?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
s3-rpc: Seperate rpc_srv_register for plain connection.
[Samba/gebeck_regimport.git] / source3 / rpc_server / srv_pipe.c
blobfccc41c33a97c5f2dae97202c6e30538bc3e91d9
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Almost completely rewritten by (C) Jeremy Allison 2005 - 2010
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 /* this module apparently provides an implementation of DCE/RPC over a
21 * named pipe (IPC$ connection using SMBtrans). details of DCE/RPC
22 * documentation are available (in on-line form) from the X-Open group.
23 *
24 * this module should provide a level of abstraction between SMB
25 * and DCE/RPC, while minimising the amount of mallocs, unnecessary
26 * data copies, and network traffic.
27 *
28 */
29
30 #include "includes.h"
31 #include "srv_pipe_internal.h"
32 #include "../librpc/gen_ndr/ndr_schannel.h"
33 #include "../libcli/auth/schannel.h"
34 #include "../libcli/auth/spnego.h"
35 #include "../libcli/auth/ntlmssp.h"
36
37 #undef DBGC_CLASS
38 #define DBGC_CLASS DBGC_RPC_SRV
39
40 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
41 {
42 struct auth_ntlmssp_state *a = auth->a_u.auth_ntlmssp_state;
43
44 if (a) {
45 auth_ntlmssp_end(&a);
46 }
47 auth->a_u.auth_ntlmssp_state = NULL;
48 }
49
50 static DATA_BLOB generic_session_key(void)
51 {
52 return data_blob("SystemLibraryDTC", 16);
53 }
54
55 /*******************************************************************
56 Generate the next PDU to be returned from the data in p->rdata.
57 Handle NTLMSSP.
58 ********************************************************************/
59
60 static bool create_next_pdu_ntlmssp(pipes_struct *p)
61 {
62 RPC_HDR_RESP hdr_resp;
63 uint32 ss_padding_len = 0;
64 uint32 data_space_available;
65 uint32 data_len_left;
66 uint32 data_len;
67 NTSTATUS status;
68 DATA_BLOB auth_blob;
69 RPC_HDR_AUTH auth_info;
70 uint8 auth_type, auth_level;
71 struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
72 TALLOC_CTX *frame;
73
74 /*
75 * If we're in the fault state, keep returning fault PDU's until
76 * the pipe gets closed. JRA.
77 */
78
79 if(p->fault_state) {
80 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
81 return True;
82 }
83
84 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
85
86 /* Change the incoming request header to a response. */
87 p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
88
89 /* Set up rpc header flags. */
90 if (p->out_data.data_sent_length == 0) {
91 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
92 } else {
93 p->hdr.flags = 0;
94 }
95
96 /*
97 * Work out how much we can fit in a single PDU.
98 */
99
100 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
101
102 /*
103 * Ensure there really is data left to send.
104 */
105
106 if(!data_len_left) {
107 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
108 return False;
109 }
110
111 /* Space available - not including padding. */
112 data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN -
113 RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
114
115 /*
116 * The amount we send is the minimum of the available
117 * space and the amount left to send.
118 */
119
120 data_len = MIN(data_len_left, data_space_available);
121
122 /* Work out any padding alignment requirements. */
123 if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
124 ss_padding_len = SERVER_NDR_PADDING_SIZE -
125 ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
126 DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
127 ss_padding_len ));
128 /* If we're over filling the packet, we need to make space
129 * for the padding at the end of the data. */
130 if (data_len + ss_padding_len > data_space_available) {
131 data_len -= SERVER_NDR_PADDING_SIZE;
132 }
133 }
134
135 /*
136 * Set up the alloc hint. This should be the data left to
137 * send.
138 */
139
140 hdr_resp.alloc_hint = data_len_left;
141
142 /*
143 * Work out if this PDU will be the last.
144 */
145
146 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
147 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
148 }
149
150 /*
151 * Set up the header lengths.
152 */
153
154 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
155 data_len + ss_padding_len +
156 RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
157 p->hdr.auth_len = NTLMSSP_SIG_SIZE;
158
159
160 /*
161 * Init the parse struct to point at the outgoing
162 * data.
163 */
164
165 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
166
167 /* Store the header in the data stream. */
168 if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
169 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
170 prs_mem_free(&p->out_data.frag);
171 return False;
172 }
173
174 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
175 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
176 prs_mem_free(&p->out_data.frag);
177 return False;
178 }
179
180 /* Copy the data into the PDU. */
181
182 if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
183 p->out_data.data_sent_length, data_len)) {
184 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
185 prs_mem_free(&p->out_data.frag);
186 return False;
187 }
188
189 /* Copy the sign/seal padding data. */
190 if (ss_padding_len) {
191 char pad[SERVER_NDR_PADDING_SIZE];
192
193 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
194 if (!prs_copy_data_in(&p->out_data.frag, pad,
195 ss_padding_len)) {
196 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
197 (unsigned int)ss_padding_len));
198 prs_mem_free(&p->out_data.frag);
199 return False;
200 }
201 }
202
203
204 /* Now write out the auth header and null blob. */
205 if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
206 auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
207 } else {
208 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
209 }
210 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
211 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
212 } else {
213 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
214 }
215
216 init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
217
218 if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
219 &p->out_data.frag, 0)) {
220 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
221 prs_mem_free(&p->out_data.frag);
222 return False;
223 }
224
225 /* Generate the sign blob. */
226
227 frame = talloc_stackframe();
228 switch (p->auth.auth_level) {
229 case DCERPC_AUTH_LEVEL_PRIVACY:
230 /* Data portion is encrypted. */
231 status = auth_ntlmssp_seal_packet(
232 a, frame,
233 (uint8_t *)prs_data_p(&p->out_data.frag)
234 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
235 data_len + ss_padding_len,
236 (unsigned char *)prs_data_p(&p->out_data.frag),
237 (size_t)prs_offset(&p->out_data.frag),
238 &auth_blob);
239 if (!NT_STATUS_IS_OK(status)) {
240 talloc_free(frame);
241 prs_mem_free(&p->out_data.frag);
242 return False;
243 }
244 break;
245 case DCERPC_AUTH_LEVEL_INTEGRITY:
246 /* Data is signed. */
247 status = auth_ntlmssp_sign_packet(
248 a, frame,
249 (unsigned char *)prs_data_p(&p->out_data.frag)
250 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
251 data_len + ss_padding_len,
252 (unsigned char *)prs_data_p(&p->out_data.frag),
253 (size_t)prs_offset(&p->out_data.frag),
254 &auth_blob);
255 if (!NT_STATUS_IS_OK(status)) {
256 talloc_free(frame);
257 prs_mem_free(&p->out_data.frag);
258 return False;
259 }
260 break;
261 default:
262 talloc_free(frame);
263 prs_mem_free(&p->out_data.frag);
264 return False;
265 }
266
267 /* Append the auth blob. */
268 if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
269 NTLMSSP_SIG_SIZE)) {
270 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
271 (unsigned int)NTLMSSP_SIG_SIZE));
272 talloc_free(frame);
273 prs_mem_free(&p->out_data.frag);
274 return False;
275 }
276 talloc_free(frame);
277
278 /*
279 * Setup the counts for this PDU.
280 */
281
282 p->out_data.data_sent_length += data_len;
283 p->out_data.current_pdu_sent = 0;
284
285 return True;
286 }
287
288 /*******************************************************************
289 Generate the next PDU to be returned from the data in p->rdata.
290 Return an schannel authenticated fragment.
291 ********************************************************************/
292
293 static bool create_next_pdu_schannel(pipes_struct *p)
294 {
295 RPC_HDR_RESP hdr_resp;
296 uint32 ss_padding_len = 0;
297 uint32 data_len;
298 uint32 data_space_available;
299 uint32 data_len_left;
300 uint32 data_pos;
301 NTSTATUS status;
302
303 /*
304 * If we're in the fault state, keep returning fault PDU's until
305 * the pipe gets closed. JRA.
306 */
307
308 if(p->fault_state) {
309 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
310 return True;
311 }
312
313 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
314
315 /* Change the incoming request header to a response. */
316 p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
317
318 /* Set up rpc header flags. */
319 if (p->out_data.data_sent_length == 0) {
320 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
321 } else {
322 p->hdr.flags = 0;
323 }
324
325 /*
326 * Work out how much we can fit in a single PDU.
327 */
328
329 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
330
331 /*
332 * Ensure there really is data left to send.
333 */
334
335 if(!data_len_left) {
336 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
337 return False;
338 }
339
340 /* Space available - not including padding. */
341 data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
342 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
343 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
344
345 /*
346 * The amount we send is the minimum of the available
347 * space and the amount left to send.
348 */
349
350 data_len = MIN(data_len_left, data_space_available);
351
352 /* Work out any padding alignment requirements. */
353 if ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE) {
354 ss_padding_len = SERVER_NDR_PADDING_SIZE -
355 ((RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len) % SERVER_NDR_PADDING_SIZE);
356 DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
357 ss_padding_len ));
358 /* If we're over filling the packet, we need to make space
359 * for the padding at the end of the data. */
360 if (data_len + ss_padding_len > data_space_available) {
361 data_len -= SERVER_NDR_PADDING_SIZE;
362 }
363 }
364
365 /*
366 * Set up the alloc hint. This should be the data left to
367 * send.
368 */
369
370 hdr_resp.alloc_hint = data_len_left;
371
372 /*
373 * Work out if this PDU will be the last.
374 */
375
376 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
377 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
378 }
379
380 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
381 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
382 p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
383
384 /*
385 * Init the parse struct to point at the outgoing
386 * data.
387 */
388
389 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
390
391 /* Store the header in the data stream. */
392 if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
393 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
394 prs_mem_free(&p->out_data.frag);
395 return False;
396 }
397
398 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
399 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
400 prs_mem_free(&p->out_data.frag);
401 return False;
402 }
403
404 /* Store the current offset. */
405 data_pos = prs_offset(&p->out_data.frag);
406
407 /* Copy the data into the PDU. */
408
409 if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
410 p->out_data.data_sent_length, data_len)) {
411 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
412 prs_mem_free(&p->out_data.frag);
413 return False;
414 }
415
416 /* Copy the sign/seal padding data. */
417 if (ss_padding_len) {
418 char pad[SERVER_NDR_PADDING_SIZE];
419 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
420 if (!prs_copy_data_in(&p->out_data.frag, pad,
421 ss_padding_len)) {
422 DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
423 prs_mem_free(&p->out_data.frag);
424 return False;
425 }
426 }
427
428 {
429 /*
430 * Schannel processing.
431 */
432 RPC_HDR_AUTH auth_info;
433 DATA_BLOB blob;
434 uint8_t *data;
435
436 /* Check it's the type of reply we were expecting to decode */
437
438 init_rpc_hdr_auth(&auth_info,
439 DCERPC_AUTH_TYPE_SCHANNEL,
440 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
441 DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
442 ss_padding_len, 1);
443
444 if (!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
445 &p->out_data.frag, 0)) {
446 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
447 prs_mem_free(&p->out_data.frag);
448 return False;
449 }
450
451 data = (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos;
452
453 switch (p->auth.auth_level) {
454 case DCERPC_AUTH_LEVEL_PRIVACY:
455 status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
456 talloc_tos(),
457 true,
458 data,
459 data_len + ss_padding_len,
460 &blob);
461 break;
462 case DCERPC_AUTH_LEVEL_INTEGRITY:
463 status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
464 talloc_tos(),
465 false,
466 data,
467 data_len + ss_padding_len,
468 &blob);
469 break;
470 default:
471 status = NT_STATUS_INTERNAL_ERROR;
472 break;
473 }
474
475 if (!NT_STATUS_IS_OK(status)) {
476 DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
477 nt_errstr(status)));
478 prs_mem_free(&p->out_data.frag);
479 return false;
480 }
481
482 /* Finally marshall the blob. */
483
484 if (DEBUGLEVEL >= 10) {
485 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
486 }
487
488 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
489 prs_mem_free(&p->out_data.frag);
490 return false;
491 }
492 }
493
494 /*
495 * Setup the counts for this PDU.
496 */
497
498 p->out_data.data_sent_length += data_len;
499 p->out_data.current_pdu_sent = 0;
500
501 return True;
502 }
503
504 /*******************************************************************
505 Generate the next PDU to be returned from the data in p->rdata.
506 No authentication done.
507 ********************************************************************/
508
509 static bool create_next_pdu_noauth(pipes_struct *p)
510 {
511 RPC_HDR_RESP hdr_resp;
512 uint32 data_len;
513 uint32 data_space_available;
514 uint32 data_len_left;
515
516 /*
517 * If we're in the fault state, keep returning fault PDU's until
518 * the pipe gets closed. JRA.
519 */
520
521 if(p->fault_state) {
522 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
523 return True;
524 }
525
526 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
527
528 /* Change the incoming request header to a response. */
529 p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
530
531 /* Set up rpc header flags. */
532 if (p->out_data.data_sent_length == 0) {
533 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
534 } else {
535 p->hdr.flags = 0;
536 }
537
538 /*
539 * Work out how much we can fit in a single PDU.
540 */
541
542 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
543
544 /*
545 * Ensure there really is data left to send.
546 */
547
548 if(!data_len_left) {
549 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
550 return False;
551 }
552
553 data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
554 - RPC_HDR_RESP_LEN;
555
556 /*
557 * The amount we send is the minimum of the available
558 * space and the amount left to send.
559 */
560
561 data_len = MIN(data_len_left, data_space_available);
562
563 /*
564 * Set up the alloc hint. This should be the data left to
565 * send.
566 */
567
568 hdr_resp.alloc_hint = data_len_left;
569
570 /*
571 * Work out if this PDU will be the last.
572 */
573
574 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
575 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
576 }
577
578 /*
579 * Set up the header lengths.
580 */
581
582 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
583 p->hdr.auth_len = 0;
584
585 /*
586 * Init the parse struct to point at the outgoing
587 * data.
588 */
589
590 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
591
592 /* Store the header in the data stream. */
593 if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
594 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
595 prs_mem_free(&p->out_data.frag);
596 return False;
597 }
598
599 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
600 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
601 prs_mem_free(&p->out_data.frag);
602 return False;
603 }
604
605 /* Copy the data into the PDU. */
606
607 if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
608 p->out_data.data_sent_length, data_len)) {
609 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
610 prs_mem_free(&p->out_data.frag);
611 return False;
612 }
613
614 /*
615 * Setup the counts for this PDU.
616 */
617
618 p->out_data.data_sent_length += data_len;
619 p->out_data.current_pdu_sent = 0;
620
621 return True;
622 }
623
624 /*******************************************************************
625 Generate the next PDU to be returned from the data in p->rdata.
626 ********************************************************************/
627
628 bool create_next_pdu(pipes_struct *p)
629 {
630 switch(p->auth.auth_level) {
631 case DCERPC_AUTH_LEVEL_NONE:
632 case DCERPC_AUTH_LEVEL_CONNECT:
633 /* This is incorrect for auth level connect. Fixme. JRA */
634 return create_next_pdu_noauth(p);
635
636 default:
637 switch(p->auth.auth_type) {
638 case PIPE_AUTH_TYPE_NTLMSSP:
639 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
640 return create_next_pdu_ntlmssp(p);
641 case PIPE_AUTH_TYPE_SCHANNEL:
642 return create_next_pdu_schannel(p);
643 default:
644 break;
645 }
646 }
647
648 DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
649 (unsigned int)p->auth.auth_level,
650 (unsigned int)p->auth.auth_type));
651 return False;
652 }
653
654 /*******************************************************************
655 Process an NTLMSSP authentication response.
656 If this function succeeds, the user has been authenticated
657 and their domain, name and calling workstation stored in
658 the pipe struct.
659 *******************************************************************/
660
661 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
662 {
663 DATA_BLOB session_key, reply;
664 NTSTATUS status;
665 struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
666 bool ret;
667
668 DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
669 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
670
671 ZERO_STRUCT(reply);
672
673 /* this has to be done as root in order to verify the password */
674 become_root();
675 status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
676 unbecome_root();
677
678 /* Don't generate a reply. */
679 data_blob_free(&reply);
680
681 if (!NT_STATUS_IS_OK(status)) {
682 return False;
683 }
684
685 /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
686 ensure the underlying NTLMSSP flags are also set. If not we should
687 refuse the bind. */
688
689 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
690 if (!auth_ntlmssp_negotiated_sign(a)) {
691 DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
692 "but client declined signing.\n",
693 get_pipe_name_from_syntax(talloc_tos(),
694 &p->syntax)));
695 return False;
696 }
697 }
698 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
699 if (!auth_ntlmssp_negotiated_seal(a)) {
700 DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
701 "but client declined sealing.\n",
702 get_pipe_name_from_syntax(talloc_tos(),
703 &p->syntax)));
704 return False;
705 }
706 }
707
708 DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
709 "workstation: %s\n",
710 auth_ntlmssp_get_username(a),
711 auth_ntlmssp_get_domain(a),
712 auth_ntlmssp_get_client(a)));
713
714 TALLOC_FREE(p->server_info);
715
716 p->server_info = auth_ntlmssp_server_info(p, a);
717 if (p->server_info == NULL) {
718 DEBUG(0, ("auth_ntlmssp_server_info failed to obtain the server info for authenticated user\n"));
719 return false;
720 }
721
722 if (p->server_info->ptok == NULL) {
723 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
724 return False;
725 }
726
727 /*
728 * We're an authenticated bind over smb, so the session key needs to
729 * be set to "SystemLibraryDTC". Weird, but this is what Windows
730 * does. See the RPC-SAMBA3SESSIONKEY.
731 */
732
733 session_key = generic_session_key();
734 if (session_key.data == NULL) {
735 return False;
736 }
737
738 ret = server_info_set_session_key(p->server_info, session_key);
739
740 data_blob_free(&session_key);
741
742 return True;
743 }
744
745 /*******************************************************************
746 This is the "stage3" NTLMSSP response after a bind request and reply.
747 *******************************************************************/
748
749 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
750 {
751 RPC_HDR_AUTH auth_info;
752 uint32 pad = 0;
753 DATA_BLOB blob;
754 uint32_t auth_len = p->hdr.auth_len;
755
756 ZERO_STRUCT(blob);
757
758 DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
759
760 if (auth_len == 0) {
761 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
762 goto err;
763 }
764
765 /* 4 bytes padding. */
766 if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
767 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
768 goto err;
769 }
770
771 /* Ensure there's enough data for an authenticated request. */
772 if (RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + auth_len >
773 p->hdr.frag_len) {
774 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len "
775 "%u is too large.\n",
776 (unsigned int)auth_len ));
777 goto err;
778 }
779
780 /*
781 * Decode the authentication verifier response.
782 */
783
784 /* Pull the auth header and the following data into a blob. */
785 /* NB. The offset of the auth_header is relative to the *end*
786 * of the packet, not the start. Also, the length of the
787 * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
788 * as the RPC header isn't included in rpc_in_p. */
789 if(!prs_set_offset(rpc_in_p,
790 p->hdr.frag_len - RPC_HEADER_LEN -
791 RPC_HDR_AUTH_LEN - auth_len)) {
792 DEBUG(0,("api_pipe_bind_auth3: cannot move "
793 "offset to %u.\n",
794 (unsigned int)(p->hdr.frag_len -
795 RPC_HDR_AUTH_LEN - auth_len) ));
796 goto err;
797 }
798
799 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in_p, 0)) {
800 DEBUG(0,("api_pipe_bind_auth3: failed to "
801 "unmarshall RPC_HDR_AUTH.\n"));
802 goto err;
803 }
804
805 /* We must NEVER look at auth_info->auth_pad_len here,
806 * as old Samba client code gets it wrong and sends it
807 * as zero. JRA.
808 */
809
810 if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
811 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
812 (unsigned int)auth_info.auth_type ));
813 return False;
814 }
815
816 blob = data_blob(NULL,p->hdr.auth_len);
817
818 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
819 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
820 (unsigned int)p->hdr.auth_len ));
821 goto err;
822 }
823
824 /*
825 * The following call actually checks the challenge/response data.
826 * for correctness against the given DOMAIN\user name.
827 */
828
829 if (!pipe_ntlmssp_verify_final(p, &blob)) {
830 goto err;
831 }
832
833 data_blob_free(&blob);
834
835 p->pipe_bound = True;
836
837 return True;
838
839 err:
840
841 data_blob_free(&blob);
842 free_pipe_ntlmssp_auth_data(&p->auth);
843 p->auth.a_u.auth_ntlmssp_state = NULL;
844
845 return False;
846 }
847
848 /*******************************************************************
849 Marshall a bind_nak pdu.
850 *******************************************************************/
851
852 static bool setup_bind_nak(pipes_struct *p)
853 {
854 RPC_HDR nak_hdr;
855 uint16 zero = 0;
856
857 /* Free any memory in the current return data buffer. */
858 prs_mem_free(&p->out_data.rdata);
859
860 /*
861 * Marshall directly into the outgoing PDU space. We
862 * must do this as we need to set to the bind response
863 * header and are never sending more than one PDU here.
864 */
865
866 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
867
868 /*
869 * Initialize a bind_nak header.
870 */
871
872 init_rpc_hdr(&nak_hdr, DCERPC_PKT_BIND_NAK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
873 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
874
875 /*
876 * Marshall the header into the outgoing PDU.
877 */
878
879 if(!smb_io_rpc_hdr("", &nak_hdr, &p->out_data.frag, 0)) {
880 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
881 prs_mem_free(&p->out_data.frag);
882 return False;
883 }
884
885 /*
886 * Now add the reject reason.
887 */
888
889 if(!prs_uint16("reject code", &p->out_data.frag, 0, &zero)) {
890 prs_mem_free(&p->out_data.frag);
891 return False;
892 }
893
894 p->out_data.data_sent_length = 0;
895 p->out_data.current_pdu_sent = 0;
896
897 if (p->auth.auth_data_free_func) {
898 (*p->auth.auth_data_free_func)(&p->auth);
899 }
900 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
901 p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
902 p->pipe_bound = False;
903
904 return True;
905 }
906
907 /*******************************************************************
908 Marshall a fault pdu.
909 *******************************************************************/
910
911 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
912 {
913 RPC_HDR fault_hdr;
914 RPC_HDR_RESP hdr_resp;
915 RPC_HDR_FAULT fault_resp;
916
917 /* Free any memory in the current return data buffer. */
918 prs_mem_free(&p->out_data.rdata);
919
920 /*
921 * Marshall directly into the outgoing PDU space. We
922 * must do this as we need to set to the bind response
923 * header and are never sending more than one PDU here.
924 */
925
926 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
927
928 /*
929 * Initialize a fault header.
930 */
931
932 init_rpc_hdr(&fault_hdr, DCERPC_PKT_FAULT, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST | DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
933 p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
934
935 /*
936 * Initialize the HDR_RESP and FAULT parts of the PDU.
937 */
938
939 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
940
941 fault_resp.status = status;
942 fault_resp.reserved = 0;
943
944 /*
945 * Marshall the header into the outgoing PDU.
946 */
947
948 if(!smb_io_rpc_hdr("", &fault_hdr, &p->out_data.frag, 0)) {
949 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
950 prs_mem_free(&p->out_data.frag);
951 return False;
952 }
953
954 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
955 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
956 prs_mem_free(&p->out_data.frag);
957 return False;
958 }
959
960 if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &p->out_data.frag, 0)) {
961 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
962 prs_mem_free(&p->out_data.frag);
963 return False;
964 }
965
966 p->out_data.data_sent_length = 0;
967 p->out_data.current_pdu_sent = 0;
968
969 return True;
970 }
971
972 #if 0
973 /*******************************************************************
974 Marshall a cancel_ack pdu.
975 We should probably check the auth-verifier here.
976 *******************************************************************/
977
978 bool setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
979 {
980 prs_struct outgoing_pdu;
981 RPC_HDR ack_reply_hdr;
982
983 /* Free any memory in the current return data buffer. */
984 prs_mem_free(&p->out_data.rdata);
985
986 /*
987 * Marshall directly into the outgoing PDU space. We
988 * must do this as we need to set to the bind response
989 * header and are never sending more than one PDU here.
990 */
991
992 prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
993 prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
994
995 /*
996 * Initialize a cancel_ack header.
997 */
998
999 init_rpc_hdr(&ack_reply_hdr, DCERPC_PKT_CANCEL_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1000 p->hdr.call_id, RPC_HEADER_LEN, 0);
1001
1002 /*
1003 * Marshall the header into the outgoing PDU.
1004 */
1005
1006 if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
1007 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
1008 prs_mem_free(&outgoing_pdu);
1009 return False;
1010 }
1011
1012 p->out_data.data_sent_length = 0;
1013 p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
1014 p->out_data.current_pdu_sent = 0;
1015
1016 prs_mem_free(&outgoing_pdu);
1017 return True;
1018 }
1019 #endif
1020
1021 /*******************************************************************
1022 Ensure a bind request has the correct abstract & transfer interface.
1023 Used to reject unknown binds from Win2k.
1024 *******************************************************************/
1025
1026 static bool check_bind_req(struct pipes_struct *p,
1027 struct ndr_syntax_id* abstract,
1028 struct ndr_syntax_id* transfer,
1029 uint32 context_id)
1030 {
1031 struct pipe_rpc_fns *context_fns;
1032
1033 DEBUG(3,("check_bind_req for %s\n",
1034 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1035
1036 /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
1037 if (rpc_srv_pipe_exists_by_id(abstract) &&
1038 ndr_syntax_id_equal(transfer, &ndr_transfer_syntax)) {
1039 DEBUG(3, ("check_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1040 rpc_srv_get_pipe_cli_name(abstract),
1041 rpc_srv_get_pipe_srv_name(abstract)));
1042 } else {
1043 return false;
1044 }
1045
1046 context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
1047 if (context_fns == NULL) {
1048 DEBUG(0,("check_bind_req: malloc() failed!\n"));
1049 return False;
1050 }
1051
1052 context_fns->n_cmds = rpc_srv_get_pipe_num_cmds(abstract);
1053 context_fns->cmds = rpc_srv_get_pipe_cmds(abstract);
1054 context_fns->context_id = context_id;
1055
1056 /* add to the list of open contexts */
1057
1058 DLIST_ADD( p->contexts, context_fns );
1059
1060 return True;
1061 }
1062
1063 /**
1064 * Is a named pipe known?
1065 * @param[in] cli_filename The pipe name requested by the client
1066 * @result Do we want to serve this?
1067 */
1068 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1069 {
1070 const char *pipename = cli_filename;
1071 NTSTATUS status;
1072
1073 if (strnequal(pipename, "\\PIPE\\", 6)) {
1074 pipename += 5;
1075 }
1076
1077 if (*pipename == '\\') {
1078 pipename += 1;
1079 }
1080
1081 if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1082 DEBUG(10, ("refusing spoolss access\n"));
1083 return false;
1084 }
1085
1086 if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1087 return true;
1088 }
1089
1090 status = smb_probe_module("rpc", pipename);
1091 if (!NT_STATUS_IS_OK(status)) {
1092 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1093 return false;
1094 }
1095 DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
1096
1097 /*
1098 * Scan the list again for the interface id
1099 */
1100 if (rpc_srv_get_pipe_interface_by_cli_name(pipename, syntax)) {
1101 return true;
1102 }
1103
1104 DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
1105 pipename));
1106
1107 return false;
1108 }
1109
1110 /*******************************************************************
1111 Handle a SPNEGO krb5 bind auth.
1112 *******************************************************************/
1113
1114 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1115 DATA_BLOB *psecblob, prs_struct *pout_auth)
1116 {
1117 return False;
1118 }
1119
1120 /*******************************************************************
1121 Handle the first part of a SPNEGO bind auth.
1122 *******************************************************************/
1123
1124 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1125 uint32_t ss_padding_len,
1126 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1127 {
1128 DATA_BLOB blob;
1129 DATA_BLOB secblob;
1130 DATA_BLOB response;
1131 DATA_BLOB chal;
1132 char *OIDs[ASN1_MAX_OIDS];
1133 int i;
1134 NTSTATUS status;
1135 bool got_kerberos_mechanism = false;
1136 struct auth_ntlmssp_state *a = NULL;
1137 RPC_HDR_AUTH auth_info;
1138
1139 ZERO_STRUCT(secblob);
1140 ZERO_STRUCT(chal);
1141 ZERO_STRUCT(response);
1142
1143 /* Grab the SPNEGO blob. */
1144 blob = data_blob(NULL,p->hdr.auth_len);
1145
1146 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1147 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1148 (unsigned int)p->hdr.auth_len ));
1149 goto err;
1150 }
1151
1152 if (blob.data[0] != ASN1_APPLICATION(0)) {
1153 goto err;
1154 }
1155
1156 /* parse out the OIDs and the first sec blob */
1157 if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1158 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1159 goto err;
1160 }
1161
1162 if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1163 got_kerberos_mechanism = true;
1164 }
1165
1166 for (i=0;OIDs[i];i++) {
1167 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1168 TALLOC_FREE(OIDs[i]);
1169 }
1170 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1171
1172 if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1173 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1174 data_blob_free(&secblob);
1175 data_blob_free(&blob);
1176 return ret;
1177 }
1178
1179 if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1180 /* Free any previous auth type. */
1181 free_pipe_ntlmssp_auth_data(&p->auth);
1182 }
1183
1184 if (!got_kerberos_mechanism) {
1185 /* Initialize the NTLM engine. */
1186 status = auth_ntlmssp_start(&a);
1187 if (!NT_STATUS_IS_OK(status)) {
1188 goto err;
1189 }
1190
1191 /*
1192 * Pass the first security blob of data to it.
1193 * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1194 * which means we need another packet to complete the bind.
1195 */
1196
1197 status = auth_ntlmssp_update(a, secblob, &chal);
1198
1199 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1200 DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1201 goto err;
1202 }
1203
1204 /* Generate the response blob we need for step 2 of the bind. */
1205 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1206 } else {
1207 /*
1208 * SPNEGO negotiate down to NTLMSSP. The subsequent
1209 * code to process follow-up packets is not complete
1210 * yet. JRA.
1211 */
1212 response = spnego_gen_auth_response(NULL,
1213 NT_STATUS_MORE_PROCESSING_REQUIRED,
1214 OID_NTLMSSP);
1215 }
1216
1217 /* auth_pad_len will be handled by the caller */
1218
1219 /* Copy the blob into the pout_auth parse struct */
1220 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1221 pauth_info->auth_level, ss_padding_len, 1);
1222 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1223 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1224 goto err;
1225 }
1226
1227 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1228 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1229 goto err;
1230 }
1231
1232 p->auth.a_u.auth_ntlmssp_state = a;
1233 p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1234 p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1235
1236 data_blob_free(&blob);
1237 data_blob_free(&secblob);
1238 data_blob_free(&chal);
1239 data_blob_free(&response);
1240
1241 /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1242 return True;
1243
1244 err:
1245
1246 data_blob_free(&blob);
1247 data_blob_free(&secblob);
1248 data_blob_free(&chal);
1249 data_blob_free(&response);
1250
1251 p->auth.a_u.auth_ntlmssp_state = NULL;
1252
1253 return False;
1254 }
1255
1256 /*******************************************************************
1257 Handle the second part of a SPNEGO bind auth.
1258 *******************************************************************/
1259
1260 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1261 uint32_t ss_padding_len,
1262 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1263 {
1264 RPC_HDR_AUTH auth_info;
1265 DATA_BLOB spnego_blob;
1266 DATA_BLOB auth_blob;
1267 DATA_BLOB auth_reply;
1268 DATA_BLOB response;
1269 struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
1270
1271 ZERO_STRUCT(spnego_blob);
1272 ZERO_STRUCT(auth_blob);
1273 ZERO_STRUCT(auth_reply);
1274 ZERO_STRUCT(response);
1275
1276 /*
1277 * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1278 * fail here as 'a' == NULL.
1279 */
1280 if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1281 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1282 goto err;
1283 }
1284
1285 /* Grab the SPNEGO blob. */
1286 spnego_blob = data_blob(NULL,p->hdr.auth_len);
1287
1288 if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1289 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1290 (unsigned int)p->hdr.auth_len ));
1291 goto err;
1292 }
1293
1294 if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1295 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1296 goto err;
1297 }
1298
1299 if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1300 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1301 goto err;
1302 }
1303
1304 /*
1305 * The following call actually checks the challenge/response data.
1306 * for correctness against the given DOMAIN\user name.
1307 */
1308
1309 if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1310 goto err;
1311 }
1312
1313 data_blob_free(&spnego_blob);
1314 data_blob_free(&auth_blob);
1315
1316 /* Generate the spnego "accept completed" blob - no incoming data. */
1317 response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1318
1319 /* FIXME - add auth_pad_len here ! */
1320
1321 /* Copy the blob into the pout_auth parse struct */
1322 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO,
1323 pauth_info->auth_level, ss_padding_len, 1);
1324 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1325 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1326 goto err;
1327 }
1328
1329 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1330 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1331 goto err;
1332 }
1333
1334 data_blob_free(&auth_reply);
1335 data_blob_free(&response);
1336
1337 p->pipe_bound = True;
1338
1339 return True;
1340
1341 err:
1342
1343 data_blob_free(&spnego_blob);
1344 data_blob_free(&auth_blob);
1345 data_blob_free(&auth_reply);
1346 data_blob_free(&response);
1347
1348 free_pipe_ntlmssp_auth_data(&p->auth);
1349 p->auth.a_u.auth_ntlmssp_state = NULL;
1350
1351 return False;
1352 }
1353
1354 /*******************************************************************
1355 Handle an schannel bind auth.
1356 *******************************************************************/
1357
1358 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1359 uint32_t ss_padding_len,
1360 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1361 {
1362 RPC_HDR_AUTH auth_info;
1363 struct NL_AUTH_MESSAGE neg;
1364 struct NL_AUTH_MESSAGE reply;
1365 bool ret;
1366 NTSTATUS status;
1367 struct netlogon_creds_CredentialState *creds;
1368 DATA_BLOB session_key;
1369 enum ndr_err_code ndr_err;
1370 DATA_BLOB blob;
1371
1372 blob = data_blob_const(prs_data_p(rpc_in_p) + prs_offset(rpc_in_p),
1373 prs_data_size(rpc_in_p));
1374
1375 ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), &neg,
1376 (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1377 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1378 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1379 return false;
1380 }
1381
1382 if (DEBUGLEVEL >= 10) {
1383 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1384 }
1385
1386 if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1387 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1388 return false;
1389 }
1390
1391 /*
1392 * The neg.oem_netbios_computer.a key here must match the remote computer name
1393 * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1394 * operations that use credentials.
1395 */
1396
1397 become_root();
1398 status = schannel_get_creds_state(p, lp_private_dir(),
1399 neg.oem_netbios_computer.a, &creds);
1400 unbecome_root();
1401
1402 if (!NT_STATUS_IS_OK(status)) {
1403 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1404 return False;
1405 }
1406
1407 p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1408 if (!p->auth.a_u.schannel_auth) {
1409 TALLOC_FREE(creds);
1410 return False;
1411 }
1412
1413 p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1414 p->auth.a_u.schannel_auth->seq_num = 0;
1415 p->auth.a_u.schannel_auth->initiator = false;
1416 p->auth.a_u.schannel_auth->creds = creds;
1417
1418 /*
1419 * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1420 * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1421 * struct of the person who opened the pipe. I need to test this further. JRA.
1422 *
1423 * VL. As we are mapping this to guest set the generic key
1424 * "SystemLibraryDTC" key here. It's a bit difficult to test against
1425 * W2k3, as it does not allow schannel binds against SAMR and LSA
1426 * anymore.
1427 */
1428
1429 session_key = generic_session_key();
1430 if (session_key.data == NULL) {
1431 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1432 " key\n"));
1433 return false;
1434 }
1435
1436 ret = server_info_set_session_key(p->server_info, session_key);
1437
1438 data_blob_free(&session_key);
1439
1440 if (!ret) {
1441 DEBUG(0, ("server_info_set_session_key failed\n"));
1442 return false;
1443 }
1444
1445 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SCHANNEL,
1446 pauth_info->auth_level, ss_padding_len, 1);
1447 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1448 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1449 return False;
1450 }
1451
1452 /*** SCHANNEL verifier ***/
1453
1454 reply.MessageType = NL_NEGOTIATE_RESPONSE;
1455 reply.Flags = 0;
1456 reply.Buffer.dummy = 5; /* ??? actually I don't think
1457 * this has any meaning
1458 * here - gd */
1459
1460 ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), &reply,
1461 (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1462 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1463 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1464 return false;
1465 }
1466
1467 if (DEBUGLEVEL >= 10) {
1468 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1469 }
1470
1471 if (!prs_copy_data_in(pout_auth, (const char *)blob.data, blob.length)) {
1472 return false;
1473 }
1474
1475 DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1476 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1477
1478 /* We're finished with this bind - no more packets. */
1479 p->auth.auth_data_free_func = NULL;
1480 p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1481
1482 p->pipe_bound = True;
1483
1484 return True;
1485 }
1486
1487 /*******************************************************************
1488 Handle an NTLMSSP bind auth.
1489 *******************************************************************/
1490
1491 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1492 uint32_t ss_padding_len,
1493 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1494 {
1495 RPC_HDR_AUTH auth_info;
1496 DATA_BLOB blob;
1497 DATA_BLOB response;
1498 NTSTATUS status;
1499 struct auth_ntlmssp_state *a = NULL;
1500
1501 ZERO_STRUCT(blob);
1502 ZERO_STRUCT(response);
1503
1504 /* Grab the NTLMSSP blob. */
1505 blob = data_blob(NULL,p->hdr.auth_len);
1506
1507 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1508 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1509 (unsigned int)p->hdr.auth_len ));
1510 goto err;
1511 }
1512
1513 if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1514 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1515 goto err;
1516 }
1517
1518 /* We have an NTLMSSP blob. */
1519 status = auth_ntlmssp_start(&a);
1520 if (!NT_STATUS_IS_OK(status)) {
1521 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1522 nt_errstr(status) ));
1523 goto err;
1524 }
1525
1526 status = auth_ntlmssp_update(a, blob, &response);
1527 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1528 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1529 nt_errstr(status) ));
1530 goto err;
1531 }
1532
1533 data_blob_free(&blob);
1534
1535 /* Copy the blob into the pout_auth parse struct */
1536 init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_NTLMSSP,
1537 pauth_info->auth_level, ss_padding_len, 1);
1538 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1539 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1540 goto err;
1541 }
1542
1543 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1544 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1545 goto err;
1546 }
1547
1548 p->auth.a_u.auth_ntlmssp_state = a;
1549 p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1550 p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1551
1552 data_blob_free(&blob);
1553 data_blob_free(&response);
1554
1555 DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1556
1557 /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1558 return True;
1559
1560 err:
1561
1562 data_blob_free(&blob);
1563 data_blob_free(&response);
1564
1565 free_pipe_ntlmssp_auth_data(&p->auth);
1566 p->auth.a_u.auth_ntlmssp_state = NULL;
1567 return False;
1568 }
1569
1570 /*******************************************************************
1571 Respond to a pipe bind request.
1572 *******************************************************************/
1573
1574 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1575 {
1576 RPC_HDR_BA hdr_ba;
1577 RPC_HDR_RB hdr_rb;
1578 RPC_HDR_AUTH auth_info;
1579 uint16 assoc_gid;
1580 fstring ack_pipe_name;
1581 prs_struct out_hdr_ba;
1582 prs_struct out_auth;
1583 int auth_len = 0;
1584 unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1585 uint32_t ss_padding_len = 0;
1586 NTSTATUS status;
1587 struct ndr_syntax_id id;
1588
1589 /* No rebinds on a bound pipe - use alter context. */
1590 if (p->pipe_bound) {
1591 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1592 "pipe %s.\n",
1593 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1594 return setup_bind_nak(p);
1595 }
1596
1597 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1598
1599 /*
1600 * Marshall directly into the outgoing PDU space. We
1601 * must do this as we need to set to the bind response
1602 * header and are never sending more than one PDU here.
1603 */
1604
1605 /*
1606 * Setup the memory to marshall the ba header, and the
1607 * auth footers.
1608 */
1609
1610 if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1611 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1612 prs_mem_free(&p->out_data.frag);
1613 return False;
1614 }
1615
1616 if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1617 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1618 prs_mem_free(&p->out_data.frag);
1619 prs_mem_free(&out_hdr_ba);
1620 return False;
1621 }
1622
1623 DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1624
1625 ZERO_STRUCT(hdr_rb);
1626
1627 /* decode the bind request */
1628
1629 if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0)) {
1630 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB "
1631 "struct.\n"));
1632 goto err_exit;
1633 }
1634
1635 if (hdr_rb.num_contexts == 0) {
1636 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1637 goto err_exit;
1638 }
1639
1640 /*
1641 * Try and find the correct pipe name to ensure
1642 * that this is a pipe name we support.
1643 */
1644 id = hdr_rb.rpc_context[0].abstract;
1645 if (rpc_srv_pipe_exists_by_id(&id)) {
1646 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1647 rpc_srv_get_pipe_cli_name(&id),
1648 rpc_srv_get_pipe_srv_name(&id)));
1649 } else {
1650 status = smb_probe_module(
1651 "rpc", get_pipe_name_from_syntax(
1652 talloc_tos(),
1653 &hdr_rb.rpc_context[0].abstract));
1654
1655 if (NT_STATUS_IS_ERR(status)) {
1656 DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1657 get_pipe_name_from_syntax(
1658 talloc_tos(),
1659 &hdr_rb.rpc_context[0].abstract)));
1660 prs_mem_free(&p->out_data.frag);
1661 prs_mem_free(&out_hdr_ba);
1662 prs_mem_free(&out_auth);
1663
1664 return setup_bind_nak(p);
1665 }
1666
1667 if (rpc_srv_get_pipe_interface_by_cli_name(
1668 get_pipe_name_from_syntax(talloc_tos(),
1669 &p->syntax),
1670 &id)) {
1671 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1672 rpc_srv_get_pipe_cli_name(&id),
1673 rpc_srv_get_pipe_srv_name(&id)));
1674 } else {
1675 DEBUG(0, ("module %s doesn't provide functions for "
1676 "pipe %s!\n",
1677 get_pipe_name_from_syntax(talloc_tos(),
1678 &p->syntax),
1679 get_pipe_name_from_syntax(talloc_tos(),
1680 &p->syntax)));
1681 goto err_exit;
1682 }
1683 }
1684
1685 /* name has to be \PIPE\xxxxx */
1686 fstrcpy(ack_pipe_name, "\\PIPE\\");
1687 fstrcat(ack_pipe_name, rpc_srv_get_pipe_srv_name(&id));
1688
1689 DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1690
1691 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1692
1693 /*
1694 * Create the bind response struct.
1695 */
1696
1697 /* If the requested abstract synt uuid doesn't match our client pipe,
1698 reject the bind_ack & set the transfer interface synt to all 0's,
1699 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1700 unknown to NT4)
1701 Needed when adding entries to a DACL from NT5 - SK */
1702
1703 if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1704 hdr_rb.rpc_context[0].context_id )) {
1705 init_rpc_hdr_ba(&hdr_ba,
1706 RPC_MAX_PDU_FRAG_LEN,
1707 RPC_MAX_PDU_FRAG_LEN,
1708 assoc_gid,
1709 ack_pipe_name,
1710 0x1, 0x0, 0x0,
1711 &hdr_rb.rpc_context[0].transfer[0]);
1712 } else {
1713 /* Rejection reason: abstract syntax not supported */
1714 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1715 RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1716 ack_pipe_name, 0x1, 0x2, 0x1,
1717 &null_ndr_syntax_id);
1718 p->pipe_bound = False;
1719 }
1720
1721 /*
1722 * and marshall it.
1723 */
1724
1725 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1726 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1727 goto err_exit;
1728 }
1729
1730 /*
1731 * Check if this is an authenticated bind request.
1732 */
1733
1734 if (p->hdr.auth_len) {
1735 /*
1736 * Decode the authentication verifier.
1737 */
1738
1739 /* Work out any padding needed before the auth footer. */
1740 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
1741 ss_padding_len = SERVER_NDR_PADDING_SIZE -
1742 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
1743 DEBUG(10,("api_pipe_bind_req: auth pad_len = %u\n",
1744 (unsigned int)ss_padding_len ));
1745 }
1746
1747 /* Quick length check. Won't catch a bad auth footer,
1748 * prevents overrun. */
1749
1750 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
1751 DEBUG(0,("api_pipe_bind_req: auth_len (%u) "
1752 "too long for fragment %u.\n",
1753 (unsigned int)p->hdr.auth_len,
1754 (unsigned int)p->hdr.frag_len ));
1755 goto err_exit;
1756 }
1757
1758 /* Pull the auth header and the following data into a blob. */
1759 /* NB. The offset of the auth_header is relative to the *end*
1760 * of the packet, not the start. Also, the length of the
1761 * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
1762 * as the RPC header isn't included in rpc_in_p. */
1763 if(!prs_set_offset(rpc_in_p,
1764 p->hdr.frag_len - RPC_HEADER_LEN -
1765 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
1766 DEBUG(0,("api_pipe_bind_req: cannot move "
1767 "offset to %u.\n",
1768 (unsigned int)(p->hdr.frag_len -
1769 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
1770 goto err_exit;
1771 }
1772
1773 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1774 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1775 goto err_exit;
1776 }
1777
1778 auth_type = auth_info.auth_type;
1779
1780 /* Work out if we have to sign or seal etc. */
1781 switch (auth_info.auth_level) {
1782 case DCERPC_AUTH_LEVEL_INTEGRITY:
1783 p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1784 break;
1785 case DCERPC_AUTH_LEVEL_PRIVACY:
1786 p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1787 break;
1788 default:
1789 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1790 (unsigned int)auth_info.auth_level ));
1791 goto err_exit;
1792 }
1793 } else {
1794 ZERO_STRUCT(auth_info);
1795 }
1796
1797 switch(auth_type) {
1798 case DCERPC_AUTH_TYPE_NTLMSSP:
1799 if (!pipe_ntlmssp_auth_bind(p, rpc_in_p,
1800 ss_padding_len, &auth_info, &out_auth)) {
1801 goto err_exit;
1802 }
1803 assoc_gid = 0x7a77;
1804 break;
1805
1806 case DCERPC_AUTH_TYPE_SCHANNEL:
1807 if (!pipe_schannel_auth_bind(p, rpc_in_p,
1808 ss_padding_len, &auth_info, &out_auth)) {
1809 goto err_exit;
1810 }
1811 break;
1812
1813 case DCERPC_AUTH_TYPE_SPNEGO:
1814 if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p,
1815 ss_padding_len, &auth_info, &out_auth)) {
1816 goto err_exit;
1817 }
1818 break;
1819
1820 case DCERPC_AUTH_TYPE_NONE:
1821 /* Unauthenticated bind request. */
1822 /* We're finished - no more packets. */
1823 p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1824 /* We must set the pipe auth_level here also. */
1825 p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1826 p->pipe_bound = True;
1827 /* The session key was initialized from the SMB
1828 * session in make_internal_rpc_pipe_p */
1829 ss_padding_len = 0;
1830 break;
1831
1832 default:
1833 DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1834 goto err_exit;
1835 }
1836 /*
1837 * Create the header, now we know the length.
1838 */
1839
1840 if (prs_offset(&out_auth)) {
1841 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1842 }
1843
1844 init_rpc_hdr(&p->hdr, DCERPC_PKT_BIND_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1845 p->hdr.call_id,
1846 RPC_HEADER_LEN + prs_offset(&out_hdr_ba) +
1847 ss_padding_len + prs_offset(&out_auth),
1848 auth_len);
1849
1850 /*
1851 * Marshall the header into the outgoing PDU.
1852 */
1853
1854 if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1855 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1856 goto err_exit;
1857 }
1858
1859 /*
1860 * Now add the RPC_HDR_BA and any auth needed.
1861 */
1862
1863 if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1864 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1865 goto err_exit;
1866 }
1867
1868 if (auth_len) {
1869 if (ss_padding_len) {
1870 char pad[SERVER_NDR_PADDING_SIZE];
1871 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
1872 if (!prs_copy_data_in(&p->out_data.frag, pad,
1873 ss_padding_len)) {
1874 DEBUG(0,("api_pipe_bind_req: failed to add %u "
1875 "bytes of pad data.\n",
1876 (unsigned int)ss_padding_len));
1877 goto err_exit;
1878 }
1879 }
1880
1881 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1882 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1883 goto err_exit;
1884 }
1885 }
1886
1887 /*
1888 * Setup the lengths for the initial reply.
1889 */
1890
1891 p->out_data.data_sent_length = 0;
1892 p->out_data.current_pdu_sent = 0;
1893
1894 prs_mem_free(&out_hdr_ba);
1895 prs_mem_free(&out_auth);
1896
1897 return True;
1898
1899 err_exit:
1900
1901 prs_mem_free(&p->out_data.frag);
1902 prs_mem_free(&out_hdr_ba);
1903 prs_mem_free(&out_auth);
1904 return setup_bind_nak(p);
1905 }
1906
1907 /****************************************************************************
1908 Deal with an alter context call. Can be third part of 3 leg auth request for
1909 SPNEGO calls.
1910 ****************************************************************************/
1911
1912 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1913 {
1914 RPC_HDR_BA hdr_ba;
1915 RPC_HDR_RB hdr_rb;
1916 RPC_HDR_AUTH auth_info;
1917 uint16 assoc_gid;
1918 fstring ack_pipe_name;
1919 prs_struct out_hdr_ba;
1920 prs_struct out_auth;
1921 int auth_len = 0;
1922 uint32_t ss_padding_len = 0;
1923
1924 prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1925
1926 /*
1927 * Marshall directly into the outgoing PDU space. We
1928 * must do this as we need to set to the bind response
1929 * header and are never sending more than one PDU here.
1930 */
1931
1932 /*
1933 * Setup the memory to marshall the ba header, and the
1934 * auth footers.
1935 */
1936
1937 if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1938 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1939 prs_mem_free(&p->out_data.frag);
1940 return False;
1941 }
1942
1943 if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1944 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1945 prs_mem_free(&p->out_data.frag);
1946 prs_mem_free(&out_hdr_ba);
1947 return False;
1948 }
1949
1950 ZERO_STRUCT(hdr_rb);
1951
1952 DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1953
1954 /* decode the alter context request */
1955 if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0)) {
1956 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1957 goto err_exit;
1958 }
1959
1960 /* secondary address CAN be NULL
1961 * as the specs say it's ignored.
1962 * It MUST be NULL to have the spoolss working.
1963 */
1964 fstrcpy(ack_pipe_name,"");
1965
1966 DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1967
1968 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1969
1970 /*
1971 * Create the bind response struct.
1972 */
1973
1974 /* If the requested abstract synt uuid doesn't match our client pipe,
1975 reject the bind_ack & set the transfer interface synt to all 0's,
1976 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1977 unknown to NT4)
1978 Needed when adding entries to a DACL from NT5 - SK */
1979
1980 if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1981 hdr_rb.rpc_context[0].context_id )) {
1982 init_rpc_hdr_ba(&hdr_ba,
1983 RPC_MAX_PDU_FRAG_LEN,
1984 RPC_MAX_PDU_FRAG_LEN,
1985 assoc_gid,
1986 ack_pipe_name,
1987 0x1, 0x0, 0x0,
1988 &hdr_rb.rpc_context[0].transfer[0]);
1989 } else {
1990 /* Rejection reason: abstract syntax not supported */
1991 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1992 RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1993 ack_pipe_name, 0x1, 0x2, 0x1,
1994 &null_ndr_syntax_id);
1995 p->pipe_bound = False;
1996 }
1997
1998 /*
1999 * and marshall it.
2000 */
2001
2002 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
2003 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
2004 goto err_exit;
2005 }
2006
2007
2008 /*
2009 * Check if this is an authenticated alter context request.
2010 */
2011
2012 if (p->hdr.auth_len != 0) {
2013 /*
2014 * Decode the authentication verifier.
2015 */
2016
2017 /* Work out any padding needed before the auth footer. */
2018 if ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE) {
2019 ss_padding_len = SERVER_NDR_PADDING_SIZE -
2020 ((RPC_HEADER_LEN + prs_offset(&out_hdr_ba)) % SERVER_NDR_PADDING_SIZE);
2021 DEBUG(10,("api_pipe_alter_context: auth pad_len = %u\n",
2022 (unsigned int)ss_padding_len ));
2023 }
2024
2025 /* Quick length check. Won't catch a bad auth footer,
2026 * prevents overrun. */
2027
2028 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_AUTH_LEN + p->hdr.auth_len) {
2029 DEBUG(0,("api_pipe_alter_context: auth_len (%u) "
2030 "too long for fragment %u.\n",
2031 (unsigned int)p->hdr.auth_len,
2032 (unsigned int)p->hdr.frag_len ));
2033 goto err_exit;
2034 }
2035
2036 /* Pull the auth header and the following data into a blob. */
2037 /* NB. The offset of the auth_header is relative to the *end*
2038 * of the packet, not the start. Also, the length of the
2039 * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2040 * as the RPC header isn't included in rpc_in_p. */
2041 if(!prs_set_offset(rpc_in_p,
2042 p->hdr.frag_len - RPC_HEADER_LEN -
2043 RPC_HDR_AUTH_LEN - p->hdr.auth_len)) {
2044 DEBUG(0,("api_alter_context: cannot move "
2045 "offset to %u.\n",
2046 (unsigned int)(p->hdr.frag_len -
2047 RPC_HDR_AUTH_LEN - p->hdr.auth_len) ));
2048 goto err_exit;
2049 }
2050
2051 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
2052 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
2053 goto err_exit;
2054 }
2055
2056 /*
2057 * Currently only the SPNEGO auth type uses the alter ctx
2058 * response in place of the NTLMSSP auth3 type.
2059 */
2060
2061 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
2062 /* We can only finish if the pipe is unbound. */
2063 if (!p->pipe_bound) {
2064 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p,
2065 ss_padding_len, &auth_info, &out_auth)) {
2066 goto err_exit;
2067 }
2068 } else {
2069 goto err_exit;
2070 }
2071 }
2072 } else {
2073 ZERO_STRUCT(auth_info);
2074 }
2075 /*
2076 * Create the header, now we know the length.
2077 */
2078
2079 if (prs_offset(&out_auth)) {
2080 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
2081 }
2082
2083 init_rpc_hdr(&p->hdr, DCERPC_PKT_ALTER_RESP, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
2084 p->hdr.call_id,
2085 RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
2086 auth_len);
2087
2088 /*
2089 * Marshall the header into the outgoing PDU.
2090 */
2091
2092 if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
2093 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
2094 goto err_exit;
2095 }
2096
2097 /*
2098 * Now add the RPC_HDR_BA and any auth needed.
2099 */
2100
2101 if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
2102 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
2103 goto err_exit;
2104 }
2105
2106 if (auth_len) {
2107 if (ss_padding_len) {
2108 char pad[SERVER_NDR_PADDING_SIZE];
2109 memset(pad, '\0', SERVER_NDR_PADDING_SIZE);
2110 if (!prs_copy_data_in(&p->out_data.frag, pad,
2111 ss_padding_len)) {
2112 DEBUG(0,("api_pipe_alter_context: failed to add %u "
2113 "bytes of pad data.\n",
2114 (unsigned int)ss_padding_len));
2115 goto err_exit;
2116 }
2117 }
2118
2119 if (!prs_append_prs_data( &p->out_data.frag, &out_auth)) {
2120 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
2121 goto err_exit;
2122 }
2123 }
2124
2125 /*
2126 * Setup the lengths for the initial reply.
2127 */
2128
2129 p->out_data.data_sent_length = 0;
2130 p->out_data.current_pdu_sent = 0;
2131
2132 prs_mem_free(&out_hdr_ba);
2133 prs_mem_free(&out_auth);
2134
2135 return True;
2136
2137 err_exit:
2138
2139 prs_mem_free(&p->out_data.frag);
2140 prs_mem_free(&out_hdr_ba);
2141 prs_mem_free(&out_auth);
2142 return setup_bind_nak(p);
2143 }
2144
2145 /****************************************************************************
2146 Deal with NTLMSSP sign & seal processing on an RPC request.
2147 ****************************************************************************/
2148
2149 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
2150 uint32 *p_ss_padding_len, NTSTATUS *pstatus)
2151 {
2152 RPC_HDR_AUTH auth_info;
2153 uint32 auth_len = p->hdr.auth_len;
2154 uint32 save_offset = prs_offset(rpc_in);
2155 struct auth_ntlmssp_state *a = p->auth.a_u.auth_ntlmssp_state;
2156 unsigned char *data = NULL;
2157 size_t data_len;
2158 unsigned char *full_packet_data = NULL;
2159 size_t full_packet_data_len;
2160 DATA_BLOB auth_blob;
2161
2162 *pstatus = NT_STATUS_OK;
2163
2164 if (p->auth.auth_level == DCERPC_AUTH_LEVEL_NONE || p->auth.auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
2165 return True;
2166 }
2167
2168 if (!a) {
2169 *pstatus = NT_STATUS_INVALID_PARAMETER;
2170 return False;
2171 }
2172
2173 /* Ensure there's enough data for an authenticated request. */
2174 if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN
2175 + auth_len > p->hdr.frag_len) {
2176 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2177 (unsigned int)auth_len ));
2178 *pstatus = NT_STATUS_INVALID_PARAMETER;
2179 return False;
2180 }
2181
2182 /*
2183 * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2184 * after the RPC header.
2185 * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2186 * functions as NTLMv2 checks the rpc headers also.
2187 * Both of these values include any auth_pad_len bytes.
2188 */
2189
2190 data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2191 data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2192
2193 full_packet_data = p->in_data.current_in_pdu;
2194 full_packet_data_len = p->hdr.frag_len - auth_len;
2195
2196 /* Pull the auth header and the following data into a blob. */
2197 /* NB. The offset of the auth_header is relative to the *end*
2198 * of the packet, not the start. Also, the length of the
2199 * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2200 * as the RPC header isn't included in rpc_in_p. */
2201 if(!prs_set_offset(rpc_in,
2202 p->hdr.frag_len - RPC_HEADER_LEN -
2203 RPC_HDR_AUTH_LEN - auth_len)) {
2204 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move "
2205 "offset to %u.\n",
2206 (unsigned int)(p->hdr.frag_len -
2207 RPC_HDR_AUTH_LEN - auth_len) ));
2208 *pstatus = NT_STATUS_INVALID_PARAMETER;
2209 return False;
2210 }
2211
2212 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2213 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to "
2214 "unmarshall RPC_HDR_AUTH.\n"));
2215 *pstatus = NT_STATUS_INVALID_PARAMETER;
2216 return False;
2217 }
2218
2219 /* Ensure auth_pad_len fits into the packet. */
2220 if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2221 RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2222 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_info.auth_pad_len "
2223 "too large (%u), auth_len (%u), frag_len = (%u).\n",
2224 (unsigned int)auth_info.auth_pad_len,
2225 (unsigned int)auth_len,
2226 (unsigned int)p->hdr.frag_len ));
2227 *pstatus = NT_STATUS_INVALID_PARAMETER;
2228 return False;
2229 }
2230
2231 auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2232 auth_blob.length = auth_len;
2233
2234 switch (p->auth.auth_level) {
2235 case DCERPC_AUTH_LEVEL_PRIVACY:
2236 /* Data is encrypted. */
2237 *pstatus = auth_ntlmssp_unseal_packet(a,
2238 data, data_len,
2239 full_packet_data,
2240 full_packet_data_len,
2241 &auth_blob);
2242 if (!NT_STATUS_IS_OK(*pstatus)) {
2243 return False;
2244 }
2245 break;
2246 case DCERPC_AUTH_LEVEL_INTEGRITY:
2247 /* Data is signed. */
2248 *pstatus = auth_ntlmssp_check_packet(a,
2249 data, data_len,
2250 full_packet_data,
2251 full_packet_data_len,
2252 &auth_blob);
2253 if (!NT_STATUS_IS_OK(*pstatus)) {
2254 return False;
2255 }
2256 break;
2257 default:
2258 *pstatus = NT_STATUS_INVALID_PARAMETER;
2259 return False;
2260 }
2261
2262 /*
2263 * Return the current pointer to the data offset.
2264 */
2265
2266 if(!prs_set_offset(rpc_in, save_offset)) {
2267 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2268 (unsigned int)save_offset ));
2269 *pstatus = NT_STATUS_INVALID_PARAMETER;
2270 return False;
2271 }
2272
2273 /*
2274 * Remember the padding length. We must remove it from the real data
2275 * stream once the sign/seal is done.
2276 */
2277
2278 *p_ss_padding_len = auth_info.auth_pad_len;
2279
2280 return True;
2281 }
2282
2283 /****************************************************************************
2284 Deal with schannel processing on an RPC request.
2285 ****************************************************************************/
2286
2287 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2288 {
2289 uint32 data_len;
2290 uint32 auth_len;
2291 uint32 save_offset = prs_offset(rpc_in);
2292 RPC_HDR_AUTH auth_info;
2293 DATA_BLOB blob;
2294 NTSTATUS status;
2295 uint8_t *data;
2296
2297 auth_len = p->hdr.auth_len;
2298
2299 if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN ||
2300 auth_len > RPC_HEADER_LEN +
2301 RPC_HDR_REQ_LEN +
2302 RPC_HDR_AUTH_LEN +
2303 auth_len) {
2304 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2305 return False;
2306 }
2307
2308 /*
2309 * The following is that length of the data we must verify or unseal.
2310 * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2311 * preceeding the auth_data, but does include the auth_pad_len bytes.
2312 */
2313
2314 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2315 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2316 (unsigned int)p->hdr.frag_len,
2317 (unsigned int)auth_len ));
2318 return False;
2319 }
2320
2321 data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2322 RPC_HDR_AUTH_LEN - auth_len;
2323
2324 DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2325
2326 /* Pull the auth header and the following data into a blob. */
2327 /* NB. The offset of the auth_header is relative to the *end*
2328 * of the packet, not the start. Also, the length of the
2329 * data in rpc_in_p is p->hdr.frag_len - RPC_HEADER_LEN,
2330 * as the RPC header isn't included in rpc_in_p. */
2331 if(!prs_set_offset(rpc_in,
2332 p->hdr.frag_len - RPC_HEADER_LEN -
2333 RPC_HDR_AUTH_LEN - auth_len)) {
2334 DEBUG(0,("api_pipe_schannel_process: cannot move "
2335 "offset to %u.\n",
2336 (unsigned int)(p->hdr.frag_len -
2337 RPC_HDR_AUTH_LEN - auth_len) ));
2338 return False;
2339 }
2340
2341 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2342 DEBUG(0,("api_pipe_schannel_process: failed to "
2343 "unmarshall RPC_HDR_AUTH.\n"));
2344 return False;
2345 }
2346
2347 /* Ensure auth_pad_len fits into the packet. */
2348 if (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + auth_info.auth_pad_len +
2349 RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len) {
2350 DEBUG(0,("api_pipe_schannel_process: auth_info.auth_pad_len "
2351 "too large (%u), auth_len (%u), frag_len = (%u).\n",
2352 (unsigned int)auth_info.auth_pad_len,
2353 (unsigned int)auth_len,
2354 (unsigned int)p->hdr.frag_len ));
2355 return False;
2356 }
2357
2358 if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
2359 DEBUG(0,("Invalid auth info %d on schannel\n",
2360 auth_info.auth_type));
2361 return False;
2362 }
2363
2364 blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), auth_len);
2365
2366 if (DEBUGLEVEL >= 10) {
2367 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
2368 }
2369
2370 data = (uint8_t *)prs_data_p(rpc_in)+RPC_HDR_REQ_LEN;
2371
2372 switch (auth_info.auth_level) {
2373 case DCERPC_AUTH_LEVEL_PRIVACY:
2374 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2375 talloc_tos(),
2376 true,
2377 data,
2378 data_len,
2379 &blob);
2380 break;
2381 case DCERPC_AUTH_LEVEL_INTEGRITY:
2382 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2383 talloc_tos(),
2384 false,
2385 data,
2386 data_len,
2387 &blob);
2388 break;
2389 default:
2390 status = NT_STATUS_INTERNAL_ERROR;
2391 break;
2392 }
2393
2394 if (!NT_STATUS_IS_OK(status)) {
2395 DEBUG(0,("failed to unseal packet: %s\n", nt_errstr(status)));
2396 return false;
2397 }
2398
2399 /*
2400 * Return the current pointer to the data offset.
2401 */
2402
2403 if(!prs_set_offset(rpc_in, save_offset)) {
2404 DEBUG(0,("failed to set offset back to %u\n",
2405 (unsigned int)save_offset ));
2406 return False;
2407 }
2408
2409 /*
2410 * Remember the padding length. We must remove it from the real data
2411 * stream once the sign/seal is done.
2412 */
2413
2414 *p_ss_padding_len = auth_info.auth_pad_len;
2415
2416 return True;
2417 }
2418
2419 /****************************************************************************
2420 Find the set of RPC functions associated with this context_id
2421 ****************************************************************************/
2422
2423 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2424 {
2425 PIPE_RPC_FNS *fns = NULL;
2426
2427 if ( !list ) {
2428 DEBUG(0,("find_pipe_fns_by_context: ERROR! No context list for pipe!\n"));
2429 return NULL;
2430 }
2431
2432 for (fns=list; fns; fns=fns->next ) {
2433 if ( fns->context_id == context_id )
2434 return fns;
2435 }
2436 return NULL;
2437 }
2438
2439 /****************************************************************************
2440 Memory cleanup.
2441 ****************************************************************************/
2442
2443 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2444 {
2445 PIPE_RPC_FNS *tmp = list;
2446 PIPE_RPC_FNS *tmp2;
2447
2448 while (tmp) {
2449 tmp2 = tmp->next;
2450 SAFE_FREE(tmp);
2451 tmp = tmp2;
2452 }
2453
2454 return;
2455 }
2456
2457 static bool api_rpcTNP(pipes_struct *p,
2458 const struct api_struct *api_rpc_cmds, int n_cmds);
2459
2460 /****************************************************************************
2461 Find the correct RPC function to call for this request.
2462 If the pipe is authenticated then become the correct UNIX user
2463 before doing the call.
2464 ****************************************************************************/
2465
2466 bool api_pipe_request(pipes_struct *p)
2467 {
2468 bool ret = False;
2469 bool changed_user = False;
2470 PIPE_RPC_FNS *pipe_fns;
2471
2472 if (p->pipe_bound &&
2473 ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2474 (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2475 if(!become_authenticated_pipe_user(p)) {
2476 prs_mem_free(&p->out_data.rdata);
2477 return False;
2478 }
2479 changed_user = True;
2480 }
2481
2482 DEBUG(5, ("Requested \\PIPE\\%s\n",
2483 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2484
2485 /* get the set of RPC functions for this context */
2486
2487 pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2488
2489 if ( pipe_fns ) {
2490 TALLOC_CTX *frame = talloc_stackframe();
2491 ret = api_rpcTNP(p, pipe_fns->cmds, pipe_fns->n_cmds);
2492 TALLOC_FREE(frame);
2493 }
2494 else {
2495 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2496 p->hdr_req.context_id,
2497 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2498 }
2499
2500 if (changed_user) {
2501 unbecome_authenticated_pipe_user();
2502 }
2503
2504 return ret;
2505 }
2506
2507 /*******************************************************************
2508 Calls the underlying RPC function for a named pipe.
2509 ********************************************************************/
2510
2511 static bool api_rpcTNP(pipes_struct *p,
2512 const struct api_struct *api_rpc_cmds, int n_cmds)
2513 {
2514 int fn_num;
2515 uint32 offset1, offset2;
2516
2517 /* interpret the command */
2518 DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2519 get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2520 p->hdr_req.opnum));
2521
2522 if (DEBUGLEVEL >= 50) {
2523 fstring name;
2524 slprintf(name, sizeof(name)-1, "in_%s",
2525 get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2526 prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2527 }
2528
2529 for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2530 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2531 DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2532 break;
2533 }
2534 }
2535
2536 if (fn_num == n_cmds) {
2537 /*
2538 * For an unknown RPC just return a fault PDU but
2539 * return True to allow RPC's on the pipe to continue
2540 * and not put the pipe into fault state. JRA.
2541 */
2542 DEBUG(4, ("unknown\n"));
2543 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2544 return True;
2545 }
2546
2547 offset1 = prs_offset(&p->out_data.rdata);
2548
2549 DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2550 fn_num, api_rpc_cmds[fn_num].fn));
2551 /* do the actual command */
2552 if(!api_rpc_cmds[fn_num].fn(p)) {
2553 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2554 get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2555 api_rpc_cmds[fn_num].name));
2556 prs_mem_free(&p->out_data.rdata);
2557 return False;
2558 }
2559
2560 if (p->bad_handle_fault_state) {
2561 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2562 p->bad_handle_fault_state = False;
2563 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2564 return True;
2565 }
2566
2567 if (p->rng_fault_state) {
2568 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2569 p->rng_fault_state = False;
2570 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2571 return True;
2572 }
2573
2574 offset2 = prs_offset(&p->out_data.rdata);
2575 prs_set_offset(&p->out_data.rdata, offset1);
2576 if (DEBUGLEVEL >= 50) {
2577 fstring name;
2578 slprintf(name, sizeof(name)-1, "out_%s",
2579 get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2580 prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2581 }
2582 prs_set_offset(&p->out_data.rdata, offset2);
2583
2584 DEBUG(5,("api_rpcTNP: called %s successfully\n",
2585 get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2586
2587 /* Check for buffer underflow in rpc parsing */
2588
2589 if ((DEBUGLEVEL >= 10) &&
2590 (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2591 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2592 char *data = (char *)SMB_MALLOC(data_len);
2593
2594 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2595 if (data) {
2596 prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2597 SAFE_FREE(data);
2598 }
2599
2600 }
2601
2602 return True;
2603 }
reg import