?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Document default of the printing config variable.
[Samba/nascimento.git] / source3 / rpc_server / srv_pipe.c
blob343342a06c175d0ce82a396757e9d221f4fd2eaa
1 /*
2 * Unix SMB/CIFS implementation.
3 * RPC Pipe client / server routines
4 * Almost completely rewritten by (C) Jeremy Allison 2005.
5 *
6 * This program is free software; you can redistribute it and/or modify
7 * it under the terms of the GNU General Public License as published by
8 * the Free Software Foundation; either version 3 of the License, or
9 * (at your option) any later version.
10 *
11 * This program is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the
14 * GNU General Public License for more details.
15 *
16 * You should have received a copy of the GNU General Public License
17 * along with this program; if not, see <http://www.gnu.org/licenses/>.
18 */
19
20 /* this module apparently provides an implementation of DCE/RPC over a
21 * named pipe (IPC$ connection using SMBtrans). details of DCE/RPC
22 * documentation are available (in on-line form) from the X-Open group.
23 *
24 * this module should provide a level of abstraction between SMB
25 * and DCE/RPC, while minimising the amount of mallocs, unnecessary
26 * data copies, and network traffic.
27 *
28 */
29
30 #include "includes.h"
31
32 extern struct current_user current_user;
33
34 #undef DBGC_CLASS
35 #define DBGC_CLASS DBGC_RPC_SRV
36
37 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
38 {
39 AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
40
41 if (a) {
42 auth_ntlmssp_end(&a);
43 }
44 auth->a_u.auth_ntlmssp_state = NULL;
45 }
46
47 static DATA_BLOB generic_session_key(void)
48 {
49 return data_blob("SystemLibraryDTC", 16);
50 }
51
52 /*******************************************************************
53 Generate the next PDU to be returned from the data in p->rdata.
54 Handle NTLMSSP.
55 ********************************************************************/
56
57 static bool create_next_pdu_ntlmssp(pipes_struct *p)
58 {
59 RPC_HDR_RESP hdr_resp;
60 uint32 ss_padding_len = 0;
61 uint32 data_space_available;
62 uint32 data_len_left;
63 uint32 data_len;
64 prs_struct outgoing_pdu;
65 NTSTATUS status;
66 DATA_BLOB auth_blob;
67 RPC_HDR_AUTH auth_info;
68 uint8 auth_type, auth_level;
69 AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
70
71 /*
72 * If we're in the fault state, keep returning fault PDU's until
73 * the pipe gets closed. JRA.
74 */
75
76 if(p->fault_state) {
77 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
78 return True;
79 }
80
81 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
82
83 /* Change the incoming request header to a response. */
84 p->hdr.pkt_type = RPC_RESPONSE;
85
86 /* Set up rpc header flags. */
87 if (p->out_data.data_sent_length == 0) {
88 p->hdr.flags = RPC_FLG_FIRST;
89 } else {
90 p->hdr.flags = 0;
91 }
92
93 /*
94 * Work out how much we can fit in a single PDU.
95 */
96
97 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
98
99 /*
100 * Ensure there really is data left to send.
101 */
102
103 if(!data_len_left) {
104 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
105 return False;
106 }
107
108 data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
109 RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
110
111 /*
112 * The amount we send is the minimum of the available
113 * space and the amount left to send.
114 */
115
116 data_len = MIN(data_len_left, data_space_available);
117
118 /*
119 * Set up the alloc hint. This should be the data left to
120 * send.
121 */
122
123 hdr_resp.alloc_hint = data_len_left;
124
125 /*
126 * Work out if this PDU will be the last.
127 */
128
129 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
130 p->hdr.flags |= RPC_FLG_LAST;
131 if (data_len_left % 8) {
132 ss_padding_len = 8 - (data_len_left % 8);
133 DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
134 ss_padding_len ));
135 }
136 }
137
138 /*
139 * Set up the header lengths.
140 */
141
142 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
143 data_len + ss_padding_len +
144 RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
145 p->hdr.auth_len = NTLMSSP_SIG_SIZE;
146
147
148 /*
149 * Init the parse struct to point at the outgoing
150 * data.
151 */
152
153 prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
154 prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
155
156 /* Store the header in the data stream. */
157 if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
158 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
159 prs_mem_free(&outgoing_pdu);
160 return False;
161 }
162
163 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
164 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
165 prs_mem_free(&outgoing_pdu);
166 return False;
167 }
168
169 /* Copy the data into the PDU. */
170
171 if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
172 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
173 prs_mem_free(&outgoing_pdu);
174 return False;
175 }
176
177 /* Copy the sign/seal padding data. */
178 if (ss_padding_len) {
179 char pad[8];
180
181 memset(pad, '\0', 8);
182 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
183 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
184 (unsigned int)ss_padding_len));
185 prs_mem_free(&outgoing_pdu);
186 return False;
187 }
188 }
189
190
191 /* Now write out the auth header and null blob. */
192 if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
193 auth_type = RPC_NTLMSSP_AUTH_TYPE;
194 } else {
195 auth_type = RPC_SPNEGO_AUTH_TYPE;
196 }
197 if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
198 auth_level = RPC_AUTH_LEVEL_PRIVACY;
199 } else {
200 auth_level = RPC_AUTH_LEVEL_INTEGRITY;
201 }
202
203 init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
204 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
205 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
206 prs_mem_free(&outgoing_pdu);
207 return False;
208 }
209
210 /* Generate the sign blob. */
211
212 switch (p->auth.auth_level) {
213 case PIPE_AUTH_LEVEL_PRIVACY:
214 /* Data portion is encrypted. */
215 status = ntlmssp_seal_packet(a->ntlmssp_state,
216 (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
217 data_len + ss_padding_len,
218 (unsigned char *)prs_data_p(&outgoing_pdu),
219 (size_t)prs_offset(&outgoing_pdu),
220 &auth_blob);
221 if (!NT_STATUS_IS_OK(status)) {
222 data_blob_free(&auth_blob);
223 prs_mem_free(&outgoing_pdu);
224 return False;
225 }
226 break;
227 case PIPE_AUTH_LEVEL_INTEGRITY:
228 /* Data is signed. */
229 status = ntlmssp_sign_packet(a->ntlmssp_state,
230 (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
231 data_len + ss_padding_len,
232 (unsigned char *)prs_data_p(&outgoing_pdu),
233 (size_t)prs_offset(&outgoing_pdu),
234 &auth_blob);
235 if (!NT_STATUS_IS_OK(status)) {
236 data_blob_free(&auth_blob);
237 prs_mem_free(&outgoing_pdu);
238 return False;
239 }
240 break;
241 default:
242 prs_mem_free(&outgoing_pdu);
243 return False;
244 }
245
246 /* Append the auth blob. */
247 if (!prs_copy_data_in(&outgoing_pdu, (char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
248 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
249 (unsigned int)NTLMSSP_SIG_SIZE));
250 data_blob_free(&auth_blob);
251 prs_mem_free(&outgoing_pdu);
252 return False;
253 }
254
255 data_blob_free(&auth_blob);
256
257 /*
258 * Setup the counts for this PDU.
259 */
260
261 p->out_data.data_sent_length += data_len;
262 p->out_data.current_pdu_len = p->hdr.frag_len;
263 p->out_data.current_pdu_sent = 0;
264
265 prs_mem_free(&outgoing_pdu);
266 return True;
267 }
268
269 /*******************************************************************
270 Generate the next PDU to be returned from the data in p->rdata.
271 Return an schannel authenticated fragment.
272 ********************************************************************/
273
274 static bool create_next_pdu_schannel(pipes_struct *p)
275 {
276 RPC_HDR_RESP hdr_resp;
277 uint32 ss_padding_len = 0;
278 uint32 data_len;
279 uint32 data_space_available;
280 uint32 data_len_left;
281 prs_struct outgoing_pdu;
282 uint32 data_pos;
283
284 /*
285 * If we're in the fault state, keep returning fault PDU's until
286 * the pipe gets closed. JRA.
287 */
288
289 if(p->fault_state) {
290 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
291 return True;
292 }
293
294 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
295
296 /* Change the incoming request header to a response. */
297 p->hdr.pkt_type = RPC_RESPONSE;
298
299 /* Set up rpc header flags. */
300 if (p->out_data.data_sent_length == 0) {
301 p->hdr.flags = RPC_FLG_FIRST;
302 } else {
303 p->hdr.flags = 0;
304 }
305
306 /*
307 * Work out how much we can fit in a single PDU.
308 */
309
310 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
311
312 /*
313 * Ensure there really is data left to send.
314 */
315
316 if(!data_len_left) {
317 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
318 return False;
319 }
320
321 data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
322 RPC_HDR_AUTH_LEN - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
323
324 /*
325 * The amount we send is the minimum of the available
326 * space and the amount left to send.
327 */
328
329 data_len = MIN(data_len_left, data_space_available);
330
331 /*
332 * Set up the alloc hint. This should be the data left to
333 * send.
334 */
335
336 hdr_resp.alloc_hint = data_len_left;
337
338 /*
339 * Work out if this PDU will be the last.
340 */
341
342 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
343 p->hdr.flags |= RPC_FLG_LAST;
344 if (data_len_left % 8) {
345 ss_padding_len = 8 - (data_len_left % 8);
346 DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
347 ss_padding_len ));
348 }
349 }
350
351 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
352 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
353 p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
354
355 /*
356 * Init the parse struct to point at the outgoing
357 * data.
358 */
359
360 prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
361 prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
362
363 /* Store the header in the data stream. */
364 if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
365 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
366 prs_mem_free(&outgoing_pdu);
367 return False;
368 }
369
370 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
371 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
372 prs_mem_free(&outgoing_pdu);
373 return False;
374 }
375
376 /* Store the current offset. */
377 data_pos = prs_offset(&outgoing_pdu);
378
379 /* Copy the data into the PDU. */
380
381 if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
382 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
383 prs_mem_free(&outgoing_pdu);
384 return False;
385 }
386
387 /* Copy the sign/seal padding data. */
388 if (ss_padding_len) {
389 char pad[8];
390 memset(pad, '\0', 8);
391 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
392 DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
393 prs_mem_free(&outgoing_pdu);
394 return False;
395 }
396 }
397
398 {
399 /*
400 * Schannel processing.
401 */
402 char *data;
403 RPC_HDR_AUTH auth_info;
404 RPC_AUTH_SCHANNEL_CHK verf;
405
406 data = prs_data_p(&outgoing_pdu) + data_pos;
407 /* Check it's the type of reply we were expecting to decode */
408
409 init_rpc_hdr_auth(&auth_info,
410 RPC_SCHANNEL_AUTH_TYPE,
411 p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY ?
412 RPC_AUTH_LEVEL_PRIVACY : RPC_AUTH_LEVEL_INTEGRITY,
413 ss_padding_len, 1);
414
415 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
416 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
417 prs_mem_free(&outgoing_pdu);
418 return False;
419 }
420
421 schannel_encode(p->auth.a_u.schannel_auth,
422 p->auth.auth_level,
423 SENDER_IS_ACCEPTOR,
424 &verf, data, data_len + ss_padding_len);
425
426 if (!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
427 &verf, &outgoing_pdu, 0)) {
428 prs_mem_free(&outgoing_pdu);
429 return False;
430 }
431
432 p->auth.a_u.schannel_auth->seq_num++;
433 }
434
435 /*
436 * Setup the counts for this PDU.
437 */
438
439 p->out_data.data_sent_length += data_len;
440 p->out_data.current_pdu_len = p->hdr.frag_len;
441 p->out_data.current_pdu_sent = 0;
442
443 prs_mem_free(&outgoing_pdu);
444 return True;
445 }
446
447 /*******************************************************************
448 Generate the next PDU to be returned from the data in p->rdata.
449 No authentication done.
450 ********************************************************************/
451
452 static bool create_next_pdu_noauth(pipes_struct *p)
453 {
454 RPC_HDR_RESP hdr_resp;
455 uint32 data_len;
456 uint32 data_space_available;
457 uint32 data_len_left;
458 prs_struct outgoing_pdu;
459
460 /*
461 * If we're in the fault state, keep returning fault PDU's until
462 * the pipe gets closed. JRA.
463 */
464
465 if(p->fault_state) {
466 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
467 return True;
468 }
469
470 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
471
472 /* Change the incoming request header to a response. */
473 p->hdr.pkt_type = RPC_RESPONSE;
474
475 /* Set up rpc header flags. */
476 if (p->out_data.data_sent_length == 0) {
477 p->hdr.flags = RPC_FLG_FIRST;
478 } else {
479 p->hdr.flags = 0;
480 }
481
482 /*
483 * Work out how much we can fit in a single PDU.
484 */
485
486 data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
487
488 /*
489 * Ensure there really is data left to send.
490 */
491
492 if(!data_len_left) {
493 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
494 return False;
495 }
496
497 data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
498
499 /*
500 * The amount we send is the minimum of the available
501 * space and the amount left to send.
502 */
503
504 data_len = MIN(data_len_left, data_space_available);
505
506 /*
507 * Set up the alloc hint. This should be the data left to
508 * send.
509 */
510
511 hdr_resp.alloc_hint = data_len_left;
512
513 /*
514 * Work out if this PDU will be the last.
515 */
516
517 if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
518 p->hdr.flags |= RPC_FLG_LAST;
519 }
520
521 /*
522 * Set up the header lengths.
523 */
524
525 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
526 p->hdr.auth_len = 0;
527
528 /*
529 * Init the parse struct to point at the outgoing
530 * data.
531 */
532
533 prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
534 prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
535
536 /* Store the header in the data stream. */
537 if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
538 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
539 prs_mem_free(&outgoing_pdu);
540 return False;
541 }
542
543 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
544 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
545 prs_mem_free(&outgoing_pdu);
546 return False;
547 }
548
549 /* Copy the data into the PDU. */
550
551 if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
552 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
553 prs_mem_free(&outgoing_pdu);
554 return False;
555 }
556
557 /*
558 * Setup the counts for this PDU.
559 */
560
561 p->out_data.data_sent_length += data_len;
562 p->out_data.current_pdu_len = p->hdr.frag_len;
563 p->out_data.current_pdu_sent = 0;
564
565 prs_mem_free(&outgoing_pdu);
566 return True;
567 }
568
569 /*******************************************************************
570 Generate the next PDU to be returned from the data in p->rdata.
571 ********************************************************************/
572
573 bool create_next_pdu(pipes_struct *p)
574 {
575 switch(p->auth.auth_level) {
576 case PIPE_AUTH_LEVEL_NONE:
577 case PIPE_AUTH_LEVEL_CONNECT:
578 /* This is incorrect for auth level connect. Fixme. JRA */
579 return create_next_pdu_noauth(p);
580
581 default:
582 switch(p->auth.auth_type) {
583 case PIPE_AUTH_TYPE_NTLMSSP:
584 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
585 return create_next_pdu_ntlmssp(p);
586 case PIPE_AUTH_TYPE_SCHANNEL:
587 return create_next_pdu_schannel(p);
588 default:
589 break;
590 }
591 }
592
593 DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
594 (unsigned int)p->auth.auth_level,
595 (unsigned int)p->auth.auth_type));
596 return False;
597 }
598
599 /*******************************************************************
600 Process an NTLMSSP authentication response.
601 If this function succeeds, the user has been authenticated
602 and their domain, name and calling workstation stored in
603 the pipe struct.
604 *******************************************************************/
605
606 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
607 {
608 DATA_BLOB session_key, reply;
609 NTSTATUS status;
610 AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
611 bool ret;
612
613 DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n", p->name));
614
615 ZERO_STRUCT(reply);
616
617 /* this has to be done as root in order to verify the password */
618 become_root();
619 status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
620 unbecome_root();
621
622 /* Don't generate a reply. */
623 data_blob_free(&reply);
624
625 if (!NT_STATUS_IS_OK(status)) {
626 return False;
627 }
628
629 /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
630 ensure the underlying NTLMSSP flags are also set. If not we should
631 refuse the bind. */
632
633 if (p->auth.auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
634 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
635 DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
636 "but client declined signing.\n",
637 p->name ));
638 return False;
639 }
640 }
641 if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
642 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
643 DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
644 "but client declined sealing.\n",
645 p->name ));
646 return False;
647 }
648 }
649
650 DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
651 "workstation: %s\n", a->ntlmssp_state->user,
652 a->ntlmssp_state->domain, a->ntlmssp_state->workstation));
653
654 if (a->server_info->ptok == NULL) {
655 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
656 return False;
657 }
658
659 TALLOC_FREE(p->server_info);
660
661 p->server_info = copy_serverinfo(p, a->server_info);
662 if (p->server_info == NULL) {
663 DEBUG(0, ("copy_serverinfo failed\n"));
664 return false;
665 }
666
667 /*
668 * We're an authenticated bind over smb, so the session key needs to
669 * be set to "SystemLibraryDTC". Weird, but this is what Windows
670 * does. See the RPC-SAMBA3SESSIONKEY.
671 */
672
673 session_key = generic_session_key();
674 if (session_key.data == NULL) {
675 return False;
676 }
677
678 ret = server_info_set_session_key(p->server_info, session_key);
679
680 data_blob_free(&session_key);
681
682 return True;
683 }
684
685 /*******************************************************************
686 The switch table for the pipe names and the functions to handle them.
687 *******************************************************************/
688
689 struct rpc_table {
690 struct {
691 const char *clnt;
692 const char *srv;
693 } pipe;
694 struct ndr_syntax_id rpc_interface;
695 const struct api_struct *cmds;
696 int n_cmds;
697 };
698
699 static struct rpc_table *rpc_lookup;
700 static int rpc_lookup_size;
701
702 /*******************************************************************
703 This is the "stage3" NTLMSSP response after a bind request and reply.
704 *******************************************************************/
705
706 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
707 {
708 RPC_HDR_AUTH auth_info;
709 uint32 pad = 0;
710 DATA_BLOB blob;
711
712 ZERO_STRUCT(blob);
713
714 DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
715
716 if (p->hdr.auth_len == 0) {
717 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
718 goto err;
719 }
720
721 /* 4 bytes padding. */
722 if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
723 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
724 goto err;
725 }
726
727 /*
728 * Decode the authentication verifier response.
729 */
730
731 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
732 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
733 goto err;
734 }
735
736 if (auth_info.auth_type != RPC_NTLMSSP_AUTH_TYPE) {
737 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
738 (unsigned int)auth_info.auth_type ));
739 return False;
740 }
741
742 blob = data_blob(NULL,p->hdr.auth_len);
743
744 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
745 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
746 (unsigned int)p->hdr.auth_len ));
747 goto err;
748 }
749
750 /*
751 * The following call actually checks the challenge/response data.
752 * for correctness against the given DOMAIN\user name.
753 */
754
755 if (!pipe_ntlmssp_verify_final(p, &blob)) {
756 goto err;
757 }
758
759 data_blob_free(&blob);
760
761 p->pipe_bound = True;
762
763 return True;
764
765 err:
766
767 data_blob_free(&blob);
768 free_pipe_ntlmssp_auth_data(&p->auth);
769 p->auth.a_u.auth_ntlmssp_state = NULL;
770
771 return False;
772 }
773
774 /*******************************************************************
775 Marshall a bind_nak pdu.
776 *******************************************************************/
777
778 static bool setup_bind_nak(pipes_struct *p)
779 {
780 prs_struct outgoing_rpc;
781 RPC_HDR nak_hdr;
782 uint16 zero = 0;
783
784 /* Free any memory in the current return data buffer. */
785 prs_mem_free(&p->out_data.rdata);
786
787 /*
788 * Marshall directly into the outgoing PDU space. We
789 * must do this as we need to set to the bind response
790 * header and are never sending more than one PDU here.
791 */
792
793 prs_init_empty( &outgoing_rpc, p->mem_ctx, MARSHALL);
794 prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
795
796 /*
797 * Initialize a bind_nak header.
798 */
799
800 init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
801 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
802
803 /*
804 * Marshall the header into the outgoing PDU.
805 */
806
807 if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
808 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
809 prs_mem_free(&outgoing_rpc);
810 return False;
811 }
812
813 /*
814 * Now add the reject reason.
815 */
816
817 if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
818 prs_mem_free(&outgoing_rpc);
819 return False;
820 }
821
822 p->out_data.data_sent_length = 0;
823 p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
824 p->out_data.current_pdu_sent = 0;
825
826 if (p->auth.auth_data_free_func) {
827 (*p->auth.auth_data_free_func)(&p->auth);
828 }
829 p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
830 p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
831 p->pipe_bound = False;
832
833 return True;
834 }
835
836 /*******************************************************************
837 Marshall a fault pdu.
838 *******************************************************************/
839
840 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
841 {
842 prs_struct outgoing_pdu;
843 RPC_HDR fault_hdr;
844 RPC_HDR_RESP hdr_resp;
845 RPC_HDR_FAULT fault_resp;
846
847 /* Free any memory in the current return data buffer. */
848 prs_mem_free(&p->out_data.rdata);
849
850 /*
851 * Marshall directly into the outgoing PDU space. We
852 * must do this as we need to set to the bind response
853 * header and are never sending more than one PDU here.
854 */
855
856 prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
857 prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
858
859 /*
860 * Initialize a fault header.
861 */
862
863 init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
864 p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
865
866 /*
867 * Initialize the HDR_RESP and FAULT parts of the PDU.
868 */
869
870 memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
871
872 fault_resp.status = status;
873 fault_resp.reserved = 0;
874
875 /*
876 * Marshall the header into the outgoing PDU.
877 */
878
879 if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
880 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
881 prs_mem_free(&outgoing_pdu);
882 return False;
883 }
884
885 if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
886 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
887 prs_mem_free(&outgoing_pdu);
888 return False;
889 }
890
891 if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
892 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
893 prs_mem_free(&outgoing_pdu);
894 return False;
895 }
896
897 p->out_data.data_sent_length = 0;
898 p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
899 p->out_data.current_pdu_sent = 0;
900
901 prs_mem_free(&outgoing_pdu);
902 return True;
903 }
904
905 #if 0
906 /*******************************************************************
907 Marshall a cancel_ack pdu.
908 We should probably check the auth-verifier here.
909 *******************************************************************/
910
911 bool setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
912 {
913 prs_struct outgoing_pdu;
914 RPC_HDR ack_reply_hdr;
915
916 /* Free any memory in the current return data buffer. */
917 prs_mem_free(&p->out_data.rdata);
918
919 /*
920 * Marshall directly into the outgoing PDU space. We
921 * must do this as we need to set to the bind response
922 * header and are never sending more than one PDU here.
923 */
924
925 prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
926 prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
927
928 /*
929 * Initialize a cancel_ack header.
930 */
931
932 init_rpc_hdr(&ack_reply_hdr, RPC_CANCEL_ACK, RPC_FLG_FIRST | RPC_FLG_LAST,
933 p->hdr.call_id, RPC_HEADER_LEN, 0);
934
935 /*
936 * Marshall the header into the outgoing PDU.
937 */
938
939 if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
940 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
941 prs_mem_free(&outgoing_pdu);
942 return False;
943 }
944
945 p->out_data.data_sent_length = 0;
946 p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
947 p->out_data.current_pdu_sent = 0;
948
949 prs_mem_free(&outgoing_pdu);
950 return True;
951 }
952 #endif
953
954 /*******************************************************************
955 Ensure a bind request has the correct abstract & transfer interface.
956 Used to reject unknown binds from Win2k.
957 *******************************************************************/
958
959 bool check_bind_req(struct pipes_struct *p, RPC_IFACE* abstract,
960 RPC_IFACE* transfer, uint32 context_id)
961 {
962 int i=0;
963 struct pipe_rpc_fns *context_fns;
964
965 DEBUG(3,("check_bind_req for %s\n", p->name));
966
967 /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
968
969 for (i=0; i<rpc_lookup_size; i++) {
970 DEBUGADD(10, ("checking %s\n", rpc_lookup[i].pipe.clnt));
971 if (strequal(rpc_lookup[i].pipe.clnt, p->name)
972 && ndr_syntax_id_equal(
973 abstract, &rpc_lookup[i].rpc_interface)
974 && ndr_syntax_id_equal(
975 transfer, &ndr_transfer_syntax)) {
976 break;
977 }
978 }
979
980 if (i == rpc_lookup_size) {
981 return false;
982 }
983
984 context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
985 if (context_fns == NULL) {
986 DEBUG(0,("check_bind_req: malloc() failed!\n"));
987 return False;
988 }
989
990 context_fns->cmds = rpc_lookup[i].cmds;
991 context_fns->n_cmds = rpc_lookup[i].n_cmds;
992 context_fns->context_id = context_id;
993
994 /* add to the list of open contexts */
995
996 DLIST_ADD( p->contexts, context_fns );
997
998 return True;
999 }
1000
1001 /*******************************************************************
1002 Register commands to an RPC pipe
1003 *******************************************************************/
1004
1005 NTSTATUS rpc_srv_register(int version, const char *clnt, const char *srv,
1006 const struct ndr_interface_table *iface,
1007 const struct api_struct *cmds, int size)
1008 {
1009 struct rpc_table *rpc_entry;
1010
1011 if (!clnt || !srv || !cmds) {
1012 return NT_STATUS_INVALID_PARAMETER;
1013 }
1014
1015 if (version != SMB_RPC_INTERFACE_VERSION) {
1016 DEBUG(0,("Can't register rpc commands!\n"
1017 "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1018 ", while this version of samba uses version %d!\n",
1019 version,SMB_RPC_INTERFACE_VERSION));
1020 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1021 }
1022
1023 /* TODO:
1024 *
1025 * we still need to make sure that don't register the same commands twice!!!
1026 *
1027 * --metze
1028 */
1029
1030 /* We use a temporary variable because this call can fail and
1031 rpc_lookup will still be valid afterwards. It could then succeed if
1032 called again later */
1033 rpc_lookup_size++;
1034 rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1035 if (NULL == rpc_entry) {
1036 rpc_lookup_size--;
1037 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1038 return NT_STATUS_NO_MEMORY;
1039 } else {
1040 rpc_lookup = rpc_entry;
1041 }
1042
1043 rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1044 ZERO_STRUCTP(rpc_entry);
1045 rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1046 rpc_entry->pipe.srv = SMB_STRDUP(srv);
1047 rpc_entry->rpc_interface = iface->syntax_id;
1048 rpc_entry->cmds = cmds;
1049 rpc_entry->n_cmds = size;
1050
1051 return NT_STATUS_OK;
1052 }
1053
1054 /**
1055 * Is a named pipe known?
1056 * @param[in] cli_filename The pipe name requested by the client
1057 * @result Do we want to serve this?
1058 */
1059 bool is_known_pipename(const char *cli_filename)
1060 {
1061 const char *pipename = cli_filename;
1062 int i;
1063
1064 if (strnequal(pipename, "\\PIPE\\", 6)) {
1065 pipename += 5;
1066 }
1067
1068 if (*pipename == '\\') {
1069 pipename += 1;
1070 }
1071
1072 if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1073 DEBUG(10, ("refusing spoolss access\n"));
1074 return false;
1075 }
1076
1077 for (i=0; i<rpc_lookup_size; i++) {
1078 if (strequal(pipename, rpc_lookup[i].pipe.clnt)) {
1079 return true;
1080 }
1081 }
1082
1083 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1084 return false;
1085 }
1086
1087 /*******************************************************************
1088 Handle a SPNEGO krb5 bind auth.
1089 *******************************************************************/
1090
1091 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1092 DATA_BLOB *psecblob, prs_struct *pout_auth)
1093 {
1094 return False;
1095 }
1096
1097 /*******************************************************************
1098 Handle the first part of a SPNEGO bind auth.
1099 *******************************************************************/
1100
1101 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1102 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1103 {
1104 DATA_BLOB blob;
1105 DATA_BLOB secblob;
1106 DATA_BLOB response;
1107 DATA_BLOB chal;
1108 char *OIDs[ASN1_MAX_OIDS];
1109 int i;
1110 NTSTATUS status;
1111 bool got_kerberos_mechanism = false;
1112 AUTH_NTLMSSP_STATE *a = NULL;
1113 RPC_HDR_AUTH auth_info;
1114
1115 ZERO_STRUCT(secblob);
1116 ZERO_STRUCT(chal);
1117 ZERO_STRUCT(response);
1118
1119 /* Grab the SPNEGO blob. */
1120 blob = data_blob(NULL,p->hdr.auth_len);
1121
1122 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1123 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1124 (unsigned int)p->hdr.auth_len ));
1125 goto err;
1126 }
1127
1128 if (blob.data[0] != ASN1_APPLICATION(0)) {
1129 goto err;
1130 }
1131
1132 /* parse out the OIDs and the first sec blob */
1133 if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1134 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1135 goto err;
1136 }
1137
1138 if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1139 got_kerberos_mechanism = true;
1140 }
1141
1142 for (i=0;OIDs[i];i++) {
1143 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1144 TALLOC_FREE(OIDs[i]);
1145 }
1146 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1147
1148 if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || lp_use_kerberos_keytab()) ) {
1149 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1150 data_blob_free(&secblob);
1151 data_blob_free(&blob);
1152 return ret;
1153 }
1154
1155 if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1156 /* Free any previous auth type. */
1157 free_pipe_ntlmssp_auth_data(&p->auth);
1158 }
1159
1160 if (!got_kerberos_mechanism) {
1161 /* Initialize the NTLM engine. */
1162 status = auth_ntlmssp_start(&a);
1163 if (!NT_STATUS_IS_OK(status)) {
1164 goto err;
1165 }
1166
1167 /*
1168 * Pass the first security blob of data to it.
1169 * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1170 * which means we need another packet to complete the bind.
1171 */
1172
1173 status = auth_ntlmssp_update(a, secblob, &chal);
1174
1175 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1176 DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1177 goto err;
1178 }
1179
1180 /* Generate the response blob we need for step 2 of the bind. */
1181 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1182 } else {
1183 /*
1184 * SPNEGO negotiate down to NTLMSSP. The subsequent
1185 * code to process follow-up packets is not complete
1186 * yet. JRA.
1187 */
1188 response = spnego_gen_auth_response(NULL,
1189 NT_STATUS_MORE_PROCESSING_REQUIRED,
1190 OID_NTLMSSP);
1191 }
1192
1193 /* Copy the blob into the pout_auth parse struct */
1194 init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1195 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1196 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1197 goto err;
1198 }
1199
1200 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1201 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1202 goto err;
1203 }
1204
1205 p->auth.a_u.auth_ntlmssp_state = a;
1206 p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1207 p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1208
1209 data_blob_free(&blob);
1210 data_blob_free(&secblob);
1211 data_blob_free(&chal);
1212 data_blob_free(&response);
1213
1214 /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1215 return True;
1216
1217 err:
1218
1219 data_blob_free(&blob);
1220 data_blob_free(&secblob);
1221 data_blob_free(&chal);
1222 data_blob_free(&response);
1223
1224 p->auth.a_u.auth_ntlmssp_state = NULL;
1225
1226 return False;
1227 }
1228
1229 /*******************************************************************
1230 Handle the second part of a SPNEGO bind auth.
1231 *******************************************************************/
1232
1233 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1234 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1235 {
1236 RPC_HDR_AUTH auth_info;
1237 DATA_BLOB spnego_blob;
1238 DATA_BLOB auth_blob;
1239 DATA_BLOB auth_reply;
1240 DATA_BLOB response;
1241 AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1242
1243 ZERO_STRUCT(spnego_blob);
1244 ZERO_STRUCT(auth_blob);
1245 ZERO_STRUCT(auth_reply);
1246 ZERO_STRUCT(response);
1247
1248 /*
1249 * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1250 * fail here as 'a' == NULL.
1251 */
1252 if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1253 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1254 goto err;
1255 }
1256
1257 /* Grab the SPNEGO blob. */
1258 spnego_blob = data_blob(NULL,p->hdr.auth_len);
1259
1260 if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1261 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1262 (unsigned int)p->hdr.auth_len ));
1263 goto err;
1264 }
1265
1266 if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1267 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1268 goto err;
1269 }
1270
1271 if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1272 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1273 goto err;
1274 }
1275
1276 /*
1277 * The following call actually checks the challenge/response data.
1278 * for correctness against the given DOMAIN\user name.
1279 */
1280
1281 if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1282 goto err;
1283 }
1284
1285 data_blob_free(&spnego_blob);
1286 data_blob_free(&auth_blob);
1287
1288 /* Generate the spnego "accept completed" blob - no incoming data. */
1289 response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1290
1291 /* Copy the blob into the pout_auth parse struct */
1292 init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1293 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1294 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1295 goto err;
1296 }
1297
1298 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1299 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1300 goto err;
1301 }
1302
1303 data_blob_free(&auth_reply);
1304 data_blob_free(&response);
1305
1306 p->pipe_bound = True;
1307
1308 return True;
1309
1310 err:
1311
1312 data_blob_free(&spnego_blob);
1313 data_blob_free(&auth_blob);
1314 data_blob_free(&auth_reply);
1315 data_blob_free(&response);
1316
1317 free_pipe_ntlmssp_auth_data(&p->auth);
1318 p->auth.a_u.auth_ntlmssp_state = NULL;
1319
1320 return False;
1321 }
1322
1323 /*******************************************************************
1324 Handle an schannel bind auth.
1325 *******************************************************************/
1326
1327 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1328 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1329 {
1330 RPC_HDR_AUTH auth_info;
1331 RPC_AUTH_SCHANNEL_NEG neg;
1332 RPC_AUTH_VERIFIER auth_verifier;
1333 bool ret;
1334 struct dcinfo *pdcinfo;
1335 uint32 flags;
1336 DATA_BLOB session_key;
1337
1338 if (!smb_io_rpc_auth_schannel_neg("", &neg, rpc_in_p, 0)) {
1339 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1340 return False;
1341 }
1342
1343 /*
1344 * The neg.myname key here must match the remote computer name
1345 * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1346 * operations that use credentials.
1347 */
1348
1349 become_root();
1350 ret = secrets_restore_schannel_session_info(p->mem_ctx, neg.myname, &pdcinfo);
1351 unbecome_root();
1352
1353 if (!ret) {
1354 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1355 return False;
1356 }
1357
1358 p->auth.a_u.schannel_auth = talloc(p, struct schannel_auth_struct);
1359 if (!p->auth.a_u.schannel_auth) {
1360 TALLOC_FREE(pdcinfo);
1361 return False;
1362 }
1363
1364 memset(p->auth.a_u.schannel_auth->sess_key, 0, sizeof(p->auth.a_u.schannel_auth->sess_key));
1365 memcpy(p->auth.a_u.schannel_auth->sess_key, pdcinfo->sess_key,
1366 sizeof(pdcinfo->sess_key));
1367
1368 TALLOC_FREE(pdcinfo);
1369
1370 p->auth.a_u.schannel_auth->seq_num = 0;
1371
1372 /*
1373 * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1374 * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1375 * struct of the person who opened the pipe. I need to test this further. JRA.
1376 *
1377 * VL. As we are mapping this to guest set the generic key
1378 * "SystemLibraryDTC" key here. It's a bit difficult to test against
1379 * W2k3, as it does not allow schannel binds against SAMR and LSA
1380 * anymore.
1381 */
1382
1383 session_key = generic_session_key();
1384 if (session_key.data == NULL) {
1385 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1386 " key\n"));
1387 return false;
1388 }
1389
1390 ret = server_info_set_session_key(p->server_info, session_key);
1391
1392 data_blob_free(&session_key);
1393
1394 if (!ret) {
1395 DEBUG(0, ("server_info_set_session_key failed\n"));
1396 return false;
1397 }
1398
1399 init_rpc_hdr_auth(&auth_info, RPC_SCHANNEL_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1400 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1401 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1402 return False;
1403 }
1404
1405 /*** SCHANNEL verifier ***/
1406
1407 init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1408 if(!smb_io_rpc_schannel_verifier("", &auth_verifier, pout_auth, 0)) {
1409 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1410 return False;
1411 }
1412
1413 prs_align(pout_auth);
1414
1415 flags = 5;
1416 if(!prs_uint32("flags ", pout_auth, 0, &flags)) {
1417 return False;
1418 }
1419
1420 DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1421 neg.domain, neg.myname));
1422
1423 /* We're finished with this bind - no more packets. */
1424 p->auth.auth_data_free_func = NULL;
1425 p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1426
1427 p->pipe_bound = True;
1428
1429 return True;
1430 }
1431
1432 /*******************************************************************
1433 Handle an NTLMSSP bind auth.
1434 *******************************************************************/
1435
1436 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1437 RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1438 {
1439 RPC_HDR_AUTH auth_info;
1440 DATA_BLOB blob;
1441 DATA_BLOB response;
1442 NTSTATUS status;
1443 AUTH_NTLMSSP_STATE *a = NULL;
1444
1445 ZERO_STRUCT(blob);
1446 ZERO_STRUCT(response);
1447
1448 /* Grab the NTLMSSP blob. */
1449 blob = data_blob(NULL,p->hdr.auth_len);
1450
1451 if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1452 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1453 (unsigned int)p->hdr.auth_len ));
1454 goto err;
1455 }
1456
1457 if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1458 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1459 goto err;
1460 }
1461
1462 /* We have an NTLMSSP blob. */
1463 status = auth_ntlmssp_start(&a);
1464 if (!NT_STATUS_IS_OK(status)) {
1465 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1466 nt_errstr(status) ));
1467 goto err;
1468 }
1469
1470 status = auth_ntlmssp_update(a, blob, &response);
1471 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1472 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1473 nt_errstr(status) ));
1474 goto err;
1475 }
1476
1477 data_blob_free(&blob);
1478
1479 /* Copy the blob into the pout_auth parse struct */
1480 init_rpc_hdr_auth(&auth_info, RPC_NTLMSSP_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1481 if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1482 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1483 goto err;
1484 }
1485
1486 if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1487 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1488 goto err;
1489 }
1490
1491 p->auth.a_u.auth_ntlmssp_state = a;
1492 p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1493 p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1494
1495 data_blob_free(&blob);
1496 data_blob_free(&response);
1497
1498 DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1499
1500 /* We can't set pipe_bound True yet - we need an RPC_AUTH3 response packet... */
1501 return True;
1502
1503 err:
1504
1505 data_blob_free(&blob);
1506 data_blob_free(&response);
1507
1508 free_pipe_ntlmssp_auth_data(&p->auth);
1509 p->auth.a_u.auth_ntlmssp_state = NULL;
1510 return False;
1511 }
1512
1513 /*******************************************************************
1514 Respond to a pipe bind request.
1515 *******************************************************************/
1516
1517 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1518 {
1519 RPC_HDR_BA hdr_ba;
1520 RPC_HDR_RB hdr_rb;
1521 RPC_HDR_AUTH auth_info;
1522 uint16 assoc_gid;
1523 fstring ack_pipe_name;
1524 prs_struct out_hdr_ba;
1525 prs_struct out_auth;
1526 prs_struct outgoing_rpc;
1527 int i = 0;
1528 int auth_len = 0;
1529 unsigned int auth_type = RPC_ANONYMOUS_AUTH_TYPE;
1530
1531 /* No rebinds on a bound pipe - use alter context. */
1532 if (p->pipe_bound) {
1533 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound pipe %s.\n", p->pipe_srv_name));
1534 return setup_bind_nak(p);
1535 }
1536
1537 prs_init_empty( &outgoing_rpc, p->mem_ctx, MARSHALL);
1538
1539 /*
1540 * Marshall directly into the outgoing PDU space. We
1541 * must do this as we need to set to the bind response
1542 * header and are never sending more than one PDU here.
1543 */
1544
1545 prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1546
1547 /*
1548 * Setup the memory to marshall the ba header, and the
1549 * auth footers.
1550 */
1551
1552 if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1553 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1554 prs_mem_free(&outgoing_rpc);
1555 return False;
1556 }
1557
1558 if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1559 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1560 prs_mem_free(&outgoing_rpc);
1561 prs_mem_free(&out_hdr_ba);
1562 return False;
1563 }
1564
1565 DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1566
1567 ZERO_STRUCT(hdr_rb);
1568
1569 /* decode the bind request */
1570
1571 if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0)) {
1572 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB "
1573 "struct.\n"));
1574 goto err_exit;
1575 }
1576
1577 if (hdr_rb.num_contexts == 0) {
1578 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1579 goto err_exit;
1580 }
1581
1582 /*
1583 * Try and find the correct pipe name to ensure
1584 * that this is a pipe name we support.
1585 */
1586
1587 for (i = 0; i < rpc_lookup_size; i++) {
1588 if (ndr_syntax_id_equal(&rpc_lookup[i].rpc_interface,
1589 &hdr_rb.rpc_context[0].abstract)) {
1590 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1591 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1592 fstrcpy(p->name, rpc_lookup[i].pipe.clnt);
1593 fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1594 break;
1595 }
1596 }
1597
1598 if (i == rpc_lookup_size) {
1599 if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) {
1600 DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1601 p->name ));
1602 prs_mem_free(&outgoing_rpc);
1603 prs_mem_free(&out_hdr_ba);
1604 prs_mem_free(&out_auth);
1605
1606 return setup_bind_nak(p);
1607 }
1608
1609 for (i = 0; i < rpc_lookup_size; i++) {
1610 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1611 DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1612 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1613 fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1614 break;
1615 }
1616 }
1617
1618 if (i == rpc_lookup_size) {
1619 DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
1620 goto err_exit;
1621 }
1622 }
1623
1624 /* name has to be \PIPE\xxxxx */
1625 fstrcpy(ack_pipe_name, "\\PIPE\\");
1626 fstrcat(ack_pipe_name, p->pipe_srv_name);
1627
1628 DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1629
1630 /*
1631 * Check if this is an authenticated bind request.
1632 */
1633
1634 if (p->hdr.auth_len) {
1635 /*
1636 * Decode the authentication verifier.
1637 */
1638
1639 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1640 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1641 goto err_exit;
1642 }
1643
1644 auth_type = auth_info.auth_type;
1645
1646 /* Work out if we have to sign or seal etc. */
1647 switch (auth_info.auth_level) {
1648 case RPC_AUTH_LEVEL_INTEGRITY:
1649 p->auth.auth_level = PIPE_AUTH_LEVEL_INTEGRITY;
1650 break;
1651 case RPC_AUTH_LEVEL_PRIVACY:
1652 p->auth.auth_level = PIPE_AUTH_LEVEL_PRIVACY;
1653 break;
1654 default:
1655 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1656 (unsigned int)auth_info.auth_level ));
1657 goto err_exit;
1658 }
1659 } else {
1660 ZERO_STRUCT(auth_info);
1661 }
1662
1663 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1664
1665 switch(auth_type) {
1666 case RPC_NTLMSSP_AUTH_TYPE:
1667 if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1668 goto err_exit;
1669 }
1670 assoc_gid = 0x7a77;
1671 break;
1672
1673 case RPC_SCHANNEL_AUTH_TYPE:
1674 if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1675 goto err_exit;
1676 }
1677 break;
1678
1679 case RPC_SPNEGO_AUTH_TYPE:
1680 if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1681 goto err_exit;
1682 }
1683 break;
1684
1685 case RPC_ANONYMOUS_AUTH_TYPE:
1686 /* Unauthenticated bind request. */
1687 /* We're finished - no more packets. */
1688 p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1689 /* We must set the pipe auth_level here also. */
1690 p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
1691 p->pipe_bound = True;
1692 /* The session key was initialized from the SMB
1693 * session in make_internal_rpc_pipe_p */
1694 break;
1695
1696 default:
1697 DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1698 goto err_exit;
1699 }
1700
1701 /*
1702 * Create the bind response struct.
1703 */
1704
1705 /* If the requested abstract synt uuid doesn't match our client pipe,
1706 reject the bind_ack & set the transfer interface synt to all 0's,
1707 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1708 unknown to NT4)
1709 Needed when adding entries to a DACL from NT5 - SK */
1710
1711 if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1712 hdr_rb.rpc_context[0].context_id )) {
1713 init_rpc_hdr_ba(&hdr_ba,
1714 RPC_MAX_PDU_FRAG_LEN,
1715 RPC_MAX_PDU_FRAG_LEN,
1716 assoc_gid,
1717 ack_pipe_name,
1718 0x1, 0x0, 0x0,
1719 &hdr_rb.rpc_context[0].transfer[0]);
1720 } else {
1721 RPC_IFACE null_interface;
1722 ZERO_STRUCT(null_interface);
1723 /* Rejection reason: abstract syntax not supported */
1724 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1725 RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1726 ack_pipe_name, 0x1, 0x2, 0x1,
1727 &null_interface);
1728 p->pipe_bound = False;
1729 }
1730
1731 /*
1732 * and marshall it.
1733 */
1734
1735 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1736 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1737 goto err_exit;
1738 }
1739
1740 /*
1741 * Create the header, now we know the length.
1742 */
1743
1744 if (prs_offset(&out_auth)) {
1745 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1746 }
1747
1748 init_rpc_hdr(&p->hdr, RPC_BINDACK, RPC_FLG_FIRST | RPC_FLG_LAST,
1749 p->hdr.call_id,
1750 RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1751 auth_len);
1752
1753 /*
1754 * Marshall the header into the outgoing PDU.
1755 */
1756
1757 if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1758 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1759 goto err_exit;
1760 }
1761
1762 /*
1763 * Now add the RPC_HDR_BA and any auth needed.
1764 */
1765
1766 if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1767 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1768 goto err_exit;
1769 }
1770
1771 if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1772 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1773 goto err_exit;
1774 }
1775
1776 /*
1777 * Setup the lengths for the initial reply.
1778 */
1779
1780 p->out_data.data_sent_length = 0;
1781 p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1782 p->out_data.current_pdu_sent = 0;
1783
1784 prs_mem_free(&out_hdr_ba);
1785 prs_mem_free(&out_auth);
1786
1787 return True;
1788
1789 err_exit:
1790
1791 prs_mem_free(&outgoing_rpc);
1792 prs_mem_free(&out_hdr_ba);
1793 prs_mem_free(&out_auth);
1794 return setup_bind_nak(p);
1795 }
1796
1797 /****************************************************************************
1798 Deal with an alter context call. Can be third part of 3 leg auth request for
1799 SPNEGO calls.
1800 ****************************************************************************/
1801
1802 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1803 {
1804 RPC_HDR_BA hdr_ba;
1805 RPC_HDR_RB hdr_rb;
1806 RPC_HDR_AUTH auth_info;
1807 uint16 assoc_gid;
1808 fstring ack_pipe_name;
1809 prs_struct out_hdr_ba;
1810 prs_struct out_auth;
1811 prs_struct outgoing_rpc;
1812 int auth_len = 0;
1813
1814 prs_init_empty( &outgoing_rpc, p->mem_ctx, MARSHALL);
1815
1816 /*
1817 * Marshall directly into the outgoing PDU space. We
1818 * must do this as we need to set to the bind response
1819 * header and are never sending more than one PDU here.
1820 */
1821
1822 prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1823
1824 /*
1825 * Setup the memory to marshall the ba header, and the
1826 * auth footers.
1827 */
1828
1829 if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1830 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1831 prs_mem_free(&outgoing_rpc);
1832 return False;
1833 }
1834
1835 if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1836 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1837 prs_mem_free(&outgoing_rpc);
1838 prs_mem_free(&out_hdr_ba);
1839 return False;
1840 }
1841
1842 ZERO_STRUCT(hdr_rb);
1843
1844 DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1845
1846 /* decode the alter context request */
1847 if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0)) {
1848 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1849 goto err_exit;
1850 }
1851
1852 /* secondary address CAN be NULL
1853 * as the specs say it's ignored.
1854 * It MUST be NULL to have the spoolss working.
1855 */
1856 fstrcpy(ack_pipe_name,"");
1857
1858 DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1859
1860 /*
1861 * Check if this is an authenticated alter context request.
1862 */
1863
1864 if (p->hdr.auth_len != 0) {
1865 /*
1866 * Decode the authentication verifier.
1867 */
1868
1869 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1870 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1871 goto err_exit;
1872 }
1873
1874 /*
1875 * Currently only the SPNEGO auth type uses the alter ctx
1876 * response in place of the NTLMSSP auth3 type.
1877 */
1878
1879 if (auth_info.auth_type == RPC_SPNEGO_AUTH_TYPE) {
1880 /* We can only finish if the pipe is unbound. */
1881 if (!p->pipe_bound) {
1882 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1883 goto err_exit;
1884 }
1885 } else {
1886 goto err_exit;
1887 }
1888 }
1889 } else {
1890 ZERO_STRUCT(auth_info);
1891 }
1892
1893 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1894
1895 /*
1896 * Create the bind response struct.
1897 */
1898
1899 /* If the requested abstract synt uuid doesn't match our client pipe,
1900 reject the bind_ack & set the transfer interface synt to all 0's,
1901 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1902 unknown to NT4)
1903 Needed when adding entries to a DACL from NT5 - SK */
1904
1905 if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1906 hdr_rb.rpc_context[0].context_id )) {
1907 init_rpc_hdr_ba(&hdr_ba,
1908 RPC_MAX_PDU_FRAG_LEN,
1909 RPC_MAX_PDU_FRAG_LEN,
1910 assoc_gid,
1911 ack_pipe_name,
1912 0x1, 0x0, 0x0,
1913 &hdr_rb.rpc_context[0].transfer[0]);
1914 } else {
1915 RPC_IFACE null_interface;
1916 ZERO_STRUCT(null_interface);
1917 /* Rejection reason: abstract syntax not supported */
1918 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1919 RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1920 ack_pipe_name, 0x1, 0x2, 0x1,
1921 &null_interface);
1922 p->pipe_bound = False;
1923 }
1924
1925 /*
1926 * and marshall it.
1927 */
1928
1929 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1930 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1931 goto err_exit;
1932 }
1933
1934 /*
1935 * Create the header, now we know the length.
1936 */
1937
1938 if (prs_offset(&out_auth)) {
1939 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1940 }
1941
1942 init_rpc_hdr(&p->hdr, RPC_ALTCONTRESP, RPC_FLG_FIRST | RPC_FLG_LAST,
1943 p->hdr.call_id,
1944 RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1945 auth_len);
1946
1947 /*
1948 * Marshall the header into the outgoing PDU.
1949 */
1950
1951 if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1952 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
1953 goto err_exit;
1954 }
1955
1956 /*
1957 * Now add the RPC_HDR_BA and any auth needed.
1958 */
1959
1960 if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1961 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
1962 goto err_exit;
1963 }
1964
1965 if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1966 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
1967 goto err_exit;
1968 }
1969
1970 /*
1971 * Setup the lengths for the initial reply.
1972 */
1973
1974 p->out_data.data_sent_length = 0;
1975 p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1976 p->out_data.current_pdu_sent = 0;
1977
1978 prs_mem_free(&out_hdr_ba);
1979 prs_mem_free(&out_auth);
1980
1981 return True;
1982
1983 err_exit:
1984
1985 prs_mem_free(&outgoing_rpc);
1986 prs_mem_free(&out_hdr_ba);
1987 prs_mem_free(&out_auth);
1988 return setup_bind_nak(p);
1989 }
1990
1991 /****************************************************************************
1992 Deal with NTLMSSP sign & seal processing on an RPC request.
1993 ****************************************************************************/
1994
1995 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
1996 uint32 *p_ss_padding_len, NTSTATUS *pstatus)
1997 {
1998 RPC_HDR_AUTH auth_info;
1999 uint32 auth_len = p->hdr.auth_len;
2000 uint32 save_offset = prs_offset(rpc_in);
2001 AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
2002 unsigned char *data = NULL;
2003 size_t data_len;
2004 unsigned char *full_packet_data = NULL;
2005 size_t full_packet_data_len;
2006 DATA_BLOB auth_blob;
2007
2008 *pstatus = NT_STATUS_OK;
2009
2010 if (p->auth.auth_level == PIPE_AUTH_LEVEL_NONE || p->auth.auth_level == PIPE_AUTH_LEVEL_CONNECT) {
2011 return True;
2012 }
2013
2014 if (!a) {
2015 *pstatus = NT_STATUS_INVALID_PARAMETER;
2016 return False;
2017 }
2018
2019 /* Ensure there's enough data for an authenticated request. */
2020 if ((auth_len > RPC_MAX_SIGN_SIZE) ||
2021 (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
2022 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2023 (unsigned int)auth_len ));
2024 *pstatus = NT_STATUS_INVALID_PARAMETER;
2025 return False;
2026 }
2027
2028 /*
2029 * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2030 * after the RPC header.
2031 * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2032 * functions as NTLMv2 checks the rpc headers also.
2033 */
2034
2035 data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2036 data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2037
2038 full_packet_data = p->in_data.current_in_pdu;
2039 full_packet_data_len = p->hdr.frag_len - auth_len;
2040
2041 /* Pull the auth header and the following data into a blob. */
2042 if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2043 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
2044 (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
2045 *pstatus = NT_STATUS_INVALID_PARAMETER;
2046 return False;
2047 }
2048
2049 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2050 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
2051 *pstatus = NT_STATUS_INVALID_PARAMETER;
2052 return False;
2053 }
2054
2055 auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2056 auth_blob.length = auth_len;
2057
2058 switch (p->auth.auth_level) {
2059 case PIPE_AUTH_LEVEL_PRIVACY:
2060 /* Data is encrypted. */
2061 *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
2062 data, data_len,
2063 full_packet_data,
2064 full_packet_data_len,
2065 &auth_blob);
2066 if (!NT_STATUS_IS_OK(*pstatus)) {
2067 return False;
2068 }
2069 break;
2070 case PIPE_AUTH_LEVEL_INTEGRITY:
2071 /* Data is signed. */
2072 *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
2073 data, data_len,
2074 full_packet_data,
2075 full_packet_data_len,
2076 &auth_blob);
2077 if (!NT_STATUS_IS_OK(*pstatus)) {
2078 return False;
2079 }
2080 break;
2081 default:
2082 *pstatus = NT_STATUS_INVALID_PARAMETER;
2083 return False;
2084 }
2085
2086 /*
2087 * Return the current pointer to the data offset.
2088 */
2089
2090 if(!prs_set_offset(rpc_in, save_offset)) {
2091 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2092 (unsigned int)save_offset ));
2093 *pstatus = NT_STATUS_INVALID_PARAMETER;
2094 return False;
2095 }
2096
2097 /*
2098 * Remember the padding length. We must remove it from the real data
2099 * stream once the sign/seal is done.
2100 */
2101
2102 *p_ss_padding_len = auth_info.auth_pad_len;
2103
2104 return True;
2105 }
2106
2107 /****************************************************************************
2108 Deal with schannel processing on an RPC request.
2109 ****************************************************************************/
2110
2111 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2112 {
2113 uint32 data_len;
2114 uint32 auth_len;
2115 uint32 save_offset = prs_offset(rpc_in);
2116 RPC_HDR_AUTH auth_info;
2117 RPC_AUTH_SCHANNEL_CHK schannel_chk;
2118
2119 auth_len = p->hdr.auth_len;
2120
2121 if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
2122 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2123 return False;
2124 }
2125
2126 /*
2127 * The following is that length of the data we must verify or unseal.
2128 * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2129 * preceeding the auth_data.
2130 */
2131
2132 if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2133 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2134 (unsigned int)p->hdr.frag_len,
2135 (unsigned int)auth_len ));
2136 return False;
2137 }
2138
2139 data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2140 RPC_HDR_AUTH_LEN - auth_len;
2141
2142 DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2143
2144 if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2145 DEBUG(0,("cannot move offset to %u.\n",
2146 (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2147 return False;
2148 }
2149
2150 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2151 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2152 return False;
2153 }
2154
2155 if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
2156 DEBUG(0,("Invalid auth info %d on schannel\n",
2157 auth_info.auth_type));
2158 return False;
2159 }
2160
2161 if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN, &schannel_chk, rpc_in, 0)) {
2162 DEBUG(0,("failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
2163 return False;
2164 }
2165
2166 if (!schannel_decode(p->auth.a_u.schannel_auth,
2167 p->auth.auth_level,
2168 SENDER_IS_INITIATOR,
2169 &schannel_chk,
2170 prs_data_p(rpc_in)+RPC_HDR_REQ_LEN, data_len)) {
2171 DEBUG(3,("failed to decode PDU\n"));
2172 return False;
2173 }
2174
2175 /*
2176 * Return the current pointer to the data offset.
2177 */
2178
2179 if(!prs_set_offset(rpc_in, save_offset)) {
2180 DEBUG(0,("failed to set offset back to %u\n",
2181 (unsigned int)save_offset ));
2182 return False;
2183 }
2184
2185 /* The sequence number gets incremented on both send and receive. */
2186 p->auth.a_u.schannel_auth->seq_num++;
2187
2188 /*
2189 * Remember the padding length. We must remove it from the real data
2190 * stream once the sign/seal is done.
2191 */
2192
2193 *p_ss_padding_len = auth_info.auth_pad_len;
2194
2195 return True;
2196 }
2197
2198 /****************************************************************************
2199 Find the set of RPC functions associated with this context_id
2200 ****************************************************************************/
2201
2202 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2203 {
2204 PIPE_RPC_FNS *fns = NULL;
2205
2206 if ( !list ) {
2207 DEBUG(0,("find_pipe_fns_by_context: ERROR! No context list for pipe!\n"));
2208 return NULL;
2209 }
2210
2211 for (fns=list; fns; fns=fns->next ) {
2212 if ( fns->context_id == context_id )
2213 return fns;
2214 }
2215 return NULL;
2216 }
2217
2218 /****************************************************************************
2219 Memory cleanup.
2220 ****************************************************************************/
2221
2222 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2223 {
2224 PIPE_RPC_FNS *tmp = list;
2225 PIPE_RPC_FNS *tmp2;
2226
2227 while (tmp) {
2228 tmp2 = tmp->next;
2229 SAFE_FREE(tmp);
2230 tmp = tmp2;
2231 }
2232
2233 return;
2234 }
2235
2236 static bool api_rpcTNP(pipes_struct *p, const char *rpc_name,
2237 const struct api_struct *api_rpc_cmds, int n_cmds);
2238
2239 /****************************************************************************
2240 Find the correct RPC function to call for this request.
2241 If the pipe is authenticated then become the correct UNIX user
2242 before doing the call.
2243 ****************************************************************************/
2244
2245 bool api_pipe_request(pipes_struct *p)
2246 {
2247 bool ret = False;
2248 bool changed_user = False;
2249 PIPE_RPC_FNS *pipe_fns;
2250
2251 if (p->pipe_bound &&
2252 ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2253 (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2254 if(!become_authenticated_pipe_user(p)) {
2255 prs_mem_free(&p->out_data.rdata);
2256 return False;
2257 }
2258 changed_user = True;
2259 }
2260
2261 DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
2262
2263 /* get the set of RPC functions for this context */
2264
2265 pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2266
2267 if ( pipe_fns ) {
2268 TALLOC_CTX *frame = talloc_stackframe();
2269 ret = api_rpcTNP(p, p->name, pipe_fns->cmds, pipe_fns->n_cmds);
2270 TALLOC_FREE(frame);
2271 }
2272 else {
2273 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2274 p->hdr_req.context_id, p->name));
2275 }
2276
2277 if (changed_user) {
2278 unbecome_authenticated_pipe_user();
2279 }
2280
2281 return ret;
2282 }
2283
2284 /*******************************************************************
2285 Calls the underlying RPC function for a named pipe.
2286 ********************************************************************/
2287
2288 static bool api_rpcTNP(pipes_struct *p, const char *rpc_name,
2289 const struct api_struct *api_rpc_cmds, int n_cmds)
2290 {
2291 int fn_num;
2292 fstring name;
2293 uint32 offset1, offset2;
2294
2295 /* interpret the command */
2296 DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
2297
2298 slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
2299 prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2300
2301 for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2302 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2303 DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2304 break;
2305 }
2306 }
2307
2308 if (fn_num == n_cmds) {
2309 /*
2310 * For an unknown RPC just return a fault PDU but
2311 * return True to allow RPC's on the pipe to continue
2312 * and not put the pipe into fault state. JRA.
2313 */
2314 DEBUG(4, ("unknown\n"));
2315 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2316 return True;
2317 }
2318
2319 offset1 = prs_offset(&p->out_data.rdata);
2320
2321 DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2322 fn_num, api_rpc_cmds[fn_num].fn));
2323 /* do the actual command */
2324 if(!api_rpc_cmds[fn_num].fn(p)) {
2325 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
2326 prs_mem_free(&p->out_data.rdata);
2327 return False;
2328 }
2329
2330 if (p->bad_handle_fault_state) {
2331 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2332 p->bad_handle_fault_state = False;
2333 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2334 return True;
2335 }
2336
2337 if (p->rng_fault_state) {
2338 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2339 p->rng_fault_state = False;
2340 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2341 return True;
2342 }
2343
2344 slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
2345 offset2 = prs_offset(&p->out_data.rdata);
2346 prs_set_offset(&p->out_data.rdata, offset1);
2347 prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2348 prs_set_offset(&p->out_data.rdata, offset2);
2349
2350 DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
2351
2352 /* Check for buffer underflow in rpc parsing */
2353
2354 if ((DEBUGLEVEL >= 10) &&
2355 (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2356 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2357 char *data = (char *)SMB_MALLOC(data_len);
2358
2359 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2360 if (data) {
2361 prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2362 SAFE_FREE(data);
2363 }
2364
2365 }
2366
2367 return True;
2368 }