source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31
  32 extern struct pipe_id_info pipe_names[];
  33 extern struct current_user current_user;
  34
  35 #undef DBGC_CLASS
  36 #define DBGC_CLASS DBGC_RPC_SRV
  37
  38 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  39 {
  40         AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
  41
  42         if (a) {
  43                 auth_ntlmssp_end(&a);
  44         }
  45         auth->a_u.auth_ntlmssp_state = NULL;
  46 }
  47
  48 static DATA_BLOB generic_session_key(void)
  49 {
  50         return data_blob("SystemLibraryDTC", 16);
  51 }
  52
  53 /*******************************************************************
  54  Generate the next PDU to be returned from the data in p->rdata.
  55  Handle NTLMSSP.
  56  ********************************************************************/
  57
  58 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  59 {
  60         RPC_HDR_RESP hdr_resp;
  61         uint32 ss_padding_len = 0;
  62         uint32 data_space_available;
  63         uint32 data_len_left;
  64         uint32 data_len;
  65         prs_struct outgoing_pdu;
  66         NTSTATUS status;
  67         DATA_BLOB auth_blob;
  68         RPC_HDR_AUTH auth_info;
  69         uint8 auth_type, auth_level;
  70         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
  71
  72         /*
  73          * If we're in the fault state, keep returning fault PDU's until
  74          * the pipe gets closed. JRA.
  75          */
  76
  77         if(p->fault_state) {
  78                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  79                 return True;
  80         }
  81
  82         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  83
  84         /* Change the incoming request header to a response. */
  85         p->hdr.pkt_type = RPC_RESPONSE;
  86
  87         /* Set up rpc header flags. */
  88         if (p->out_data.data_sent_length == 0) {
  89                 p->hdr.flags = RPC_FLG_FIRST;
  90         } else {
  91                 p->hdr.flags = 0;
  92         }
  93
  94         /*
  95          * Work out how much we can fit in a single PDU.
  96          */
  97
  98         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
  99
 100         /*
 101          * Ensure there really is data left to send.
 102          */
 103
 104         if(!data_len_left) {
 105                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 106                 return False;
 107         }
 108
 109         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 110                                         RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 111
 112         /*
 113          * The amount we send is the minimum of the available
 114          * space and the amount left to send.
 115          */
 116
 117         data_len = MIN(data_len_left, data_space_available);
 118
 119         /*
 120          * Set up the alloc hint. This should be the data left to
 121          * send.
 122          */
 123
 124         hdr_resp.alloc_hint = data_len_left;
 125
 126         /*
 127          * Work out if this PDU will be the last.
 128          */
 129
 130         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 131                 p->hdr.flags |= RPC_FLG_LAST;
 132                 if (data_len_left % 8) {
 133                         ss_padding_len = 8 - (data_len_left % 8);
 134                         DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 135                                 ss_padding_len ));
 136                 }
 137         }
 138
 139         /*
 140          * Set up the header lengths.
 141          */
 142
 143         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 144                         data_len + ss_padding_len +
 145                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 146         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 147
 148
 149         /*
 150          * Init the parse struct to point at the outgoing
 151          * data.
 152          */
 153
 154         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 155         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 156
 157         /* Store the header in the data stream. */
 158         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 159                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 160                 prs_mem_free(&outgoing_pdu);
 161                 return False;
 162         }
 163
 164         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 165                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 166                 prs_mem_free(&outgoing_pdu);
 167                 return False;
 168         }
 169
 170         /* Copy the data into the PDU. */
 171
 172         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 173                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 174                 prs_mem_free(&outgoing_pdu);
 175                 return False;
 176         }
 177
 178         /* Copy the sign/seal padding data. */
 179         if (ss_padding_len) {
 180                 char pad[8];
 181
 182                 memset(pad, '\0', 8);
 183                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 184                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 185                                         (unsigned int)ss_padding_len));
 186                         prs_mem_free(&outgoing_pdu);
 187                         return False;
 188                 }
 189         }
 190
 191
 192         /* Now write out the auth header and null blob. */
 193         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 194                 auth_type = RPC_NTLMSSP_AUTH_TYPE;
 195         } else {
 196                 auth_type = RPC_SPNEGO_AUTH_TYPE;
 197         }
 198         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 199                 auth_level = RPC_AUTH_LEVEL_PRIVACY;
 200         } else {
 201                 auth_level = RPC_AUTH_LEVEL_INTEGRITY;
 202         }
 203
 204         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 205         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 206                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 207                 prs_mem_free(&outgoing_pdu);
 208                 return False;
 209         }
 210
 211         /* Generate the sign blob. */
 212
 213         switch (p->auth.auth_level) {
 214                 case PIPE_AUTH_LEVEL_PRIVACY:
 215                         /* Data portion is encrypted. */
 216                         status = ntlmssp_seal_packet(a->ntlmssp_state,
 217                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 218                                                         data_len + ss_padding_len,
 219                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 220                                                         (size_t)prs_offset(&outgoing_pdu),
 221                                                         &auth_blob);
 222                         if (!NT_STATUS_IS_OK(status)) {
 223                                 data_blob_free(&auth_blob);
 224                                 prs_mem_free(&outgoing_pdu);
 225                                 return False;
 226                         }
 227                         break;
 228                 case PIPE_AUTH_LEVEL_INTEGRITY:
 229                         /* Data is signed. */
 230                         status = ntlmssp_sign_packet(a->ntlmssp_state,
 231                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 232                                                         data_len + ss_padding_len,
 233                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 234                                                         (size_t)prs_offset(&outgoing_pdu),
 235                                                         &auth_blob);
 236                         if (!NT_STATUS_IS_OK(status)) {
 237                                 data_blob_free(&auth_blob);
 238                                 prs_mem_free(&outgoing_pdu);
 239                                 return False;
 240                         }
 241                         break;
 242                 default:
 243                         prs_mem_free(&outgoing_pdu);
 244                         return False;
 245         }
 246
 247         /* Append the auth blob. */
 248         if (!prs_copy_data_in(&outgoing_pdu, (char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
 249                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 250                                 (unsigned int)NTLMSSP_SIG_SIZE));
 251                 data_blob_free(&auth_blob);
 252                 prs_mem_free(&outgoing_pdu);
 253                 return False;
 254         }
 255
 256         data_blob_free(&auth_blob);
 257
 258         /*
 259          * Setup the counts for this PDU.
 260          */
 261
 262         p->out_data.data_sent_length += data_len;
 263         p->out_data.current_pdu_len = p->hdr.frag_len;
 264         p->out_data.current_pdu_sent = 0;
 265
 266         prs_mem_free(&outgoing_pdu);
 267         return True;
 268 }
 269
 270 /*******************************************************************
 271  Generate the next PDU to be returned from the data in p->rdata.
 272  Return an schannel authenticated fragment.
 273  ********************************************************************/
 274
 275 static bool create_next_pdu_schannel(pipes_struct *p)
 276 {
 277         RPC_HDR_RESP hdr_resp;
 278         uint32 ss_padding_len = 0;
 279         uint32 data_len;
 280         uint32 data_space_available;
 281         uint32 data_len_left;
 282         prs_struct outgoing_pdu;
 283         uint32 data_pos;
 284
 285         /*
 286          * If we're in the fault state, keep returning fault PDU's until
 287          * the pipe gets closed. JRA.
 288          */
 289
 290         if(p->fault_state) {
 291                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 292                 return True;
 293         }
 294
 295         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 296
 297         /* Change the incoming request header to a response. */
 298         p->hdr.pkt_type = RPC_RESPONSE;
 299
 300         /* Set up rpc header flags. */
 301         if (p->out_data.data_sent_length == 0) {
 302                 p->hdr.flags = RPC_FLG_FIRST;
 303         } else {
 304                 p->hdr.flags = 0;
 305         }
 306
 307         /*
 308          * Work out how much we can fit in a single PDU.
 309          */
 310
 311         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 312
 313         /*
 314          * Ensure there really is data left to send.
 315          */
 316
 317         if(!data_len_left) {
 318                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 319                 return False;
 320         }
 321
 322         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 323                                         RPC_HDR_AUTH_LEN - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 324
 325         /*
 326          * The amount we send is the minimum of the available
 327          * space and the amount left to send.
 328          */
 329
 330         data_len = MIN(data_len_left, data_space_available);
 331
 332         /*
 333          * Set up the alloc hint. This should be the data left to
 334          * send.
 335          */
 336
 337         hdr_resp.alloc_hint = data_len_left;
 338
 339         /*
 340          * Work out if this PDU will be the last.
 341          */
 342
 343         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 344                 p->hdr.flags |= RPC_FLG_LAST;
 345                 if (data_len_left % 8) {
 346                         ss_padding_len = 8 - (data_len_left % 8);
 347                         DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 348                                 ss_padding_len ));
 349                 }
 350         }
 351
 352         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 353                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 354         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 355
 356         /*
 357          * Init the parse struct to point at the outgoing
 358          * data.
 359          */
 360
 361         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 362         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 363
 364         /* Store the header in the data stream. */
 365         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 366                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 367                 prs_mem_free(&outgoing_pdu);
 368                 return False;
 369         }
 370
 371         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 372                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 373                 prs_mem_free(&outgoing_pdu);
 374                 return False;
 375         }
 376
 377         /* Store the current offset. */
 378         data_pos = prs_offset(&outgoing_pdu);
 379
 380         /* Copy the data into the PDU. */
 381
 382         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 383                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 384                 prs_mem_free(&outgoing_pdu);
 385                 return False;
 386         }
 387
 388         /* Copy the sign/seal padding data. */
 389         if (ss_padding_len) {
 390                 char pad[8];
 391                 memset(pad, '\0', 8);
 392                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 393                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 394                         prs_mem_free(&outgoing_pdu);
 395                         return False;
 396                 }
 397         }
 398
 399         {
 400                 /*
 401                  * Schannel processing.
 402                  */
 403                 char *data;
 404                 RPC_HDR_AUTH auth_info;
 405                 RPC_AUTH_SCHANNEL_CHK verf;
 406
 407                 data = prs_data_p(&outgoing_pdu) + data_pos;
 408                 /* Check it's the type of reply we were expecting to decode */
 409
 410                 init_rpc_hdr_auth(&auth_info,
 411                                 RPC_SCHANNEL_AUTH_TYPE,
 412                                 p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY ?
 413                                         RPC_AUTH_LEVEL_PRIVACY : RPC_AUTH_LEVEL_INTEGRITY,
 414                                 ss_padding_len, 1);
 415
 416                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 417                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 418                         prs_mem_free(&outgoing_pdu);
 419                         return False;
 420                 }
 421
 422                 schannel_encode(p->auth.a_u.schannel_auth,
 423                               p->auth.auth_level,
 424                               SENDER_IS_ACCEPTOR,
 425                               &verf, data, data_len + ss_padding_len);
 426
 427                 if (!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 428                                 &verf, &outgoing_pdu, 0)) {
 429                         prs_mem_free(&outgoing_pdu);
 430                         return False;
 431                 }
 432
 433                 p->auth.a_u.schannel_auth->seq_num++;
 434         }
 435
 436         /*
 437          * Setup the counts for this PDU.
 438          */
 439
 440         p->out_data.data_sent_length += data_len;
 441         p->out_data.current_pdu_len = p->hdr.frag_len;
 442         p->out_data.current_pdu_sent = 0;
 443
 444         prs_mem_free(&outgoing_pdu);
 445         return True;
 446 }
 447
 448 /*******************************************************************
 449  Generate the next PDU to be returned from the data in p->rdata.
 450  No authentication done.
 451 ********************************************************************/
 452
 453 static bool create_next_pdu_noauth(pipes_struct *p)
 454 {
 455         RPC_HDR_RESP hdr_resp;
 456         uint32 data_len;
 457         uint32 data_space_available;
 458         uint32 data_len_left;
 459         prs_struct outgoing_pdu;
 460
 461         /*
 462          * If we're in the fault state, keep returning fault PDU's until
 463          * the pipe gets closed. JRA.
 464          */
 465
 466         if(p->fault_state) {
 467                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 468                 return True;
 469         }
 470
 471         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 472
 473         /* Change the incoming request header to a response. */
 474         p->hdr.pkt_type = RPC_RESPONSE;
 475
 476         /* Set up rpc header flags. */
 477         if (p->out_data.data_sent_length == 0) {
 478                 p->hdr.flags = RPC_FLG_FIRST;
 479         } else {
 480                 p->hdr.flags = 0;
 481         }
 482
 483         /*
 484          * Work out how much we can fit in a single PDU.
 485          */
 486
 487         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 488
 489         /*
 490          * Ensure there really is data left to send.
 491          */
 492
 493         if(!data_len_left) {
 494                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 495                 return False;
 496         }
 497
 498         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 499
 500         /*
 501          * The amount we send is the minimum of the available
 502          * space and the amount left to send.
 503          */
 504
 505         data_len = MIN(data_len_left, data_space_available);
 506
 507         /*
 508          * Set up the alloc hint. This should be the data left to
 509          * send.
 510          */
 511
 512         hdr_resp.alloc_hint = data_len_left;
 513
 514         /*
 515          * Work out if this PDU will be the last.
 516          */
 517
 518         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 519                 p->hdr.flags |= RPC_FLG_LAST;
 520         }
 521
 522         /*
 523          * Set up the header lengths.
 524          */
 525
 526         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 527         p->hdr.auth_len = 0;
 528
 529         /*
 530          * Init the parse struct to point at the outgoing
 531          * data.
 532          */
 533
 534         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 535         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 536
 537         /* Store the header in the data stream. */
 538         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 539                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 540                 prs_mem_free(&outgoing_pdu);
 541                 return False;
 542         }
 543
 544         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 545                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 546                 prs_mem_free(&outgoing_pdu);
 547                 return False;
 548         }
 549
 550         /* Copy the data into the PDU. */
 551
 552         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 553                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 554                 prs_mem_free(&outgoing_pdu);
 555                 return False;
 556         }
 557
 558         /*
 559          * Setup the counts for this PDU.
 560          */
 561
 562         p->out_data.data_sent_length += data_len;
 563         p->out_data.current_pdu_len = p->hdr.frag_len;
 564         p->out_data.current_pdu_sent = 0;
 565
 566         prs_mem_free(&outgoing_pdu);
 567         return True;
 568 }
 569
 570 /*******************************************************************
 571  Generate the next PDU to be returned from the data in p->rdata.
 572 ********************************************************************/
 573
 574 bool create_next_pdu(pipes_struct *p)
 575 {
 576         switch(p->auth.auth_level) {
 577                 case PIPE_AUTH_LEVEL_NONE:
 578                 case PIPE_AUTH_LEVEL_CONNECT:
 579                         /* This is incorrect for auth level connect. Fixme. JRA */
 580                         return create_next_pdu_noauth(p);
 581
 582                 default:
 583                         switch(p->auth.auth_type) {
 584                                 case PIPE_AUTH_TYPE_NTLMSSP:
 585                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 586                                         return create_next_pdu_ntlmssp(p);
 587                                 case PIPE_AUTH_TYPE_SCHANNEL:
 588                                         return create_next_pdu_schannel(p);
 589                                 default:
 590                                         break;
 591                         }
 592         }
 593
 594         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 595                         (unsigned int)p->auth.auth_level,
 596                         (unsigned int)p->auth.auth_type));
 597         return False;
 598 }
 599
 600 /*******************************************************************
 601  Process an NTLMSSP authentication response.
 602  If this function succeeds, the user has been authenticated
 603  and their domain, name and calling workstation stored in
 604  the pipe struct.
 605 *******************************************************************/
 606
 607 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 608 {
 609         DATA_BLOB reply;
 610         NTSTATUS status;
 611         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
 612
 613         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n", p->name));
 614
 615         ZERO_STRUCT(reply);
 616
 617         /* Set up for non-authenticated user. */
 618         TALLOC_FREE(p->pipe_user.nt_user_token);
 619         p->pipe_user.ut.ngroups = 0;
 620         SAFE_FREE( p->pipe_user.ut.groups);
 621
 622         /* this has to be done as root in order to verify the password */
 623         become_root();
 624         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 625         unbecome_root();
 626
 627         /* Don't generate a reply. */
 628         data_blob_free(&reply);
 629
 630         if (!NT_STATUS_IS_OK(status)) {
 631                 return False;
 632         }
 633
 634         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 635            ensure the underlying NTLMSSP flags are also set. If not we should
 636            refuse the bind. */
 637
 638         if (p->auth.auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
 639                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 640                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 641                                 "but client declined signing.\n",
 642                                         p->name ));
 643                         return False;
 644                 }
 645         }
 646         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 647                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
 648                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 649                                 "but client declined sealing.\n",
 650                                         p->name ));
 651                         return False;
 652                 }
 653         }
 654
 655         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 656                   "workstation: %s\n", a->ntlmssp_state->user,
 657                   a->ntlmssp_state->domain, a->ntlmssp_state->workstation));
 658
 659         /*
 660          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 661          */
 662
 663         p->pipe_user.ut.uid = a->server_info->utok.uid;
 664         p->pipe_user.ut.gid = a->server_info->utok.gid;
 665
 666         /*
 667          * We're an authenticated bind over smbd, so the session key needs to
 668          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 669          * does. See the RPC-SAMBA3SESSIONKEY.
 670          */
 671
 672         data_blob_free(&p->session_key);
 673         p->session_key = generic_session_key();
 674         if (!p->session_key.data) {
 675                 return False;
 676         }
 677
 678         p->pipe_user.ut.ngroups = a->server_info->utok.ngroups;
 679         if (p->pipe_user.ut.ngroups) {
 680                 if (!(p->pipe_user.ut.groups = (gid_t *)memdup(
 681                               a->server_info->utok.groups,
 682                               sizeof(gid_t) * p->pipe_user.ut.ngroups))) {
 683                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 684                         return False;
 685                 }
 686         }
 687
 688         if (a->server_info->ptok) {
 689                 p->pipe_user.nt_user_token =
 690                         dup_nt_token(NULL, a->server_info->ptok);
 691         } else {
 692                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 693                 p->pipe_user.nt_user_token = NULL;
 694                 return False;
 695         }
 696
 697         TALLOC_FREE(p->server_info);
 698
 699         p->server_info = copy_serverinfo(p, a->server_info);
 700         if (p->server_info == NULL) {
 701                 DEBUG(0, ("copy_serverinfo failed\n"));
 702                 return false;
 703         }
 704
 705         server_info_set_session_key(p->server_info, p->session_key);
 706
 707         return True;
 708 }
 709
 710 /*******************************************************************
 711  The switch table for the pipe names and the functions to handle them.
 712 *******************************************************************/
 713
 714 struct rpc_table {
 715         struct {
 716                 const char *clnt;
 717                 const char *srv;
 718         } pipe;
 719         const struct api_struct *cmds;
 720         int n_cmds;
 721 };
 722
 723 static struct rpc_table *rpc_lookup;
 724 static int rpc_lookup_size;
 725
 726 /*******************************************************************
 727  This is the "stage3" NTLMSSP response after a bind request and reply.
 728 *******************************************************************/
 729
 730 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 731 {
 732         RPC_HDR_AUTH auth_info;
 733         uint32 pad;
 734         DATA_BLOB blob;
 735
 736         ZERO_STRUCT(blob);
 737
 738         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 739
 740         if (p->hdr.auth_len == 0) {
 741                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 742                 goto err;
 743         }
 744
 745         /* 4 bytes padding. */
 746         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 747                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 748                 goto err;
 749         }
 750
 751         /*
 752          * Decode the authentication verifier response.
 753          */
 754
 755         if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 756                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
 757                 goto err;
 758         }
 759
 760         if (auth_info.auth_type != RPC_NTLMSSP_AUTH_TYPE) {
 761                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 762                         (unsigned int)auth_info.auth_type ));
 763                 return False;
 764         }
 765
 766         blob = data_blob(NULL,p->hdr.auth_len);
 767
 768         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 769                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 770                         (unsigned int)p->hdr.auth_len ));
 771                 goto err;
 772         }
 773
 774         /*
 775          * The following call actually checks the challenge/response data.
 776          * for correctness against the given DOMAIN\user name.
 777          */
 778
 779         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 780                 goto err;
 781         }
 782
 783         data_blob_free(&blob);
 784
 785         p->pipe_bound = True;
 786
 787         return True;
 788
 789  err:
 790
 791         data_blob_free(&blob);
 792         free_pipe_ntlmssp_auth_data(&p->auth);
 793         p->auth.a_u.auth_ntlmssp_state = NULL;
 794
 795         return False;
 796 }
 797
 798 /*******************************************************************
 799  Marshall a bind_nak pdu.
 800 *******************************************************************/
 801
 802 static bool setup_bind_nak(pipes_struct *p)
 803 {
 804         prs_struct outgoing_rpc;
 805         RPC_HDR nak_hdr;
 806         uint16 zero = 0;
 807
 808         /* Free any memory in the current return data buffer. */
 809         prs_mem_free(&p->out_data.rdata);
 810
 811         /*
 812          * Marshall directly into the outgoing PDU space. We
 813          * must do this as we need to set to the bind response
 814          * header and are never sending more than one PDU here.
 815          */
 816
 817         prs_init_empty( &outgoing_rpc, p->mem_ctx, MARSHALL);
 818         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 819
 820         /*
 821          * Initialize a bind_nak header.
 822          */
 823
 824         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 825                 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 826
 827         /*
 828          * Marshall the header into the outgoing PDU.
 829          */
 830
 831         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 832                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 833                 prs_mem_free(&outgoing_rpc);
 834                 return False;
 835         }
 836
 837         /*
 838          * Now add the reject reason.
 839          */
 840
 841         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 842                 prs_mem_free(&outgoing_rpc);
 843                 return False;
 844         }
 845
 846         p->out_data.data_sent_length = 0;
 847         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 848         p->out_data.current_pdu_sent = 0;
 849
 850         if (p->auth.auth_data_free_func) {
 851                 (*p->auth.auth_data_free_func)(&p->auth);
 852         }
 853         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
 854         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 855         p->pipe_bound = False;
 856
 857         return True;
 858 }
 859
 860 /*******************************************************************
 861  Marshall a fault pdu.
 862 *******************************************************************/
 863
 864 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 865 {
 866         prs_struct outgoing_pdu;
 867         RPC_HDR fault_hdr;
 868         RPC_HDR_RESP hdr_resp;
 869         RPC_HDR_FAULT fault_resp;
 870
 871         /* Free any memory in the current return data buffer. */
 872         prs_mem_free(&p->out_data.rdata);
 873
 874         /*
 875          * Marshall directly into the outgoing PDU space. We
 876          * must do this as we need to set to the bind response
 877          * header and are never sending more than one PDU here.
 878          */
 879
 880         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 881         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 882
 883         /*
 884          * Initialize a fault header.
 885          */
 886
 887         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 888             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 889
 890         /*
 891          * Initialize the HDR_RESP and FAULT parts of the PDU.
 892          */
 893
 894         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 895
 896         fault_resp.status = status;
 897         fault_resp.reserved = 0;
 898
 899         /*
 900          * Marshall the header into the outgoing PDU.
 901          */
 902
 903         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 904                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 905                 prs_mem_free(&outgoing_pdu);
 906                 return False;
 907         }
 908
 909         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 910                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 911                 prs_mem_free(&outgoing_pdu);
 912                 return False;
 913         }
 914
 915         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 916                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 917                 prs_mem_free(&outgoing_pdu);
 918                 return False;
 919         }
 920
 921         p->out_data.data_sent_length = 0;
 922         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 923         p->out_data.current_pdu_sent = 0;
 924
 925         prs_mem_free(&outgoing_pdu);
 926         return True;
 927 }
 928
 929 #if 0
 930 /*******************************************************************
 931  Marshall a cancel_ack pdu.
 932  We should probably check the auth-verifier here.
 933 *******************************************************************/
 934
 935 bool setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
 936 {
 937         prs_struct outgoing_pdu;
 938         RPC_HDR ack_reply_hdr;
 939
 940         /* Free any memory in the current return data buffer. */
 941         prs_mem_free(&p->out_data.rdata);
 942
 943         /*
 944          * Marshall directly into the outgoing PDU space. We
 945          * must do this as we need to set to the bind response
 946          * header and are never sending more than one PDU here.
 947          */
 948
 949         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 950         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 951
 952         /*
 953          * Initialize a cancel_ack header.
 954          */
 955
 956         init_rpc_hdr(&ack_reply_hdr, RPC_CANCEL_ACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 957                         p->hdr.call_id, RPC_HEADER_LEN, 0);
 958
 959         /*
 960          * Marshall the header into the outgoing PDU.
 961          */
 962
 963         if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
 964                 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
 965                 prs_mem_free(&outgoing_pdu);
 966                 return False;
 967         }
 968
 969         p->out_data.data_sent_length = 0;
 970         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 971         p->out_data.current_pdu_sent = 0;
 972
 973         prs_mem_free(&outgoing_pdu);
 974         return True;
 975 }
 976 #endif
 977
 978 /*******************************************************************
 979  Ensure a bind request has the correct abstract & transfer interface.
 980  Used to reject unknown binds from Win2k.
 981 *******************************************************************/
 982
 983 bool check_bind_req(struct pipes_struct *p, RPC_IFACE* abstract,
 984                     RPC_IFACE* transfer, uint32 context_id)
 985 {
 986         char *pipe_name = p->name;
 987         int i=0;
 988         fstring pname;
 989
 990         fstrcpy(pname,"\\PIPE\\");
 991         fstrcat(pname,pipe_name);
 992
 993         DEBUG(3,("check_bind_req for %s\n", pname));
 994
 995         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 996
 997         for ( i=0; pipe_names[i].client_pipe; i++ ) {
 998                 DEBUGADD(10,("checking %s\n", pipe_names[i].client_pipe));
 999                 if ( strequal(pipe_names[i].client_pipe, pname)
1000                         && (abstract->if_version == pipe_names[i].abstr_syntax->if_version)
1001                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax->uuid, sizeof(struct GUID)) == 0)
1002                         && (transfer->if_version == pipe_names[i].trans_syntax->if_version)
1003                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax->uuid, sizeof(struct GUID)) == 0) ) {
1004                         struct api_struct       *fns = NULL;
1005                         int                     n_fns = 0;
1006                         PIPE_RPC_FNS            *context_fns;
1007
1008                         if ( !(context_fns = SMB_MALLOC_P(PIPE_RPC_FNS)) ) {
1009                                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
1010                                 return False;
1011                         }
1012
1013                         /* save the RPC function table associated with this bind */
1014
1015                         get_pipe_fns(i, &fns, &n_fns);
1016
1017                         context_fns->cmds = fns;
1018                         context_fns->n_cmds = n_fns;
1019                         context_fns->context_id = context_id;
1020
1021                         /* add to the list of open contexts */
1022
1023                         DLIST_ADD( p->contexts, context_fns );
1024
1025                         break;
1026                 }
1027         }
1028
1029         if(pipe_names[i].client_pipe == NULL) {
1030                 return False;
1031         }
1032
1033         return True;
1034 }
1035
1036 /*******************************************************************
1037  Register commands to an RPC pipe
1038 *******************************************************************/
1039
1040 NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *srv, const struct api_struct *cmds, int size)
1041 {
1042         struct rpc_table *rpc_entry;
1043
1044         if (!clnt || !srv || !cmds) {
1045                 return NT_STATUS_INVALID_PARAMETER;
1046         }
1047
1048         if (version != SMB_RPC_INTERFACE_VERSION) {
1049                 DEBUG(0,("Can't register rpc commands!\n"
1050                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1051                          ", while this version of samba uses version %d!\n",
1052                          version,SMB_RPC_INTERFACE_VERSION));
1053                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1054         }
1055
1056         /* TODO:
1057          *
1058          * we still need to make sure that don't register the same commands twice!!!
1059          *
1060          * --metze
1061          */
1062
1063         /* We use a temporary variable because this call can fail and
1064            rpc_lookup will still be valid afterwards.  It could then succeed if
1065            called again later */
1066         rpc_lookup_size++;
1067         rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1068         if (NULL == rpc_entry) {
1069                 rpc_lookup_size--;
1070                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1071                 return NT_STATUS_NO_MEMORY;
1072         } else {
1073                 rpc_lookup = rpc_entry;
1074         }
1075
1076         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1077         ZERO_STRUCTP(rpc_entry);
1078         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1079         rpc_entry->pipe.srv = SMB_STRDUP(srv);
1080         rpc_entry->cmds = cmds;
1081         rpc_entry->n_cmds = size;
1082
1083         return NT_STATUS_OK;
1084 }
1085
1086 /*******************************************************************
1087  Handle a SPNEGO krb5 bind auth.
1088 *******************************************************************/
1089
1090 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1091                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1092 {
1093         return False;
1094 }
1095
1096 /*******************************************************************
1097  Handle the first part of a SPNEGO bind auth.
1098 *******************************************************************/
1099
1100 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1101                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1102 {
1103         DATA_BLOB blob;
1104         DATA_BLOB secblob;
1105         DATA_BLOB response;
1106         DATA_BLOB chal;
1107         char *OIDs[ASN1_MAX_OIDS];
1108         int i;
1109         NTSTATUS status;
1110         bool got_kerberos_mechanism = false;
1111         AUTH_NTLMSSP_STATE *a = NULL;
1112         RPC_HDR_AUTH auth_info;
1113
1114         ZERO_STRUCT(secblob);
1115         ZERO_STRUCT(chal);
1116         ZERO_STRUCT(response);
1117
1118         /* Grab the SPNEGO blob. */
1119         blob = data_blob(NULL,p->hdr.auth_len);
1120
1121         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1122                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1123                         (unsigned int)p->hdr.auth_len ));
1124                 goto err;
1125         }
1126
1127         if (blob.data[0] != ASN1_APPLICATION(0)) {
1128                 goto err;
1129         }
1130
1131         /* parse out the OIDs and the first sec blob */
1132         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1133                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1134                 goto err;
1135         }
1136
1137         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1138                 got_kerberos_mechanism = true;
1139         }
1140
1141         for (i=0;OIDs[i];i++) {
1142                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1143                 SAFE_FREE(OIDs[i]);
1144         }
1145         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1146
1147         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || lp_use_kerberos_keytab()) ) {
1148                 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1149                 data_blob_free(&secblob);
1150                 data_blob_free(&blob);
1151                 return ret;
1152         }
1153
1154         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1155                 /* Free any previous auth type. */
1156                 free_pipe_ntlmssp_auth_data(&p->auth);
1157         }
1158
1159         if (!got_kerberos_mechanism) {
1160                 /* Initialize the NTLM engine. */
1161                 status = auth_ntlmssp_start(&a);
1162                 if (!NT_STATUS_IS_OK(status)) {
1163                         goto err;
1164                 }
1165
1166                 /*
1167                  * Pass the first security blob of data to it.
1168                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1169                  * which means we need another packet to complete the bind.
1170                  */
1171
1172                 status = auth_ntlmssp_update(a, secblob, &chal);
1173
1174                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1175                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1176                         goto err;
1177                 }
1178
1179                 /* Generate the response blob we need for step 2 of the bind. */
1180                 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1181         } else {
1182                 /*
1183                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1184                  * code to process follow-up packets is not complete
1185                  * yet. JRA.
1186                  */
1187                 response = spnego_gen_auth_response(NULL,
1188                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1189                                         OID_NTLMSSP);
1190         }
1191
1192         /* Copy the blob into the pout_auth parse struct */
1193         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1194         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1195                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1196                 goto err;
1197         }
1198
1199         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1200                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1201                 goto err;
1202         }
1203
1204         p->auth.a_u.auth_ntlmssp_state = a;
1205         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1206         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1207
1208         data_blob_free(&blob);
1209         data_blob_free(&secblob);
1210         data_blob_free(&chal);
1211         data_blob_free(&response);
1212
1213         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1214         return True;
1215
1216  err:
1217
1218         data_blob_free(&blob);
1219         data_blob_free(&secblob);
1220         data_blob_free(&chal);
1221         data_blob_free(&response);
1222
1223         p->auth.a_u.auth_ntlmssp_state = NULL;
1224
1225         return False;
1226 }
1227
1228 /*******************************************************************
1229  Handle the second part of a SPNEGO bind auth.
1230 *******************************************************************/
1231
1232 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1233                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1234 {
1235         RPC_HDR_AUTH auth_info;
1236         DATA_BLOB spnego_blob;
1237         DATA_BLOB auth_blob;
1238         DATA_BLOB auth_reply;
1239         DATA_BLOB response;
1240         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1241
1242         ZERO_STRUCT(spnego_blob);
1243         ZERO_STRUCT(auth_blob);
1244         ZERO_STRUCT(auth_reply);
1245         ZERO_STRUCT(response);
1246
1247         /*
1248          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1249          * fail here as 'a' == NULL.
1250          */
1251         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1252                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1253                 goto err;
1254         }
1255
1256         /* Grab the SPNEGO blob. */
1257         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1258
1259         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1260                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1261                         (unsigned int)p->hdr.auth_len ));
1262                 goto err;
1263         }
1264
1265         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1266                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1267                 goto err;
1268         }
1269
1270         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1271                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1272                 goto err;
1273         }
1274
1275         /*
1276          * The following call actually checks the challenge/response data.
1277          * for correctness against the given DOMAIN\user name.
1278          */
1279
1280         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1281                 goto err;
1282         }
1283
1284         data_blob_free(&spnego_blob);
1285         data_blob_free(&auth_blob);
1286
1287         /* Generate the spnego "accept completed" blob - no incoming data. */
1288         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1289
1290         /* Copy the blob into the pout_auth parse struct */
1291         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1292         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1293                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1294                 goto err;
1295         }
1296
1297         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1298                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1299                 goto err;
1300         }
1301
1302         data_blob_free(&auth_reply);
1303         data_blob_free(&response);
1304
1305         p->pipe_bound = True;
1306
1307         return True;
1308
1309  err:
1310
1311         data_blob_free(&spnego_blob);
1312         data_blob_free(&auth_blob);
1313         data_blob_free(&auth_reply);
1314         data_blob_free(&response);
1315
1316         free_pipe_ntlmssp_auth_data(&p->auth);
1317         p->auth.a_u.auth_ntlmssp_state = NULL;
1318
1319         return False;
1320 }
1321
1322 /*******************************************************************
1323  Handle an schannel bind auth.
1324 *******************************************************************/
1325
1326 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1327                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1328 {
1329         RPC_HDR_AUTH auth_info;
1330         RPC_AUTH_SCHANNEL_NEG neg;
1331         RPC_AUTH_VERIFIER auth_verifier;
1332         bool ret;
1333         struct dcinfo *pdcinfo;
1334         uint32 flags;
1335
1336         if (!smb_io_rpc_auth_schannel_neg("", &neg, rpc_in_p, 0)) {
1337                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1338                 return False;
1339         }
1340
1341         /*
1342          * The neg.myname key here must match the remote computer name
1343          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1344          * operations that use credentials.
1345          */
1346
1347         become_root();
1348         ret = secrets_restore_schannel_session_info(p->mem_ctx, neg.myname, &pdcinfo);
1349         unbecome_root();
1350
1351         if (!ret) {
1352                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1353                 return False;
1354         }
1355
1356         p->auth.a_u.schannel_auth = talloc(p, struct schannel_auth_struct);
1357         if (!p->auth.a_u.schannel_auth) {
1358                 TALLOC_FREE(pdcinfo);
1359                 return False;
1360         }
1361
1362         memset(p->auth.a_u.schannel_auth->sess_key, 0, sizeof(p->auth.a_u.schannel_auth->sess_key));
1363         memcpy(p->auth.a_u.schannel_auth->sess_key, pdcinfo->sess_key,
1364                         sizeof(pdcinfo->sess_key));
1365
1366         TALLOC_FREE(pdcinfo);
1367
1368         p->auth.a_u.schannel_auth->seq_num = 0;
1369
1370         /*
1371          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1372          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1373          * struct of the person who opened the pipe. I need to test this further. JRA.
1374          *
1375          * VL. As we are mapping this to guest set the generic key
1376          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1377          * W2k3, as it does not allow schannel binds against SAMR and LSA
1378          * anymore.
1379          */
1380
1381         data_blob_free(&p->session_key);
1382         p->session_key = generic_session_key();
1383         if (p->session_key.data == NULL) {
1384                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1385                           " key\n"));
1386                 return False;
1387         }
1388
1389         init_rpc_hdr_auth(&auth_info, RPC_SCHANNEL_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1390         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1391                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1392                 return False;
1393         }
1394
1395         /*** SCHANNEL verifier ***/
1396
1397         init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1398         if(!smb_io_rpc_schannel_verifier("", &auth_verifier, pout_auth, 0)) {
1399                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1400                 return False;
1401         }
1402
1403         prs_align(pout_auth);
1404
1405         flags = 5;
1406         if(!prs_uint32("flags ", pout_auth, 0, &flags)) {
1407                 return False;
1408         }
1409
1410         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1411                 neg.domain, neg.myname));
1412
1413         /* We're finished with this bind - no more packets. */
1414         p->auth.auth_data_free_func = NULL;
1415         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1416
1417         p->pipe_bound = True;
1418
1419         return True;
1420 }
1421
1422 /*******************************************************************
1423  Handle an NTLMSSP bind auth.
1424 *******************************************************************/
1425
1426 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1427                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1428 {
1429         RPC_HDR_AUTH auth_info;
1430         DATA_BLOB blob;
1431         DATA_BLOB response;
1432         NTSTATUS status;
1433         AUTH_NTLMSSP_STATE *a = NULL;
1434
1435         ZERO_STRUCT(blob);
1436         ZERO_STRUCT(response);
1437
1438         /* Grab the NTLMSSP blob. */
1439         blob = data_blob(NULL,p->hdr.auth_len);
1440
1441         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1442                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1443                         (unsigned int)p->hdr.auth_len ));
1444                 goto err;
1445         }
1446
1447         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1448                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1449                 goto err;
1450         }
1451
1452         /* We have an NTLMSSP blob. */
1453         status = auth_ntlmssp_start(&a);
1454         if (!NT_STATUS_IS_OK(status)) {
1455                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1456                         nt_errstr(status) ));
1457                 goto err;
1458         }
1459
1460         status = auth_ntlmssp_update(a, blob, &response);
1461         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1462                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1463                         nt_errstr(status) ));
1464                 goto err;
1465         }
1466
1467         data_blob_free(&blob);
1468
1469         /* Copy the blob into the pout_auth parse struct */
1470         init_rpc_hdr_auth(&auth_info, RPC_NTLMSSP_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1471         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1472                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1473                 goto err;
1474         }
1475
1476         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1477                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1478                 goto err;
1479         }
1480
1481         p->auth.a_u.auth_ntlmssp_state = a;
1482         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1483         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1484
1485         data_blob_free(&blob);
1486         data_blob_free(&response);
1487
1488         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1489
1490         /* We can't set pipe_bound True yet - we need an RPC_AUTH3 response packet... */
1491         return True;
1492
1493   err:
1494
1495         data_blob_free(&blob);
1496         data_blob_free(&response);
1497
1498         free_pipe_ntlmssp_auth_data(&p->auth);
1499         p->auth.a_u.auth_ntlmssp_state = NULL;
1500         return False;
1501 }
1502
1503 /*******************************************************************
1504  Respond to a pipe bind request.
1505 *******************************************************************/
1506
1507 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1508 {
1509         RPC_HDR_BA hdr_ba;
1510         RPC_HDR_RB hdr_rb;
1511         RPC_HDR_AUTH auth_info;
1512         uint16 assoc_gid;
1513         fstring ack_pipe_name;
1514         prs_struct out_hdr_ba;
1515         prs_struct out_auth;
1516         prs_struct outgoing_rpc;
1517         int i = 0;
1518         int auth_len = 0;
1519         unsigned int auth_type = RPC_ANONYMOUS_AUTH_TYPE;
1520
1521         /* No rebinds on a bound pipe - use alter context. */
1522         if (p->pipe_bound) {
1523                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound pipe %s.\n", p->pipe_srv_name));
1524                 return setup_bind_nak(p);
1525         }
1526
1527         prs_init_empty( &outgoing_rpc, p->mem_ctx, MARSHALL);
1528
1529         /*
1530          * Marshall directly into the outgoing PDU space. We
1531          * must do this as we need to set to the bind response
1532          * header and are never sending more than one PDU here.
1533          */
1534
1535         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1536
1537         /*
1538          * Setup the memory to marshall the ba header, and the
1539          * auth footers.
1540          */
1541
1542         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1543                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1544                 prs_mem_free(&outgoing_rpc);
1545                 return False;
1546         }
1547
1548         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1549                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1550                 prs_mem_free(&outgoing_rpc);
1551                 prs_mem_free(&out_hdr_ba);
1552                 return False;
1553         }
1554
1555         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1556
1557         /*
1558          * Try and find the correct pipe name to ensure
1559          * that this is a pipe name we support.
1560          */
1561
1562
1563         for (i = 0; i < rpc_lookup_size; i++) {
1564                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1565                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1566                                 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1567                         fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1568                         break;
1569                 }
1570         }
1571
1572         if (i == rpc_lookup_size) {
1573                 if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) {
1574                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1575                                 p->name ));
1576                         prs_mem_free(&outgoing_rpc);
1577                         prs_mem_free(&out_hdr_ba);
1578                         prs_mem_free(&out_auth);
1579
1580                         return setup_bind_nak(p);
1581                 }
1582
1583                 for (i = 0; i < rpc_lookup_size; i++) {
1584                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1585                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1586                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1587                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1588                                break;
1589                        }
1590                 }
1591
1592                 if (i == rpc_lookup_size) {
1593                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
1594                         goto err_exit;
1595                 }
1596         }
1597
1598         ZERO_STRUCT(hdr_rb);
1599
1600         /* decode the bind request */
1601         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1602                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
1603                 goto err_exit;
1604         }
1605
1606         /* name has to be \PIPE\xxxxx */
1607         fstrcpy(ack_pipe_name, "\\PIPE\\");
1608         fstrcat(ack_pipe_name, p->pipe_srv_name);
1609
1610         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1611
1612         /*
1613          * Check if this is an authenticated bind request.
1614          */
1615
1616         if (p->hdr.auth_len) {
1617                 /*
1618                  * Decode the authentication verifier.
1619                  */
1620
1621                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1622                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1623                         goto err_exit;
1624                 }
1625
1626                 auth_type = auth_info.auth_type;
1627
1628                 /* Work out if we have to sign or seal etc. */
1629                 switch (auth_info.auth_level) {
1630                         case RPC_AUTH_LEVEL_INTEGRITY:
1631                                 p->auth.auth_level = PIPE_AUTH_LEVEL_INTEGRITY;
1632                                 break;
1633                         case RPC_AUTH_LEVEL_PRIVACY:
1634                                 p->auth.auth_level = PIPE_AUTH_LEVEL_PRIVACY;
1635                                 break;
1636                         default:
1637                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1638                                         (unsigned int)auth_info.auth_level ));
1639                                 goto err_exit;
1640                 }
1641         } else {
1642                 ZERO_STRUCT(auth_info);
1643         }
1644
1645         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1646
1647         switch(auth_type) {
1648                 case RPC_NTLMSSP_AUTH_TYPE:
1649                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1650                                 goto err_exit;
1651                         }
1652                         assoc_gid = 0x7a77;
1653                         break;
1654
1655                 case RPC_SCHANNEL_AUTH_TYPE:
1656                         if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1657                                 goto err_exit;
1658                         }
1659                         break;
1660
1661                 case RPC_SPNEGO_AUTH_TYPE:
1662                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1663                                 goto err_exit;
1664                         }
1665                         break;
1666
1667                 case RPC_ANONYMOUS_AUTH_TYPE:
1668                         /* Unauthenticated bind request. */
1669                         /* Get the authenticated pipe user from current_user */
1670                         if (!copy_current_user(&p->pipe_user, &current_user)) {
1671                                 DEBUG(10, ("Could not copy current user\n"));
1672                                 goto err_exit;
1673                         }
1674                         /* We're finished - no more packets. */
1675                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1676                         /* We must set the pipe auth_level here also. */
1677                         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
1678                         p->pipe_bound = True;
1679                         /* The session key was initialized from the SMB
1680                          * session in make_internal_rpc_pipe_p */
1681                         break;
1682
1683                 default:
1684                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1685                         goto err_exit;
1686         }
1687
1688         /*
1689          * Create the bind response struct.
1690          */
1691
1692         /* If the requested abstract synt uuid doesn't match our client pipe,
1693                 reject the bind_ack & set the transfer interface synt to all 0's,
1694                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1695                 unknown to NT4)
1696                 Needed when adding entries to a DACL from NT5 - SK */
1697
1698         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1699                                 hdr_rb.rpc_context[0].context_id )) {
1700                 init_rpc_hdr_ba(&hdr_ba,
1701                         RPC_MAX_PDU_FRAG_LEN,
1702                         RPC_MAX_PDU_FRAG_LEN,
1703                         assoc_gid,
1704                         ack_pipe_name,
1705                         0x1, 0x0, 0x0,
1706                         &hdr_rb.rpc_context[0].transfer[0]);
1707         } else {
1708                 RPC_IFACE null_interface;
1709                 ZERO_STRUCT(null_interface);
1710                 /* Rejection reason: abstract syntax not supported */
1711                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1712                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1713                                         ack_pipe_name, 0x1, 0x2, 0x1,
1714                                         &null_interface);
1715                 p->pipe_bound = False;
1716         }
1717
1718         /*
1719          * and marshall it.
1720          */
1721
1722         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1723                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1724                 goto err_exit;
1725         }
1726
1727         /*
1728          * Create the header, now we know the length.
1729          */
1730
1731         if (prs_offset(&out_auth)) {
1732                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1733         }
1734
1735         init_rpc_hdr(&p->hdr, RPC_BINDACK, RPC_FLG_FIRST | RPC_FLG_LAST,
1736                         p->hdr.call_id,
1737                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1738                         auth_len);
1739
1740         /*
1741          * Marshall the header into the outgoing PDU.
1742          */
1743
1744         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1745                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1746                 goto err_exit;
1747         }
1748
1749         /*
1750          * Now add the RPC_HDR_BA and any auth needed.
1751          */
1752
1753         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1754                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1755                 goto err_exit;
1756         }
1757
1758         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1759                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1760                 goto err_exit;
1761         }
1762
1763         /*
1764          * Setup the lengths for the initial reply.
1765          */
1766
1767         p->out_data.data_sent_length = 0;
1768         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1769         p->out_data.current_pdu_sent = 0;
1770
1771         prs_mem_free(&out_hdr_ba);
1772         prs_mem_free(&out_auth);
1773
1774         return True;
1775
1776   err_exit:
1777
1778         prs_mem_free(&outgoing_rpc);
1779         prs_mem_free(&out_hdr_ba);
1780         prs_mem_free(&out_auth);
1781         return setup_bind_nak(p);
1782 }
1783
1784 /****************************************************************************
1785  Deal with an alter context call. Can be third part of 3 leg auth request for
1786  SPNEGO calls.
1787 ****************************************************************************/
1788
1789 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1790 {
1791         RPC_HDR_BA hdr_ba;
1792         RPC_HDR_RB hdr_rb;
1793         RPC_HDR_AUTH auth_info;
1794         uint16 assoc_gid;
1795         fstring ack_pipe_name;
1796         prs_struct out_hdr_ba;
1797         prs_struct out_auth;
1798         prs_struct outgoing_rpc;
1799         int auth_len = 0;
1800
1801         prs_init_empty( &outgoing_rpc, p->mem_ctx, MARSHALL);
1802
1803         /*
1804          * Marshall directly into the outgoing PDU space. We
1805          * must do this as we need to set to the bind response
1806          * header and are never sending more than one PDU here.
1807          */
1808
1809         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1810
1811         /*
1812          * Setup the memory to marshall the ba header, and the
1813          * auth footers.
1814          */
1815
1816         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1817                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1818                 prs_mem_free(&outgoing_rpc);
1819                 return False;
1820         }
1821
1822         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1823                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1824                 prs_mem_free(&outgoing_rpc);
1825                 prs_mem_free(&out_hdr_ba);
1826                 return False;
1827         }
1828
1829         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1830
1831         /* decode the alter context request */
1832         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1833                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1834                 goto err_exit;
1835         }
1836
1837         /* secondary address CAN be NULL
1838          * as the specs say it's ignored.
1839          * It MUST be NULL to have the spoolss working.
1840          */
1841         fstrcpy(ack_pipe_name,"");
1842
1843         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1844
1845         /*
1846          * Check if this is an authenticated alter context request.
1847          */
1848
1849         if (p->hdr.auth_len != 0) {
1850                 /*
1851                  * Decode the authentication verifier.
1852                  */
1853
1854                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1855                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1856                         goto err_exit;
1857                 }
1858
1859                 /*
1860                  * Currently only the SPNEGO auth type uses the alter ctx
1861                  * response in place of the NTLMSSP auth3 type.
1862                  */
1863
1864                 if (auth_info.auth_type == RPC_SPNEGO_AUTH_TYPE) {
1865                         /* We can only finish if the pipe is unbound. */
1866                         if (!p->pipe_bound) {
1867                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1868                                         goto err_exit;
1869                                 }
1870                         } else {
1871                                 goto err_exit;
1872                         }
1873                 }
1874         } else {
1875                 ZERO_STRUCT(auth_info);
1876         }
1877
1878         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1879
1880         /*
1881          * Create the bind response struct.
1882          */
1883
1884         /* If the requested abstract synt uuid doesn't match our client pipe,
1885                 reject the bind_ack & set the transfer interface synt to all 0's,
1886                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1887                 unknown to NT4)
1888                 Needed when adding entries to a DACL from NT5 - SK */
1889
1890         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1891                                 hdr_rb.rpc_context[0].context_id )) {
1892                 init_rpc_hdr_ba(&hdr_ba,
1893                         RPC_MAX_PDU_FRAG_LEN,
1894                         RPC_MAX_PDU_FRAG_LEN,
1895                         assoc_gid,
1896                         ack_pipe_name,
1897                         0x1, 0x0, 0x0,
1898                         &hdr_rb.rpc_context[0].transfer[0]);
1899         } else {
1900                 RPC_IFACE null_interface;
1901                 ZERO_STRUCT(null_interface);
1902                 /* Rejection reason: abstract syntax not supported */
1903                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1904                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1905                                         ack_pipe_name, 0x1, 0x2, 0x1,
1906                                         &null_interface);
1907                 p->pipe_bound = False;
1908         }
1909
1910         /*
1911          * and marshall it.
1912          */
1913
1914         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1915                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1916                 goto err_exit;
1917         }
1918
1919         /*
1920          * Create the header, now we know the length.
1921          */
1922
1923         if (prs_offset(&out_auth)) {
1924                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1925         }
1926
1927         init_rpc_hdr(&p->hdr, RPC_ALTCONTRESP, RPC_FLG_FIRST | RPC_FLG_LAST,
1928                         p->hdr.call_id,
1929                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1930                         auth_len);
1931
1932         /*
1933          * Marshall the header into the outgoing PDU.
1934          */
1935
1936         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1937                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
1938                 goto err_exit;
1939         }
1940
1941         /*
1942          * Now add the RPC_HDR_BA and any auth needed.
1943          */
1944
1945         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1946                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
1947                 goto err_exit;
1948         }
1949
1950         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1951                 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
1952                 goto err_exit;
1953         }
1954
1955         /*
1956          * Setup the lengths for the initial reply.
1957          */
1958
1959         p->out_data.data_sent_length = 0;
1960         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1961         p->out_data.current_pdu_sent = 0;
1962
1963         prs_mem_free(&out_hdr_ba);
1964         prs_mem_free(&out_auth);
1965
1966         return True;
1967
1968   err_exit:
1969
1970         prs_mem_free(&outgoing_rpc);
1971         prs_mem_free(&out_hdr_ba);
1972         prs_mem_free(&out_auth);
1973         return setup_bind_nak(p);
1974 }
1975
1976 /****************************************************************************
1977  Deal with NTLMSSP sign & seal processing on an RPC request.
1978 ****************************************************************************/
1979
1980 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
1981                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
1982 {
1983         RPC_HDR_AUTH auth_info;
1984         uint32 auth_len = p->hdr.auth_len;
1985         uint32 save_offset = prs_offset(rpc_in);
1986         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1987         unsigned char *data = NULL;
1988         size_t data_len;
1989         unsigned char *full_packet_data = NULL;
1990         size_t full_packet_data_len;
1991         DATA_BLOB auth_blob;
1992
1993         *pstatus = NT_STATUS_OK;
1994
1995         if (p->auth.auth_level == PIPE_AUTH_LEVEL_NONE || p->auth.auth_level == PIPE_AUTH_LEVEL_CONNECT) {
1996                 return True;
1997         }
1998
1999         if (!a) {
2000                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2001                 return False;
2002         }
2003
2004         /* Ensure there's enough data for an authenticated request. */
2005         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
2006                         (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
2007                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2008                         (unsigned int)auth_len ));
2009                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2010                 return False;
2011         }
2012
2013         /*
2014          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2015          * after the RPC header.
2016          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2017          * functions as NTLMv2 checks the rpc headers also.
2018          */
2019
2020         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2021         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2022
2023         full_packet_data = p->in_data.current_in_pdu;
2024         full_packet_data_len = p->hdr.frag_len - auth_len;
2025
2026         /* Pull the auth header and the following data into a blob. */
2027         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2028                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
2029                         (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
2030                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2031                 return False;
2032         }
2033
2034         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2035                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
2036                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2037                 return False;
2038         }
2039
2040         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2041         auth_blob.length = auth_len;
2042
2043         switch (p->auth.auth_level) {
2044                 case PIPE_AUTH_LEVEL_PRIVACY:
2045                         /* Data is encrypted. */
2046                         *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
2047                                                         data, data_len,
2048                                                         full_packet_data,
2049                                                         full_packet_data_len,
2050                                                         &auth_blob);
2051                         if (!NT_STATUS_IS_OK(*pstatus)) {
2052                                 return False;
2053                         }
2054                         break;
2055                 case PIPE_AUTH_LEVEL_INTEGRITY:
2056                         /* Data is signed. */
2057                         *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
2058                                                         data, data_len,
2059                                                         full_packet_data,
2060                                                         full_packet_data_len,
2061                                                         &auth_blob);
2062                         if (!NT_STATUS_IS_OK(*pstatus)) {
2063                                 return False;
2064                         }
2065                         break;
2066                 default:
2067                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2068                         return False;
2069         }
2070
2071         /*
2072          * Return the current pointer to the data offset.
2073          */
2074
2075         if(!prs_set_offset(rpc_in, save_offset)) {
2076                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2077                         (unsigned int)save_offset ));
2078                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2079                 return False;
2080         }
2081
2082         /*
2083          * Remember the padding length. We must remove it from the real data
2084          * stream once the sign/seal is done.
2085          */
2086
2087         *p_ss_padding_len = auth_info.auth_pad_len;
2088
2089         return True;
2090 }
2091
2092 /****************************************************************************
2093  Deal with schannel processing on an RPC request.
2094 ****************************************************************************/
2095
2096 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2097 {
2098         uint32 data_len;
2099         uint32 auth_len;
2100         uint32 save_offset = prs_offset(rpc_in);
2101         RPC_HDR_AUTH auth_info;
2102         RPC_AUTH_SCHANNEL_CHK schannel_chk;
2103
2104         auth_len = p->hdr.auth_len;
2105
2106         if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
2107                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2108                 return False;
2109         }
2110
2111         /*
2112          * The following is that length of the data we must verify or unseal.
2113          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2114          * preceeding the auth_data.
2115          */
2116
2117         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2118                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2119                         (unsigned int)p->hdr.frag_len,
2120                         (unsigned int)auth_len ));
2121                 return False;
2122         }
2123
2124         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2125                 RPC_HDR_AUTH_LEN - auth_len;
2126
2127         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2128
2129         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2130                 DEBUG(0,("cannot move offset to %u.\n",
2131                          (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2132                 return False;
2133         }
2134
2135         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2136                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2137                 return False;
2138         }
2139
2140         if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
2141                 DEBUG(0,("Invalid auth info %d on schannel\n",
2142                          auth_info.auth_type));
2143                 return False;
2144         }
2145
2146         if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN, &schannel_chk, rpc_in, 0)) {
2147                 DEBUG(0,("failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
2148                 return False;
2149         }
2150
2151         if (!schannel_decode(p->auth.a_u.schannel_auth,
2152                            p->auth.auth_level,
2153                            SENDER_IS_INITIATOR,
2154                            &schannel_chk,
2155                            prs_data_p(rpc_in)+RPC_HDR_REQ_LEN, data_len)) {
2156                 DEBUG(3,("failed to decode PDU\n"));
2157                 return False;
2158         }
2159
2160         /*
2161          * Return the current pointer to the data offset.
2162          */
2163
2164         if(!prs_set_offset(rpc_in, save_offset)) {
2165                 DEBUG(0,("failed to set offset back to %u\n",
2166                          (unsigned int)save_offset ));
2167                 return False;
2168         }
2169
2170         /* The sequence number gets incremented on both send and receive. */
2171         p->auth.a_u.schannel_auth->seq_num++;
2172
2173         /*
2174          * Remember the padding length. We must remove it from the real data
2175          * stream once the sign/seal is done.
2176          */
2177
2178         *p_ss_padding_len = auth_info.auth_pad_len;
2179
2180         return True;
2181 }
2182
2183 /****************************************************************************
2184  Return a user struct for a pipe user.
2185 ****************************************************************************/
2186
2187 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
2188 {
2189         if (p->pipe_bound &&
2190                         (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP ||
2191                         (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2192                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
2193         } else {
2194                 memcpy(user, &current_user, sizeof(struct current_user));
2195         }
2196
2197         return user;
2198 }
2199
2200 /****************************************************************************
2201  Find the set of RPC functions associated with this context_id
2202 ****************************************************************************/
2203
2204 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2205 {
2206         PIPE_RPC_FNS *fns = NULL;
2207         PIPE_RPC_FNS *tmp = NULL;
2208
2209         if ( !list ) {
2210                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2211                 return NULL;
2212         }
2213
2214         for (tmp=list; tmp; tmp=tmp->next ) {
2215                 if ( tmp->context_id == context_id )
2216                         break;
2217         }
2218
2219         fns = tmp;
2220
2221         return fns;
2222 }
2223
2224 /****************************************************************************
2225  Memory cleanup.
2226 ****************************************************************************/
2227
2228 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2229 {
2230         PIPE_RPC_FNS *tmp = list;
2231         PIPE_RPC_FNS *tmp2;
2232
2233         while (tmp) {
2234                 tmp2 = tmp->next;
2235                 SAFE_FREE(tmp);
2236                 tmp = tmp2;
2237         }
2238
2239         return;
2240 }
2241
2242 /****************************************************************************
2243  Find the correct RPC function to call for this request.
2244  If the pipe is authenticated then become the correct UNIX user
2245  before doing the call.
2246 ****************************************************************************/
2247
2248 bool api_pipe_request(pipes_struct *p)
2249 {
2250         bool ret = False;
2251         bool changed_user = False;
2252         PIPE_RPC_FNS *pipe_fns;
2253
2254         if (p->pipe_bound &&
2255                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2256                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2257                 if(!become_authenticated_pipe_user(p)) {
2258                         prs_mem_free(&p->out_data.rdata);
2259                         return False;
2260                 }
2261                 changed_user = True;
2262         }
2263
2264         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
2265
2266         /* get the set of RPC functions for this context */
2267
2268         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2269
2270         if ( pipe_fns ) {
2271                 TALLOC_CTX *frame = talloc_stackframe();
2272                 ret = api_rpcTNP(p, p->name, pipe_fns->cmds, pipe_fns->n_cmds);
2273                 TALLOC_FREE(frame);
2274         }
2275         else {
2276                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2277                         p->hdr_req.context_id, p->name));
2278         }
2279
2280         if (changed_user) {
2281                 unbecome_authenticated_pipe_user();
2282         }
2283
2284         return ret;
2285 }
2286
2287 /*******************************************************************
2288  Calls the underlying RPC function for a named pipe.
2289  ********************************************************************/
2290
2291 bool api_rpcTNP(pipes_struct *p, const char *rpc_name,
2292                 const struct api_struct *api_rpc_cmds, int n_cmds)
2293 {
2294         int fn_num;
2295         fstring name;
2296         uint32 offset1, offset2;
2297
2298         /* interpret the command */
2299         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
2300
2301         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
2302         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2303
2304         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2305                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2306                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2307                         break;
2308                 }
2309         }
2310
2311         if (fn_num == n_cmds) {
2312                 /*
2313                  * For an unknown RPC just return a fault PDU but
2314                  * return True to allow RPC's on the pipe to continue
2315                  * and not put the pipe into fault state. JRA.
2316                  */
2317                 DEBUG(4, ("unknown\n"));
2318                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2319                 return True;
2320         }
2321
2322         offset1 = prs_offset(&p->out_data.rdata);
2323
2324         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2325                 fn_num, api_rpc_cmds[fn_num].fn));
2326         /* do the actual command */
2327         if(!api_rpc_cmds[fn_num].fn(p)) {
2328                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
2329                 prs_mem_free(&p->out_data.rdata);
2330                 return False;
2331         }
2332
2333         if (p->bad_handle_fault_state) {
2334                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2335                 p->bad_handle_fault_state = False;
2336                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2337                 return True;
2338         }
2339
2340         if (p->rng_fault_state) {
2341                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2342                 p->rng_fault_state = False;
2343                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2344                 return True;
2345         }
2346
2347         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
2348         offset2 = prs_offset(&p->out_data.rdata);
2349         prs_set_offset(&p->out_data.rdata, offset1);
2350         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2351         prs_set_offset(&p->out_data.rdata, offset2);
2352
2353         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
2354
2355         /* Check for buffer underflow in rpc parsing */
2356
2357         if ((DEBUGLEVEL >= 10) &&
2358             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2359                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2360                 char *data = (char *)SMB_MALLOC(data_len);
2361
2362                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2363                 if (data) {
2364                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2365                         SAFE_FREE(data);
2366                 }
2367
2368         }
2369
2370         return True;
2371 }
2372
2373 /*******************************************************************
2374 *******************************************************************/
2375
2376 void get_pipe_fns( int idx, struct api_struct **fns, int *n_fns )
2377 {
2378         struct api_struct *cmds = NULL;
2379         int               n_cmds = 0;
2380
2381         switch ( idx ) {
2382                 case PI_LSARPC:
2383                         lsarpc_get_pipe_fns( &cmds, &n_cmds );
2384                         break;
2385                 case PI_DSSETUP:
2386                         dssetup_get_pipe_fns( &cmds, &n_cmds );
2387                         break;
2388                 case PI_SAMR:
2389                         samr_get_pipe_fns( &cmds, &n_cmds );
2390                         break;
2391                 case PI_NETLOGON:
2392                         netlogon_get_pipe_fns( &cmds, &n_cmds );
2393                         break;
2394                 case PI_SRVSVC:
2395                         srvsvc_get_pipe_fns( &cmds, &n_cmds );
2396                         break;
2397                 case PI_WKSSVC:
2398                         wkssvc_get_pipe_fns( &cmds, &n_cmds );
2399                         break;
2400                 case PI_WINREG:
2401                         winreg_get_pipe_fns( &cmds, &n_cmds );
2402                         break;
2403                 case PI_SPOOLSS:
2404                         spoolss_get_pipe_fns( &cmds, &n_cmds );
2405                         break;
2406                 case PI_NETDFS:
2407                         netdfs_get_pipe_fns( &cmds, &n_cmds );
2408                         break;
2409                 case PI_SVCCTL:
2410                         svcctl2_get_pipe_fns( &cmds, &n_cmds );
2411                         break;
2412                 case PI_EVENTLOG:
2413                         eventlog2_get_pipe_fns( &cmds, &n_cmds );
2414                         break;
2415                 case PI_NTSVCS:
2416                         ntsvcs2_get_pipe_fns( &cmds, &n_cmds );
2417                         break;
2418 #ifdef DEVELOPER
2419                 case PI_RPCECHO:
2420                         rpcecho_get_pipe_fns( &cmds, &n_cmds );
2421                         break;
2422 #endif
2423                 default:
2424                         DEBUG(0,("get_pipe_fns: Unknown pipe index! [%d]\n", idx));
2425         }
2426
2427         *fns = cmds;
2428         *n_fns = n_cmds;
2429
2430         return;
2431 }