?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-passdb: Fix typo in comment.
[Samba.git] / source3 / rpc_server / srv_pipe.c
blobd1f9823b497b8adb07b76371db1ab1a2ba7ee1fb
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 /* this module apparently provides an implementation of DCE/RPC over a
21 * named pipe (IPC$ connection using SMBtrans). details of DCE/RPC
22 * documentation are available (in on-line form) from the X-Open group.
23 *
24 * this module should provide a level of abstraction between SMB
25 * and DCE/RPC, while minimising the amount of mallocs, unnecessary
26 * data copies, and network traffic.
27 *
28 */
29
30 #include "includes.h"
31 #include "srv_pipe_internal.h"
32 #include "../librpc/gen_ndr/ndr_schannel.h"
33 #include "../libcli/auth/schannel.h"
34 #include "../libcli/auth/spnego.h"
35 #include "../libcli/auth/ntlmssp.h"
36
37 #undef DBGC_CLASS
38 #define DBGC_CLASS DBGC_RPC_SRV
39
40 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
41 {
42 struct auth_ntlmssp_state *a = auth->a_u.auth_ntlmssp_state;
43
44 if (a) {
45 auth_ntlmssp_end(&a);
46 }
47 auth->a_u.auth_ntlmssp_state = NULL;
48 }
49
50 static DATA_BLOB generic_session_key(void)
51 {
52 return data_blob("SystemLibraryDTC", 16);
53 }
54
55 /*******************************************************************
56 Generate the next PDU to be returned from the data in p->rdata.
57 Handle NTLMSSP.
58 ********************************************************************/
59
60 static bool create_next_pdu_ntlmssp(pipes_struct *p)
61 {
62 RPC_HDR_RESP hdr_resp;
63 uint32 ss_padding_len = 0;
64 uint32 data_space_available;
65 uint32 data_len_left;
66 uint32 data_len;
67 NTSTATUS status;
68 DATA_BLOB auth_blob;
69 RPC_HDR_AUTH auth_info;
70 uint8 auth_type, auth_level;
71 struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
72 TALLOC_CTX *frame;
73
74 /*
75 * If we're in the fault state, keep returning fault PDU's until
76 * the pipe gets closed. JRA.
77 */
78
79 if(p->fault_state) {
80 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
81 return True;
82 }
83
84 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
85
86 /* Change the incoming request header to a response. */
87 p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
88
89 /* Set up rpc header flags. */
90 if (p->out_data.data_sent_length == 0) {
91 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
92 } else {
93 p->hdr.flags = 0;
94 }
95
96 /*
97 * Work out how much we can fit in a single PDU.
98 */
99
100 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
101
102 /*
103 * Ensure there really is data left to send.
104 */
105
106 if(!data_len_left) {
107 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
108 return False;
109 }
110
111 /* Space available - not including padding. */
112 data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN -
113 RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
114
115 /*
116 * The amount we send is the minimum of the available
117 * space and the amount left to send.
118 */
119
120 data_len = MIN(data_len_left, data_space_available);
121
122 /* Work out any padding alignment requirements. */
123 if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
124 ss_padding_len = SERVER_NDR_PADDING_SIZE -
125 ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
126 DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
127 ss_padding_len ));
128 /* If we're over filling the packet, we need to make space
129 * for the padding at the end of the data. */
130 if (data_len + ss_padding_len > data_space_available) {
131 data_len -= SERVER_NDR_PADDING_SIZE;
132 }
133 }
134
135 /*
136 * Set up the alloc hint. This should be the data left to
137 * send.
138 */
139
140 hdr_resp.alloc_hint = data_len_left;
141
142 /*
143 * Work out if this PDU will be the last.
144 */
145
146 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
147 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
148 }
149
150 /*
151 * Set up the header lengths.
152 */
153
154 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
155 data_len + ss_padding_len +
156 RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
157 p->hdr.auth_len = NTLMSSP_SIG_SIZE;
158
159
160 /*
161 * Init the parse struct to point at the outgoing
162 * data.
163 */
164
165 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
166
167 /* Store the header in the data stream. */
168 if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
169 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
170 prs_mem_free(&p->out_data.frag);
171 return False;
172 }
173
174 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
175 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
176 prs_mem_free(&p->out_data.frag);
177 return False;
178 }
179
180 /* Copy the data into the PDU. */
181
182 if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
183 p->out_data.data_sent_length, data_len)) {
184 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
185 prs_mem_free(&p->out_data.frag);
186 return False;
187 }
188
189 /* Copy the sign/seal padding data. */
190 if (ss_padding_len) {
191 char pad[SERVER_NDR_PADDING_SIZE];
192
193 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
194 if (!prs_copy_data_in(&p->out_data.frag, pad,
195 ss_padding_len)) {
196 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
197 (unsigned int)ss_padding_len));
198 prs_mem_free(&p->out_data.frag);
199 return False;
200 }
201 }
202
203
204 /* Now write out the auth header and null blob. */
205 if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
206 auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
207 } else {
208 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
209 }
210 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
211 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
212 } else {
213 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
214 }
215
216 init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
217
218 if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
219 &p->out_data.frag, 0)) {
220 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
221 prs_mem_free(&p->out_data.frag);
222 return False;
223 }
224
225 /* Generate the sign blob. */
226
227 frame = talloc_stackframe();
228 switch (p->auth.auth_level) {
229 case DCERPC_AUTH_LEVEL_PRIVACY:
230 /* Data portion is encrypted. */
231 status = auth_ntlmssp_seal_packet(
232 a, frame,
233 (uint8_t *)prs_data_p(&p->out_data.frag)
234 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
235 data_len + ss_padding_len,
236 (unsigned char *)prs_data_p(&p->out_data.frag),
237 (size_t)prs_offset(&p->out_data.frag),
238 &auth_blob);
239 if (!NT_STATUS_IS_OK(status)) {
240 talloc_free(frame);
241 prs_mem_free(&p->out_data.frag);
242 return False;
243 }
244 break;
245 case DCERPC_AUTH_LEVEL_INTEGRITY:
246 /* Data is signed. */
247 status = auth_ntlmssp_sign_packet(
248 a, frame,
249 (unsigned char *)prs_data_p(&p->out_data.frag)
250 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
251 data_len + ss_padding_len,
252 (unsigned char *)prs_data_p(&p->out_data.frag),
253 (size_t)prs_offset(&p->out_data.frag),
254 &auth_blob);
255 if (!NT_STATUS_IS_OK(status)) {
256 talloc_free(frame);
257 prs_mem_free(&p->out_data.frag);
258 return False;
259 }
260 break;
261 default:
262 talloc_free(frame);
263 prs_mem_free(&p->out_data.frag);
264 return False;
265 }
266
267 /* Append the auth blob. */
268 if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
269 NTLMSSP_SIG_SIZE)) {
270 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
271 (unsigned int)NTLMSSP_SIG_SIZE));
272 talloc_free(frame);
273 prs_mem_free(&p->out_data.frag);
274 return False;
275 }
276 talloc_free(frame);
277
278 /*
279 * Setup the counts for this PDU.
280 */
281
282 p->out_data.data_sent_length += data_len;
283 p->out_data.current_pdu_sent = 0;
284
285 return True;
286 }
287
288 /*******************************************************************
289 Generate the next PDU to be returned from the data in p->rdata.
290 Return an schannel authenticated fragment.
291 ********************************************************************/
292
293 static bool create_next_pdu_schannel(pipes_struct *p)
294 {
295 RPC_HDR_RESP hdr_resp;
296 uint32 ss_padding_len = 0;
297 uint32 data_len;
298 uint32 data_space_available;
299 uint32 data_len_left;
300 uint32 data_pos;
301 NTSTATUS status;
302
303 /*
304 * If we're in the fault state, keep returning fault PDU's until
305 * the pipe gets closed. JRA.
306 */
307
308 if(p->fault_state) {
309 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
310 return True;
311 }
312
313 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
314
315 /* Change the incoming request header to a response. */
316 p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
317
318 /* Set up rpc header flags. */
319 if (p->out_data.data_sent_length == 0) {
320 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
321 } else {
322 p->hdr.flags = 0;
323 }
324
325 /*
326 * Work out how much we can fit in a single PDU.
327 */
328
329 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
330
331 /*
332 * Ensure there really is data left to send.
333 */
334
335 if(!data_len_left) {
336 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
337 return False;
338 }
339
340 /* Space available - not including padding. */
341 data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
342 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
343 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
344
345 /*
346 * The amount we send is the minimum of the available
347 * space and the amount left to send.
348 */
349
350 data_len = MIN(data_len_left, data_space_available);
351
352 /* Work out any padding alignment requirements. */
353 if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
354 ss_padding_len = SERVER_NDR_PADDING_SIZE -
355 ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
356 DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
357 ss_padding_len ));
358 /* If we're over filling the packet, we need to make space
359 * for the padding at the end of the data. */
360 if (data_len + ss_padding_len > data_space_available) {
361 data_len -= SERVER_NDR_PADDING_SIZE;
362 }
363 }
364
365 /*
366 * Set up the alloc hint. This should be the data left to
367 * send.
368 */
369
370 hdr_resp.alloc_hint = data_len_left;
371
372 /*
373 * Work out if this PDU will be the last.
374 */
375
376 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
377 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
378 }
379
380 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
381 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
382 p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
383
384 /*
385 * Init the parse struct to point at the outgoing
386 * data.
387 */
388
389 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
390
391 /* Store the header in the data stream. */
392 if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
393 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
394 prs_mem_free(&p->out_data.frag);
395 return False;
396 }
397
398 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
399 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
400 prs_mem_free(&p->out_data.frag);
401 return False;
402 }
403
404 /* Store the current offset. */
405 data_pos = prs_offset(&p->out_data.frag);
406
407 /* Copy the data into the PDU. */
408
409 if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
410 p->out_data.data_sent_length, data_len)) {
411 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
412 prs_mem_free(&p->out_data.frag);
413 return False;
414 }
415
416 /* Copy the sign/seal padding data. */
417 if (ss_padding_len) {
418 char pad[SERVER_NDR_PADDING_SIZE];
419 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
420 if (!prs_copy_data_in(&p->out_data.frag, pad,
421 ss_padding_len)) {
422 DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
423 prs_mem_free(&p->out_data.frag);
424 return False;
425 }
426 }
427
428 {
429 /*
430 * Schannel processing.
431 */
432 RPC_HDR_AUTH auth_info;
433 DATA_BLOB blob;
434 uint8_t *data;
435
436 /* Check it's the type of reply we were expecting to decode */
437
438 init_rpc_hdr_auth(&auth_info,
439 DCERPC_AUTH_TYPE_SCHANNEL,
440 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
441 DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
442 ss_padding_len, 1);
443
444 if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
445 &p->out_data.frag, 0)) {
446 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
447 prs_mem_free(&p->out_data.frag);
448 return False;
449 }
450
451 data = (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos;
452
453 switch (p->auth.auth_level) {
454 case DCERPC_AUTH_LEVEL_PRIVACY:
455 status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
456 talloc_tos(),
457 true,
458 data,
459 data_len + ss_padding_len,
460 &blob);
461 break;
462 case DCERPC_AUTH_LEVEL_INTEGRITY:
463 status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
464 talloc_tos(),
465 false,
466 data,
467 data_len + ss_padding_len,
468 &blob);
469 break;
470 default:
471 status = NT_STATUS_INTERNAL_ERROR;
472 break;
473 }
474
475 if (!NT_STATUS_IS_OK(status)) {
476 DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
477 nt_errstr(status)));
478 prs_mem_free(&p->out_data.frag);
479 return false;
480 }
481
482 /* Finally marshall the blob. */
483
484 if (DEBUGLEVEL >= 10) {
485 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
486 }
487
488 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
489 prs_mem_free(&p->out_data.frag);
490 return false;
491 }
492 }
493
494 /*
495 * Setup the counts for this PDU.
496 */
497
498 p->out_data.data_sent_length += data_len;
499 p->out_data.current_pdu_sent = 0;
500
501 return True;
502 }
503
504 /*******************************************************************
505 Generate the next PDU to be returned from the data in p->rdata.
506 No authentication done.
507 ********************************************************************/
508
509 static bool create_next_pdu_noauth(pipes_struct *p)
510 {
511 RPC_HDR_RESP hdr_resp;
512 uint32 data_len;
513 uint32 data_space_available;
514 uint32 data_len_left;
515
516 /*
517 * If we're in the fault state, keep returning fault PDU's until
518 * the pipe gets closed. JRA.
519 */
520
521 if(p->fault_state) {
522 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
523 return True;
524 }
525
526 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
527
528 /* Change the incoming request header to a response. */
529 p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
530
531 /* Set up rpc header flags. */
532 if (p->out_data.data_sent_length == 0) {
533 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
534 } else {
535 p->hdr.flags = 0;
536 }
537
538 /*
539 * Work out how much we can fit in a single PDU.
540 */
541
542 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
543
544 /*
545 * Ensure there really is data left to send.
546 */
547
548 if(!data_len_left) {
549 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
550 return False;
551 }
552
553 data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
554 - RPC_HDR_RESP_LEN;
555
556 /*
557 * The amount we send is the minimum of the available
558 * space and the amount left to send.
559 */
560
561 data_len = MIN(data_len_left, data_space_available);
562
563 /*
564 * Set up the alloc hint. This should be the data left to
565 * send.
566 */
567
568 hdr_resp.alloc_hint = data_len_left;
569
570 /*
571 * Work out if this PDU will be the last.
572 */
573
574 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
575 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
576 }
577
578 /*
579 * Set up the header lengths.
580 */
581
582 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
583 p->hdr.auth_len = 0;
584
585 /*
586 * Init the parse struct to point at the outgoing
587 * data.
588 */
589
590 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
591
592 /* Store the header in the data stream. */
593 if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
594 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
595 prs_mem_free(&p->out_data.frag);
596 return False;
597 }
598
599 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
600 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
601 prs_mem_free(&p->out_data.frag);
602 return False;
603 }
604
605 /* Copy the data into the PDU. */
606
607 if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
608 p->out_data.data_sent_length, data_len)) {
609 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
610 prs_mem_free(&p->out_data.frag);
611 return False;
612 }
613
614 /*
615 * Setup the counts for this PDU.
616 */
617
618 p->out_data.data_sent_length += data_len;
619 p->out_data.current_pdu_sent = 0;
620
621 return True;
622 }
623
624 /*******************************************************************
625 Generate the next PDU to be returned from the data in p->rdata.
626 ********************************************************************/
627
628 bool create_next_pdu(pipes_struct *p)
629 {
630 switch(p->auth.auth_level) {
631 case DCERPC_AUTH_LEVEL_NONE:
632 case DCERPC_AUTH_LEVEL_CONNECT:
633 /* This is incorrect for auth level connect. Fixme. JRA */
634 return create_next_pdu_noauth(p);
635
636 default:
637 switch(p->auth.auth_type) {
638 case PIPE_AUTH_TYPE_NTLMSSP:
639 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
640 return create_next_pdu_ntlmssp(p);
641 case PIPE_AUTH_TYPE_SCHANNEL:
642 return create_next_pdu_schannel(p);
643 default:
644 break;
645 }
646 }
647
648 DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
649 (unsigned int)p->auth.auth_level,
650 (unsigned int)p->auth.auth_type));
651 return False;
652 }
653
654 /*******************************************************************
655 Process an NTLMSSP authentication response.
656 If this function succeeds, the user has been authenticated
657 and their domain, name and calling workstation stored in
658 the pipe struct.
659 *******************************************************************/
660
661 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
662 {
663 DATA_BLOB session_key, reply;
664 NTSTATUS status;
665 struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
666 bool ret;
667
668 DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
669 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
670
671 ZERO_STRUCT(reply);
672
673 /* this has to be done as root in order to verify the password */
674 become_root();
675 status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
676 unbecome_root();
677
678 /* Don't generate a reply. */
679 data_blob_free(&reply);
680
681 if (!NT_STATUS_IS_OK(status)) {
682 return False;
683 }
684
685 /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
686 ensure the underlying NTLMSSP flags are also set. If not we should
687 refuse the bind. */
688
689 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
690 if (!auth_ntlmssp_negotiated_sign(a)) {
691 DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
692 "but client declined signing.\n",
693 get_pipe_name_from_syntax(talloc_tos(),
694 &p->syntax)));
695 return False;
696 }
697 }
698 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
699 if (!auth_ntlmssp_negotiated_seal(a)) {
700 DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
701 "but client declined sealing.\n",
702 get_pipe_name_from_syntax(talloc_tos(),
703 &p->syntax)));
704 return False;
705 }
706 }
707
708 DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
709 "workstation: %s\n",
710 auth_ntlmssp_get_username(a),
711 auth_ntlmssp_get_domain(a),
712 auth_ntlmssp_get_client(a)));
713
714 TALLOC_FREE(p->server_info);
715
716 p->server_info = auth_ntlmssp_server_info(p, a);
717 if (p->server_info == NULL) {
718 DEBUG(0, ("auth_ntlmssp_server_info failed to obtain the server info for authenticated user\n"));
719 return false;
720 }
721
722 if (p->server_info->ptok == NULL) {
723 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
724 return False;
725 }
726
727 /*
728 * We're an authenticated bind over smb, so the session key needs to
729 * be set to "SystemLibraryDTC". Weird, but this is what Windows
730 * does. See the RPC-SAMBA3SESSIONKEY.
731 */
732
733 session_key = generic_session_key();
734 if (session_key.data == NULL) {
735 return False;
736 }
737
738 ret = server_info_set_session_key(p->server_info, session_key);
739
740 data_blob_free(&session_key);
741
742 return True;
743 }
744
745 /*******************************************************************
746 This is the "stage3" NTLMSSP response after a bind request and reply.
747 *******************************************************************/
748
749 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
750 {
751 RPC_HDR_AUTH auth_info;
752 uint32 pad = 0;
753 DATA_BLOB blob;
754 uint32_t auth_len = p->hdr.auth_len;
755
756 ZERO_STRUCT(blob);
757
758 DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
759
760 if (auth_len == 0) {
761 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
762 goto err;
763 }
764
765 /* 4 bytes padding. */
766 if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
767 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
768 goto err;
769 }
770
771 /* Ensure there's enough data for an authenticated request. */
772 if (RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + auth_len >
773 p->hdr.frag_len) {
774 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
775 "%u is too large.\n",
776 (unsigned int)auth_len ));
777 goto err;
778 }
779
780 /*
781 * Decode the authentication verifier response.
782 */
783
784 /* Pull the auth header and the following data into a blob. */
785 /* NB. The offset of the auth_header is relative to the *end*
786 * of the packet, not the start. Also, the length of the
787 * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
788 * as the RPC header isn't included in rpc_in_p. */
789 if(!prs_set_offset(rpc_in_p,
790 p->hdr.frag_len - RPC_HEADER_LEN -
791 RPC_HDR_AUTH_LEN - auth_len)) {
792 DEBUG(0,("api_pipe_bind_auth3: cannot move "
793 "offset to %u.\n",
794 (unsigned int)(p->hdr.frag_len -
795 RPC_HDR_AUTH_LEN - auth_len) ));
796 goto err;
797 }
798
799 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in_p, 0)) {
800 DEBUG(0,("api_pipe_bind_auth3: failed to "
801 "unmarshall RPC_HDR_AUTH.\n"));
802 goto err;
803 }
804
805 /* We must NEVER look at auth_info->auth_pad_len here,
806 * as old Samba client code gets it wrong and sends it
807 * as zero. JRA.
808 */
809
810 if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
811 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
812 (unsigned int)auth_info.auth_type ));
813 return False;
814 }
815
816 blob = data_blob(NULL,p->hdr.auth_len);
817
818 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
819 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
820 (unsigned int)p->hdr.auth_len ));
821 goto err;
822 }
823
824 /*
825 * The following call actually checks the challenge/response data.
826 * for correctness against the given DOMAIN\user name.
827 */
828
829 if (!pipe_ntlmssp_verify_final(p, &blob)) {
830 goto err;
831 }
832
833 data_blob_free(&blob);
834
835 p->pipe_bound = True;
836
837 return True;
838
839 err:
840
841 data_blob_free(&blob);
842 free_pipe_ntlmssp_auth_data(&p->auth);
843 p->auth.a_u.auth_ntlmssp_state = NULL;
844
845 return False;
846 }
847
848 /*******************************************************************
849 Marshall a bind_nak pdu.
850 *******************************************************************/
851
852 static bool setup_bind_nak(pipes_struct *p)
853 {
854 RPC_HDR nak_hdr;
855 uint16 zero = 0;
856
857 /* Free any memory in the current return data buffer. */
858 prs_mem_free(&p->out_data.rdata);
859
860 /*
861 * Marshall directly into the outgoing PDU space. We
862 * must do this as we need to set to the bind response
863 * header and are never sending more than one PDU here.
864 */
865
866 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
867
868 /*
869 * Initialize a bind_nak header.
870 */
871
872 init_rpc_hdr(&nak_hdr, DCERPC_PKT_BIND_NAK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
873 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
874
875 /*
876 * Marshall the header into the outgoing PDU.
877 */
878
879 if(!smb_io_rpc_hdr("", &nak_hdr, &p->out_data.frag, 0)) {
880 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
881 prs_mem_free(&p->out_data.frag);
882 return False;
883 }
884
885 /*
886 * Now add the reject reason.
887 */
888
889 if(!prs_uint16("reject code", &p->out_data.frag, 0, &zero)) {
890 prs_mem_free(&p->out_data.frag);
891 return False;
892 }
893
894 p->out_data.data_sent_length = 0;
895 p->out_data.current_pdu_sent = 0;
896
897 if (p->auth.auth_data_free_func) {
898 (*p->auth.auth_data_free_func)(&p->auth);
899 }
900 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
901 p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
902 p->pipe_bound = False;
903
904 return True;
905 }
906
907 /*******************************************************************
908 Marshall a fault pdu.
909 *******************************************************************/
910
911 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
912 {
913 RPC_HDR fault_hdr;
914 RPC_HDR_RESP hdr_resp;
915 RPC_HDR_FAULT fault_resp;
916
917 /* Free any memory in the current return data buffer. */
918 prs_mem_free(&p->out_data.rdata);
919
920 /*
921 * Marshall directly into the outgoing PDU space. We
922 * must do this as we need to set to the bind response
923 * header and are never sending more than one PDU here.
924 */
925
926 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
927
928 /*
929 * Initialize a fault header.
930 */
931
932 init_rpc_hdr(&fault_hdr, DCERPC_PKT_FAULT, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST | DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
933 p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
934
935 /*
936 * Initialize the HDR_RESP and FAULT parts of the PDU.
937 */
938
939 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
940
941 fault_resp.status = status;
942 fault_resp.reserved = 0;
943
944 /*
945 * Marshall the header into the outgoing PDU.
946 */
947
948 if(!smb_io_rpc_hdr("", &fault_hdr, &p->out_data.frag, 0)) {
949 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
950 prs_mem_free(&p->out_data.frag);
951 return False;
952 }
953
954 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
955 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
956 prs_mem_free(&p->out_data.frag);
957 return False;
958 }
959
960 if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &p->out_data.frag, 0)) {
961 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
962 prs_mem_free(&p->out_data.frag);
963 return False;
964 }
965
966 p->out_data.data_sent_length = 0;
967 p->out_data.current_pdu_sent = 0;
968
969 return True;
970 }
971
972 #if 0
973 /*******************************************************************
974 Marshall a cancel_ack pdu.
975 We should probably check the auth-verifier here.
976 *******************************************************************/
977
978 bool setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
979 {
980 prs_struct outgoing_pdu;
981 RPC_HDR ack_reply_hdr;
982
983 /* Free any memory in the current return data buffer. */
984 prs_mem_free(&p->out_data.rdata);
985
986 /*
987 * Marshall directly into the outgoing PDU space. We
988 * must do this as we need to set to the bind response
989 * header and are never sending more than one PDU here.
990 */
991
992 prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
993 prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
994
995 /*
996 * Initialize a cancel_ack header.
997 */
998
999 init_rpc_hdr(&ack_reply_hdr, DCERPC_PKT_CANCEL_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1000 p->hdr.call_id, RPC_HEADER_LEN, 0);
1001
1002 /*
1003 * Marshall the header into the outgoing PDU.
1004 */
1005
1006 if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
1007 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
1008 prs_mem_free(&outgoing_pdu);
1009 return False;
1010 }
1011
1012 p->out_data.data_sent_length = 0;
1013 p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
1014 p->out_data.current_pdu_sent = 0;
1015
1016 prs_mem_free(&outgoing_pdu);
1017 return True;
1018 }
1019 #endif
1020
1021 /*******************************************************************
1022 Ensure a bind request has the correct abstract & transfer interface.
1023 Used to reject unknown binds from Win2k.
1024 *******************************************************************/
1025
1026 static bool check_bind_req(struct pipes_struct *p,
1027 struct ndr_syntax_id* abstract,
1028 struct ndr_syntax_id* transfer,
1029 uint32 context_id)
1030 {
1031 struct pipe_rpc_fns *context_fns;
1032
1033 DEBUG(3,("check_bind_req for %s\n",
1034 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1035
1036 /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
1037 if (rpc_srv_pipe_exists_by_id(abstract) &&
1038 ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
1039 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1040 rpc_srv_get_pipe_cli_name(abstract),
1041 rpc_srv_get_pipe_srv_name(abstract)));
1042 } else {
1043 return false;
1044 }
1045
1046 context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
1047 if (context_fns == NULL) {
1048 DEBUG(0,("check_bind_req: malloc() failed!\n"));
1049 return False;
1050 }
1051
1052 context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
1053 context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
1054 context_fns->context_id = context_id;
1055
1056 /* add to the list of open contexts */
1057
1058 DLIST_ADD( p->contexts, context_fns );
1059
1060 return True;
1061 }
1062
1063 /**
1064 * Is a named pipe known?
1065 * @param[in] cli_filename The pipe name requested by the client
1066 * @result Do we want to serve this?
1067 */
1068 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1069 {
1070 const char *pipename = cli_filename;
1071 NTSTATUS status;
1072
1073 if (strnequal(pipename, "\\PIPE\\", 6)) {
1074 pipename += 5;
1075 }
1076
1077 if (*pipename == '\\') {
1078 pipename += 1;
1079 }
1080
1081 if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1082 DEBUG(10, ("refusing spoolss access\n"));
1083 return false;
1084 }
1085
1086 if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1087 return true;
1088 }
1089
1090 status = smb_probe_module("rpc", pipename);
1091 if (!NT_STATUS_IS_OK(status)) {
1092 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1093 return false;
1094 }
1095 DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
1096
1097 /*
1098 * Scan the list again for the interface id
1099 */
1100 if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1101 return true;
1102 }
1103
1104 DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
1105 pipename));
1106
1107 return false;
1108 }
1109
1110 /*******************************************************************
1111 Handle a SPNEGO krb5 bind auth.
1112 *******************************************************************/
1113
1114 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1115 DATA_BLOB *psecblob, prs_struct *pout_auth)
1116 {
1117 return False;
1118 }
1119
1120 /*******************************************************************
1121 Handle the first part of a SPNEGO bind auth.
1122 *******************************************************************/
1123
1124 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1125 uint32_t ss_padding_len,
1126 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1127 {
1128 DATA_BLOB blob;
1129 DATA_BLOB secblob;
1130 DATA_BLOB response;
1131 DATA_BLOB chal;
1132 char *OIDs[ASN1_MAX_OIDS];
1133 int i;
1134 NTSTATUS status;
1135 bool got_kerberos_mechanism = false;
1136 struct auth_ntlmssp_state *a = NULL;
1137 RPC_HDR_AUTH auth_info;
1138
1139 ZERO_STRUCT(secblob);
1140 ZERO_STRUCT(chal);
1141 ZERO_STRUCT(response);
1142
1143 /* Grab the SPNEGO blob. */
1144 blob = data_blob(NULL,p->hdr.auth_len);
1145
1146 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1147 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1148 (unsigned int)p->hdr.auth_len ));
1149 goto err;
1150 }
1151
1152 if (blob.data[0] != ASN1_APPLICATION(0)) {
1153 goto err;
1154 }
1155
1156 /* parse out the OIDs and the first sec blob */
1157 if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1158 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1159 goto err;
1160 }
1161
1162 if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1163 got_kerberos_mechanism = true;
1164 }
1165
1166 for (i=0;OIDs[i];i++) {
1167 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1168 TALLOC_FREE(OIDs[i]);
1169 }
1170 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1171
1172 if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1173 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1174 data_blob_free(&secblob);
1175 data_blob_free(&blob);
1176 return ret;
1177 }
1178
1179 if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1180 /* Free any previous auth type. */
1181 free_pipe_ntlmssp_auth_data(&p->auth);
1182 }
1183
1184 if (!got_kerberos_mechanism) {
1185 /* Initialize the NTLM engine. */
1186 status = auth_ntlmssp_start(&a);
1187 if (!NT_STATUS_IS_OK(status)) {
1188 goto err;
1189 }
1190
1191 switch (auth_info.auth_level) {
1192 case DCERPC_AUTH_LEVEL_INTEGRITY:
1193 auth_ntlmssp_want_sign(a);
1194 break;
1195 case DCERPC_AUTH_LEVEL_PRIVACY:
1196 auth_ntlmssp_want_seal(a);
1197 break;
1198 default:
1199 break;
1200 }
1201 /*
1202 * Pass the first security blob of data to it.
1203 * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1204 * which means we need another packet to complete the bind.
1205 */
1206
1207 status = auth_ntlmssp_update(a, secblob, &chal);
1208
1209 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1210 DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1211 goto err;
1212 }
1213
1214 /* Generate the response blob we need for step 2 of the bind. */
1215 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1216 } else {
1217 /*
1218 * SPNEGO negotiate down to NTLMSSP. The subsequent
1219 * code to process follow-up packets is not complete
1220 * yet. JRA.
1221 */
1222 response = spnego_gen_auth_response(NULL,
1223 NT_STATUS_MORE_PROCESSING_REQUIRED,
1224 OID_NTLMSSP);
1225 }
1226
1227 /* auth_pad_len will be handled by the caller */
1228
1229 /* Copy the blob into the pout_auth parse struct */
1230 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1231 pauth_info->auth_level, ss_padding_len, 1);
1232 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1233 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1234 goto err;
1235 }
1236
1237 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1238 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1239 goto err;
1240 }
1241
1242 p->auth.a_u.auth_ntlmssp_state = a;
1243 p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1244 p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1245
1246 data_blob_free(&blob);
1247 data_blob_free(&secblob);
1248 data_blob_free(&chal);
1249 data_blob_free(&response);
1250
1251 /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1252 return True;
1253
1254 err:
1255
1256 data_blob_free(&blob);
1257 data_blob_free(&secblob);
1258 data_blob_free(&chal);
1259 data_blob_free(&response);
1260
1261 p->auth.a_u.auth_ntlmssp_state = NULL;
1262
1263 return False;
1264 }
1265
1266 /*******************************************************************
1267 Handle the second part of a SPNEGO bind auth.
1268 *******************************************************************/
1269
1270 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1271 uint32_t ss_padding_len,
1272 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1273 {
1274 RPC_HDR_AUTH auth_info;
1275 DATA_BLOB spnego_blob;
1276 DATA_BLOB auth_blob;
1277 DATA_BLOB auth_reply;
1278 DATA_BLOB response;
1279 struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
1280
1281 ZERO_STRUCT(spnego_blob);
1282 ZERO_STRUCT(auth_blob);
1283 ZERO_STRUCT(auth_reply);
1284 ZERO_STRUCT(response);
1285
1286 /*
1287 * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1288 * fail here as 'a' == NULL.
1289 */
1290 if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1291 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1292 goto err;
1293 }
1294
1295 /* Grab the SPNEGO blob. */
1296 spnego_blob = data_blob(NULL,p->hdr.auth_len);
1297
1298 if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1299 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1300 (unsigned int)p->hdr.auth_len ));
1301 goto err;
1302 }
1303
1304 if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1305 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1306 goto err;
1307 }
1308
1309 if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1310 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1311 goto err;
1312 }
1313
1314 /*
1315 * The following call actually checks the challenge/response data.
1316 * for correctness against the given DOMAIN\user name.
1317 */
1318
1319 if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1320 goto err;
1321 }
1322
1323 data_blob_free(&spnego_blob);
1324 data_blob_free(&auth_blob);
1325
1326 /* Generate the spnego "accept completed" blob - no incoming data. */
1327 response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1328
1329 /* FIXME - add auth_pad_len here ! */
1330
1331 /* Copy the blob into the pout_auth parse struct */
1332 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1333 pauth_info->auth_level, ss_padding_len, 1);
1334 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1335 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1336 goto err;
1337 }
1338
1339 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1340 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1341 goto err;
1342 }
1343
1344 data_blob_free(&auth_reply);
1345 data_blob_free(&response);
1346
1347 p->pipe_bound = True;
1348
1349 return True;
1350
1351 err:
1352
1353 data_blob_free(&spnego_blob);
1354 data_blob_free(&auth_blob);
1355 data_blob_free(&auth_reply);
1356 data_blob_free(&response);
1357
1358 free_pipe_ntlmssp_auth_data(&p->auth);
1359 p->auth.a_u.auth_ntlmssp_state = NULL;
1360
1361 return False;
1362 }
1363
1364 /*******************************************************************
1365 Handle an schannel bind auth.
1366 *******************************************************************/
1367
1368 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1369 uint32_t ss_padding_len,
1370 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1371 {
1372 RPC_HDR_AUTH auth_info;
1373 struct NL_AUTH_MESSAGE neg;
1374 struct NL_AUTH_MESSAGE reply;
1375 bool ret;
1376 NTSTATUS status;
1377 struct netlogon_creds_CredentialState *creds;
1378 DATA_BLOB session_key;
1379 enum ndr_err_code ndr_err;
1380 DATA_BLOB blob;
1381
1382 blob = data_blob_const(prs_data_p(rpc_in_p) + prs_offset(rpc_in_p),
1383 prs_data_size(rpc_in_p));
1384
1385 ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), &neg,
1386 (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1387 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1388 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1389 return false;
1390 }
1391
1392 if (DEBUGLEVEL >= 10) {
1393 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1394 }
1395
1396 if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1397 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1398 return false;
1399 }
1400
1401 /*
1402 * The neg.oem_netbios_computer.a key here must match the remote computer name
1403 * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1404 * operations that use credentials.
1405 */
1406
1407 become_root();
1408 status = schannel_get_creds_state(p, lp_private_dir(),
1409 neg.oem_netbios_computer.a, &creds);
1410 unbecome_root();
1411
1412 if (!NT_STATUS_IS_OK(status)) {
1413 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1414 return False;
1415 }
1416
1417 p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1418 if (!p->auth.a_u.schannel_auth) {
1419 TALLOC_FREE(creds);
1420 return False;
1421 }
1422
1423 p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1424 p->auth.a_u.schannel_auth->seq_num = 0;
1425 p->auth.a_u.schannel_auth->initiator = false;
1426 p->auth.a_u.schannel_auth->creds = creds;
1427
1428 /*
1429 * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1430 * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1431 * struct of the person who opened the pipe. I need to test this further. JRA.
1432 *
1433 * VL. As we are mapping this to guest set the generic key
1434 * "SystemLibraryDTC" key here. It's a bit difficult to test against
1435 * W2k3, as it does not allow schannel binds against SAMR and LSA
1436 * anymore.
1437 */
1438
1439 session_key = generic_session_key();
1440 if (session_key.data == NULL) {
1441 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1442 " key\n"));
1443 return false;
1444 }
1445
1446 ret = server_info_set_session_key(p->server_info, session_key);
1447
1448 data_blob_free(&session_key);
1449
1450 if (!ret) {
1451 DEBUG(0, ("server_info_set_session_key failed\n"));
1452 return false;
1453 }
1454
1455 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SCHANNEL,
1456 pauth_info->auth_level, ss_padding_len, 1);
1457 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1458 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1459 return False;
1460 }
1461
1462 /*** SCHANNEL verifier ***/
1463
1464 reply.MessageType = NL_NEGOTIATE_RESPONSE;
1465 reply.Flags = 0;
1466 reply.Buffer.dummy = 5; /* ??? actually I don't think
1467 * this has any meaning
1468 * here - gd */
1469
1470 ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &reply,
1471 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1472 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1473 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1474 return false;
1475 }
1476
1477 if (DEBUGLEVEL >= 10) {
1478 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1479 }
1480
1481 if (!prs_copy_data_in(pout_auth, (const char *)blob.data, blob.length)) {
1482 return false;
1483 }
1484
1485 DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1486 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1487
1488 /* We're finished with this bind - no more packets. */
1489 p->auth.auth_data_free_func = NULL;
1490 p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1491
1492 p->pipe_bound = True;
1493
1494 return True;
1495 }
1496
1497 /*******************************************************************
1498 Handle an NTLMSSP bind auth.
1499 *******************************************************************/
1500
1501 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1502 uint32_t ss_padding_len,
1503 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1504 {
1505 RPC_HDR_AUTH auth_info;
1506 DATA_BLOB blob;
1507 DATA_BLOB response;
1508 NTSTATUS status;
1509 struct auth_ntlmssp_state *a = NULL;
1510
1511 ZERO_STRUCT(blob);
1512 ZERO_STRUCT(response);
1513
1514 /* Grab the NTLMSSP blob. */
1515 blob = data_blob(NULL,p->hdr.auth_len);
1516
1517 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1518 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1519 (unsigned int)p->hdr.auth_len ));
1520 goto err;
1521 }
1522
1523 if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1524 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1525 goto err;
1526 }
1527
1528 /* We have an NTLMSSP blob. */
1529 status = auth_ntlmssp_start(&a);
1530 if (!NT_STATUS_IS_OK(status)) {
1531 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1532 nt_errstr(status) ));
1533 goto err;
1534 }
1535
1536 switch (pauth_info->auth_level) {
1537 case DCERPC_AUTH_LEVEL_INTEGRITY:
1538 auth_ntlmssp_want_sign(a);
1539 break;
1540 case DCERPC_AUTH_LEVEL_PRIVACY:
1541 auth_ntlmssp_want_seal(a);
1542 break;
1543 default:
1544 break;
1545 }
1546
1547 status = auth_ntlmssp_update(a, blob, &response);
1548 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1549 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1550 nt_errstr(status) ));
1551 goto err;
1552 }
1553
1554 data_blob_free(&blob);
1555
1556 /* Copy the blob into the pout_auth parse struct */
1557 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_NTLMSSP,
1558 pauth_info->auth_level, ss_padding_len, 1);
1559 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1560 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1561 goto err;
1562 }
1563
1564 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1565 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1566 goto err;
1567 }
1568
1569 p->auth.a_u.auth_ntlmssp_state = a;
1570 p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1571 p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1572
1573 data_blob_free(&blob);
1574 data_blob_free(&response);
1575
1576 DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1577
1578 /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1579 return True;
1580
1581 err:
1582
1583 data_blob_free(&blob);
1584 data_blob_free(&response);
1585
1586 free_pipe_ntlmssp_auth_data(&p->auth);
1587 p->auth.a_u.auth_ntlmssp_state = NULL;
1588 return False;
1589 }
1590
1591 /*******************************************************************
1592 Respond to a pipe bind request.
1593 *******************************************************************/
1594
1595 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1596 {
1597 RPC_HDR_BA hdr_ba;
1598 RPC_HDR_RB hdr_rb;
1599 RPC_HDR_AUTH auth_info;
1600 uint16 assoc_gid;
1601 fstring ack_pipe_name;
1602 prs_struct out_hdr_ba;
1603 prs_struct out_auth;
1604 int auth_len = 0;
1605 unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1606 uint32_t ss_padding_len = 0;
1607 NTSTATUS status;
1608 struct ndr_syntax_id id;
1609
1610 /* No rebinds on a bound pipe - use alter context. */
1611 if (p->pipe_bound) {
1612 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1613 "pipe %s.\n",
1614 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1615 return setup_bind_nak(p);
1616 }
1617
1618 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1619
1620 /*
1621 * Marshall directly into the outgoing PDU space. We
1622 * must do this as we need to set to the bind response
1623 * header and are never sending more than one PDU here.
1624 */
1625
1626 /*
1627 * Setup the memory to marshall the ba header, and the
1628 * auth footers.
1629 */
1630
1631 if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1632 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1633 prs_mem_free(&p->out_data.frag);
1634 return False;
1635 }
1636
1637 if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1638 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1639 prs_mem_free(&p->out_data.frag);
1640 prs_mem_free(&out_hdr_ba);
1641 return False;
1642 }
1643
1644 DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1645
1646 ZERO_STRUCT(hdr_rb);
1647
1648 /* decode the bind request */
1649
1650 if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0)) {
1651 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB "
1652 "struct.\n"));
1653 goto err_exit;
1654 }
1655
1656 if (hdr_rb.num_contexts == 0) {
1657 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1658 goto err_exit;
1659 }
1660
1661 /*
1662 * Try and find the correct pipe name to ensure
1663 * that this is a pipe name we support.
1664 */
1665 id = hdr_rb.rpc_context[0].abstract;
1666 if (rpc_srv_pipe_exists_by_id(&id)) {
1667 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1668 rpc_srv_get_pipe_cli_name(&id),
1669 rpc_srv_get_pipe_srv_name(&id)));
1670 } else {
1671 status = smb_probe_module(
1672 "rpc", get_pipe_name_from_syntax(
1673 talloc_tos(),
1674 &hdr_rb.rpc_context[0].abstract));
1675
1676 if (NT_STATUS_IS_ERR(status)) {
1677 DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1678 get_pipe_name_from_syntax(
1679 talloc_tos(),
1680 &hdr_rb.rpc_context[0].abstract)));
1681 prs_mem_free(&p->out_data.frag);
1682 prs_mem_free(&out_hdr_ba);
1683 prs_mem_free(&out_auth);
1684
1685 return setup_bind_nak(p);
1686 }
1687
1688 if (rpc_srv_get_pipe_interface_by_cli_name(
1689 get_pipe_name_from_syntax(talloc_tos(),
1690 &p->syntax),
1691 &id)) {
1692 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1693 rpc_srv_get_pipe_cli_name(&id),
1694 rpc_srv_get_pipe_srv_name(&id)));
1695 } else {
1696 DEBUG(0, ("module %s doesn't provide functions for "
1697 "pipe %s!\n",
1698 get_pipe_name_from_syntax(talloc_tos(),
1699 &p->syntax),
1700 get_pipe_name_from_syntax(talloc_tos(),
1701 &p->syntax)));
1702 goto err_exit;
1703 }
1704 }
1705
1706 /* name has to be \PIPE\xxxxx */
1707 fstrcpy(ack_pipe_name, "\\PIPE\\");
1708 fstrcat(ack_pipe_name, rpc_srv_get_pipe_srv_name(&id));
1709
1710 DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1711
1712 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1713
1714 /*
1715 * Create the bind response struct.
1716 */
1717
1718 /* If the requested abstract synt uuid doesn't match our client pipe,
1719 reject the bind_ack & set the transfer interface synt to all 0's,
1720 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1721 unknown to NT4)
1722 Needed when adding entries to a DACL from NT5 - SK */
1723
1724 if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1725 hdr_rb.rpc_context[0].context_id )) {
1726 init_rpc_hdr_ba(&hdr_ba,
1727 RPC_MAX_PDU_FRAG_LEN,
1728 RPC_MAX_PDU_FRAG_LEN,
1729 assoc_gid,
1730 ack_pipe_name,
1731 0x1, 0x0, 0x0,
1732 &hdr_rb.rpc_context[0].transfer[0]);
1733 } else {
1734 /* Rejection reason: abstract syntax not supported */
1735 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1736 RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1737 ack_pipe_name, 0x1, 0x2, 0x1,
1738 &null_ndr_syntax_id);
1739 p->pipe_bound = False;
1740 }
1741
1742 /*
1743 * and marshall it.
1744 */
1745
1746 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1747 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1748 goto err_exit;
1749 }
1750
1751 /*
1752 * Check if this is an authenticated bind request.
1753 */
1754
1755 if (p->hdr.auth_len) {
1756 /*
1757 * Decode the authentication verifier.
1758 */
1759
1760 /* Work out any padding needed before the auth footer. */
1761 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
1762 ss_padding_len = SERVER_NDR_PADDING_SIZE -
1763 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
1764 DEBUG(10,("api_pipe_bind_req: auth pad_len = %u\n",
1765 (unsigned int)ss_padding_len ));
1766 }
1767
1768 /* Quick length check. Won't catch a bad auth footer,
1769 * prevents overrun. */
1770
1771 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
1772 DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
1773 "too long for fragment %u.\n",
1774 (unsigned int)p->hdr.auth_len,
1775 (unsigned int)p->hdr.frag_len ));
1776 goto err_exit;
1777 }
1778
1779 /* Pull the auth header and the following data into a blob. */
1780 /* NB. The offset of the auth_header is relative to the *end*
1781 * of the packet, not the start. Also, the length of the
1782 * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
1783 * as the RPC header isn't included in rpc_in_p. */
1784 if(!prs_set_offset(rpc_in_p,
1785 p->hdr.frag_len - RPC_HEADER_LEN -
1786 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
1787 DEBUG(0,("api_pipe_bind_req: cannot move "
1788 "offset to %u.\n",
1789 (unsigned int)(p->hdr.frag_len -
1790 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
1791 goto err_exit;
1792 }
1793
1794 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1795 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1796 goto err_exit;
1797 }
1798
1799 auth_type = auth_info.auth_type;
1800
1801 /* Work out if we have to sign or seal etc. */
1802 switch (auth_info.auth_level) {
1803 case DCERPC_AUTH_LEVEL_INTEGRITY:
1804 p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1805 break;
1806 case DCERPC_AUTH_LEVEL_PRIVACY:
1807 p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1808 break;
1809 default:
1810 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1811 (unsigned int)auth_info.auth_level ));
1812 goto err_exit;
1813 }
1814 } else {
1815 ZERO_STRUCT(auth_info);
1816 }
1817
1818 switch(auth_type) {
1819 case DCERPC_AUTH_TYPE_NTLMSSP:
1820 if (!pipe_ntlmssp_auth_bind(p, rpc_in_p,
1821 ss_padding_len, &auth_info, &out_auth)) {
1822 goto err_exit;
1823 }
1824 assoc_gid = 0x7a77;
1825 break;
1826
1827 case DCERPC_AUTH_TYPE_SCHANNEL:
1828 if (!pipe_schannel_auth_bind(p, rpc_in_p,
1829 ss_padding_len, &auth_info, &out_auth)) {
1830 goto err_exit;
1831 }
1832 break;
1833
1834 case DCERPC_AUTH_TYPE_SPNEGO:
1835 if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p,
1836 ss_padding_len, &auth_info, &out_auth)) {
1837 goto err_exit;
1838 }
1839 break;
1840
1841 case DCERPC_AUTH_TYPE_NONE:
1842 /* Unauthenticated bind request. */
1843 /* We're finished - no more packets. */
1844 p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1845 /* We must set the pipe auth_level here also. */
1846 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1847 p->pipe_bound = True;
1848 /* The session key was initialized from the SMB
1849 * session in make_internal_rpc_pipe_p */
1850 ss_padding_len = 0;
1851 break;
1852
1853 default:
1854 DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1855 goto err_exit;
1856 }
1857 /*
1858 * Create the header, now we know the length.
1859 */
1860
1861 if (prs_offset(&out_auth)) {
1862 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1863 }
1864
1865 init_rpc_hdr(&p->hdr, DCERPC_PKT_BIND_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1866 p->hdr.call_id,
1867 RPC_HEADER_LEN + prs_offset(&out_hdr_ba) +
1868 ss_padding_len + prs_offset(&out_auth),
1869 auth_len);
1870
1871 /*
1872 * Marshall the header into the outgoing PDU.
1873 */
1874
1875 if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1876 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1877 goto err_exit;
1878 }
1879
1880 /*
1881 * Now add the RPC_HDR_BA and any auth needed.
1882 */
1883
1884 if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1885 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1886 goto err_exit;
1887 }
1888
1889 if (auth_len) {
1890 if (ss_padding_len) {
1891 char pad[SERVER_NDR_PADDING_SIZE];
1892 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1893 if (!prs_copy_data_in(&p->out_data.frag, pad,
1894 ss_padding_len)) {
1895 DEBUG(0,("api_pipe_bind_req: failed to add %u "
1896 "bytes of pad data.\n",
1897 (unsigned int)ss_padding_len));
1898 goto err_exit;
1899 }
1900 }
1901
1902 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1903 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1904 goto err_exit;
1905 }
1906 }
1907
1908 /*
1909 * Setup the lengths for the initial reply.
1910 */
1911
1912 p->out_data.data_sent_length = 0;
1913 p->out_data.current_pdu_sent = 0;
1914
1915 prs_mem_free(&out_hdr_ba);
1916 prs_mem_free(&out_auth);
1917
1918 return True;
1919
1920 err_exit:
1921
1922 prs_mem_free(&p->out_data.frag);
1923 prs_mem_free(&out_hdr_ba);
1924 prs_mem_free(&out_auth);
1925 return setup_bind_nak(p);
1926 }
1927
1928 /****************************************************************************
1929 Deal with an alter context call. Can be third part of 3 leg auth request for
1930 SPNEGO calls.
1931 ****************************************************************************/
1932
1933 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1934 {
1935 RPC_HDR_BA hdr_ba;
1936 RPC_HDR_RB hdr_rb;
1937 RPC_HDR_AUTH auth_info;
1938 uint16 assoc_gid;
1939 fstring ack_pipe_name;
1940 prs_struct out_hdr_ba;
1941 prs_struct out_auth;
1942 int auth_len = 0;
1943 uint32_t ss_padding_len = 0;
1944
1945 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1946
1947 /*
1948 * Marshall directly into the outgoing PDU space. We
1949 * must do this as we need to set to the bind response
1950 * header and are never sending more than one PDU here.
1951 */
1952
1953 /*
1954 * Setup the memory to marshall the ba header, and the
1955 * auth footers.
1956 */
1957
1958 if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1959 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1960 prs_mem_free(&p->out_data.frag);
1961 return False;
1962 }
1963
1964 if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1965 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1966 prs_mem_free(&p->out_data.frag);
1967 prs_mem_free(&out_hdr_ba);
1968 return False;
1969 }
1970
1971 ZERO_STRUCT(hdr_rb);
1972
1973 DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1974
1975 /* decode the alter context request */
1976 if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0)) {
1977 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1978 goto err_exit;
1979 }
1980
1981 /* secondary address CAN be NULL
1982 * as the specs say it's ignored.
1983 * It MUST be NULL to have the spoolss working.
1984 */
1985 fstrcpy(ack_pipe_name,"");
1986
1987 DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1988
1989 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1990
1991 /*
1992 * Create the bind response struct.
1993 */
1994
1995 /* If the requested abstract synt uuid doesn't match our client pipe,
1996 reject the bind_ack & set the transfer interface synt to all 0's,
1997 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1998 unknown to NT4)
1999 Needed when adding entries to a DACL from NT5 - SK */
2000
2001 if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
2002 hdr_rb.rpc_context[0].context_id )) {
2003 init_rpc_hdr_ba(&hdr_ba,
2004 RPC_MAX_PDU_FRAG_LEN,
2005 RPC_MAX_PDU_FRAG_LEN,
2006 assoc_gid,
2007 ack_pipe_name,
2008 0x1, 0x0, 0x0,
2009 &hdr_rb.rpc_context[0].transfer[0]);
2010 } else {
2011 /* Rejection reason: abstract syntax not supported */
2012 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
2013 RPC_MAX_PDU_FRAG_LEN, assoc_gid,
2014 ack_pipe_name, 0x1, 0x2, 0x1,
2015 &null_ndr_syntax_id);
2016 p->pipe_bound = False;
2017 }
2018
2019 /*
2020 * and marshall it.
2021 */
2022
2023 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
2024 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
2025 goto err_exit;
2026 }
2027
2028
2029 /*
2030 * Check if this is an authenticated alter context request.
2031 */
2032
2033 if (p->hdr.auth_len != 0) {
2034 /*
2035 * Decode the authentication verifier.
2036 */
2037
2038 /* Work out any padding needed before the auth footer. */
2039 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
2040 ss_padding_len = SERVER_NDR_PADDING_SIZE -
2041 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
2042 DEBUG(10,("api_pipe_alter_context: auth pad_len = %u\n",
2043 (unsigned int)ss_padding_len ));
2044 }
2045
2046 /* Quick length check. Won't catch a bad auth footer,
2047 * prevents overrun. */
2048
2049 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
2050 DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
2051 "too long for fragment %u.\n",
2052 (unsigned int)p->hdr.auth_len,
2053 (unsigned int)p->hdr.frag_len ));
2054 goto err_exit;
2055 }
2056
2057 /* Pull the auth header and the following data into a blob. */
2058 /* NB. The offset of the auth_header is relative to the *end*
2059 * of the packet, not the start. Also, the length of the
2060 * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2061 * as the RPC header isn't included in rpc_in_p. */
2062 if(!prs_set_offset(rpc_in_p,
2063 p->hdr.frag_len - RPC_HEADER_LEN -
2064 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
2065 DEBUG(0,("api_alter_context: cannot move "
2066 "offset to %u.\n",
2067 (unsigned int)(p->hdr.frag_len -
2068 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
2069 goto err_exit;
2070 }
2071
2072 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
2073 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
2074 goto err_exit;
2075 }
2076
2077 /*
2078 * Currently only the SPNEGO auth type uses the alter ctx
2079 * response in place of the NTLMSSP auth3 type.
2080 */
2081
2082 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
2083 /* We can only finish if the pipe is unbound. */
2084 if (!p->pipe_bound) {
2085 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p,
2086 ss_padding_len, &auth_info, &out_auth)) {
2087 goto err_exit;
2088 }
2089 } else {
2090 goto err_exit;
2091 }
2092 }
2093 } else {
2094 ZERO_STRUCT(auth_info);
2095 }
2096 /*
2097 * Create the header, now we know the length.
2098 */
2099
2100 if (prs_offset(&out_auth)) {
2101 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
2102 }
2103
2104 init_rpc_hdr(&p->hdr, DCERPC_PKT_ALTER_RESP, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
2105 p->hdr.call_id,
2106 RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
2107 auth_len);
2108
2109 /*
2110 * Marshall the header into the outgoing PDU.
2111 */
2112
2113 if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
2114 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
2115 goto err_exit;
2116 }
2117
2118 /*
2119 * Now add the RPC_HDR_BA and any auth needed.
2120 */
2121
2122 if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
2123 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
2124 goto err_exit;
2125 }
2126
2127 if (auth_len) {
2128 if (ss_padding_len) {
2129 char pad[SERVER_NDR_PADDING_SIZE];
2130 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
2131 if (!prs_copy_data_in(&p->out_data.frag, pad,
2132 ss_padding_len)) {
2133 DEBUG(0,("api_pipe_alter_context: failed to add %u "
2134 "bytes of pad data.\n",
2135 (unsigned int)ss_padding_len));
2136 goto err_exit;
2137 }
2138 }
2139
2140 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
2141 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
2142 goto err_exit;
2143 }
2144 }
2145
2146 /*
2147 * Setup the lengths for the initial reply.
2148 */
2149
2150 p->out_data.data_sent_length = 0;
2151 p->out_data.current_pdu_sent = 0;
2152
2153 prs_mem_free(&out_hdr_ba);
2154 prs_mem_free(&out_auth);
2155
2156 return True;
2157
2158 err_exit:
2159
2160 prs_mem_free(&p->out_data.frag);
2161 prs_mem_free(&out_hdr_ba);
2162 prs_mem_free(&out_auth);
2163 return setup_bind_nak(p);
2164 }
2165
2166 /****************************************************************************
2167 Deal with NTLMSSP sign & seal processing on an RPC request.
2168 ****************************************************************************/
2169
2170 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
2171 uint32 *p_ss_padding_len, NTSTATUS *pstatus)
2172 {
2173 RPC_HDR_AUTH auth_info;
2174 uint32 auth_len = p->hdr.auth_len;
2175 uint32 save_offset = prs_offset(rpc_in);
2176 struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
2177 unsigned char *data = NULL;
2178 size_t data_len;
2179 unsigned char *full_packet_data = NULL;
2180 size_t full_packet_data_len;
2181 DATA_BLOB auth_blob;
2182
2183 *pstatus = NT_STATUS_OK;
2184
2185 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_NONE || p->auth.auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
2186 return True;
2187 }
2188
2189 if (!a) {
2190 *pstatus = NT_STATUS_INVALID_PARAMETER;
2191 return False;
2192 }
2193
2194 /* Ensure there's enough data for an authenticated request. */
2195 if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN
2196 + auth_len > p->hdr.frag_len) {
2197 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2198 (unsigned int)auth_len ));
2199 *pstatus = NT_STATUS_INVALID_PARAMETER;
2200 return False;
2201 }
2202
2203 /*
2204 * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2205 * after the RPC header.
2206 * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2207 * functions as NTLMv2 checks the rpc headers also.
2208 * Both of these values include any auth_pad_len bytes.
2209 */
2210
2211 data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2212 data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2213
2214 full_packet_data = p->in_data.current_in_pdu;
2215 full_packet_data_len = p->hdr.frag_len - auth_len;
2216
2217 /* Pull the auth header and the following data into a blob. */
2218 /* NB. The offset of the auth_header is relative to the *end*
2219 * of the packet, not the start. Also, the length of the
2220 * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2221 * as the RPC header isn't included in rpc_in_p. */
2222 if(!prs_set_offset(rpc_in,
2223 p->hdr.frag_len - RPC_HEADER_LEN -
2224 RPC_HDR_AUTH_LEN - auth_len)) {
2225 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move "
2226 "offset to %u.\n",
2227 (unsigned int)(p->hdr.frag_len -
2228 RPC_HDR_AUTH_LEN - auth_len) ));
2229 *pstatus = NT_STATUS_INVALID_PARAMETER;
2230 return False;
2231 }
2232
2233 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2234 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to "
2235 "unmarshall RPC_HDR_AUTH.\n"));
2236 *pstatus = NT_STATUS_INVALID_PARAMETER;
2237 return False;
2238 }
2239
2240 /* Ensure auth_pad_len fits into the packet. */
2241 if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2242 RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2243 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_info.auth_pad_len "
2244 "too large (%u), auth_len (%u), frag_len = (%u).\n",
2245 (unsigned int)auth_info.auth_pad_len,
2246 (unsigned int)auth_len,
2247 (unsigned int)p->hdr.frag_len ));
2248 *pstatus = NT_STATUS_INVALID_PARAMETER;
2249 return False;
2250 }
2251
2252 auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2253 auth_blob.length = auth_len;
2254
2255 switch (p->auth.auth_level) {
2256 case DCERPC_AUTH_LEVEL_PRIVACY:
2257 /* Data is encrypted. */
2258 *pstatus = auth_ntlmssp_unseal_packet(a,
2259 data, data_len,
2260 full_packet_data,
2261 full_packet_data_len,
2262 &auth_blob);
2263 if (!NT_STATUS_IS_OK(*pstatus)) {
2264 return False;
2265 }
2266 break;
2267 case DCERPC_AUTH_LEVEL_INTEGRITY:
2268 /* Data is signed. */
2269 *pstatus = auth_ntlmssp_check_packet(a,
2270 data, data_len,
2271 full_packet_data,
2272 full_packet_data_len,
2273 &auth_blob);
2274 if (!NT_STATUS_IS_OK(*pstatus)) {
2275 return False;
2276 }
2277 break;
2278 default:
2279 *pstatus = NT_STATUS_INVALID_PARAMETER;
2280 return False;
2281 }
2282
2283 /*
2284 * Return the current pointer to the data offset.
2285 */
2286
2287 if(!prs_set_offset(rpc_in, save_offset)) {
2288 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2289 (unsigned int)save_offset ));
2290 *pstatus = NT_STATUS_INVALID_PARAMETER;
2291 return False;
2292 }
2293
2294 /*
2295 * Remember the padding length. We must remove it from the real data
2296 * stream once the sign/seal is done.
2297 */
2298
2299 *p_ss_padding_len = auth_info.auth_pad_len;
2300
2301 return True;
2302 }
2303
2304 /****************************************************************************
2305 Deal with schannel processing on an RPC request.
2306 ****************************************************************************/
2307
2308 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2309 {
2310 uint32 data_len;
2311 uint32 auth_len;
2312 uint32 save_offset = prs_offset(rpc_in);
2313 RPC_HDR_AUTH auth_info;
2314 DATA_BLOB blob;
2315 NTSTATUS status;
2316 uint8_t *data;
2317
2318 auth_len = p->hdr.auth_len;
2319
2320 if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN ||
2321 auth_len > RPC_HEADER_LEN +
2322 RPC_HDR_REQ_LEN +
2323 RPC_HDR_AUTH_LEN +
2324 auth_len) {
2325 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2326 return False;
2327 }
2328
2329 /*
2330 * The following is that length of the data we must verify or unseal.
2331 * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2332 * preceeding the auth_data, but does include the auth_pad_len bytes.
2333 */
2334
2335 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2336 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2337 (unsigned int)p->hdr.frag_len,
2338 (unsigned int)auth_len ));
2339 return False;
2340 }
2341
2342 data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2343 RPC_HDR_AUTH_LEN - auth_len;
2344
2345 DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2346
2347 /* Pull the auth header and the following data into a blob. */
2348 /* NB. The offset of the auth_header is relative to the *end*
2349 * of the packet, not the start. Also, the length of the
2350 * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2351 * as the RPC header isn't included in rpc_in_p. */
2352 if(!prs_set_offset(rpc_in,
2353 p->hdr.frag_len - RPC_HEADER_LEN -
2354 RPC_HDR_AUTH_LEN - auth_len)) {
2355 DEBUG(0,("api_pipe_schannel_process: cannot move "
2356 "offset to %u.\n",
2357 (unsigned int)(p->hdr.frag_len -
2358 RPC_HDR_AUTH_LEN - auth_len) ));
2359 return False;
2360 }
2361
2362 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2363 DEBUG(0,("api_pipe_schannel_process: failed to "
2364 "unmarshall RPC_HDR_AUTH.\n"));
2365 return False;
2366 }
2367
2368 /* Ensure auth_pad_len fits into the packet. */
2369 if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2370 RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2371 DEBUG(0,("api_pipe_schannel_process: auth_info.auth_pad_len "
2372 "too large (%u), auth_len (%u), frag_len = (%u).\n",
2373 (unsigned int)auth_info.auth_pad_len,
2374 (unsigned int)auth_len,
2375 (unsigned int)p->hdr.frag_len ));
2376 return False;
2377 }
2378
2379 if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
2380 DEBUG(0,("Invalid auth info %d on schannel\n",
2381 auth_info.auth_type));
2382 return False;
2383 }
2384
2385 blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), auth_len);
2386
2387 if (DEBUGLEVEL >= 10) {
2388 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
2389 }
2390
2391 data = (uint8_t *)prs_data_p(rpc_in)+RPC_HDR_REQ_LEN;
2392
2393 switch (auth_info.auth_level) {
2394 case DCERPC_AUTH_LEVEL_PRIVACY:
2395 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2396 talloc_tos(),
2397 true,
2398 data,
2399 data_len,
2400 &blob);
2401 break;
2402 case DCERPC_AUTH_LEVEL_INTEGRITY:
2403 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2404 talloc_tos(),
2405 false,
2406 data,
2407 data_len,
2408 &blob);
2409 break;
2410 default:
2411 status = NT_STATUS_INTERNAL_ERROR;
2412 break;
2413 }
2414
2415 if (!NT_STATUS_IS_OK(status)) {
2416 DEBUG(0,("failed to unseal packet: %s\n", nt_errstr(status)));
2417 return false;
2418 }
2419
2420 /*
2421 * Return the current pointer to the data offset.
2422 */
2423
2424 if(!prs_set_offset(rpc_in, save_offset)) {
2425 DEBUG(0,("failed to set offset back to %u\n",
2426 (unsigned int)save_offset ));
2427 return False;
2428 }
2429
2430 /*
2431 * Remember the padding length. We must remove it from the real data
2432 * stream once the sign/seal is done.
2433 */
2434
2435 *p_ss_padding_len = auth_info.auth_pad_len;
2436
2437 return True;
2438 }
2439
2440 /****************************************************************************
2441 Find the set of RPC functions associated with this context_id
2442 ****************************************************************************/
2443
2444 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2445 {
2446 PIPE_RPC_FNS *fns = NULL;
2447
2448 if ( !list ) {
2449 DEBUG(0,("find_pipe_fns_by_context: ERROR! No context list for pipe!\n"));
2450 return NULL;
2451 }
2452
2453 for (fns=list; fns; fns=fns->next ) {
2454 if ( fns->context_id == context_id )
2455 return fns;
2456 }
2457 return NULL;
2458 }
2459
2460 /****************************************************************************
2461 Memory cleanup.
2462 ****************************************************************************/
2463
2464 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2465 {
2466 PIPE_RPC_FNS *tmp = list;
2467 PIPE_RPC_FNS *tmp2;
2468
2469 while (tmp) {
2470 tmp2 = tmp->next;
2471 SAFE_FREE(tmp);
2472 tmp = tmp2;
2473 }
2474
2475 return;
2476 }
2477
2478 static bool api_rpcTNP(pipes_struct *p,
2479 const struct api_struct *api_rpc_cmds, int n_cmds);
2480
2481 /****************************************************************************
2482 Find the correct RPC function to call for this request.
2483 If the pipe is authenticated then become the correct UNIX user
2484 before doing the call.
2485 ****************************************************************************/
2486
2487 bool api_pipe_request(pipes_struct *p)
2488 {
2489 bool ret = False;
2490 bool changed_user = False;
2491 PIPE_RPC_FNS *pipe_fns;
2492
2493 if (p->pipe_bound &&
2494 ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2495 (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2496 if(!become_authenticated_pipe_user(p)) {
2497 prs_mem_free(&p->out_data.rdata);
2498 return False;
2499 }
2500 changed_user = True;
2501 }
2502
2503 DEBUG(5, ("Requested \\PIPE\\%s\n",
2504 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2505
2506 /* get the set of RPC functions for this context */
2507
2508 pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2509
2510 if ( pipe_fns ) {
2511 TALLOC_CTX *frame = talloc_stackframe();
2512 ret = api_rpcTNP(p, pipe_fns->cmds, pipe_fns->n_cmds);
2513 TALLOC_FREE(frame);
2514 }
2515 else {
2516 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2517 p->hdr_req.context_id,
2518 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2519 }
2520
2521 if (changed_user) {
2522 unbecome_authenticated_pipe_user();
2523 }
2524
2525 return ret;
2526 }
2527
2528 /*******************************************************************
2529 Calls the underlying RPC function for a named pipe.
2530 ********************************************************************/
2531
2532 static bool api_rpcTNP(pipes_struct *p,
2533 const struct api_struct *api_rpc_cmds, int n_cmds)
2534 {
2535 int fn_num;
2536 uint32 offset1, offset2;
2537
2538 /* interpret the command */
2539 DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2540 get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2541 p->hdr_req.opnum));
2542
2543 if (DEBUGLEVEL >= 50) {
2544 fstring name;
2545 slprintf(name, sizeof(name)-1, "in_%s",
2546 get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2547 prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2548 }
2549
2550 for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2551 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2552 DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2553 break;
2554 }
2555 }
2556
2557 if (fn_num == n_cmds) {
2558 /*
2559 * For an unknown RPC just return a fault PDU but
2560 * return True to allow RPC's on the pipe to continue
2561 * and not put the pipe into fault state. JRA.
2562 */
2563 DEBUG(4, ("unknown\n"));
2564 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2565 return True;
2566 }
2567
2568 offset1 = prs_offset(&p->out_data.rdata);
2569
2570 DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2571 fn_num, api_rpc_cmds[fn_num].fn));
2572 /* do the actual command */
2573 if(!api_rpc_cmds[fn_num].fn(p)) {
2574 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2575 get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2576 api_rpc_cmds[fn_num].name));
2577 prs_mem_free(&p->out_data.rdata);
2578 return False;
2579 }
2580
2581 if (p->bad_handle_fault_state) {
2582 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2583 p->bad_handle_fault_state = False;
2584 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2585 return True;
2586 }
2587
2588 if (p->rng_fault_state) {
2589 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2590 p->rng_fault_state = False;
2591 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2592 return True;
2593 }
2594
2595 offset2 = prs_offset(&p->out_data.rdata);
2596 prs_set_offset(&p->out_data.rdata, offset1);
2597 if (DEBUGLEVEL >= 50) {
2598 fstring name;
2599 slprintf(name, sizeof(name)-1, "out_%s",
2600 get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2601 prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2602 }
2603 prs_set_offset(&p->out_data.rdata, offset2);
2604
2605 DEBUG(5,("api_rpcTNP: called %s successfully\n",
2606 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2607
2608 /* Check for buffer underflow in rpc parsing */
2609
2610 if ((DEBUGLEVEL >= 10) &&
2611 (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2612 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2613 char *data = (char *)SMB_MALLOC(data_len);
2614
2615 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2616 if (data) {
2617 prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2618 SAFE_FREE(data);
2619 }
2620
2621 }
2622
2623 return True;
2624 }
Samba GIT mirror