?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s4:minschema/fullschema - add correct header comments
[Samba/aatanasov.git] / source3 / rpc_server / srv_pipe.c
blob8611be49e31e112c6ea731f2089c3ab8923b218a
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Almost completely rewritten by (C) Jeremy Allison 2005.
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 /* this module apparently provides an implementation of DCE/RPC over a
21 * named pipe (IPC$ connection using SMBtrans). details of DCE/RPC
22 * documentation are available (in on-line form) from the X-Open group.
23 *
24 * this module should provide a level of abstraction between SMB
25 * and DCE/RPC, while minimising the amount of mallocs, unnecessary
26 * data copies, and network traffic.
27 *
28 */
29
30 #include "includes.h"
31 #include "../libcli/auth/libcli_auth.h"
32 #include "../librpc/gen_ndr/ndr_schannel.h"
33 #include "../libcli/auth/schannel.h"
34 #include "../libcli/auth/schannel_proto.h"
35 #include "../libcli/auth/spnego.h"
36
37 extern struct current_user current_user;
38
39 #undef DBGC_CLASS
40 #define DBGC_CLASS DBGC_RPC_SRV
41
42 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
43 {
44 AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
45
46 if (a) {
47 auth_ntlmssp_end(&a);
48 }
49 auth->a_u.auth_ntlmssp_state = NULL;
50 }
51
52 static DATA_BLOB generic_session_key(void)
53 {
54 return data_blob("SystemLibraryDTC", 16);
55 }
56
57 /*******************************************************************
58 Generate the next PDU to be returned from the data in p->rdata.
59 Handle NTLMSSP.
60 ********************************************************************/
61
62 static bool create_next_pdu_ntlmssp(pipes_struct *p)
63 {
64 RPC_HDR_RESP hdr_resp;
65 uint32 ss_padding_len = 0;
66 uint32 data_space_available;
67 uint32 data_len_left;
68 uint32 data_len;
69 NTSTATUS status;
70 DATA_BLOB auth_blob;
71 RPC_HDR_AUTH auth_info;
72 uint8 auth_type, auth_level;
73 AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
74
75 /*
76 * If we're in the fault state, keep returning fault PDU's until
77 * the pipe gets closed. JRA.
78 */
79
80 if(p->fault_state) {
81 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
82 return True;
83 }
84
85 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
86
87 /* Change the incoming request header to a response. */
88 p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
89
90 /* Set up rpc header flags. */
91 if (p->out_data.data_sent_length == 0) {
92 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
93 } else {
94 p->hdr.flags = 0;
95 }
96
97 /*
98 * Work out how much we can fit in a single PDU.
99 */
100
101 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
102
103 /*
104 * Ensure there really is data left to send.
105 */
106
107 if(!data_len_left) {
108 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
109 return False;
110 }
111
112 data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
113 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
114
115 /*
116 * The amount we send is the minimum of the available
117 * space and the amount left to send.
118 */
119
120 data_len = MIN(data_len_left, data_space_available);
121
122 /*
123 * Set up the alloc hint. This should be the data left to
124 * send.
125 */
126
127 hdr_resp.alloc_hint = data_len_left;
128
129 /*
130 * Work out if this PDU will be the last.
131 */
132
133 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
134 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
135 if (data_len_left % 8) {
136 ss_padding_len = 8 - (data_len_left % 8);
137 DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
138 ss_padding_len ));
139 }
140 }
141
142 /*
143 * Set up the header lengths.
144 */
145
146 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
147 data_len + ss_padding_len +
148 RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
149 p->hdr.auth_len = NTLMSSP_SIG_SIZE;
150
151
152 /*
153 * Init the parse struct to point at the outgoing
154 * data.
155 */
156
157 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
158
159 /* Store the header in the data stream. */
160 if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
161 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
162 prs_mem_free(&p->out_data.frag);
163 return False;
164 }
165
166 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
167 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
168 prs_mem_free(&p->out_data.frag);
169 return False;
170 }
171
172 /* Copy the data into the PDU. */
173
174 if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
175 p->out_data.data_sent_length, data_len)) {
176 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
177 prs_mem_free(&p->out_data.frag);
178 return False;
179 }
180
181 /* Copy the sign/seal padding data. */
182 if (ss_padding_len) {
183 char pad[8];
184
185 memset(pad, '\0', 8);
186 if (!prs_copy_data_in(&p->out_data.frag, pad,
187 ss_padding_len)) {
188 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
189 (unsigned int)ss_padding_len));
190 prs_mem_free(&p->out_data.frag);
191 return False;
192 }
193 }
194
195
196 /* Now write out the auth header and null blob. */
197 if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
198 auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
199 } else {
200 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
201 }
202 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
203 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
204 } else {
205 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
206 }
207
208 init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
209 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &p->out_data.frag,
210 0)) {
211 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
212 prs_mem_free(&p->out_data.frag);
213 return False;
214 }
215
216 /* Generate the sign blob. */
217
218 switch (p->auth.auth_level) {
219 case DCERPC_AUTH_LEVEL_PRIVACY:
220 /* Data portion is encrypted. */
221 status = ntlmssp_seal_packet(
222 a->ntlmssp_state,
223 (uint8_t *)prs_data_p(&p->out_data.frag)
224 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
225 data_len + ss_padding_len,
226 (unsigned char *)prs_data_p(&p->out_data.frag),
227 (size_t)prs_offset(&p->out_data.frag),
228 &auth_blob);
229 if (!NT_STATUS_IS_OK(status)) {
230 data_blob_free(&auth_blob);
231 prs_mem_free(&p->out_data.frag);
232 return False;
233 }
234 break;
235 case DCERPC_AUTH_LEVEL_INTEGRITY:
236 /* Data is signed. */
237 status = ntlmssp_sign_packet(
238 a->ntlmssp_state,
239 (unsigned char *)prs_data_p(&p->out_data.frag)
240 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
241 data_len + ss_padding_len,
242 (unsigned char *)prs_data_p(&p->out_data.frag),
243 (size_t)prs_offset(&p->out_data.frag),
244 &auth_blob);
245 if (!NT_STATUS_IS_OK(status)) {
246 data_blob_free(&auth_blob);
247 prs_mem_free(&p->out_data.frag);
248 return False;
249 }
250 break;
251 default:
252 prs_mem_free(&p->out_data.frag);
253 return False;
254 }
255
256 /* Append the auth blob. */
257 if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
258 NTLMSSP_SIG_SIZE)) {
259 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
260 (unsigned int)NTLMSSP_SIG_SIZE));
261 data_blob_free(&auth_blob);
262 prs_mem_free(&p->out_data.frag);
263 return False;
264 }
265
266 data_blob_free(&auth_blob);
267
268 /*
269 * Setup the counts for this PDU.
270 */
271
272 p->out_data.data_sent_length += data_len;
273 p->out_data.current_pdu_sent = 0;
274
275 return True;
276 }
277
278 /*******************************************************************
279 Generate the next PDU to be returned from the data in p->rdata.
280 Return an schannel authenticated fragment.
281 ********************************************************************/
282
283 static bool create_next_pdu_schannel(pipes_struct *p)
284 {
285 RPC_HDR_RESP hdr_resp;
286 uint32 ss_padding_len = 0;
287 uint32 data_len;
288 uint32 data_space_available;
289 uint32 data_len_left;
290 uint32 data_pos;
291 NTSTATUS status;
292
293 /*
294 * If we're in the fault state, keep returning fault PDU's until
295 * the pipe gets closed. JRA.
296 */
297
298 if(p->fault_state) {
299 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
300 return True;
301 }
302
303 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
304
305 /* Change the incoming request header to a response. */
306 p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
307
308 /* Set up rpc header flags. */
309 if (p->out_data.data_sent_length == 0) {
310 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
311 } else {
312 p->hdr.flags = 0;
313 }
314
315 /*
316 * Work out how much we can fit in a single PDU.
317 */
318
319 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
320
321 /*
322 * Ensure there really is data left to send.
323 */
324
325 if(!data_len_left) {
326 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
327 return False;
328 }
329
330 data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
331 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
332 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
333
334 /*
335 * The amount we send is the minimum of the available
336 * space and the amount left to send.
337 */
338
339 data_len = MIN(data_len_left, data_space_available);
340
341 /*
342 * Set up the alloc hint. This should be the data left to
343 * send.
344 */
345
346 hdr_resp.alloc_hint = data_len_left;
347
348 /*
349 * Work out if this PDU will be the last.
350 */
351
352 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
353 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
354 if (data_len_left % 8) {
355 ss_padding_len = 8 - (data_len_left % 8);
356 DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
357 ss_padding_len ));
358 }
359 }
360
361 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
362 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
363 p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
364
365 /*
366 * Init the parse struct to point at the outgoing
367 * data.
368 */
369
370 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
371
372 /* Store the header in the data stream. */
373 if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
374 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
375 prs_mem_free(&p->out_data.frag);
376 return False;
377 }
378
379 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
380 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
381 prs_mem_free(&p->out_data.frag);
382 return False;
383 }
384
385 /* Store the current offset. */
386 data_pos = prs_offset(&p->out_data.frag);
387
388 /* Copy the data into the PDU. */
389
390 if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
391 p->out_data.data_sent_length, data_len)) {
392 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
393 prs_mem_free(&p->out_data.frag);
394 return False;
395 }
396
397 /* Copy the sign/seal padding data. */
398 if (ss_padding_len) {
399 char pad[8];
400 memset(pad, '\0', 8);
401 if (!prs_copy_data_in(&p->out_data.frag, pad,
402 ss_padding_len)) {
403 DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
404 prs_mem_free(&p->out_data.frag);
405 return False;
406 }
407 }
408
409 {
410 /*
411 * Schannel processing.
412 */
413 RPC_HDR_AUTH auth_info;
414 DATA_BLOB blob;
415 uint8_t *data;
416
417 /* Check it's the type of reply we were expecting to decode */
418
419 init_rpc_hdr_auth(&auth_info,
420 DCERPC_AUTH_TYPE_SCHANNEL,
421 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
422 DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
423 ss_padding_len, 1);
424
425 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
426 &p->out_data.frag, 0)) {
427 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
428 prs_mem_free(&p->out_data.frag);
429 return False;
430 }
431
432 data = (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos;
433
434 switch (p->auth.auth_level) {
435 case DCERPC_AUTH_LEVEL_PRIVACY:
436 status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
437 talloc_tos(),
438 true,
439 data,
440 data_len + ss_padding_len,
441 &blob);
442 break;
443 case DCERPC_AUTH_LEVEL_INTEGRITY:
444 status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
445 talloc_tos(),
446 false,
447 data,
448 data_len + ss_padding_len,
449 &blob);
450 break;
451 default:
452 status = NT_STATUS_INTERNAL_ERROR;
453 break;
454 }
455
456 if (!NT_STATUS_IS_OK(status)) {
457 DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
458 nt_errstr(status)));
459 prs_mem_free(&p->out_data.frag);
460 return false;
461 }
462
463 /* Finally marshall the blob. */
464
465 if (DEBUGLEVEL >= 10) {
466 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
467 }
468
469 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
470 prs_mem_free(&p->out_data.frag);
471 return false;
472 }
473 }
474
475 /*
476 * Setup the counts for this PDU.
477 */
478
479 p->out_data.data_sent_length += data_len;
480 p->out_data.current_pdu_sent = 0;
481
482 return True;
483 }
484
485 /*******************************************************************
486 Generate the next PDU to be returned from the data in p->rdata.
487 No authentication done.
488 ********************************************************************/
489
490 static bool create_next_pdu_noauth(pipes_struct *p)
491 {
492 RPC_HDR_RESP hdr_resp;
493 uint32 data_len;
494 uint32 data_space_available;
495 uint32 data_len_left;
496
497 /*
498 * If we're in the fault state, keep returning fault PDU's until
499 * the pipe gets closed. JRA.
500 */
501
502 if(p->fault_state) {
503 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
504 return True;
505 }
506
507 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
508
509 /* Change the incoming request header to a response. */
510 p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
511
512 /* Set up rpc header flags. */
513 if (p->out_data.data_sent_length == 0) {
514 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
515 } else {
516 p->hdr.flags = 0;
517 }
518
519 /*
520 * Work out how much we can fit in a single PDU.
521 */
522
523 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
524
525 /*
526 * Ensure there really is data left to send.
527 */
528
529 if(!data_len_left) {
530 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
531 return False;
532 }
533
534 data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
535 - RPC_HDR_RESP_LEN;
536
537 /*
538 * The amount we send is the minimum of the available
539 * space and the amount left to send.
540 */
541
542 data_len = MIN(data_len_left, data_space_available);
543
544 /*
545 * Set up the alloc hint. This should be the data left to
546 * send.
547 */
548
549 hdr_resp.alloc_hint = data_len_left;
550
551 /*
552 * Work out if this PDU will be the last.
553 */
554
555 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
556 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
557 }
558
559 /*
560 * Set up the header lengths.
561 */
562
563 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
564 p->hdr.auth_len = 0;
565
566 /*
567 * Init the parse struct to point at the outgoing
568 * data.
569 */
570
571 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
572
573 /* Store the header in the data stream. */
574 if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
575 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
576 prs_mem_free(&p->out_data.frag);
577 return False;
578 }
579
580 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
581 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
582 prs_mem_free(&p->out_data.frag);
583 return False;
584 }
585
586 /* Copy the data into the PDU. */
587
588 if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
589 p->out_data.data_sent_length, data_len)) {
590 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
591 prs_mem_free(&p->out_data.frag);
592 return False;
593 }
594
595 /*
596 * Setup the counts for this PDU.
597 */
598
599 p->out_data.data_sent_length += data_len;
600 p->out_data.current_pdu_sent = 0;
601
602 return True;
603 }
604
605 /*******************************************************************
606 Generate the next PDU to be returned from the data in p->rdata.
607 ********************************************************************/
608
609 bool create_next_pdu(pipes_struct *p)
610 {
611 switch(p->auth.auth_level) {
612 case DCERPC_AUTH_LEVEL_NONE:
613 case DCERPC_AUTH_LEVEL_CONNECT:
614 /* This is incorrect for auth level connect. Fixme. JRA */
615 return create_next_pdu_noauth(p);
616
617 default:
618 switch(p->auth.auth_type) {
619 case PIPE_AUTH_TYPE_NTLMSSP:
620 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
621 return create_next_pdu_ntlmssp(p);
622 case PIPE_AUTH_TYPE_SCHANNEL:
623 return create_next_pdu_schannel(p);
624 default:
625 break;
626 }
627 }
628
629 DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
630 (unsigned int)p->auth.auth_level,
631 (unsigned int)p->auth.auth_type));
632 return False;
633 }
634
635 /*******************************************************************
636 Process an NTLMSSP authentication response.
637 If this function succeeds, the user has been authenticated
638 and their domain, name and calling workstation stored in
639 the pipe struct.
640 *******************************************************************/
641
642 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
643 {
644 DATA_BLOB session_key, reply;
645 NTSTATUS status;
646 AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
647 bool ret;
648
649 DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
650 get_pipe_name_from_iface(&p->syntax)));
651
652 ZERO_STRUCT(reply);
653
654 /* this has to be done as root in order to verify the password */
655 become_root();
656 status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
657 unbecome_root();
658
659 /* Don't generate a reply. */
660 data_blob_free(&reply);
661
662 if (!NT_STATUS_IS_OK(status)) {
663 return False;
664 }
665
666 /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
667 ensure the underlying NTLMSSP flags are also set. If not we should
668 refuse the bind. */
669
670 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
671 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
672 DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
673 "but client declined signing.\n",
674 get_pipe_name_from_iface(&p->syntax)));
675 return False;
676 }
677 }
678 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
679 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
680 DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
681 "but client declined sealing.\n",
682 get_pipe_name_from_iface(&p->syntax)));
683 return False;
684 }
685 }
686
687 DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
688 "workstation: %s\n", a->ntlmssp_state->user,
689 a->ntlmssp_state->domain, a->ntlmssp_state->workstation));
690
691 if (a->server_info->ptok == NULL) {
692 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
693 return False;
694 }
695
696 TALLOC_FREE(p->server_info);
697
698 p->server_info = copy_serverinfo(p, a->server_info);
699 if (p->server_info == NULL) {
700 DEBUG(0, ("copy_serverinfo failed\n"));
701 return false;
702 }
703
704 /*
705 * We're an authenticated bind over smb, so the session key needs to
706 * be set to "SystemLibraryDTC". Weird, but this is what Windows
707 * does. See the RPC-SAMBA3SESSIONKEY.
708 */
709
710 session_key = generic_session_key();
711 if (session_key.data == NULL) {
712 return False;
713 }
714
715 ret = server_info_set_session_key(p->server_info, session_key);
716
717 data_blob_free(&session_key);
718
719 return True;
720 }
721
722 /*******************************************************************
723 The switch table for the pipe names and the functions to handle them.
724 *******************************************************************/
725
726 struct rpc_table {
727 struct {
728 const char *clnt;
729 const char *srv;
730 } pipe;
731 struct ndr_syntax_id rpc_interface;
732 const struct api_struct *cmds;
733 int n_cmds;
734 };
735
736 static struct rpc_table *rpc_lookup;
737 static int rpc_lookup_size;
738
739 /*******************************************************************
740 This is the "stage3" NTLMSSP response after a bind request and reply.
741 *******************************************************************/
742
743 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
744 {
745 RPC_HDR_AUTH auth_info;
746 uint32 pad = 0;
747 DATA_BLOB blob;
748
749 ZERO_STRUCT(blob);
750
751 DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
752
753 if (p->hdr.auth_len == 0) {
754 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
755 goto err;
756 }
757
758 /* 4 bytes padding. */
759 if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
760 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
761 goto err;
762 }
763
764 /*
765 * Decode the authentication verifier response.
766 */
767
768 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
769 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
770 goto err;
771 }
772
773 if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
774 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
775 (unsigned int)auth_info.auth_type ));
776 return False;
777 }
778
779 blob = data_blob(NULL,p->hdr.auth_len);
780
781 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
782 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
783 (unsigned int)p->hdr.auth_len ));
784 goto err;
785 }
786
787 /*
788 * The following call actually checks the challenge/response data.
789 * for correctness against the given DOMAIN\user name.
790 */
791
792 if (!pipe_ntlmssp_verify_final(p, &blob)) {
793 goto err;
794 }
795
796 data_blob_free(&blob);
797
798 p->pipe_bound = True;
799
800 return True;
801
802 err:
803
804 data_blob_free(&blob);
805 free_pipe_ntlmssp_auth_data(&p->auth);
806 p->auth.a_u.auth_ntlmssp_state = NULL;
807
808 return False;
809 }
810
811 /*******************************************************************
812 Marshall a bind_nak pdu.
813 *******************************************************************/
814
815 static bool setup_bind_nak(pipes_struct *p)
816 {
817 RPC_HDR nak_hdr;
818 uint16 zero = 0;
819
820 /* Free any memory in the current return data buffer. */
821 prs_mem_free(&p->out_data.rdata);
822
823 /*
824 * Marshall directly into the outgoing PDU space. We
825 * must do this as we need to set to the bind response
826 * header and are never sending more than one PDU here.
827 */
828
829 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
830
831 /*
832 * Initialize a bind_nak header.
833 */
834
835 init_rpc_hdr(&nak_hdr, DCERPC_PKT_BIND_NAK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
836 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
837
838 /*
839 * Marshall the header into the outgoing PDU.
840 */
841
842 if(!smb_io_rpc_hdr("", &nak_hdr, &p->out_data.frag, 0)) {
843 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
844 prs_mem_free(&p->out_data.frag);
845 return False;
846 }
847
848 /*
849 * Now add the reject reason.
850 */
851
852 if(!prs_uint16("reject code", &p->out_data.frag, 0, &zero)) {
853 prs_mem_free(&p->out_data.frag);
854 return False;
855 }
856
857 p->out_data.data_sent_length = 0;
858 p->out_data.current_pdu_sent = 0;
859
860 if (p->auth.auth_data_free_func) {
861 (*p->auth.auth_data_free_func)(&p->auth);
862 }
863 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
864 p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
865 p->pipe_bound = False;
866
867 return True;
868 }
869
870 /*******************************************************************
871 Marshall a fault pdu.
872 *******************************************************************/
873
874 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
875 {
876 RPC_HDR fault_hdr;
877 RPC_HDR_RESP hdr_resp;
878 RPC_HDR_FAULT fault_resp;
879
880 /* Free any memory in the current return data buffer. */
881 prs_mem_free(&p->out_data.rdata);
882
883 /*
884 * Marshall directly into the outgoing PDU space. We
885 * must do this as we need to set to the bind response
886 * header and are never sending more than one PDU here.
887 */
888
889 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
890
891 /*
892 * Initialize a fault header.
893 */
894
895 init_rpc_hdr(&fault_hdr, DCERPC_PKT_FAULT, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST | DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
896 p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
897
898 /*
899 * Initialize the HDR_RESP and FAULT parts of the PDU.
900 */
901
902 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
903
904 fault_resp.status = status;
905 fault_resp.reserved = 0;
906
907 /*
908 * Marshall the header into the outgoing PDU.
909 */
910
911 if(!smb_io_rpc_hdr("", &fault_hdr, &p->out_data.frag, 0)) {
912 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
913 prs_mem_free(&p->out_data.frag);
914 return False;
915 }
916
917 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
918 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
919 prs_mem_free(&p->out_data.frag);
920 return False;
921 }
922
923 if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &p->out_data.frag, 0)) {
924 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
925 prs_mem_free(&p->out_data.frag);
926 return False;
927 }
928
929 p->out_data.data_sent_length = 0;
930 p->out_data.current_pdu_sent = 0;
931
932 return True;
933 }
934
935 #if 0
936 /*******************************************************************
937 Marshall a cancel_ack pdu.
938 We should probably check the auth-verifier here.
939 *******************************************************************/
940
941 bool setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
942 {
943 prs_struct outgoing_pdu;
944 RPC_HDR ack_reply_hdr;
945
946 /* Free any memory in the current return data buffer. */
947 prs_mem_free(&p->out_data.rdata);
948
949 /*
950 * Marshall directly into the outgoing PDU space. We
951 * must do this as we need to set to the bind response
952 * header and are never sending more than one PDU here.
953 */
954
955 prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
956 prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
957
958 /*
959 * Initialize a cancel_ack header.
960 */
961
962 init_rpc_hdr(&ack_reply_hdr, DCERPC_PKT_CANCEL_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
963 p->hdr.call_id, RPC_HEADER_LEN, 0);
964
965 /*
966 * Marshall the header into the outgoing PDU.
967 */
968
969 if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
970 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
971 prs_mem_free(&outgoing_pdu);
972 return False;
973 }
974
975 p->out_data.data_sent_length = 0;
976 p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
977 p->out_data.current_pdu_sent = 0;
978
979 prs_mem_free(&outgoing_pdu);
980 return True;
981 }
982 #endif
983
984 /*******************************************************************
985 Ensure a bind request has the correct abstract & transfer interface.
986 Used to reject unknown binds from Win2k.
987 *******************************************************************/
988
989 static bool check_bind_req(struct pipes_struct *p,
990 struct ndr_syntax_id* abstract,
991 struct ndr_syntax_id* transfer,
992 uint32 context_id)
993 {
994 int i=0;
995 struct pipe_rpc_fns *context_fns;
996
997 DEBUG(3,("check_bind_req for %s\n",
998 get_pipe_name_from_iface(&p->syntax)));
999
1000 /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
1001
1002 for (i=0; i<rpc_lookup_size; i++) {
1003 DEBUGADD(10, ("checking %s\n", rpc_lookup[i].pipe.clnt));
1004 if (ndr_syntax_id_equal(
1005 abstract, &rpc_lookup[i].rpc_interface)
1006 && ndr_syntax_id_equal(
1007 transfer, &ndr_transfer_syntax)) {
1008 break;
1009 }
1010 }
1011
1012 if (i == rpc_lookup_size) {
1013 return false;
1014 }
1015
1016 context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
1017 if (context_fns == NULL) {
1018 DEBUG(0,("check_bind_req: malloc() failed!\n"));
1019 return False;
1020 }
1021
1022 context_fns->cmds = rpc_lookup[i].cmds;
1023 context_fns->n_cmds = rpc_lookup[i].n_cmds;
1024 context_fns->context_id = context_id;
1025
1026 /* add to the list of open contexts */
1027
1028 DLIST_ADD( p->contexts, context_fns );
1029
1030 return True;
1031 }
1032
1033 /*******************************************************************
1034 Register commands to an RPC pipe
1035 *******************************************************************/
1036
1037 NTSTATUS rpc_srv_register(int version, const char *clnt, const char *srv,
1038 const struct ndr_interface_table *iface,
1039 const struct api_struct *cmds, int size)
1040 {
1041 struct rpc_table *rpc_entry;
1042
1043 if (!clnt || !srv || !cmds) {
1044 return NT_STATUS_INVALID_PARAMETER;
1045 }
1046
1047 if (version != SMB_RPC_INTERFACE_VERSION) {
1048 DEBUG(0,("Can't register rpc commands!\n"
1049 "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1050 ", while this version of samba uses version %d!\n",
1051 version,SMB_RPC_INTERFACE_VERSION));
1052 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1053 }
1054
1055 /* TODO:
1056 *
1057 * we still need to make sure that don't register the same commands twice!!!
1058 *
1059 * --metze
1060 */
1061
1062 /* We use a temporary variable because this call can fail and
1063 rpc_lookup will still be valid afterwards. It could then succeed if
1064 called again later */
1065 rpc_lookup_size++;
1066 rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1067 if (NULL == rpc_entry) {
1068 rpc_lookup_size--;
1069 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1070 return NT_STATUS_NO_MEMORY;
1071 } else {
1072 rpc_lookup = rpc_entry;
1073 }
1074
1075 rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1076 ZERO_STRUCTP(rpc_entry);
1077 rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1078 rpc_entry->pipe.srv = SMB_STRDUP(srv);
1079 rpc_entry->rpc_interface = iface->syntax_id;
1080 rpc_entry->cmds = cmds;
1081 rpc_entry->n_cmds = size;
1082
1083 return NT_STATUS_OK;
1084 }
1085
1086 /**
1087 * Is a named pipe known?
1088 * @param[in] cli_filename The pipe name requested by the client
1089 * @result Do we want to serve this?
1090 */
1091 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1092 {
1093 const char *pipename = cli_filename;
1094 int i;
1095
1096 if (strnequal(pipename, "\\PIPE\\", 6)) {
1097 pipename += 5;
1098 }
1099
1100 if (*pipename == '\\') {
1101 pipename += 1;
1102 }
1103
1104 if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1105 DEBUG(10, ("refusing spoolss access\n"));
1106 return false;
1107 }
1108
1109 for (i=0; i<rpc_lookup_size; i++) {
1110 if (strequal(pipename, rpc_lookup[i].pipe.clnt)) {
1111 *syntax = rpc_lookup[i].rpc_interface;
1112 return true;
1113 }
1114 }
1115
1116 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1117 return false;
1118 }
1119
1120 /*******************************************************************
1121 Handle a SPNEGO krb5 bind auth.
1122 *******************************************************************/
1123
1124 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1125 DATA_BLOB *psecblob, prs_struct *pout_auth)
1126 {
1127 return False;
1128 }
1129
1130 /*******************************************************************
1131 Handle the first part of a SPNEGO bind auth.
1132 *******************************************************************/
1133
1134 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1135 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1136 {
1137 DATA_BLOB blob;
1138 DATA_BLOB secblob;
1139 DATA_BLOB response;
1140 DATA_BLOB chal;
1141 char *OIDs[ASN1_MAX_OIDS];
1142 int i;
1143 NTSTATUS status;
1144 bool got_kerberos_mechanism = false;
1145 AUTH_NTLMSSP_STATE *a = NULL;
1146 RPC_HDR_AUTH auth_info;
1147
1148 ZERO_STRUCT(secblob);
1149 ZERO_STRUCT(chal);
1150 ZERO_STRUCT(response);
1151
1152 /* Grab the SPNEGO blob. */
1153 blob = data_blob(NULL,p->hdr.auth_len);
1154
1155 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1156 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1157 (unsigned int)p->hdr.auth_len ));
1158 goto err;
1159 }
1160
1161 if (blob.data[0] != ASN1_APPLICATION(0)) {
1162 goto err;
1163 }
1164
1165 /* parse out the OIDs and the first sec blob */
1166 if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1167 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1168 goto err;
1169 }
1170
1171 if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1172 got_kerberos_mechanism = true;
1173 }
1174
1175 for (i=0;OIDs[i];i++) {
1176 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1177 TALLOC_FREE(OIDs[i]);
1178 }
1179 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1180
1181 if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1182 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1183 data_blob_free(&secblob);
1184 data_blob_free(&blob);
1185 return ret;
1186 }
1187
1188 if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1189 /* Free any previous auth type. */
1190 free_pipe_ntlmssp_auth_data(&p->auth);
1191 }
1192
1193 if (!got_kerberos_mechanism) {
1194 /* Initialize the NTLM engine. */
1195 status = auth_ntlmssp_start(&a);
1196 if (!NT_STATUS_IS_OK(status)) {
1197 goto err;
1198 }
1199
1200 /*
1201 * Pass the first security blob of data to it.
1202 * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1203 * which means we need another packet to complete the bind.
1204 */
1205
1206 status = auth_ntlmssp_update(a, secblob, &chal);
1207
1208 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1209 DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1210 goto err;
1211 }
1212
1213 /* Generate the response blob we need for step 2 of the bind. */
1214 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1215 } else {
1216 /*
1217 * SPNEGO negotiate down to NTLMSSP. The subsequent
1218 * code to process follow-up packets is not complete
1219 * yet. JRA.
1220 */
1221 response = spnego_gen_auth_response(NULL,
1222 NT_STATUS_MORE_PROCESSING_REQUIRED,
1223 OID_NTLMSSP);
1224 }
1225
1226 /* Copy the blob into the pout_auth parse struct */
1227 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1228 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1229 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1230 goto err;
1231 }
1232
1233 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1234 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1235 goto err;
1236 }
1237
1238 p->auth.a_u.auth_ntlmssp_state = a;
1239 p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1240 p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1241
1242 data_blob_free(&blob);
1243 data_blob_free(&secblob);
1244 data_blob_free(&chal);
1245 data_blob_free(&response);
1246
1247 /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1248 return True;
1249
1250 err:
1251
1252 data_blob_free(&blob);
1253 data_blob_free(&secblob);
1254 data_blob_free(&chal);
1255 data_blob_free(&response);
1256
1257 p->auth.a_u.auth_ntlmssp_state = NULL;
1258
1259 return False;
1260 }
1261
1262 /*******************************************************************
1263 Handle the second part of a SPNEGO bind auth.
1264 *******************************************************************/
1265
1266 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1267 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1268 {
1269 RPC_HDR_AUTH auth_info;
1270 DATA_BLOB spnego_blob;
1271 DATA_BLOB auth_blob;
1272 DATA_BLOB auth_reply;
1273 DATA_BLOB response;
1274 AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1275
1276 ZERO_STRUCT(spnego_blob);
1277 ZERO_STRUCT(auth_blob);
1278 ZERO_STRUCT(auth_reply);
1279 ZERO_STRUCT(response);
1280
1281 /*
1282 * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1283 * fail here as 'a' == NULL.
1284 */
1285 if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1286 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1287 goto err;
1288 }
1289
1290 /* Grab the SPNEGO blob. */
1291 spnego_blob = data_blob(NULL,p->hdr.auth_len);
1292
1293 if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1294 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1295 (unsigned int)p->hdr.auth_len ));
1296 goto err;
1297 }
1298
1299 if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1300 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1301 goto err;
1302 }
1303
1304 if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1305 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1306 goto err;
1307 }
1308
1309 /*
1310 * The following call actually checks the challenge/response data.
1311 * for correctness against the given DOMAIN\user name.
1312 */
1313
1314 if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1315 goto err;
1316 }
1317
1318 data_blob_free(&spnego_blob);
1319 data_blob_free(&auth_blob);
1320
1321 /* Generate the spnego "accept completed" blob - no incoming data. */
1322 response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1323
1324 /* Copy the blob into the pout_auth parse struct */
1325 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1326 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1327 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1328 goto err;
1329 }
1330
1331 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1332 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1333 goto err;
1334 }
1335
1336 data_blob_free(&auth_reply);
1337 data_blob_free(&response);
1338
1339 p->pipe_bound = True;
1340
1341 return True;
1342
1343 err:
1344
1345 data_blob_free(&spnego_blob);
1346 data_blob_free(&auth_blob);
1347 data_blob_free(&auth_reply);
1348 data_blob_free(&response);
1349
1350 free_pipe_ntlmssp_auth_data(&p->auth);
1351 p->auth.a_u.auth_ntlmssp_state = NULL;
1352
1353 return False;
1354 }
1355
1356 /*******************************************************************
1357 Handle an schannel bind auth.
1358 *******************************************************************/
1359
1360 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1361 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1362 {
1363 RPC_HDR_AUTH auth_info;
1364 struct NL_AUTH_MESSAGE neg;
1365 struct NL_AUTH_MESSAGE reply;
1366 bool ret;
1367 NTSTATUS status;
1368 struct netlogon_creds_CredentialState *creds;
1369 DATA_BLOB session_key;
1370 enum ndr_err_code ndr_err;
1371 DATA_BLOB blob;
1372
1373 blob = data_blob_const(prs_data_p(rpc_in_p) + prs_offset(rpc_in_p),
1374 prs_data_size(rpc_in_p));
1375
1376 ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), NULL, &neg,
1377 (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1378 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1379 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1380 return false;
1381 }
1382
1383 if (DEBUGLEVEL >= 10) {
1384 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1385 }
1386
1387 if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1388 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1389 return false;
1390 }
1391
1392 /*
1393 * The neg.oem_netbios_computer.a key here must match the remote computer name
1394 * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1395 * operations that use credentials.
1396 */
1397
1398 become_root();
1399 status = schannel_fetch_session_key(p,
1400 neg.oem_netbios_computer.a,
1401 &creds);
1402 unbecome_root();
1403
1404 if (!NT_STATUS_IS_OK(status)) {
1405 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1406 return False;
1407 }
1408
1409 p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1410 if (!p->auth.a_u.schannel_auth) {
1411 TALLOC_FREE(creds);
1412 return False;
1413 }
1414
1415 p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1416 p->auth.a_u.schannel_auth->seq_num = 0;
1417 p->auth.a_u.schannel_auth->initiator = false;
1418 p->auth.a_u.schannel_auth->creds = creds;
1419
1420 /*
1421 * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1422 * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1423 * struct of the person who opened the pipe. I need to test this further. JRA.
1424 *
1425 * VL. As we are mapping this to guest set the generic key
1426 * "SystemLibraryDTC" key here. It's a bit difficult to test against
1427 * W2k3, as it does not allow schannel binds against SAMR and LSA
1428 * anymore.
1429 */
1430
1431 session_key = generic_session_key();
1432 if (session_key.data == NULL) {
1433 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1434 " key\n"));
1435 return false;
1436 }
1437
1438 ret = server_info_set_session_key(p->server_info, session_key);
1439
1440 data_blob_free(&session_key);
1441
1442 if (!ret) {
1443 DEBUG(0, ("server_info_set_session_key failed\n"));
1444 return false;
1445 }
1446
1447 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SCHANNEL, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1448 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1449 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1450 return False;
1451 }
1452
1453 /*** SCHANNEL verifier ***/
1454
1455 reply.MessageType = NL_NEGOTIATE_RESPONSE;
1456 reply.Flags = 0;
1457 reply.Buffer.dummy = 5; /* ??? actually I don't think
1458 * this has any meaning
1459 * here - gd */
1460
1461 ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), NULL, &reply,
1462 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1463 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1464 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1465 return false;
1466 }
1467
1468 if (DEBUGLEVEL >= 10) {
1469 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1470 }
1471
1472 if (!prs_copy_data_in(pout_auth, (const char *)blob.data, blob.length)) {
1473 return false;
1474 }
1475
1476 DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1477 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1478
1479 /* We're finished with this bind - no more packets. */
1480 p->auth.auth_data_free_func = NULL;
1481 p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1482
1483 p->pipe_bound = True;
1484
1485 return True;
1486 }
1487
1488 /*******************************************************************
1489 Handle an NTLMSSP bind auth.
1490 *******************************************************************/
1491
1492 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1493 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1494 {
1495 RPC_HDR_AUTH auth_info;
1496 DATA_BLOB blob;
1497 DATA_BLOB response;
1498 NTSTATUS status;
1499 AUTH_NTLMSSP_STATE *a = NULL;
1500
1501 ZERO_STRUCT(blob);
1502 ZERO_STRUCT(response);
1503
1504 /* Grab the NTLMSSP blob. */
1505 blob = data_blob(NULL,p->hdr.auth_len);
1506
1507 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1508 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1509 (unsigned int)p->hdr.auth_len ));
1510 goto err;
1511 }
1512
1513 if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1514 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1515 goto err;
1516 }
1517
1518 /* We have an NTLMSSP blob. */
1519 status = auth_ntlmssp_start(&a);
1520 if (!NT_STATUS_IS_OK(status)) {
1521 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1522 nt_errstr(status) ));
1523 goto err;
1524 }
1525
1526 status = auth_ntlmssp_update(a, blob, &response);
1527 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1528 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1529 nt_errstr(status) ));
1530 goto err;
1531 }
1532
1533 data_blob_free(&blob);
1534
1535 /* Copy the blob into the pout_auth parse struct */
1536 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_NTLMSSP, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1537 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1538 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1539 goto err;
1540 }
1541
1542 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1543 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1544 goto err;
1545 }
1546
1547 p->auth.a_u.auth_ntlmssp_state = a;
1548 p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1549 p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1550
1551 data_blob_free(&blob);
1552 data_blob_free(&response);
1553
1554 DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1555
1556 /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1557 return True;
1558
1559 err:
1560
1561 data_blob_free(&blob);
1562 data_blob_free(&response);
1563
1564 free_pipe_ntlmssp_auth_data(&p->auth);
1565 p->auth.a_u.auth_ntlmssp_state = NULL;
1566 return False;
1567 }
1568
1569 /*******************************************************************
1570 Respond to a pipe bind request.
1571 *******************************************************************/
1572
1573 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1574 {
1575 RPC_HDR_BA hdr_ba;
1576 RPC_HDR_RB hdr_rb;
1577 RPC_HDR_AUTH auth_info;
1578 uint16 assoc_gid;
1579 fstring ack_pipe_name;
1580 prs_struct out_hdr_ba;
1581 prs_struct out_auth;
1582 int i = 0;
1583 int auth_len = 0;
1584 unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1585
1586 /* No rebinds on a bound pipe - use alter context. */
1587 if (p->pipe_bound) {
1588 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1589 "pipe %s.\n", get_pipe_name_from_iface(&p->syntax)));
1590 return setup_bind_nak(p);
1591 }
1592
1593 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1594
1595 /*
1596 * Marshall directly into the outgoing PDU space. We
1597 * must do this as we need to set to the bind response
1598 * header and are never sending more than one PDU here.
1599 */
1600
1601 /*
1602 * Setup the memory to marshall the ba header, and the
1603 * auth footers.
1604 */
1605
1606 if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1607 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1608 prs_mem_free(&p->out_data.frag);
1609 return False;
1610 }
1611
1612 if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1613 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1614 prs_mem_free(&p->out_data.frag);
1615 prs_mem_free(&out_hdr_ba);
1616 return False;
1617 }
1618
1619 DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1620
1621 ZERO_STRUCT(hdr_rb);
1622
1623 /* decode the bind request */
1624
1625 if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0)) {
1626 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB "
1627 "struct.\n"));
1628 goto err_exit;
1629 }
1630
1631 if (hdr_rb.num_contexts == 0) {
1632 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1633 goto err_exit;
1634 }
1635
1636 /*
1637 * Try and find the correct pipe name to ensure
1638 * that this is a pipe name we support.
1639 */
1640
1641 for (i = 0; i < rpc_lookup_size; i++) {
1642 if (ndr_syntax_id_equal(&rpc_lookup[i].rpc_interface,
1643 &hdr_rb.rpc_context[0].abstract)) {
1644 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1645 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1646 break;
1647 }
1648 }
1649
1650 if (i == rpc_lookup_size) {
1651 NTSTATUS status;
1652
1653 status = smb_probe_module(
1654 "rpc", get_pipe_name_from_iface(
1655 &hdr_rb.rpc_context[0].abstract));
1656
1657 if (NT_STATUS_IS_ERR(status)) {
1658 DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1659 get_pipe_name_from_iface(&hdr_rb.rpc_context[0].abstract)));
1660 prs_mem_free(&p->out_data.frag);
1661 prs_mem_free(&out_hdr_ba);
1662 prs_mem_free(&out_auth);
1663
1664 return setup_bind_nak(p);
1665 }
1666
1667 for (i = 0; i < rpc_lookup_size; i++) {
1668 if (strequal(rpc_lookup[i].pipe.clnt,
1669 get_pipe_name_from_iface(&p->syntax))) {
1670 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1671 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1672 break;
1673 }
1674 }
1675
1676 if (i == rpc_lookup_size) {
1677 DEBUG(0, ("module %s doesn't provide functions for "
1678 "pipe %s!\n",
1679 get_pipe_name_from_iface(&p->syntax),
1680 get_pipe_name_from_iface(&p->syntax)));
1681 goto err_exit;
1682 }
1683 }
1684
1685 /* name has to be \PIPE\xxxxx */
1686 fstrcpy(ack_pipe_name, "\\PIPE\\");
1687 fstrcat(ack_pipe_name, rpc_lookup[i].pipe.srv);
1688
1689 DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1690
1691 /*
1692 * Check if this is an authenticated bind request.
1693 */
1694
1695 if (p->hdr.auth_len) {
1696 /*
1697 * Decode the authentication verifier.
1698 */
1699
1700 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1701 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1702 goto err_exit;
1703 }
1704
1705 auth_type = auth_info.auth_type;
1706
1707 /* Work out if we have to sign or seal etc. */
1708 switch (auth_info.auth_level) {
1709 case DCERPC_AUTH_LEVEL_INTEGRITY:
1710 p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1711 break;
1712 case DCERPC_AUTH_LEVEL_PRIVACY:
1713 p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1714 break;
1715 default:
1716 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1717 (unsigned int)auth_info.auth_level ));
1718 goto err_exit;
1719 }
1720 } else {
1721 ZERO_STRUCT(auth_info);
1722 }
1723
1724 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1725
1726 switch(auth_type) {
1727 case DCERPC_AUTH_TYPE_NTLMSSP:
1728 if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1729 goto err_exit;
1730 }
1731 assoc_gid = 0x7a77;
1732 break;
1733
1734 case DCERPC_AUTH_TYPE_SCHANNEL:
1735 if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1736 goto err_exit;
1737 }
1738 break;
1739
1740 case DCERPC_AUTH_TYPE_SPNEGO:
1741 if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1742 goto err_exit;
1743 }
1744 break;
1745
1746 case DCERPC_AUTH_TYPE_NONE:
1747 /* Unauthenticated bind request. */
1748 /* We're finished - no more packets. */
1749 p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1750 /* We must set the pipe auth_level here also. */
1751 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1752 p->pipe_bound = True;
1753 /* The session key was initialized from the SMB
1754 * session in make_internal_rpc_pipe_p */
1755 break;
1756
1757 default:
1758 DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1759 goto err_exit;
1760 }
1761
1762 /*
1763 * Create the bind response struct.
1764 */
1765
1766 /* If the requested abstract synt uuid doesn't match our client pipe,
1767 reject the bind_ack & set the transfer interface synt to all 0's,
1768 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1769 unknown to NT4)
1770 Needed when adding entries to a DACL from NT5 - SK */
1771
1772 if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1773 hdr_rb.rpc_context[0].context_id )) {
1774 init_rpc_hdr_ba(&hdr_ba,
1775 RPC_MAX_PDU_FRAG_LEN,
1776 RPC_MAX_PDU_FRAG_LEN,
1777 assoc_gid,
1778 ack_pipe_name,
1779 0x1, 0x0, 0x0,
1780 &hdr_rb.rpc_context[0].transfer[0]);
1781 } else {
1782 /* Rejection reason: abstract syntax not supported */
1783 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1784 RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1785 ack_pipe_name, 0x1, 0x2, 0x1,
1786 &null_ndr_syntax_id);
1787 p->pipe_bound = False;
1788 }
1789
1790 /*
1791 * and marshall it.
1792 */
1793
1794 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1795 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1796 goto err_exit;
1797 }
1798
1799 /*
1800 * Create the header, now we know the length.
1801 */
1802
1803 if (prs_offset(&out_auth)) {
1804 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1805 }
1806
1807 init_rpc_hdr(&p->hdr, DCERPC_PKT_BIND_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1808 p->hdr.call_id,
1809 RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1810 auth_len);
1811
1812 /*
1813 * Marshall the header into the outgoing PDU.
1814 */
1815
1816 if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1817 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1818 goto err_exit;
1819 }
1820
1821 /*
1822 * Now add the RPC_HDR_BA and any auth needed.
1823 */
1824
1825 if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1826 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1827 goto err_exit;
1828 }
1829
1830 if (auth_len && !prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1831 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1832 goto err_exit;
1833 }
1834
1835 /*
1836 * Setup the lengths for the initial reply.
1837 */
1838
1839 p->out_data.data_sent_length = 0;
1840 p->out_data.current_pdu_sent = 0;
1841
1842 prs_mem_free(&out_hdr_ba);
1843 prs_mem_free(&out_auth);
1844
1845 return True;
1846
1847 err_exit:
1848
1849 prs_mem_free(&p->out_data.frag);
1850 prs_mem_free(&out_hdr_ba);
1851 prs_mem_free(&out_auth);
1852 return setup_bind_nak(p);
1853 }
1854
1855 /****************************************************************************
1856 Deal with an alter context call. Can be third part of 3 leg auth request for
1857 SPNEGO calls.
1858 ****************************************************************************/
1859
1860 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1861 {
1862 RPC_HDR_BA hdr_ba;
1863 RPC_HDR_RB hdr_rb;
1864 RPC_HDR_AUTH auth_info;
1865 uint16 assoc_gid;
1866 fstring ack_pipe_name;
1867 prs_struct out_hdr_ba;
1868 prs_struct out_auth;
1869 int auth_len = 0;
1870
1871 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1872
1873 /*
1874 * Marshall directly into the outgoing PDU space. We
1875 * must do this as we need to set to the bind response
1876 * header and are never sending more than one PDU here.
1877 */
1878
1879 /*
1880 * Setup the memory to marshall the ba header, and the
1881 * auth footers.
1882 */
1883
1884 if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1885 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1886 prs_mem_free(&p->out_data.frag);
1887 return False;
1888 }
1889
1890 if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1891 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1892 prs_mem_free(&p->out_data.frag);
1893 prs_mem_free(&out_hdr_ba);
1894 return False;
1895 }
1896
1897 ZERO_STRUCT(hdr_rb);
1898
1899 DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1900
1901 /* decode the alter context request */
1902 if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0)) {
1903 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1904 goto err_exit;
1905 }
1906
1907 /* secondary address CAN be NULL
1908 * as the specs say it's ignored.
1909 * It MUST be NULL to have the spoolss working.
1910 */
1911 fstrcpy(ack_pipe_name,"");
1912
1913 DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1914
1915 /*
1916 * Check if this is an authenticated alter context request.
1917 */
1918
1919 if (p->hdr.auth_len != 0) {
1920 /*
1921 * Decode the authentication verifier.
1922 */
1923
1924 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1925 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1926 goto err_exit;
1927 }
1928
1929 /*
1930 * Currently only the SPNEGO auth type uses the alter ctx
1931 * response in place of the NTLMSSP auth3 type.
1932 */
1933
1934 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
1935 /* We can only finish if the pipe is unbound. */
1936 if (!p->pipe_bound) {
1937 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1938 goto err_exit;
1939 }
1940 } else {
1941 goto err_exit;
1942 }
1943 }
1944 } else {
1945 ZERO_STRUCT(auth_info);
1946 }
1947
1948 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1949
1950 /*
1951 * Create the bind response struct.
1952 */
1953
1954 /* If the requested abstract synt uuid doesn't match our client pipe,
1955 reject the bind_ack & set the transfer interface synt to all 0's,
1956 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1957 unknown to NT4)
1958 Needed when adding entries to a DACL from NT5 - SK */
1959
1960 if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1961 hdr_rb.rpc_context[0].context_id )) {
1962 init_rpc_hdr_ba(&hdr_ba,
1963 RPC_MAX_PDU_FRAG_LEN,
1964 RPC_MAX_PDU_FRAG_LEN,
1965 assoc_gid,
1966 ack_pipe_name,
1967 0x1, 0x0, 0x0,
1968 &hdr_rb.rpc_context[0].transfer[0]);
1969 } else {
1970 /* Rejection reason: abstract syntax not supported */
1971 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1972 RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1973 ack_pipe_name, 0x1, 0x2, 0x1,
1974 &null_ndr_syntax_id);
1975 p->pipe_bound = False;
1976 }
1977
1978 /*
1979 * and marshall it.
1980 */
1981
1982 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1983 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1984 goto err_exit;
1985 }
1986
1987 /*
1988 * Create the header, now we know the length.
1989 */
1990
1991 if (prs_offset(&out_auth)) {
1992 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1993 }
1994
1995 init_rpc_hdr(&p->hdr, DCERPC_PKT_ALTER_RESP, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1996 p->hdr.call_id,
1997 RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1998 auth_len);
1999
2000 /*
2001 * Marshall the header into the outgoing PDU.
2002 */
2003
2004 if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
2005 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
2006 goto err_exit;
2007 }
2008
2009 /*
2010 * Now add the RPC_HDR_BA and any auth needed.
2011 */
2012
2013 if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
2014 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
2015 goto err_exit;
2016 }
2017
2018 if (auth_len && !prs_append_prs_data(&p->out_data.frag, &out_auth)) {
2019 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
2020 goto err_exit;
2021 }
2022
2023 /*
2024 * Setup the lengths for the initial reply.
2025 */
2026
2027 p->out_data.data_sent_length = 0;
2028 p->out_data.current_pdu_sent = 0;
2029
2030 prs_mem_free(&out_hdr_ba);
2031 prs_mem_free(&out_auth);
2032
2033 return True;
2034
2035 err_exit:
2036
2037 prs_mem_free(&p->out_data.frag);
2038 prs_mem_free(&out_hdr_ba);
2039 prs_mem_free(&out_auth);
2040 return setup_bind_nak(p);
2041 }
2042
2043 /****************************************************************************
2044 Deal with NTLMSSP sign & seal processing on an RPC request.
2045 ****************************************************************************/
2046
2047 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
2048 uint32 *p_ss_padding_len, NTSTATUS *pstatus)
2049 {
2050 RPC_HDR_AUTH auth_info;
2051 uint32 auth_len = p->hdr.auth_len;
2052 uint32 save_offset = prs_offset(rpc_in);
2053 AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
2054 unsigned char *data = NULL;
2055 size_t data_len;
2056 unsigned char *full_packet_data = NULL;
2057 size_t full_packet_data_len;
2058 DATA_BLOB auth_blob;
2059
2060 *pstatus = NT_STATUS_OK;
2061
2062 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_NONE || p->auth.auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
2063 return True;
2064 }
2065
2066 if (!a) {
2067 *pstatus = NT_STATUS_INVALID_PARAMETER;
2068 return False;
2069 }
2070
2071 /* Ensure there's enough data for an authenticated request. */
2072 if ((auth_len > RPC_MAX_SIGN_SIZE) ||
2073 (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
2074 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2075 (unsigned int)auth_len ));
2076 *pstatus = NT_STATUS_INVALID_PARAMETER;
2077 return False;
2078 }
2079
2080 /*
2081 * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2082 * after the RPC header.
2083 * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2084 * functions as NTLMv2 checks the rpc headers also.
2085 */
2086
2087 data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2088 data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2089
2090 full_packet_data = p->in_data.current_in_pdu;
2091 full_packet_data_len = p->hdr.frag_len - auth_len;
2092
2093 /* Pull the auth header and the following data into a blob. */
2094 if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2095 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
2096 (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
2097 *pstatus = NT_STATUS_INVALID_PARAMETER;
2098 return False;
2099 }
2100
2101 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2102 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
2103 *pstatus = NT_STATUS_INVALID_PARAMETER;
2104 return False;
2105 }
2106
2107 auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2108 auth_blob.length = auth_len;
2109
2110 switch (p->auth.auth_level) {
2111 case DCERPC_AUTH_LEVEL_PRIVACY:
2112 /* Data is encrypted. */
2113 *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
2114 data, data_len,
2115 full_packet_data,
2116 full_packet_data_len,
2117 &auth_blob);
2118 if (!NT_STATUS_IS_OK(*pstatus)) {
2119 return False;
2120 }
2121 break;
2122 case DCERPC_AUTH_LEVEL_INTEGRITY:
2123 /* Data is signed. */
2124 *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
2125 data, data_len,
2126 full_packet_data,
2127 full_packet_data_len,
2128 &auth_blob);
2129 if (!NT_STATUS_IS_OK(*pstatus)) {
2130 return False;
2131 }
2132 break;
2133 default:
2134 *pstatus = NT_STATUS_INVALID_PARAMETER;
2135 return False;
2136 }
2137
2138 /*
2139 * Return the current pointer to the data offset.
2140 */
2141
2142 if(!prs_set_offset(rpc_in, save_offset)) {
2143 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2144 (unsigned int)save_offset ));
2145 *pstatus = NT_STATUS_INVALID_PARAMETER;
2146 return False;
2147 }
2148
2149 /*
2150 * Remember the padding length. We must remove it from the real data
2151 * stream once the sign/seal is done.
2152 */
2153
2154 *p_ss_padding_len = auth_info.auth_pad_len;
2155
2156 return True;
2157 }
2158
2159 /****************************************************************************
2160 Deal with schannel processing on an RPC request.
2161 ****************************************************************************/
2162
2163 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2164 {
2165 uint32 data_len;
2166 uint32 auth_len;
2167 uint32 save_offset = prs_offset(rpc_in);
2168 RPC_HDR_AUTH auth_info;
2169 DATA_BLOB blob;
2170 NTSTATUS status;
2171 uint8_t *data;
2172
2173 auth_len = p->hdr.auth_len;
2174
2175 if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN ||
2176 auth_len > RPC_HEADER_LEN +
2177 RPC_HDR_REQ_LEN +
2178 RPC_HDR_AUTH_LEN +
2179 auth_len) {
2180 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2181 return False;
2182 }
2183
2184 /*
2185 * The following is that length of the data we must verify or unseal.
2186 * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2187 * preceeding the auth_data.
2188 */
2189
2190 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2191 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2192 (unsigned int)p->hdr.frag_len,
2193 (unsigned int)auth_len ));
2194 return False;
2195 }
2196
2197 data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2198 RPC_HDR_AUTH_LEN - auth_len;
2199
2200 DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2201
2202 if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2203 DEBUG(0,("cannot move offset to %u.\n",
2204 (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2205 return False;
2206 }
2207
2208 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2209 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2210 return False;
2211 }
2212
2213 if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
2214 DEBUG(0,("Invalid auth info %d on schannel\n",
2215 auth_info.auth_type));
2216 return False;
2217 }
2218
2219 blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), auth_len);
2220
2221 if (DEBUGLEVEL >= 10) {
2222 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
2223 }
2224
2225 data = (uint8_t *)prs_data_p(rpc_in)+RPC_HDR_REQ_LEN;
2226
2227 switch (auth_info.auth_level) {
2228 case DCERPC_AUTH_LEVEL_PRIVACY:
2229 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2230 talloc_tos(),
2231 true,
2232 data,
2233 data_len,
2234 &blob);
2235 break;
2236 case DCERPC_AUTH_LEVEL_INTEGRITY:
2237 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2238 talloc_tos(),
2239 false,
2240 data,
2241 data_len,
2242 &blob);
2243 break;
2244 default:
2245 status = NT_STATUS_INTERNAL_ERROR;
2246 break;
2247 }
2248
2249 if (!NT_STATUS_IS_OK(status)) {
2250 DEBUG(0,("failed to unseal packet: %s\n", nt_errstr(status)));
2251 return false;
2252 }
2253
2254 /*
2255 * Return the current pointer to the data offset.
2256 */
2257
2258 if(!prs_set_offset(rpc_in, save_offset)) {
2259 DEBUG(0,("failed to set offset back to %u\n",
2260 (unsigned int)save_offset ));
2261 return False;
2262 }
2263
2264 /*
2265 * Remember the padding length. We must remove it from the real data
2266 * stream once the sign/seal is done.
2267 */
2268
2269 *p_ss_padding_len = auth_info.auth_pad_len;
2270
2271 return True;
2272 }
2273
2274 /****************************************************************************
2275 Find the set of RPC functions associated with this context_id
2276 ****************************************************************************/
2277
2278 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2279 {
2280 PIPE_RPC_FNS *fns = NULL;
2281
2282 if ( !list ) {
2283 DEBUG(0,("find_pipe_fns_by_context: ERROR! No context list for pipe!\n"));
2284 return NULL;
2285 }
2286
2287 for (fns=list; fns; fns=fns->next ) {
2288 if ( fns->context_id == context_id )
2289 return fns;
2290 }
2291 return NULL;
2292 }
2293
2294 /****************************************************************************
2295 Memory cleanup.
2296 ****************************************************************************/
2297
2298 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2299 {
2300 PIPE_RPC_FNS *tmp = list;
2301 PIPE_RPC_FNS *tmp2;
2302
2303 while (tmp) {
2304 tmp2 = tmp->next;
2305 SAFE_FREE(tmp);
2306 tmp = tmp2;
2307 }
2308
2309 return;
2310 }
2311
2312 static bool api_rpcTNP(pipes_struct *p,
2313 const struct api_struct *api_rpc_cmds, int n_cmds);
2314
2315 /****************************************************************************
2316 Find the correct RPC function to call for this request.
2317 If the pipe is authenticated then become the correct UNIX user
2318 before doing the call.
2319 ****************************************************************************/
2320
2321 bool api_pipe_request(pipes_struct *p)
2322 {
2323 bool ret = False;
2324 bool changed_user = False;
2325 PIPE_RPC_FNS *pipe_fns;
2326
2327 if (p->pipe_bound &&
2328 ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2329 (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2330 if(!become_authenticated_pipe_user(p)) {
2331 prs_mem_free(&p->out_data.rdata);
2332 return False;
2333 }
2334 changed_user = True;
2335 }
2336
2337 DEBUG(5, ("Requested \\PIPE\\%s\n",
2338 get_pipe_name_from_iface(&p->syntax)));
2339
2340 /* get the set of RPC functions for this context */
2341
2342 pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2343
2344 if ( pipe_fns ) {
2345 TALLOC_CTX *frame = talloc_stackframe();
2346 ret = api_rpcTNP(p, pipe_fns->cmds, pipe_fns->n_cmds);
2347 TALLOC_FREE(frame);
2348 }
2349 else {
2350 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2351 p->hdr_req.context_id,
2352 get_pipe_name_from_iface(&p->syntax)));
2353 }
2354
2355 if (changed_user) {
2356 unbecome_authenticated_pipe_user();
2357 }
2358
2359 return ret;
2360 }
2361
2362 /*******************************************************************
2363 Calls the underlying RPC function for a named pipe.
2364 ********************************************************************/
2365
2366 static bool api_rpcTNP(pipes_struct *p,
2367 const struct api_struct *api_rpc_cmds, int n_cmds)
2368 {
2369 int fn_num;
2370 uint32 offset1, offset2;
2371
2372 /* interpret the command */
2373 DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2374 get_pipe_name_from_iface(&p->syntax), p->hdr_req.opnum));
2375
2376 if (DEBUGLEVEL >= 50) {
2377 fstring name;
2378 slprintf(name, sizeof(name)-1, "in_%s",
2379 get_pipe_name_from_iface(&p->syntax));
2380 prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2381 }
2382
2383 for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2384 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2385 DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2386 break;
2387 }
2388 }
2389
2390 if (fn_num == n_cmds) {
2391 /*
2392 * For an unknown RPC just return a fault PDU but
2393 * return True to allow RPC's on the pipe to continue
2394 * and not put the pipe into fault state. JRA.
2395 */
2396 DEBUG(4, ("unknown\n"));
2397 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2398 return True;
2399 }
2400
2401 offset1 = prs_offset(&p->out_data.rdata);
2402
2403 DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2404 fn_num, api_rpc_cmds[fn_num].fn));
2405 /* do the actual command */
2406 if(!api_rpc_cmds[fn_num].fn(p)) {
2407 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2408 get_pipe_name_from_iface(&p->syntax),
2409 api_rpc_cmds[fn_num].name));
2410 prs_mem_free(&p->out_data.rdata);
2411 return False;
2412 }
2413
2414 if (p->bad_handle_fault_state) {
2415 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2416 p->bad_handle_fault_state = False;
2417 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2418 return True;
2419 }
2420
2421 if (p->rng_fault_state) {
2422 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2423 p->rng_fault_state = False;
2424 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2425 return True;
2426 }
2427
2428 offset2 = prs_offset(&p->out_data.rdata);
2429 prs_set_offset(&p->out_data.rdata, offset1);
2430 if (DEBUGLEVEL >= 50) {
2431 fstring name;
2432 slprintf(name, sizeof(name)-1, "out_%s",
2433 get_pipe_name_from_iface(&p->syntax));
2434 prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2435 }
2436 prs_set_offset(&p->out_data.rdata, offset2);
2437
2438 DEBUG(5,("api_rpcTNP: called %s successfully\n",
2439 get_pipe_name_from_iface(&p->syntax)));
2440
2441 /* Check for buffer underflow in rpc parsing */
2442
2443 if ((DEBUGLEVEL >= 10) &&
2444 (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2445 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2446 char *data = (char *)SMB_MALLOC(data_len);
2447
2448 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2449 if (data) {
2450 prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2451 SAFE_FREE(data);
2452 }
2453
2454 }
2455
2456 return True;
2457 }
aatanasov's samba4 branch