?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-schannel: fix api_pipe_schannel_process(), was using incorrect buffer length.
[Samba/aatanasov.git] / source3 / rpc_server / srv_pipe.c
blobce7df63972abafc6e14c2163303a756b0447b512
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Almost completely rewritten by (C) Jeremy Allison 2005.
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 /* this module apparently provides an implementation of DCE/RPC over a
21 * named pipe (IPC$ connection using SMBtrans). details of DCE/RPC
22 * documentation are available (in on-line form) from the X-Open group.
23 *
24 * this module should provide a level of abstraction between SMB
25 * and DCE/RPC, while minimising the amount of mallocs, unnecessary
26 * data copies, and network traffic.
27 *
28 */
29
30 #include "includes.h"
31 #include "../libcli/auth/libcli_auth.h"
32 #include "../librpc/gen_ndr/ndr_schannel.h"
33
34 extern struct current_user current_user;
35
36 #undef DBGC_CLASS
37 #define DBGC_CLASS DBGC_RPC_SRV
38
39 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
40 {
41 AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
42
43 if (a) {
44 auth_ntlmssp_end(&a);
45 }
46 auth->a_u.auth_ntlmssp_state = NULL;
47 }
48
49 static DATA_BLOB generic_session_key(void)
50 {
51 return data_blob("SystemLibraryDTC", 16);
52 }
53
54 /*******************************************************************
55 Generate the next PDU to be returned from the data in p->rdata.
56 Handle NTLMSSP.
57 ********************************************************************/
58
59 static bool create_next_pdu_ntlmssp(pipes_struct *p)
60 {
61 RPC_HDR_RESP hdr_resp;
62 uint32 ss_padding_len = 0;
63 uint32 data_space_available;
64 uint32 data_len_left;
65 uint32 data_len;
66 NTSTATUS status;
67 DATA_BLOB auth_blob;
68 RPC_HDR_AUTH auth_info;
69 uint8 auth_type, auth_level;
70 AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
71
72 /*
73 * If we're in the fault state, keep returning fault PDU's until
74 * the pipe gets closed. JRA.
75 */
76
77 if(p->fault_state) {
78 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
79 return True;
80 }
81
82 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
83
84 /* Change the incoming request header to a response. */
85 p->hdr.pkt_type = RPC_RESPONSE;
86
87 /* Set up rpc header flags. */
88 if (p->out_data.data_sent_length == 0) {
89 p->hdr.flags = RPC_FLG_FIRST;
90 } else {
91 p->hdr.flags = 0;
92 }
93
94 /*
95 * Work out how much we can fit in a single PDU.
96 */
97
98 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
99
100 /*
101 * Ensure there really is data left to send.
102 */
103
104 if(!data_len_left) {
105 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
106 return False;
107 }
108
109 data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
110 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
111
112 /*
113 * The amount we send is the minimum of the available
114 * space and the amount left to send.
115 */
116
117 data_len = MIN(data_len_left, data_space_available);
118
119 /*
120 * Set up the alloc hint. This should be the data left to
121 * send.
122 */
123
124 hdr_resp.alloc_hint = data_len_left;
125
126 /*
127 * Work out if this PDU will be the last.
128 */
129
130 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
131 p->hdr.flags |= RPC_FLG_LAST;
132 if (data_len_left % 8) {
133 ss_padding_len = 8 - (data_len_left % 8);
134 DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
135 ss_padding_len ));
136 }
137 }
138
139 /*
140 * Set up the header lengths.
141 */
142
143 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
144 data_len + ss_padding_len +
145 RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
146 p->hdr.auth_len = NTLMSSP_SIG_SIZE;
147
148
149 /*
150 * Init the parse struct to point at the outgoing
151 * data.
152 */
153
154 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
155
156 /* Store the header in the data stream. */
157 if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
158 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
159 prs_mem_free(&p->out_data.frag);
160 return False;
161 }
162
163 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
164 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
165 prs_mem_free(&p->out_data.frag);
166 return False;
167 }
168
169 /* Copy the data into the PDU. */
170
171 if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
172 p->out_data.data_sent_length, data_len)) {
173 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
174 prs_mem_free(&p->out_data.frag);
175 return False;
176 }
177
178 /* Copy the sign/seal padding data. */
179 if (ss_padding_len) {
180 char pad[8];
181
182 memset(pad, '\0', 8);
183 if (!prs_copy_data_in(&p->out_data.frag, pad,
184 ss_padding_len)) {
185 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
186 (unsigned int)ss_padding_len));
187 prs_mem_free(&p->out_data.frag);
188 return False;
189 }
190 }
191
192
193 /* Now write out the auth header and null blob. */
194 if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
195 auth_type = RPC_NTLMSSP_AUTH_TYPE;
196 } else {
197 auth_type = RPC_SPNEGO_AUTH_TYPE;
198 }
199 if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
200 auth_level = RPC_AUTH_LEVEL_PRIVACY;
201 } else {
202 auth_level = RPC_AUTH_LEVEL_INTEGRITY;
203 }
204
205 init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
206 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &p->out_data.frag,
207 0)) {
208 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
209 prs_mem_free(&p->out_data.frag);
210 return False;
211 }
212
213 /* Generate the sign blob. */
214
215 switch (p->auth.auth_level) {
216 case PIPE_AUTH_LEVEL_PRIVACY:
217 /* Data portion is encrypted. */
218 status = ntlmssp_seal_packet(
219 a->ntlmssp_state,
220 (uint8_t *)prs_data_p(&p->out_data.frag)
221 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
222 data_len + ss_padding_len,
223 (unsigned char *)prs_data_p(&p->out_data.frag),
224 (size_t)prs_offset(&p->out_data.frag),
225 &auth_blob);
226 if (!NT_STATUS_IS_OK(status)) {
227 data_blob_free(&auth_blob);
228 prs_mem_free(&p->out_data.frag);
229 return False;
230 }
231 break;
232 case PIPE_AUTH_LEVEL_INTEGRITY:
233 /* Data is signed. */
234 status = ntlmssp_sign_packet(
235 a->ntlmssp_state,
236 (unsigned char *)prs_data_p(&p->out_data.frag)
237 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
238 data_len + ss_padding_len,
239 (unsigned char *)prs_data_p(&p->out_data.frag),
240 (size_t)prs_offset(&p->out_data.frag),
241 &auth_blob);
242 if (!NT_STATUS_IS_OK(status)) {
243 data_blob_free(&auth_blob);
244 prs_mem_free(&p->out_data.frag);
245 return False;
246 }
247 break;
248 default:
249 prs_mem_free(&p->out_data.frag);
250 return False;
251 }
252
253 /* Append the auth blob. */
254 if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
255 NTLMSSP_SIG_SIZE)) {
256 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
257 (unsigned int)NTLMSSP_SIG_SIZE));
258 data_blob_free(&auth_blob);
259 prs_mem_free(&p->out_data.frag);
260 return False;
261 }
262
263 data_blob_free(&auth_blob);
264
265 /*
266 * Setup the counts for this PDU.
267 */
268
269 p->out_data.data_sent_length += data_len;
270 p->out_data.current_pdu_sent = 0;
271
272 return True;
273 }
274
275 /*******************************************************************
276 Generate the next PDU to be returned from the data in p->rdata.
277 Return an schannel authenticated fragment.
278 ********************************************************************/
279
280 static bool create_next_pdu_schannel(pipes_struct *p)
281 {
282 RPC_HDR_RESP hdr_resp;
283 uint32 ss_padding_len = 0;
284 uint32 data_len;
285 uint32 data_space_available;
286 uint32 data_len_left;
287 uint32 data_pos;
288
289 /*
290 * If we're in the fault state, keep returning fault PDU's until
291 * the pipe gets closed. JRA.
292 */
293
294 if(p->fault_state) {
295 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
296 return True;
297 }
298
299 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
300
301 /* Change the incoming request header to a response. */
302 p->hdr.pkt_type = RPC_RESPONSE;
303
304 /* Set up rpc header flags. */
305 if (p->out_data.data_sent_length == 0) {
306 p->hdr.flags = RPC_FLG_FIRST;
307 } else {
308 p->hdr.flags = 0;
309 }
310
311 /*
312 * Work out how much we can fit in a single PDU.
313 */
314
315 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
316
317 /*
318 * Ensure there really is data left to send.
319 */
320
321 if(!data_len_left) {
322 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
323 return False;
324 }
325
326 data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
327 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
328 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
329
330 /*
331 * The amount we send is the minimum of the available
332 * space and the amount left to send.
333 */
334
335 data_len = MIN(data_len_left, data_space_available);
336
337 /*
338 * Set up the alloc hint. This should be the data left to
339 * send.
340 */
341
342 hdr_resp.alloc_hint = data_len_left;
343
344 /*
345 * Work out if this PDU will be the last.
346 */
347
348 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
349 p->hdr.flags |= RPC_FLG_LAST;
350 if (data_len_left % 8) {
351 ss_padding_len = 8 - (data_len_left % 8);
352 DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
353 ss_padding_len ));
354 }
355 }
356
357 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
358 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
359 p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
360
361 /*
362 * Init the parse struct to point at the outgoing
363 * data.
364 */
365
366 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
367
368 /* Store the header in the data stream. */
369 if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
370 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
371 prs_mem_free(&p->out_data.frag);
372 return False;
373 }
374
375 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
376 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
377 prs_mem_free(&p->out_data.frag);
378 return False;
379 }
380
381 /* Store the current offset. */
382 data_pos = prs_offset(&p->out_data.frag);
383
384 /* Copy the data into the PDU. */
385
386 if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
387 p->out_data.data_sent_length, data_len)) {
388 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
389 prs_mem_free(&p->out_data.frag);
390 return False;
391 }
392
393 /* Copy the sign/seal padding data. */
394 if (ss_padding_len) {
395 char pad[8];
396 memset(pad, '\0', 8);
397 if (!prs_copy_data_in(&p->out_data.frag, pad,
398 ss_padding_len)) {
399 DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
400 prs_mem_free(&p->out_data.frag);
401 return False;
402 }
403 }
404
405 {
406 /*
407 * Schannel processing.
408 */
409 RPC_HDR_AUTH auth_info;
410 struct NL_AUTH_SIGNATURE verf;
411 DATA_BLOB blob;
412 enum ndr_err_code ndr_err;
413
414 /* Check it's the type of reply we were expecting to decode */
415
416 init_rpc_hdr_auth(&auth_info,
417 RPC_SCHANNEL_AUTH_TYPE,
418 p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY ?
419 RPC_AUTH_LEVEL_PRIVACY : RPC_AUTH_LEVEL_INTEGRITY,
420 ss_padding_len, 1);
421
422 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
423 &p->out_data.frag, 0)) {
424 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
425 prs_mem_free(&p->out_data.frag);
426 return False;
427 }
428
429 schannel_encode(p->auth.a_u.schannel_auth,
430 p->auth.auth_level, SENDER_IS_ACCEPTOR, &verf,
431 prs_data_p(&p->out_data.frag) + data_pos,
432 data_len + ss_padding_len);
433
434 /* Finally marshall the blob. */
435
436 ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), NULL, &verf,
437 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_SIGNATURE);
438 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
439 prs_mem_free(&p->out_data.frag);
440 return false;
441 }
442
443 if (DEBUGLEVEL >= 10) {
444 NDR_PRINT_DEBUG(NL_AUTH_SIGNATURE, &verf);
445 }
446
447 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
448 prs_mem_free(&p->out_data.frag);
449 return false;
450 }
451
452 p->auth.a_u.schannel_auth->seq_num++;
453 }
454
455 /*
456 * Setup the counts for this PDU.
457 */
458
459 p->out_data.data_sent_length += data_len;
460 p->out_data.current_pdu_sent = 0;
461
462 return True;
463 }
464
465 /*******************************************************************
466 Generate the next PDU to be returned from the data in p->rdata.
467 No authentication done.
468 ********************************************************************/
469
470 static bool create_next_pdu_noauth(pipes_struct *p)
471 {
472 RPC_HDR_RESP hdr_resp;
473 uint32 data_len;
474 uint32 data_space_available;
475 uint32 data_len_left;
476
477 /*
478 * If we're in the fault state, keep returning fault PDU's until
479 * the pipe gets closed. JRA.
480 */
481
482 if(p->fault_state) {
483 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
484 return True;
485 }
486
487 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
488
489 /* Change the incoming request header to a response. */
490 p->hdr.pkt_type = RPC_RESPONSE;
491
492 /* Set up rpc header flags. */
493 if (p->out_data.data_sent_length == 0) {
494 p->hdr.flags = RPC_FLG_FIRST;
495 } else {
496 p->hdr.flags = 0;
497 }
498
499 /*
500 * Work out how much we can fit in a single PDU.
501 */
502
503 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
504
505 /*
506 * Ensure there really is data left to send.
507 */
508
509 if(!data_len_left) {
510 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
511 return False;
512 }
513
514 data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
515 - RPC_HDR_RESP_LEN;
516
517 /*
518 * The amount we send is the minimum of the available
519 * space and the amount left to send.
520 */
521
522 data_len = MIN(data_len_left, data_space_available);
523
524 /*
525 * Set up the alloc hint. This should be the data left to
526 * send.
527 */
528
529 hdr_resp.alloc_hint = data_len_left;
530
531 /*
532 * Work out if this PDU will be the last.
533 */
534
535 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
536 p->hdr.flags |= RPC_FLG_LAST;
537 }
538
539 /*
540 * Set up the header lengths.
541 */
542
543 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
544 p->hdr.auth_len = 0;
545
546 /*
547 * Init the parse struct to point at the outgoing
548 * data.
549 */
550
551 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
552
553 /* Store the header in the data stream. */
554 if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
555 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
556 prs_mem_free(&p->out_data.frag);
557 return False;
558 }
559
560 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
561 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
562 prs_mem_free(&p->out_data.frag);
563 return False;
564 }
565
566 /* Copy the data into the PDU. */
567
568 if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
569 p->out_data.data_sent_length, data_len)) {
570 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
571 prs_mem_free(&p->out_data.frag);
572 return False;
573 }
574
575 /*
576 * Setup the counts for this PDU.
577 */
578
579 p->out_data.data_sent_length += data_len;
580 p->out_data.current_pdu_sent = 0;
581
582 return True;
583 }
584
585 /*******************************************************************
586 Generate the next PDU to be returned from the data in p->rdata.
587 ********************************************************************/
588
589 bool create_next_pdu(pipes_struct *p)
590 {
591 switch(p->auth.auth_level) {
592 case PIPE_AUTH_LEVEL_NONE:
593 case PIPE_AUTH_LEVEL_CONNECT:
594 /* This is incorrect for auth level connect. Fixme. JRA */
595 return create_next_pdu_noauth(p);
596
597 default:
598 switch(p->auth.auth_type) {
599 case PIPE_AUTH_TYPE_NTLMSSP:
600 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
601 return create_next_pdu_ntlmssp(p);
602 case PIPE_AUTH_TYPE_SCHANNEL:
603 return create_next_pdu_schannel(p);
604 default:
605 break;
606 }
607 }
608
609 DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
610 (unsigned int)p->auth.auth_level,
611 (unsigned int)p->auth.auth_type));
612 return False;
613 }
614
615 /*******************************************************************
616 Process an NTLMSSP authentication response.
617 If this function succeeds, the user has been authenticated
618 and their domain, name and calling workstation stored in
619 the pipe struct.
620 *******************************************************************/
621
622 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
623 {
624 DATA_BLOB session_key, reply;
625 NTSTATUS status;
626 AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
627 bool ret;
628
629 DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
630 get_pipe_name_from_iface(&p->syntax)));
631
632 ZERO_STRUCT(reply);
633
634 /* this has to be done as root in order to verify the password */
635 become_root();
636 status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
637 unbecome_root();
638
639 /* Don't generate a reply. */
640 data_blob_free(&reply);
641
642 if (!NT_STATUS_IS_OK(status)) {
643 return False;
644 }
645
646 /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
647 ensure the underlying NTLMSSP flags are also set. If not we should
648 refuse the bind. */
649
650 if (p->auth.auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
651 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
652 DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
653 "but client declined signing.\n",
654 get_pipe_name_from_iface(&p->syntax)));
655 return False;
656 }
657 }
658 if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
659 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
660 DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
661 "but client declined sealing.\n",
662 get_pipe_name_from_iface(&p->syntax)));
663 return False;
664 }
665 }
666
667 DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
668 "workstation: %s\n", a->ntlmssp_state->user,
669 a->ntlmssp_state->domain, a->ntlmssp_state->workstation));
670
671 if (a->server_info->ptok == NULL) {
672 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
673 return False;
674 }
675
676 TALLOC_FREE(p->server_info);
677
678 p->server_info = copy_serverinfo(p, a->server_info);
679 if (p->server_info == NULL) {
680 DEBUG(0, ("copy_serverinfo failed\n"));
681 return false;
682 }
683
684 /*
685 * We're an authenticated bind over smb, so the session key needs to
686 * be set to "SystemLibraryDTC". Weird, but this is what Windows
687 * does. See the RPC-SAMBA3SESSIONKEY.
688 */
689
690 session_key = generic_session_key();
691 if (session_key.data == NULL) {
692 return False;
693 }
694
695 ret = server_info_set_session_key(p->server_info, session_key);
696
697 data_blob_free(&session_key);
698
699 return True;
700 }
701
702 /*******************************************************************
703 The switch table for the pipe names and the functions to handle them.
704 *******************************************************************/
705
706 struct rpc_table {
707 struct {
708 const char *clnt;
709 const char *srv;
710 } pipe;
711 struct ndr_syntax_id rpc_interface;
712 const struct api_struct *cmds;
713 int n_cmds;
714 };
715
716 static struct rpc_table *rpc_lookup;
717 static int rpc_lookup_size;
718
719 /*******************************************************************
720 This is the "stage3" NTLMSSP response after a bind request and reply.
721 *******************************************************************/
722
723 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
724 {
725 RPC_HDR_AUTH auth_info;
726 uint32 pad = 0;
727 DATA_BLOB blob;
728
729 ZERO_STRUCT(blob);
730
731 DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
732
733 if (p->hdr.auth_len == 0) {
734 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
735 goto err;
736 }
737
738 /* 4 bytes padding. */
739 if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
740 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
741 goto err;
742 }
743
744 /*
745 * Decode the authentication verifier response.
746 */
747
748 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
749 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
750 goto err;
751 }
752
753 if (auth_info.auth_type != RPC_NTLMSSP_AUTH_TYPE) {
754 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
755 (unsigned int)auth_info.auth_type ));
756 return False;
757 }
758
759 blob = data_blob(NULL,p->hdr.auth_len);
760
761 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
762 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
763 (unsigned int)p->hdr.auth_len ));
764 goto err;
765 }
766
767 /*
768 * The following call actually checks the challenge/response data.
769 * for correctness against the given DOMAIN\user name.
770 */
771
772 if (!pipe_ntlmssp_verify_final(p, &blob)) {
773 goto err;
774 }
775
776 data_blob_free(&blob);
777
778 p->pipe_bound = True;
779
780 return True;
781
782 err:
783
784 data_blob_free(&blob);
785 free_pipe_ntlmssp_auth_data(&p->auth);
786 p->auth.a_u.auth_ntlmssp_state = NULL;
787
788 return False;
789 }
790
791 /*******************************************************************
792 Marshall a bind_nak pdu.
793 *******************************************************************/
794
795 static bool setup_bind_nak(pipes_struct *p)
796 {
797 RPC_HDR nak_hdr;
798 uint16 zero = 0;
799
800 /* Free any memory in the current return data buffer. */
801 prs_mem_free(&p->out_data.rdata);
802
803 /*
804 * Marshall directly into the outgoing PDU space. We
805 * must do this as we need to set to the bind response
806 * header and are never sending more than one PDU here.
807 */
808
809 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
810
811 /*
812 * Initialize a bind_nak header.
813 */
814
815 init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
816 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
817
818 /*
819 * Marshall the header into the outgoing PDU.
820 */
821
822 if(!smb_io_rpc_hdr("", &nak_hdr, &p->out_data.frag, 0)) {
823 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
824 prs_mem_free(&p->out_data.frag);
825 return False;
826 }
827
828 /*
829 * Now add the reject reason.
830 */
831
832 if(!prs_uint16("reject code", &p->out_data.frag, 0, &zero)) {
833 prs_mem_free(&p->out_data.frag);
834 return False;
835 }
836
837 p->out_data.data_sent_length = 0;
838 p->out_data.current_pdu_sent = 0;
839
840 if (p->auth.auth_data_free_func) {
841 (*p->auth.auth_data_free_func)(&p->auth);
842 }
843 p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
844 p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
845 p->pipe_bound = False;
846
847 return True;
848 }
849
850 /*******************************************************************
851 Marshall a fault pdu.
852 *******************************************************************/
853
854 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
855 {
856 RPC_HDR fault_hdr;
857 RPC_HDR_RESP hdr_resp;
858 RPC_HDR_FAULT fault_resp;
859
860 /* Free any memory in the current return data buffer. */
861 prs_mem_free(&p->out_data.rdata);
862
863 /*
864 * Marshall directly into the outgoing PDU space. We
865 * must do this as we need to set to the bind response
866 * header and are never sending more than one PDU here.
867 */
868
869 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
870
871 /*
872 * Initialize a fault header.
873 */
874
875 init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
876 p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
877
878 /*
879 * Initialize the HDR_RESP and FAULT parts of the PDU.
880 */
881
882 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
883
884 fault_resp.status = status;
885 fault_resp.reserved = 0;
886
887 /*
888 * Marshall the header into the outgoing PDU.
889 */
890
891 if(!smb_io_rpc_hdr("", &fault_hdr, &p->out_data.frag, 0)) {
892 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
893 prs_mem_free(&p->out_data.frag);
894 return False;
895 }
896
897 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
898 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
899 prs_mem_free(&p->out_data.frag);
900 return False;
901 }
902
903 if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &p->out_data.frag, 0)) {
904 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
905 prs_mem_free(&p->out_data.frag);
906 return False;
907 }
908
909 p->out_data.data_sent_length = 0;
910 p->out_data.current_pdu_sent = 0;
911
912 return True;
913 }
914
915 #if 0
916 /*******************************************************************
917 Marshall a cancel_ack pdu.
918 We should probably check the auth-verifier here.
919 *******************************************************************/
920
921 bool setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
922 {
923 prs_struct outgoing_pdu;
924 RPC_HDR ack_reply_hdr;
925
926 /* Free any memory in the current return data buffer. */
927 prs_mem_free(&p->out_data.rdata);
928
929 /*
930 * Marshall directly into the outgoing PDU space. We
931 * must do this as we need to set to the bind response
932 * header and are never sending more than one PDU here.
933 */
934
935 prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
936 prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
937
938 /*
939 * Initialize a cancel_ack header.
940 */
941
942 init_rpc_hdr(&ack_reply_hdr, RPC_CANCEL_ACK, RPC_FLG_FIRST | RPC_FLG_LAST,
943 p->hdr.call_id, RPC_HEADER_LEN, 0);
944
945 /*
946 * Marshall the header into the outgoing PDU.
947 */
948
949 if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
950 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
951 prs_mem_free(&outgoing_pdu);
952 return False;
953 }
954
955 p->out_data.data_sent_length = 0;
956 p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
957 p->out_data.current_pdu_sent = 0;
958
959 prs_mem_free(&outgoing_pdu);
960 return True;
961 }
962 #endif
963
964 /*******************************************************************
965 Ensure a bind request has the correct abstract & transfer interface.
966 Used to reject unknown binds from Win2k.
967 *******************************************************************/
968
969 static bool check_bind_req(struct pipes_struct *p,
970 struct ndr_syntax_id* abstract,
971 struct ndr_syntax_id* transfer,
972 uint32 context_id)
973 {
974 int i=0;
975 struct pipe_rpc_fns *context_fns;
976
977 DEBUG(3,("check_bind_req for %s\n",
978 get_pipe_name_from_iface(&p->syntax)));
979
980 /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
981
982 for (i=0; i<rpc_lookup_size; i++) {
983 DEBUGADD(10, ("checking %s\n", rpc_lookup[i].pipe.clnt));
984 if (ndr_syntax_id_equal(
985 abstract, &rpc_lookup[i].rpc_interface)
986 && ndr_syntax_id_equal(
987 transfer, &ndr_transfer_syntax)) {
988 break;
989 }
990 }
991
992 if (i == rpc_lookup_size) {
993 return false;
994 }
995
996 context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
997 if (context_fns == NULL) {
998 DEBUG(0,("check_bind_req: malloc() failed!\n"));
999 return False;
1000 }
1001
1002 context_fns->cmds = rpc_lookup[i].cmds;
1003 context_fns->n_cmds = rpc_lookup[i].n_cmds;
1004 context_fns->context_id = context_id;
1005
1006 /* add to the list of open contexts */
1007
1008 DLIST_ADD( p->contexts, context_fns );
1009
1010 return True;
1011 }
1012
1013 /*******************************************************************
1014 Register commands to an RPC pipe
1015 *******************************************************************/
1016
1017 NTSTATUS rpc_srv_register(int version, const char *clnt, const char *srv,
1018 const struct ndr_interface_table *iface,
1019 const struct api_struct *cmds, int size)
1020 {
1021 struct rpc_table *rpc_entry;
1022
1023 if (!clnt || !srv || !cmds) {
1024 return NT_STATUS_INVALID_PARAMETER;
1025 }
1026
1027 if (version != SMB_RPC_INTERFACE_VERSION) {
1028 DEBUG(0,("Can't register rpc commands!\n"
1029 "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1030 ", while this version of samba uses version %d!\n",
1031 version,SMB_RPC_INTERFACE_VERSION));
1032 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1033 }
1034
1035 /* TODO:
1036 *
1037 * we still need to make sure that don't register the same commands twice!!!
1038 *
1039 * --metze
1040 */
1041
1042 /* We use a temporary variable because this call can fail and
1043 rpc_lookup will still be valid afterwards. It could then succeed if
1044 called again later */
1045 rpc_lookup_size++;
1046 rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1047 if (NULL == rpc_entry) {
1048 rpc_lookup_size--;
1049 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1050 return NT_STATUS_NO_MEMORY;
1051 } else {
1052 rpc_lookup = rpc_entry;
1053 }
1054
1055 rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1056 ZERO_STRUCTP(rpc_entry);
1057 rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1058 rpc_entry->pipe.srv = SMB_STRDUP(srv);
1059 rpc_entry->rpc_interface = iface->syntax_id;
1060 rpc_entry->cmds = cmds;
1061 rpc_entry->n_cmds = size;
1062
1063 return NT_STATUS_OK;
1064 }
1065
1066 /**
1067 * Is a named pipe known?
1068 * @param[in] cli_filename The pipe name requested by the client
1069 * @result Do we want to serve this?
1070 */
1071 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1072 {
1073 const char *pipename = cli_filename;
1074 int i;
1075
1076 if (strnequal(pipename, "\\PIPE\\", 6)) {
1077 pipename += 5;
1078 }
1079
1080 if (*pipename == '\\') {
1081 pipename += 1;
1082 }
1083
1084 if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1085 DEBUG(10, ("refusing spoolss access\n"));
1086 return false;
1087 }
1088
1089 for (i=0; i<rpc_lookup_size; i++) {
1090 if (strequal(pipename, rpc_lookup[i].pipe.clnt)) {
1091 *syntax = rpc_lookup[i].rpc_interface;
1092 return true;
1093 }
1094 }
1095
1096 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1097 return false;
1098 }
1099
1100 /*******************************************************************
1101 Handle a SPNEGO krb5 bind auth.
1102 *******************************************************************/
1103
1104 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1105 DATA_BLOB *psecblob, prs_struct *pout_auth)
1106 {
1107 return False;
1108 }
1109
1110 /*******************************************************************
1111 Handle the first part of a SPNEGO bind auth.
1112 *******************************************************************/
1113
1114 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1115 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1116 {
1117 DATA_BLOB blob;
1118 DATA_BLOB secblob;
1119 DATA_BLOB response;
1120 DATA_BLOB chal;
1121 char *OIDs[ASN1_MAX_OIDS];
1122 int i;
1123 NTSTATUS status;
1124 bool got_kerberos_mechanism = false;
1125 AUTH_NTLMSSP_STATE *a = NULL;
1126 RPC_HDR_AUTH auth_info;
1127
1128 ZERO_STRUCT(secblob);
1129 ZERO_STRUCT(chal);
1130 ZERO_STRUCT(response);
1131
1132 /* Grab the SPNEGO blob. */
1133 blob = data_blob(NULL,p->hdr.auth_len);
1134
1135 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1136 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1137 (unsigned int)p->hdr.auth_len ));
1138 goto err;
1139 }
1140
1141 if (blob.data[0] != ASN1_APPLICATION(0)) {
1142 goto err;
1143 }
1144
1145 /* parse out the OIDs and the first sec blob */
1146 if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1147 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1148 goto err;
1149 }
1150
1151 if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1152 got_kerberos_mechanism = true;
1153 }
1154
1155 for (i=0;OIDs[i];i++) {
1156 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1157 TALLOC_FREE(OIDs[i]);
1158 }
1159 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1160
1161 if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1162 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1163 data_blob_free(&secblob);
1164 data_blob_free(&blob);
1165 return ret;
1166 }
1167
1168 if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1169 /* Free any previous auth type. */
1170 free_pipe_ntlmssp_auth_data(&p->auth);
1171 }
1172
1173 if (!got_kerberos_mechanism) {
1174 /* Initialize the NTLM engine. */
1175 status = auth_ntlmssp_start(&a);
1176 if (!NT_STATUS_IS_OK(status)) {
1177 goto err;
1178 }
1179
1180 /*
1181 * Pass the first security blob of data to it.
1182 * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1183 * which means we need another packet to complete the bind.
1184 */
1185
1186 status = auth_ntlmssp_update(a, secblob, &chal);
1187
1188 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1189 DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1190 goto err;
1191 }
1192
1193 /* Generate the response blob we need for step 2 of the bind. */
1194 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1195 } else {
1196 /*
1197 * SPNEGO negotiate down to NTLMSSP. The subsequent
1198 * code to process follow-up packets is not complete
1199 * yet. JRA.
1200 */
1201 response = spnego_gen_auth_response(NULL,
1202 NT_STATUS_MORE_PROCESSING_REQUIRED,
1203 OID_NTLMSSP);
1204 }
1205
1206 /* Copy the blob into the pout_auth parse struct */
1207 init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1208 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1209 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1210 goto err;
1211 }
1212
1213 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1214 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1215 goto err;
1216 }
1217
1218 p->auth.a_u.auth_ntlmssp_state = a;
1219 p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1220 p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1221
1222 data_blob_free(&blob);
1223 data_blob_free(&secblob);
1224 data_blob_free(&chal);
1225 data_blob_free(&response);
1226
1227 /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1228 return True;
1229
1230 err:
1231
1232 data_blob_free(&blob);
1233 data_blob_free(&secblob);
1234 data_blob_free(&chal);
1235 data_blob_free(&response);
1236
1237 p->auth.a_u.auth_ntlmssp_state = NULL;
1238
1239 return False;
1240 }
1241
1242 /*******************************************************************
1243 Handle the second part of a SPNEGO bind auth.
1244 *******************************************************************/
1245
1246 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1247 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1248 {
1249 RPC_HDR_AUTH auth_info;
1250 DATA_BLOB spnego_blob;
1251 DATA_BLOB auth_blob;
1252 DATA_BLOB auth_reply;
1253 DATA_BLOB response;
1254 AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1255
1256 ZERO_STRUCT(spnego_blob);
1257 ZERO_STRUCT(auth_blob);
1258 ZERO_STRUCT(auth_reply);
1259 ZERO_STRUCT(response);
1260
1261 /*
1262 * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1263 * fail here as 'a' == NULL.
1264 */
1265 if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1266 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1267 goto err;
1268 }
1269
1270 /* Grab the SPNEGO blob. */
1271 spnego_blob = data_blob(NULL,p->hdr.auth_len);
1272
1273 if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1274 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1275 (unsigned int)p->hdr.auth_len ));
1276 goto err;
1277 }
1278
1279 if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1280 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1281 goto err;
1282 }
1283
1284 if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1285 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1286 goto err;
1287 }
1288
1289 /*
1290 * The following call actually checks the challenge/response data.
1291 * for correctness against the given DOMAIN\user name.
1292 */
1293
1294 if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1295 goto err;
1296 }
1297
1298 data_blob_free(&spnego_blob);
1299 data_blob_free(&auth_blob);
1300
1301 /* Generate the spnego "accept completed" blob - no incoming data. */
1302 response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1303
1304 /* Copy the blob into the pout_auth parse struct */
1305 init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1306 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1307 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1308 goto err;
1309 }
1310
1311 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1312 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1313 goto err;
1314 }
1315
1316 data_blob_free(&auth_reply);
1317 data_blob_free(&response);
1318
1319 p->pipe_bound = True;
1320
1321 return True;
1322
1323 err:
1324
1325 data_blob_free(&spnego_blob);
1326 data_blob_free(&auth_blob);
1327 data_blob_free(&auth_reply);
1328 data_blob_free(&response);
1329
1330 free_pipe_ntlmssp_auth_data(&p->auth);
1331 p->auth.a_u.auth_ntlmssp_state = NULL;
1332
1333 return False;
1334 }
1335
1336 /*******************************************************************
1337 Handle an schannel bind auth.
1338 *******************************************************************/
1339
1340 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1341 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1342 {
1343 RPC_HDR_AUTH auth_info;
1344 struct NL_AUTH_MESSAGE neg;
1345 struct NL_AUTH_MESSAGE reply;
1346 bool ret;
1347 NTSTATUS status;
1348 struct netlogon_creds_CredentialState *creds;
1349 DATA_BLOB session_key;
1350 enum ndr_err_code ndr_err;
1351 DATA_BLOB blob;
1352
1353 blob = data_blob_const(prs_data_p(rpc_in_p) + prs_offset(rpc_in_p),
1354 prs_data_size(rpc_in_p));
1355
1356 ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), NULL, &neg,
1357 (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1358 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1359 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1360 return false;
1361 }
1362
1363 if (DEBUGLEVEL >= 10) {
1364 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1365 }
1366
1367 if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1368 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1369 return false;
1370 }
1371
1372 /*
1373 * The neg.oem_netbios_computer.a key here must match the remote computer name
1374 * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1375 * operations that use credentials.
1376 */
1377
1378 become_root();
1379 status = schannel_fetch_session_key(p->mem_ctx,
1380 neg.oem_netbios_computer.a,
1381 &creds);
1382 unbecome_root();
1383
1384 if (!NT_STATUS_IS_OK(status)) {
1385 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1386 return False;
1387 }
1388
1389 p->auth.a_u.schannel_auth = talloc(p, struct schannel_auth_struct);
1390 if (!p->auth.a_u.schannel_auth) {
1391 TALLOC_FREE(creds);
1392 return False;
1393 }
1394
1395 memset(p->auth.a_u.schannel_auth->sess_key, 0, sizeof(p->auth.a_u.schannel_auth->sess_key));
1396 memcpy(p->auth.a_u.schannel_auth->sess_key, creds->session_key,
1397 sizeof(creds->session_key));
1398
1399 TALLOC_FREE(creds);
1400
1401 p->auth.a_u.schannel_auth->seq_num = 0;
1402
1403 /*
1404 * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1405 * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1406 * struct of the person who opened the pipe. I need to test this further. JRA.
1407 *
1408 * VL. As we are mapping this to guest set the generic key
1409 * "SystemLibraryDTC" key here. It's a bit difficult to test against
1410 * W2k3, as it does not allow schannel binds against SAMR and LSA
1411 * anymore.
1412 */
1413
1414 session_key = generic_session_key();
1415 if (session_key.data == NULL) {
1416 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1417 " key\n"));
1418 return false;
1419 }
1420
1421 ret = server_info_set_session_key(p->server_info, session_key);
1422
1423 data_blob_free(&session_key);
1424
1425 if (!ret) {
1426 DEBUG(0, ("server_info_set_session_key failed\n"));
1427 return false;
1428 }
1429
1430 init_rpc_hdr_auth(&auth_info, RPC_SCHANNEL_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1431 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1432 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1433 return False;
1434 }
1435
1436 /*** SCHANNEL verifier ***/
1437
1438 reply.MessageType = NL_NEGOTIATE_RESPONSE;
1439 reply.Flags = 0;
1440 reply.Buffer.dummy = 5; /* ??? actually I don't think
1441 * this has any meaning
1442 * here - gd */
1443
1444 ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), NULL, &reply,
1445 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1446 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1447 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1448 return false;
1449 }
1450
1451 if (DEBUGLEVEL >= 10) {
1452 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1453 }
1454
1455 if (!prs_copy_data_in(pout_auth, (const char *)blob.data, blob.length)) {
1456 return false;
1457 }
1458
1459 DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1460 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1461
1462 /* We're finished with this bind - no more packets. */
1463 p->auth.auth_data_free_func = NULL;
1464 p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1465
1466 p->pipe_bound = True;
1467
1468 return True;
1469 }
1470
1471 /*******************************************************************
1472 Handle an NTLMSSP bind auth.
1473 *******************************************************************/
1474
1475 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1476 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1477 {
1478 RPC_HDR_AUTH auth_info;
1479 DATA_BLOB blob;
1480 DATA_BLOB response;
1481 NTSTATUS status;
1482 AUTH_NTLMSSP_STATE *a = NULL;
1483
1484 ZERO_STRUCT(blob);
1485 ZERO_STRUCT(response);
1486
1487 /* Grab the NTLMSSP blob. */
1488 blob = data_blob(NULL,p->hdr.auth_len);
1489
1490 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1491 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1492 (unsigned int)p->hdr.auth_len ));
1493 goto err;
1494 }
1495
1496 if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1497 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1498 goto err;
1499 }
1500
1501 /* We have an NTLMSSP blob. */
1502 status = auth_ntlmssp_start(&a);
1503 if (!NT_STATUS_IS_OK(status)) {
1504 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1505 nt_errstr(status) ));
1506 goto err;
1507 }
1508
1509 status = auth_ntlmssp_update(a, blob, &response);
1510 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1511 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1512 nt_errstr(status) ));
1513 goto err;
1514 }
1515
1516 data_blob_free(&blob);
1517
1518 /* Copy the blob into the pout_auth parse struct */
1519 init_rpc_hdr_auth(&auth_info, RPC_NTLMSSP_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1520 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1521 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1522 goto err;
1523 }
1524
1525 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1526 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1527 goto err;
1528 }
1529
1530 p->auth.a_u.auth_ntlmssp_state = a;
1531 p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1532 p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1533
1534 data_blob_free(&blob);
1535 data_blob_free(&response);
1536
1537 DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1538
1539 /* We can't set pipe_bound True yet - we need an RPC_AUTH3 response packet... */
1540 return True;
1541
1542 err:
1543
1544 data_blob_free(&blob);
1545 data_blob_free(&response);
1546
1547 free_pipe_ntlmssp_auth_data(&p->auth);
1548 p->auth.a_u.auth_ntlmssp_state = NULL;
1549 return False;
1550 }
1551
1552 /*******************************************************************
1553 Respond to a pipe bind request.
1554 *******************************************************************/
1555
1556 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1557 {
1558 RPC_HDR_BA hdr_ba;
1559 RPC_HDR_RB hdr_rb;
1560 RPC_HDR_AUTH auth_info;
1561 uint16 assoc_gid;
1562 fstring ack_pipe_name;
1563 prs_struct out_hdr_ba;
1564 prs_struct out_auth;
1565 int i = 0;
1566 int auth_len = 0;
1567 unsigned int auth_type = RPC_ANONYMOUS_AUTH_TYPE;
1568
1569 /* No rebinds on a bound pipe - use alter context. */
1570 if (p->pipe_bound) {
1571 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1572 "pipe %s.\n", get_pipe_name_from_iface(&p->syntax)));
1573 return setup_bind_nak(p);
1574 }
1575
1576 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1577
1578 /*
1579 * Marshall directly into the outgoing PDU space. We
1580 * must do this as we need to set to the bind response
1581 * header and are never sending more than one PDU here.
1582 */
1583
1584 /*
1585 * Setup the memory to marshall the ba header, and the
1586 * auth footers.
1587 */
1588
1589 if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1590 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1591 prs_mem_free(&p->out_data.frag);
1592 return False;
1593 }
1594
1595 if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1596 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1597 prs_mem_free(&p->out_data.frag);
1598 prs_mem_free(&out_hdr_ba);
1599 return False;
1600 }
1601
1602 DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1603
1604 ZERO_STRUCT(hdr_rb);
1605
1606 /* decode the bind request */
1607
1608 if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0)) {
1609 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB "
1610 "struct.\n"));
1611 goto err_exit;
1612 }
1613
1614 if (hdr_rb.num_contexts == 0) {
1615 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1616 goto err_exit;
1617 }
1618
1619 /*
1620 * Try and find the correct pipe name to ensure
1621 * that this is a pipe name we support.
1622 */
1623
1624 for (i = 0; i < rpc_lookup_size; i++) {
1625 if (ndr_syntax_id_equal(&rpc_lookup[i].rpc_interface,
1626 &hdr_rb.rpc_context[0].abstract)) {
1627 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1628 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1629 break;
1630 }
1631 }
1632
1633 if (i == rpc_lookup_size) {
1634 NTSTATUS status;
1635
1636 status = smb_probe_module(
1637 "rpc", get_pipe_name_from_iface(
1638 &hdr_rb.rpc_context[0].abstract));
1639
1640 if (NT_STATUS_IS_ERR(status)) {
1641 DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1642 get_pipe_name_from_iface(&hdr_rb.rpc_context[0].abstract)));
1643 prs_mem_free(&p->out_data.frag);
1644 prs_mem_free(&out_hdr_ba);
1645 prs_mem_free(&out_auth);
1646
1647 return setup_bind_nak(p);
1648 }
1649
1650 for (i = 0; i < rpc_lookup_size; i++) {
1651 if (strequal(rpc_lookup[i].pipe.clnt,
1652 get_pipe_name_from_iface(&p->syntax))) {
1653 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1654 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1655 break;
1656 }
1657 }
1658
1659 if (i == rpc_lookup_size) {
1660 DEBUG(0, ("module %s doesn't provide functions for "
1661 "pipe %s!\n",
1662 get_pipe_name_from_iface(&p->syntax),
1663 get_pipe_name_from_iface(&p->syntax)));
1664 goto err_exit;
1665 }
1666 }
1667
1668 /* name has to be \PIPE\xxxxx */
1669 fstrcpy(ack_pipe_name, "\\PIPE\\");
1670 fstrcat(ack_pipe_name, rpc_lookup[i].pipe.srv);
1671
1672 DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1673
1674 /*
1675 * Check if this is an authenticated bind request.
1676 */
1677
1678 if (p->hdr.auth_len) {
1679 /*
1680 * Decode the authentication verifier.
1681 */
1682
1683 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1684 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1685 goto err_exit;
1686 }
1687
1688 auth_type = auth_info.auth_type;
1689
1690 /* Work out if we have to sign or seal etc. */
1691 switch (auth_info.auth_level) {
1692 case RPC_AUTH_LEVEL_INTEGRITY:
1693 p->auth.auth_level = PIPE_AUTH_LEVEL_INTEGRITY;
1694 break;
1695 case RPC_AUTH_LEVEL_PRIVACY:
1696 p->auth.auth_level = PIPE_AUTH_LEVEL_PRIVACY;
1697 break;
1698 default:
1699 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1700 (unsigned int)auth_info.auth_level ));
1701 goto err_exit;
1702 }
1703 } else {
1704 ZERO_STRUCT(auth_info);
1705 }
1706
1707 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1708
1709 switch(auth_type) {
1710 case RPC_NTLMSSP_AUTH_TYPE:
1711 if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1712 goto err_exit;
1713 }
1714 assoc_gid = 0x7a77;
1715 break;
1716
1717 case RPC_SCHANNEL_AUTH_TYPE:
1718 if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1719 goto err_exit;
1720 }
1721 break;
1722
1723 case RPC_SPNEGO_AUTH_TYPE:
1724 if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1725 goto err_exit;
1726 }
1727 break;
1728
1729 case RPC_ANONYMOUS_AUTH_TYPE:
1730 /* Unauthenticated bind request. */
1731 /* We're finished - no more packets. */
1732 p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1733 /* We must set the pipe auth_level here also. */
1734 p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
1735 p->pipe_bound = True;
1736 /* The session key was initialized from the SMB
1737 * session in make_internal_rpc_pipe_p */
1738 break;
1739
1740 default:
1741 DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1742 goto err_exit;
1743 }
1744
1745 /*
1746 * Create the bind response struct.
1747 */
1748
1749 /* If the requested abstract synt uuid doesn't match our client pipe,
1750 reject the bind_ack & set the transfer interface synt to all 0's,
1751 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1752 unknown to NT4)
1753 Needed when adding entries to a DACL from NT5 - SK */
1754
1755 if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1756 hdr_rb.rpc_context[0].context_id )) {
1757 init_rpc_hdr_ba(&hdr_ba,
1758 RPC_MAX_PDU_FRAG_LEN,
1759 RPC_MAX_PDU_FRAG_LEN,
1760 assoc_gid,
1761 ack_pipe_name,
1762 0x1, 0x0, 0x0,
1763 &hdr_rb.rpc_context[0].transfer[0]);
1764 } else {
1765 /* Rejection reason: abstract syntax not supported */
1766 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1767 RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1768 ack_pipe_name, 0x1, 0x2, 0x1,
1769 &null_ndr_syntax_id);
1770 p->pipe_bound = False;
1771 }
1772
1773 /*
1774 * and marshall it.
1775 */
1776
1777 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1778 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1779 goto err_exit;
1780 }
1781
1782 /*
1783 * Create the header, now we know the length.
1784 */
1785
1786 if (prs_offset(&out_auth)) {
1787 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1788 }
1789
1790 init_rpc_hdr(&p->hdr, RPC_BINDACK, RPC_FLG_FIRST | RPC_FLG_LAST,
1791 p->hdr.call_id,
1792 RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1793 auth_len);
1794
1795 /*
1796 * Marshall the header into the outgoing PDU.
1797 */
1798
1799 if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1800 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1801 goto err_exit;
1802 }
1803
1804 /*
1805 * Now add the RPC_HDR_BA and any auth needed.
1806 */
1807
1808 if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1809 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1810 goto err_exit;
1811 }
1812
1813 if (auth_len && !prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1814 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1815 goto err_exit;
1816 }
1817
1818 /*
1819 * Setup the lengths for the initial reply.
1820 */
1821
1822 p->out_data.data_sent_length = 0;
1823 p->out_data.current_pdu_sent = 0;
1824
1825 prs_mem_free(&out_hdr_ba);
1826 prs_mem_free(&out_auth);
1827
1828 return True;
1829
1830 err_exit:
1831
1832 prs_mem_free(&p->out_data.frag);
1833 prs_mem_free(&out_hdr_ba);
1834 prs_mem_free(&out_auth);
1835 return setup_bind_nak(p);
1836 }
1837
1838 /****************************************************************************
1839 Deal with an alter context call. Can be third part of 3 leg auth request for
1840 SPNEGO calls.
1841 ****************************************************************************/
1842
1843 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1844 {
1845 RPC_HDR_BA hdr_ba;
1846 RPC_HDR_RB hdr_rb;
1847 RPC_HDR_AUTH auth_info;
1848 uint16 assoc_gid;
1849 fstring ack_pipe_name;
1850 prs_struct out_hdr_ba;
1851 prs_struct out_auth;
1852 int auth_len = 0;
1853
1854 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1855
1856 /*
1857 * Marshall directly into the outgoing PDU space. We
1858 * must do this as we need to set to the bind response
1859 * header and are never sending more than one PDU here.
1860 */
1861
1862 /*
1863 * Setup the memory to marshall the ba header, and the
1864 * auth footers.
1865 */
1866
1867 if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1868 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1869 prs_mem_free(&p->out_data.frag);
1870 return False;
1871 }
1872
1873 if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1874 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1875 prs_mem_free(&p->out_data.frag);
1876 prs_mem_free(&out_hdr_ba);
1877 return False;
1878 }
1879
1880 ZERO_STRUCT(hdr_rb);
1881
1882 DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1883
1884 /* decode the alter context request */
1885 if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0)) {
1886 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1887 goto err_exit;
1888 }
1889
1890 /* secondary address CAN be NULL
1891 * as the specs say it's ignored.
1892 * It MUST be NULL to have the spoolss working.
1893 */
1894 fstrcpy(ack_pipe_name,"");
1895
1896 DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1897
1898 /*
1899 * Check if this is an authenticated alter context request.
1900 */
1901
1902 if (p->hdr.auth_len != 0) {
1903 /*
1904 * Decode the authentication verifier.
1905 */
1906
1907 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1908 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1909 goto err_exit;
1910 }
1911
1912 /*
1913 * Currently only the SPNEGO auth type uses the alter ctx
1914 * response in place of the NTLMSSP auth3 type.
1915 */
1916
1917 if (auth_info.auth_type == RPC_SPNEGO_AUTH_TYPE) {
1918 /* We can only finish if the pipe is unbound. */
1919 if (!p->pipe_bound) {
1920 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1921 goto err_exit;
1922 }
1923 } else {
1924 goto err_exit;
1925 }
1926 }
1927 } else {
1928 ZERO_STRUCT(auth_info);
1929 }
1930
1931 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1932
1933 /*
1934 * Create the bind response struct.
1935 */
1936
1937 /* If the requested abstract synt uuid doesn't match our client pipe,
1938 reject the bind_ack & set the transfer interface synt to all 0's,
1939 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1940 unknown to NT4)
1941 Needed when adding entries to a DACL from NT5 - SK */
1942
1943 if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1944 hdr_rb.rpc_context[0].context_id )) {
1945 init_rpc_hdr_ba(&hdr_ba,
1946 RPC_MAX_PDU_FRAG_LEN,
1947 RPC_MAX_PDU_FRAG_LEN,
1948 assoc_gid,
1949 ack_pipe_name,
1950 0x1, 0x0, 0x0,
1951 &hdr_rb.rpc_context[0].transfer[0]);
1952 } else {
1953 /* Rejection reason: abstract syntax not supported */
1954 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1955 RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1956 ack_pipe_name, 0x1, 0x2, 0x1,
1957 &null_ndr_syntax_id);
1958 p->pipe_bound = False;
1959 }
1960
1961 /*
1962 * and marshall it.
1963 */
1964
1965 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1966 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1967 goto err_exit;
1968 }
1969
1970 /*
1971 * Create the header, now we know the length.
1972 */
1973
1974 if (prs_offset(&out_auth)) {
1975 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1976 }
1977
1978 init_rpc_hdr(&p->hdr, RPC_ALTCONTRESP, RPC_FLG_FIRST | RPC_FLG_LAST,
1979 p->hdr.call_id,
1980 RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1981 auth_len);
1982
1983 /*
1984 * Marshall the header into the outgoing PDU.
1985 */
1986
1987 if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1988 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
1989 goto err_exit;
1990 }
1991
1992 /*
1993 * Now add the RPC_HDR_BA and any auth needed.
1994 */
1995
1996 if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1997 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
1998 goto err_exit;
1999 }
2000
2001 if (auth_len && !prs_append_prs_data(&p->out_data.frag, &out_auth)) {
2002 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
2003 goto err_exit;
2004 }
2005
2006 /*
2007 * Setup the lengths for the initial reply.
2008 */
2009
2010 p->out_data.data_sent_length = 0;
2011 p->out_data.current_pdu_sent = 0;
2012
2013 prs_mem_free(&out_hdr_ba);
2014 prs_mem_free(&out_auth);
2015
2016 return True;
2017
2018 err_exit:
2019
2020 prs_mem_free(&p->out_data.frag);
2021 prs_mem_free(&out_hdr_ba);
2022 prs_mem_free(&out_auth);
2023 return setup_bind_nak(p);
2024 }
2025
2026 /****************************************************************************
2027 Deal with NTLMSSP sign & seal processing on an RPC request.
2028 ****************************************************************************/
2029
2030 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
2031 uint32 *p_ss_padding_len, NTSTATUS *pstatus)
2032 {
2033 RPC_HDR_AUTH auth_info;
2034 uint32 auth_len = p->hdr.auth_len;
2035 uint32 save_offset = prs_offset(rpc_in);
2036 AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
2037 unsigned char *data = NULL;
2038 size_t data_len;
2039 unsigned char *full_packet_data = NULL;
2040 size_t full_packet_data_len;
2041 DATA_BLOB auth_blob;
2042
2043 *pstatus = NT_STATUS_OK;
2044
2045 if (p->auth.auth_level == PIPE_AUTH_LEVEL_NONE || p->auth.auth_level == PIPE_AUTH_LEVEL_CONNECT) {
2046 return True;
2047 }
2048
2049 if (!a) {
2050 *pstatus = NT_STATUS_INVALID_PARAMETER;
2051 return False;
2052 }
2053
2054 /* Ensure there's enough data for an authenticated request. */
2055 if ((auth_len > RPC_MAX_SIGN_SIZE) ||
2056 (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
2057 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2058 (unsigned int)auth_len ));
2059 *pstatus = NT_STATUS_INVALID_PARAMETER;
2060 return False;
2061 }
2062
2063 /*
2064 * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2065 * after the RPC header.
2066 * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2067 * functions as NTLMv2 checks the rpc headers also.
2068 */
2069
2070 data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2071 data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2072
2073 full_packet_data = p->in_data.current_in_pdu;
2074 full_packet_data_len = p->hdr.frag_len - auth_len;
2075
2076 /* Pull the auth header and the following data into a blob. */
2077 if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2078 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
2079 (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
2080 *pstatus = NT_STATUS_INVALID_PARAMETER;
2081 return False;
2082 }
2083
2084 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2085 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
2086 *pstatus = NT_STATUS_INVALID_PARAMETER;
2087 return False;
2088 }
2089
2090 auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2091 auth_blob.length = auth_len;
2092
2093 switch (p->auth.auth_level) {
2094 case PIPE_AUTH_LEVEL_PRIVACY:
2095 /* Data is encrypted. */
2096 *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
2097 data, data_len,
2098 full_packet_data,
2099 full_packet_data_len,
2100 &auth_blob);
2101 if (!NT_STATUS_IS_OK(*pstatus)) {
2102 return False;
2103 }
2104 break;
2105 case PIPE_AUTH_LEVEL_INTEGRITY:
2106 /* Data is signed. */
2107 *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
2108 data, data_len,
2109 full_packet_data,
2110 full_packet_data_len,
2111 &auth_blob);
2112 if (!NT_STATUS_IS_OK(*pstatus)) {
2113 return False;
2114 }
2115 break;
2116 default:
2117 *pstatus = NT_STATUS_INVALID_PARAMETER;
2118 return False;
2119 }
2120
2121 /*
2122 * Return the current pointer to the data offset.
2123 */
2124
2125 if(!prs_set_offset(rpc_in, save_offset)) {
2126 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2127 (unsigned int)save_offset ));
2128 *pstatus = NT_STATUS_INVALID_PARAMETER;
2129 return False;
2130 }
2131
2132 /*
2133 * Remember the padding length. We must remove it from the real data
2134 * stream once the sign/seal is done.
2135 */
2136
2137 *p_ss_padding_len = auth_info.auth_pad_len;
2138
2139 return True;
2140 }
2141
2142 /****************************************************************************
2143 Deal with schannel processing on an RPC request.
2144 ****************************************************************************/
2145
2146 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2147 {
2148 uint32 data_len;
2149 uint32 auth_len;
2150 uint32 save_offset = prs_offset(rpc_in);
2151 RPC_HDR_AUTH auth_info;
2152 struct NL_AUTH_SIGNATURE schannel_chk;
2153 enum ndr_err_code ndr_err;
2154 DATA_BLOB blob;
2155
2156 auth_len = p->hdr.auth_len;
2157
2158 if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN ||
2159 auth_len > RPC_HEADER_LEN +
2160 RPC_HDR_REQ_LEN +
2161 RPC_HDR_AUTH_LEN +
2162 auth_len) {
2163 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2164 return False;
2165 }
2166
2167 /*
2168 * The following is that length of the data we must verify or unseal.
2169 * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2170 * preceeding the auth_data.
2171 */
2172
2173 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2174 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2175 (unsigned int)p->hdr.frag_len,
2176 (unsigned int)auth_len ));
2177 return False;
2178 }
2179
2180 data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2181 RPC_HDR_AUTH_LEN - auth_len;
2182
2183 DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2184
2185 if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2186 DEBUG(0,("cannot move offset to %u.\n",
2187 (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2188 return False;
2189 }
2190
2191 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2192 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2193 return False;
2194 }
2195
2196 if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
2197 DEBUG(0,("Invalid auth info %d on schannel\n",
2198 auth_info.auth_type));
2199 return False;
2200 }
2201
2202 blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), auth_len);
2203
2204 ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), NULL, &schannel_chk,
2205 (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_SIGNATURE);
2206 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2207 DEBUG(0,("failed to pull NL_AUTH_SIGNATURE\n"));
2208 dump_data(2, blob.data, blob.length);
2209 return false;
2210 }
2211
2212 if (DEBUGLEVEL >= 10) {
2213 NDR_PRINT_DEBUG(NL_AUTH_SIGNATURE, &schannel_chk);
2214 }
2215
2216 if (!schannel_decode(p->auth.a_u.schannel_auth,
2217 p->auth.auth_level,
2218 SENDER_IS_INITIATOR,
2219 &schannel_chk,
2220 prs_data_p(rpc_in)+RPC_HDR_REQ_LEN, data_len)) {
2221 DEBUG(3,("failed to decode PDU\n"));
2222 return False;
2223 }
2224
2225 /*
2226 * Return the current pointer to the data offset.
2227 */
2228
2229 if(!prs_set_offset(rpc_in, save_offset)) {
2230 DEBUG(0,("failed to set offset back to %u\n",
2231 (unsigned int)save_offset ));
2232 return False;
2233 }
2234
2235 /* The sequence number gets incremented on both send and receive. */
2236 p->auth.a_u.schannel_auth->seq_num++;
2237
2238 /*
2239 * Remember the padding length. We must remove it from the real data
2240 * stream once the sign/seal is done.
2241 */
2242
2243 *p_ss_padding_len = auth_info.auth_pad_len;
2244
2245 return True;
2246 }
2247
2248 /****************************************************************************
2249 Find the set of RPC functions associated with this context_id
2250 ****************************************************************************/
2251
2252 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2253 {
2254 PIPE_RPC_FNS *fns = NULL;
2255
2256 if ( !list ) {
2257 DEBUG(0,("find_pipe_fns_by_context: ERROR! No context list for pipe!\n"));
2258 return NULL;
2259 }
2260
2261 for (fns=list; fns; fns=fns->next ) {
2262 if ( fns->context_id == context_id )
2263 return fns;
2264 }
2265 return NULL;
2266 }
2267
2268 /****************************************************************************
2269 Memory cleanup.
2270 ****************************************************************************/
2271
2272 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2273 {
2274 PIPE_RPC_FNS *tmp = list;
2275 PIPE_RPC_FNS *tmp2;
2276
2277 while (tmp) {
2278 tmp2 = tmp->next;
2279 SAFE_FREE(tmp);
2280 tmp = tmp2;
2281 }
2282
2283 return;
2284 }
2285
2286 static bool api_rpcTNP(pipes_struct *p,
2287 const struct api_struct *api_rpc_cmds, int n_cmds);
2288
2289 /****************************************************************************
2290 Find the correct RPC function to call for this request.
2291 If the pipe is authenticated then become the correct UNIX user
2292 before doing the call.
2293 ****************************************************************************/
2294
2295 bool api_pipe_request(pipes_struct *p)
2296 {
2297 bool ret = False;
2298 bool changed_user = False;
2299 PIPE_RPC_FNS *pipe_fns;
2300
2301 if (p->pipe_bound &&
2302 ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2303 (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2304 if(!become_authenticated_pipe_user(p)) {
2305 prs_mem_free(&p->out_data.rdata);
2306 return False;
2307 }
2308 changed_user = True;
2309 }
2310
2311 DEBUG(5, ("Requested \\PIPE\\%s\n",
2312 get_pipe_name_from_iface(&p->syntax)));
2313
2314 /* get the set of RPC functions for this context */
2315
2316 pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2317
2318 if ( pipe_fns ) {
2319 TALLOC_CTX *frame = talloc_stackframe();
2320 ret = api_rpcTNP(p, pipe_fns->cmds, pipe_fns->n_cmds);
2321 TALLOC_FREE(frame);
2322 }
2323 else {
2324 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2325 p->hdr_req.context_id,
2326 get_pipe_name_from_iface(&p->syntax)));
2327 }
2328
2329 if (changed_user) {
2330 unbecome_authenticated_pipe_user();
2331 }
2332
2333 return ret;
2334 }
2335
2336 /*******************************************************************
2337 Calls the underlying RPC function for a named pipe.
2338 ********************************************************************/
2339
2340 static bool api_rpcTNP(pipes_struct *p,
2341 const struct api_struct *api_rpc_cmds, int n_cmds)
2342 {
2343 int fn_num;
2344 uint32 offset1, offset2;
2345
2346 /* interpret the command */
2347 DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2348 get_pipe_name_from_iface(&p->syntax), p->hdr_req.opnum));
2349
2350 if (DEBUGLEVEL >= 50) {
2351 fstring name;
2352 slprintf(name, sizeof(name)-1, "in_%s",
2353 get_pipe_name_from_iface(&p->syntax));
2354 prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2355 }
2356
2357 for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2358 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2359 DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2360 break;
2361 }
2362 }
2363
2364 if (fn_num == n_cmds) {
2365 /*
2366 * For an unknown RPC just return a fault PDU but
2367 * return True to allow RPC's on the pipe to continue
2368 * and not put the pipe into fault state. JRA.
2369 */
2370 DEBUG(4, ("unknown\n"));
2371 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2372 return True;
2373 }
2374
2375 offset1 = prs_offset(&p->out_data.rdata);
2376
2377 DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2378 fn_num, api_rpc_cmds[fn_num].fn));
2379 /* do the actual command */
2380 if(!api_rpc_cmds[fn_num].fn(p)) {
2381 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2382 get_pipe_name_from_iface(&p->syntax),
2383 api_rpc_cmds[fn_num].name));
2384 prs_mem_free(&p->out_data.rdata);
2385 return False;
2386 }
2387
2388 if (p->bad_handle_fault_state) {
2389 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2390 p->bad_handle_fault_state = False;
2391 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2392 return True;
2393 }
2394
2395 if (p->rng_fault_state) {
2396 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2397 p->rng_fault_state = False;
2398 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2399 return True;
2400 }
2401
2402 offset2 = prs_offset(&p->out_data.rdata);
2403 prs_set_offset(&p->out_data.rdata, offset1);
2404 if (DEBUGLEVEL >= 50) {
2405 fstring name;
2406 slprintf(name, sizeof(name)-1, "out_%s",
2407 get_pipe_name_from_iface(&p->syntax));
2408 prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2409 }
2410 prs_set_offset(&p->out_data.rdata, offset2);
2411
2412 DEBUG(5,("api_rpcTNP: called %s successfully\n",
2413 get_pipe_name_from_iface(&p->syntax)));
2414
2415 /* Check for buffer underflow in rpc parsing */
2416
2417 if ((DEBUGLEVEL >= 10) &&
2418 (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2419 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2420 char *data = (char *)SMB_MALLOC(data_len);
2421
2422 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2423 if (data) {
2424 prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2425 SAFE_FREE(data);
2426 }
2427
2428 }
2429
2430 return True;
2431 }
aatanasov's samba4 branch