source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31
  32 extern struct pipe_id_info pipe_names[];
  33 extern struct current_user current_user;
  34
  35 #undef DBGC_CLASS
  36 #define DBGC_CLASS DBGC_RPC_SRV
  37
  38 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  39 {
  40         AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
  41
  42         if (a) {
  43                 auth_ntlmssp_end(&a);
  44         }
  45         auth->a_u.auth_ntlmssp_state = NULL;
  46 }
  47
  48 static DATA_BLOB generic_session_key(void)
  49 {
  50         return data_blob("SystemLibraryDTC", 16);
  51 }
  52
  53 /*******************************************************************
  54  Generate the next PDU to be returned from the data in p->rdata.
  55  Handle NTLMSSP.
  56  ********************************************************************/
  57
  58 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  59 {
  60         RPC_HDR_RESP hdr_resp;
  61         uint32 ss_padding_len = 0;
  62         uint32 data_space_available;
  63         uint32 data_len_left;
  64         uint32 data_len;
  65         prs_struct outgoing_pdu;
  66         NTSTATUS status;
  67         DATA_BLOB auth_blob;
  68         RPC_HDR_AUTH auth_info;
  69         uint8 auth_type, auth_level;
  70         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
  71
  72         /*
  73          * If we're in the fault state, keep returning fault PDU's until
  74          * the pipe gets closed. JRA.
  75          */
  76
  77         if(p->fault_state) {
  78                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  79                 return True;
  80         }
  81
  82         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  83
  84         /* Change the incoming request header to a response. */
  85         p->hdr.pkt_type = RPC_RESPONSE;
  86
  87         /* Set up rpc header flags. */
  88         if (p->out_data.data_sent_length == 0) {
  89                 p->hdr.flags = RPC_FLG_FIRST;
  90         } else {
  91                 p->hdr.flags = 0;
  92         }
  93
  94         /*
  95          * Work out how much we can fit in a single PDU.
  96          */
  97
  98         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
  99
 100         /*
 101          * Ensure there really is data left to send.
 102          */
 103
 104         if(!data_len_left) {
 105                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 106                 return False;
 107         }
 108
 109         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 110                                         RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 111
 112         /*
 113          * The amount we send is the minimum of the available
 114          * space and the amount left to send.
 115          */
 116
 117         data_len = MIN(data_len_left, data_space_available);
 118
 119         /*
 120          * Set up the alloc hint. This should be the data left to
 121          * send.
 122          */
 123
 124         hdr_resp.alloc_hint = data_len_left;
 125
 126         /*
 127          * Work out if this PDU will be the last.
 128          */
 129
 130         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 131                 p->hdr.flags |= RPC_FLG_LAST;
 132                 if (data_len_left % 8) {
 133                         ss_padding_len = 8 - (data_len_left % 8);
 134                         DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 135                                 ss_padding_len ));
 136                 }
 137         }
 138
 139         /*
 140          * Set up the header lengths.
 141          */
 142
 143         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 144                         data_len + ss_padding_len +
 145                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 146         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 147
 148
 149         /*
 150          * Init the parse struct to point at the outgoing
 151          * data.
 152          */
 153
 154         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 155         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 156
 157         /* Store the header in the data stream. */
 158         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 159                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 160                 prs_mem_free(&outgoing_pdu);
 161                 return False;
 162         }
 163
 164         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 165                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 166                 prs_mem_free(&outgoing_pdu);
 167                 return False;
 168         }
 169
 170         /* Copy the data into the PDU. */
 171
 172         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 173                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 174                 prs_mem_free(&outgoing_pdu);
 175                 return False;
 176         }
 177
 178         /* Copy the sign/seal padding data. */
 179         if (ss_padding_len) {
 180                 char pad[8];
 181
 182                 memset(pad, '\0', 8);
 183                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 184                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 185                                         (unsigned int)ss_padding_len));
 186                         prs_mem_free(&outgoing_pdu);
 187                         return False;
 188                 }
 189         }
 190
 191
 192         /* Now write out the auth header and null blob. */
 193         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 194                 auth_type = RPC_NTLMSSP_AUTH_TYPE;
 195         } else {
 196                 auth_type = RPC_SPNEGO_AUTH_TYPE;
 197         }
 198         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 199                 auth_level = RPC_AUTH_LEVEL_PRIVACY;
 200         } else {
 201                 auth_level = RPC_AUTH_LEVEL_INTEGRITY;
 202         }
 203
 204         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 205         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 206                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 207                 prs_mem_free(&outgoing_pdu);
 208                 return False;
 209         }
 210
 211         /* Generate the sign blob. */
 212
 213         switch (p->auth.auth_level) {
 214                 case PIPE_AUTH_LEVEL_PRIVACY:
 215                         /* Data portion is encrypted. */
 216                         status = ntlmssp_seal_packet(a->ntlmssp_state,
 217                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 218                                                         data_len + ss_padding_len,
 219                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 220                                                         (size_t)prs_offset(&outgoing_pdu),
 221                                                         &auth_blob);
 222                         if (!NT_STATUS_IS_OK(status)) {
 223                                 data_blob_free(&auth_blob);
 224                                 prs_mem_free(&outgoing_pdu);
 225                                 return False;
 226                         }
 227                         break;
 228                 case PIPE_AUTH_LEVEL_INTEGRITY:
 229                         /* Data is signed. */
 230                         status = ntlmssp_sign_packet(a->ntlmssp_state,
 231                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 232                                                         data_len + ss_padding_len,
 233                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 234                                                         (size_t)prs_offset(&outgoing_pdu),
 235                                                         &auth_blob);
 236                         if (!NT_STATUS_IS_OK(status)) {
 237                                 data_blob_free(&auth_blob);
 238                                 prs_mem_free(&outgoing_pdu);
 239                                 return False;
 240                         }
 241                         break;
 242                 default:
 243                         prs_mem_free(&outgoing_pdu);
 244                         return False;
 245         }
 246
 247         /* Append the auth blob. */
 248         if (!prs_copy_data_in(&outgoing_pdu, (char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
 249                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 250                                 (unsigned int)NTLMSSP_SIG_SIZE));
 251                 data_blob_free(&auth_blob);
 252                 prs_mem_free(&outgoing_pdu);
 253                 return False;
 254         }
 255
 256         data_blob_free(&auth_blob);
 257
 258         /*
 259          * Setup the counts for this PDU.
 260          */
 261
 262         p->out_data.data_sent_length += data_len;
 263         p->out_data.current_pdu_len = p->hdr.frag_len;
 264         p->out_data.current_pdu_sent = 0;
 265
 266         prs_mem_free(&outgoing_pdu);
 267         return True;
 268 }
 269
 270 /*******************************************************************
 271  Generate the next PDU to be returned from the data in p->rdata.
 272  Return an schannel authenticated fragment.
 273  ********************************************************************/
 274
 275 static bool create_next_pdu_schannel(pipes_struct *p)
 276 {
 277         RPC_HDR_RESP hdr_resp;
 278         uint32 ss_padding_len = 0;
 279         uint32 data_len;
 280         uint32 data_space_available;
 281         uint32 data_len_left;
 282         prs_struct outgoing_pdu;
 283         uint32 data_pos;
 284
 285         /*
 286          * If we're in the fault state, keep returning fault PDU's until
 287          * the pipe gets closed. JRA.
 288          */
 289
 290         if(p->fault_state) {
 291                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 292                 return True;
 293         }
 294
 295         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 296
 297         /* Change the incoming request header to a response. */
 298         p->hdr.pkt_type = RPC_RESPONSE;
 299
 300         /* Set up rpc header flags. */
 301         if (p->out_data.data_sent_length == 0) {
 302                 p->hdr.flags = RPC_FLG_FIRST;
 303         } else {
 304                 p->hdr.flags = 0;
 305         }
 306
 307         /*
 308          * Work out how much we can fit in a single PDU.
 309          */
 310
 311         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 312
 313         /*
 314          * Ensure there really is data left to send.
 315          */
 316
 317         if(!data_len_left) {
 318                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 319                 return False;
 320         }
 321
 322         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 323                                         RPC_HDR_AUTH_LEN - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 324
 325         /*
 326          * The amount we send is the minimum of the available
 327          * space and the amount left to send.
 328          */
 329
 330         data_len = MIN(data_len_left, data_space_available);
 331
 332         /*
 333          * Set up the alloc hint. This should be the data left to
 334          * send.
 335          */
 336
 337         hdr_resp.alloc_hint = data_len_left;
 338
 339         /*
 340          * Work out if this PDU will be the last.
 341          */
 342
 343         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 344                 p->hdr.flags |= RPC_FLG_LAST;
 345                 if (data_len_left % 8) {
 346                         ss_padding_len = 8 - (data_len_left % 8);
 347                         DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 348                                 ss_padding_len ));
 349                 }
 350         }
 351
 352         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 353                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 354         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 355
 356         /*
 357          * Init the parse struct to point at the outgoing
 358          * data.
 359          */
 360
 361         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 362         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 363
 364         /* Store the header in the data stream. */
 365         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 366                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 367                 prs_mem_free(&outgoing_pdu);
 368                 return False;
 369         }
 370
 371         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 372                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 373                 prs_mem_free(&outgoing_pdu);
 374                 return False;
 375         }
 376
 377         /* Store the current offset. */
 378         data_pos = prs_offset(&outgoing_pdu);
 379
 380         /* Copy the data into the PDU. */
 381
 382         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 383                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 384                 prs_mem_free(&outgoing_pdu);
 385                 return False;
 386         }
 387
 388         /* Copy the sign/seal padding data. */
 389         if (ss_padding_len) {
 390                 char pad[8];
 391                 memset(pad, '\0', 8);
 392                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 393                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 394                         prs_mem_free(&outgoing_pdu);
 395                         return False;
 396                 }
 397         }
 398
 399         {
 400                 /*
 401                  * Schannel processing.
 402                  */
 403                 char *data;
 404                 RPC_HDR_AUTH auth_info;
 405                 RPC_AUTH_SCHANNEL_CHK verf;
 406
 407                 data = prs_data_p(&outgoing_pdu) + data_pos;
 408                 /* Check it's the type of reply we were expecting to decode */
 409
 410                 init_rpc_hdr_auth(&auth_info,
 411                                 RPC_SCHANNEL_AUTH_TYPE,
 412                                 p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY ?
 413                                         RPC_AUTH_LEVEL_PRIVACY : RPC_AUTH_LEVEL_INTEGRITY,
 414                                 ss_padding_len, 1);
 415
 416                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 417                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 418                         prs_mem_free(&outgoing_pdu);
 419                         return False;
 420                 }
 421
 422                 schannel_encode(p->auth.a_u.schannel_auth,
 423                               p->auth.auth_level,
 424                               SENDER_IS_ACCEPTOR,
 425                               &verf, data, data_len + ss_padding_len);
 426
 427                 if (!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 428                                 &verf, &outgoing_pdu, 0)) {
 429                         prs_mem_free(&outgoing_pdu);
 430                         return False;
 431                 }
 432
 433                 p->auth.a_u.schannel_auth->seq_num++;
 434         }
 435
 436         /*
 437          * Setup the counts for this PDU.
 438          */
 439
 440         p->out_data.data_sent_length += data_len;
 441         p->out_data.current_pdu_len = p->hdr.frag_len;
 442         p->out_data.current_pdu_sent = 0;
 443
 444         prs_mem_free(&outgoing_pdu);
 445         return True;
 446 }
 447
 448 /*******************************************************************
 449  Generate the next PDU to be returned from the data in p->rdata.
 450  No authentication done.
 451 ********************************************************************/
 452
 453 static bool create_next_pdu_noauth(pipes_struct *p)
 454 {
 455         RPC_HDR_RESP hdr_resp;
 456         uint32 data_len;
 457         uint32 data_space_available;
 458         uint32 data_len_left;
 459         prs_struct outgoing_pdu;
 460
 461         /*
 462          * If we're in the fault state, keep returning fault PDU's until
 463          * the pipe gets closed. JRA.
 464          */
 465
 466         if(p->fault_state) {
 467                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 468                 return True;
 469         }
 470
 471         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 472
 473         /* Change the incoming request header to a response. */
 474         p->hdr.pkt_type = RPC_RESPONSE;
 475
 476         /* Set up rpc header flags. */
 477         if (p->out_data.data_sent_length == 0) {
 478                 p->hdr.flags = RPC_FLG_FIRST;
 479         } else {
 480                 p->hdr.flags = 0;
 481         }
 482
 483         /*
 484          * Work out how much we can fit in a single PDU.
 485          */
 486
 487         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 488
 489         /*
 490          * Ensure there really is data left to send.
 491          */
 492
 493         if(!data_len_left) {
 494                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 495                 return False;
 496         }
 497
 498         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 499
 500         /*
 501          * The amount we send is the minimum of the available
 502          * space and the amount left to send.
 503          */
 504
 505         data_len = MIN(data_len_left, data_space_available);
 506
 507         /*
 508          * Set up the alloc hint. This should be the data left to
 509          * send.
 510          */
 511
 512         hdr_resp.alloc_hint = data_len_left;
 513
 514         /*
 515          * Work out if this PDU will be the last.
 516          */
 517
 518         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 519                 p->hdr.flags |= RPC_FLG_LAST;
 520         }
 521
 522         /*
 523          * Set up the header lengths.
 524          */
 525
 526         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 527         p->hdr.auth_len = 0;
 528
 529         /*
 530          * Init the parse struct to point at the outgoing
 531          * data.
 532          */
 533
 534         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 535         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 536
 537         /* Store the header in the data stream. */
 538         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 539                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 540                 prs_mem_free(&outgoing_pdu);
 541                 return False;
 542         }
 543
 544         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 545                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 546                 prs_mem_free(&outgoing_pdu);
 547                 return False;
 548         }
 549
 550         /* Copy the data into the PDU. */
 551
 552         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 553                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 554                 prs_mem_free(&outgoing_pdu);
 555                 return False;
 556         }
 557
 558         /*
 559          * Setup the counts for this PDU.
 560          */
 561
 562         p->out_data.data_sent_length += data_len;
 563         p->out_data.current_pdu_len = p->hdr.frag_len;
 564         p->out_data.current_pdu_sent = 0;
 565
 566         prs_mem_free(&outgoing_pdu);
 567         return True;
 568 }
 569
 570 /*******************************************************************
 571  Generate the next PDU to be returned from the data in p->rdata.
 572 ********************************************************************/
 573
 574 bool create_next_pdu(pipes_struct *p)
 575 {
 576         switch(p->auth.auth_level) {
 577                 case PIPE_AUTH_LEVEL_NONE:
 578                 case PIPE_AUTH_LEVEL_CONNECT:
 579                         /* This is incorrect for auth level connect. Fixme. JRA */
 580                         return create_next_pdu_noauth(p);
 581
 582                 default:
 583                         switch(p->auth.auth_type) {
 584                                 case PIPE_AUTH_TYPE_NTLMSSP:
 585                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 586                                         return create_next_pdu_ntlmssp(p);
 587                                 case PIPE_AUTH_TYPE_SCHANNEL:
 588                                         return create_next_pdu_schannel(p);
 589                                 default:
 590                                         break;
 591                         }
 592         }
 593
 594         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 595                         (unsigned int)p->auth.auth_level,
 596                         (unsigned int)p->auth.auth_type));
 597         return False;
 598 }
 599
 600 /*******************************************************************
 601  Process an NTLMSSP authentication response.
 602  If this function succeeds, the user has been authenticated
 603  and their domain, name and calling workstation stored in
 604  the pipe struct.
 605 *******************************************************************/
 606
 607 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 608 {
 609         DATA_BLOB session_key, reply;
 610         NTSTATUS status;
 611         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
 612         bool ret;
 613
 614         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n", p->name));
 615
 616         ZERO_STRUCT(reply);
 617
 618         /* Set up for non-authenticated user. */
 619         TALLOC_FREE(p->pipe_user.nt_user_token);
 620         p->pipe_user.ut.ngroups = 0;
 621         SAFE_FREE( p->pipe_user.ut.groups);
 622
 623         /* this has to be done as root in order to verify the password */
 624         become_root();
 625         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 626         unbecome_root();
 627
 628         /* Don't generate a reply. */
 629         data_blob_free(&reply);
 630
 631         if (!NT_STATUS_IS_OK(status)) {
 632                 return False;
 633         }
 634
 635         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 636            ensure the underlying NTLMSSP flags are also set. If not we should
 637            refuse the bind. */
 638
 639         if (p->auth.auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
 640                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 641                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 642                                 "but client declined signing.\n",
 643                                         p->name ));
 644                         return False;
 645                 }
 646         }
 647         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 648                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
 649                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 650                                 "but client declined sealing.\n",
 651                                         p->name ));
 652                         return False;
 653                 }
 654         }
 655
 656         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 657                   "workstation: %s\n", a->ntlmssp_state->user,
 658                   a->ntlmssp_state->domain, a->ntlmssp_state->workstation));
 659
 660         /*
 661          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 662          */
 663
 664         p->pipe_user.ut.uid = a->server_info->utok.uid;
 665         p->pipe_user.ut.gid = a->server_info->utok.gid;
 666
 667         p->pipe_user.ut.ngroups = a->server_info->utok.ngroups;
 668         if (p->pipe_user.ut.ngroups) {
 669                 if (!(p->pipe_user.ut.groups = (gid_t *)memdup(
 670                               a->server_info->utok.groups,
 671                               sizeof(gid_t) * p->pipe_user.ut.ngroups))) {
 672                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 673                         return False;
 674                 }
 675         }
 676
 677         if (a->server_info->ptok) {
 678                 p->pipe_user.nt_user_token =
 679                         dup_nt_token(NULL, a->server_info->ptok);
 680         } else {
 681                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 682                 p->pipe_user.nt_user_token = NULL;
 683                 return False;
 684         }
 685
 686         TALLOC_FREE(p->server_info);
 687
 688         p->server_info = copy_serverinfo(p, a->server_info);
 689         if (p->server_info == NULL) {
 690                 DEBUG(0, ("copy_serverinfo failed\n"));
 691                 return false;
 692         }
 693
 694         /*
 695          * We're an authenticated bind over smb, so the session key needs to
 696          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 697          * does. See the RPC-SAMBA3SESSIONKEY.
 698          */
 699
 700         session_key = generic_session_key();
 701         if (session_key.data == NULL) {
 702                 return False;
 703         }
 704
 705         ret = server_info_set_session_key(p->server_info, session_key);
 706
 707         data_blob_free(&session_key);
 708
 709         return True;
 710 }
 711
 712 /*******************************************************************
 713  The switch table for the pipe names and the functions to handle them.
 714 *******************************************************************/
 715
 716 struct rpc_table {
 717         struct {
 718                 const char *clnt;
 719                 const char *srv;
 720         } pipe;
 721         struct ndr_syntax_id rpc_interface;
 722         const struct api_struct *cmds;
 723         int n_cmds;
 724 };
 725
 726 static struct rpc_table *rpc_lookup;
 727 static int rpc_lookup_size;
 728
 729 /*******************************************************************
 730  This is the "stage3" NTLMSSP response after a bind request and reply.
 731 *******************************************************************/
 732
 733 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 734 {
 735         RPC_HDR_AUTH auth_info;
 736         uint32 pad;
 737         DATA_BLOB blob;
 738
 739         ZERO_STRUCT(blob);
 740
 741         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 742
 743         if (p->hdr.auth_len == 0) {
 744                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 745                 goto err;
 746         }
 747
 748         /* 4 bytes padding. */
 749         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 750                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 751                 goto err;
 752         }
 753
 754         /*
 755          * Decode the authentication verifier response.
 756          */
 757
 758         if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 759                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
 760                 goto err;
 761         }
 762
 763         if (auth_info.auth_type != RPC_NTLMSSP_AUTH_TYPE) {
 764                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 765                         (unsigned int)auth_info.auth_type ));
 766                 return False;
 767         }
 768
 769         blob = data_blob(NULL,p->hdr.auth_len);
 770
 771         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 772                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 773                         (unsigned int)p->hdr.auth_len ));
 774                 goto err;
 775         }
 776
 777         /*
 778          * The following call actually checks the challenge/response data.
 779          * for correctness against the given DOMAIN\user name.
 780          */
 781
 782         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 783                 goto err;
 784         }
 785
 786         data_blob_free(&blob);
 787
 788         p->pipe_bound = True;
 789
 790         return True;
 791
 792  err:
 793
 794         data_blob_free(&blob);
 795         free_pipe_ntlmssp_auth_data(&p->auth);
 796         p->auth.a_u.auth_ntlmssp_state = NULL;
 797
 798         return False;
 799 }
 800
 801 /*******************************************************************
 802  Marshall a bind_nak pdu.
 803 *******************************************************************/
 804
 805 static bool setup_bind_nak(pipes_struct *p)
 806 {
 807         prs_struct outgoing_rpc;
 808         RPC_HDR nak_hdr;
 809         uint16 zero = 0;
 810
 811         /* Free any memory in the current return data buffer. */
 812         prs_mem_free(&p->out_data.rdata);
 813
 814         /*
 815          * Marshall directly into the outgoing PDU space. We
 816          * must do this as we need to set to the bind response
 817          * header and are never sending more than one PDU here.
 818          */
 819
 820         prs_init_empty( &outgoing_rpc, p->mem_ctx, MARSHALL);
 821         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 822
 823         /*
 824          * Initialize a bind_nak header.
 825          */
 826
 827         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 828                 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 829
 830         /*
 831          * Marshall the header into the outgoing PDU.
 832          */
 833
 834         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 835                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 836                 prs_mem_free(&outgoing_rpc);
 837                 return False;
 838         }
 839
 840         /*
 841          * Now add the reject reason.
 842          */
 843
 844         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 845                 prs_mem_free(&outgoing_rpc);
 846                 return False;
 847         }
 848
 849         p->out_data.data_sent_length = 0;
 850         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 851         p->out_data.current_pdu_sent = 0;
 852
 853         if (p->auth.auth_data_free_func) {
 854                 (*p->auth.auth_data_free_func)(&p->auth);
 855         }
 856         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
 857         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 858         p->pipe_bound = False;
 859
 860         return True;
 861 }
 862
 863 /*******************************************************************
 864  Marshall a fault pdu.
 865 *******************************************************************/
 866
 867 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 868 {
 869         prs_struct outgoing_pdu;
 870         RPC_HDR fault_hdr;
 871         RPC_HDR_RESP hdr_resp;
 872         RPC_HDR_FAULT fault_resp;
 873
 874         /* Free any memory in the current return data buffer. */
 875         prs_mem_free(&p->out_data.rdata);
 876
 877         /*
 878          * Marshall directly into the outgoing PDU space. We
 879          * must do this as we need to set to the bind response
 880          * header and are never sending more than one PDU here.
 881          */
 882
 883         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 884         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 885
 886         /*
 887          * Initialize a fault header.
 888          */
 889
 890         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 891             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 892
 893         /*
 894          * Initialize the HDR_RESP and FAULT parts of the PDU.
 895          */
 896
 897         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 898
 899         fault_resp.status = status;
 900         fault_resp.reserved = 0;
 901
 902         /*
 903          * Marshall the header into the outgoing PDU.
 904          */
 905
 906         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 907                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 908                 prs_mem_free(&outgoing_pdu);
 909                 return False;
 910         }
 911
 912         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 913                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 914                 prs_mem_free(&outgoing_pdu);
 915                 return False;
 916         }
 917
 918         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 919                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 920                 prs_mem_free(&outgoing_pdu);
 921                 return False;
 922         }
 923
 924         p->out_data.data_sent_length = 0;
 925         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 926         p->out_data.current_pdu_sent = 0;
 927
 928         prs_mem_free(&outgoing_pdu);
 929         return True;
 930 }
 931
 932 #if 0
 933 /*******************************************************************
 934  Marshall a cancel_ack pdu.
 935  We should probably check the auth-verifier here.
 936 *******************************************************************/
 937
 938 bool setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
 939 {
 940         prs_struct outgoing_pdu;
 941         RPC_HDR ack_reply_hdr;
 942
 943         /* Free any memory in the current return data buffer. */
 944         prs_mem_free(&p->out_data.rdata);
 945
 946         /*
 947          * Marshall directly into the outgoing PDU space. We
 948          * must do this as we need to set to the bind response
 949          * header and are never sending more than one PDU here.
 950          */
 951
 952         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 953         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 954
 955         /*
 956          * Initialize a cancel_ack header.
 957          */
 958
 959         init_rpc_hdr(&ack_reply_hdr, RPC_CANCEL_ACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 960                         p->hdr.call_id, RPC_HEADER_LEN, 0);
 961
 962         /*
 963          * Marshall the header into the outgoing PDU.
 964          */
 965
 966         if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
 967                 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
 968                 prs_mem_free(&outgoing_pdu);
 969                 return False;
 970         }
 971
 972         p->out_data.data_sent_length = 0;
 973         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 974         p->out_data.current_pdu_sent = 0;
 975
 976         prs_mem_free(&outgoing_pdu);
 977         return True;
 978 }
 979 #endif
 980
 981 /*******************************************************************
 982  Ensure a bind request has the correct abstract & transfer interface.
 983  Used to reject unknown binds from Win2k.
 984 *******************************************************************/
 985
 986 bool check_bind_req(struct pipes_struct *p, RPC_IFACE* abstract,
 987                     RPC_IFACE* transfer, uint32 context_id)
 988 {
 989         char *pipe_name = p->name;
 990         int i=0;
 991         fstring pname;
 992
 993         fstrcpy(pname,"\\PIPE\\");
 994         fstrcat(pname,pipe_name);
 995
 996         DEBUG(3,("check_bind_req for %s\n", pname));
 997
 998         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 999
1000         for ( i=0; pipe_names[i].client_pipe; i++ ) {
1001                 DEBUGADD(10,("checking %s\n", pipe_names[i].client_pipe));
1002                 if ( strequal(pipe_names[i].client_pipe, pname)
1003                         && (abstract->if_version == pipe_names[i].abstr_syntax->if_version)
1004                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax->uuid, sizeof(struct GUID)) == 0)
1005                         && (transfer->if_version == pipe_names[i].trans_syntax->if_version)
1006                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax->uuid, sizeof(struct GUID)) == 0) ) {
1007                         struct api_struct       *fns = NULL;
1008                         int                     n_fns = 0;
1009                         PIPE_RPC_FNS            *context_fns;
1010
1011                         if ( !(context_fns = SMB_MALLOC_P(PIPE_RPC_FNS)) ) {
1012                                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
1013                                 return False;
1014                         }
1015
1016                         /* save the RPC function table associated with this bind */
1017
1018                         get_pipe_fns(i, &fns, &n_fns);
1019
1020                         context_fns->cmds = fns;
1021                         context_fns->n_cmds = n_fns;
1022                         context_fns->context_id = context_id;
1023
1024                         /* add to the list of open contexts */
1025
1026                         DLIST_ADD( p->contexts, context_fns );
1027
1028                         break;
1029                 }
1030         }
1031
1032         if(pipe_names[i].client_pipe == NULL) {
1033                 return False;
1034         }
1035
1036         return True;
1037 }
1038
1039 /*******************************************************************
1040  Register commands to an RPC pipe
1041 *******************************************************************/
1042
1043 NTSTATUS rpc_pipe_register_commands(int version, const char *clnt,
1044                                     const char *srv,
1045                                     const struct ndr_syntax_id *interface,
1046                                     const struct api_struct *cmds, int size)
1047 {
1048         struct rpc_table *rpc_entry;
1049
1050         if (!clnt || !srv || !cmds) {
1051                 return NT_STATUS_INVALID_PARAMETER;
1052         }
1053
1054         if (version != SMB_RPC_INTERFACE_VERSION) {
1055                 DEBUG(0,("Can't register rpc commands!\n"
1056                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1057                          ", while this version of samba uses version %d!\n",
1058                          version,SMB_RPC_INTERFACE_VERSION));
1059                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1060         }
1061
1062         /* TODO:
1063          *
1064          * we still need to make sure that don't register the same commands twice!!!
1065          *
1066          * --metze
1067          */
1068
1069         /* We use a temporary variable because this call can fail and
1070            rpc_lookup will still be valid afterwards.  It could then succeed if
1071            called again later */
1072         rpc_lookup_size++;
1073         rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1074         if (NULL == rpc_entry) {
1075                 rpc_lookup_size--;
1076                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1077                 return NT_STATUS_NO_MEMORY;
1078         } else {
1079                 rpc_lookup = rpc_entry;
1080         }
1081
1082         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1083         ZERO_STRUCTP(rpc_entry);
1084         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1085         rpc_entry->pipe.srv = SMB_STRDUP(srv);
1086         rpc_entry->rpc_interface = *interface;
1087         rpc_entry->cmds = cmds;
1088         rpc_entry->n_cmds = size;
1089
1090         return NT_STATUS_OK;
1091 }
1092
1093 /*******************************************************************
1094  Handle a SPNEGO krb5 bind auth.
1095 *******************************************************************/
1096
1097 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1098                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1099 {
1100         return False;
1101 }
1102
1103 /*******************************************************************
1104  Handle the first part of a SPNEGO bind auth.
1105 *******************************************************************/
1106
1107 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1108                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1109 {
1110         DATA_BLOB blob;
1111         DATA_BLOB secblob;
1112         DATA_BLOB response;
1113         DATA_BLOB chal;
1114         char *OIDs[ASN1_MAX_OIDS];
1115         int i;
1116         NTSTATUS status;
1117         bool got_kerberos_mechanism = false;
1118         AUTH_NTLMSSP_STATE *a = NULL;
1119         RPC_HDR_AUTH auth_info;
1120
1121         ZERO_STRUCT(secblob);
1122         ZERO_STRUCT(chal);
1123         ZERO_STRUCT(response);
1124
1125         /* Grab the SPNEGO blob. */
1126         blob = data_blob(NULL,p->hdr.auth_len);
1127
1128         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1129                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1130                         (unsigned int)p->hdr.auth_len ));
1131                 goto err;
1132         }
1133
1134         if (blob.data[0] != ASN1_APPLICATION(0)) {
1135                 goto err;
1136         }
1137
1138         /* parse out the OIDs and the first sec blob */
1139         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1140                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1141                 goto err;
1142         }
1143
1144         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1145                 got_kerberos_mechanism = true;
1146         }
1147
1148         for (i=0;OIDs[i];i++) {
1149                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1150                 SAFE_FREE(OIDs[i]);
1151         }
1152         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1153
1154         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || lp_use_kerberos_keytab()) ) {
1155                 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1156                 data_blob_free(&secblob);
1157                 data_blob_free(&blob);
1158                 return ret;
1159         }
1160
1161         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1162                 /* Free any previous auth type. */
1163                 free_pipe_ntlmssp_auth_data(&p->auth);
1164         }
1165
1166         if (!got_kerberos_mechanism) {
1167                 /* Initialize the NTLM engine. */
1168                 status = auth_ntlmssp_start(&a);
1169                 if (!NT_STATUS_IS_OK(status)) {
1170                         goto err;
1171                 }
1172
1173                 /*
1174                  * Pass the first security blob of data to it.
1175                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1176                  * which means we need another packet to complete the bind.
1177                  */
1178
1179                 status = auth_ntlmssp_update(a, secblob, &chal);
1180
1181                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1182                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1183                         goto err;
1184                 }
1185
1186                 /* Generate the response blob we need for step 2 of the bind. */
1187                 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1188         } else {
1189                 /*
1190                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1191                  * code to process follow-up packets is not complete
1192                  * yet. JRA.
1193                  */
1194                 response = spnego_gen_auth_response(NULL,
1195                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1196                                         OID_NTLMSSP);
1197         }
1198
1199         /* Copy the blob into the pout_auth parse struct */
1200         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1201         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1202                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1203                 goto err;
1204         }
1205
1206         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1207                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1208                 goto err;
1209         }
1210
1211         p->auth.a_u.auth_ntlmssp_state = a;
1212         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1213         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1214
1215         data_blob_free(&blob);
1216         data_blob_free(&secblob);
1217         data_blob_free(&chal);
1218         data_blob_free(&response);
1219
1220         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1221         return True;
1222
1223  err:
1224
1225         data_blob_free(&blob);
1226         data_blob_free(&secblob);
1227         data_blob_free(&chal);
1228         data_blob_free(&response);
1229
1230         p->auth.a_u.auth_ntlmssp_state = NULL;
1231
1232         return False;
1233 }
1234
1235 /*******************************************************************
1236  Handle the second part of a SPNEGO bind auth.
1237 *******************************************************************/
1238
1239 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1240                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1241 {
1242         RPC_HDR_AUTH auth_info;
1243         DATA_BLOB spnego_blob;
1244         DATA_BLOB auth_blob;
1245         DATA_BLOB auth_reply;
1246         DATA_BLOB response;
1247         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1248
1249         ZERO_STRUCT(spnego_blob);
1250         ZERO_STRUCT(auth_blob);
1251         ZERO_STRUCT(auth_reply);
1252         ZERO_STRUCT(response);
1253
1254         /*
1255          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1256          * fail here as 'a' == NULL.
1257          */
1258         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1259                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1260                 goto err;
1261         }
1262
1263         /* Grab the SPNEGO blob. */
1264         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1265
1266         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1267                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1268                         (unsigned int)p->hdr.auth_len ));
1269                 goto err;
1270         }
1271
1272         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1273                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1274                 goto err;
1275         }
1276
1277         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1278                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1279                 goto err;
1280         }
1281
1282         /*
1283          * The following call actually checks the challenge/response data.
1284          * for correctness against the given DOMAIN\user name.
1285          */
1286
1287         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1288                 goto err;
1289         }
1290
1291         data_blob_free(&spnego_blob);
1292         data_blob_free(&auth_blob);
1293
1294         /* Generate the spnego "accept completed" blob - no incoming data. */
1295         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1296
1297         /* Copy the blob into the pout_auth parse struct */
1298         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1299         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1300                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1301                 goto err;
1302         }
1303
1304         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1305                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1306                 goto err;
1307         }
1308
1309         data_blob_free(&auth_reply);
1310         data_blob_free(&response);
1311
1312         p->pipe_bound = True;
1313
1314         return True;
1315
1316  err:
1317
1318         data_blob_free(&spnego_blob);
1319         data_blob_free(&auth_blob);
1320         data_blob_free(&auth_reply);
1321         data_blob_free(&response);
1322
1323         free_pipe_ntlmssp_auth_data(&p->auth);
1324         p->auth.a_u.auth_ntlmssp_state = NULL;
1325
1326         return False;
1327 }
1328
1329 /*******************************************************************
1330  Handle an schannel bind auth.
1331 *******************************************************************/
1332
1333 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1334                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1335 {
1336         RPC_HDR_AUTH auth_info;
1337         RPC_AUTH_SCHANNEL_NEG neg;
1338         RPC_AUTH_VERIFIER auth_verifier;
1339         bool ret;
1340         struct dcinfo *pdcinfo;
1341         uint32 flags;
1342         DATA_BLOB session_key;
1343
1344         if (!smb_io_rpc_auth_schannel_neg("", &neg, rpc_in_p, 0)) {
1345                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1346                 return False;
1347         }
1348
1349         /*
1350          * The neg.myname key here must match the remote computer name
1351          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1352          * operations that use credentials.
1353          */
1354
1355         become_root();
1356         ret = secrets_restore_schannel_session_info(p->mem_ctx, neg.myname, &pdcinfo);
1357         unbecome_root();
1358
1359         if (!ret) {
1360                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1361                 return False;
1362         }
1363
1364         p->auth.a_u.schannel_auth = talloc(p, struct schannel_auth_struct);
1365         if (!p->auth.a_u.schannel_auth) {
1366                 TALLOC_FREE(pdcinfo);
1367                 return False;
1368         }
1369
1370         memset(p->auth.a_u.schannel_auth->sess_key, 0, sizeof(p->auth.a_u.schannel_auth->sess_key));
1371         memcpy(p->auth.a_u.schannel_auth->sess_key, pdcinfo->sess_key,
1372                         sizeof(pdcinfo->sess_key));
1373
1374         TALLOC_FREE(pdcinfo);
1375
1376         p->auth.a_u.schannel_auth->seq_num = 0;
1377
1378         /*
1379          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1380          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1381          * struct of the person who opened the pipe. I need to test this further. JRA.
1382          *
1383          * VL. As we are mapping this to guest set the generic key
1384          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1385          * W2k3, as it does not allow schannel binds against SAMR and LSA
1386          * anymore.
1387          */
1388
1389         session_key = generic_session_key();
1390         if (session_key.data == NULL) {
1391                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1392                           " key\n"));
1393                 return false;
1394         }
1395
1396         ret = server_info_set_session_key(p->server_info, session_key);
1397
1398         data_blob_free(&session_key);
1399
1400         if (!ret) {
1401                 DEBUG(0, ("server_info_set_session_key failed\n"));
1402                 return false;
1403         }
1404
1405         init_rpc_hdr_auth(&auth_info, RPC_SCHANNEL_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1406         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1407                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1408                 return False;
1409         }
1410
1411         /*** SCHANNEL verifier ***/
1412
1413         init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1414         if(!smb_io_rpc_schannel_verifier("", &auth_verifier, pout_auth, 0)) {
1415                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1416                 return False;
1417         }
1418
1419         prs_align(pout_auth);
1420
1421         flags = 5;
1422         if(!prs_uint32("flags ", pout_auth, 0, &flags)) {
1423                 return False;
1424         }
1425
1426         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1427                 neg.domain, neg.myname));
1428
1429         /* We're finished with this bind - no more packets. */
1430         p->auth.auth_data_free_func = NULL;
1431         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1432
1433         p->pipe_bound = True;
1434
1435         return True;
1436 }
1437
1438 /*******************************************************************
1439  Handle an NTLMSSP bind auth.
1440 *******************************************************************/
1441
1442 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1443                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1444 {
1445         RPC_HDR_AUTH auth_info;
1446         DATA_BLOB blob;
1447         DATA_BLOB response;
1448         NTSTATUS status;
1449         AUTH_NTLMSSP_STATE *a = NULL;
1450
1451         ZERO_STRUCT(blob);
1452         ZERO_STRUCT(response);
1453
1454         /* Grab the NTLMSSP blob. */
1455         blob = data_blob(NULL,p->hdr.auth_len);
1456
1457         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1458                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1459                         (unsigned int)p->hdr.auth_len ));
1460                 goto err;
1461         }
1462
1463         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1464                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1465                 goto err;
1466         }
1467
1468         /* We have an NTLMSSP blob. */
1469         status = auth_ntlmssp_start(&a);
1470         if (!NT_STATUS_IS_OK(status)) {
1471                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1472                         nt_errstr(status) ));
1473                 goto err;
1474         }
1475
1476         status = auth_ntlmssp_update(a, blob, &response);
1477         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1478                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1479                         nt_errstr(status) ));
1480                 goto err;
1481         }
1482
1483         data_blob_free(&blob);
1484
1485         /* Copy the blob into the pout_auth parse struct */
1486         init_rpc_hdr_auth(&auth_info, RPC_NTLMSSP_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1487         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1488                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1489                 goto err;
1490         }
1491
1492         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1493                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1494                 goto err;
1495         }
1496
1497         p->auth.a_u.auth_ntlmssp_state = a;
1498         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1499         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1500
1501         data_blob_free(&blob);
1502         data_blob_free(&response);
1503
1504         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1505
1506         /* We can't set pipe_bound True yet - we need an RPC_AUTH3 response packet... */
1507         return True;
1508
1509   err:
1510
1511         data_blob_free(&blob);
1512         data_blob_free(&response);
1513
1514         free_pipe_ntlmssp_auth_data(&p->auth);
1515         p->auth.a_u.auth_ntlmssp_state = NULL;
1516         return False;
1517 }
1518
1519 /*******************************************************************
1520  Respond to a pipe bind request.
1521 *******************************************************************/
1522
1523 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1524 {
1525         RPC_HDR_BA hdr_ba;
1526         RPC_HDR_RB hdr_rb;
1527         RPC_HDR_AUTH auth_info;
1528         uint16 assoc_gid;
1529         fstring ack_pipe_name;
1530         prs_struct out_hdr_ba;
1531         prs_struct out_auth;
1532         prs_struct outgoing_rpc;
1533         int i = 0;
1534         int auth_len = 0;
1535         unsigned int auth_type = RPC_ANONYMOUS_AUTH_TYPE;
1536
1537         /* No rebinds on a bound pipe - use alter context. */
1538         if (p->pipe_bound) {
1539                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound pipe %s.\n", p->pipe_srv_name));
1540                 return setup_bind_nak(p);
1541         }
1542
1543         prs_init_empty( &outgoing_rpc, p->mem_ctx, MARSHALL);
1544
1545         /*
1546          * Marshall directly into the outgoing PDU space. We
1547          * must do this as we need to set to the bind response
1548          * header and are never sending more than one PDU here.
1549          */
1550
1551         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1552
1553         /*
1554          * Setup the memory to marshall the ba header, and the
1555          * auth footers.
1556          */
1557
1558         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1559                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1560                 prs_mem_free(&outgoing_rpc);
1561                 return False;
1562         }
1563
1564         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1565                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1566                 prs_mem_free(&outgoing_rpc);
1567                 prs_mem_free(&out_hdr_ba);
1568                 return False;
1569         }
1570
1571         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1572
1573         ZERO_STRUCT(hdr_rb);
1574
1575         /* decode the bind request */
1576
1577         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1578                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB "
1579                          "struct.\n"));
1580                 goto err_exit;
1581         }
1582
1583         if (hdr_rb.num_contexts == 0) {
1584                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1585                 goto err_exit;
1586         }
1587
1588         /*
1589          * Try and find the correct pipe name to ensure
1590          * that this is a pipe name we support.
1591          */
1592
1593         for (i = 0; i < rpc_lookup_size; i++) {
1594                 if (ndr_syntax_id_equal(&rpc_lookup[i].rpc_interface,
1595                                         &hdr_rb.rpc_context[0].abstract)) {
1596                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1597                                 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1598                         fstrcpy(p->name, rpc_lookup[i].pipe.clnt);
1599                         fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1600                         break;
1601                 }
1602         }
1603
1604         if (i == rpc_lookup_size) {
1605                 if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) {
1606                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1607                                 p->name ));
1608                         prs_mem_free(&outgoing_rpc);
1609                         prs_mem_free(&out_hdr_ba);
1610                         prs_mem_free(&out_auth);
1611
1612                         return setup_bind_nak(p);
1613                 }
1614
1615                 for (i = 0; i < rpc_lookup_size; i++) {
1616                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1617                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1618                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1619                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1620                                break;
1621                        }
1622                 }
1623
1624                 if (i == rpc_lookup_size) {
1625                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
1626                         goto err_exit;
1627                 }
1628         }
1629
1630         /* name has to be \PIPE\xxxxx */
1631         fstrcpy(ack_pipe_name, "\\PIPE\\");
1632         fstrcat(ack_pipe_name, p->pipe_srv_name);
1633
1634         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1635
1636         /*
1637          * Check if this is an authenticated bind request.
1638          */
1639
1640         if (p->hdr.auth_len) {
1641                 /*
1642                  * Decode the authentication verifier.
1643                  */
1644
1645                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1646                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1647                         goto err_exit;
1648                 }
1649
1650                 auth_type = auth_info.auth_type;
1651
1652                 /* Work out if we have to sign or seal etc. */
1653                 switch (auth_info.auth_level) {
1654                         case RPC_AUTH_LEVEL_INTEGRITY:
1655                                 p->auth.auth_level = PIPE_AUTH_LEVEL_INTEGRITY;
1656                                 break;
1657                         case RPC_AUTH_LEVEL_PRIVACY:
1658                                 p->auth.auth_level = PIPE_AUTH_LEVEL_PRIVACY;
1659                                 break;
1660                         default:
1661                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1662                                         (unsigned int)auth_info.auth_level ));
1663                                 goto err_exit;
1664                 }
1665         } else {
1666                 ZERO_STRUCT(auth_info);
1667         }
1668
1669         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1670
1671         switch(auth_type) {
1672                 case RPC_NTLMSSP_AUTH_TYPE:
1673                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1674                                 goto err_exit;
1675                         }
1676                         assoc_gid = 0x7a77;
1677                         break;
1678
1679                 case RPC_SCHANNEL_AUTH_TYPE:
1680                         if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1681                                 goto err_exit;
1682                         }
1683                         break;
1684
1685                 case RPC_SPNEGO_AUTH_TYPE:
1686                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1687                                 goto err_exit;
1688                         }
1689                         break;
1690
1691                 case RPC_ANONYMOUS_AUTH_TYPE:
1692                         /* Unauthenticated bind request. */
1693                         /* Get the authenticated pipe user from current_user */
1694                         if (!copy_current_user(&p->pipe_user, &current_user)) {
1695                                 DEBUG(10, ("Could not copy current user\n"));
1696                                 goto err_exit;
1697                         }
1698                         /* We're finished - no more packets. */
1699                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1700                         /* We must set the pipe auth_level here also. */
1701                         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
1702                         p->pipe_bound = True;
1703                         /* The session key was initialized from the SMB
1704                          * session in make_internal_rpc_pipe_p */
1705                         break;
1706
1707                 default:
1708                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1709                         goto err_exit;
1710         }
1711
1712         /*
1713          * Create the bind response struct.
1714          */
1715
1716         /* If the requested abstract synt uuid doesn't match our client pipe,
1717                 reject the bind_ack & set the transfer interface synt to all 0's,
1718                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1719                 unknown to NT4)
1720                 Needed when adding entries to a DACL from NT5 - SK */
1721
1722         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1723                                 hdr_rb.rpc_context[0].context_id )) {
1724                 init_rpc_hdr_ba(&hdr_ba,
1725                         RPC_MAX_PDU_FRAG_LEN,
1726                         RPC_MAX_PDU_FRAG_LEN,
1727                         assoc_gid,
1728                         ack_pipe_name,
1729                         0x1, 0x0, 0x0,
1730                         &hdr_rb.rpc_context[0].transfer[0]);
1731         } else {
1732                 RPC_IFACE null_interface;
1733                 ZERO_STRUCT(null_interface);
1734                 /* Rejection reason: abstract syntax not supported */
1735                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1736                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1737                                         ack_pipe_name, 0x1, 0x2, 0x1,
1738                                         &null_interface);
1739                 p->pipe_bound = False;
1740         }
1741
1742         /*
1743          * and marshall it.
1744          */
1745
1746         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1747                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1748                 goto err_exit;
1749         }
1750
1751         /*
1752          * Create the header, now we know the length.
1753          */
1754
1755         if (prs_offset(&out_auth)) {
1756                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1757         }
1758
1759         init_rpc_hdr(&p->hdr, RPC_BINDACK, RPC_FLG_FIRST | RPC_FLG_LAST,
1760                         p->hdr.call_id,
1761                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1762                         auth_len);
1763
1764         /*
1765          * Marshall the header into the outgoing PDU.
1766          */
1767
1768         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1769                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1770                 goto err_exit;
1771         }
1772
1773         /*
1774          * Now add the RPC_HDR_BA and any auth needed.
1775          */
1776
1777         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1778                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1779                 goto err_exit;
1780         }
1781
1782         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1783                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1784                 goto err_exit;
1785         }
1786
1787         /*
1788          * Setup the lengths for the initial reply.
1789          */
1790
1791         p->out_data.data_sent_length = 0;
1792         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1793         p->out_data.current_pdu_sent = 0;
1794
1795         prs_mem_free(&out_hdr_ba);
1796         prs_mem_free(&out_auth);
1797
1798         return True;
1799
1800   err_exit:
1801
1802         prs_mem_free(&outgoing_rpc);
1803         prs_mem_free(&out_hdr_ba);
1804         prs_mem_free(&out_auth);
1805         return setup_bind_nak(p);
1806 }
1807
1808 /****************************************************************************
1809  Deal with an alter context call. Can be third part of 3 leg auth request for
1810  SPNEGO calls.
1811 ****************************************************************************/
1812
1813 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1814 {
1815         RPC_HDR_BA hdr_ba;
1816         RPC_HDR_RB hdr_rb;
1817         RPC_HDR_AUTH auth_info;
1818         uint16 assoc_gid;
1819         fstring ack_pipe_name;
1820         prs_struct out_hdr_ba;
1821         prs_struct out_auth;
1822         prs_struct outgoing_rpc;
1823         int auth_len = 0;
1824
1825         prs_init_empty( &outgoing_rpc, p->mem_ctx, MARSHALL);
1826
1827         /*
1828          * Marshall directly into the outgoing PDU space. We
1829          * must do this as we need to set to the bind response
1830          * header and are never sending more than one PDU here.
1831          */
1832
1833         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1834
1835         /*
1836          * Setup the memory to marshall the ba header, and the
1837          * auth footers.
1838          */
1839
1840         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1841                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1842                 prs_mem_free(&outgoing_rpc);
1843                 return False;
1844         }
1845
1846         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1847                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1848                 prs_mem_free(&outgoing_rpc);
1849                 prs_mem_free(&out_hdr_ba);
1850                 return False;
1851         }
1852
1853         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1854
1855         /* decode the alter context request */
1856         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1857                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1858                 goto err_exit;
1859         }
1860
1861         /* secondary address CAN be NULL
1862          * as the specs say it's ignored.
1863          * It MUST be NULL to have the spoolss working.
1864          */
1865         fstrcpy(ack_pipe_name,"");
1866
1867         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1868
1869         /*
1870          * Check if this is an authenticated alter context request.
1871          */
1872
1873         if (p->hdr.auth_len != 0) {
1874                 /*
1875                  * Decode the authentication verifier.
1876                  */
1877
1878                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1879                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1880                         goto err_exit;
1881                 }
1882
1883                 /*
1884                  * Currently only the SPNEGO auth type uses the alter ctx
1885                  * response in place of the NTLMSSP auth3 type.
1886                  */
1887
1888                 if (auth_info.auth_type == RPC_SPNEGO_AUTH_TYPE) {
1889                         /* We can only finish if the pipe is unbound. */
1890                         if (!p->pipe_bound) {
1891                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1892                                         goto err_exit;
1893                                 }
1894                         } else {
1895                                 goto err_exit;
1896                         }
1897                 }
1898         } else {
1899                 ZERO_STRUCT(auth_info);
1900         }
1901
1902         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1903
1904         /*
1905          * Create the bind response struct.
1906          */
1907
1908         /* If the requested abstract synt uuid doesn't match our client pipe,
1909                 reject the bind_ack & set the transfer interface synt to all 0's,
1910                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1911                 unknown to NT4)
1912                 Needed when adding entries to a DACL from NT5 - SK */
1913
1914         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1915                                 hdr_rb.rpc_context[0].context_id )) {
1916                 init_rpc_hdr_ba(&hdr_ba,
1917                         RPC_MAX_PDU_FRAG_LEN,
1918                         RPC_MAX_PDU_FRAG_LEN,
1919                         assoc_gid,
1920                         ack_pipe_name,
1921                         0x1, 0x0, 0x0,
1922                         &hdr_rb.rpc_context[0].transfer[0]);
1923         } else {
1924                 RPC_IFACE null_interface;
1925                 ZERO_STRUCT(null_interface);
1926                 /* Rejection reason: abstract syntax not supported */
1927                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1928                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1929                                         ack_pipe_name, 0x1, 0x2, 0x1,
1930                                         &null_interface);
1931                 p->pipe_bound = False;
1932         }
1933
1934         /*
1935          * and marshall it.
1936          */
1937
1938         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1939                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1940                 goto err_exit;
1941         }
1942
1943         /*
1944          * Create the header, now we know the length.
1945          */
1946
1947         if (prs_offset(&out_auth)) {
1948                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1949         }
1950
1951         init_rpc_hdr(&p->hdr, RPC_ALTCONTRESP, RPC_FLG_FIRST | RPC_FLG_LAST,
1952                         p->hdr.call_id,
1953                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1954                         auth_len);
1955
1956         /*
1957          * Marshall the header into the outgoing PDU.
1958          */
1959
1960         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1961                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
1962                 goto err_exit;
1963         }
1964
1965         /*
1966          * Now add the RPC_HDR_BA and any auth needed.
1967          */
1968
1969         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1970                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
1971                 goto err_exit;
1972         }
1973
1974         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1975                 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
1976                 goto err_exit;
1977         }
1978
1979         /*
1980          * Setup the lengths for the initial reply.
1981          */
1982
1983         p->out_data.data_sent_length = 0;
1984         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1985         p->out_data.current_pdu_sent = 0;
1986
1987         prs_mem_free(&out_hdr_ba);
1988         prs_mem_free(&out_auth);
1989
1990         return True;
1991
1992   err_exit:
1993
1994         prs_mem_free(&outgoing_rpc);
1995         prs_mem_free(&out_hdr_ba);
1996         prs_mem_free(&out_auth);
1997         return setup_bind_nak(p);
1998 }
1999
2000 /****************************************************************************
2001  Deal with NTLMSSP sign & seal processing on an RPC request.
2002 ****************************************************************************/
2003
2004 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
2005                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
2006 {
2007         RPC_HDR_AUTH auth_info;
2008         uint32 auth_len = p->hdr.auth_len;
2009         uint32 save_offset = prs_offset(rpc_in);
2010         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
2011         unsigned char *data = NULL;
2012         size_t data_len;
2013         unsigned char *full_packet_data = NULL;
2014         size_t full_packet_data_len;
2015         DATA_BLOB auth_blob;
2016
2017         *pstatus = NT_STATUS_OK;
2018
2019         if (p->auth.auth_level == PIPE_AUTH_LEVEL_NONE || p->auth.auth_level == PIPE_AUTH_LEVEL_CONNECT) {
2020                 return True;
2021         }
2022
2023         if (!a) {
2024                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2025                 return False;
2026         }
2027
2028         /* Ensure there's enough data for an authenticated request. */
2029         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
2030                         (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
2031                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2032                         (unsigned int)auth_len ));
2033                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2034                 return False;
2035         }
2036
2037         /*
2038          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2039          * after the RPC header.
2040          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2041          * functions as NTLMv2 checks the rpc headers also.
2042          */
2043
2044         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2045         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2046
2047         full_packet_data = p->in_data.current_in_pdu;
2048         full_packet_data_len = p->hdr.frag_len - auth_len;
2049
2050         /* Pull the auth header and the following data into a blob. */
2051         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2052                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
2053                         (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
2054                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2055                 return False;
2056         }
2057
2058         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2059                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
2060                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2061                 return False;
2062         }
2063
2064         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2065         auth_blob.length = auth_len;
2066
2067         switch (p->auth.auth_level) {
2068                 case PIPE_AUTH_LEVEL_PRIVACY:
2069                         /* Data is encrypted. */
2070                         *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
2071                                                         data, data_len,
2072                                                         full_packet_data,
2073                                                         full_packet_data_len,
2074                                                         &auth_blob);
2075                         if (!NT_STATUS_IS_OK(*pstatus)) {
2076                                 return False;
2077                         }
2078                         break;
2079                 case PIPE_AUTH_LEVEL_INTEGRITY:
2080                         /* Data is signed. */
2081                         *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
2082                                                         data, data_len,
2083                                                         full_packet_data,
2084                                                         full_packet_data_len,
2085                                                         &auth_blob);
2086                         if (!NT_STATUS_IS_OK(*pstatus)) {
2087                                 return False;
2088                         }
2089                         break;
2090                 default:
2091                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2092                         return False;
2093         }
2094
2095         /*
2096          * Return the current pointer to the data offset.
2097          */
2098
2099         if(!prs_set_offset(rpc_in, save_offset)) {
2100                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2101                         (unsigned int)save_offset ));
2102                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2103                 return False;
2104         }
2105
2106         /*
2107          * Remember the padding length. We must remove it from the real data
2108          * stream once the sign/seal is done.
2109          */
2110
2111         *p_ss_padding_len = auth_info.auth_pad_len;
2112
2113         return True;
2114 }
2115
2116 /****************************************************************************
2117  Deal with schannel processing on an RPC request.
2118 ****************************************************************************/
2119
2120 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2121 {
2122         uint32 data_len;
2123         uint32 auth_len;
2124         uint32 save_offset = prs_offset(rpc_in);
2125         RPC_HDR_AUTH auth_info;
2126         RPC_AUTH_SCHANNEL_CHK schannel_chk;
2127
2128         auth_len = p->hdr.auth_len;
2129
2130         if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
2131                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2132                 return False;
2133         }
2134
2135         /*
2136          * The following is that length of the data we must verify or unseal.
2137          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2138          * preceeding the auth_data.
2139          */
2140
2141         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2142                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2143                         (unsigned int)p->hdr.frag_len,
2144                         (unsigned int)auth_len ));
2145                 return False;
2146         }
2147
2148         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2149                 RPC_HDR_AUTH_LEN - auth_len;
2150
2151         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2152
2153         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2154                 DEBUG(0,("cannot move offset to %u.\n",
2155                          (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2156                 return False;
2157         }
2158
2159         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2160                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2161                 return False;
2162         }
2163
2164         if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
2165                 DEBUG(0,("Invalid auth info %d on schannel\n",
2166                          auth_info.auth_type));
2167                 return False;
2168         }
2169
2170         if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN, &schannel_chk, rpc_in, 0)) {
2171                 DEBUG(0,("failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
2172                 return False;
2173         }
2174
2175         if (!schannel_decode(p->auth.a_u.schannel_auth,
2176                            p->auth.auth_level,
2177                            SENDER_IS_INITIATOR,
2178                            &schannel_chk,
2179                            prs_data_p(rpc_in)+RPC_HDR_REQ_LEN, data_len)) {
2180                 DEBUG(3,("failed to decode PDU\n"));
2181                 return False;
2182         }
2183
2184         /*
2185          * Return the current pointer to the data offset.
2186          */
2187
2188         if(!prs_set_offset(rpc_in, save_offset)) {
2189                 DEBUG(0,("failed to set offset back to %u\n",
2190                          (unsigned int)save_offset ));
2191                 return False;
2192         }
2193
2194         /* The sequence number gets incremented on both send and receive. */
2195         p->auth.a_u.schannel_auth->seq_num++;
2196
2197         /*
2198          * Remember the padding length. We must remove it from the real data
2199          * stream once the sign/seal is done.
2200          */
2201
2202         *p_ss_padding_len = auth_info.auth_pad_len;
2203
2204         return True;
2205 }
2206
2207 /****************************************************************************
2208  Return a user struct for a pipe user.
2209 ****************************************************************************/
2210
2211 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
2212 {
2213         if (p->pipe_bound &&
2214                         (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP ||
2215                         (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2216                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
2217         } else {
2218                 memcpy(user, &current_user, sizeof(struct current_user));
2219         }
2220
2221         return user;
2222 }
2223
2224 /****************************************************************************
2225  Find the set of RPC functions associated with this context_id
2226 ****************************************************************************/
2227
2228 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2229 {
2230         PIPE_RPC_FNS *fns = NULL;
2231         PIPE_RPC_FNS *tmp = NULL;
2232
2233         if ( !list ) {
2234                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2235                 return NULL;
2236         }
2237
2238         for (tmp=list; tmp; tmp=tmp->next ) {
2239                 if ( tmp->context_id == context_id )
2240                         break;
2241         }
2242
2243         fns = tmp;
2244
2245         return fns;
2246 }
2247
2248 /****************************************************************************
2249  Memory cleanup.
2250 ****************************************************************************/
2251
2252 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2253 {
2254         PIPE_RPC_FNS *tmp = list;
2255         PIPE_RPC_FNS *tmp2;
2256
2257         while (tmp) {
2258                 tmp2 = tmp->next;
2259                 SAFE_FREE(tmp);
2260                 tmp = tmp2;
2261         }
2262
2263         return;
2264 }
2265
2266 /****************************************************************************
2267  Find the correct RPC function to call for this request.
2268  If the pipe is authenticated then become the correct UNIX user
2269  before doing the call.
2270 ****************************************************************************/
2271
2272 bool api_pipe_request(pipes_struct *p)
2273 {
2274         bool ret = False;
2275         bool changed_user = False;
2276         PIPE_RPC_FNS *pipe_fns;
2277
2278         if (p->pipe_bound &&
2279                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2280                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2281                 if(!become_authenticated_pipe_user(p)) {
2282                         prs_mem_free(&p->out_data.rdata);
2283                         return False;
2284                 }
2285                 changed_user = True;
2286         }
2287
2288         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
2289
2290         /* get the set of RPC functions for this context */
2291
2292         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2293
2294         if ( pipe_fns ) {
2295                 TALLOC_CTX *frame = talloc_stackframe();
2296                 ret = api_rpcTNP(p, p->name, pipe_fns->cmds, pipe_fns->n_cmds);
2297                 TALLOC_FREE(frame);
2298         }
2299         else {
2300                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2301                         p->hdr_req.context_id, p->name));
2302         }
2303
2304         if (changed_user) {
2305                 unbecome_authenticated_pipe_user();
2306         }
2307
2308         return ret;
2309 }
2310
2311 /*******************************************************************
2312  Calls the underlying RPC function for a named pipe.
2313  ********************************************************************/
2314
2315 bool api_rpcTNP(pipes_struct *p, const char *rpc_name,
2316                 const struct api_struct *api_rpc_cmds, int n_cmds)
2317 {
2318         int fn_num;
2319         fstring name;
2320         uint32 offset1, offset2;
2321
2322         /* interpret the command */
2323         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
2324
2325         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
2326         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2327
2328         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2329                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2330                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2331                         break;
2332                 }
2333         }
2334
2335         if (fn_num == n_cmds) {
2336                 /*
2337                  * For an unknown RPC just return a fault PDU but
2338                  * return True to allow RPC's on the pipe to continue
2339                  * and not put the pipe into fault state. JRA.
2340                  */
2341                 DEBUG(4, ("unknown\n"));
2342                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2343                 return True;
2344         }
2345
2346         offset1 = prs_offset(&p->out_data.rdata);
2347
2348         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2349                 fn_num, api_rpc_cmds[fn_num].fn));
2350         /* do the actual command */
2351         if(!api_rpc_cmds[fn_num].fn(p)) {
2352                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
2353                 prs_mem_free(&p->out_data.rdata);
2354                 return False;
2355         }
2356
2357         if (p->bad_handle_fault_state) {
2358                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2359                 p->bad_handle_fault_state = False;
2360                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2361                 return True;
2362         }
2363
2364         if (p->rng_fault_state) {
2365                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2366                 p->rng_fault_state = False;
2367                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2368                 return True;
2369         }
2370
2371         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
2372         offset2 = prs_offset(&p->out_data.rdata);
2373         prs_set_offset(&p->out_data.rdata, offset1);
2374         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2375         prs_set_offset(&p->out_data.rdata, offset2);
2376
2377         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
2378
2379         /* Check for buffer underflow in rpc parsing */
2380
2381         if ((DEBUGLEVEL >= 10) &&
2382             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2383                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2384                 char *data = (char *)SMB_MALLOC(data_len);
2385
2386                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2387                 if (data) {
2388                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2389                         SAFE_FREE(data);
2390                 }
2391
2392         }
2393
2394         return True;
2395 }
2396
2397 /*******************************************************************
2398 *******************************************************************/
2399
2400 void get_pipe_fns( int idx, struct api_struct **fns, int *n_fns )
2401 {
2402         struct api_struct *cmds = NULL;
2403         int               n_cmds = 0;
2404
2405         switch ( idx ) {
2406                 case PI_LSARPC:
2407                         lsarpc_get_pipe_fns( &cmds, &n_cmds );
2408                         break;
2409                 case PI_DSSETUP:
2410                         dssetup_get_pipe_fns( &cmds, &n_cmds );
2411                         break;
2412                 case PI_SAMR:
2413                         samr_get_pipe_fns( &cmds, &n_cmds );
2414                         break;
2415                 case PI_NETLOGON:
2416                         netlogon_get_pipe_fns( &cmds, &n_cmds );
2417                         break;
2418                 case PI_SRVSVC:
2419                         srvsvc_get_pipe_fns( &cmds, &n_cmds );
2420                         break;
2421                 case PI_WKSSVC:
2422                         wkssvc_get_pipe_fns( &cmds, &n_cmds );
2423                         break;
2424                 case PI_WINREG:
2425                         winreg_get_pipe_fns( &cmds, &n_cmds );
2426                         break;
2427                 case PI_SPOOLSS:
2428                         spoolss_get_pipe_fns( &cmds, &n_cmds );
2429                         break;
2430                 case PI_NETDFS:
2431                         netdfs_get_pipe_fns( &cmds, &n_cmds );
2432                         break;
2433                 case PI_SVCCTL:
2434                         svcctl2_get_pipe_fns( &cmds, &n_cmds );
2435                         break;
2436                 case PI_EVENTLOG:
2437                         eventlog2_get_pipe_fns( &cmds, &n_cmds );
2438                         break;
2439                 case PI_NTSVCS:
2440                         ntsvcs2_get_pipe_fns( &cmds, &n_cmds );
2441                         break;
2442 #ifdef DEVELOPER
2443                 case PI_RPCECHO:
2444                         rpcecho_get_pipe_fns( &cmds, &n_cmds );
2445                         break;
2446 #endif
2447                 default:
2448                         DEBUG(0,("get_pipe_fns: Unknown pipe index! [%d]\n", idx));
2449         }
2450
2451         *fns = cmds;
2452         *n_fns = n_cmds;
2453
2454         return;
2455 }