?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:torture: test setting EOF of a stream to 0 with enabled AAPL extensions
[Samba.git] / source3 / rpc_server / srv_pipe.c
blob7a1c61594678e9814bd9bfe9d1e292a893ba6bc7
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 /* this module apparently provides an implementation of DCE/RPC over a
21 * named pipe (IPC$ connection using SMBtrans). details of DCE/RPC
22 * documentation are available (in on-line form) from the X-Open group.
23 *
24 * this module should provide a level of abstraction between SMB
25 * and DCE/RPC, while minimising the amount of mallocs, unnecessary
26 * data copies, and network traffic.
27 *
28 */
29
30 #include "includes.h"
31 #include "system/filesys.h"
32 #include "srv_pipe_internal.h"
33 #include "../librpc/gen_ndr/ndr_dcerpc.h"
34 #include "../librpc/rpc/rpc_common.h"
35 #include "dcesrv_auth_generic.h"
36 #include "rpc_server.h"
37 #include "rpc_dce.h"
38 #include "smbd/smbd.h"
39 #include "auth.h"
40 #include "ntdomain.h"
41 #include "rpc_server/srv_pipe.h"
42 #include "rpc_server/rpc_contexts.h"
43 #include "lib/param/param.h"
44 #include "librpc/ndr/ndr_table.h"
45 #include "auth/gensec/gensec.h"
46 #include "librpc/ndr/ndr_dcerpc.h"
47 #include "lib/tsocket/tsocket.h"
48 #include "../librpc/gen_ndr/ndr_samr.h"
49 #include "../librpc/gen_ndr/ndr_lsa.h"
50 #include "../librpc/gen_ndr/ndr_netlogon.h"
51 #include "../librpc/gen_ndr/ndr_epmapper.h"
52 #include "../librpc/gen_ndr/ndr_echo.h"
53 #include "../librpc/gen_ndr/ndr_winspool.h"
54
55 #undef DBGC_CLASS
56 #define DBGC_CLASS DBGC_RPC_SRV
57
58 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p);
59
60 /**
61 * Dump everything from the start of the end up of the provided data
62 * into a file, but only at debug level >= 50
63 **/
64 static void dump_pdu_region(const char *name, int v,
65 DATA_BLOB *data, size_t start, size_t end)
66 {
67 int fd, i;
68 char *fname = NULL;
69 ssize_t sz;
70
71 if (DEBUGLEVEL < 50) return;
72
73 if (start > data->length || end > data->length || start > end) return;
74
75 for (i = 1; i < 100; i++) {
76 if (v != -1) {
77 fname = talloc_asprintf(talloc_tos(),
78 "/tmp/%s_%d.%d.prs",
79 name, v, i);
80 } else {
81 fname = talloc_asprintf(talloc_tos(),
82 "/tmp/%s_%d.prs",
83 name, i);
84 }
85 if (!fname) {
86 return;
87 }
88 fd = open(fname, O_WRONLY|O_CREAT|O_EXCL, 0644);
89 if (fd != -1 || errno != EEXIST) break;
90 }
91 if (fd != -1) {
92 sz = write(fd, data->data + start, end - start);
93 i = close(fd);
94 if ((sz != end - start) || (i != 0) ) {
95 DEBUG(0, ("Error writing/closing %s: %ld!=%ld %d\n",
96 fname, (unsigned long)sz,
97 (unsigned long)end - start, i));
98 } else {
99 DEBUG(0,("created %s\n", fname));
100 }
101 }
102 TALLOC_FREE(fname);
103 }
104
105 static DATA_BLOB generic_session_key(void)
106 {
107 return data_blob_const("SystemLibraryDTC", 16);
108 }
109
110 /*******************************************************************
111 Generate the next PDU to be returned from the data.
112 ********************************************************************/
113
114 static NTSTATUS create_next_packet(TALLOC_CTX *mem_ctx,
115 struct pipe_auth_data *auth,
116 uint32_t call_id,
117 DATA_BLOB *rdata,
118 size_t data_sent_length,
119 DATA_BLOB *frag,
120 size_t *pdu_size)
121 {
122 union dcerpc_payload u;
123 uint8_t pfc_flags;
124 size_t data_left;
125 size_t data_to_send;
126 size_t frag_len;
127 size_t pad_len = 0;
128 size_t auth_len = 0;
129 NTSTATUS status;
130
131 ZERO_STRUCT(u.response);
132
133 /* Set up rpc packet pfc flags. */
134 if (data_sent_length == 0) {
135 pfc_flags = DCERPC_PFC_FLAG_FIRST;
136 } else {
137 pfc_flags = 0;
138 }
139
140 /* Work out how much we can fit in a single PDU. */
141 data_left = rdata->length - data_sent_length;
142
143 /* Ensure there really is data left to send. */
144 if (!data_left) {
145 DEBUG(0, ("No data left to send !\n"));
146 return NT_STATUS_BUFFER_TOO_SMALL;
147 }
148
149 status = dcerpc_guess_sizes(auth,
150 DCERPC_RESPONSE_LENGTH,
151 data_left,
152 RPC_MAX_PDU_FRAG_LEN,
153 &data_to_send, &frag_len,
154 &auth_len, &pad_len);
155 if (!NT_STATUS_IS_OK(status)) {
156 return status;
157 }
158
159 /* Set up the alloc hint. This should be the data left to send. */
160 u.response.alloc_hint = data_left;
161
162 /* Work out if this PDU will be the last. */
163 if (data_sent_length + data_to_send >= rdata->length) {
164 pfc_flags |= DCERPC_PFC_FLAG_LAST;
165 }
166
167 /* Prepare data to be NDR encoded. */
168 u.response.stub_and_verifier =
169 data_blob_const(rdata->data + data_sent_length, data_to_send);
170
171 /* Store the packet in the data stream. */
172 status = dcerpc_push_ncacn_packet(mem_ctx, DCERPC_PKT_RESPONSE,
173 pfc_flags, auth_len, call_id,
174 &u, frag);
175 if (!NT_STATUS_IS_OK(status)) {
176 DEBUG(0, ("Failed to marshall RPC Packet.\n"));
177 return status;
178 }
179
180 if (auth_len) {
181 /* Set the proper length on the pdu, including padding.
182 * Only needed if an auth trailer will be appended. */
183 dcerpc_set_frag_length(frag, frag->length
184 + pad_len
185 + DCERPC_AUTH_TRAILER_LENGTH
186 + auth_len);
187 }
188
189 if (auth_len) {
190 status = dcerpc_add_auth_footer(auth, pad_len, frag);
191 if (!NT_STATUS_IS_OK(status)) {
192 data_blob_free(frag);
193 return status;
194 }
195 }
196
197 *pdu_size = data_to_send;
198 return NT_STATUS_OK;
199 }
200
201 /*******************************************************************
202 Generate the next PDU to be returned from the data in p->rdata.
203 ********************************************************************/
204
205 bool create_next_pdu(struct pipes_struct *p)
206 {
207 size_t pdu_size = 0;
208 NTSTATUS status;
209
210 /*
211 * If we're in the fault state, keep returning fault PDU's until
212 * the pipe gets closed. JRA.
213 */
214 if (p->fault_state) {
215 setup_fault_pdu(p, NT_STATUS(p->fault_state));
216 return true;
217 }
218
219 status = create_next_packet(p->mem_ctx, &p->auth,
220 p->call_id, &p->out_data.rdata,
221 p->out_data.data_sent_length,
222 &p->out_data.frag, &pdu_size);
223 if (!NT_STATUS_IS_OK(status)) {
224 DEBUG(0, ("Failed to create packet with error %s, "
225 "(auth level %u / type %u)\n",
226 nt_errstr(status),
227 (unsigned int)p->auth.auth_level,
228 (unsigned int)p->auth.auth_type));
229 return false;
230 }
231
232 /* Setup the counts for this PDU. */
233 p->out_data.data_sent_length += pdu_size;
234 p->out_data.current_pdu_sent = 0;
235 return true;
236 }
237
238
239 static bool pipe_init_outgoing_data(struct pipes_struct *p);
240
241 /*******************************************************************
242 Marshall a bind_nak pdu.
243 *******************************************************************/
244
245 static bool setup_bind_nak(struct pipes_struct *p, struct ncacn_packet *pkt)
246 {
247 NTSTATUS status;
248 union dcerpc_payload u;
249
250 /* Free any memory in the current return data buffer. */
251 pipe_init_outgoing_data(p);
252
253 /*
254 * Initialize a bind_nak header.
255 */
256
257 ZERO_STRUCT(u);
258
259 u.bind_nak.reject_reason = 0;
260
261 /*
262 * Marshall directly into the outgoing PDU space. We
263 * must do this as we need to set to the bind response
264 * header and are never sending more than one PDU here.
265 */
266
267 status = dcerpc_push_ncacn_packet(p->mem_ctx,
268 DCERPC_PKT_BIND_NAK,
269 DCERPC_PFC_FLAG_FIRST |
270 DCERPC_PFC_FLAG_LAST,
271 0,
272 pkt->call_id,
273 &u,
274 &p->out_data.frag);
275 if (!NT_STATUS_IS_OK(status)) {
276 return False;
277 }
278
279 p->out_data.data_sent_length = 0;
280 p->out_data.current_pdu_sent = 0;
281
282 set_incoming_fault(p);
283 TALLOC_FREE(p->auth.auth_ctx);
284 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
285 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
286 p->pipe_bound = False;
287 p->allow_bind = false;
288 p->allow_alter = false;
289 p->allow_auth3 = false;
290
291 return True;
292 }
293
294 /*******************************************************************
295 Marshall a fault pdu.
296 *******************************************************************/
297
298 bool setup_fault_pdu(struct pipes_struct *p, NTSTATUS fault_status)
299 {
300 NTSTATUS status;
301 union dcerpc_payload u;
302
303 /* Free any memory in the current return data buffer. */
304 pipe_init_outgoing_data(p);
305
306 /*
307 * Initialize a fault header.
308 */
309
310 ZERO_STRUCT(u);
311
312 u.fault.status = NT_STATUS_V(fault_status);
313
314 /*
315 * Marshall directly into the outgoing PDU space. We
316 * must do this as we need to set to the bind response
317 * header and are never sending more than one PDU here.
318 */
319
320 status = dcerpc_push_ncacn_packet(p->mem_ctx,
321 DCERPC_PKT_FAULT,
322 DCERPC_PFC_FLAG_FIRST |
323 DCERPC_PFC_FLAG_LAST |
324 DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
325 0,
326 p->call_id,
327 &u,
328 &p->out_data.frag);
329 if (!NT_STATUS_IS_OK(status)) {
330 return False;
331 }
332
333 p->out_data.data_sent_length = 0;
334 p->out_data.current_pdu_sent = 0;
335
336 return True;
337 }
338
339 /*******************************************************************
340 Ensure a bind request has the correct abstract & transfer interface.
341 Used to reject unknown binds from Win2k.
342 *******************************************************************/
343
344 static bool check_bind_req(struct pipes_struct *p,
345 struct ndr_syntax_id* abstract,
346 struct ndr_syntax_id* transfer,
347 uint32_t context_id)
348 {
349 struct pipe_rpc_fns *context_fns;
350 bool ok;
351 const char *interface_name = NULL;
352
353 DEBUG(3,("check_bind_req for %s context_id=%u\n",
354 ndr_interface_name(&abstract->uuid,
355 abstract->if_version),
356 (unsigned)context_id));
357
358 ok = ndr_syntax_id_equal(transfer, &ndr_transfer_syntax_ndr);
359 if (!ok) {
360 DEBUG(1,("check_bind_req unknown transfer syntax for "
361 "%s context_id=%u\n",
362 ndr_interface_name(&abstract->uuid,
363 abstract->if_version),
364 (unsigned)context_id));
365 return false;
366 }
367
368 for (context_fns = p->contexts;
369 context_fns != NULL;
370 context_fns = context_fns->next)
371 {
372 if (context_fns->context_id != context_id) {
373 continue;
374 }
375
376 ok = ndr_syntax_id_equal(&context_fns->syntax,
377 abstract);
378 if (ok) {
379 return true;
380 }
381
382 DEBUG(1,("check_bind_req: changing abstract syntax for "
383 "%s context_id=%u into %s not supported\n",
384 ndr_interface_name(&context_fns->syntax.uuid,
385 context_fns->syntax.if_version),
386 (unsigned)context_id,
387 ndr_interface_name(&abstract->uuid,
388 abstract->if_version)));
389 return false;
390 }
391
392 /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
393 if (!rpc_srv_pipe_exists_by_id(abstract)) {
394 return false;
395 }
396
397 DEBUG(3, ("check_bind_req: %s -> %s rpc service\n",
398 rpc_srv_get_pipe_cli_name(abstract),
399 rpc_srv_get_pipe_srv_name(abstract)));
400
401 ok = init_pipe_handles(p, abstract);
402 if (!ok) {
403 DEBUG(1, ("Failed to init pipe handles!\n"));
404 return false;
405 }
406
407 context_fns = talloc_zero(p, struct pipe_rpc_fns);
408 if (context_fns == NULL) {
409 DEBUG(0,("check_bind_req: talloc() failed!\n"));
410 return false;
411 }
412
413 interface_name = ndr_interface_name(&abstract->uuid,
414 abstract->if_version);
415 SMB_ASSERT(interface_name != NULL);
416
417 context_fns->next = context_fns->prev = NULL;
418 context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
419 context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
420 context_fns->context_id = context_id;
421 context_fns->syntax = *abstract;
422
423 context_fns->allow_connect = lp_allow_dcerpc_auth_level_connect();
424 /*
425 * for the samr, lsarpc and netlogon interfaces we don't allow "connect"
426 * auth_level by default.
427 */
428 ok = ndr_syntax_id_equal(abstract, &ndr_table_samr.syntax_id);
429 if (ok) {
430 context_fns->allow_connect = false;
431 }
432 ok = ndr_syntax_id_equal(abstract, &ndr_table_lsarpc.syntax_id);
433 if (ok) {
434 context_fns->allow_connect = false;
435 }
436 ok = ndr_syntax_id_equal(abstract, &ndr_table_netlogon.syntax_id);
437 if (ok) {
438 context_fns->allow_connect = false;
439 }
440 /*
441 * for the epmapper and echo interfaces we allow "connect"
442 * auth_level by default.
443 */
444 ok = ndr_syntax_id_equal(abstract, &ndr_table_epmapper.syntax_id);
445 if (ok) {
446 context_fns->allow_connect = true;
447 }
448 ok = ndr_syntax_id_equal(abstract, &ndr_table_rpcecho.syntax_id);
449 if (ok) {
450 context_fns->allow_connect = true;
451 }
452 /*
453 * every interface can be modified to allow "connect" auth_level by
454 * using a parametric option like:
455 * allow dcerpc auth level connect:<interface>
456 * e.g.
457 * allow dcerpc auth level connect:samr = yes
458 */
459 context_fns->allow_connect = lp_parm_bool(-1,
460 "allow dcerpc auth level connect",
461 interface_name, context_fns->allow_connect);
462
463 ok = ndr_syntax_id_equal(abstract, &ndr_table_iremotewinspool.syntax_id);
464 if (ok) {
465 context_fns->min_auth_level = DCERPC_AUTH_LEVEL_PACKET;
466 }
467
468 /* add to the list of open contexts */
469
470 DLIST_ADD( p->contexts, context_fns );
471
472 return True;
473 }
474
475 /**
476 * Is a named pipe known?
477 * @param[in] pipename Just the filename
478 * @result Do we want to serve this?
479 */
480 bool is_known_pipename(const char *pipename, struct ndr_syntax_id *syntax)
481 {
482 NTSTATUS status;
483
484 if (strchr(pipename, '/')) {
485 DEBUG(1, ("Refusing open on pipe %s\n", pipename));
486 return false;
487 }
488
489 if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
490 DEBUG(10, ("refusing spoolss access\n"));
491 return false;
492 }
493
494 if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
495 return true;
496 }
497
498 status = smb_probe_module("rpc", pipename);
499 if (!NT_STATUS_IS_OK(status)) {
500 DEBUG(10, ("is_known_pipename: %s unknown\n", pipename));
501 return false;
502 }
503 DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
504
505 /*
506 * Scan the list again for the interface id
507 */
508 if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
509 return true;
510 }
511
512 DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
513 pipename));
514
515 return false;
516 }
517
518 /*******************************************************************
519 Handle an NTLMSSP bind auth.
520 *******************************************************************/
521
522 static bool pipe_auth_generic_bind(struct pipes_struct *p,
523 struct ncacn_packet *pkt,
524 struct dcerpc_auth *auth_info,
525 const char *service_description,
526 DATA_BLOB *response)
527 {
528 TALLOC_CTX *mem_ctx = pkt;
529 struct gensec_security *gensec_security = NULL;
530 NTSTATUS status;
531
532 status = auth_generic_server_authtype_start(p,
533 auth_info->auth_type,
534 auth_info->auth_level,
535 p->remote_address,
536 p->local_address,
537 service_description,
538 &gensec_security);
539 if (!NT_STATUS_IS_OK(status)) {
540 DEBUG(0, (__location__ ": auth_generic_server_authtype_start[%u/%u] failed: %s\n",
541 auth_info->auth_type, auth_info->auth_level, nt_errstr(status)));
542 return false;
543 }
544
545 p->auth.auth_ctx = gensec_security;
546 p->auth.auth_type = auth_info->auth_type;
547 p->auth.auth_level = auth_info->auth_level;
548 p->auth.auth_context_id = auth_info->auth_context_id;
549
550 if (pkt->pfc_flags & DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN) {
551 p->auth.client_hdr_signing = true;
552 p->auth.hdr_signing = gensec_have_feature(gensec_security,
553 GENSEC_FEATURE_SIGN_PKT_HEADER);
554 }
555
556 if (p->auth.hdr_signing) {
557 gensec_want_feature(gensec_security,
558 GENSEC_FEATURE_SIGN_PKT_HEADER);
559 }
560
561 status = auth_generic_server_step(gensec_security, mem_ctx,
562 &auth_info->credentials,
563 response);
564 if (!NT_STATUS_IS_OK(status) &&
565 !NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED))
566 {
567 DEBUG(2, (__location__ ": "
568 "auth_generic_server_step[%u/%u] failed: %s\n",
569 auth_info->auth_type, auth_info->auth_level,
570 nt_errstr(status)));
571 return false;
572 }
573
574 if (NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
575 return true;
576 }
577
578 status = pipe_auth_verify_final(p);
579 if (!NT_STATUS_IS_OK(status)) {
580 DEBUG(0, ("pipe_auth_verify_final failed: %s\n",
581 nt_errstr(status)));
582 return false;
583 }
584
585 return true;
586 }
587
588 /*******************************************************************
589 Process an NTLMSSP authentication response.
590 If this function succeeds, the user has been authenticated
591 and their domain, name and calling workstation stored in
592 the pipe struct.
593 *******************************************************************/
594
595 static bool pipe_auth_generic_verify_final(TALLOC_CTX *mem_ctx,
596 struct gensec_security *gensec_security,
597 enum dcerpc_AuthLevel auth_level,
598 struct auth_session_info **session_info)
599 {
600 NTSTATUS status;
601 bool ret;
602
603 DEBUG(5, (__location__ ": checking user details\n"));
604
605 /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
606 ensure the underlying NTLMSSP flags are also set. If not we should
607 refuse the bind. */
608
609 status = auth_generic_server_check_flags(gensec_security,
610 (auth_level >=
611 DCERPC_AUTH_LEVEL_PACKET),
612 (auth_level ==
613 DCERPC_AUTH_LEVEL_PRIVACY));
614 if (!NT_STATUS_IS_OK(status)) {
615 DEBUG(0, (__location__ ": Client failed to negotatie proper "
616 "security for rpc connection\n"));
617 return false;
618 }
619
620 TALLOC_FREE(*session_info);
621
622 status = auth_generic_server_get_user_info(gensec_security,
623 mem_ctx, session_info);
624 if (!NT_STATUS_IS_OK(status)) {
625 DEBUG(0, (__location__ ": failed to obtain the server info "
626 "for authenticated user: %s\n", nt_errstr(status)));
627 return false;
628 }
629
630 if ((*session_info)->security_token == NULL) {
631 DEBUG(1, ("Auth module failed to provide nt_user_token\n"));
632 return false;
633 }
634
635 if ((*session_info)->unix_token == NULL) {
636 DEBUG(1, ("Auth module failed to provide unix_token\n"));
637 return false;
638 }
639
640 /*
641 * We're an authenticated bind over smb, so the session key needs to
642 * be set to "SystemLibraryDTC". Weird, but this is what Windows
643 * does. See the RPC-SAMBA3SESSIONKEY.
644 */
645
646 ret = session_info_set_session_key((*session_info), generic_session_key());
647 if (!ret) {
648 DEBUG(0, ("Failed to set session key!\n"));
649 return false;
650 }
651
652 return true;
653 }
654
655 static NTSTATUS pipe_auth_verify_final(struct pipes_struct *p)
656 {
657 struct gensec_security *gensec_security;
658 bool ok;
659
660 if (p->auth.auth_type == DCERPC_AUTH_TYPE_NONE) {
661 p->pipe_bound = true;
662 return NT_STATUS_OK;
663 }
664
665 gensec_security = p->auth.auth_ctx;
666
667 ok = pipe_auth_generic_verify_final(p, gensec_security,
668 p->auth.auth_level,
669 &p->session_info);
670 if (!ok) {
671 return NT_STATUS_ACCESS_DENIED;
672 }
673
674 p->pipe_bound = true;
675
676 return NT_STATUS_OK;
677 }
678
679 /*******************************************************************
680 Respond to a pipe bind request.
681 *******************************************************************/
682
683 static bool api_pipe_bind_req(struct pipes_struct *p,
684 struct ncacn_packet *pkt)
685 {
686 struct dcerpc_auth auth_info = {0};
687 uint16_t assoc_gid;
688 NTSTATUS status;
689 struct ndr_syntax_id id;
690 uint8_t pfc_flags = 0;
691 union dcerpc_payload u;
692 struct dcerpc_ack_ctx bind_ack_ctx;
693 DATA_BLOB auth_resp = data_blob_null;
694 DATA_BLOB auth_blob = data_blob_null;
695 const struct ndr_interface_table *table;
696 const char *secondary_address = NULL;
697
698 if (!p->allow_bind) {
699 DEBUG(2,("Pipe not in allow bind state\n"));
700 return setup_bind_nak(p, pkt);
701 }
702 p->allow_bind = false;
703
704 status = dcerpc_verify_ncacn_packet_header(pkt,
705 DCERPC_PKT_BIND,
706 pkt->u.bind.auth_info.length,
707 0, /* required flags */
708 DCERPC_PFC_FLAG_FIRST |
709 DCERPC_PFC_FLAG_LAST |
710 DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
711 0x08 | /* this is not defined, but should be ignored */
712 DCERPC_PFC_FLAG_CONC_MPX |
713 DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
714 DCERPC_PFC_FLAG_MAYBE |
715 DCERPC_PFC_FLAG_OBJECT_UUID);
716 if (!NT_STATUS_IS_OK(status)) {
717 DEBUG(1, ("api_pipe_bind_req: invalid pdu: %s\n",
718 nt_errstr(status)));
719 NDR_PRINT_DEBUG(ncacn_packet, pkt);
720 goto err_exit;
721 }
722
723 if (pkt->u.bind.num_contexts == 0) {
724 DEBUG(1, ("api_pipe_bind_req: no rpc contexts around\n"));
725 goto err_exit;
726 }
727
728 if (pkt->u.bind.ctx_list[0].num_transfer_syntaxes == 0) {
729 DEBUG(1, ("api_pipe_bind_req: no transfer syntaxes around\n"));
730 goto err_exit;
731 }
732
733 /*
734 * Try and find the correct pipe name to ensure
735 * that this is a pipe name we support.
736 */
737 id = pkt->u.bind.ctx_list[0].abstract_syntax;
738
739 table = ndr_table_by_uuid(&id.uuid);
740 if (table == NULL) {
741 char *iface = ndr_syntax_id_to_string(talloc_tos(), &id);
742 DBG_NOTICE("unknown interface %s\n",
743 iface ? iface : "<null>");
744 TALLOC_FREE(iface);
745 return false;
746 }
747
748 if (rpc_srv_pipe_exists_by_id(&id)) {
749 DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
750 rpc_srv_get_pipe_cli_name(&id),
751 rpc_srv_get_pipe_srv_name(&id)));
752 } else {
753 status = smb_probe_module(
754 "rpc", dcerpc_default_transport_endpoint(pkt,
755 NCACN_NP, table));
756
757 if (NT_STATUS_IS_ERR(status)) {
758 DEBUG(3,("api_pipe_bind_req: Unknown rpc service name "
759 "%s in bind request.\n",
760 ndr_interface_name(&id.uuid,
761 id.if_version)));
762
763 return setup_bind_nak(p, pkt);
764 }
765
766 if (rpc_srv_get_pipe_interface_by_cli_name(
767 dcerpc_default_transport_endpoint(pkt,
768 NCACN_NP, table),
769 &id)) {
770 DEBUG(3, ("api_pipe_bind_req: %s -> %s rpc service\n",
771 rpc_srv_get_pipe_cli_name(&id),
772 rpc_srv_get_pipe_srv_name(&id)));
773 } else {
774 DEBUG(0, ("module %s doesn't provide functions for "
775 "pipe %s!\n",
776 ndr_interface_name(&id.uuid,
777 id.if_version),
778 ndr_interface_name(&id.uuid,
779 id.if_version)));
780 return setup_bind_nak(p, pkt);
781 }
782 }
783
784 DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
785
786 if (pkt->u.bind.assoc_group_id != 0) {
787 assoc_gid = pkt->u.bind.assoc_group_id;
788 } else {
789 assoc_gid = 0x53f0;
790 }
791
792 /*
793 * Create the bind response struct.
794 */
795
796 /* If the requested abstract synt uuid doesn't match our client pipe,
797 reject the bind_ack & set the transfer interface synt to all 0's,
798 ver 0 (observed when NT5 attempts to bind to abstract interfaces
799 unknown to NT4)
800 Needed when adding entries to a DACL from NT5 - SK */
801
802 if (check_bind_req(p,
803 &pkt->u.bind.ctx_list[0].abstract_syntax,
804 &pkt->u.bind.ctx_list[0].transfer_syntaxes[0],
805 pkt->u.bind.ctx_list[0].context_id)) {
806
807 bind_ack_ctx.result = 0;
808 bind_ack_ctx.reason.value = 0;
809 bind_ack_ctx.syntax = pkt->u.bind.ctx_list[0].transfer_syntaxes[0];
810 } else {
811 /* Rejection reason: abstract syntax not supported */
812 bind_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
813 bind_ack_ctx.reason.value = DCERPC_BIND_REASON_ASYNTAX;
814 bind_ack_ctx.syntax = ndr_syntax_id_null;
815 }
816
817 /*
818 * Check if this is an authenticated bind request.
819 */
820 if (pkt->auth_length) {
821 /*
822 * Decode the authentication verifier.
823 */
824 status = dcerpc_pull_auth_trailer(pkt, pkt,
825 &pkt->u.bind.auth_info,
826 &auth_info, NULL, true);
827 if (!NT_STATUS_IS_OK(status)) {
828 DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
829 goto err_exit;
830 }
831
832 if (!pipe_auth_generic_bind(p, pkt,
833 &auth_info,
834 table->name,
835 &auth_resp)) {
836 goto err_exit;
837 }
838 } else {
839 TALLOC_CTX *frame = talloc_stackframe();
840 struct auth4_context *auth4_context;
841 const char *transport_protection = AUTHZ_TRANSPORT_PROTECTION_NONE;
842 if (p->transport == NCACN_NP) {
843 transport_protection = AUTHZ_TRANSPORT_PROTECTION_SMB;
844 }
845
846 p->auth.auth_type = DCERPC_AUTH_TYPE_NONE;
847 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
848 p->auth.auth_context_id = 0;
849
850 become_root();
851 status = make_auth4_context(frame, &auth4_context);
852 unbecome_root();
853 if (!NT_STATUS_IS_OK(status)) {
854 DEBUG(0, ("Unable to make auth context for authz log.\n"));
855 TALLOC_FREE(frame);
856 goto err_exit;
857 }
858
859 /*
860 * Log the authorization to this RPC interface. This
861 * covered ncacn_np pass-through auth, and anonymous
862 * DCE/RPC (eg epmapper, netlogon etc)
863 */
864 log_successful_authz_event(auth4_context->msg_ctx,
865 auth4_context->lp_ctx,
866 p->remote_address,
867 p->local_address,
868 table->name,
869 derpc_transport_string_by_transport(p->transport),
870 transport_protection,
871 p->session_info);
872 TALLOC_FREE(frame);
873 }
874
875 ZERO_STRUCT(u.bind_ack);
876 u.bind_ack.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
877 u.bind_ack.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
878 u.bind_ack.assoc_group_id = assoc_gid;
879
880 switch (p->transport) {
881 case NCACN_IP_TCP:
882 secondary_address = talloc_asprintf(pkt, "%d",
883 tsocket_address_inet_port(p->local_address));
884 break;
885 case NCACN_NP:
886 default:
887 /* name has to be \PIPE\xxxxx */
888 secondary_address =
889 talloc_asprintf(pkt, "\\PIPE\\%s",
890 rpc_srv_get_pipe_srv_name(&id));
891 break;
892 }
893
894 if (secondary_address == NULL) {
895 DEBUG(0, ("Out of memory!\n"));
896 goto err_exit;
897 }
898
899 u.bind_ack.secondary_address = secondary_address;
900 u.bind_ack.secondary_address_size =
901 strlen(u.bind_ack.secondary_address) + 1;
902
903 u.bind_ack.num_results = 1;
904 u.bind_ack.ctx_list = &bind_ack_ctx;
905
906 /* NOTE: We leave the auth_info empty so we can calculate the padding
907 * later and then append the auth_info --simo */
908
909 /*
910 * Marshall directly into the outgoing PDU space. We
911 * must do this as we need to set to the bind response
912 * header and are never sending more than one PDU here.
913 */
914
915 pfc_flags = DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST;
916
917 if (p->auth.hdr_signing) {
918 pfc_flags |= DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN;
919 }
920
921 status = dcerpc_push_ncacn_packet(p->mem_ctx,
922 DCERPC_PKT_BIND_ACK,
923 pfc_flags,
924 auth_resp.length,
925 pkt->call_id,
926 &u,
927 &p->out_data.frag);
928 if (!NT_STATUS_IS_OK(status)) {
929 DEBUG(0, ("Failed to marshall bind_ack packet. (%s)\n",
930 nt_errstr(status)));
931 goto err_exit;
932 }
933
934 if (auth_resp.length) {
935 status = dcerpc_push_dcerpc_auth(pkt,
936 p->auth.auth_type,
937 p->auth.auth_level,
938 0, /* pad_len */
939 p->auth.auth_context_id,
940 &auth_resp,
941 &auth_blob);
942 if (!NT_STATUS_IS_OK(status)) {
943 DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
944 goto err_exit;
945 }
946 }
947
948 /* Now that we have the auth len store it into the right place in
949 * the dcerpc header */
950 dcerpc_set_frag_length(&p->out_data.frag,
951 p->out_data.frag.length + auth_blob.length);
952
953 if (auth_blob.length) {
954
955 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
956 auth_blob.data, auth_blob.length)) {
957 DEBUG(0, ("Append of auth info failed.\n"));
958 goto err_exit;
959 }
960 }
961
962 /*
963 * Setup the lengths for the initial reply.
964 */
965
966 p->out_data.data_sent_length = 0;
967 p->out_data.current_pdu_sent = 0;
968
969 TALLOC_FREE(auth_blob.data);
970
971 if (bind_ack_ctx.result == 0) {
972 p->allow_alter = true;
973 p->allow_auth3 = true;
974 if (p->auth.auth_type == DCERPC_AUTH_TYPE_NONE) {
975 status = pipe_auth_verify_final(p);
976 if (!NT_STATUS_IS_OK(status)) {
977 DEBUG(0, ("pipe_auth_verify_final failed: %s\n",
978 nt_errstr(status)));
979 goto err_exit;
980 }
981 }
982 } else {
983 goto err_exit;
984 }
985
986 return True;
987
988 err_exit:
989
990 data_blob_free(&p->out_data.frag);
991 TALLOC_FREE(auth_blob.data);
992 return setup_bind_nak(p, pkt);
993 }
994
995 /*******************************************************************
996 This is the "stage3" response after a bind request and reply.
997 *******************************************************************/
998
999 bool api_pipe_bind_auth3(struct pipes_struct *p, struct ncacn_packet *pkt)
1000 {
1001 struct dcerpc_auth auth_info;
1002 DATA_BLOB response = data_blob_null;
1003 struct gensec_security *gensec_security;
1004 NTSTATUS status;
1005
1006 DEBUG(5, ("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
1007
1008 if (!p->allow_auth3) {
1009 DEBUG(1, ("Pipe not in allow auth3 state.\n"));
1010 goto err;
1011 }
1012
1013 status = dcerpc_verify_ncacn_packet_header(pkt,
1014 DCERPC_PKT_AUTH3,
1015 pkt->u.auth3.auth_info.length,
1016 0, /* required flags */
1017 DCERPC_PFC_FLAG_FIRST |
1018 DCERPC_PFC_FLAG_LAST |
1019 DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
1020 0x08 | /* this is not defined, but should be ignored */
1021 DCERPC_PFC_FLAG_CONC_MPX |
1022 DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
1023 DCERPC_PFC_FLAG_MAYBE |
1024 DCERPC_PFC_FLAG_OBJECT_UUID);
1025 if (!NT_STATUS_IS_OK(status)) {
1026 DEBUG(1, ("api_pipe_bind_auth3: invalid pdu: %s\n",
1027 nt_errstr(status)));
1028 NDR_PRINT_DEBUG(ncacn_packet, pkt);
1029 goto err;
1030 }
1031
1032 /* We can only finish if the pipe is unbound for now */
1033 if (p->pipe_bound) {
1034 DEBUG(0, (__location__ ": Pipe already bound, "
1035 "AUTH3 not supported!\n"));
1036 goto err;
1037 }
1038
1039 if (pkt->auth_length == 0) {
1040 DEBUG(1, ("No auth field sent for auth3 request!\n"));
1041 goto err;
1042 }
1043
1044 /*
1045 * Decode the authentication verifier response.
1046 */
1047
1048 status = dcerpc_pull_auth_trailer(pkt, pkt,
1049 &pkt->u.auth3.auth_info,
1050 &auth_info, NULL, true);
1051 if (!NT_STATUS_IS_OK(status)) {
1052 DEBUG(1, ("Failed to unmarshall dcerpc_auth.\n"));
1053 goto err;
1054 }
1055
1056 /* We must NEVER look at auth_info->auth_pad_len here,
1057 * as old Samba client code gets it wrong and sends it
1058 * as zero. JRA.
1059 */
1060
1061 if (auth_info.auth_type != p->auth.auth_type) {
1062 DEBUG(1, ("Auth type mismatch! Client sent %d, "
1063 "but auth was started as type %d!\n",
1064 auth_info.auth_type, p->auth.auth_type));
1065 goto err;
1066 }
1067
1068 if (auth_info.auth_level != p->auth.auth_level) {
1069 DEBUG(1, ("Auth level mismatch! Client sent %d, "
1070 "but auth was started as level %d!\n",
1071 auth_info.auth_level, p->auth.auth_level));
1072 goto err;
1073 }
1074
1075 if (auth_info.auth_context_id != p->auth.auth_context_id) {
1076 DEBUG(0, ("Auth context id mismatch! Client sent %u, "
1077 "but auth was started as level %u!\n",
1078 (unsigned)auth_info.auth_context_id,
1079 (unsigned)p->auth.auth_context_id));
1080 goto err;
1081 }
1082
1083 gensec_security = p->auth.auth_ctx;
1084
1085 status = auth_generic_server_step(gensec_security,
1086 pkt, &auth_info.credentials,
1087 &response);
1088
1089 if (NT_STATUS_EQUAL(status,
1090 NT_STATUS_MORE_PROCESSING_REQUIRED) ||
1091 response.length) {
1092 DEBUG(1, (__location__ ": This was supposed to be the final "
1093 "leg, but crypto machinery claims a response is "
1094 "needed, aborting auth!\n"));
1095 data_blob_free(&response);
1096 goto err;
1097 }
1098 if (!NT_STATUS_IS_OK(status)) {
1099 DEBUG(2, ("Auth failed (%s)\n", nt_errstr(status)));
1100 goto err;
1101 }
1102
1103 /* Now verify auth was indeed successful and extract server info */
1104 status = pipe_auth_verify_final(p);
1105 if (!NT_STATUS_IS_OK(status)) {
1106 DEBUG(2, ("Auth Verify failed (%s)\n", nt_errstr(status)));
1107 goto err;
1108 }
1109
1110 return true;
1111
1112 err:
1113 p->pipe_bound = false;
1114 p->allow_bind = false;
1115 p->allow_alter = false;
1116 p->allow_auth3 = false;
1117
1118 TALLOC_FREE(p->auth.auth_ctx);
1119 return false;
1120 }
1121
1122 /****************************************************************************
1123 Deal with an alter context call. Can be third part of 3 leg auth request for
1124 SPNEGO calls.
1125 ****************************************************************************/
1126
1127 static bool api_pipe_alter_context(struct pipes_struct *p,
1128 struct ncacn_packet *pkt)
1129 {
1130 struct dcerpc_auth auth_info = {0};
1131 uint16_t assoc_gid;
1132 NTSTATUS status;
1133 union dcerpc_payload u;
1134 struct dcerpc_ack_ctx alter_ack_ctx;
1135 DATA_BLOB auth_resp = data_blob_null;
1136 DATA_BLOB auth_blob = data_blob_null;
1137 struct gensec_security *gensec_security;
1138
1139 DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1140
1141 if (!p->allow_alter) {
1142 DEBUG(1, ("Pipe not in allow alter state.\n"));
1143 goto err_exit;
1144 }
1145
1146 status = dcerpc_verify_ncacn_packet_header(pkt,
1147 DCERPC_PKT_ALTER,
1148 pkt->u.alter.auth_info.length,
1149 0, /* required flags */
1150 DCERPC_PFC_FLAG_FIRST |
1151 DCERPC_PFC_FLAG_LAST |
1152 DCERPC_PFC_FLAG_SUPPORT_HEADER_SIGN |
1153 0x08 | /* this is not defined, but should be ignored */
1154 DCERPC_PFC_FLAG_CONC_MPX |
1155 DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
1156 DCERPC_PFC_FLAG_MAYBE |
1157 DCERPC_PFC_FLAG_OBJECT_UUID);
1158 if (!NT_STATUS_IS_OK(status)) {
1159 DEBUG(1, ("api_pipe_alter_context: invalid pdu: %s\n",
1160 nt_errstr(status)));
1161 NDR_PRINT_DEBUG(ncacn_packet, pkt);
1162 goto err_exit;
1163 }
1164
1165 if (pkt->u.alter.num_contexts == 0) {
1166 DEBUG(1, ("api_pipe_alter_context: no rpc contexts around\n"));
1167 goto err_exit;
1168 }
1169
1170 if (pkt->u.alter.ctx_list[0].num_transfer_syntaxes == 0) {
1171 DEBUG(1, ("api_pipe_alter_context: no transfer syntaxes around\n"));
1172 goto err_exit;
1173 }
1174
1175 if (pkt->u.alter.assoc_group_id != 0) {
1176 assoc_gid = pkt->u.alter.assoc_group_id;
1177 } else {
1178 assoc_gid = 0x53f0;
1179 }
1180
1181 /*
1182 * Create the bind response struct.
1183 */
1184
1185 /* If the requested abstract synt uuid doesn't match our client pipe,
1186 reject the alter_ack & set the transfer interface synt to all 0's,
1187 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1188 unknown to NT4)
1189 Needed when adding entries to a DACL from NT5 - SK */
1190
1191 if (check_bind_req(p,
1192 &pkt->u.alter.ctx_list[0].abstract_syntax,
1193 &pkt->u.alter.ctx_list[0].transfer_syntaxes[0],
1194 pkt->u.alter.ctx_list[0].context_id)) {
1195
1196 alter_ack_ctx.result = 0;
1197 alter_ack_ctx.reason.value = 0;
1198 alter_ack_ctx.syntax = pkt->u.alter.ctx_list[0].transfer_syntaxes[0];
1199 } else {
1200 /* Rejection reason: abstract syntax not supported */
1201 alter_ack_ctx.result = DCERPC_BIND_PROVIDER_REJECT;
1202 alter_ack_ctx.reason.value = DCERPC_BIND_REASON_ASYNTAX;
1203 alter_ack_ctx.syntax = ndr_syntax_id_null;
1204 }
1205
1206 /*
1207 * Check if this is an authenticated alter context request.
1208 */
1209 if (pkt->auth_length) {
1210 /* We can only finish if the pipe is unbound for now */
1211 if (p->pipe_bound) {
1212 DEBUG(0, (__location__ ": Pipe already bound, "
1213 "Altering Context not yet supported!\n"));
1214 goto err_exit;
1215 }
1216
1217 status = dcerpc_pull_auth_trailer(pkt, pkt,
1218 &pkt->u.alter.auth_info,
1219 &auth_info, NULL, true);
1220 if (!NT_STATUS_IS_OK(status)) {
1221 DEBUG(0, ("Unable to unmarshall dcerpc_auth.\n"));
1222 goto err_exit;
1223 }
1224
1225 if (auth_info.auth_type != p->auth.auth_type) {
1226 DEBUG(0, ("Auth type mismatch! Client sent %d, "
1227 "but auth was started as type %d!\n",
1228 auth_info.auth_type, p->auth.auth_type));
1229 goto err_exit;
1230 }
1231
1232 if (auth_info.auth_level != p->auth.auth_level) {
1233 DEBUG(0, ("Auth level mismatch! Client sent %d, "
1234 "but auth was started as level %d!\n",
1235 auth_info.auth_level, p->auth.auth_level));
1236 goto err_exit;
1237 }
1238
1239 if (auth_info.auth_context_id != p->auth.auth_context_id) {
1240 DEBUG(0, ("Auth context id mismatch! Client sent %u, "
1241 "but auth was started as level %u!\n",
1242 (unsigned)auth_info.auth_context_id,
1243 (unsigned)p->auth.auth_context_id));
1244 goto err_exit;
1245 }
1246
1247 gensec_security = p->auth.auth_ctx;
1248 status = auth_generic_server_step(gensec_security,
1249 pkt,
1250 &auth_info.credentials,
1251 &auth_resp);
1252 if (NT_STATUS_IS_OK(status)) {
1253 /* third leg of auth, verify auth info */
1254 status = pipe_auth_verify_final(p);
1255 if (!NT_STATUS_IS_OK(status)) {
1256 DEBUG(0, ("Auth Verify failed (%s)\n",
1257 nt_errstr(status)));
1258 goto err_exit;
1259 }
1260 } else if (NT_STATUS_EQUAL(status,
1261 NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1262 DEBUG(10, ("More auth legs required.\n"));
1263 } else {
1264 DEBUG(0, ("Auth step returned an error (%s)\n",
1265 nt_errstr(status)));
1266 goto err_exit;
1267 }
1268 }
1269
1270 ZERO_STRUCT(u.alter_resp);
1271 u.alter_resp.max_xmit_frag = RPC_MAX_PDU_FRAG_LEN;
1272 u.alter_resp.max_recv_frag = RPC_MAX_PDU_FRAG_LEN;
1273 u.alter_resp.assoc_group_id = assoc_gid;
1274
1275 /* secondary address CAN be NULL
1276 * as the specs say it's ignored.
1277 * It MUST be NULL to have the spoolss working.
1278 */
1279 u.alter_resp.secondary_address = "";
1280 u.alter_resp.secondary_address_size = 1;
1281
1282 u.alter_resp.num_results = 1;
1283 u.alter_resp.ctx_list = &alter_ack_ctx;
1284
1285 /* NOTE: We leave the auth_info empty so we can calculate the padding
1286 * later and then append the auth_info --simo */
1287
1288 /*
1289 * Marshall directly into the outgoing PDU space. We
1290 * must do this as we need to set to the bind response
1291 * header and are never sending more than one PDU here.
1292 */
1293
1294 status = dcerpc_push_ncacn_packet(p->mem_ctx,
1295 DCERPC_PKT_ALTER_RESP,
1296 DCERPC_PFC_FLAG_FIRST |
1297 DCERPC_PFC_FLAG_LAST,
1298 auth_resp.length,
1299 pkt->call_id,
1300 &u,
1301 &p->out_data.frag);
1302 if (!NT_STATUS_IS_OK(status)) {
1303 DEBUG(0, ("Failed to marshall alter_resp packet. (%s)\n",
1304 nt_errstr(status)));
1305 goto err_exit;
1306 }
1307
1308 if (auth_resp.length) {
1309 status = dcerpc_push_dcerpc_auth(pkt,
1310 p->auth.auth_type,
1311 p->auth.auth_level,
1312 0, /* pad_len */
1313 p->auth.auth_context_id,
1314 &auth_resp,
1315 &auth_blob);
1316 if (!NT_STATUS_IS_OK(status)) {
1317 DEBUG(0, ("Marshalling of dcerpc_auth failed.\n"));
1318 goto err_exit;
1319 }
1320 }
1321
1322 /* Now that we have the auth len store it into the right place in
1323 * the dcerpc header */
1324 dcerpc_set_frag_length(&p->out_data.frag,
1325 p->out_data.frag.length +
1326 auth_blob.length);
1327
1328 if (auth_resp.length) {
1329 if (!data_blob_append(p->mem_ctx, &p->out_data.frag,
1330 auth_blob.data, auth_blob.length)) {
1331 DEBUG(0, ("Append of auth info failed.\n"));
1332 goto err_exit;
1333 }
1334 }
1335
1336 /*
1337 * Setup the lengths for the initial reply.
1338 */
1339
1340 p->out_data.data_sent_length = 0;
1341 p->out_data.current_pdu_sent = 0;
1342
1343 TALLOC_FREE(auth_blob.data);
1344 return True;
1345
1346 err_exit:
1347
1348 data_blob_free(&p->out_data.frag);
1349 TALLOC_FREE(auth_blob.data);
1350 return setup_bind_nak(p, pkt);
1351 }
1352
1353 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1354 const struct api_struct *api_rpc_cmds, int n_cmds,
1355 const struct ndr_syntax_id *syntax);
1356
1357 static bool srv_pipe_check_verification_trailer(struct pipes_struct *p,
1358 struct ncacn_packet *pkt,
1359 struct pipe_rpc_fns *pipe_fns)
1360 {
1361 TALLOC_CTX *frame = talloc_stackframe();
1362 struct dcerpc_sec_verification_trailer *vt = NULL;
1363 const uint32_t bitmask1 =
1364 p->auth.client_hdr_signing ? DCERPC_SEC_VT_CLIENT_SUPPORTS_HEADER_SIGNING : 0;
1365 const struct dcerpc_sec_vt_pcontext pcontext = {
1366 .abstract_syntax = pipe_fns->syntax,
1367 .transfer_syntax = ndr_transfer_syntax_ndr,
1368 };
1369 const struct dcerpc_sec_vt_header2 header2 =
1370 dcerpc_sec_vt_header2_from_ncacn_packet(pkt);
1371 struct ndr_pull *ndr;
1372 enum ndr_err_code ndr_err;
1373 bool ret = false;
1374
1375 ndr = ndr_pull_init_blob(&p->in_data.data, frame);
1376 if (ndr == NULL) {
1377 goto done;
1378 }
1379
1380 ndr_err = ndr_pop_dcerpc_sec_verification_trailer(ndr, frame, &vt);
1381 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1382 goto done;
1383 }
1384
1385 ret = dcerpc_sec_verification_trailer_check(vt, &bitmask1,
1386 &pcontext, &header2);
1387 done:
1388 TALLOC_FREE(frame);
1389 return ret;
1390 }
1391
1392 /****************************************************************************
1393 Find the correct RPC function to call for this request.
1394 If the pipe is authenticated then become the correct UNIX user
1395 before doing the call.
1396 ****************************************************************************/
1397
1398 static bool api_pipe_request(struct pipes_struct *p,
1399 struct ncacn_packet *pkt)
1400 {
1401 TALLOC_CTX *frame = talloc_stackframe();
1402 bool ret = False;
1403 struct pipe_rpc_fns *pipe_fns;
1404 const char *interface_name = NULL;
1405
1406 if (!p->pipe_bound) {
1407 DEBUG(1, ("Pipe not bound!\n"));
1408 data_blob_free(&p->out_data.rdata);
1409 TALLOC_FREE(frame);
1410 return false;
1411 }
1412
1413 /* get the set of RPC functions for this context */
1414 pipe_fns = find_pipe_fns_by_context(p->contexts,
1415 pkt->u.request.context_id);
1416 if (pipe_fns == NULL) {
1417 DEBUG(0, ("No rpc function table associated with context "
1418 "[%d]\n",
1419 pkt->u.request.context_id));
1420 data_blob_free(&p->out_data.rdata);
1421 TALLOC_FREE(frame);
1422 return false;
1423 }
1424
1425 interface_name = ndr_interface_name(&pipe_fns->syntax.uuid,
1426 pipe_fns->syntax.if_version);
1427 SMB_ASSERT(interface_name != NULL);
1428
1429 if (p->auth.auth_level < pipe_fns->min_auth_level) {
1430
1431 DEBUG(1, ("%s: auth level required for %s: 0x%x, got: 0x%0x\n",
1432 __func__, interface_name,
1433 pipe_fns->min_auth_level,
1434 p->auth.auth_level));
1435
1436 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_ACCESS_DENIED));
1437 TALLOC_FREE(frame);
1438 return true;
1439 }
1440
1441 switch (p->auth.auth_level) {
1442 case DCERPC_AUTH_LEVEL_NONE:
1443 case DCERPC_AUTH_LEVEL_PACKET:
1444 case DCERPC_AUTH_LEVEL_INTEGRITY:
1445 case DCERPC_AUTH_LEVEL_PRIVACY:
1446 break;
1447 default:
1448 if (!pipe_fns->allow_connect) {
1449 char *addr;
1450
1451 addr = tsocket_address_string(p->remote_address, frame);
1452
1453 DEBUG(1, ("%s: restrict auth_level_connect access "
1454 "to [%s] with auth[type=0x%x,level=0x%x] "
1455 "on [%s] from [%s]\n",
1456 __func__, interface_name,
1457 p->auth.auth_type,
1458 p->auth.auth_level,
1459 derpc_transport_string_by_transport(p->transport),
1460 addr));
1461
1462 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_ACCESS_DENIED));
1463 TALLOC_FREE(frame);
1464 return true;
1465 }
1466 break;
1467 }
1468
1469 if (!srv_pipe_check_verification_trailer(p, pkt, pipe_fns)) {
1470 DEBUG(1, ("srv_pipe_check_verification_trailer: failed\n"));
1471 set_incoming_fault(p);
1472 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_ACCESS_DENIED));
1473 data_blob_free(&p->out_data.rdata);
1474 TALLOC_FREE(frame);
1475 return true;
1476 }
1477
1478 if (!become_authenticated_pipe_user(p->session_info)) {
1479 DEBUG(1, ("Failed to become pipe user!\n"));
1480 data_blob_free(&p->out_data.rdata);
1481 TALLOC_FREE(frame);
1482 return false;
1483 }
1484
1485 DEBUG(5, ("Requested %s rpc service\n", interface_name));
1486
1487 ret = api_rpcTNP(p, pkt, pipe_fns->cmds, pipe_fns->n_cmds,
1488 &pipe_fns->syntax);
1489 unbecome_authenticated_pipe_user();
1490
1491 TALLOC_FREE(frame);
1492 return ret;
1493 }
1494
1495 /*******************************************************************
1496 Calls the underlying RPC function for a named pipe.
1497 ********************************************************************/
1498
1499 static bool api_rpcTNP(struct pipes_struct *p, struct ncacn_packet *pkt,
1500 const struct api_struct *api_rpc_cmds, int n_cmds,
1501 const struct ndr_syntax_id *syntax)
1502 {
1503 int fn_num;
1504 uint32_t offset1;
1505 const struct ndr_interface_table *table;
1506
1507 /* interpret the command */
1508 DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
1509 ndr_interface_name(&syntax->uuid, syntax->if_version),
1510 pkt->u.request.opnum));
1511
1512 table = ndr_table_by_uuid(&syntax->uuid);
1513 if (table == NULL) {
1514 DEBUG(0,("unknown interface\n"));
1515 return false;
1516 }
1517
1518 if (DEBUGLEVEL >= 50) {
1519 fstring name;
1520 slprintf(name, sizeof(name)-1, "in_%s",
1521 dcerpc_default_transport_endpoint(pkt, NCACN_NP, table));
1522 dump_pdu_region(name, pkt->u.request.opnum,
1523 &p->in_data.data, 0,
1524 p->in_data.data.length);
1525 }
1526
1527 for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1528 if (api_rpc_cmds[fn_num].opnum == pkt->u.request.opnum &&
1529 api_rpc_cmds[fn_num].fn != NULL) {
1530 DEBUG(3, ("api_rpcTNP: rpc command: %s\n",
1531 api_rpc_cmds[fn_num].name));
1532 break;
1533 }
1534 }
1535
1536 if (fn_num == n_cmds) {
1537 /*
1538 * For an unknown RPC just return a fault PDU but
1539 * return True to allow RPC's on the pipe to continue
1540 * and not put the pipe into fault state. JRA.
1541 */
1542 DEBUG(4, ("unknown\n"));
1543 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
1544 return True;
1545 }
1546
1547 offset1 = p->out_data.rdata.length;
1548
1549 DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1550 fn_num, api_rpc_cmds[fn_num].fn));
1551 /* do the actual command */
1552 if(!api_rpc_cmds[fn_num].fn(p)) {
1553 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
1554 ndr_interface_name(&syntax->uuid, syntax->if_version),
1555 api_rpc_cmds[fn_num].name));
1556 data_blob_free(&p->out_data.rdata);
1557 return False;
1558 }
1559
1560 if (p->fault_state) {
1561 DEBUG(4,("api_rpcTNP: fault(%d) return.\n", p->fault_state));
1562 setup_fault_pdu(p, NT_STATUS(p->fault_state));
1563 p->fault_state = 0;
1564 return true;
1565 }
1566
1567 if (DEBUGLEVEL >= 50) {
1568 fstring name;
1569 slprintf(name, sizeof(name)-1, "out_%s",
1570 dcerpc_default_transport_endpoint(pkt, NCACN_NP, table));
1571 dump_pdu_region(name, pkt->u.request.opnum,
1572 &p->out_data.rdata, offset1,
1573 p->out_data.rdata.length);
1574 }
1575
1576 DEBUG(5,("api_rpcTNP: called %s successfully\n",
1577 ndr_interface_name(&syntax->uuid, syntax->if_version)));
1578
1579 /* Check for buffer underflow in rpc parsing */
1580 if ((DEBUGLEVEL >= 10) &&
1581 (pkt->frag_length < p->in_data.data.length)) {
1582 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1583 dump_data(10, p->in_data.data.data + pkt->frag_length,
1584 p->in_data.data.length - pkt->frag_length);
1585 }
1586
1587 return True;
1588 }
1589
1590 /****************************************************************************
1591 Initialise an outgoing packet.
1592 ****************************************************************************/
1593
1594 static bool pipe_init_outgoing_data(struct pipes_struct *p)
1595 {
1596 output_data *o_data = &p->out_data;
1597
1598 /* Reset the offset counters. */
1599 o_data->data_sent_length = 0;
1600 o_data->current_pdu_sent = 0;
1601
1602 data_blob_free(&o_data->frag);
1603
1604 /* Free any memory in the current return data buffer. */
1605 data_blob_free(&o_data->rdata);
1606
1607 return True;
1608 }
1609
1610 /****************************************************************************
1611 Sets the fault state on incoming packets.
1612 ****************************************************************************/
1613
1614 void set_incoming_fault(struct pipes_struct *p)
1615 {
1616 data_blob_free(&p->in_data.data);
1617 p->in_data.pdu_needed_len = 0;
1618 p->in_data.pdu.length = 0;
1619 p->fault_state = DCERPC_NCA_S_PROTO_ERROR;
1620
1621 p->allow_alter = false;
1622 p->allow_auth3 = false;
1623 p->pipe_bound = false;
1624
1625 DEBUG(10, ("Setting fault state\n"));
1626 }
1627
1628 static NTSTATUS dcesrv_auth_request(struct pipe_auth_data *auth,
1629 struct ncacn_packet *pkt,
1630 DATA_BLOB *raw_pkt)
1631 {
1632 NTSTATUS status;
1633 size_t hdr_size = DCERPC_REQUEST_LENGTH;
1634
1635 DEBUG(10, ("Checking request auth.\n"));
1636
1637 if (pkt->pfc_flags & DCERPC_PFC_FLAG_OBJECT_UUID) {
1638 hdr_size += 16;
1639 }
1640
1641 /* in case of sealing this function will unseal the data in place */
1642 status = dcerpc_check_auth(auth, pkt,
1643 &pkt->u.request.stub_and_verifier,
1644 hdr_size, raw_pkt);
1645 if (!NT_STATUS_IS_OK(status)) {
1646 return status;
1647 }
1648
1649 return NT_STATUS_OK;
1650 }
1651
1652 /****************************************************************************
1653 Processes a request pdu. This will do auth processing if needed, and
1654 appends the data into the complete stream if the LAST flag is not set.
1655 ****************************************************************************/
1656
1657 static bool process_request_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1658 {
1659 NTSTATUS status;
1660 DATA_BLOB data;
1661 struct dcerpc_sec_vt_header2 hdr2;
1662
1663 if (!p->pipe_bound) {
1664 DEBUG(0,("process_request_pdu: rpc request with no bind.\n"));
1665 set_incoming_fault(p);
1666 return False;
1667 }
1668
1669 /*
1670 * We don't ignore DCERPC_PFC_FLAG_PENDING_CANCEL.
1671 * TODO: we can reject it with DCERPC_FAULT_NO_CALL_ACTIVE later.
1672 */
1673 status = dcerpc_verify_ncacn_packet_header(pkt,
1674 DCERPC_PKT_REQUEST,
1675 pkt->u.request.stub_and_verifier.length,
1676 0, /* required_flags */
1677 DCERPC_PFC_FLAG_FIRST |
1678 DCERPC_PFC_FLAG_LAST |
1679 0x08 | /* this is not defined, but should be ignored */
1680 DCERPC_PFC_FLAG_CONC_MPX |
1681 DCERPC_PFC_FLAG_DID_NOT_EXECUTE |
1682 DCERPC_PFC_FLAG_MAYBE |
1683 DCERPC_PFC_FLAG_OBJECT_UUID);
1684 if (!NT_STATUS_IS_OK(status)) {
1685 DEBUG(1, ("process_request_pdu: invalid pdu: %s\n",
1686 nt_errstr(status)));
1687 NDR_PRINT_DEBUG(ncacn_packet, pkt);
1688 set_incoming_fault(p);
1689 return false;
1690 }
1691
1692 hdr2 = dcerpc_sec_vt_header2_from_ncacn_packet(pkt);
1693 if (pkt->pfc_flags & DCERPC_PFC_FLAG_FIRST) {
1694 p->header2 = hdr2;
1695 } else {
1696 if (!dcerpc_sec_vt_header2_equal(&hdr2, &p->header2)) {
1697 set_incoming_fault(p);
1698 return false;
1699 }
1700 }
1701
1702 /* Store the opnum */
1703 p->opnum = pkt->u.request.opnum;
1704
1705 status = dcesrv_auth_request(&p->auth, pkt, &p->in_data.pdu);
1706 if (!NT_STATUS_IS_OK(status)) {
1707 DEBUG(0, ("Failed to check packet auth. (%s)\n",
1708 nt_errstr(status)));
1709 set_incoming_fault(p);
1710 return false;
1711 }
1712
1713 data = pkt->u.request.stub_and_verifier;
1714
1715 /*
1716 * Check the data length doesn't go over the 15Mb limit.
1717 * increased after observing a bug in the Windows NT 4.0 SP6a
1718 * spoolsv.exe when the response to a GETPRINTERDRIVER2 RPC
1719 * will not fit in the initial buffer of size 0x1068 --jerry 22/01/2002
1720 */
1721
1722 if (p->in_data.data.length + data.length > MAX_RPC_DATA_SIZE) {
1723 DEBUG(0, ("process_request_pdu: "
1724 "rpc data buffer too large (%u) + (%u)\n",
1725 (unsigned int)p->in_data.data.length,
1726 (unsigned int)data.length));
1727 set_incoming_fault(p);
1728 return False;
1729 }
1730
1731 /*
1732 * Append the data portion into the buffer and return.
1733 */
1734
1735 if (data.length) {
1736 if (!data_blob_append(p->mem_ctx, &p->in_data.data,
1737 data.data, data.length)) {
1738 DEBUG(0, ("Unable to append data size %u "
1739 "to parse buffer of size %u.\n",
1740 (unsigned int)data.length,
1741 (unsigned int)p->in_data.data.length));
1742 set_incoming_fault(p);
1743 return False;
1744 }
1745 }
1746
1747 if (!(pkt->pfc_flags & DCERPC_PFC_FLAG_LAST)) {
1748 return true;
1749 }
1750
1751 /*
1752 * Ok - we finally have a complete RPC stream.
1753 * Call the rpc command to process it.
1754 */
1755
1756 return api_pipe_request(p, pkt);
1757 }
1758
1759 void process_complete_pdu(struct pipes_struct *p, struct ncacn_packet *pkt)
1760 {
1761 bool reply = false;
1762
1763 /* Store the call_id */
1764 p->call_id = pkt->call_id;
1765
1766 DEBUG(10, ("Processing packet type %u\n", (unsigned int)pkt->ptype));
1767
1768 if (!pipe_init_outgoing_data(p)) {
1769 goto done;
1770 }
1771
1772 switch (pkt->ptype) {
1773 case DCERPC_PKT_REQUEST:
1774 reply = process_request_pdu(p, pkt);
1775 break;
1776
1777 case DCERPC_PKT_PING: /* CL request - ignore... */
1778 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1779 (unsigned int)pkt->ptype));
1780 break;
1781
1782 case DCERPC_PKT_RESPONSE: /* No responses here. */
1783 DEBUG(0, ("Error - DCERPC_PKT_RESPONSE received from client"));
1784 break;
1785
1786 case DCERPC_PKT_FAULT:
1787 case DCERPC_PKT_WORKING:
1788 /* CL request - reply to a ping when a call in process. */
1789 case DCERPC_PKT_NOCALL:
1790 /* CL - server reply to a ping call. */
1791 case DCERPC_PKT_REJECT:
1792 case DCERPC_PKT_ACK:
1793 case DCERPC_PKT_CL_CANCEL:
1794 case DCERPC_PKT_FACK:
1795 case DCERPC_PKT_CANCEL_ACK:
1796 DEBUG(0, ("Error - Connectionless packet type %u received\n",
1797 (unsigned int)pkt->ptype));
1798 break;
1799
1800 case DCERPC_PKT_BIND:
1801 /*
1802 * We assume that a pipe bind is only in one pdu.
1803 */
1804 reply = api_pipe_bind_req(p, pkt);
1805 break;
1806
1807 case DCERPC_PKT_BIND_ACK:
1808 case DCERPC_PKT_BIND_NAK:
1809 DEBUG(0, ("Error - DCERPC_PKT_BINDACK/DCERPC_PKT_BINDNACK "
1810 "packet type %u received.\n",
1811 (unsigned int)pkt->ptype));
1812 break;
1813
1814
1815 case DCERPC_PKT_ALTER:
1816 /*
1817 * We assume that a pipe bind is only in one pdu.
1818 */
1819 reply = api_pipe_alter_context(p, pkt);
1820 break;
1821
1822 case DCERPC_PKT_ALTER_RESP:
1823 DEBUG(0, ("Error - DCERPC_PKT_ALTER_RESP received: "
1824 "Should only be server -> client.\n"));
1825 break;
1826
1827 case DCERPC_PKT_AUTH3:
1828 /*
1829 * The third packet in an auth exchange.
1830 */
1831 reply = api_pipe_bind_auth3(p, pkt);
1832 break;
1833
1834 case DCERPC_PKT_SHUTDOWN:
1835 DEBUG(0, ("Error - DCERPC_PKT_SHUTDOWN received: "
1836 "Should only be server -> client.\n"));
1837 break;
1838
1839 case DCERPC_PKT_CO_CANCEL:
1840 /* For now just free all client data and continue
1841 * processing. */
1842 DEBUG(3,("process_complete_pdu: DCERPC_PKT_CO_CANCEL."
1843 " Abandoning rpc call.\n"));
1844 /* As we never do asynchronous RPC serving, we can
1845 * never cancel a call (as far as I know).
1846 * If we ever did we'd have to send a cancel_ack reply.
1847 * For now, just free all client data and continue
1848 * processing. */
1849 reply = True;
1850 break;
1851
1852 #if 0
1853 /* Enable this if we're doing async rpc. */
1854 /* We must check the outstanding callid matches. */
1855 if (pipe_init_outgoing_data(p)) {
1856 /* Send a cancel_ack PDU reply. */
1857 /* We should probably check the auth-verifier here. */
1858 reply = setup_cancel_ack_reply(p, pkt);
1859 }
1860 break;
1861 #endif
1862
1863 case DCERPC_PKT_ORPHANED:
1864 /* We should probably check the auth-verifier here.
1865 * For now just free all client data and continue
1866 * processing. */
1867 DEBUG(3, ("process_complete_pdu: DCERPC_PKT_ORPHANED."
1868 " Abandoning rpc call.\n"));
1869 reply = True;
1870 break;
1871
1872 default:
1873 DEBUG(0, ("process_complete_pdu: "
1874 "Unknown rpc type = %u received.\n",
1875 (unsigned int)pkt->ptype));
1876 break;
1877 }
1878
1879 done:
1880 if (!reply) {
1881 DEBUG(3,("DCE/RPC fault sent!"));
1882 set_incoming_fault(p);
1883 setup_fault_pdu(p, NT_STATUS(DCERPC_NCA_S_PROTO_ERROR));
1884 }
1885 /* pkt and p->in_data.pdu.data freed by caller */
1886 }
1887
Samba GIT mirror