *mem_ctx = pkt;
 529         struct gensec_security *gensec_security = NULL;
 530         NTSTATUS status;
 531
 532         status = auth_generic_server_authtype_start(p,
 533                                                     auth_info->auth_type,
 534                                                     auth_info->auth_level,
 535                                                     p->remote_address,
 536                                                     p->local_address,
 537                                                     service_description,
 538                                                     &gensec_security);
 539         if (!NT_STATUS_IS_OK(status)) {
 540                 DEBUG(0, (__location__ ": auth_generic_server_authtype_start[%u/%u] failed: %s\n",
 541                           auth_info->auth_type, auth_info->auth_level, nt_errstr(status)));
 542                 return false;
 543         }
 544
 545         p->auth.auth_ctx = gensec_security;
 546         p->auth.auth_type = auth_info->auth_type;
 547         p->auth.auth_level = auth_info->auth_level;
 548         p->auth.auth_context_id = auth_info->auth_context_id;
 549
 550         if (pkt->pfc_flags & DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN) {
 551                 p->auth.client_hdr_signing = true;
 552                 p->auth.hdr_signing = gensec_have_feature(gensec_security,
 553                                                 GENSEC_FEATURE_SIGN_PKT_HEADER);
 554         }
 555
 556         if (p->auth.hdr_signing) {
 557                 gensec_want_feature(gensec_security,
 558                                     GENSEC_FEATURE_SIGN_PKT_HEADER);
 559         }
 560
 561         status = auth_generic_server_step(gensec_security, mem_ctx,
 562                                           &auth_info->credentials,
 563                                           response);
 564         if (!NT_STATUS_IS_OK(status) &&
 565             !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED))
 566         {
 567                 DEBUG(2, (__location__ ": "
 568                           "auth_generic_server_step[%u/%u] failed: %s\n",
 569                           auth_info->auth_type, auth_info->auth_level,
 570                           nt_errstr(status)));
 571                 return false;
 572         }
 573
 574         if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 575                 return true;
 576         }
 577
 578         status = pipe_auth_verify_final(p);
 579         if (!NT_STATUS_IS_OK(status)) {
 580                 DEBUG(0, ("pipe_auth_verify_final failed: %s\n",
 581                           nt_errstr(status)));
 582                 return false;
 583         }
 584
 585         return true;
 586 }
 587
 588 /*******************************************************************
 589  Process an NTLMSSP authentication response.
 590  If this function succeeds, the user has been authenticated
 591  and their domain, name and calling workstation stored in
 592  the pipe struct.
 593 *******************************************************************/
 594
 595 static bool pipe_auth_generic_verify_final(TALLOC_CTX *mem_ctx,
 596                                 struct gensec_security *gensec_security,
 597                                 enum dcerpc_AuthLevel auth_level,
 598                                 struct auth_session_info **session_info)
 599 {
 600         NTSTATUS status;
 601         bool ret;
 602
 603         DEBUG(5, (__location__ ": checking user details\n"));
 604
 605         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 606            ensure the underlying NTLMSSP flags are also set. If not we should
 607            refuse the bind. */
 608
 609         status = auth_generic_server_check_flags(gensec_security,
 610                                             (auth_level >=
 611                                                 DCERPC_AUTH_LEVEL_PACKET),
 612                                             (auth_level ==
 613                                                 DCERPC_AUTH_LEVEL_PRIVACY));
 614         if (!NT_STATUS_IS_OK(status)) {
 615                 DEBUG(0, (__location__ ": Client failed to negotatie proper "
 616                           "security for rpc connection\n"));
 617                 return false;
 618         }
 619
 620         TALLOC_FREE(*session_info);
 621
 622         status = auth_generic_server_get_user_info(gensec_security,
 623                                                 mem_ctx, session_info);
 624         if (!NT_STATUS_IS_OK(status)) {
 625                 DEBUG(0, (__location__ ": failed to obtain the server info "
 626                           "for authenticated user: %s\n", nt_errstr(status)));
 627                 return false;
 628         }
 629
 630         if ((*session_info)->security_token == NULL) {
 631                 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
 632                 return false;
 633         }
 634
 635         if ((*session_info)->unix_token == NULL) {
 636                 DEBUG(1, ("Auth module failed to provide unix_token\n"));
 637                 return false;
 638         }
 639
 640         /*
 641          * We're an authenticated bind over smb, so the session key needs to
 642          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 643          * does. See the RPC-SAMBA3SESSIONKEY.
 644          */
 645
 646         ret = session_info_set_session_key((*session_info), generic_session_key());
 647         if (!ret) {
 648                 DEBUG(0, ("Failed to set session key!\n"));
 649                 return false;
 650         }
 651
 652         return true;
 653 }
 654
 655 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
 656 {
 657         struct gensec_security *gensec_security;
 658         bool ok;
 659
 660         if (p->auth.auth_type == DCERPC_AUTH_TYPE_NONE) {
 661                 p->pipe_bound = true;
 662                 return NT_STATUS_OK;
 663         }
 664
 665         gensec_security = p->auth.auth_ctx;
 666
 667         ok = pipe_auth_generic_verify_final(p, gensec_security,
 668                                             p->auth.auth_level,
 669                                             &p->session_info);
 670         if (!ok) {
 671                 return NT_STATUS_ACCESS_DENIED;
 672         }
 673
 674         p->pipe_bound = true;
 675
 676         return NT_STATUS_OK;
 677 }
 678
 679 /*******************************************************************
 680  Respond to a pipe bind request.
 681 *******************************************************************/
 682
 683 static bool api_pipe_bind_req(struct pipes_struct *p,
 684                                 struct ncacn_packet *pkt)
 685 {
 686         struct dcerpc_auth auth_info = {0};
 687         uint16_t assoc_gid;
 688         NTSTATUS status;
 689         struct ndr_syntax_id id;
 690         uint8_t pfc_flags = 0;
 691         union dcerpc_payload u;
 692         struct dcerpc_ack_ctx bind_ack_ctx;
 693         DATA_BLOB auth_resp = data_blob_null;
 694         DATA_BLOB auth_blob = data_blob_null;
 695         const struct ndr_interface_table *table;
 696         const char *secondary_address = NULL;
 697
 698         if (!p->allow_bind) {
 699                 DEBUG(2,("Pipe not in allow bind state\n"));
 700                 return setup_bind_nak(p, pkt);
 701         }
 702         p->allow_bind = false;
 703
 704         status = dcerpc_verify_ncacn_packet_header(pkt,
 705                         DCERPC_PKT_BIND,
 706                         pkt->u.bind.auth_info.length,
 707                         0, /* required flags */
 708                         DCERPC_PFC_FLAG_FIRST |
 709                         DCERPC_PFC_FLAG_LAST |
 710                         DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
 711                         0x08 | /* this is not defined, but should be ignored */
 712                         DCERPC_PFC_FLAG_CONC_MPX |
 713                         DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
 714                         DCERPC_PFC_FLAG_MAYBE |
 715                         DCERPC_PFC_FLAG_OBJECT_UUID);
 716         if (!NT_STATUS_IS_OK(status)) {
 717                 DEBUG(1, ("api_pipe_bind_req: invalid pdu: %s\n",
 718                           nt_errstr(status)));
 719                 NDR_PRINT_DEBUG(ncacn_packet, pkt);
 720                 goto err_exit;
 721         }
 722
 723         if (pkt->u.bind.num_contexts == 0) {
 724                 DEBUG(1, ("api_pipe_bind_req: no rpc contexts around\n"));
 725                 goto err_exit;
 726         }
 727
 728         if (pkt->u.bind.ctx_list[0].num_transfer_syntaxes == 0) {
 729                 DEBUG(1, ("api_pipe_bind_req: no transfer syntaxes around\n"));
 730                 goto err_exit;
 731         }
 732
 733         /*
 734          * Try and find the correct pipe name to ensure
 735          * that this is a pipe name we support.
 736          */
 737         id = pkt->u.bind.ctx_list[0].abstract_syntax;
 738
 739         table = ndr_table_by_uuid(&id.uuid);
 740         if (table == NULL) {
 741                 DEBUG(0,("unknown interface\n"));
 742                 return false;
 743         }
 744
 745         if (rpc_srv_pipe_exists_by_id(&id)) {
 746                 DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 747                           rpc_srv_get_pipe_cli_name(&id),
 748                           rpc_srv_get_pipe_srv_name(&id)));
 749         } else {
 750                 status = smb_probe_module(
 751                         "rpc", dcerpc_default_transport_endpoint(pkt,
 752                                 NCACN_NP, table));
 753
 754                 if (NT_STATUS_IS_ERR(status)) {
 755                         DEBUG(3,("api_pipe_bind_req: Unknown rpc service name "
 756                                  "%s in bind request.\n",
 757                                  ndr_interface_name(&id.uuid,
 758                                                     id.if_version)));
 759
 760                         return setup_bind_nak(p, pkt);
 761                 }
 762
 763                 if (rpc_srv_get_pipe_interface_by_cli_name(
 764                                 dcerpc_default_transport_endpoint(pkt,
 765                                         NCACN_NP, table),
 766                                 &id)) {
 767                         DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
 768                                   rpc_srv_get_pipe_cli_name(&id),
 769                                   rpc_srv_get_pipe_srv_name(&id)));
 770                 } else {
 771                         DEBUG(0, ("module %s doesn't provide functions for "
 772                                   "pipe %s!\n",
 773                                   ndr_interface_name(&id.uuid,
 774                                                      id.if_version),
 775                                   ndr_interface_name(&id.uuid,
 776                                                      id.if_version)));
 777                         return setup_bind_nak(p, pkt);
 778                 }
 779         }
 780
 781         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 782
 783         if (pkt->u.bind.assoc_group_id != 0) {
 784                 assoc_gid = pkt->u.bind.assoc_group_id;
 785         } else {
 786                 assoc_gid = 0x53f0;
 787         }
 788
 789         /*
 790          * Create the bind response struct.
 791          */
 792
 793         /* If the requested abstract synt uuid doesn't match our client pipe,
 794                 reject the bind_ack & set the transfer interface synt to all 0's,
 795                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 796                 unknown to NT4)
 797                 Needed when adding entries to a DACL from NT5 - SK */
 798
 799         if (check_bind_req(p,
 800                         &pkt->u.bind.ctx_list[0].abstract_syntax,
 801                         &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
 802                         pkt->u.bind.ctx_list[0].context_id)) {
 803
 804                 bind_ack_ctx.result = 0;
 805                 bind_ack_ctx.reason.value = 0;
 806                 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
 807         } else {
 808                 /* Rejection reason: abstract syntax not supported */
 809                 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
 810                 bind_ack_ctx.reason.value = DCERPC_BIND_REASON_ASYNTAX;
 811                 bind_ack_ctx.syntax = ndr_syntax_id_null;
 812         }
 813
 814         /*
 815          * Check if this is an authenticated bind request.
 816          */
 817         if (pkt->auth_length) {
 818                 /*
 819                  * Decode the authentication verifier.
 820                  */
 821                 status = dcerpc_pull_auth_trailer(pkt, pkt,
 822                                                   &pkt->u.bind.auth_info,
 823                                                   &auth_info, NULL, true);
 824                 if (!NT_STATUS_IS_OK(status)) {
 825                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
 826                         goto err_exit;
 827                 }
 828
 829                 if (!pipe_auth_generic_bind(p, pkt,
 830                                             &auth_info,
 831                                             table->name,
 832                                             &auth_resp)) {
 833                         goto err_exit;
 834                 }
 835         } else {
 836                 TALLOC_CTX *frame = talloc_stackframe();
 837                 struct auth4_context *auth4_context;
 838                 const char *transport_protection = AUTHZ_TRANSPORT_PROTECTION_NONE;
 839                 if (p->transport == NCACN_NP) {
 840                         transport_protection = AUTHZ_TRANSPORT_PROTECTION_SMB;
 841                 }
 842
 843                 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
 844                 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 845                 p->auth.auth_context_id = 0;
 846
 847                 status = make_auth4_context(frame, &auth4_context);
 848                 if (!NT_STATUS_IS_OK(status)) {
 849                         DEBUG(0, ("Unable to make auth context for authz log.\n"));
 850                         TALLOC_FREE(frame);
 851                         goto err_exit;
 852                 }
 853
 854                 /*
 855                  * Log the authorization to this RPC interface.  This
 856                  * covered ncacn_np pass-through auth, and anonymous
 857                  * DCE/RPC (eg epmapper, netlogon etc)
 858                  */
 859                 log_successful_authz_event(auth4_context->msg_ctx,
 860                                            auth4_context->lp_ctx,
 861                                            p->remote_address,
 862                                            p->local_address,
 863                                            table->name,
 864                                            derpc_transport_string_by_transport(p->transport),
 865                                            transport_protection,
 866                                            p->session_info);
 867                 TALLOC_FREE(frame);
 868         }
 869
 870         ZERO_STRUCT(u.bind_ack);
 871         u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
 872         u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
 873         u.bind_ack.assoc_group_id = assoc_gid;
 874
 875         switch (p->transport) {
 876         case NCACN_IP_TCP:
 877                 secondary_address = talloc_asprintf(pkt, "%d",
 878                         tsocket_address_inet_port(p->local_address));
 879                 break;
 880         case NCACN_NP:
 881         default:
 882                 /* name has to be \PIPE\xxxxx */
 883                 secondary_address =
 884                                 talloc_asprintf(pkt, "\\PIPE\\%s",
 885                                                 rpc_srv_get_pipe_srv_name(&id));
 886                 break;
 887         }
 888
 889         if (secondary_address == NULL) {
 890                 DEBUG(0, ("Out of memory!\n"));
 891                 goto err_exit;
 892         }
 893
 894         u.bind_ack.secondary_address = secondary_address;
 895         u.bind_ack.secondary_address_size =
 896                                 strlen(u.bind_ack.secondary_address) + 1;
 897
 898         u.bind_ack.num_results = 1;
 899         u.bind_ack.ctx_list = &bind_ack_ctx;
 900
 901         /* NOTE: We leave the auth_info empty so we can calculate the padding
 902          * later and then append the auth_info --simo */
 903
 904         /*
 905          * Marshall directly into the outgoing PDU space. We
 906          * must do this as we need to set to the bind response
 907          * header and are never sending more than one PDU here.
 908          */
 909
 910         pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
 911
 912         if (p->auth.hdr_signing) {
 913                 pfc_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
 914         }
 915
 916         status = dcerpc_push_ncacn_packet(p->mem_ctx,
 917                                           DCERPC_PKT_BIND_ACK,
 918                                           pfc_flags,
 919                                           auth_resp.length,
 920                                           pkt->call_id,
 921                                           &u,
 922                                           &p->out_data.frag);
 923         if (!NT_STATUS_IS_OK(status)) {
 924                 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
 925                           nt_errstr(status)));
 926                 goto err_exit;
 927         }
 928
 929         if (auth_resp.length) {
 930                 status = dcerpc_push_dcerpc_auth(pkt,
 931                                                  p->auth.auth_type,
 932                                                  p->auth.auth_level,
 933                                                  0, /* pad_len */
 934                                                  p->auth.auth_context_id,
 935                                                  &auth_resp,
 936                                                  &auth_blob);
 937                 if (!NT_STATUS_IS_OK(status)) {
 938                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
 939                         goto err_exit;
 940                 }
 941         }
 942
 943         /* Now that we have the auth len store it into the right place in
 944          * the dcerpc header */
 945         dcerpc_set_frag_length(&p->out_data.frag,
 946                                 p->out_data.frag.length + auth_blob.length);
 947
 948         if (auth_blob.length) {
 949
 950                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
 951                                         auth_blob.data, auth_blob.length)) {
 952                         DEBUG(0, ("Append of auth info failed.\n"));
 953                         goto err_exit;
 954                 }
 955         }
 956
 957         /*
 958          * Setup the lengths for the initial reply.
 959          */
 960
 961         p->out_data.data_sent_length = 0;
 962         p->out_data.current_pdu_sent = 0;
 963
 964         TALLOC_FREE(auth_blob.data);
 965
 966         if (bind_ack_ctx.result == 0) {
 967                 p->allow_alter = true;
 968                 p->allow_auth3 = true;
 969                 if (p->auth.auth_type == DCERPC_AUTH_TYPE_NONE) {
 970                         status = pipe_auth_verify_final(p);
 971                         if (!NT_STATUS_IS_OK(status)) {
 972                                 DEBUG(0, ("pipe_auth_verify_final failed: %s\n",
 973                                           nt_errstr(status)));
 974                                 goto err_exit;
 975                         }
 976                 }
 977         } else {
 978                 goto err_exit;
 979         }
 980
 981         return True;
 982
 983   err_exit:
 984
 985         data_blob_free(&p->out_data.frag);
 986         TALLOC_FREE(auth_blob.data);
 987         return setup_bind_nak(p, pkt);
 988 }
 989
 990 /*******************************************************************
 991  This is the "stage3" response after a bind request and reply.
 992 *******************************************************************/
 993
 994 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
 995 {
 996         struct dcerpc_auth auth_info;
 997         DATA_BLOB response = data_blob_null;
 998         struct gensec_security *gensec_security;
 999         NTSTATUS status;
1000
1001         DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
1002
1003         if (!p->allow_auth3) {
1004                 DEBUG(1, ("Pipe not in allow auth3 state.\n"));
1005                 goto err;
1006         }
1007
1008         status = dcerpc_verify_ncacn_packet_header(pkt,
1009                         DCERPC_PKT_AUTH3,
1010                         pkt->u.auth3.auth_info.length,
1011                         0, /* required flags */
1012                         DCERPC_PFC_FLAG_FIRST |
1013                         DCERPC_PFC_FLAG_LAST |
1014                         DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
1015                         0x08 | /* this is not defined, but should be ignored */
1016                         DCERPC_PFC_FLAG_CONC_MPX |
1017                         DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
1018                         DCERPC_PFC_FLAG_MAYBE |
1019                         DCERPC_PFC_FLAG_OBJECT_UUID);
1020         if (!NT_STATUS_IS_OK(status)) {
1021                 DEBUG(1, ("api_pipe_bind_auth3: invalid pdu: %s\n",
1022                           nt_errstr(status)));
1023                 NDR_PRINT_DEBUG(ncacn_packet, pkt);
1024                 goto err;
1025         }
1026
1027         /* We can only finish if the pipe is unbound for now */
1028         if (p->pipe_bound) {
1029                 DEBUG(0, (__location__ ": Pipe already bound, "
1030                           "AUTH3 not supported!\n"));
1031                 goto err;
1032         }
1033
1034         if (pkt->auth_length == 0) {
1035                 DEBUG(1, ("No auth field sent for auth3 request!\n"));
1036                 goto err;
1037         }
1038
1039         /*
1040          * Decode the authentication verifier response.
1041          */
1042
1043         status = dcerpc_pull_auth_trailer(pkt, pkt,
1044                                           &pkt->u.auth3.auth_info,
1045                                           &auth_info, NULL, true);
1046         if (!NT_STATUS_IS_OK(status)) {
1047                 DEBUG(1, ("Failed to unmarshall dcerpc_auth.\n"));
1048                 goto err;
1049         }
1050
1051         /* We must NEVER look at auth_info->auth_pad_len here,
1052          * as old Samba client code gets it wrong and sends it
1053          * as zero. JRA.
1054          */
1055
1056         if (auth_info.auth_type != p->auth.auth_type) {
1057                 DEBUG(1, ("Auth type mismatch! Client sent %d, "
1058                           "but auth was started as type %d!\n",
1059                           auth_info.auth_type, p->auth.auth_type));
1060                 goto err;
1061         }
1062
1063         if (auth_info.auth_level != p->auth.auth_level) {
1064                 DEBUG(1, ("Auth level mismatch! Client sent %d, "
1065                           "but auth was started as level %d!\n",
1066                           auth_info.auth_level, p->auth.auth_level));
1067                 goto err;
1068         }
1069
1070         if (auth_info.auth_context_id != p->auth.auth_context_id) {
1071                 DEBUG(0, ("Auth context id mismatch! Client sent %u, "
1072                           "but auth was started as level %u!\n",
1073                           (unsigned)auth_info.auth_context_id,
1074                           (unsigned)p->auth.auth_context_id));
1075                 goto err;
1076         }
1077
1078         gensec_security = p->auth.auth_ctx;
1079
1080         status = auth_generic_server_step(gensec_security,
1081                                           pkt, &auth_info.credentials,
1082                                           &response);
1083
1084         if (NT_STATUS_EQUAL(status,
1085                             NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1086             response.length) {
1087                 DEBUG(1, (__location__ ": This was supposed to be the final "
1088                           "leg, but crypto machinery claims a response is "
1089                           "needed, aborting auth!\n"));
1090                 data_blob_free(&response);
1091                 goto err;
1092         }
1093         if (!NT_STATUS_IS_OK(status)) {
1094                 DEBUG(2, ("Auth failed (%s)\n", nt_errstr(status)));
1095                 goto err;
1096         }
1097
1098         /* Now verify auth was indeed successful and extract server info */
1099         status = pipe_auth_verify_final(p);
1100         if (!NT_STATUS_IS_OK(status)) {
1101                 DEBUG(2, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1102                 goto err;
1103         }
1104
1105         return true;
1106
1107 err:
1108         p->pipe_bound = false;
1109         p->allow_bind = false;
1110         p->allow_alter = false;
1111         p->allow_auth3 = false;
1112
1113         TALLOC_FREE(p->auth.auth_ctx);
1114         return false;
1115 }
1116
1117 /****************************************************************************
1118  Deal with an alter context call. Can be third part of 3 leg auth request for
1119  SPNEGO calls.
1120 ****************************************************************************/
1121
1122 static bool api_pipe_alter_context(struct pipes_struct *p,
1123                                         struct ncacn_packet *pkt)
1124 {
1125         struct dcerpc_auth auth_info = {0};
1126         uint16_t assoc_gid;
1127         NTSTATUS status;
1128         union dcerpc_payload u;
1129         struct dcerpc_ack_ctx alter_ack_ctx;
1130         DATA_BLOB auth_resp = data_blob_null;
1131         DATA_BLOB auth_blob = data_blob_null;
1132         struct gensec_security *gensec_security;
1133
1134         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1135
1136         if (!p->allow_alter) {
1137                 DEBUG(1, ("Pipe not in allow alter state.\n"));
1138                 goto err_exit;
1139         }
1140
1141         status = dcerpc_verify_ncacn_packet_header(pkt,
1142                         DCERPC_PKT_ALTER,
1143                         pkt->u.alter.auth_info.length,
1144                         0, /* required flags */
1145                         DCERPC_PFC_FLAG_FIRST |
1146                         DCERPC_PFC_FLAG_LAST |
1147                         DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
1148                         0x08 | /* this is not defined, but should be ignored */
1149                         DCERPC_PFC_FLAG_CONC_MPX |
1150                         DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
1151                         DCERPC_PFC_FLAG_MAYBE |
1152                         DCERPC_PFC_FLAG_OBJECT_UUID);
1153         if (!NT_STATUS_IS_OK(status)) {
1154                 DEBUG(1, ("api_pipe_alter_context: invalid pdu: %s\n",
1155                           nt_errstr(status)));
1156                 NDR_PRINT_DEBUG(ncacn_packet, pkt);
1157                 goto err_exit;
1158         }
1159
1160         if (pkt->u.alter.num_contexts == 0) {
1161                 DEBUG(1, ("api_pipe_alter_context: no rpc contexts around\n"));
1162                 goto err_exit;
1163         }
1164
1165         if (pkt->u.alter.ctx_list[0].num_transfer_syntaxes == 0) {
1166                 DEBUG(1, ("api_pipe_alter_context: no transfer syntaxes around\n"));
1167                 goto err_exit;
1168         }
1169
1170         if (pkt->u.alter.assoc_group_id != 0) {
1171                 assoc_gid = pkt->u.alter.assoc_group_id;
1172         } else {
1173                 assoc_gid = 0x53f0;
1174         }
1175
1176         /*
1177          * Create the bind response struct.
1178          */
1179
1180         /* If the requested abstract synt uuid doesn't match our client pipe,
1181                 reject the alter_ack & set the transfer interface synt to all 0's,
1182                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1183                 unknown to NT4)
1184                 Needed when adding entries to a DACL from NT5 - SK */
1185
1186         if (check_bind_req(p,
1187                         &pkt->u.alter.ctx_list[0].abstract_syntax,
1188                         &pkt->u.alter.ctx_list[0].transfer_syntaxes[0],
1189                         pkt->u.alter.ctx_list[0].context_id)) {
1190
1191                 alter_ack_ctx.result = 0;
1192                 alter_ack_ctx.reason.value = 0;
1193                 alter_ack_ctx.syntax = pkt->u.alter.ctx_list[0].transfer_syntaxes[0];
1194         } else {
1195                 /* Rejection reason: abstract syntax not supported */
1196                 alter_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1197                 alter_ack_ctx.reason.value = DCERPC_BIND_REASON_ASYNTAX;
1198                 alter_ack_ctx.syntax = ndr_syntax_id_null;
1199         }
1200
1201         /*
1202          * Check if this is an authenticated alter context request.
1203          */
1204         if (pkt->auth_length) {
1205                 /* We can only finish if the pipe is unbound for now */
1206                 if (p->pipe_bound) {
1207                         DEBUG(0, (__location__ ": Pipe already bound, "
1208                                   "Altering Context not yet supported!\n"));
1209                         goto err_exit;
1210                 }
1211
1212                 status = dcerpc_pull_auth_trailer(pkt, pkt,
1213                                                   &pkt->u.alter.auth_info,
1214                                                   &auth_info, NULL, true);
1215                 if (!NT_STATUS_IS_OK(status)) {
1216                         DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1217                         goto err_exit;
1218                 }
1219
1220                 if (auth_info.auth_type != p->auth.auth_type) {
1221                         DEBUG(0, ("Auth type mismatch! Client sent %d, "
1222                                   "but auth was started as type %d!\n",
1223                                   auth_info.auth_type, p->auth.auth_type));
1224                         goto err_exit;
1225                 }
1226
1227                 if (auth_info.auth_level != p->auth.auth_level) {
1228                         DEBUG(0, ("Auth level mismatch! Client sent %d, "
1229                                   "but auth was started as level %d!\n",
1230                                   auth_info.auth_level, p->auth.auth_level));
1231                         goto err_exit;
1232                 }
1233
1234                 if (auth_info.auth_context_id != p->auth.auth_context_id) {
1235                         DEBUG(0, ("Auth context id mismatch! Client sent %u, "
1236                                   "but auth was started as level %u!\n",
1237                                   (unsigned)auth_info.auth_context_id,
1238                                   (unsigned)p->auth.auth_context_id));
1239                         goto err_exit;
1240                 }
1241
1242                 gensec_security = p->auth.auth_ctx;
1243                 status = auth_generic_server_step(gensec_security,
1244                                                   pkt,
1245                                                   &auth_info.credentials,
1246                                                   &auth_resp);
1247                 if (NT_STATUS_IS_OK(status)) {
1248                         /* third leg of auth, verify auth info */
1249                         status = pipe_auth_verify_final(p);
1250                         if (!NT_STATUS_IS_OK(status)) {
1251                                 DEBUG(0, ("Auth Verify failed (%s)\n",
1252                                           nt_errstr(status)));
1253                                 goto err_exit;
1254                         }
1255                 } else if (NT_STATUS_EQUAL(status,
1256                                         NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1257                         DEBUG(10, ("More auth legs required.\n"));
1258                 } else {
1259                         DEBUG(0, ("Auth step returned an error (%s)\n",
1260                                   nt_errstr(status)));
1261                         goto err_exit;
1262                 }
1263         }
1264
1265         ZERO_STRUCT(u.alter_resp);
1266         u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1267         u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1268         u.alter_resp.assoc_group_id = assoc_gid;
1269
1270         /* secondary address CAN be NULL
1271          * as the specs say it's ignored.
1272          * It MUST be NULL to have the spoolss working.
1273          */
1274         u.alter_resp.secondary_address = "";
1275         u.alter_resp.secondary_address_size = 1;
1276
1277         u.alter_resp.num_results = 1;
1278         u.alter_resp.ctx_list = &alter_ack_ctx;
1279
1280         /* NOTE: We leave the auth_info empty so we can calculate the padding
1281          * later and then append the auth_info --simo */
1282
1283         /*
1284          * Marshall directly into the outgoing PDU space. We
1285          * must do this as we need to set to the bind response
1286          * header and are never sending more than one PDU here.
1287          */
1288
1289         status = dcerpc_push_ncacn_packet(p->mem_ctx,
1290                                           DCERPC_PKT_ALTER_RESP,
1291                                           DCERPC_PFC_FLAG_FIRST |
1292                                                 DCERPC_PFC_FLAG_LAST,
1293                                           auth_resp.length,
1294                                           pkt->call_id,
1295                                           &u,
1296                                           &p->out_data.frag);
1297         if (!NT_STATUS_IS_OK(status)) {
1298                 DEBUG(0, ("Failed to marshall alter_resp packet. (%s)\n",
1299                           nt_errstr(status)));
1300                 goto err_exit;
1301         }
1302
1303         if (auth_resp.length) {
1304                 status = dcerpc_push_dcerpc_auth(pkt,
1305                                                  p->auth.auth_type,
1306                                                  p->auth.auth_level,
1307                                                  0, /* pad_len */
1308                                                  p->auth.auth_context_id,
1309                                                  &auth_resp,
1310                                                  &auth_blob);
1311                 if (!NT_STATUS_IS_OK(status)) {
1312                         DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1313                         goto err_exit;
1314                 }
1315         }
1316
1317         /* Now that we have the auth len store it into the right place in
1318          * the dcerpc header */
1319         dcerpc_set_frag_length(&p->out_data.frag,
1320                                 p->out_data.frag.length +
1321                                 auth_blob.length);
1322
1323         if (auth_resp.length) {
1324                 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1325                                         auth_blob.data, auth_blob.length)) {
1326                         DEBUG(0, ("Append of auth info failed.\n"));
1327                         goto err_exit;
1328                 }
1329         }
1330
1331         /*
1332          * Setup the lengths for the initial reply.
1333          */
1334
1335         p->out_data.data_sent_length = 0;
1336         p->out_data.current_pdu_sent = 0;
1337
1338         TALLOC_FREE(auth_blob.data);
1339         return True;
1340
1341   err_exit:
1342
1343         data_blob_free(&p->out_data.frag);
1344         TALLOC_FREE(auth_blob.data);
1345         return setup_bind_nak(p, pkt);
1346 }
1347
1348 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1349                        const struct api_struct *api_rpc_cmds, int n_cmds,
1350                        const struct ndr_syntax_id *syntax);
1351
1352 static bool srv_pipe_check_verification_trailer(struct pipes_struct *p,
1353                                                 struct ncacn_packet *pkt,
1354                                                 struct pipe_rpc_fns *pipe_fns)
1355 {
1356         TALLOC_CTX *frame = talloc_stackframe();
1357         struct dcerpc_sec_verification_trailer *vt = NULL;
1358         const uint32_t bitmask1 =
1359                 p->auth.client_hdr_signing ? DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING : 0;
1360         const struct dcerpc_sec_vt_pcontext pcontext = {
1361                 .abstract_syntax = pipe_fns->syntax,
1362                 .transfer_syntax = ndr_transfer_syntax_ndr,
1363         };
1364         const struct dcerpc_sec_vt_header2 header2 =
1365                dcerpc_sec_vt_header2_from_ncacn_packet(pkt);
1366         struct ndr_pull *ndr;
1367         enum ndr_err_code ndr_err;
1368         bool ret = false;
1369
1370         ndr = ndr_pull_init_blob(&p->in_data.data, frame);
1371         if (ndr == NULL) {
1372                 goto done;
1373         }
1374
1375         ndr_err = ndr_pop_dcerpc_sec_verification_trailer(ndr, frame, &vt);
1376         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1377                 goto done;
1378         }
1379
1380         ret = dcerpc_sec_verification_trailer_check(vt, &bitmask1,
1381                                                     &pcontext, &header2);
1382 done:
1383         TALLOC_FREE(frame);
1384         return ret;
1385 }
1386
1387 /****************************************************************************
1388  Find the correct RPC function to call for this request.
1389  If the pipe is authenticated then become the correct UNIX user
1390  before doing the call.
1391 ****************************************************************************/
1392
1393 static bool api_pipe_request(struct pipes_struct *p,
1394                                 struct ncacn_packet *pkt)
1395 {
1396         TALLOC_CTX *frame = talloc_stackframe();
1397         bool ret = False;
1398         struct pipe_rpc_fns *pipe_fns;
1399         const char *interface_name = NULL;
1400
1401         if (!p->pipe_bound) {
1402                 DEBUG(1, ("Pipe not bound!\n"));
1403                 data_blob_free(&p->out_data.rdata);
1404                 TALLOC_FREE(frame);
1405                 return false;
1406         }
1407
1408         /* get the set of RPC functions for this context */
1409         pipe_fns = find_pipe_fns_by_context(p->contexts,
1410                                             pkt->u.request.context_id);
1411         if (pipe_fns == NULL) {
1412                 DEBUG(0, ("No rpc function table associated with context "
1413                           "[%d]\n",
1414                           pkt->u.request.context_id));
1415                 data_blob_free(&p->out_data.rdata);
1416                 TALLOC_FREE(frame);
1417                 return false;
1418         }
1419
1420         interface_name = ndr_interface_name(&pipe_fns->syntax.uuid,
1421                                             pipe_fns->syntax.if_version);
1422         SMB_ASSERT(interface_name != NULL);
1423
1424         if (p->auth.auth_level < pipe_fns->min_auth_level) {
1425
1426                 DEBUG(1, ("%s: auth level required for %s: 0x%x, got: 0x%0x\n",
1427                           __func__, interface_name,
1428                           pipe_fns->min_auth_level,
1429                           p->auth.auth_level));
1430
1431                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_ACCESS_DENIED));
1432                 TALLOC_FREE(frame);
1433                 return true;
1434         }
1435
1436         switch (p->auth.auth_level) {
1437         case DCERPC_AUTH_LEVEL_NONE:
1438         case DCERPC_AUTH_LEVEL_PACKET:
1439         case DCERPC_AUTH_LEVEL_INTEGRITY:
1440         case DCERPC_AUTH_LEVEL_PRIVACY:
1441                 break;
1442         default:
1443                 if (!pipe_fns->allow_connect) {
1444                         char *addr;
1445
1446                         addr = tsocket_address_string(p->remote_address, frame);
1447
1448                         DEBUG(1, ("%s: restrict auth_level_connect access "
1449                                   "to [%s] with auth[type=0x%x,level=0x%x] "
1450                                   "on [%s] from [%s]\n",
1451                                   __func__, interface_name,
1452                                   p->auth.auth_type,
1453                                   p->auth.auth_level,
1454                                   derpc_transport_string_by_transport(p->transport),
1455                                   addr));
1456
1457                         setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_ACCESS_DENIED));
1458                         TALLOC_FREE(frame);
1459                         return true;
1460                 }
1461                 break;
1462         }
1463
1464         if (!srv_pipe_check_verification_trailer(p, pkt, pipe_fns)) {
1465                 DEBUG(1, ("srv_pipe_check_verification_trailer: failed\n"));
1466                 set_incoming_fault(p);
1467                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_ACCESS_DENIED));
1468                 data_blob_free(&p->out_data.rdata);
1469                 TALLOC_FREE(frame);
1470                 return true;
1471         }
1472
1473         if (!become_authenticated_pipe_user(p->session_info)) {
1474                 DEBUG(1, ("Failed to become pipe user!\n"));
1475                 data_blob_free(&p->out_data.rdata);
1476                 TALLOC_FREE(frame);
1477                 return false;
1478         }
1479
1480         DEBUG(5, ("Requested %s rpc service\n", interface_name));
1481
1482         ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds,
1483                          &pipe_fns->syntax);
1484         unbecome_authenticated_pipe_user();
1485
1486         TALLOC_FREE(frame);
1487         return ret;
1488 }
1489
1490 /*******************************************************************
1491  Calls the underlying RPC function for a named pipe.
1492  ********************************************************************/
1493
1494 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1495                        const struct api_struct *api_rpc_cmds, int n_cmds,
1496                        const struct ndr_syntax_id *syntax)
1497 {
1498         int fn_num;
1499         uint32_t offset1;
1500         const struct ndr_interface_table *table;
1501
1502         /* interpret the command */
1503         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1504                  ndr_interface_name(&syntax->uuid, syntax->if_version),
1505                  pkt->u.request.opnum));
1506
1507         table = ndr_table_by_uuid(&syntax->uuid);
1508         if (table == NULL) {
1509                 DEBUG(0,("unknown interface\n"));
1510                 return false;
1511         }
1512
1513         if (DEBUGLEVEL >= 50) {
1514                 fstring name;
1515                 slprintf(name, sizeof(name)-1, "in_%s",
1516                          dcerpc_default_transport_endpoint(pkt, NCACN_NP, table));
1517                 dump_pdu_region(name, pkt->u.request.opnum,
1518                                 &p->in_data.data, 0,
1519                                 p->in_data.data.length);
1520         }
1521
1522         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1523                 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1524                     api_rpc_cmds[fn_num].fn != NULL) {
1525                         DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1526                                   api_rpc_cmds[fn_num].name));
1527                         break;
1528                 }
1529         }
1530
1531         if (fn_num == n_cmds) {
1532                 /*
1533                  * For an unknown RPC just return a fault PDU but
1534                  * return True to allow RPC's on the pipe to continue
1535                  * and not put the pipe into fault state. JRA.
1536                  */
1537                 DEBUG(4, ("unknown\n"));
1538                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1539                 return True;
1540         }
1541
1542         offset1 = p->out_data.rdata.length;
1543
1544         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1545                 fn_num, api_rpc_cmds[fn_num].fn));
1546         /* do the actual command */
1547         if(!api_rpc_cmds[fn_num].fn(p)) {
1548                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1549                          ndr_interface_name(&syntax->uuid, syntax->if_version),
1550                          api_rpc_cmds[fn_num].name));
1551                 data_blob_free(&p->out_data.rdata);
1552                 return False;
1553         }
1554
1555         if (p->fault_state) {
1556                 DEBUG(4,("api_rpcTNP: fault(%d) return.\n", p->fault_state));
1557                 setup_fault_pdu(p, NT_STATUS(p->fault_state));
1558                 p->fault_state = 0;
1559                 return true;
1560         }
1561
1562         if (DEBUGLEVEL >= 50) {
1563                 fstring name;
1564                 slprintf(name, sizeof(name)-1, "out_%s",
1565                          dcerpc_default_transport_endpoint(pkt, NCACN_NP, table));
1566                 dump_pdu_region(name, pkt->u.request.opnum,
1567                                 &p->out_data.rdata, offset1,
1568                                 p->out_data.rdata.length);
1569         }
1570
1571         DEBUG(5,("api_rpcTNP: called %s successfully\n",
1572                  ndr_interface_name(&syntax->uuid, syntax->if_version)));
1573
1574         /* Check for buffer underflow in rpc parsing */
1575         if ((DEBUGLEVEL >= 10) &&
1576             (pkt->frag_length < p->in_data.data.length)) {
1577                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1578                 dump_data(10, p->in_data.data.data + pkt->frag_length,
1579                               p->in_data.data.length - pkt->frag_length);
1580         }
1581
1582         return True;
1583 }
1584
1585 /****************************************************************************
1586  Initialise an outgoing packet.
1587 ****************************************************************************/
1588
1589 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1590 {
1591         output_data *o_data = &p->out_data;
1592
1593         /* Reset the offset counters. */
1594         o_data->data_sent_length = 0;
1595         o_data->current_pdu_sent = 0;
1596
1597         data_blob_free(&o_data->frag);
1598
1599         /* Free any memory in the current return data buffer. */
1600         data_blob_free(&o_data->rdata);
1601
1602         return True;
1603 }
1604
1605 /****************************************************************************
1606  Sets the fault state on incoming packets.
1607 ****************************************************************************/
1608
1609 void set_incoming_fault(struct pipes_struct *p)
1610 {
1611         data_blob_free(&p->in_data.data);
1612         p->in_data.pdu_needed_len = 0;
1613         p->in_data.pdu.length = 0;
1614         p->fault_state = DCERPC_NCA_S_PROTO_ERROR;
1615
1616         p->allow_alter = false;
1617         p->allow_auth3 = false;
1618         p->pipe_bound = false;
1619
1620         DEBUG(10, ("Setting fault state\n"));
1621 }
1622
1623 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1624                                     struct ncacn_packet *pkt,
1625                                     DATA_BLOB *raw_pkt)
1626 {
1627         NTSTATUS status;
1628         size_t hdr_size = DCERPC_REQUEST_LENGTH;
1629
1630         DEBUG(10, ("Checking request auth.\n"));
1631
1632         if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1633                 hdr_size += 16;
1634         }
1635
1636         /* in case of sealing this function will unseal the data in place */
1637         status = dcerpc_check_auth(auth, pkt,
1638                                    &pkt->u.request.stub_and_verifier,
1639                                    hdr_size, raw_pkt);
1640         if (!NT_STATUS_IS_OK(status)) {
1641                 return status;
1642         }
1643
1644         return NT_STATUS_OK;
1645 }
1646
1647 /****************************************************************************
1648  Processes a request pdu. This will do auth processing if needed, and
1649  appends the data into the complete stream if the LAST flag is not set.
1650 ****************************************************************************/
1651
1652 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1653 {
1654         NTSTATUS status;
1655         DATA_BLOB data;
1656         struct dcerpc_sec_vt_header2 hdr2;
1657
1658         if (!p->pipe_bound) {
1659                 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1660                 set_incoming_fault(p);
1661                 return False;
1662         }
1663
1664         /*
1665          * We don't ignore DCERPC_PFC_FLAG_PENDING_CANCEL.
1666          * TODO: we can reject it with DCERPC_FAULT_NO_CALL_ACTIVE later.
1667          */
1668         status = dcerpc_verify_ncacn_packet_header(pkt,
1669                         DCERPC_PKT_REQUEST,
1670                         pkt->u.request.stub_and_verifier.length,
1671                         0, /* required_flags */
1672                         DCERPC_PFC_FLAG_FIRST |
1673                         DCERPC_PFC_FLAG_LAST |
1674                         0x08 | /* this is not defined, but should be ignored */
1675                         DCERPC_PFC_FLAG_CONC_MPX |
1676                         DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
1677                         DCERPC_PFC_FLAG_MAYBE |
1678                         DCERPC_PFC_FLAG_OBJECT_UUID);
1679         if (!NT_STATUS_IS_OK(status)) {
1680                 DEBUG(1, ("process_request_pdu: invalid pdu: %s\n",
1681                           nt_errstr(status)));
1682                 NDR_PRINT_DEBUG(ncacn_packet, pkt);
1683                 set_incoming_fault(p);
1684                 return false;
1685         }
1686
1687         hdr2 = dcerpc_sec_vt_header2_from_ncacn_packet(pkt);
1688         if (pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST) {
1689                 p->header2 = hdr2;
1690         } else {
1691                 if (!dcerpc_sec_vt_header2_equal(&hdr2, &p->header2)) {
1692                         set_incoming_fault(p);
1693                         return false;
1694                 }
1695         }
1696
1697         /* Store the opnum */
1698         p->opnum = pkt->u.request.opnum;
1699
1700         status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1701         if (!NT_STATUS_IS_OK(status)) {
1702                 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1703                           nt_errstr(status)));
1704                 set_incoming_fault(p);
1705                 return false;
1706         }
1707
1708         data = pkt->u.request.stub_and_verifier;
1709
1710         /*
1711          * Check the data length doesn't go over the 15Mb limit.
1712          * increased after observing a bug in the Windows NT 4.0 SP6a
1713          * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1714          * will not fit in the initial buffer of size 0x1068   --jerry 22/01/2002
1715          */
1716
1717         if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1718                 DEBUG(0, ("process_request_pdu: "
1719                           "rpc data buffer too large (%u) + (%u)\n",
1720                           (unsigned int)p->in_data.data.length,
1721                           (unsigned int)data.length));
1722                 set_incoming_fault(p);
1723                 return False;
1724         }
1725
1726         /*
1727          * Append the data portion into the buffer and return.
1728          */
1729
1730         if (data.length) {
1731                 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1732                                           data.data, data.length)) {
1733                         DEBUG(0, ("Unable to append data size %u "
1734                                   "to parse buffer of size %u.\n",
1735                                   (unsigned int)data.length,
1736                                   (unsigned int)p->in_data.data.length));
1737                         set_incoming_fault(p);
1738                         return False;
1739                 }
1740         }
1741
1742         if (!(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
1743                 return true;
1744         }
1745
1746         /*
1747          * Ok - we finally have a complete RPC stream.
1748          * Call the rpc command to process it.
1749          */
1750
1751         return api_pipe_request(p, pkt);
1752 }
1753
1754 void process_complete_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1755 {
1756         bool reply = false;
1757
1758         /* Store the call_id */
1759         p->call_id = pkt->call_id;
1760
1761         DEBUG(10, ("Processing packet type %u\n", (unsigned int)pkt->ptype));
1762
1763         if (!pipe_init_outgoing_data(p)) {
1764                 goto done;
1765         }
1766
1767         switch (pkt->ptype) {
1768         case DCERPC_PKT_REQUEST:
1769                 reply = process_request_pdu(p, pkt);
1770                 break;
1771
1772         case DCERPC_PKT_PING: /* CL request - ignore... */
1773                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1774                           (unsigned int)pkt->ptype));
1775                 break;
1776
1777         case DCERPC_PKT_RESPONSE: /* No responses here. */
1778                 DEBUG(0, ("Error - DCERPC_PKT_RESPONSE received from client"));
1779                 break;
1780
1781         case DCERPC_PKT_FAULT:
1782         case DCERPC_PKT_WORKING:
1783                 /* CL request - reply to a ping when a call in process. */
1784         case DCERPC_PKT_NOCALL:
1785                 /* CL - server reply to a ping call. */
1786         case DCERPC_PKT_REJECT:
1787         case DCERPC_PKT_ACK:
1788         case DCERPC_PKT_CL_CANCEL:
1789         case DCERPC_PKT_FACK:
1790         case DCERPC_PKT_CANCEL_ACK:
1791                 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1792                           (unsigned int)pkt->ptype));
1793                 break;
1794
1795         case DCERPC_PKT_BIND:
1796                 /*
1797                  * We assume that a pipe bind is only in one pdu.
1798                  */
1799                 reply = api_pipe_bind_req(p, pkt);
1800                 break;
1801
1802         case DCERPC_PKT_BIND_ACK:
1803         case DCERPC_PKT_BIND_NAK:
1804                 DEBUG(0, ("Error - DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1805                           "packet type %u received.\n",
1806                           (unsigned int)pkt->ptype));
1807                 break;
1808
1809
1810         case DCERPC_PKT_ALTER:
1811                 /*
1812                  * We assume that a pipe bind is only in one pdu.
1813                  */
1814                 reply = api_pipe_alter_context(p, pkt);
1815                 break;
1816
1817         case DCERPC_PKT_ALTER_RESP:
1818                 DEBUG(0, ("Error - DCERPC_PKT_ALTER_RESP received: "
1819                           "Should only be server -> client.\n"));
1820                 break;
1821
1822         case DCERPC_PKT_AUTH3:
1823                 /*
1824                  * The third packet in an auth exchange.
1825                  */
1826                 reply = api_pipe_bind_auth3(p, pkt);
1827                 break;
1828
1829         case DCERPC_PKT_SHUTDOWN:
1830                 DEBUG(0, ("Error - DCERPC_PKT_SHUTDOWN received: "
1831                           "Should only be server -> client.\n"));
1832                 break;
1833
1834         case DCERPC_PKT_CO_CANCEL:
1835                 /* For now just free all client data and continue
1836                  * processing. */
1837                 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1838                          " Abandoning rpc call.\n"));
1839                 /* As we never do asynchronous RPC serving, we can
1840                  * never cancel a call (as far as I know).
1841                  * If we ever did we'd have to send a cancel_ack reply.
1842                  * For now, just free all client data and continue
1843                  * processing. */
1844                 reply = True;
1845                 break;
1846
1847 #if 0
1848                 /* Enable this if we're doing async rpc. */
1849                 /* We must check the outstanding callid matches. */
1850                 if (pipe_init_outgoing_data(p)) {
1851                         /* Send a cancel_ack PDU reply. */
1852                         /* We should probably check the auth-verifier here. */
1853                         reply = setup_cancel_ack_reply(p, pkt);
1854                 }
1855                 break;
1856 #endif
1857
1858         case DCERPC_PKT_ORPHANED:
1859                 /* We should probably check the auth-verifier here.
1860                  * For now just free all client data and continue
1861                  * processing. */
1862                 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
1863                           " Abandoning rpc call.\n"));
1864                 reply = True;
1865                 break;
1866
1867         default:
1868                 DEBUG(0, ("process_complete_pdu: "
1869                           "Unknown rpc type = %u received.\n",
1870                           (unsigned int)pkt->ptype));
1871                 break;
1872         }
1873
1874 done:
1875         if (!reply) {
1876                 DEBUG(3,("DCE/RPC fault sent!"));
1877                 set_incoming_fault(p);
1878                 setup_fault_pdu(p, NT_STATUS(DCERPC_NCA_S_PROTO_ERROR));
1879         }
1880         /* pkt and p->in_data.pdu.data freed by caller */
1881 }
1882