source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "../librpc/gen_ndr/ndr_schannel.h"
  32 #include "../libcli/auth/schannel.h"
  33 #include "../libcli/auth/spnego.h"
  34 #include "../libcli/auth/ntlmssp.h"
  35
  36 #undef DBGC_CLASS
  37 #define DBGC_CLASS DBGC_RPC_SRV
  38
  39 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  40 {
  41         struct auth_ntlmssp_state *a = auth->a_u.auth_ntlmssp_state;
  42
  43         if (a) {
  44                 auth_ntlmssp_end(&a);
  45         }
  46         auth->a_u.auth_ntlmssp_state = NULL;
  47 }
  48
  49 static DATA_BLOB generic_session_key(void)
  50 {
  51         return data_blob("SystemLibraryDTC", 16);
  52 }
  53
  54 /*******************************************************************
  55  Generate the next PDU to be returned from the data in p->rdata.
  56  Handle NTLMSSP.
  57  ********************************************************************/
  58
  59 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  60 {
  61         RPC_HDR_RESP hdr_resp;
  62         uint32 ss_padding_len = 0;
  63         uint32 data_space_available;
  64         uint32 data_len_left;
  65         uint32 data_len;
  66         NTSTATUS status;
  67         DATA_BLOB auth_blob;
  68         RPC_HDR_AUTH auth_info;
  69         uint8 auth_type, auth_level;
  70         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
  71         TALLOC_CTX *frame;
  72
  73         /*
  74          * If we're in the fault state, keep returning fault PDU's until
  75          * the pipe gets closed. JRA.
  76          */
  77
  78         if(p->fault_state) {
  79                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  80                 return True;
  81         }
  82
  83         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  84
  85         /* Change the incoming request header to a response. */
  86         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
  87
  88         /* Set up rpc header flags. */
  89         if (p->out_data.data_sent_length == 0) {
  90                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
  91         } else {
  92                 p->hdr.flags = 0;
  93         }
  94
  95         /*
  96          * Work out how much we can fit in a single PDU.
  97          */
  98
  99         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 100
 101         /*
 102          * Ensure there really is data left to send.
 103          */
 104
 105         if(!data_len_left) {
 106                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 107                 return False;
 108         }
 109
 110         /* Space available - not including padding. */
 111         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN -
 112                 RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 113
 114         /*
 115          * The amount we send is the minimum of the available
 116          * space and the amount left to send.
 117          */
 118
 119         data_len = MIN(data_len_left, data_space_available);
 120
 121         /* Work out any padding alignment requirements. */
 122         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 123                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 124                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 125                 DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 126                         ss_padding_len ));
 127                 /* If we're over filling the packet, we need to make space
 128                  * for the padding at the end of the data. */
 129                 if (data_len + ss_padding_len > data_space_available) {
 130                         data_len -= SERVER_NDR_PADDING_SIZE;
 131                 }
 132         }
 133
 134         /*
 135          * Set up the alloc hint. This should be the data left to
 136          * send.
 137          */
 138
 139         hdr_resp.alloc_hint = data_len_left;
 140
 141         /*
 142          * Work out if this PDU will be the last.
 143          */
 144
 145         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 146                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 147         }
 148
 149         /*
 150          * Set up the header lengths.
 151          */
 152
 153         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 154                         data_len + ss_padding_len +
 155                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 156         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 157
 158
 159         /*
 160          * Init the parse struct to point at the outgoing
 161          * data.
 162          */
 163
 164         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 165
 166         /* Store the header in the data stream. */
 167         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 168                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 169                 prs_mem_free(&p->out_data.frag);
 170                 return False;
 171         }
 172
 173         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 174                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 175                 prs_mem_free(&p->out_data.frag);
 176                 return False;
 177         }
 178
 179         /* Copy the data into the PDU. */
 180
 181         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 182                                      p->out_data.data_sent_length, data_len)) {
 183                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 184                 prs_mem_free(&p->out_data.frag);
 185                 return False;
 186         }
 187
 188         /* Copy the sign/seal padding data. */
 189         if (ss_padding_len) {
 190                 char pad[SERVER_NDR_PADDING_SIZE];
 191
 192                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 193                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 194                                       ss_padding_len)) {
 195                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 196                                         (unsigned int)ss_padding_len));
 197                         prs_mem_free(&p->out_data.frag);
 198                         return False;
 199                 }
 200         }
 201
 202
 203         /* Now write out the auth header and null blob. */
 204         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 205                 auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 206         } else {
 207                 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 208         }
 209         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 210                 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 211         } else {
 212                 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 213         }
 214
 215         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 216
 217         if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 218                                 &p->out_data.frag, 0)) {
 219                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 220                 prs_mem_free(&p->out_data.frag);
 221                 return False;
 222         }
 223
 224         /* Generate the sign blob. */
 225
 226         frame = talloc_stackframe();
 227         switch (p->auth.auth_level) {
 228                 case DCERPC_AUTH_LEVEL_PRIVACY:
 229                         /* Data portion is encrypted. */
 230                         status = auth_ntlmssp_seal_packet(
 231                                 a, frame,
 232                                 (uint8_t *)prs_data_p(&p->out_data.frag)
 233                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 234                                 data_len + ss_padding_len,
 235                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 236                                 (size_t)prs_offset(&p->out_data.frag),
 237                                 &auth_blob);
 238                         if (!NT_STATUS_IS_OK(status)) {
 239                                 talloc_free(frame);
 240                                 prs_mem_free(&p->out_data.frag);
 241                                 return False;
 242                         }
 243                         break;
 244                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 245                         /* Data is signed. */
 246                         status = auth_ntlmssp_sign_packet(
 247                                 a, frame,
 248                                 (unsigned char *)prs_data_p(&p->out_data.frag)
 249                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 250                                 data_len + ss_padding_len,
 251                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 252                                 (size_t)prs_offset(&p->out_data.frag),
 253                                 &auth_blob);
 254                         if (!NT_STATUS_IS_OK(status)) {
 255                                 talloc_free(frame);
 256                                 prs_mem_free(&p->out_data.frag);
 257                                 return False;
 258                         }
 259                         break;
 260                 default:
 261                         talloc_free(frame);
 262                         prs_mem_free(&p->out_data.frag);
 263                         return False;
 264         }
 265
 266         /* Append the auth blob. */
 267         if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
 268                               NTLMSSP_SIG_SIZE)) {
 269                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 270                                 (unsigned int)NTLMSSP_SIG_SIZE));
 271                 talloc_free(frame);
 272                 prs_mem_free(&p->out_data.frag);
 273                 return False;
 274         }
 275         talloc_free(frame);
 276
 277         /*
 278          * Setup the counts for this PDU.
 279          */
 280
 281         p->out_data.data_sent_length += data_len;
 282         p->out_data.current_pdu_sent = 0;
 283
 284         return True;
 285 }
 286
 287 /*******************************************************************
 288  Generate the next PDU to be returned from the data in p->rdata.
 289  Return an schannel authenticated fragment.
 290  ********************************************************************/
 291
 292 static bool create_next_pdu_schannel(pipes_struct *p)
 293 {
 294         RPC_HDR_RESP hdr_resp;
 295         uint32 ss_padding_len = 0;
 296         uint32 data_len;
 297         uint32 data_space_available;
 298         uint32 data_len_left;
 299         uint32 data_pos;
 300         NTSTATUS status;
 301
 302         /*
 303          * If we're in the fault state, keep returning fault PDU's until
 304          * the pipe gets closed. JRA.
 305          */
 306
 307         if(p->fault_state) {
 308                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 309                 return True;
 310         }
 311
 312         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 313
 314         /* Change the incoming request header to a response. */
 315         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
 316
 317         /* Set up rpc header flags. */
 318         if (p->out_data.data_sent_length == 0) {
 319                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
 320         } else {
 321                 p->hdr.flags = 0;
 322         }
 323
 324         /*
 325          * Work out how much we can fit in a single PDU.
 326          */
 327
 328         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 329
 330         /*
 331          * Ensure there really is data left to send.
 332          */
 333
 334         if(!data_len_left) {
 335                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 336                 return False;
 337         }
 338
 339         /* Space available - not including padding. */
 340         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 341                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
 342                 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 343
 344         /*
 345          * The amount we send is the minimum of the available
 346          * space and the amount left to send.
 347          */
 348
 349         data_len = MIN(data_len_left, data_space_available);
 350
 351         /* Work out any padding alignment requirements. */
 352         if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
 353                 ss_padding_len = SERVER_NDR_PADDING_SIZE -
 354                         ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
 355                 DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 356                         ss_padding_len ));
 357                 /* If we're over filling the packet, we need to make space
 358                  * for the padding at the end of the data. */
 359                 if (data_len + ss_padding_len > data_space_available) {
 360                         data_len -= SERVER_NDR_PADDING_SIZE;
 361                 }
 362         }
 363
 364         /*
 365          * Set up the alloc hint. This should be the data left to
 366          * send.
 367          */
 368
 369         hdr_resp.alloc_hint = data_len_left;
 370
 371         /*
 372          * Work out if this PDU will be the last.
 373          */
 374
 375         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 376                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 377         }
 378
 379         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 380                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 381         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 382
 383         /*
 384          * Init the parse struct to point at the outgoing
 385          * data.
 386          */
 387
 388         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 389
 390         /* Store the header in the data stream. */
 391         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 392                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 393                 prs_mem_free(&p->out_data.frag);
 394                 return False;
 395         }
 396
 397         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 398                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 399                 prs_mem_free(&p->out_data.frag);
 400                 return False;
 401         }
 402
 403         /* Store the current offset. */
 404         data_pos = prs_offset(&p->out_data.frag);
 405
 406         /* Copy the data into the PDU. */
 407
 408         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 409                                      p->out_data.data_sent_length, data_len)) {
 410                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 411                 prs_mem_free(&p->out_data.frag);
 412                 return False;
 413         }
 414
 415         /* Copy the sign/seal padding data. */
 416         if (ss_padding_len) {
 417                 char pad[SERVER_NDR_PADDING_SIZE];
 418                 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
 419                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 420                                       ss_padding_len)) {
 421                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 422                         prs_mem_free(&p->out_data.frag);
 423                         return False;
 424                 }
 425         }
 426
 427         {
 428                 /*
 429                  * Schannel processing.
 430                  */
 431                 RPC_HDR_AUTH auth_info;
 432                 DATA_BLOB blob;
 433                 uint8_t *data;
 434
 435                 /* Check it's the type of reply we were expecting to decode */
 436
 437                 init_rpc_hdr_auth(&auth_info,
 438                                 DCERPC_AUTH_TYPE_SCHANNEL,
 439                                 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
 440                                         DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
 441                                 ss_padding_len, 1);
 442
 443                 if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 444                                         &p->out_data.frag, 0)) {
 445                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 446                         prs_mem_free(&p->out_data.frag);
 447                         return False;
 448                 }
 449
 450                 data = (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos;
 451
 452                 switch (p->auth.auth_level) {
 453                 case DCERPC_AUTH_LEVEL_PRIVACY:
 454                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 455                                                         talloc_tos(),
 456                                                         true,
 457                                                         data,
 458                                                         data_len + ss_padding_len,
 459                                                         &blob);
 460                         break;
 461                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 462                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 463                                                         talloc_tos(),
 464                                                         false,
 465                                                         data,
 466                                                         data_len + ss_padding_len,
 467                                                         &blob);
 468                         break;
 469                 default:
 470                         status = NT_STATUS_INTERNAL_ERROR;
 471                         break;
 472                 }
 473
 474                 if (!NT_STATUS_IS_OK(status)) {
 475                         DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
 476                                 nt_errstr(status)));
 477                         prs_mem_free(&p->out_data.frag);
 478                         return false;
 479                 }
 480
 481                 /* Finally marshall the blob. */
 482
 483                 if (DEBUGLEVEL >= 10) {
 484                         dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
 485                 }
 486
 487                 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
 488                         prs_mem_free(&p->out_data.frag);
 489                         return false;
 490                 }
 491         }
 492
 493         /*
 494          * Setup the counts for this PDU.
 495          */
 496
 497         p->out_data.data_sent_length += data_len;
 498         p->out_data.current_pdu_sent = 0;
 499
 500         return True;
 501 }
 502
 503 /*******************************************************************
 504  Generate the next PDU to be returned from the data in p->rdata.
 505  No authentication done.
 506 ********************************************************************/
 507
 508 static bool create_next_pdu_noauth(pipes_struct *p)
 509 {
 510         RPC_HDR_RESP hdr_resp;
 511         uint32 data_len;
 512         uint32 data_space_available;
 513         uint32 data_len_left;
 514
 515         /*
 516          * If we're in the fault state, keep returning fault PDU's until
 517          * the pipe gets closed. JRA.
 518          */
 519
 520         if(p->fault_state) {
 521                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 522                 return True;
 523         }
 524
 525         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 526
 527         /* Change the incoming request header to a response. */
 528         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
 529
 530         /* Set up rpc header flags. */
 531         if (p->out_data.data_sent_length == 0) {
 532                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
 533         } else {
 534                 p->hdr.flags = 0;
 535         }
 536
 537         /*
 538          * Work out how much we can fit in a single PDU.
 539          */
 540
 541         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 542
 543         /*
 544          * Ensure there really is data left to send.
 545          */
 546
 547         if(!data_len_left) {
 548                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 549                 return False;
 550         }
 551
 552         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 553                 - RPC_HDR_RESP_LEN;
 554
 555         /*
 556          * The amount we send is the minimum of the available
 557          * space and the amount left to send.
 558          */
 559
 560         data_len = MIN(data_len_left, data_space_available);
 561
 562         /*
 563          * Set up the alloc hint. This should be the data left to
 564          * send.
 565          */
 566
 567         hdr_resp.alloc_hint = data_len_left;
 568
 569         /*
 570          * Work out if this PDU will be the last.
 571          */
 572
 573         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 574                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 575         }
 576
 577         /*
 578          * Set up the header lengths.
 579          */
 580
 581         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 582         p->hdr.auth_len = 0;
 583
 584         /*
 585          * Init the parse struct to point at the outgoing
 586          * data.
 587          */
 588
 589         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 590
 591         /* Store the header in the data stream. */
 592         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 593                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 594                 prs_mem_free(&p->out_data.frag);
 595                 return False;
 596         }
 597
 598         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 599                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 600                 prs_mem_free(&p->out_data.frag);
 601                 return False;
 602         }
 603
 604         /* Copy the data into the PDU. */
 605
 606         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 607                                      p->out_data.data_sent_length, data_len)) {
 608                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 609                 prs_mem_free(&p->out_data.frag);
 610                 return False;
 611         }
 612
 613         /*
 614          * Setup the counts for this PDU.
 615          */
 616
 617         p->out_data.data_sent_length += data_len;
 618         p->out_data.current_pdu_sent = 0;
 619
 620         return True;
 621 }
 622
 623 /*******************************************************************
 624  Generate the next PDU to be returned from the data in p->rdata.
 625 ********************************************************************/
 626
 627 bool create_next_pdu(pipes_struct *p)
 628 {
 629         switch(p->auth.auth_level) {
 630                 case DCERPC_AUTH_LEVEL_NONE:
 631                 case DCERPC_AUTH_LEVEL_CONNECT:
 632                         /* This is incorrect for auth level connect. Fixme. JRA */
 633                         return create_next_pdu_noauth(p);
 634
 635                 default:
 636                         switch(p->auth.auth_type) {
 637                                 case PIPE_AUTH_TYPE_NTLMSSP:
 638                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 639                                         return create_next_pdu_ntlmssp(p);
 640                                 case PIPE_AUTH_TYPE_SCHANNEL:
 641                                         return create_next_pdu_schannel(p);
 642                                 default:
 643                                         break;
 644                         }
 645         }
 646
 647         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 648                         (unsigned int)p->auth.auth_level,
 649                         (unsigned int)p->auth.auth_type));
 650         return False;
 651 }
 652
 653 /*******************************************************************
 654  Process an NTLMSSP authentication response.
 655  If this function succeeds, the user has been authenticated
 656  and their domain, name and calling workstation stored in
 657  the pipe struct.
 658 *******************************************************************/
 659
 660 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 661 {
 662         DATA_BLOB session_key, reply;
 663         NTSTATUS status;
 664         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
 665         bool ret;
 666
 667         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
 668                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 669
 670         ZERO_STRUCT(reply);
 671
 672         /* this has to be done as root in order to verify the password */
 673         become_root();
 674         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 675         unbecome_root();
 676
 677         /* Don't generate a reply. */
 678         data_blob_free(&reply);
 679
 680         if (!NT_STATUS_IS_OK(status)) {
 681                 return False;
 682         }
 683
 684         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 685            ensure the underlying NTLMSSP flags are also set. If not we should
 686            refuse the bind. */
 687
 688         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
 689                 if (!auth_ntlmssp_negotiated_sign(a)) {
 690                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 691                                 "but client declined signing.\n",
 692                                  get_pipe_name_from_syntax(talloc_tos(),
 693                                                            &p->syntax)));
 694                         return False;
 695                 }
 696         }
 697         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 698                 if (!auth_ntlmssp_negotiated_seal(a)) {
 699                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 700                                 "but client declined sealing.\n",
 701                                  get_pipe_name_from_syntax(talloc_tos(),
 702                                                            &p->syntax)));
 703                         return False;
 704                 }
 705         }
 706
 707         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 708                   "workstation: %s\n",
 709                   auth_ntlmssp_get_username(a),
 710                   auth_ntlmssp_get_domain(a),
 711                   auth_ntlmssp_get_client(a)));
 712
 713         TALLOC_FREE(p->server_info);
 714
 715         p->server_info = auth_ntlmssp_server_info(p, a);
 716         if (p->server_info == NULL) {
 717                 DEBUG(0, ("auth_ntlmssp_server_info failed to obtain the server info for authenticated user\n"));
 718                 return false;
 719         }
 720
 721         if (p->server_info->ptok == NULL) {
 722                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 723                 return False;
 724         }
 725
 726         /*
 727          * We're an authenticated bind over smb, so the session key needs to
 728          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 729          * does. See the RPC-SAMBA3SESSIONKEY.
 730          */
 731
 732         session_key = generic_session_key();
 733         if (session_key.data == NULL) {
 734                 return False;
 735         }
 736
 737         ret = server_info_set_session_key(p->server_info, session_key);
 738
 739         data_blob_free(&session_key);
 740
 741         return True;
 742 }
 743
 744 /*******************************************************************
 745  The switch table for the pipe names and the functions to handle them.
 746 *******************************************************************/
 747
 748 struct rpc_table {
 749         struct {
 750                 const char *clnt;
 751                 const char *srv;
 752         } pipe;
 753         struct ndr_syntax_id rpc_interface;
 754         const struct api_struct *cmds;
 755         int n_cmds;
 756 };
 757
 758 static struct rpc_table *rpc_lookup;
 759 static int rpc_lookup_size;
 760
 761 /*******************************************************************
 762  This is the "stage3" NTLMSSP response after a bind request and reply.
 763 *******************************************************************/
 764
 765 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 766 {
 767         RPC_HDR_AUTH auth_info;
 768         uint32 pad = 0;
 769         DATA_BLOB blob;
 770         uint32_t auth_len = p->hdr.auth_len;
 771
 772         ZERO_STRUCT(blob);
 773
 774         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 775
 776         if (auth_len == 0) {
 777                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 778                 goto err;
 779         }
 780
 781         /* 4 bytes padding. */
 782         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 783                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 784                 goto err;
 785         }
 786
 787         /* Ensure there's enough data for an authenticated request. */
 788         if (RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + auth_len >
 789                                 p->hdr.frag_len) {
 790                         DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
 791                                 "%u is too large.\n",
 792                         (unsigned int)auth_len ));
 793                 goto err;
 794         }
 795
 796         /*
 797          * Decode the authentication verifier response.
 798          */
 799
 800         /* Pull the auth header and the following data into a blob. */
 801         /* NB. The offset of the auth_header is relative to the *end*
 802          * of the packet, not the start. Also, the length of the
 803          * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
 804          * as the RPC header isn't included in rpc_in_p. */
 805         if(!prs_set_offset(rpc_in_p,
 806                         p->hdr.frag_len - RPC_HEADER_LEN -
 807                         RPC_HDR_AUTH_LEN - auth_len)) {
 808                 DEBUG(0,("api_pipe_bind_auth3: cannot move "
 809                         "offset to %u.\n",
 810                         (unsigned int)(p->hdr.frag_len -
 811                                 RPC_HDR_AUTH_LEN - auth_len) ));
 812                 goto err;
 813         }
 814
 815         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in_p, 0)) {
 816                 DEBUG(0,("api_pipe_bind_auth3: failed to "
 817                         "unmarshall RPC_HDR_AUTH.\n"));
 818                 goto err;
 819         }
 820
 821         /* We must NEVER look at auth_info->auth_pad_len here,
 822          * as old Samba client code gets it wrong and sends it
 823          * as zero. JRA.
 824          */
 825
 826         if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
 827                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 828                         (unsigned int)auth_info.auth_type ));
 829                 return False;
 830         }
 831
 832         blob = data_blob(NULL,p->hdr.auth_len);
 833
 834         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 835                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 836                         (unsigned int)p->hdr.auth_len ));
 837                 goto err;
 838         }
 839
 840         /*
 841          * The following call actually checks the challenge/response data.
 842          * for correctness against the given DOMAIN\user name.
 843          */
 844
 845         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 846                 goto err;
 847         }
 848
 849         data_blob_free(&blob);
 850
 851         p->pipe_bound = True;
 852
 853         return True;
 854
 855  err:
 856
 857         data_blob_free(&blob);
 858         free_pipe_ntlmssp_auth_data(&p->auth);
 859         p->auth.a_u.auth_ntlmssp_state = NULL;
 860
 861         return False;
 862 }
 863
 864 /*******************************************************************
 865  Marshall a bind_nak pdu.
 866 *******************************************************************/
 867
 868 static bool setup_bind_nak(pipes_struct *p)
 869 {
 870         RPC_HDR nak_hdr;
 871         uint16 zero = 0;
 872
 873         /* Free any memory in the current return data buffer. */
 874         prs_mem_free(&p->out_data.rdata);
 875
 876         /*
 877          * Marshall directly into the outgoing PDU space. We
 878          * must do this as we need to set to the bind response
 879          * header and are never sending more than one PDU here.
 880          */
 881
 882         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 883
 884         /*
 885          * Initialize a bind_nak header.
 886          */
 887
 888         init_rpc_hdr(&nak_hdr, DCERPC_PKT_BIND_NAK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
 889                 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 890
 891         /*
 892          * Marshall the header into the outgoing PDU.
 893          */
 894
 895         if(!smb_io_rpc_hdr("", &nak_hdr, &p->out_data.frag, 0)) {
 896                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 897                 prs_mem_free(&p->out_data.frag);
 898                 return False;
 899         }
 900
 901         /*
 902          * Now add the reject reason.
 903          */
 904
 905         if(!prs_uint16("reject code", &p->out_data.frag, 0, &zero)) {
 906                 prs_mem_free(&p->out_data.frag);
 907                 return False;
 908         }
 909
 910         p->out_data.data_sent_length = 0;
 911         p->out_data.current_pdu_sent = 0;
 912
 913         if (p->auth.auth_data_free_func) {
 914                 (*p->auth.auth_data_free_func)(&p->auth);
 915         }
 916         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 917         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 918         p->pipe_bound = False;
 919
 920         return True;
 921 }
 922
 923 /*******************************************************************
 924  Marshall a fault pdu.
 925 *******************************************************************/
 926
 927 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 928 {
 929         RPC_HDR fault_hdr;
 930         RPC_HDR_RESP hdr_resp;
 931         RPC_HDR_FAULT fault_resp;
 932
 933         /* Free any memory in the current return data buffer. */
 934         prs_mem_free(&p->out_data.rdata);
 935
 936         /*
 937          * Marshall directly into the outgoing PDU space. We
 938          * must do this as we need to set to the bind response
 939          * header and are never sending more than one PDU here.
 940          */
 941
 942         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 943
 944         /*
 945          * Initialize a fault header.
 946          */
 947
 948         init_rpc_hdr(&fault_hdr, DCERPC_PKT_FAULT, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST | DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 949             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 950
 951         /*
 952          * Initialize the HDR_RESP and FAULT parts of the PDU.
 953          */
 954
 955         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 956
 957         fault_resp.status = status;
 958         fault_resp.reserved = 0;
 959
 960         /*
 961          * Marshall the header into the outgoing PDU.
 962          */
 963
 964         if(!smb_io_rpc_hdr("", &fault_hdr, &p->out_data.frag, 0)) {
 965                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 966                 prs_mem_free(&p->out_data.frag);
 967                 return False;
 968         }
 969
 970         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 971                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 972                 prs_mem_free(&p->out_data.frag);
 973                 return False;
 974         }
 975
 976         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &p->out_data.frag, 0)) {
 977                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 978                 prs_mem_free(&p->out_data.frag);
 979                 return False;
 980         }
 981
 982         p->out_data.data_sent_length = 0;
 983         p->out_data.current_pdu_sent = 0;
 984
 985         return True;
 986 }
 987
 988 #if 0
 989 /*******************************************************************
 990  Marshall a cancel_ack pdu.
 991  We should probably check the auth-verifier here.
 992 *******************************************************************/
 993
 994 bool setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
 995 {
 996         prs_struct outgoing_pdu;
 997         RPC_HDR ack_reply_hdr;
 998
 999         /* Free any memory in the current return data buffer. */
1000         prs_mem_free(&p->out_data.rdata);
1001
1002         /*
1003          * Marshall directly into the outgoing PDU space. We
1004          * must do this as we need to set to the bind response
1005          * header and are never sending more than one PDU here.
1006          */
1007
1008         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
1009         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1010
1011         /*
1012          * Initialize a cancel_ack header.
1013          */
1014
1015         init_rpc_hdr(&ack_reply_hdr, DCERPC_PKT_CANCEL_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1016                         p->hdr.call_id, RPC_HEADER_LEN, 0);
1017
1018         /*
1019          * Marshall the header into the outgoing PDU.
1020          */
1021
1022         if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
1023                 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
1024                 prs_mem_free(&outgoing_pdu);
1025                 return False;
1026         }
1027
1028         p->out_data.data_sent_length = 0;
1029         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
1030         p->out_data.current_pdu_sent = 0;
1031
1032         prs_mem_free(&outgoing_pdu);
1033         return True;
1034 }
1035 #endif
1036
1037 /*******************************************************************
1038  Ensure a bind request has the correct abstract & transfer interface.
1039  Used to reject unknown binds from Win2k.
1040 *******************************************************************/
1041
1042 static bool check_bind_req(struct pipes_struct *p,
1043                            struct ndr_syntax_id* abstract,
1044                            struct ndr_syntax_id* transfer,
1045                            uint32 context_id)
1046 {
1047         int i=0;
1048         struct pipe_rpc_fns *context_fns;
1049
1050         DEBUG(3,("check_bind_req for %s\n",
1051                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1052
1053         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
1054
1055         for (i=0; i<rpc_lookup_size; i++) {
1056                 DEBUGADD(10, ("checking %s\n", rpc_lookup[i].pipe.clnt));
1057                 if (ndr_syntax_id_equal(
1058                             abstract, &rpc_lookup[i].rpc_interface)
1059                     && ndr_syntax_id_equal(
1060                             transfer, &ndr_transfer_syntax)) {
1061                         break;
1062                 }
1063         }
1064
1065         if (i == rpc_lookup_size) {
1066                 return false;
1067         }
1068
1069         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
1070         if (context_fns == NULL) {
1071                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
1072                 return False;
1073         }
1074
1075         context_fns->cmds = rpc_lookup[i].cmds;
1076         context_fns->n_cmds = rpc_lookup[i].n_cmds;
1077         context_fns->context_id = context_id;
1078
1079         /* add to the list of open contexts */
1080
1081         DLIST_ADD( p->contexts, context_fns );
1082
1083         return True;
1084 }
1085
1086 /*******************************************************************
1087  Register commands to an RPC pipe
1088 *******************************************************************/
1089
1090 NTSTATUS rpc_srv_register(int version, const char *clnt, const char *srv,
1091                           const struct ndr_interface_table *iface,
1092                           const struct api_struct *cmds, int size)
1093 {
1094         struct rpc_table *rpc_entry;
1095
1096         if (!clnt || !srv || !cmds) {
1097                 return NT_STATUS_INVALID_PARAMETER;
1098         }
1099
1100         if (version != SMB_RPC_INTERFACE_VERSION) {
1101                 DEBUG(0,("Can't register rpc commands!\n"
1102                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1103                          ", while this version of samba uses version %d!\n",
1104                          version,SMB_RPC_INTERFACE_VERSION));
1105                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1106         }
1107
1108         /* TODO:
1109          *
1110          * we still need to make sure that don't register the same commands twice!!!
1111          *
1112          * --metze
1113          */
1114
1115         /* We use a temporary variable because this call can fail and
1116            rpc_lookup will still be valid afterwards.  It could then succeed if
1117            called again later */
1118         rpc_lookup_size++;
1119         rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1120         if (NULL == rpc_entry) {
1121                 rpc_lookup_size--;
1122                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1123                 return NT_STATUS_NO_MEMORY;
1124         } else {
1125                 rpc_lookup = rpc_entry;
1126         }
1127
1128         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1129         ZERO_STRUCTP(rpc_entry);
1130         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1131         rpc_entry->pipe.srv = SMB_STRDUP(srv);
1132         rpc_entry->rpc_interface = iface->syntax_id;
1133         rpc_entry->cmds = cmds;
1134         rpc_entry->n_cmds = size;
1135
1136         return NT_STATUS_OK;
1137 }
1138
1139 /**
1140  * Is a named pipe known?
1141  * @param[in] cli_filename      The pipe name requested by the client
1142  * @result                      Do we want to serve this?
1143  */
1144 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1145 {
1146         const char *pipename = cli_filename;
1147         int i;
1148         NTSTATUS status;
1149
1150         if (strnequal(pipename, "\\PIPE\\", 6)) {
1151                 pipename += 5;
1152         }
1153
1154         if (*pipename == '\\') {
1155                 pipename += 1;
1156         }
1157
1158         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1159                 DEBUG(10, ("refusing spoolss access\n"));
1160                 return false;
1161         }
1162
1163         for (i=0; i<rpc_lookup_size; i++) {
1164                 if (strequal(pipename, rpc_lookup[i].pipe.clnt)) {
1165                         *syntax = rpc_lookup[i].rpc_interface;
1166                         return true;
1167                 }
1168         }
1169
1170         status = smb_probe_module("rpc", pipename);
1171         if (!NT_STATUS_IS_OK(status)) {
1172                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1173                 return false;
1174         }
1175         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
1176
1177         /*
1178          * Scan the list again for the interface id
1179          */
1180
1181         for (i=0; i<rpc_lookup_size; i++) {
1182                 if (strequal(pipename, rpc_lookup[i].pipe.clnt)) {
1183                         *syntax = rpc_lookup[i].rpc_interface;
1184                         return true;
1185                 }
1186         }
1187
1188         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
1189                    pipename));
1190
1191         return false;
1192 }
1193
1194 /*******************************************************************
1195  Handle a SPNEGO krb5 bind auth.
1196 *******************************************************************/
1197
1198 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1199                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1200 {
1201         return False;
1202 }
1203
1204 /*******************************************************************
1205  Handle the first part of a SPNEGO bind auth.
1206 *******************************************************************/
1207
1208 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1209                                         uint32_t ss_padding_len,
1210                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1211 {
1212         DATA_BLOB blob;
1213         DATA_BLOB secblob;
1214         DATA_BLOB response;
1215         DATA_BLOB chal;
1216         char *OIDs[ASN1_MAX_OIDS];
1217         int i;
1218         NTSTATUS status;
1219         bool got_kerberos_mechanism = false;
1220         struct auth_ntlmssp_state *a = NULL;
1221         RPC_HDR_AUTH auth_info;
1222
1223         ZERO_STRUCT(secblob);
1224         ZERO_STRUCT(chal);
1225         ZERO_STRUCT(response);
1226
1227         /* Grab the SPNEGO blob. */
1228         blob = data_blob(NULL,p->hdr.auth_len);
1229
1230         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1231                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1232                         (unsigned int)p->hdr.auth_len ));
1233                 goto err;
1234         }
1235
1236         if (blob.data[0] != ASN1_APPLICATION(0)) {
1237                 goto err;
1238         }
1239
1240         /* parse out the OIDs and the first sec blob */
1241         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1242                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1243                 goto err;
1244         }
1245
1246         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1247                 got_kerberos_mechanism = true;
1248         }
1249
1250         for (i=0;OIDs[i];i++) {
1251                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1252                 TALLOC_FREE(OIDs[i]);
1253         }
1254         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1255
1256         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1257                 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1258                 data_blob_free(&secblob);
1259                 data_blob_free(&blob);
1260                 return ret;
1261         }
1262
1263         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1264                 /* Free any previous auth type. */
1265                 free_pipe_ntlmssp_auth_data(&p->auth);
1266         }
1267
1268         if (!got_kerberos_mechanism) {
1269                 /* Initialize the NTLM engine. */
1270                 status = auth_ntlmssp_start(&a);
1271                 if (!NT_STATUS_IS_OK(status)) {
1272                         goto err;
1273                 }
1274
1275                 /*
1276                  * Pass the first security blob of data to it.
1277                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1278                  * which means we need another packet to complete the bind.
1279                  */
1280
1281                 status = auth_ntlmssp_update(a, secblob, &chal);
1282
1283                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1284                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1285                         goto err;
1286                 }
1287
1288                 /* Generate the response blob we need for step 2 of the bind. */
1289                 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1290         } else {
1291                 /*
1292                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1293                  * code to process follow-up packets is not complete
1294                  * yet. JRA.
1295                  */
1296                 response = spnego_gen_auth_response(NULL,
1297                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1298                                         OID_NTLMSSP);
1299         }
1300
1301         /* auth_pad_len will be handled by the caller */
1302
1303         /* Copy the blob into the pout_auth parse struct */
1304         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1305                         pauth_info->auth_level, ss_padding_len, 1);
1306         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1307                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1308                 goto err;
1309         }
1310
1311         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1312                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1313                 goto err;
1314         }
1315
1316         p->auth.a_u.auth_ntlmssp_state = a;
1317         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1318         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1319
1320         data_blob_free(&blob);
1321         data_blob_free(&secblob);
1322         data_blob_free(&chal);
1323         data_blob_free(&response);
1324
1325         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1326         return True;
1327
1328  err:
1329
1330         data_blob_free(&blob);
1331         data_blob_free(&secblob);
1332         data_blob_free(&chal);
1333         data_blob_free(&response);
1334
1335         p->auth.a_u.auth_ntlmssp_state = NULL;
1336
1337         return False;
1338 }
1339
1340 /*******************************************************************
1341  Handle the second part of a SPNEGO bind auth.
1342 *******************************************************************/
1343
1344 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1345                                 uint32_t ss_padding_len,
1346                                 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1347 {
1348         RPC_HDR_AUTH auth_info;
1349         DATA_BLOB spnego_blob;
1350         DATA_BLOB auth_blob;
1351         DATA_BLOB auth_reply;
1352         DATA_BLOB response;
1353         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
1354
1355         ZERO_STRUCT(spnego_blob);
1356         ZERO_STRUCT(auth_blob);
1357         ZERO_STRUCT(auth_reply);
1358         ZERO_STRUCT(response);
1359
1360         /*
1361          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1362          * fail here as 'a' == NULL.
1363          */
1364         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1365                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1366                 goto err;
1367         }
1368
1369         /* Grab the SPNEGO blob. */
1370         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1371
1372         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1373                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1374                         (unsigned int)p->hdr.auth_len ));
1375                 goto err;
1376         }
1377
1378         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1379                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1380                 goto err;
1381         }
1382
1383         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1384                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1385                 goto err;
1386         }
1387
1388         /*
1389          * The following call actually checks the challenge/response data.
1390          * for correctness against the given DOMAIN\user name.
1391          */
1392
1393         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1394                 goto err;
1395         }
1396
1397         data_blob_free(&spnego_blob);
1398         data_blob_free(&auth_blob);
1399
1400         /* Generate the spnego "accept completed" blob - no incoming data. */
1401         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1402
1403         /* FIXME - add auth_pad_len here ! */
1404
1405         /* Copy the blob into the pout_auth parse struct */
1406         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1407                         pauth_info->auth_level, ss_padding_len, 1);
1408         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1409                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1410                 goto err;
1411         }
1412
1413         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1414                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1415                 goto err;
1416         }
1417
1418         data_blob_free(&auth_reply);
1419         data_blob_free(&response);
1420
1421         p->pipe_bound = True;
1422
1423         return True;
1424
1425  err:
1426
1427         data_blob_free(&spnego_blob);
1428         data_blob_free(&auth_blob);
1429         data_blob_free(&auth_reply);
1430         data_blob_free(&response);
1431
1432         free_pipe_ntlmssp_auth_data(&p->auth);
1433         p->auth.a_u.auth_ntlmssp_state = NULL;
1434
1435         return False;
1436 }
1437
1438 /*******************************************************************
1439  Handle an schannel bind auth.
1440 *******************************************************************/
1441
1442 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1443                                         uint32_t ss_padding_len,
1444                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1445 {
1446         RPC_HDR_AUTH auth_info;
1447         struct NL_AUTH_MESSAGE neg;
1448         struct NL_AUTH_MESSAGE reply;
1449         bool ret;
1450         NTSTATUS status;
1451         struct netlogon_creds_CredentialState *creds;
1452         DATA_BLOB session_key;
1453         enum ndr_err_code ndr_err;
1454         DATA_BLOB blob;
1455
1456         blob = data_blob_const(prs_data_p(rpc_in_p) + prs_offset(rpc_in_p),
1457                                prs_data_size(rpc_in_p));
1458
1459         ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), &neg,
1460                                (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1461         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1462                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1463                 return false;
1464         }
1465
1466         if (DEBUGLEVEL >= 10) {
1467                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1468         }
1469
1470         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1471                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1472                 return false;
1473         }
1474
1475         /*
1476          * The neg.oem_netbios_computer.a key here must match the remote computer name
1477          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1478          * operations that use credentials.
1479          */
1480
1481         become_root();
1482         status = schannel_get_creds_state(p, lp_private_dir(),
1483                                             neg.oem_netbios_computer.a, &creds);
1484         unbecome_root();
1485
1486         if (!NT_STATUS_IS_OK(status)) {
1487                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1488                 return False;
1489         }
1490
1491         p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1492         if (!p->auth.a_u.schannel_auth) {
1493                 TALLOC_FREE(creds);
1494                 return False;
1495         }
1496
1497         p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1498         p->auth.a_u.schannel_auth->seq_num = 0;
1499         p->auth.a_u.schannel_auth->initiator = false;
1500         p->auth.a_u.schannel_auth->creds = creds;
1501
1502         /*
1503          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1504          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1505          * struct of the person who opened the pipe. I need to test this further. JRA.
1506          *
1507          * VL. As we are mapping this to guest set the generic key
1508          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1509          * W2k3, as it does not allow schannel binds against SAMR and LSA
1510          * anymore.
1511          */
1512
1513         session_key = generic_session_key();
1514         if (session_key.data == NULL) {
1515                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1516                           " key\n"));
1517                 return false;
1518         }
1519
1520         ret = server_info_set_session_key(p->server_info, session_key);
1521
1522         data_blob_free(&session_key);
1523
1524         if (!ret) {
1525                 DEBUG(0, ("server_info_set_session_key failed\n"));
1526                 return false;
1527         }
1528
1529         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SCHANNEL,
1530                         pauth_info->auth_level, ss_padding_len, 1);
1531         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1532                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1533                 return False;
1534         }
1535
1536         /*** SCHANNEL verifier ***/
1537
1538         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
1539         reply.Flags                             = 0;
1540         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
1541                                                       * this has any meaning
1542                                                       * here - gd */
1543
1544         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &reply,
1545                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1546         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1547                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1548                 return false;
1549         }
1550
1551         if (DEBUGLEVEL >= 10) {
1552                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1553         }
1554
1555         if (!prs_copy_data_in(pout_auth, (const char *)blob.data, blob.length)) {
1556                 return false;
1557         }
1558
1559         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1560                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1561
1562         /* We're finished with this bind - no more packets. */
1563         p->auth.auth_data_free_func = NULL;
1564         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1565
1566         p->pipe_bound = True;
1567
1568         return True;
1569 }
1570
1571 /*******************************************************************
1572  Handle an NTLMSSP bind auth.
1573 *******************************************************************/
1574
1575 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1576                                         uint32_t ss_padding_len,
1577                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1578 {
1579         RPC_HDR_AUTH auth_info;
1580         DATA_BLOB blob;
1581         DATA_BLOB response;
1582         NTSTATUS status;
1583         struct auth_ntlmssp_state *a = NULL;
1584
1585         ZERO_STRUCT(blob);
1586         ZERO_STRUCT(response);
1587
1588         /* Grab the NTLMSSP blob. */
1589         blob = data_blob(NULL,p->hdr.auth_len);
1590
1591         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1592                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1593                         (unsigned int)p->hdr.auth_len ));
1594                 goto err;
1595         }
1596
1597         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1598                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1599                 goto err;
1600         }
1601
1602         /* We have an NTLMSSP blob. */
1603         status = auth_ntlmssp_start(&a);
1604         if (!NT_STATUS_IS_OK(status)) {
1605                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1606                         nt_errstr(status) ));
1607                 goto err;
1608         }
1609
1610         status = auth_ntlmssp_update(a, blob, &response);
1611         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1612                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1613                         nt_errstr(status) ));
1614                 goto err;
1615         }
1616
1617         data_blob_free(&blob);
1618
1619         /* Copy the blob into the pout_auth parse struct */
1620         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_NTLMSSP,
1621                         pauth_info->auth_level, ss_padding_len, 1);
1622         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1623                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1624                 goto err;
1625         }
1626
1627         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1628                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1629                 goto err;
1630         }
1631
1632         p->auth.a_u.auth_ntlmssp_state = a;
1633         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1634         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1635
1636         data_blob_free(&blob);
1637         data_blob_free(&response);
1638
1639         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1640
1641         /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1642         return True;
1643
1644   err:
1645
1646         data_blob_free(&blob);
1647         data_blob_free(&response);
1648
1649         free_pipe_ntlmssp_auth_data(&p->auth);
1650         p->auth.a_u.auth_ntlmssp_state = NULL;
1651         return False;
1652 }
1653
1654 /*******************************************************************
1655  Respond to a pipe bind request.
1656 *******************************************************************/
1657
1658 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1659 {
1660         RPC_HDR_BA hdr_ba;
1661         RPC_HDR_RB hdr_rb;
1662         RPC_HDR_AUTH auth_info;
1663         uint16 assoc_gid;
1664         fstring ack_pipe_name;
1665         prs_struct out_hdr_ba;
1666         prs_struct out_auth;
1667         int i = 0;
1668         int auth_len = 0;
1669         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1670         uint32_t ss_padding_len = 0;
1671
1672         /* No rebinds on a bound pipe - use alter context. */
1673         if (p->pipe_bound) {
1674                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1675                          "pipe %s.\n",
1676                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1677                 return setup_bind_nak(p);
1678         }
1679
1680         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1681
1682         /*
1683          * Marshall directly into the outgoing PDU space. We
1684          * must do this as we need to set to the bind response
1685          * header and are never sending more than one PDU here.
1686          */
1687
1688         /*
1689          * Setup the memory to marshall the ba header, and the
1690          * auth footers.
1691          */
1692
1693         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1694                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1695                 prs_mem_free(&p->out_data.frag);
1696                 return False;
1697         }
1698
1699         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1700                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1701                 prs_mem_free(&p->out_data.frag);
1702                 prs_mem_free(&out_hdr_ba);
1703                 return False;
1704         }
1705
1706         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1707
1708         ZERO_STRUCT(hdr_rb);
1709
1710         /* decode the bind request */
1711
1712         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1713                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB "
1714                          "struct.\n"));
1715                 goto err_exit;
1716         }
1717
1718         if (hdr_rb.num_contexts == 0) {
1719                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1720                 goto err_exit;
1721         }
1722
1723         /*
1724          * Try and find the correct pipe name to ensure
1725          * that this is a pipe name we support.
1726          */
1727
1728         for (i = 0; i < rpc_lookup_size; i++) {
1729                 if (ndr_syntax_id_equal(&rpc_lookup[i].rpc_interface,
1730                                         &hdr_rb.rpc_context[0].abstract)) {
1731                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1732                                 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1733                         break;
1734                 }
1735         }
1736
1737         if (i == rpc_lookup_size) {
1738                 NTSTATUS status;
1739
1740                 status = smb_probe_module(
1741                         "rpc", get_pipe_name_from_syntax(
1742                                 talloc_tos(),
1743                                 &hdr_rb.rpc_context[0].abstract));
1744
1745                 if (NT_STATUS_IS_ERR(status)) {
1746                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1747                                 get_pipe_name_from_syntax(
1748                                         talloc_tos(),
1749                                         &hdr_rb.rpc_context[0].abstract)));
1750                         prs_mem_free(&p->out_data.frag);
1751                         prs_mem_free(&out_hdr_ba);
1752                         prs_mem_free(&out_auth);
1753
1754                         return setup_bind_nak(p);
1755                 }
1756
1757                 for (i = 0; i < rpc_lookup_size; i++) {
1758                        if (strequal(rpc_lookup[i].pipe.clnt,
1759                                     get_pipe_name_from_syntax(talloc_tos(),
1760                                                               &p->syntax))) {
1761                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1762                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1763                                break;
1764                        }
1765                 }
1766
1767                 if (i == rpc_lookup_size) {
1768                         DEBUG(0, ("module %s doesn't provide functions for "
1769                                   "pipe %s!\n",
1770                                   get_pipe_name_from_syntax(talloc_tos(),
1771                                                             &p->syntax),
1772                                   get_pipe_name_from_syntax(talloc_tos(),
1773                                                             &p->syntax)));
1774                         goto err_exit;
1775                 }
1776         }
1777
1778         /* name has to be \PIPE\xxxxx */
1779         fstrcpy(ack_pipe_name, "\\PIPE\\");
1780         fstrcat(ack_pipe_name, rpc_lookup[i].pipe.srv);
1781
1782         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1783
1784         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1785
1786         /*
1787          * Create the bind response struct.
1788          */
1789
1790         /* If the requested abstract synt uuid doesn't match our client pipe,
1791                 reject the bind_ack & set the transfer interface synt to all 0's,
1792                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1793                 unknown to NT4)
1794                 Needed when adding entries to a DACL from NT5 - SK */
1795
1796         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1797                                 hdr_rb.rpc_context[0].context_id )) {
1798                 init_rpc_hdr_ba(&hdr_ba,
1799                         RPC_MAX_PDU_FRAG_LEN,
1800                         RPC_MAX_PDU_FRAG_LEN,
1801                         assoc_gid,
1802                         ack_pipe_name,
1803                         0x1, 0x0, 0x0,
1804                         &hdr_rb.rpc_context[0].transfer[0]);
1805         } else {
1806                 /* Rejection reason: abstract syntax not supported */
1807                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1808                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1809                                         ack_pipe_name, 0x1, 0x2, 0x1,
1810                                         &null_ndr_syntax_id);
1811                 p->pipe_bound = False;
1812         }
1813
1814         /*
1815          * and marshall it.
1816          */
1817
1818         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1819                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1820                 goto err_exit;
1821         }
1822
1823         /*
1824          * Check if this is an authenticated bind request.
1825          */
1826
1827         if (p->hdr.auth_len) {
1828                 /*
1829                  * Decode the authentication verifier.
1830                  */
1831
1832                 /* Work out any padding needed before the auth footer. */
1833                 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
1834                         ss_padding_len = SERVER_NDR_PADDING_SIZE -
1835                                 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
1836                         DEBUG(10,("api_pipe_bind_req: auth pad_len = %u\n",
1837                                 (unsigned int)ss_padding_len ));
1838                 }
1839
1840                 /* Quick length check. Won't catch a bad auth footer,
1841                  * prevents overrun. */
1842
1843                 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
1844                         DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
1845                                 "too long for fragment %u.\n",
1846                                 (unsigned int)p->hdr.auth_len,
1847                                 (unsigned int)p->hdr.frag_len ));
1848                         goto err_exit;
1849                 }
1850
1851                 /* Pull the auth header and the following data into a blob. */
1852                 /* NB. The offset of the auth_header is relative to the *end*
1853                  * of the packet, not the start. Also, the length of the
1854                  * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
1855                  * as the RPC header isn't included in rpc_in_p. */
1856                 if(!prs_set_offset(rpc_in_p,
1857                                 p->hdr.frag_len - RPC_HEADER_LEN -
1858                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
1859                         DEBUG(0,("api_pipe_bind_req: cannot move "
1860                                 "offset to %u.\n",
1861                                 (unsigned int)(p->hdr.frag_len -
1862                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
1863                         goto err_exit;
1864                 }
1865
1866                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1867                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1868                         goto err_exit;
1869                 }
1870
1871                 auth_type = auth_info.auth_type;
1872
1873                 /* Work out if we have to sign or seal etc. */
1874                 switch (auth_info.auth_level) {
1875                         case DCERPC_AUTH_LEVEL_INTEGRITY:
1876                                 p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1877                                 break;
1878                         case DCERPC_AUTH_LEVEL_PRIVACY:
1879                                 p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1880                                 break;
1881                         default:
1882                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1883                                         (unsigned int)auth_info.auth_level ));
1884                                 goto err_exit;
1885                 }
1886         } else {
1887                 ZERO_STRUCT(auth_info);
1888         }
1889
1890         switch(auth_type) {
1891                 case DCERPC_AUTH_TYPE_NTLMSSP:
1892                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p,
1893                                         ss_padding_len, &auth_info, &out_auth)) {
1894                                 goto err_exit;
1895                         }
1896                         assoc_gid = 0x7a77;
1897                         break;
1898
1899                 case DCERPC_AUTH_TYPE_SCHANNEL:
1900                         if (!pipe_schannel_auth_bind(p, rpc_in_p,
1901                                         ss_padding_len, &auth_info, &out_auth)) {
1902                                 goto err_exit;
1903                         }
1904                         break;
1905
1906                 case DCERPC_AUTH_TYPE_SPNEGO:
1907                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p,
1908                                         ss_padding_len, &auth_info, &out_auth)) {
1909                                 goto err_exit;
1910                         }
1911                         break;
1912
1913                 case DCERPC_AUTH_TYPE_NONE:
1914                         /* Unauthenticated bind request. */
1915                         /* We're finished - no more packets. */
1916                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1917                         /* We must set the pipe auth_level here also. */
1918                         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1919                         p->pipe_bound = True;
1920                         /* The session key was initialized from the SMB
1921                          * session in make_internal_rpc_pipe_p */
1922                         ss_padding_len = 0;
1923                         break;
1924
1925                 default:
1926                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1927                         goto err_exit;
1928         }
1929         /*
1930          * Create the header, now we know the length.
1931          */
1932
1933         if (prs_offset(&out_auth)) {
1934                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1935         }
1936
1937         init_rpc_hdr(&p->hdr, DCERPC_PKT_BIND_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1938                         p->hdr.call_id,
1939                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) +
1940                                 ss_padding_len + prs_offset(&out_auth),
1941                         auth_len);
1942
1943         /*
1944          * Marshall the header into the outgoing PDU.
1945          */
1946
1947         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1948                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1949                 goto err_exit;
1950         }
1951
1952         /*
1953          * Now add the RPC_HDR_BA and any auth needed.
1954          */
1955
1956         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1957                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1958                 goto err_exit;
1959         }
1960
1961         if (auth_len) {
1962                 if (ss_padding_len) {
1963                         char pad[SERVER_NDR_PADDING_SIZE];
1964                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1965                         if (!prs_copy_data_in(&p->out_data.frag, pad,
1966                                         ss_padding_len)) {
1967                                 DEBUG(0,("api_pipe_bind_req: failed to add %u "
1968                                         "bytes of pad data.\n",
1969                                         (unsigned int)ss_padding_len));
1970                                 goto err_exit;
1971                         }
1972                 }
1973
1974                 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1975                         DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1976                         goto err_exit;
1977                 }
1978         }
1979
1980         /*
1981          * Setup the lengths for the initial reply.
1982          */
1983
1984         p->out_data.data_sent_length = 0;
1985         p->out_data.current_pdu_sent = 0;
1986
1987         prs_mem_free(&out_hdr_ba);
1988         prs_mem_free(&out_auth);
1989
1990         return True;
1991
1992   err_exit:
1993
1994         prs_mem_free(&p->out_data.frag);
1995         prs_mem_free(&out_hdr_ba);
1996         prs_mem_free(&out_auth);
1997         return setup_bind_nak(p);
1998 }
1999
2000 /****************************************************************************
2001  Deal with an alter context call. Can be third part of 3 leg auth request for
2002  SPNEGO calls.
2003 ****************************************************************************/
2004
2005 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
2006 {
2007         RPC_HDR_BA hdr_ba;
2008         RPC_HDR_RB hdr_rb;
2009         RPC_HDR_AUTH auth_info;
2010         uint16 assoc_gid;
2011         fstring ack_pipe_name;
2012         prs_struct out_hdr_ba;
2013         prs_struct out_auth;
2014         int auth_len = 0;
2015         uint32_t ss_padding_len = 0;
2016
2017         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
2018
2019         /*
2020          * Marshall directly into the outgoing PDU space. We
2021          * must do this as we need to set to the bind response
2022          * header and are never sending more than one PDU here.
2023          */
2024
2025         /*
2026          * Setup the memory to marshall the ba header, and the
2027          * auth footers.
2028          */
2029
2030         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
2031                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
2032                 prs_mem_free(&p->out_data.frag);
2033                 return False;
2034         }
2035
2036         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
2037                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
2038                 prs_mem_free(&p->out_data.frag);
2039                 prs_mem_free(&out_hdr_ba);
2040                 return False;
2041         }
2042
2043         ZERO_STRUCT(hdr_rb);
2044
2045         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
2046
2047         /* decode the alter context request */
2048         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
2049                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
2050                 goto err_exit;
2051         }
2052
2053         /* secondary address CAN be NULL
2054          * as the specs say it's ignored.
2055          * It MUST be NULL to have the spoolss working.
2056          */
2057         fstrcpy(ack_pipe_name,"");
2058
2059         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
2060
2061         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
2062
2063         /*
2064          * Create the bind response struct.
2065          */
2066
2067         /* If the requested abstract synt uuid doesn't match our client pipe,
2068                 reject the bind_ack & set the transfer interface synt to all 0's,
2069                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
2070                 unknown to NT4)
2071                 Needed when adding entries to a DACL from NT5 - SK */
2072
2073         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
2074                                 hdr_rb.rpc_context[0].context_id )) {
2075                 init_rpc_hdr_ba(&hdr_ba,
2076                         RPC_MAX_PDU_FRAG_LEN,
2077                         RPC_MAX_PDU_FRAG_LEN,
2078                         assoc_gid,
2079                         ack_pipe_name,
2080                         0x1, 0x0, 0x0,
2081                         &hdr_rb.rpc_context[0].transfer[0]);
2082         } else {
2083                 /* Rejection reason: abstract syntax not supported */
2084                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
2085                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
2086                                         ack_pipe_name, 0x1, 0x2, 0x1,
2087                                         &null_ndr_syntax_id);
2088                 p->pipe_bound = False;
2089         }
2090
2091         /*
2092          * and marshall it.
2093          */
2094
2095         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
2096                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
2097                 goto err_exit;
2098         }
2099
2100
2101         /*
2102          * Check if this is an authenticated alter context request.
2103          */
2104
2105         if (p->hdr.auth_len != 0) {
2106                 /*
2107                  * Decode the authentication verifier.
2108                  */
2109
2110                 /* Work out any padding needed before the auth footer. */
2111                 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
2112                         ss_padding_len = SERVER_NDR_PADDING_SIZE -
2113                                 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
2114                         DEBUG(10,("api_pipe_alter_context: auth pad_len = %u\n",
2115                                 (unsigned int)ss_padding_len ));
2116                 }
2117
2118                 /* Quick length check. Won't catch a bad auth footer,
2119                  * prevents overrun. */
2120
2121                 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
2122                         DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
2123                                 "too long for fragment %u.\n",
2124                                 (unsigned int)p->hdr.auth_len,
2125                                 (unsigned int)p->hdr.frag_len ));
2126                         goto err_exit;
2127                 }
2128
2129                 /* Pull the auth header and the following data into a blob. */
2130                 /* NB. The offset of the auth_header is relative to the *end*
2131                  * of the packet, not the start. Also, the length of the
2132                  * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2133                  * as the RPC header isn't included in rpc_in_p. */
2134                 if(!prs_set_offset(rpc_in_p,
2135                                 p->hdr.frag_len - RPC_HEADER_LEN -
2136                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
2137                         DEBUG(0,("api_alter_context: cannot move "
2138                                 "offset to %u.\n",
2139                                 (unsigned int)(p->hdr.frag_len -
2140                                 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
2141                         goto err_exit;
2142                 }
2143
2144                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
2145                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
2146                         goto err_exit;
2147                 }
2148
2149                 /*
2150                  * Currently only the SPNEGO auth type uses the alter ctx
2151                  * response in place of the NTLMSSP auth3 type.
2152                  */
2153
2154                 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
2155                         /* We can only finish if the pipe is unbound. */
2156                         if (!p->pipe_bound) {
2157                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p,
2158                                                 ss_padding_len, &auth_info, &out_auth)) {
2159                                         goto err_exit;
2160                                 }
2161                         } else {
2162                                 goto err_exit;
2163                         }
2164                 }
2165         } else {
2166                 ZERO_STRUCT(auth_info);
2167         }
2168         /*
2169          * Create the header, now we know the length.
2170          */
2171
2172         if (prs_offset(&out_auth)) {
2173                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
2174         }
2175
2176         init_rpc_hdr(&p->hdr, DCERPC_PKT_ALTER_RESP, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
2177                         p->hdr.call_id,
2178                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
2179                         auth_len);
2180
2181         /*
2182          * Marshall the header into the outgoing PDU.
2183          */
2184
2185         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
2186                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
2187                 goto err_exit;
2188         }
2189
2190         /*
2191          * Now add the RPC_HDR_BA and any auth needed.
2192          */
2193
2194         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
2195                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
2196                 goto err_exit;
2197         }
2198
2199         if (auth_len) {
2200                 if (ss_padding_len) {
2201                         char pad[SERVER_NDR_PADDING_SIZE];
2202                         memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
2203                         if (!prs_copy_data_in(&p->out_data.frag, pad,
2204                                         ss_padding_len)) {
2205                                 DEBUG(0,("api_pipe_alter_context: failed to add %u "
2206                                         "bytes of pad data.\n",
2207                                         (unsigned int)ss_padding_len));
2208                                 goto err_exit;
2209                         }
2210                 }
2211
2212                 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
2213                         DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
2214                         goto err_exit;
2215                 }
2216         }
2217
2218         /*
2219          * Setup the lengths for the initial reply.
2220          */
2221
2222         p->out_data.data_sent_length = 0;
2223         p->out_data.current_pdu_sent = 0;
2224
2225         prs_mem_free(&out_hdr_ba);
2226         prs_mem_free(&out_auth);
2227
2228         return True;
2229
2230   err_exit:
2231
2232         prs_mem_free(&p->out_data.frag);
2233         prs_mem_free(&out_hdr_ba);
2234         prs_mem_free(&out_auth);
2235         return setup_bind_nak(p);
2236 }
2237
2238 /****************************************************************************
2239  Deal with NTLMSSP sign & seal processing on an RPC request.
2240 ****************************************************************************/
2241
2242 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
2243                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
2244 {
2245         RPC_HDR_AUTH auth_info;
2246         uint32 auth_len = p->hdr.auth_len;
2247         uint32 save_offset = prs_offset(rpc_in);
2248         struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
2249         unsigned char *data = NULL;
2250         size_t data_len;
2251         unsigned char *full_packet_data = NULL;
2252         size_t full_packet_data_len;
2253         DATA_BLOB auth_blob;
2254
2255         *pstatus = NT_STATUS_OK;
2256
2257         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_NONE || p->auth.auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
2258                 return True;
2259         }
2260
2261         if (!a) {
2262                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2263                 return False;
2264         }
2265
2266         /* Ensure there's enough data for an authenticated request. */
2267         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN
2268                         + auth_len > p->hdr.frag_len) {
2269                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2270                         (unsigned int)auth_len ));
2271                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2272                 return False;
2273         }
2274
2275         /*
2276          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2277          * after the RPC header.
2278          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2279          * functions as NTLMv2 checks the rpc headers also.
2280          * Both of these values include any auth_pad_len bytes.
2281          */
2282
2283         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2284         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2285
2286         full_packet_data = p->in_data.current_in_pdu;
2287         full_packet_data_len = p->hdr.frag_len - auth_len;
2288
2289         /* Pull the auth header and the following data into a blob. */
2290         /* NB. The offset of the auth_header is relative to the *end*
2291          * of the packet, not the start. Also, the length of the
2292          * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2293          * as the RPC header isn't included in rpc_in_p. */
2294         if(!prs_set_offset(rpc_in,
2295                         p->hdr.frag_len - RPC_HEADER_LEN -
2296                         RPC_HDR_AUTH_LEN - auth_len)) {
2297                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move "
2298                         "offset to %u.\n",
2299                         (unsigned int)(p->hdr.frag_len -
2300                                 RPC_HDR_AUTH_LEN - auth_len) ));
2301                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2302                 return False;
2303         }
2304
2305         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2306                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to "
2307                         "unmarshall RPC_HDR_AUTH.\n"));
2308                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2309                 return False;
2310         }
2311
2312         /* Ensure auth_pad_len fits into the packet. */
2313         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2314                         RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2315                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_info.auth_pad_len "
2316                         "too large (%u), auth_len (%u), frag_len = (%u).\n",
2317                         (unsigned int)auth_info.auth_pad_len,
2318                         (unsigned int)auth_len,
2319                         (unsigned int)p->hdr.frag_len ));
2320                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2321                 return False;
2322         }
2323
2324         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2325         auth_blob.length = auth_len;
2326
2327         switch (p->auth.auth_level) {
2328                 case DCERPC_AUTH_LEVEL_PRIVACY:
2329                         /* Data is encrypted. */
2330                         *pstatus = auth_ntlmssp_unseal_packet(a,
2331                                                               data, data_len,
2332                                                               full_packet_data,
2333                                                               full_packet_data_len,
2334                                                               &auth_blob);
2335                         if (!NT_STATUS_IS_OK(*pstatus)) {
2336                                 return False;
2337                         }
2338                         break;
2339                 case DCERPC_AUTH_LEVEL_INTEGRITY:
2340                         /* Data is signed. */
2341                         *pstatus = auth_ntlmssp_check_packet(a,
2342                                                              data, data_len,
2343                                                              full_packet_data,
2344                                                              full_packet_data_len,
2345                                                              &auth_blob);
2346                         if (!NT_STATUS_IS_OK(*pstatus)) {
2347                                 return False;
2348                         }
2349                         break;
2350                 default:
2351                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2352                         return False;
2353         }
2354
2355         /*
2356          * Return the current pointer to the data offset.
2357          */
2358
2359         if(!prs_set_offset(rpc_in, save_offset)) {
2360                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2361                         (unsigned int)save_offset ));
2362                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2363                 return False;
2364         }
2365
2366         /*
2367          * Remember the padding length. We must remove it from the real data
2368          * stream once the sign/seal is done.
2369          */
2370
2371         *p_ss_padding_len = auth_info.auth_pad_len;
2372
2373         return True;
2374 }
2375
2376 /****************************************************************************
2377  Deal with schannel processing on an RPC request.
2378 ****************************************************************************/
2379
2380 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2381 {
2382         uint32 data_len;
2383         uint32 auth_len;
2384         uint32 save_offset = prs_offset(rpc_in);
2385         RPC_HDR_AUTH auth_info;
2386         DATA_BLOB blob;
2387         NTSTATUS status;
2388         uint8_t *data;
2389
2390         auth_len = p->hdr.auth_len;
2391
2392         if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN ||
2393                         auth_len > RPC_HEADER_LEN +
2394                                         RPC_HDR_REQ_LEN +
2395                                         RPC_HDR_AUTH_LEN +
2396                                         auth_len) {
2397                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2398                 return False;
2399         }
2400
2401         /*
2402          * The following is that length of the data we must verify or unseal.
2403          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2404          * preceeding the auth_data, but does include the auth_pad_len bytes.
2405          */
2406
2407         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2408                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2409                         (unsigned int)p->hdr.frag_len,
2410                         (unsigned int)auth_len ));
2411                 return False;
2412         }
2413
2414         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2415                 RPC_HDR_AUTH_LEN - auth_len;
2416
2417         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2418
2419         /* Pull the auth header and the following data into a blob. */
2420         /* NB. The offset of the auth_header is relative to the *end*
2421          * of the packet, not the start. Also, the length of the
2422          * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2423          * as the RPC header isn't included in rpc_in_p. */
2424         if(!prs_set_offset(rpc_in,
2425                         p->hdr.frag_len - RPC_HEADER_LEN -
2426                         RPC_HDR_AUTH_LEN - auth_len)) {
2427                 DEBUG(0,("api_pipe_schannel_process: cannot move "
2428                         "offset to %u.\n",
2429                         (unsigned int)(p->hdr.frag_len -
2430                                 RPC_HDR_AUTH_LEN - auth_len) ));
2431                 return False;
2432         }
2433
2434         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2435                 DEBUG(0,("api_pipe_schannel_process: failed to "
2436                         "unmarshall RPC_HDR_AUTH.\n"));
2437                 return False;
2438         }
2439
2440         /* Ensure auth_pad_len fits into the packet. */
2441         if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2442                         RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2443                 DEBUG(0,("api_pipe_schannel_process: auth_info.auth_pad_len "
2444                         "too large (%u), auth_len (%u), frag_len = (%u).\n",
2445                         (unsigned int)auth_info.auth_pad_len,
2446                         (unsigned int)auth_len,
2447                         (unsigned int)p->hdr.frag_len ));
2448                 return False;
2449         }
2450
2451         if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
2452                 DEBUG(0,("Invalid auth info %d on schannel\n",
2453                          auth_info.auth_type));
2454                 return False;
2455         }
2456
2457         blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), auth_len);
2458
2459         if (DEBUGLEVEL >= 10) {
2460                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
2461         }
2462
2463         data = (uint8_t *)prs_data_p(rpc_in)+RPC_HDR_REQ_LEN;
2464
2465         switch (auth_info.auth_level) {
2466         case DCERPC_AUTH_LEVEL_PRIVACY:
2467                 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2468                                                 talloc_tos(),
2469                                                 true,
2470                                                 data,
2471                                                 data_len,
2472                                                 &blob);
2473                 break;
2474         case DCERPC_AUTH_LEVEL_INTEGRITY:
2475                 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2476                                                 talloc_tos(),
2477                                                 false,
2478                                                 data,
2479                                                 data_len,
2480                                                 &blob);
2481                 break;
2482         default:
2483                 status = NT_STATUS_INTERNAL_ERROR;
2484                 break;
2485         }
2486
2487         if (!NT_STATUS_IS_OK(status)) {
2488                 DEBUG(0,("failed to unseal packet: %s\n", nt_errstr(status)));
2489                 return false;
2490         }
2491
2492         /*
2493          * Return the current pointer to the data offset.
2494          */
2495
2496         if(!prs_set_offset(rpc_in, save_offset)) {
2497                 DEBUG(0,("failed to set offset back to %u\n",
2498                          (unsigned int)save_offset ));
2499                 return False;
2500         }
2501
2502         /*
2503          * Remember the padding length. We must remove it from the real data
2504          * stream once the sign/seal is done.
2505          */
2506
2507         *p_ss_padding_len = auth_info.auth_pad_len;
2508
2509         return True;
2510 }
2511
2512 /****************************************************************************
2513  Find the set of RPC functions associated with this context_id
2514 ****************************************************************************/
2515
2516 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2517 {
2518         PIPE_RPC_FNS *fns = NULL;
2519
2520         if ( !list ) {
2521                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2522                 return NULL;
2523         }
2524
2525         for (fns=list; fns; fns=fns->next ) {
2526                 if ( fns->context_id == context_id )
2527                         return fns;
2528         }
2529         return NULL;
2530 }
2531
2532 /****************************************************************************
2533  Memory cleanup.
2534 ****************************************************************************/
2535
2536 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2537 {
2538         PIPE_RPC_FNS *tmp = list;
2539         PIPE_RPC_FNS *tmp2;
2540
2541         while (tmp) {
2542                 tmp2 = tmp->next;
2543                 SAFE_FREE(tmp);
2544                 tmp = tmp2;
2545         }
2546
2547         return;
2548 }
2549
2550 static bool api_rpcTNP(pipes_struct *p,
2551                        const struct api_struct *api_rpc_cmds, int n_cmds);
2552
2553 /****************************************************************************
2554  Find the correct RPC function to call for this request.
2555  If the pipe is authenticated then become the correct UNIX user
2556  before doing the call.
2557 ****************************************************************************/
2558
2559 bool api_pipe_request(pipes_struct *p)
2560 {
2561         bool ret = False;
2562         bool changed_user = False;
2563         PIPE_RPC_FNS *pipe_fns;
2564
2565         if (p->pipe_bound &&
2566                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2567                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2568                 if(!become_authenticated_pipe_user(p)) {
2569                         prs_mem_free(&p->out_data.rdata);
2570                         return False;
2571                 }
2572                 changed_user = True;
2573         }
2574
2575         DEBUG(5, ("Requested \\PIPE\\%s\n",
2576                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2577
2578         /* get the set of RPC functions for this context */
2579
2580         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2581
2582         if ( pipe_fns ) {
2583                 TALLOC_CTX *frame = talloc_stackframe();
2584                 ret = api_rpcTNP(p, pipe_fns->cmds, pipe_fns->n_cmds);
2585                 TALLOC_FREE(frame);
2586         }
2587         else {
2588                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2589                         p->hdr_req.context_id,
2590                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2591         }
2592
2593         if (changed_user) {
2594                 unbecome_authenticated_pipe_user();
2595         }
2596
2597         return ret;
2598 }
2599
2600 /*******************************************************************
2601  Calls the underlying RPC function for a named pipe.
2602  ********************************************************************/
2603
2604 static bool api_rpcTNP(pipes_struct *p,
2605                        const struct api_struct *api_rpc_cmds, int n_cmds)
2606 {
2607         int fn_num;
2608         uint32 offset1, offset2;
2609
2610         /* interpret the command */
2611         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2612                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2613                  p->hdr_req.opnum));
2614
2615         if (DEBUGLEVEL >= 50) {
2616                 fstring name;
2617                 slprintf(name, sizeof(name)-1, "in_%s",
2618                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2619                 prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2620         }
2621
2622         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2623                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2624                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2625                         break;
2626                 }
2627         }
2628
2629         if (fn_num == n_cmds) {
2630                 /*
2631                  * For an unknown RPC just return a fault PDU but
2632                  * return True to allow RPC's on the pipe to continue
2633                  * and not put the pipe into fault state. JRA.
2634                  */
2635                 DEBUG(4, ("unknown\n"));
2636                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2637                 return True;
2638         }
2639
2640         offset1 = prs_offset(&p->out_data.rdata);
2641
2642         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2643                 fn_num, api_rpc_cmds[fn_num].fn));
2644         /* do the actual command */
2645         if(!api_rpc_cmds[fn_num].fn(p)) {
2646                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2647                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2648                          api_rpc_cmds[fn_num].name));
2649                 prs_mem_free(&p->out_data.rdata);
2650                 return False;
2651         }
2652
2653         if (p->bad_handle_fault_state) {
2654                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2655                 p->bad_handle_fault_state = False;
2656                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2657                 return True;
2658         }
2659
2660         if (p->rng_fault_state) {
2661                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2662                 p->rng_fault_state = False;
2663                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2664                 return True;
2665         }
2666
2667         offset2 = prs_offset(&p->out_data.rdata);
2668         prs_set_offset(&p->out_data.rdata, offset1);
2669         if (DEBUGLEVEL >= 50) {
2670                 fstring name;
2671                 slprintf(name, sizeof(name)-1, "out_%s",
2672                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2673                 prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2674         }
2675         prs_set_offset(&p->out_data.rdata, offset2);
2676
2677         DEBUG(5,("api_rpcTNP: called %s successfully\n",
2678                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2679
2680         /* Check for buffer underflow in rpc parsing */
2681
2682         if ((DEBUGLEVEL >= 10) &&
2683             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2684                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2685                 char *data = (char *)SMB_MALLOC(data_len);
2686
2687                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2688                 if (data) {
2689                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2690                         SAFE_FREE(data);
2691                 }
2692
2693         }
2694
2695         return True;
2696 }