?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ntlmssp: Make the ntlmssp.h from source3/ a common header
[Samba/ekacnet.git] / source3 / rpc_server / srv_pipe.c
blobce087a4e034e52c30c0d23128a22b870e5e046b3
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 /* this module apparently provides an implementation of DCE/RPC over a
21 * named pipe (IPC$ connection using SMBtrans). details of DCE/RPC
22 * documentation are available (in on-line form) from the X-Open group.
23 *
24 * this module should provide a level of abstraction between SMB
25 * and DCE/RPC, while minimising the amount of mallocs, unnecessary
26 * data copies, and network traffic.
27 *
28 */
29
30 #include "includes.h"
31 #include "../librpc/gen_ndr/ndr_schannel.h"
32 #include "../libcli/auth/schannel.h"
33 #include "../libcli/auth/spnego.h"
34 #include "../libcli/auth/ntlmssp.h"
35
36 #undef DBGC_CLASS
37 #define DBGC_CLASS DBGC_RPC_SRV
38
39 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
40 {
41 struct auth_ntlmssp_state *a = auth->a_u.auth_ntlmssp_state;
42
43 if (a) {
44 auth_ntlmssp_end(&a);
45 }
46 auth->a_u.auth_ntlmssp_state = NULL;
47 }
48
49 static DATA_BLOB generic_session_key(void)
50 {
51 return data_blob("SystemLibraryDTC", 16);
52 }
53
54 /*******************************************************************
55 Generate the next PDU to be returned from the data in p->rdata.
56 Handle NTLMSSP.
57 ********************************************************************/
58
59 static bool create_next_pdu_ntlmssp(pipes_struct *p)
60 {
61 RPC_HDR_RESP hdr_resp;
62 uint32 ss_padding_len = 0;
63 uint32 data_space_available;
64 uint32 data_len_left;
65 uint32 data_len;
66 NTSTATUS status;
67 DATA_BLOB auth_blob;
68 RPC_HDR_AUTH auth_info;
69 uint8 auth_type, auth_level;
70 struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
71
72 /*
73 * If we're in the fault state, keep returning fault PDU's until
74 * the pipe gets closed. JRA.
75 */
76
77 if(p->fault_state) {
78 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
79 return True;
80 }
81
82 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
83
84 /* Change the incoming request header to a response. */
85 p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
86
87 /* Set up rpc header flags. */
88 if (p->out_data.data_sent_length == 0) {
89 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
90 } else {
91 p->hdr.flags = 0;
92 }
93
94 /*
95 * Work out how much we can fit in a single PDU.
96 */
97
98 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
99
100 /*
101 * Ensure there really is data left to send.
102 */
103
104 if(!data_len_left) {
105 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
106 return False;
107 }
108
109 /* Space available - not including padding. */
110 data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN -
111 RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
112
113 /*
114 * The amount we send is the minimum of the available
115 * space and the amount left to send.
116 */
117
118 data_len = MIN(data_len_left, data_space_available);
119
120 /* Work out any padding alignment requirements. */
121 if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
122 ss_padding_len = SERVER_NDR_PADDING_SIZE -
123 ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
124 DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
125 ss_padding_len ));
126 /* If we're over filling the packet, we need to make space
127 * for the padding at the end of the data. */
128 if (data_len + ss_padding_len > data_space_available) {
129 data_len -= SERVER_NDR_PADDING_SIZE;
130 }
131 }
132
133 /*
134 * Set up the alloc hint. This should be the data left to
135 * send.
136 */
137
138 hdr_resp.alloc_hint = data_len_left;
139
140 /*
141 * Work out if this PDU will be the last.
142 */
143
144 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
145 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
146 }
147
148 /*
149 * Set up the header lengths.
150 */
151
152 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
153 data_len + ss_padding_len +
154 RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
155 p->hdr.auth_len = NTLMSSP_SIG_SIZE;
156
157
158 /*
159 * Init the parse struct to point at the outgoing
160 * data.
161 */
162
163 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
164
165 /* Store the header in the data stream. */
166 if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
167 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
168 prs_mem_free(&p->out_data.frag);
169 return False;
170 }
171
172 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
173 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
174 prs_mem_free(&p->out_data.frag);
175 return False;
176 }
177
178 /* Copy the data into the PDU. */
179
180 if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
181 p->out_data.data_sent_length, data_len)) {
182 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
183 prs_mem_free(&p->out_data.frag);
184 return False;
185 }
186
187 /* Copy the sign/seal padding data. */
188 if (ss_padding_len) {
189 char pad[SERVER_NDR_PADDING_SIZE];
190
191 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
192 if (!prs_copy_data_in(&p->out_data.frag, pad,
193 ss_padding_len)) {
194 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
195 (unsigned int)ss_padding_len));
196 prs_mem_free(&p->out_data.frag);
197 return False;
198 }
199 }
200
201
202 /* Now write out the auth header and null blob. */
203 if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
204 auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
205 } else {
206 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
207 }
208 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
209 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
210 } else {
211 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
212 }
213
214 init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
215
216 if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
217 &p->out_data.frag, 0)) {
218 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
219 prs_mem_free(&p->out_data.frag);
220 return False;
221 }
222
223 /* Generate the sign blob. */
224
225 switch (p->auth.auth_level) {
226 case DCERPC_AUTH_LEVEL_PRIVACY:
227 /* Data portion is encrypted. */
228 status = auth_ntlmssp_seal_packet(
229 a,
230 (uint8_t *)prs_data_p(&p->out_data.frag)
231 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
232 data_len + ss_padding_len,
233 (unsigned char *)prs_data_p(&p->out_data.frag),
234 (size_t)prs_offset(&p->out_data.frag),
235 &auth_blob);
236 if (!NT_STATUS_IS_OK(status)) {
237 data_blob_free(&auth_blob);
238 prs_mem_free(&p->out_data.frag);
239 return False;
240 }
241 break;
242 case DCERPC_AUTH_LEVEL_INTEGRITY:
243 /* Data is signed. */
244 status = auth_ntlmssp_sign_packet(
245 a,
246 (unsigned char *)prs_data_p(&p->out_data.frag)
247 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
248 data_len + ss_padding_len,
249 (unsigned char *)prs_data_p(&p->out_data.frag),
250 (size_t)prs_offset(&p->out_data.frag),
251 &auth_blob);
252 if (!NT_STATUS_IS_OK(status)) {
253 data_blob_free(&auth_blob);
254 prs_mem_free(&p->out_data.frag);
255 return False;
256 }
257 break;
258 default:
259 prs_mem_free(&p->out_data.frag);
260 return False;
261 }
262
263 /* Append the auth blob. */
264 if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
265 NTLMSSP_SIG_SIZE)) {
266 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
267 (unsigned int)NTLMSSP_SIG_SIZE));
268 data_blob_free(&auth_blob);
269 prs_mem_free(&p->out_data.frag);
270 return False;
271 }
272
273 data_blob_free(&auth_blob);
274
275 /*
276 * Setup the counts for this PDU.
277 */
278
279 p->out_data.data_sent_length += data_len;
280 p->out_data.current_pdu_sent = 0;
281
282 return True;
283 }
284
285 /*******************************************************************
286 Generate the next PDU to be returned from the data in p->rdata.
287 Return an schannel authenticated fragment.
288 ********************************************************************/
289
290 static bool create_next_pdu_schannel(pipes_struct *p)
291 {
292 RPC_HDR_RESP hdr_resp;
293 uint32 ss_padding_len = 0;
294 uint32 data_len;
295 uint32 data_space_available;
296 uint32 data_len_left;
297 uint32 data_pos;
298 NTSTATUS status;
299
300 /*
301 * If we're in the fault state, keep returning fault PDU's until
302 * the pipe gets closed. JRA.
303 */
304
305 if(p->fault_state) {
306 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
307 return True;
308 }
309
310 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
311
312 /* Change the incoming request header to a response. */
313 p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
314
315 /* Set up rpc header flags. */
316 if (p->out_data.data_sent_length == 0) {
317 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
318 } else {
319 p->hdr.flags = 0;
320 }
321
322 /*
323 * Work out how much we can fit in a single PDU.
324 */
325
326 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
327
328 /*
329 * Ensure there really is data left to send.
330 */
331
332 if(!data_len_left) {
333 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
334 return False;
335 }
336
337 /* Space available - not including padding. */
338 data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
339 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
340 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
341
342 /*
343 * The amount we send is the minimum of the available
344 * space and the amount left to send.
345 */
346
347 data_len = MIN(data_len_left, data_space_available);
348
349 /* Work out any padding alignment requirements. */
350 if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
351 ss_padding_len = SERVER_NDR_PADDING_SIZE -
352 ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
353 DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
354 ss_padding_len ));
355 /* If we're over filling the packet, we need to make space
356 * for the padding at the end of the data. */
357 if (data_len + ss_padding_len > data_space_available) {
358 data_len -= SERVER_NDR_PADDING_SIZE;
359 }
360 }
361
362 /*
363 * Set up the alloc hint. This should be the data left to
364 * send.
365 */
366
367 hdr_resp.alloc_hint = data_len_left;
368
369 /*
370 * Work out if this PDU will be the last.
371 */
372
373 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
374 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
375 }
376
377 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
378 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
379 p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
380
381 /*
382 * Init the parse struct to point at the outgoing
383 * data.
384 */
385
386 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
387
388 /* Store the header in the data stream. */
389 if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
390 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
391 prs_mem_free(&p->out_data.frag);
392 return False;
393 }
394
395 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
396 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
397 prs_mem_free(&p->out_data.frag);
398 return False;
399 }
400
401 /* Store the current offset. */
402 data_pos = prs_offset(&p->out_data.frag);
403
404 /* Copy the data into the PDU. */
405
406 if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
407 p->out_data.data_sent_length, data_len)) {
408 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
409 prs_mem_free(&p->out_data.frag);
410 return False;
411 }
412
413 /* Copy the sign/seal padding data. */
414 if (ss_padding_len) {
415 char pad[SERVER_NDR_PADDING_SIZE];
416 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
417 if (!prs_copy_data_in(&p->out_data.frag, pad,
418 ss_padding_len)) {
419 DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
420 prs_mem_free(&p->out_data.frag);
421 return False;
422 }
423 }
424
425 {
426 /*
427 * Schannel processing.
428 */
429 RPC_HDR_AUTH auth_info;
430 DATA_BLOB blob;
431 uint8_t *data;
432
433 /* Check it's the type of reply we were expecting to decode */
434
435 init_rpc_hdr_auth(&auth_info,
436 DCERPC_AUTH_TYPE_SCHANNEL,
437 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
438 DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
439 ss_padding_len, 1);
440
441 if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
442 &p->out_data.frag, 0)) {
443 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
444 prs_mem_free(&p->out_data.frag);
445 return False;
446 }
447
448 data = (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos;
449
450 switch (p->auth.auth_level) {
451 case DCERPC_AUTH_LEVEL_PRIVACY:
452 status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
453 talloc_tos(),
454 true,
455 data,
456 data_len + ss_padding_len,
457 &blob);
458 break;
459 case DCERPC_AUTH_LEVEL_INTEGRITY:
460 status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
461 talloc_tos(),
462 false,
463 data,
464 data_len + ss_padding_len,
465 &blob);
466 break;
467 default:
468 status = NT_STATUS_INTERNAL_ERROR;
469 break;
470 }
471
472 if (!NT_STATUS_IS_OK(status)) {
473 DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
474 nt_errstr(status)));
475 prs_mem_free(&p->out_data.frag);
476 return false;
477 }
478
479 /* Finally marshall the blob. */
480
481 if (DEBUGLEVEL >= 10) {
482 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
483 }
484
485 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
486 prs_mem_free(&p->out_data.frag);
487 return false;
488 }
489 }
490
491 /*
492 * Setup the counts for this PDU.
493 */
494
495 p->out_data.data_sent_length += data_len;
496 p->out_data.current_pdu_sent = 0;
497
498 return True;
499 }
500
501 /*******************************************************************
502 Generate the next PDU to be returned from the data in p->rdata.
503 No authentication done.
504 ********************************************************************/
505
506 static bool create_next_pdu_noauth(pipes_struct *p)
507 {
508 RPC_HDR_RESP hdr_resp;
509 uint32 data_len;
510 uint32 data_space_available;
511 uint32 data_len_left;
512
513 /*
514 * If we're in the fault state, keep returning fault PDU's until
515 * the pipe gets closed. JRA.
516 */
517
518 if(p->fault_state) {
519 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
520 return True;
521 }
522
523 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
524
525 /* Change the incoming request header to a response. */
526 p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
527
528 /* Set up rpc header flags. */
529 if (p->out_data.data_sent_length == 0) {
530 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
531 } else {
532 p->hdr.flags = 0;
533 }
534
535 /*
536 * Work out how much we can fit in a single PDU.
537 */
538
539 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
540
541 /*
542 * Ensure there really is data left to send.
543 */
544
545 if(!data_len_left) {
546 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
547 return False;
548 }
549
550 data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
551 - RPC_HDR_RESP_LEN;
552
553 /*
554 * The amount we send is the minimum of the available
555 * space and the amount left to send.
556 */
557
558 data_len = MIN(data_len_left, data_space_available);
559
560 /*
561 * Set up the alloc hint. This should be the data left to
562 * send.
563 */
564
565 hdr_resp.alloc_hint = data_len_left;
566
567 /*
568 * Work out if this PDU will be the last.
569 */
570
571 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
572 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
573 }
574
575 /*
576 * Set up the header lengths.
577 */
578
579 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
580 p->hdr.auth_len = 0;
581
582 /*
583 * Init the parse struct to point at the outgoing
584 * data.
585 */
586
587 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
588
589 /* Store the header in the data stream. */
590 if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
591 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
592 prs_mem_free(&p->out_data.frag);
593 return False;
594 }
595
596 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
597 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
598 prs_mem_free(&p->out_data.frag);
599 return False;
600 }
601
602 /* Copy the data into the PDU. */
603
604 if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
605 p->out_data.data_sent_length, data_len)) {
606 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
607 prs_mem_free(&p->out_data.frag);
608 return False;
609 }
610
611 /*
612 * Setup the counts for this PDU.
613 */
614
615 p->out_data.data_sent_length += data_len;
616 p->out_data.current_pdu_sent = 0;
617
618 return True;
619 }
620
621 /*******************************************************************
622 Generate the next PDU to be returned from the data in p->rdata.
623 ********************************************************************/
624
625 bool create_next_pdu(pipes_struct *p)
626 {
627 switch(p->auth.auth_level) {
628 case DCERPC_AUTH_LEVEL_NONE:
629 case DCERPC_AUTH_LEVEL_CONNECT:
630 /* This is incorrect for auth level connect. Fixme. JRA */
631 return create_next_pdu_noauth(p);
632
633 default:
634 switch(p->auth.auth_type) {
635 case PIPE_AUTH_TYPE_NTLMSSP:
636 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
637 return create_next_pdu_ntlmssp(p);
638 case PIPE_AUTH_TYPE_SCHANNEL:
639 return create_next_pdu_schannel(p);
640 default:
641 break;
642 }
643 }
644
645 DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
646 (unsigned int)p->auth.auth_level,
647 (unsigned int)p->auth.auth_type));
648 return False;
649 }
650
651 /*******************************************************************
652 Process an NTLMSSP authentication response.
653 If this function succeeds, the user has been authenticated
654 and their domain, name and calling workstation stored in
655 the pipe struct.
656 *******************************************************************/
657
658 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
659 {
660 DATA_BLOB session_key, reply;
661 NTSTATUS status;
662 struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
663 bool ret;
664
665 DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
666 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
667
668 ZERO_STRUCT(reply);
669
670 /* this has to be done as root in order to verify the password */
671 become_root();
672 status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
673 unbecome_root();
674
675 /* Don't generate a reply. */
676 data_blob_free(&reply);
677
678 if (!NT_STATUS_IS_OK(status)) {
679 return False;
680 }
681
682 /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
683 ensure the underlying NTLMSSP flags are also set. If not we should
684 refuse the bind. */
685
686 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
687 if (!auth_ntlmssp_negotiated_sign(a)) {
688 DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
689 "but client declined signing.\n",
690 get_pipe_name_from_syntax(talloc_tos(),
691 &p->syntax)));
692 return False;
693 }
694 }
695 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
696 if (!auth_ntlmssp_negotiated_seal(a)) {
697 DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
698 "but client declined sealing.\n",
699 get_pipe_name_from_syntax(talloc_tos(),
700 &p->syntax)));
701 return False;
702 }
703 }
704
705 DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
706 "workstation: %s\n",
707 auth_ntlmssp_get_username(a),
708 auth_ntlmssp_get_domain(a),
709 auth_ntlmssp_get_client(a)));
710
711 TALLOC_FREE(p->server_info);
712
713 p->server_info = auth_ntlmssp_server_info(p, a);
714 if (p->server_info == NULL) {
715 DEBUG(0, ("auth_ntlmssp_server_info failed to obtain the server info for authenticated user\n"));
716 return false;
717 }
718
719 if (p->server_info->ptok == NULL) {
720 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
721 return False;
722 }
723
724 /*
725 * We're an authenticated bind over smb, so the session key needs to
726 * be set to "SystemLibraryDTC". Weird, but this is what Windows
727 * does. See the RPC-SAMBA3SESSIONKEY.
728 */
729
730 session_key = generic_session_key();
731 if (session_key.data == NULL) {
732 return False;
733 }
734
735 ret = server_info_set_session_key(p->server_info, session_key);
736
737 data_blob_free(&session_key);
738
739 return True;
740 }
741
742 /*******************************************************************
743 The switch table for the pipe names and the functions to handle them.
744 *******************************************************************/
745
746 struct rpc_table {
747 struct {
748 const char *clnt;
749 const char *srv;
750 } pipe;
751 struct ndr_syntax_id rpc_interface;
752 const struct api_struct *cmds;
753 int n_cmds;
754 };
755
756 static struct rpc_table *rpc_lookup;
757 static int rpc_lookup_size;
758
759 /*******************************************************************
760 This is the "stage3" NTLMSSP response after a bind request and reply.
761 *******************************************************************/
762
763 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
764 {
765 RPC_HDR_AUTH auth_info;
766 uint32 pad = 0;
767 DATA_BLOB blob;
768 uint32_t auth_len = p->hdr.auth_len;
769
770 ZERO_STRUCT(blob);
771
772 DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
773
774 if (auth_len == 0) {
775 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
776 goto err;
777 }
778
779 /* 4 bytes padding. */
780 if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
781 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
782 goto err;
783 }
784
785 /* Ensure there's enough data for an authenticated request. */
786 if (RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + auth_len >
787 p->hdr.frag_len) {
788 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
789 "%u is too large.\n",
790 (unsigned int)auth_len ));
791 goto err;
792 }
793
794 /*
795 * Decode the authentication verifier response.
796 */
797
798 /* Pull the auth header and the following data into a blob. */
799 /* NB. The offset of the auth_header is relative to the *end*
800 * of the packet, not the start. Also, the length of the
801 * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
802 * as the RPC header isn't included in rpc_in_p. */
803 if(!prs_set_offset(rpc_in_p,
804 p->hdr.frag_len - RPC_HEADER_LEN -
805 RPC_HDR_AUTH_LEN - auth_len)) {
806 DEBUG(0,("api_pipe_bind_auth3: cannot move "
807 "offset to %u.\n",
808 (unsigned int)(p->hdr.frag_len -
809 RPC_HDR_AUTH_LEN - auth_len) ));
810 goto err;
811 }
812
813 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in_p, 0)) {
814 DEBUG(0,("api_pipe_bind_auth3: failed to "
815 "unmarshall RPC_HDR_AUTH.\n"));
816 goto err;
817 }
818
819 /* We must NEVER look at auth_info->auth_pad_len here,
820 * as old Samba client code gets it wrong and sends it
821 * as zero. JRA.
822 */
823
824 if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
825 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
826 (unsigned int)auth_info.auth_type ));
827 return False;
828 }
829
830 blob = data_blob(NULL,p->hdr.auth_len);
831
832 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
833 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
834 (unsigned int)p->hdr.auth_len ));
835 goto err;
836 }
837
838 /*
839 * The following call actually checks the challenge/response data.
840 * for correctness against the given DOMAIN\user name.
841 */
842
843 if (!pipe_ntlmssp_verify_final(p, &blob)) {
844 goto err;
845 }
846
847 data_blob_free(&blob);
848
849 p->pipe_bound = True;
850
851 return True;
852
853 err:
854
855 data_blob_free(&blob);
856 free_pipe_ntlmssp_auth_data(&p->auth);
857 p->auth.a_u.auth_ntlmssp_state = NULL;
858
859 return False;
860 }
861
862 /*******************************************************************
863 Marshall a bind_nak pdu.
864 *******************************************************************/
865
866 static bool setup_bind_nak(pipes_struct *p)
867 {
868 RPC_HDR nak_hdr;
869 uint16 zero = 0;
870
871 /* Free any memory in the current return data buffer. */
872 prs_mem_free(&p->out_data.rdata);
873
874 /*
875 * Marshall directly into the outgoing PDU space. We
876 * must do this as we need to set to the bind response
877 * header and are never sending more than one PDU here.
878 */
879
880 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
881
882 /*
883 * Initialize a bind_nak header.
884 */
885
886 init_rpc_hdr(&nak_hdr, DCERPC_PKT_BIND_NAK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
887 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
888
889 /*
890 * Marshall the header into the outgoing PDU.
891 */
892
893 if(!smb_io_rpc_hdr("", &nak_hdr, &p->out_data.frag, 0)) {
894 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
895 prs_mem_free(&p->out_data.frag);
896 return False;
897 }
898
899 /*
900 * Now add the reject reason.
901 */
902
903 if(!prs_uint16("reject code", &p->out_data.frag, 0, &zero)) {
904 prs_mem_free(&p->out_data.frag);
905 return False;
906 }
907
908 p->out_data.data_sent_length = 0;
909 p->out_data.current_pdu_sent = 0;
910
911 if (p->auth.auth_data_free_func) {
912 (*p->auth.auth_data_free_func)(&p->auth);
913 }
914 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
915 p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
916 p->pipe_bound = False;
917
918 return True;
919 }
920
921 /*******************************************************************
922 Marshall a fault pdu.
923 *******************************************************************/
924
925 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
926 {
927 RPC_HDR fault_hdr;
928 RPC_HDR_RESP hdr_resp;
929 RPC_HDR_FAULT fault_resp;
930
931 /* Free any memory in the current return data buffer. */
932 prs_mem_free(&p->out_data.rdata);
933
934 /*
935 * Marshall directly into the outgoing PDU space. We
936 * must do this as we need to set to the bind response
937 * header and are never sending more than one PDU here.
938 */
939
940 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
941
942 /*
943 * Initialize a fault header.
944 */
945
946 init_rpc_hdr(&fault_hdr, DCERPC_PKT_FAULT, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST | DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
947 p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
948
949 /*
950 * Initialize the HDR_RESP and FAULT parts of the PDU.
951 */
952
953 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
954
955 fault_resp.status = status;
956 fault_resp.reserved = 0;
957
958 /*
959 * Marshall the header into the outgoing PDU.
960 */
961
962 if(!smb_io_rpc_hdr("", &fault_hdr, &p->out_data.frag, 0)) {
963 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
964 prs_mem_free(&p->out_data.frag);
965 return False;
966 }
967
968 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
969 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
970 prs_mem_free(&p->out_data.frag);
971 return False;
972 }
973
974 if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &p->out_data.frag, 0)) {
975 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
976 prs_mem_free(&p->out_data.frag);
977 return False;
978 }
979
980 p->out_data.data_sent_length = 0;
981 p->out_data.current_pdu_sent = 0;
982
983 return True;
984 }
985
986 #if 0
987 /*******************************************************************
988 Marshall a cancel_ack pdu.
989 We should probably check the auth-verifier here.
990 *******************************************************************/
991
992 bool setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
993 {
994 prs_struct outgoing_pdu;
995 RPC_HDR ack_reply_hdr;
996
997 /* Free any memory in the current return data buffer. */
998 prs_mem_free(&p->out_data.rdata);
999
1000 /*
1001 * Marshall directly into the outgoing PDU space. We
1002 * must do this as we need to set to the bind response
1003 * header and are never sending more than one PDU here.
1004 */
1005
1006 prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
1007 prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1008
1009 /*
1010 * Initialize a cancel_ack header.
1011 */
1012
1013 init_rpc_hdr(&ack_reply_hdr, DCERPC_PKT_CANCEL_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1014 p->hdr.call_id, RPC_HEADER_LEN, 0);
1015
1016 /*
1017 * Marshall the header into the outgoing PDU.
1018 */
1019
1020 if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
1021 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
1022 prs_mem_free(&outgoing_pdu);
1023 return False;
1024 }
1025
1026 p->out_data.data_sent_length = 0;
1027 p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
1028 p->out_data.current_pdu_sent = 0;
1029
1030 prs_mem_free(&outgoing_pdu);
1031 return True;
1032 }
1033 #endif
1034
1035 /*******************************************************************
1036 Ensure a bind request has the correct abstract & transfer interface.
1037 Used to reject unknown binds from Win2k.
1038 *******************************************************************/
1039
1040 static bool check_bind_req(struct pipes_struct *p,
1041 struct ndr_syntax_id* abstract,
1042 struct ndr_syntax_id* transfer,
1043 uint32 context_id)
1044 {
1045 int i=0;
1046 struct pipe_rpc_fns *context_fns;
1047
1048 DEBUG(3,("check_bind_req for %s\n",
1049 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1050
1051 /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
1052
1053 for (i=0; i<rpc_lookup_size; i++) {
1054 DEBUGADD(10, ("checking %s\n", rpc_lookup[i].pipe.clnt));
1055 if (ndr_syntax_id_equal(
1056 abstract, &rpc_lookup[i].rpc_interface)
1057 && ndr_syntax_id_equal(
1058 transfer, &ndr_transfer_syntax)) {
1059 break;
1060 }
1061 }
1062
1063 if (i == rpc_lookup_size) {
1064 return false;
1065 }
1066
1067 context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
1068 if (context_fns == NULL) {
1069 DEBUG(0,("check_bind_req: malloc() failed!\n"));
1070 return False;
1071 }
1072
1073 context_fns->cmds = rpc_lookup[i].cmds;
1074 context_fns->n_cmds = rpc_lookup[i].n_cmds;
1075 context_fns->context_id = context_id;
1076
1077 /* add to the list of open contexts */
1078
1079 DLIST_ADD( p->contexts, context_fns );
1080
1081 return True;
1082 }
1083
1084 /*******************************************************************
1085 Register commands to an RPC pipe
1086 *******************************************************************/
1087
1088 NTSTATUS rpc_srv_register(int version, const char *clnt, const char *srv,
1089 const struct ndr_interface_table *iface,
1090 const struct api_struct *cmds, int size)
1091 {
1092 struct rpc_table *rpc_entry;
1093
1094 if (!clnt || !srv || !cmds) {
1095 return NT_STATUS_INVALID_PARAMETER;
1096 }
1097
1098 if (version != SMB_RPC_INTERFACE_VERSION) {
1099 DEBUG(0,("Can't register rpc commands!\n"
1100 "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1101 ", while this version of samba uses version %d!\n",
1102 version,SMB_RPC_INTERFACE_VERSION));
1103 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1104 }
1105
1106 /* TODO:
1107 *
1108 * we still need to make sure that don't register the same commands twice!!!
1109 *
1110 * --metze
1111 */
1112
1113 /* We use a temporary variable because this call can fail and
1114 rpc_lookup will still be valid afterwards. It could then succeed if
1115 called again later */
1116 rpc_lookup_size++;
1117 rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1118 if (NULL == rpc_entry) {
1119 rpc_lookup_size--;
1120 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1121 return NT_STATUS_NO_MEMORY;
1122 } else {
1123 rpc_lookup = rpc_entry;
1124 }
1125
1126 rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1127 ZERO_STRUCTP(rpc_entry);
1128 rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1129 rpc_entry->pipe.srv = SMB_STRDUP(srv);
1130 rpc_entry->rpc_interface = iface->syntax_id;
1131 rpc_entry->cmds = cmds;
1132 rpc_entry->n_cmds = size;
1133
1134 return NT_STATUS_OK;
1135 }
1136
1137 /**
1138 * Is a named pipe known?
1139 * @param[in] cli_filename The pipe name requested by the client
1140 * @result Do we want to serve this?
1141 */
1142 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1143 {
1144 const char *pipename = cli_filename;
1145 int i;
1146 NTSTATUS status;
1147
1148 if (strnequal(pipename, "\\PIPE\\", 6)) {
1149 pipename += 5;
1150 }
1151
1152 if (*pipename == '\\') {
1153 pipename += 1;
1154 }
1155
1156 if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1157 DEBUG(10, ("refusing spoolss access\n"));
1158 return false;
1159 }
1160
1161 for (i=0; i<rpc_lookup_size; i++) {
1162 if (strequal(pipename, rpc_lookup[i].pipe.clnt)) {
1163 *syntax = rpc_lookup[i].rpc_interface;
1164 return true;
1165 }
1166 }
1167
1168 status = smb_probe_module("rpc", pipename);
1169 if (!NT_STATUS_IS_OK(status)) {
1170 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1171 return false;
1172 }
1173 DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
1174
1175 /*
1176 * Scan the list again for the interface id
1177 */
1178
1179 for (i=0; i<rpc_lookup_size; i++) {
1180 if (strequal(pipename, rpc_lookup[i].pipe.clnt)) {
1181 *syntax = rpc_lookup[i].rpc_interface;
1182 return true;
1183 }
1184 }
1185
1186 DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
1187 pipename));
1188
1189 return false;
1190 }
1191
1192 /*******************************************************************
1193 Handle a SPNEGO krb5 bind auth.
1194 *******************************************************************/
1195
1196 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1197 DATA_BLOB *psecblob, prs_struct *pout_auth)
1198 {
1199 return False;
1200 }
1201
1202 /*******************************************************************
1203 Handle the first part of a SPNEGO bind auth.
1204 *******************************************************************/
1205
1206 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1207 uint32_t ss_padding_len,
1208 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1209 {
1210 DATA_BLOB blob;
1211 DATA_BLOB secblob;
1212 DATA_BLOB response;
1213 DATA_BLOB chal;
1214 char *OIDs[ASN1_MAX_OIDS];
1215 int i;
1216 NTSTATUS status;
1217 bool got_kerberos_mechanism = false;
1218 struct auth_ntlmssp_state *a = NULL;
1219 RPC_HDR_AUTH auth_info;
1220
1221 ZERO_STRUCT(secblob);
1222 ZERO_STRUCT(chal);
1223 ZERO_STRUCT(response);
1224
1225 /* Grab the SPNEGO blob. */
1226 blob = data_blob(NULL,p->hdr.auth_len);
1227
1228 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1229 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1230 (unsigned int)p->hdr.auth_len ));
1231 goto err;
1232 }
1233
1234 if (blob.data[0] != ASN1_APPLICATION(0)) {
1235 goto err;
1236 }
1237
1238 /* parse out the OIDs and the first sec blob */
1239 if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1240 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1241 goto err;
1242 }
1243
1244 if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1245 got_kerberos_mechanism = true;
1246 }
1247
1248 for (i=0;OIDs[i];i++) {
1249 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1250 TALLOC_FREE(OIDs[i]);
1251 }
1252 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1253
1254 if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1255 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1256 data_blob_free(&secblob);
1257 data_blob_free(&blob);
1258 return ret;
1259 }
1260
1261 if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1262 /* Free any previous auth type. */
1263 free_pipe_ntlmssp_auth_data(&p->auth);
1264 }
1265
1266 if (!got_kerberos_mechanism) {
1267 /* Initialize the NTLM engine. */
1268 status = auth_ntlmssp_start(&a);
1269 if (!NT_STATUS_IS_OK(status)) {
1270 goto err;
1271 }
1272
1273 /*
1274 * Pass the first security blob of data to it.
1275 * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1276 * which means we need another packet to complete the bind.
1277 */
1278
1279 status = auth_ntlmssp_update(a, secblob, &chal);
1280
1281 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1282 DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1283 goto err;
1284 }
1285
1286 /* Generate the response blob we need for step 2 of the bind. */
1287 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1288 } else {
1289 /*
1290 * SPNEGO negotiate down to NTLMSSP. The subsequent
1291 * code to process follow-up packets is not complete
1292 * yet. JRA.
1293 */
1294 response = spnego_gen_auth_response(NULL,
1295 NT_STATUS_MORE_PROCESSING_REQUIRED,
1296 OID_NTLMSSP);
1297 }
1298
1299 /* auth_pad_len will be handled by the caller */
1300
1301 /* Copy the blob into the pout_auth parse struct */
1302 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1303 pauth_info->auth_level, ss_padding_len, 1);
1304 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1305 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1306 goto err;
1307 }
1308
1309 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1310 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1311 goto err;
1312 }
1313
1314 p->auth.a_u.auth_ntlmssp_state = a;
1315 p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1316 p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1317
1318 data_blob_free(&blob);
1319 data_blob_free(&secblob);
1320 data_blob_free(&chal);
1321 data_blob_free(&response);
1322
1323 /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1324 return True;
1325
1326 err:
1327
1328 data_blob_free(&blob);
1329 data_blob_free(&secblob);
1330 data_blob_free(&chal);
1331 data_blob_free(&response);
1332
1333 p->auth.a_u.auth_ntlmssp_state = NULL;
1334
1335 return False;
1336 }
1337
1338 /*******************************************************************
1339 Handle the second part of a SPNEGO bind auth.
1340 *******************************************************************/
1341
1342 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1343 uint32_t ss_padding_len,
1344 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1345 {
1346 RPC_HDR_AUTH auth_info;
1347 DATA_BLOB spnego_blob;
1348 DATA_BLOB auth_blob;
1349 DATA_BLOB auth_reply;
1350 DATA_BLOB response;
1351 struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
1352
1353 ZERO_STRUCT(spnego_blob);
1354 ZERO_STRUCT(auth_blob);
1355 ZERO_STRUCT(auth_reply);
1356 ZERO_STRUCT(response);
1357
1358 /*
1359 * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1360 * fail here as 'a' == NULL.
1361 */
1362 if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1363 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1364 goto err;
1365 }
1366
1367 /* Grab the SPNEGO blob. */
1368 spnego_blob = data_blob(NULL,p->hdr.auth_len);
1369
1370 if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1371 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1372 (unsigned int)p->hdr.auth_len ));
1373 goto err;
1374 }
1375
1376 if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1377 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1378 goto err;
1379 }
1380
1381 if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1382 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1383 goto err;
1384 }
1385
1386 /*
1387 * The following call actually checks the challenge/response data.
1388 * for correctness against the given DOMAIN\user name.
1389 */
1390
1391 if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1392 goto err;
1393 }
1394
1395 data_blob_free(&spnego_blob);
1396 data_blob_free(&auth_blob);
1397
1398 /* Generate the spnego "accept completed" blob - no incoming data. */
1399 response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1400
1401 /* FIXME - add auth_pad_len here ! */
1402
1403 /* Copy the blob into the pout_auth parse struct */
1404 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1405 pauth_info->auth_level, ss_padding_len, 1);
1406 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1407 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1408 goto err;
1409 }
1410
1411 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1412 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1413 goto err;
1414 }
1415
1416 data_blob_free(&auth_reply);
1417 data_blob_free(&response);
1418
1419 p->pipe_bound = True;
1420
1421 return True;
1422
1423 err:
1424
1425 data_blob_free(&spnego_blob);
1426 data_blob_free(&auth_blob);
1427 data_blob_free(&auth_reply);
1428 data_blob_free(&response);
1429
1430 free_pipe_ntlmssp_auth_data(&p->auth);
1431 p->auth.a_u.auth_ntlmssp_state = NULL;
1432
1433 return False;
1434 }
1435
1436 /*******************************************************************
1437 Handle an schannel bind auth.
1438 *******************************************************************/
1439
1440 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1441 uint32_t ss_padding_len,
1442 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1443 {
1444 RPC_HDR_AUTH auth_info;
1445 struct NL_AUTH_MESSAGE neg;
1446 struct NL_AUTH_MESSAGE reply;
1447 bool ret;
1448 NTSTATUS status;
1449 struct netlogon_creds_CredentialState *creds;
1450 DATA_BLOB session_key;
1451 enum ndr_err_code ndr_err;
1452 DATA_BLOB blob;
1453
1454 blob = data_blob_const(prs_data_p(rpc_in_p) + prs_offset(rpc_in_p),
1455 prs_data_size(rpc_in_p));
1456
1457 ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), &neg,
1458 (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1459 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1460 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1461 return false;
1462 }
1463
1464 if (DEBUGLEVEL >= 10) {
1465 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1466 }
1467
1468 if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1469 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1470 return false;
1471 }
1472
1473 /*
1474 * The neg.oem_netbios_computer.a key here must match the remote computer name
1475 * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1476 * operations that use credentials.
1477 */
1478
1479 become_root();
1480 status = schannel_get_creds_state(p, lp_private_dir(),
1481 neg.oem_netbios_computer.a, &creds);
1482 unbecome_root();
1483
1484 if (!NT_STATUS_IS_OK(status)) {
1485 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1486 return False;
1487 }
1488
1489 p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1490 if (!p->auth.a_u.schannel_auth) {
1491 TALLOC_FREE(creds);
1492 return False;
1493 }
1494
1495 p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1496 p->auth.a_u.schannel_auth->seq_num = 0;
1497 p->auth.a_u.schannel_auth->initiator = false;
1498 p->auth.a_u.schannel_auth->creds = creds;
1499
1500 /*
1501 * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1502 * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1503 * struct of the person who opened the pipe. I need to test this further. JRA.
1504 *
1505 * VL. As we are mapping this to guest set the generic key
1506 * "SystemLibraryDTC" key here. It's a bit difficult to test against
1507 * W2k3, as it does not allow schannel binds against SAMR and LSA
1508 * anymore.
1509 */
1510
1511 session_key = generic_session_key();
1512 if (session_key.data == NULL) {
1513 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1514 " key\n"));
1515 return false;
1516 }
1517
1518 ret = server_info_set_session_key(p->server_info, session_key);
1519
1520 data_blob_free(&session_key);
1521
1522 if (!ret) {
1523 DEBUG(0, ("server_info_set_session_key failed\n"));
1524 return false;
1525 }
1526
1527 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SCHANNEL,
1528 pauth_info->auth_level, ss_padding_len, 1);
1529 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1530 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1531 return False;
1532 }
1533
1534 /*** SCHANNEL verifier ***/
1535
1536 reply.MessageType = NL_NEGOTIATE_RESPONSE;
1537 reply.Flags = 0;
1538 reply.Buffer.dummy = 5; /* ??? actually I don't think
1539 * this has any meaning
1540 * here - gd */
1541
1542 ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &reply,
1543 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1544 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1545 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1546 return false;
1547 }
1548
1549 if (DEBUGLEVEL >= 10) {
1550 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1551 }
1552
1553 if (!prs_copy_data_in(pout_auth, (const char *)blob.data, blob.length)) {
1554 return false;
1555 }
1556
1557 DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1558 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1559
1560 /* We're finished with this bind - no more packets. */
1561 p->auth.auth_data_free_func = NULL;
1562 p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1563
1564 p->pipe_bound = True;
1565
1566 return True;
1567 }
1568
1569 /*******************************************************************
1570 Handle an NTLMSSP bind auth.
1571 *******************************************************************/
1572
1573 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1574 uint32_t ss_padding_len,
1575 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1576 {
1577 RPC_HDR_AUTH auth_info;
1578 DATA_BLOB blob;
1579 DATA_BLOB response;
1580 NTSTATUS status;
1581 struct auth_ntlmssp_state *a = NULL;
1582
1583 ZERO_STRUCT(blob);
1584 ZERO_STRUCT(response);
1585
1586 /* Grab the NTLMSSP blob. */
1587 blob = data_blob(NULL,p->hdr.auth_len);
1588
1589 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1590 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1591 (unsigned int)p->hdr.auth_len ));
1592 goto err;
1593 }
1594
1595 if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1596 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1597 goto err;
1598 }
1599
1600 /* We have an NTLMSSP blob. */
1601 status = auth_ntlmssp_start(&a);
1602 if (!NT_STATUS_IS_OK(status)) {
1603 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1604 nt_errstr(status) ));
1605 goto err;
1606 }
1607
1608 status = auth_ntlmssp_update(a, blob, &response);
1609 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1610 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1611 nt_errstr(status) ));
1612 goto err;
1613 }
1614
1615 data_blob_free(&blob);
1616
1617 /* Copy the blob into the pout_auth parse struct */
1618 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_NTLMSSP,
1619 pauth_info->auth_level, ss_padding_len, 1);
1620 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1621 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1622 goto err;
1623 }
1624
1625 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1626 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1627 goto err;
1628 }
1629
1630 p->auth.a_u.auth_ntlmssp_state = a;
1631 p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1632 p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1633
1634 data_blob_free(&blob);
1635 data_blob_free(&response);
1636
1637 DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1638
1639 /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1640 return True;
1641
1642 err:
1643
1644 data_blob_free(&blob);
1645 data_blob_free(&response);
1646
1647 free_pipe_ntlmssp_auth_data(&p->auth);
1648 p->auth.a_u.auth_ntlmssp_state = NULL;
1649 return False;
1650 }
1651
1652 /*******************************************************************
1653 Respond to a pipe bind request.
1654 *******************************************************************/
1655
1656 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1657 {
1658 RPC_HDR_BA hdr_ba;
1659 RPC_HDR_RB hdr_rb;
1660 RPC_HDR_AUTH auth_info;
1661 uint16 assoc_gid;
1662 fstring ack_pipe_name;
1663 prs_struct out_hdr_ba;
1664 prs_struct out_auth;
1665 int i = 0;
1666 int auth_len = 0;
1667 unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1668 uint32_t ss_padding_len = 0;
1669
1670 /* No rebinds on a bound pipe - use alter context. */
1671 if (p->pipe_bound) {
1672 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1673 "pipe %s.\n",
1674 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1675 return setup_bind_nak(p);
1676 }
1677
1678 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1679
1680 /*
1681 * Marshall directly into the outgoing PDU space. We
1682 * must do this as we need to set to the bind response
1683 * header and are never sending more than one PDU here.
1684 */
1685
1686 /*
1687 * Setup the memory to marshall the ba header, and the
1688 * auth footers.
1689 */
1690
1691 if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1692 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1693 prs_mem_free(&p->out_data.frag);
1694 return False;
1695 }
1696
1697 if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1698 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1699 prs_mem_free(&p->out_data.frag);
1700 prs_mem_free(&out_hdr_ba);
1701 return False;
1702 }
1703
1704 DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1705
1706 ZERO_STRUCT(hdr_rb);
1707
1708 /* decode the bind request */
1709
1710 if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0)) {
1711 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB "
1712 "struct.\n"));
1713 goto err_exit;
1714 }
1715
1716 if (hdr_rb.num_contexts == 0) {
1717 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1718 goto err_exit;
1719 }
1720
1721 /*
1722 * Try and find the correct pipe name to ensure
1723 * that this is a pipe name we support.
1724 */
1725
1726 for (i = 0; i < rpc_lookup_size; i++) {
1727 if (ndr_syntax_id_equal(&rpc_lookup[i].rpc_interface,
1728 &hdr_rb.rpc_context[0].abstract)) {
1729 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1730 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1731 break;
1732 }
1733 }
1734
1735 if (i == rpc_lookup_size) {
1736 NTSTATUS status;
1737
1738 status = smb_probe_module(
1739 "rpc", get_pipe_name_from_syntax(
1740 talloc_tos(),
1741 &hdr_rb.rpc_context[0].abstract));
1742
1743 if (NT_STATUS_IS_ERR(status)) {
1744 DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1745 get_pipe_name_from_syntax(
1746 talloc_tos(),
1747 &hdr_rb.rpc_context[0].abstract)));
1748 prs_mem_free(&p->out_data.frag);
1749 prs_mem_free(&out_hdr_ba);
1750 prs_mem_free(&out_auth);
1751
1752 return setup_bind_nak(p);
1753 }
1754
1755 for (i = 0; i < rpc_lookup_size; i++) {
1756 if (strequal(rpc_lookup[i].pipe.clnt,
1757 get_pipe_name_from_syntax(talloc_tos(),
1758 &p->syntax))) {
1759 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1760 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1761 break;
1762 }
1763 }
1764
1765 if (i == rpc_lookup_size) {
1766 DEBUG(0, ("module %s doesn't provide functions for "
1767 "pipe %s!\n",
1768 get_pipe_name_from_syntax(talloc_tos(),
1769 &p->syntax),
1770 get_pipe_name_from_syntax(talloc_tos(),
1771 &p->syntax)));
1772 goto err_exit;
1773 }
1774 }
1775
1776 /* name has to be \PIPE\xxxxx */
1777 fstrcpy(ack_pipe_name, "\\PIPE\\");
1778 fstrcat(ack_pipe_name, rpc_lookup[i].pipe.srv);
1779
1780 DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1781
1782 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1783
1784 /*
1785 * Create the bind response struct.
1786 */
1787
1788 /* If the requested abstract synt uuid doesn't match our client pipe,
1789 reject the bind_ack & set the transfer interface synt to all 0's,
1790 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1791 unknown to NT4)
1792 Needed when adding entries to a DACL from NT5 - SK */
1793
1794 if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1795 hdr_rb.rpc_context[0].context_id )) {
1796 init_rpc_hdr_ba(&hdr_ba,
1797 RPC_MAX_PDU_FRAG_LEN,
1798 RPC_MAX_PDU_FRAG_LEN,
1799 assoc_gid,
1800 ack_pipe_name,
1801 0x1, 0x0, 0x0,
1802 &hdr_rb.rpc_context[0].transfer[0]);
1803 } else {
1804 /* Rejection reason: abstract syntax not supported */
1805 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1806 RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1807 ack_pipe_name, 0x1, 0x2, 0x1,
1808 &null_ndr_syntax_id);
1809 p->pipe_bound = False;
1810 }
1811
1812 /*
1813 * and marshall it.
1814 */
1815
1816 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1817 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1818 goto err_exit;
1819 }
1820
1821 /*
1822 * Check if this is an authenticated bind request.
1823 */
1824
1825 if (p->hdr.auth_len) {
1826 /*
1827 * Decode the authentication verifier.
1828 */
1829
1830 /* Work out any padding needed before the auth footer. */
1831 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
1832 ss_padding_len = SERVER_NDR_PADDING_SIZE -
1833 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
1834 DEBUG(10,("api_pipe_bind_req: auth pad_len = %u\n",
1835 (unsigned int)ss_padding_len ));
1836 }
1837
1838 /* Quick length check. Won't catch a bad auth footer,
1839 * prevents overrun. */
1840
1841 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
1842 DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
1843 "too long for fragment %u.\n",
1844 (unsigned int)p->hdr.auth_len,
1845 (unsigned int)p->hdr.frag_len ));
1846 goto err_exit;
1847 }
1848
1849 /* Pull the auth header and the following data into a blob. */
1850 /* NB. The offset of the auth_header is relative to the *end*
1851 * of the packet, not the start. Also, the length of the
1852 * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
1853 * as the RPC header isn't included in rpc_in_p. */
1854 if(!prs_set_offset(rpc_in_p,
1855 p->hdr.frag_len - RPC_HEADER_LEN -
1856 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
1857 DEBUG(0,("api_pipe_bind_req: cannot move "
1858 "offset to %u.\n",
1859 (unsigned int)(p->hdr.frag_len -
1860 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
1861 goto err_exit;
1862 }
1863
1864 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1865 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1866 goto err_exit;
1867 }
1868
1869 auth_type = auth_info.auth_type;
1870
1871 /* Work out if we have to sign or seal etc. */
1872 switch (auth_info.auth_level) {
1873 case DCERPC_AUTH_LEVEL_INTEGRITY:
1874 p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1875 break;
1876 case DCERPC_AUTH_LEVEL_PRIVACY:
1877 p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1878 break;
1879 default:
1880 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1881 (unsigned int)auth_info.auth_level ));
1882 goto err_exit;
1883 }
1884 } else {
1885 ZERO_STRUCT(auth_info);
1886 }
1887
1888 switch(auth_type) {
1889 case DCERPC_AUTH_TYPE_NTLMSSP:
1890 if (!pipe_ntlmssp_auth_bind(p, rpc_in_p,
1891 ss_padding_len, &auth_info, &out_auth)) {
1892 goto err_exit;
1893 }
1894 assoc_gid = 0x7a77;
1895 break;
1896
1897 case DCERPC_AUTH_TYPE_SCHANNEL:
1898 if (!pipe_schannel_auth_bind(p, rpc_in_p,
1899 ss_padding_len, &auth_info, &out_auth)) {
1900 goto err_exit;
1901 }
1902 break;
1903
1904 case DCERPC_AUTH_TYPE_SPNEGO:
1905 if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p,
1906 ss_padding_len, &auth_info, &out_auth)) {
1907 goto err_exit;
1908 }
1909 break;
1910
1911 case DCERPC_AUTH_TYPE_NONE:
1912 /* Unauthenticated bind request. */
1913 /* We're finished - no more packets. */
1914 p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1915 /* We must set the pipe auth_level here also. */
1916 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1917 p->pipe_bound = True;
1918 /* The session key was initialized from the SMB
1919 * session in make_internal_rpc_pipe_p */
1920 ss_padding_len = 0;
1921 break;
1922
1923 default:
1924 DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1925 goto err_exit;
1926 }
1927 /*
1928 * Create the header, now we know the length.
1929 */
1930
1931 if (prs_offset(&out_auth)) {
1932 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1933 }
1934
1935 init_rpc_hdr(&p->hdr, DCERPC_PKT_BIND_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1936 p->hdr.call_id,
1937 RPC_HEADER_LEN + prs_offset(&out_hdr_ba) +
1938 ss_padding_len + prs_offset(&out_auth),
1939 auth_len);
1940
1941 /*
1942 * Marshall the header into the outgoing PDU.
1943 */
1944
1945 if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1946 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1947 goto err_exit;
1948 }
1949
1950 /*
1951 * Now add the RPC_HDR_BA and any auth needed.
1952 */
1953
1954 if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1955 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1956 goto err_exit;
1957 }
1958
1959 if (auth_len) {
1960 if (ss_padding_len) {
1961 char pad[SERVER_NDR_PADDING_SIZE];
1962 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1963 if (!prs_copy_data_in(&p->out_data.frag, pad,
1964 ss_padding_len)) {
1965 DEBUG(0,("api_pipe_bind_req: failed to add %u "
1966 "bytes of pad data.\n",
1967 (unsigned int)ss_padding_len));
1968 goto err_exit;
1969 }
1970 }
1971
1972 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1973 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1974 goto err_exit;
1975 }
1976 }
1977
1978 /*
1979 * Setup the lengths for the initial reply.
1980 */
1981
1982 p->out_data.data_sent_length = 0;
1983 p->out_data.current_pdu_sent = 0;
1984
1985 prs_mem_free(&out_hdr_ba);
1986 prs_mem_free(&out_auth);
1987
1988 return True;
1989
1990 err_exit:
1991
1992 prs_mem_free(&p->out_data.frag);
1993 prs_mem_free(&out_hdr_ba);
1994 prs_mem_free(&out_auth);
1995 return setup_bind_nak(p);
1996 }
1997
1998 /****************************************************************************
1999 Deal with an alter context call. Can be third part of 3 leg auth request for
2000 SPNEGO calls.
2001 ****************************************************************************/
2002
2003 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
2004 {
2005 RPC_HDR_BA hdr_ba;
2006 RPC_HDR_RB hdr_rb;
2007 RPC_HDR_AUTH auth_info;
2008 uint16 assoc_gid;
2009 fstring ack_pipe_name;
2010 prs_struct out_hdr_ba;
2011 prs_struct out_auth;
2012 int auth_len = 0;
2013 uint32_t ss_padding_len = 0;
2014
2015 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
2016
2017 /*
2018 * Marshall directly into the outgoing PDU space. We
2019 * must do this as we need to set to the bind response
2020 * header and are never sending more than one PDU here.
2021 */
2022
2023 /*
2024 * Setup the memory to marshall the ba header, and the
2025 * auth footers.
2026 */
2027
2028 if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
2029 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
2030 prs_mem_free(&p->out_data.frag);
2031 return False;
2032 }
2033
2034 if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
2035 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
2036 prs_mem_free(&p->out_data.frag);
2037 prs_mem_free(&out_hdr_ba);
2038 return False;
2039 }
2040
2041 ZERO_STRUCT(hdr_rb);
2042
2043 DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
2044
2045 /* decode the alter context request */
2046 if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0)) {
2047 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
2048 goto err_exit;
2049 }
2050
2051 /* secondary address CAN be NULL
2052 * as the specs say it's ignored.
2053 * It MUST be NULL to have the spoolss working.
2054 */
2055 fstrcpy(ack_pipe_name,"");
2056
2057 DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
2058
2059 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
2060
2061 /*
2062 * Create the bind response struct.
2063 */
2064
2065 /* If the requested abstract synt uuid doesn't match our client pipe,
2066 reject the bind_ack & set the transfer interface synt to all 0's,
2067 ver 0 (observed when NT5 attempts to bind to abstract interfaces
2068 unknown to NT4)
2069 Needed when adding entries to a DACL from NT5 - SK */
2070
2071 if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
2072 hdr_rb.rpc_context[0].context_id )) {
2073 init_rpc_hdr_ba(&hdr_ba,
2074 RPC_MAX_PDU_FRAG_LEN,
2075 RPC_MAX_PDU_FRAG_LEN,
2076 assoc_gid,
2077 ack_pipe_name,
2078 0x1, 0x0, 0x0,
2079 &hdr_rb.rpc_context[0].transfer[0]);
2080 } else {
2081 /* Rejection reason: abstract syntax not supported */
2082 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
2083 RPC_MAX_PDU_FRAG_LEN, assoc_gid,
2084 ack_pipe_name, 0x1, 0x2, 0x1,
2085 &null_ndr_syntax_id);
2086 p->pipe_bound = False;
2087 }
2088
2089 /*
2090 * and marshall it.
2091 */
2092
2093 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
2094 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
2095 goto err_exit;
2096 }
2097
2098
2099 /*
2100 * Check if this is an authenticated alter context request.
2101 */
2102
2103 if (p->hdr.auth_len != 0) {
2104 /*
2105 * Decode the authentication verifier.
2106 */
2107
2108 /* Work out any padding needed before the auth footer. */
2109 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
2110 ss_padding_len = SERVER_NDR_PADDING_SIZE -
2111 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
2112 DEBUG(10,("api_pipe_alter_context: auth pad_len = %u\n",
2113 (unsigned int)ss_padding_len ));
2114 }
2115
2116 /* Quick length check. Won't catch a bad auth footer,
2117 * prevents overrun. */
2118
2119 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
2120 DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
2121 "too long for fragment %u.\n",
2122 (unsigned int)p->hdr.auth_len,
2123 (unsigned int)p->hdr.frag_len ));
2124 goto err_exit;
2125 }
2126
2127 /* Pull the auth header and the following data into a blob. */
2128 /* NB. The offset of the auth_header is relative to the *end*
2129 * of the packet, not the start. Also, the length of the
2130 * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2131 * as the RPC header isn't included in rpc_in_p. */
2132 if(!prs_set_offset(rpc_in_p,
2133 p->hdr.frag_len - RPC_HEADER_LEN -
2134 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
2135 DEBUG(0,("api_alter_context: cannot move "
2136 "offset to %u.\n",
2137 (unsigned int)(p->hdr.frag_len -
2138 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
2139 goto err_exit;
2140 }
2141
2142 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
2143 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
2144 goto err_exit;
2145 }
2146
2147 /*
2148 * Currently only the SPNEGO auth type uses the alter ctx
2149 * response in place of the NTLMSSP auth3 type.
2150 */
2151
2152 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
2153 /* We can only finish if the pipe is unbound. */
2154 if (!p->pipe_bound) {
2155 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p,
2156 ss_padding_len, &auth_info, &out_auth)) {
2157 goto err_exit;
2158 }
2159 } else {
2160 goto err_exit;
2161 }
2162 }
2163 } else {
2164 ZERO_STRUCT(auth_info);
2165 }
2166 /*
2167 * Create the header, now we know the length.
2168 */
2169
2170 if (prs_offset(&out_auth)) {
2171 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
2172 }
2173
2174 init_rpc_hdr(&p->hdr, DCERPC_PKT_ALTER_RESP, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
2175 p->hdr.call_id,
2176 RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
2177 auth_len);
2178
2179 /*
2180 * Marshall the header into the outgoing PDU.
2181 */
2182
2183 if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
2184 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
2185 goto err_exit;
2186 }
2187
2188 /*
2189 * Now add the RPC_HDR_BA and any auth needed.
2190 */
2191
2192 if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
2193 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
2194 goto err_exit;
2195 }
2196
2197 if (auth_len) {
2198 if (ss_padding_len) {
2199 char pad[SERVER_NDR_PADDING_SIZE];
2200 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
2201 if (!prs_copy_data_in(&p->out_data.frag, pad,
2202 ss_padding_len)) {
2203 DEBUG(0,("api_pipe_alter_context: failed to add %u "
2204 "bytes of pad data.\n",
2205 (unsigned int)ss_padding_len));
2206 goto err_exit;
2207 }
2208 }
2209
2210 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
2211 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
2212 goto err_exit;
2213 }
2214 }
2215
2216 /*
2217 * Setup the lengths for the initial reply.
2218 */
2219
2220 p->out_data.data_sent_length = 0;
2221 p->out_data.current_pdu_sent = 0;
2222
2223 prs_mem_free(&out_hdr_ba);
2224 prs_mem_free(&out_auth);
2225
2226 return True;
2227
2228 err_exit:
2229
2230 prs_mem_free(&p->out_data.frag);
2231 prs_mem_free(&out_hdr_ba);
2232 prs_mem_free(&out_auth);
2233 return setup_bind_nak(p);
2234 }
2235
2236 /****************************************************************************
2237 Deal with NTLMSSP sign & seal processing on an RPC request.
2238 ****************************************************************************/
2239
2240 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
2241 uint32 *p_ss_padding_len, NTSTATUS *pstatus)
2242 {
2243 RPC_HDR_AUTH auth_info;
2244 uint32 auth_len = p->hdr.auth_len;
2245 uint32 save_offset = prs_offset(rpc_in);
2246 struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
2247 unsigned char *data = NULL;
2248 size_t data_len;
2249 unsigned char *full_packet_data = NULL;
2250 size_t full_packet_data_len;
2251 DATA_BLOB auth_blob;
2252
2253 *pstatus = NT_STATUS_OK;
2254
2255 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_NONE || p->auth.auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
2256 return True;
2257 }
2258
2259 if (!a) {
2260 *pstatus = NT_STATUS_INVALID_PARAMETER;
2261 return False;
2262 }
2263
2264 /* Ensure there's enough data for an authenticated request. */
2265 if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN
2266 + auth_len > p->hdr.frag_len) {
2267 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2268 (unsigned int)auth_len ));
2269 *pstatus = NT_STATUS_INVALID_PARAMETER;
2270 return False;
2271 }
2272
2273 /*
2274 * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2275 * after the RPC header.
2276 * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2277 * functions as NTLMv2 checks the rpc headers also.
2278 * Both of these values include any auth_pad_len bytes.
2279 */
2280
2281 data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2282 data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2283
2284 full_packet_data = p->in_data.current_in_pdu;
2285 full_packet_data_len = p->hdr.frag_len - auth_len;
2286
2287 /* Pull the auth header and the following data into a blob. */
2288 /* NB. The offset of the auth_header is relative to the *end*
2289 * of the packet, not the start. Also, the length of the
2290 * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2291 * as the RPC header isn't included in rpc_in_p. */
2292 if(!prs_set_offset(rpc_in,
2293 p->hdr.frag_len - RPC_HEADER_LEN -
2294 RPC_HDR_AUTH_LEN - auth_len)) {
2295 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move "
2296 "offset to %u.\n",
2297 (unsigned int)(p->hdr.frag_len -
2298 RPC_HDR_AUTH_LEN - auth_len) ));
2299 *pstatus = NT_STATUS_INVALID_PARAMETER;
2300 return False;
2301 }
2302
2303 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2304 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to "
2305 "unmarshall RPC_HDR_AUTH.\n"));
2306 *pstatus = NT_STATUS_INVALID_PARAMETER;
2307 return False;
2308 }
2309
2310 /* Ensure auth_pad_len fits into the packet. */
2311 if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2312 RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2313 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_info.auth_pad_len "
2314 "too large (%u), auth_len (%u), frag_len = (%u).\n",
2315 (unsigned int)auth_info.auth_pad_len,
2316 (unsigned int)auth_len,
2317 (unsigned int)p->hdr.frag_len ));
2318 *pstatus = NT_STATUS_INVALID_PARAMETER;
2319 return False;
2320 }
2321
2322 auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2323 auth_blob.length = auth_len;
2324
2325 switch (p->auth.auth_level) {
2326 case DCERPC_AUTH_LEVEL_PRIVACY:
2327 /* Data is encrypted. */
2328 *pstatus = auth_ntlmssp_unseal_packet(a,
2329 data, data_len,
2330 full_packet_data,
2331 full_packet_data_len,
2332 &auth_blob);
2333 if (!NT_STATUS_IS_OK(*pstatus)) {
2334 return False;
2335 }
2336 break;
2337 case DCERPC_AUTH_LEVEL_INTEGRITY:
2338 /* Data is signed. */
2339 *pstatus = auth_ntlmssp_check_packet(a,
2340 data, data_len,
2341 full_packet_data,
2342 full_packet_data_len,
2343 &auth_blob);
2344 if (!NT_STATUS_IS_OK(*pstatus)) {
2345 return False;
2346 }
2347 break;
2348 default:
2349 *pstatus = NT_STATUS_INVALID_PARAMETER;
2350 return False;
2351 }
2352
2353 /*
2354 * Return the current pointer to the data offset.
2355 */
2356
2357 if(!prs_set_offset(rpc_in, save_offset)) {
2358 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2359 (unsigned int)save_offset ));
2360 *pstatus = NT_STATUS_INVALID_PARAMETER;
2361 return False;
2362 }
2363
2364 /*
2365 * Remember the padding length. We must remove it from the real data
2366 * stream once the sign/seal is done.
2367 */
2368
2369 *p_ss_padding_len = auth_info.auth_pad_len;
2370
2371 return True;
2372 }
2373
2374 /****************************************************************************
2375 Deal with schannel processing on an RPC request.
2376 ****************************************************************************/
2377
2378 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2379 {
2380 uint32 data_len;
2381 uint32 auth_len;
2382 uint32 save_offset = prs_offset(rpc_in);
2383 RPC_HDR_AUTH auth_info;
2384 DATA_BLOB blob;
2385 NTSTATUS status;
2386 uint8_t *data;
2387
2388 auth_len = p->hdr.auth_len;
2389
2390 if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN ||
2391 auth_len > RPC_HEADER_LEN +
2392 RPC_HDR_REQ_LEN +
2393 RPC_HDR_AUTH_LEN +
2394 auth_len) {
2395 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2396 return False;
2397 }
2398
2399 /*
2400 * The following is that length of the data we must verify or unseal.
2401 * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2402 * preceeding the auth_data, but does include the auth_pad_len bytes.
2403 */
2404
2405 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2406 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2407 (unsigned int)p->hdr.frag_len,
2408 (unsigned int)auth_len ));
2409 return False;
2410 }
2411
2412 data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2413 RPC_HDR_AUTH_LEN - auth_len;
2414
2415 DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2416
2417 /* Pull the auth header and the following data into a blob. */
2418 /* NB. The offset of the auth_header is relative to the *end*
2419 * of the packet, not the start. Also, the length of the
2420 * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2421 * as the RPC header isn't included in rpc_in_p. */
2422 if(!prs_set_offset(rpc_in,
2423 p->hdr.frag_len - RPC_HEADER_LEN -
2424 RPC_HDR_AUTH_LEN - auth_len)) {
2425 DEBUG(0,("api_pipe_schannel_process: cannot move "
2426 "offset to %u.\n",
2427 (unsigned int)(p->hdr.frag_len -
2428 RPC_HDR_AUTH_LEN - auth_len) ));
2429 return False;
2430 }
2431
2432 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2433 DEBUG(0,("api_pipe_schannel_process: failed to "
2434 "unmarshall RPC_HDR_AUTH.\n"));
2435 return False;
2436 }
2437
2438 /* Ensure auth_pad_len fits into the packet. */
2439 if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2440 RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2441 DEBUG(0,("api_pipe_schannel_process: auth_info.auth_pad_len "
2442 "too large (%u), auth_len (%u), frag_len = (%u).\n",
2443 (unsigned int)auth_info.auth_pad_len,
2444 (unsigned int)auth_len,
2445 (unsigned int)p->hdr.frag_len ));
2446 return False;
2447 }
2448
2449 if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
2450 DEBUG(0,("Invalid auth info %d on schannel\n",
2451 auth_info.auth_type));
2452 return False;
2453 }
2454
2455 blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), auth_len);
2456
2457 if (DEBUGLEVEL >= 10) {
2458 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
2459 }
2460
2461 data = (uint8_t *)prs_data_p(rpc_in)+RPC_HDR_REQ_LEN;
2462
2463 switch (auth_info.auth_level) {
2464 case DCERPC_AUTH_LEVEL_PRIVACY:
2465 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2466 talloc_tos(),
2467 true,
2468 data,
2469 data_len,
2470 &blob);
2471 break;
2472 case DCERPC_AUTH_LEVEL_INTEGRITY:
2473 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2474 talloc_tos(),
2475 false,
2476 data,
2477 data_len,
2478 &blob);
2479 break;
2480 default:
2481 status = NT_STATUS_INTERNAL_ERROR;
2482 break;
2483 }
2484
2485 if (!NT_STATUS_IS_OK(status)) {
2486 DEBUG(0,("failed to unseal packet: %s\n", nt_errstr(status)));
2487 return false;
2488 }
2489
2490 /*
2491 * Return the current pointer to the data offset.
2492 */
2493
2494 if(!prs_set_offset(rpc_in, save_offset)) {
2495 DEBUG(0,("failed to set offset back to %u\n",
2496 (unsigned int)save_offset ));
2497 return False;
2498 }
2499
2500 /*
2501 * Remember the padding length. We must remove it from the real data
2502 * stream once the sign/seal is done.
2503 */
2504
2505 *p_ss_padding_len = auth_info.auth_pad_len;
2506
2507 return True;
2508 }
2509
2510 /****************************************************************************
2511 Find the set of RPC functions associated with this context_id
2512 ****************************************************************************/
2513
2514 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2515 {
2516 PIPE_RPC_FNS *fns = NULL;
2517
2518 if ( !list ) {
2519 DEBUG(0,("find_pipe_fns_by_context: ERROR! No context list for pipe!\n"));
2520 return NULL;
2521 }
2522
2523 for (fns=list; fns; fns=fns->next ) {
2524 if ( fns->context_id == context_id )
2525 return fns;
2526 }
2527 return NULL;
2528 }
2529
2530 /****************************************************************************
2531 Memory cleanup.
2532 ****************************************************************************/
2533
2534 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2535 {
2536 PIPE_RPC_FNS *tmp = list;
2537 PIPE_RPC_FNS *tmp2;
2538
2539 while (tmp) {
2540 tmp2 = tmp->next;
2541 SAFE_FREE(tmp);
2542 tmp = tmp2;
2543 }
2544
2545 return;
2546 }
2547
2548 static bool api_rpcTNP(pipes_struct *p,
2549 const struct api_struct *api_rpc_cmds, int n_cmds);
2550
2551 /****************************************************************************
2552 Find the correct RPC function to call for this request.
2553 If the pipe is authenticated then become the correct UNIX user
2554 before doing the call.
2555 ****************************************************************************/
2556
2557 bool api_pipe_request(pipes_struct *p)
2558 {
2559 bool ret = False;
2560 bool changed_user = False;
2561 PIPE_RPC_FNS *pipe_fns;
2562
2563 if (p->pipe_bound &&
2564 ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2565 (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2566 if(!become_authenticated_pipe_user(p)) {
2567 prs_mem_free(&p->out_data.rdata);
2568 return False;
2569 }
2570 changed_user = True;
2571 }
2572
2573 DEBUG(5, ("Requested \\PIPE\\%s\n",
2574 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2575
2576 /* get the set of RPC functions for this context */
2577
2578 pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2579
2580 if ( pipe_fns ) {
2581 TALLOC_CTX *frame = talloc_stackframe();
2582 ret = api_rpcTNP(p, pipe_fns->cmds, pipe_fns->n_cmds);
2583 TALLOC_FREE(frame);
2584 }
2585 else {
2586 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2587 p->hdr_req.context_id,
2588 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2589 }
2590
2591 if (changed_user) {
2592 unbecome_authenticated_pipe_user();
2593 }
2594
2595 return ret;
2596 }
2597
2598 /*******************************************************************
2599 Calls the underlying RPC function for a named pipe.
2600 ********************************************************************/
2601
2602 static bool api_rpcTNP(pipes_struct *p,
2603 const struct api_struct *api_rpc_cmds, int n_cmds)
2604 {
2605 int fn_num;
2606 uint32 offset1, offset2;
2607
2608 /* interpret the command */
2609 DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2610 get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2611 p->hdr_req.opnum));
2612
2613 if (DEBUGLEVEL >= 50) {
2614 fstring name;
2615 slprintf(name, sizeof(name)-1, "in_%s",
2616 get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2617 prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2618 }
2619
2620 for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2621 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2622 DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2623 break;
2624 }
2625 }
2626
2627 if (fn_num == n_cmds) {
2628 /*
2629 * For an unknown RPC just return a fault PDU but
2630 * return True to allow RPC's on the pipe to continue
2631 * and not put the pipe into fault state. JRA.
2632 */
2633 DEBUG(4, ("unknown\n"));
2634 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2635 return True;
2636 }
2637
2638 offset1 = prs_offset(&p->out_data.rdata);
2639
2640 DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2641 fn_num, api_rpc_cmds[fn_num].fn));
2642 /* do the actual command */
2643 if(!api_rpc_cmds[fn_num].fn(p)) {
2644 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2645 get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2646 api_rpc_cmds[fn_num].name));
2647 prs_mem_free(&p->out_data.rdata);
2648 return False;
2649 }
2650
2651 if (p->bad_handle_fault_state) {
2652 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2653 p->bad_handle_fault_state = False;
2654 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2655 return True;
2656 }
2657
2658 if (p->rng_fault_state) {
2659 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2660 p->rng_fault_state = False;
2661 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2662 return True;
2663 }
2664
2665 offset2 = prs_offset(&p->out_data.rdata);
2666 prs_set_offset(&p->out_data.rdata, offset1);
2667 if (DEBUGLEVEL >= 50) {
2668 fstring name;
2669 slprintf(name, sizeof(name)-1, "out_%s",
2670 get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2671 prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2672 }
2673 prs_set_offset(&p->out_data.rdata, offset2);
2674
2675 DEBUG(5,("api_rpcTNP: called %s successfully\n",
2676 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2677
2678 /* Check for buffer underflow in rpc parsing */
2679
2680 if ((DEBUGLEVEL >= 10) &&
2681 (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2682 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2683 char *data = (char *)SMB_MALLOC(data_len);
2684
2685 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2686 if (data) {
2687 prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2688 SAFE_FREE(data);
2689 }
2690
2691 }
2692
2693 return True;
2694 }