source/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1998
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   6  *  Copyright (C) Paul Ashton                  1997-1998,
   7  *  Copyright (C) Jeremy Allison                    1999,
   8  *  Copyright (C) Anthony Liguori                   2003.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25 /*  this module apparently provides an implementation of DCE/RPC over a
  26  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  27  *  documentation are available (in on-line form) from the X-Open group.
  28  *
  29  *  this module should provide a level of abstraction between SMB
  30  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  31  *  data copies, and network traffic.
  32  *
  33  *  in this version, which takes a "let's learn what's going on and
  34  *  get something running" approach, there is additional network
  35  *  traffic generated, but the code should be easier to understand...
  36  *
  37  *  ... if you read the docs.  or stare at packets for weeks on end.
  38  *
  39  */
  40
  41 #include "includes.h"
  42
  43 #undef DBGC_CLASS
  44 #define DBGC_CLASS DBGC_RPC_SRV
  45
  46 static void NTLMSSPcalc_p( pipes_struct *p, unsigned char *data, int len)
  47 {
  48     unsigned char *hash = p->ntlmssp_hash;
  49     unsigned char index_i = hash[256];
  50     unsigned char index_j = hash[257];
  51     int ind;
  52
  53     for( ind = 0; ind < len; ind++) {
  54         unsigned char tc;
  55         unsigned char t;
  56
  57         index_i++;
  58         index_j += hash[index_i];
  59
  60         tc = hash[index_i];
  61         hash[index_i] = hash[index_j];
  62         hash[index_j] = tc;
  63
  64         t = hash[index_i] + hash[index_j];
  65         data[ind] = data[ind] ^ hash[t];
  66     }
  67
  68     hash[256] = index_i;
  69     hash[257] = index_j;
  70 }
  71
  72 /*******************************************************************
  73  Generate the next PDU to be returned from the data in p->rdata.
  74  We cheat here as this function doesn't handle the special auth
  75  footers of the authenticated bind response reply.
  76  ********************************************************************/
  77
  78 BOOL create_next_pdu(pipes_struct *p)
  79 {
  80         RPC_HDR_RESP hdr_resp;
  81         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
  82         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
  83         uint32 data_len;
  84         uint32 data_space_available;
  85         uint32 data_len_left;
  86         prs_struct outgoing_pdu;
  87         uint32 data_pos;
  88
  89         /*
  90          * If we're in the fault state, keep returning fault PDU's until
  91          * the pipe gets closed. JRA.
  92          */
  93
  94         if(p->fault_state) {
  95                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
  96                 return True;
  97         }
  98
  99         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 100
 101         /* Change the incoming request header to a response. */
 102         p->hdr.pkt_type = RPC_RESPONSE;
 103
 104         /* Set up rpc header flags. */
 105         if (p->out_data.data_sent_length == 0)
 106                 p->hdr.flags = RPC_FLG_FIRST;
 107         else
 108                 p->hdr.flags = 0;
 109
 110         /*
 111          * Work out how much we can fit in a single PDU.
 112          */
 113
 114         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 115         if(p->ntlmssp_auth_validated)
 116                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN);
 117
 118         /*
 119          * The amount we send is the minimum of the available
 120          * space and the amount left to send.
 121          */
 122
 123         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 124
 125         /*
 126          * Ensure there really is data left to send.
 127          */
 128
 129         if(!data_len_left) {
 130                 DEBUG(0,("create_next_pdu: no data left to send !\n"));
 131                 return False;
 132         }
 133
 134         data_len = MIN(data_len_left, data_space_available);
 135
 136         /*
 137          * Set up the alloc hint. This should be the data left to
 138          * send.
 139          */
 140
 141         hdr_resp.alloc_hint = data_len_left;
 142
 143         /*
 144          * Set up the header lengths.
 145          */
 146
 147         if (p->ntlmssp_auth_validated) {
 148                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
 149                                         RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN;
 150                 p->hdr.auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 151         } else {
 152                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 153                 p->hdr.auth_len = 0;
 154         }
 155
 156         /*
 157          * Work out if this PDU will be the last.
 158          */
 159
 160         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata))
 161                 p->hdr.flags |= RPC_FLG_LAST;
 162
 163         /*
 164          * Init the parse struct to point at the outgoing
 165          * data.
 166          */
 167
 168         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 169         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 170
 171         /* Store the header in the data stream. */
 172         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 173                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR.\n"));
 174                 prs_mem_free(&outgoing_pdu);
 175                 return False;
 176         }
 177
 178         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 179                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_RESP.\n"));
 180                 prs_mem_free(&outgoing_pdu);
 181                 return False;
 182         }
 183
 184         /* Store the current offset. */
 185         data_pos = prs_offset(&outgoing_pdu);
 186
 187         /* Copy the data into the PDU. */
 188
 189         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 190                 DEBUG(0,("create_next_pdu: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 191                 prs_mem_free(&outgoing_pdu);
 192                 return False;
 193         }
 194
 195         if (p->hdr.auth_len > 0) {
 196                 uint32 crc32 = 0;
 197                 char *data;
 198
 199                 DEBUG(5,("create_next_pdu: sign: %s seal: %s data %d auth %d\n",
 200                          BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, p->hdr.auth_len));
 201
 202                 /*
 203                  * Set data to point to where we copied the data into.
 204                  */
 205
 206                 data = prs_data_p(&outgoing_pdu) + data_pos;
 207
 208                 if (auth_seal) {
 209                         crc32 = crc32_calc_buffer(data, data_len);
 210                         NTLMSSPcalc_p(p, (uchar*)data, data_len);
 211                 }
 212
 213                 if (auth_seal || auth_verify) {
 214                         RPC_HDR_AUTH auth_info;
 215
 216                         init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL,
 217                                         (auth_verify ? RPC_HDR_AUTH_LEN : 0), (auth_verify ? 1 : 0));
 218                         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 219                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 220                                 prs_mem_free(&outgoing_pdu);
 221                                 return False;
 222                         }
 223                 }
 224
 225                 if (auth_verify) {
 226                         RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
 227                         char *auth_data = prs_data_p(&outgoing_pdu);
 228
 229                         p->ntlmssp_seq_num++;
 230                         init_rpc_auth_ntlmssp_chk(&ntlmssp_chk, NTLMSSP_SIGN_VERSION,
 231                                         crc32, p->ntlmssp_seq_num++);
 232                         auth_data = prs_data_p(&outgoing_pdu) + prs_offset(&outgoing_pdu) + 4;
 233                         if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, &outgoing_pdu, 0)) {
 234                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_AUTH_NTLMSSP_CHK.\n"));
 235                                 prs_mem_free(&outgoing_pdu);
 236                                 return False;
 237                         }
 238                         NTLMSSPcalc_p(p, (uchar*)auth_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 239                 }
 240         }
 241
 242         /*
 243          * Setup the counts for this PDU.
 244          */
 245
 246         p->out_data.data_sent_length += data_len;
 247         p->out_data.current_pdu_len = p->hdr.frag_len;
 248         p->out_data.current_pdu_sent = 0;
 249
 250         prs_mem_free(&outgoing_pdu);
 251         return True;
 252 }
 253
 254 /*******************************************************************
 255  Process an NTLMSSP authentication response.
 256  If this function succeeds, the user has been authenticated
 257  and their domain, name and calling workstation stored in
 258  the pipe struct.
 259  The initial challenge is stored in p->challenge.
 260  *******************************************************************/
 261
 262 static BOOL api_pipe_ntlmssp_verify(pipes_struct *p, RPC_AUTH_NTLMSSP_RESP *ntlmssp_resp)
 263 {
 264         uchar lm_owf[24];
 265         uchar nt_owf[128];
 266         int nt_pw_len;
 267         int lm_pw_len;
 268         fstring user_name;
 269         fstring domain;
 270         fstring wks;
 271
 272         NTSTATUS nt_status;
 273
 274         struct auth_context *auth_context = NULL;
 275         auth_usersupplied_info *user_info = NULL;
 276         auth_serversupplied_info *server_info = NULL;
 277
 278         DEBUG(5,("api_pipe_ntlmssp_verify: checking user details\n"));
 279
 280         memset(p->user_name, '\0', sizeof(p->user_name));
 281         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 282         memset(p->domain, '\0', sizeof(p->domain));
 283         memset(p->wks, '\0', sizeof(p->wks));
 284
 285         /* Set up for non-authenticated user. */
 286         delete_nt_token(&p->pipe_user.nt_user_token);
 287         p->pipe_user.ngroups = 0;
 288         SAFE_FREE( p->pipe_user.groups);
 289
 290         /*
 291          * Setup an empty password for a guest user.
 292          */
 293
 294         /*
 295          * We always negotiate UNICODE.
 296          */
 297
 298         if (p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_UNICODE) {
 299                 rpcstr_pull(user_name, ntlmssp_resp->user, sizeof(fstring), ntlmssp_resp->hdr_usr.str_str_len*2, 0 );
 300                 rpcstr_pull(domain, ntlmssp_resp->domain, sizeof(fstring), ntlmssp_resp->hdr_domain.str_str_len*2, 0);
 301                 rpcstr_pull(wks, ntlmssp_resp->wks, sizeof(fstring), ntlmssp_resp->hdr_wks.str_str_len*2, 0);
 302         } else {
 303                 pull_ascii_fstring(user_name, ntlmssp_resp->user);
 304                 pull_ascii_fstring(domain, ntlmssp_resp->domain);
 305                 pull_ascii_fstring(wks, ntlmssp_resp->wks);
 306         }
 307
 308         DEBUG(5,("user: %s domain: %s wks: %s\n", user_name, domain, wks));
 309
 310         nt_pw_len = MIN(sizeof(nt_owf), ntlmssp_resp->hdr_nt_resp.str_str_len);
 311         lm_pw_len = MIN(sizeof(lm_owf), ntlmssp_resp->hdr_lm_resp.str_str_len);
 312
 313         memcpy(lm_owf, ntlmssp_resp->lm_resp, sizeof(lm_owf));
 314         memcpy(nt_owf, ntlmssp_resp->nt_resp, nt_pw_len);
 315
 316 #ifdef DEBUG_PASSWORD
 317         DEBUG(100,("lm, nt owfs, chal\n"));
 318         dump_data(100, (char *)lm_owf, sizeof(lm_owf));
 319         dump_data(100, (char *)nt_owf, nt_pw_len);
 320         dump_data(100, (char *)p->challenge, 8);
 321 #endif
 322
 323         /*
 324          * Allow guest access. Patch from Shirish Kalele <kalele@veritas.com>.
 325          */
 326
 327         if (*user_name) {
 328
 329                 /*
 330                  * Do the length checking only if user is not NULL.
 331                  */
 332
 333                 if (ntlmssp_resp->hdr_lm_resp.str_str_len == 0)
 334                         return False;
 335                 if (ntlmssp_resp->hdr_nt_resp.str_str_len == 0)
 336                         return False;
 337                 if (ntlmssp_resp->hdr_usr.str_str_len == 0)
 338                         return False;
 339                 if (ntlmssp_resp->hdr_domain.str_str_len == 0)
 340                         return False;
 341                 if (ntlmssp_resp->hdr_wks.str_str_len == 0)
 342                         return False;
 343
 344         }
 345
 346         make_auth_context_fixed(&auth_context, (uchar*)p->challenge);
 347
 348         if (!make_user_info_netlogon_network(&user_info,
 349                                              user_name, domain, wks,
 350                                              lm_owf, lm_pw_len,
 351                                              nt_owf, nt_pw_len)) {
 352                 DEBUG(0,("make_user_info_netlogon_network failed!  Failing authenticaion.\n"));
 353                 return False;
 354         }
 355
 356         nt_status = auth_context->check_ntlm_password(auth_context, user_info, &server_info);
 357
 358         (auth_context->free)(&auth_context);
 359         free_user_info(&user_info);
 360
 361         p->ntlmssp_auth_validated = NT_STATUS_IS_OK(nt_status);
 362
 363         if (!p->ntlmssp_auth_validated) {
 364                 DEBUG(1,("api_pipe_ntlmssp_verify: User [%s]\\[%s] from machine %s \
 365 failed authentication on named pipe %s.\n", domain, user_name, wks, p->name ));
 366                 free_server_info(&server_info);
 367                 return False;
 368         }
 369
 370         /*
 371          * Set up the sign/seal data.
 372          */
 373
 374         {
 375                 uchar p24[24];
 376                 NTLMSSPOWFencrypt(server_info->first_8_lm_hash, lm_owf, p24);
 377                 {
 378                         unsigned char j = 0;
 379                         int ind;
 380
 381                         unsigned char k2[8];
 382
 383                         memcpy(k2, p24, 5);
 384                         k2[5] = 0xe5;
 385                         k2[6] = 0x38;
 386                         k2[7] = 0xb0;
 387
 388                         for (ind = 0; ind < 256; ind++)
 389                                 p->ntlmssp_hash[ind] = (unsigned char)ind;
 390
 391                         for( ind = 0; ind < 256; ind++) {
 392                                 unsigned char tc;
 393
 394                                 j += (p->ntlmssp_hash[ind] + k2[ind%8]);
 395
 396                                 tc = p->ntlmssp_hash[ind];
 397                                 p->ntlmssp_hash[ind] = p->ntlmssp_hash[j];
 398                                 p->ntlmssp_hash[j] = tc;
 399                         }
 400
 401                         p->ntlmssp_hash[256] = 0;
 402                         p->ntlmssp_hash[257] = 0;
 403                 }
 404 /*              NTLMSSPhash(p->ntlmssp_hash, p24); */
 405                 p->ntlmssp_seq_num = 0;
 406
 407         }
 408
 409         fstrcpy(p->user_name, user_name);
 410         fstrcpy(p->pipe_user_name, pdb_get_username(server_info->sam_account));
 411         fstrcpy(p->domain, domain);
 412         fstrcpy(p->wks, wks);
 413
 414         /*
 415          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 416          */
 417
 418         if (!IS_SAM_UNIX_USER(server_info->sam_account)) {
 419                 DEBUG(0,("Attempted authenticated pipe with invalid user.  No uid/gid in SAM_ACCOUNT\n"));
 420                 free_server_info(&server_info);
 421                 return False;
 422         }
 423
 424         memcpy(p->session_key, server_info->session_key, sizeof(p->session_key));
 425
 426         p->pipe_user.uid = pdb_get_uid(server_info->sam_account);
 427         p->pipe_user.gid = pdb_get_gid(server_info->sam_account);
 428
 429         p->pipe_user.ngroups = server_info->n_groups;
 430         if (p->pipe_user.ngroups) {
 431                 if (!(p->pipe_user.groups = memdup(server_info->groups, sizeof(gid_t) * p->pipe_user.ngroups))) {
 432                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 433                         free_server_info(&server_info);
 434                         return False;
 435                 }
 436         }
 437
 438         if (server_info->ptok)
 439                 p->pipe_user.nt_user_token = dup_nt_token(server_info->ptok);
 440         else {
 441                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 442                 p->pipe_user.nt_user_token = NULL;
 443                 free_server_info(&server_info);
 444                 return False;
 445         }
 446
 447         p->ntlmssp_auth_validated = True;
 448
 449         free_server_info(&server_info);
 450         return True;
 451 }
 452
 453 /*******************************************************************
 454  The switch table for the pipe names and the functions to handle them.
 455  *******************************************************************/
 456
 457 struct rpc_table
 458 {
 459   struct
 460   {
 461     const char *clnt;
 462     const char *srv;
 463   } pipe;
 464   struct api_struct *cmds;
 465   int n_cmds;
 466 };
 467
 468 static struct rpc_table *rpc_lookup;
 469 static int rpc_lookup_size;
 470
 471 /*******************************************************************
 472  This is the client reply to our challenge for an authenticated
 473  bind request. The challenge we sent is in p->challenge.
 474 *******************************************************************/
 475
 476 BOOL api_pipe_bind_auth_resp(pipes_struct *p, prs_struct *rpc_in_p)
 477 {
 478         RPC_HDR_AUTHA autha_info;
 479         RPC_AUTH_VERIFIER auth_verifier;
 480         RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 481
 482         DEBUG(5,("api_pipe_bind_auth_resp: decode request. %d\n", __LINE__));
 483
 484         if (p->hdr.auth_len == 0) {
 485                 DEBUG(0,("api_pipe_bind_auth_resp: No auth field sent !\n"));
 486                 return False;
 487         }
 488
 489         /*
 490          * Decode the authentication verifier response.
 491          */
 492
 493         if(!smb_io_rpc_hdr_autha("", &autha_info, rpc_in_p, 0)) {
 494                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_HDR_AUTHA failed.\n"));
 495                 return False;
 496         }
 497
 498         if (autha_info.auth_type != NTLMSSP_AUTH_TYPE || autha_info.auth_level != NTLMSSP_AUTH_LEVEL) {
 499                 DEBUG(0,("api_pipe_bind_auth_resp: incorrect auth type (%d) or level (%d).\n",
 500                         (int)autha_info.auth_type, (int)autha_info.auth_level ));
 501                 return False;
 502         }
 503
 504         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 505                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_AUTH_VERIFIER failed.\n"));
 506                 return False;
 507         }
 508
 509         /*
 510          * Ensure this is a NTLMSSP_AUTH packet type.
 511          */
 512
 513         if (!rpc_auth_verifier_chk(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH)) {
 514                 DEBUG(0,("api_pipe_bind_auth_resp: rpc_auth_verifier_chk failed.\n"));
 515                 return False;
 516         }
 517
 518         if(!smb_io_rpc_auth_ntlmssp_resp("", &ntlmssp_resp, rpc_in_p, 0)) {
 519                 DEBUG(0,("api_pipe_bind_auth_resp: Failed to unmarshall RPC_AUTH_NTLMSSP_RESP.\n"));
 520                 return False;
 521         }
 522
 523         /*
 524          * The following call actually checks the challenge/response data.
 525          * for correctness against the given DOMAIN\user name.
 526          */
 527
 528         if (!api_pipe_ntlmssp_verify(p, &ntlmssp_resp))
 529                 return False;
 530
 531         p->pipe_bound = True
 532 ;
 533         return True;
 534 }
 535
 536 /*******************************************************************
 537  Marshall a bind_nak pdu.
 538 *******************************************************************/
 539
 540 static BOOL setup_bind_nak(pipes_struct *p)
 541 {
 542         prs_struct outgoing_rpc;
 543         RPC_HDR nak_hdr;
 544         uint16 zero = 0;
 545
 546         /* Free any memory in the current return data buffer. */
 547         prs_mem_free(&p->out_data.rdata);
 548
 549         /*
 550          * Marshall directly into the outgoing PDU space. We
 551          * must do this as we need to set to the bind response
 552          * header and are never sending more than one PDU here.
 553          */
 554
 555         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 556         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 557
 558
 559         /*
 560          * Initialize a bind_nak header.
 561          */
 562
 563         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 564             p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 565
 566         /*
 567          * Marshall the header into the outgoing PDU.
 568          */
 569
 570         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 571                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 572                 prs_mem_free(&outgoing_rpc);
 573                 return False;
 574         }
 575
 576         /*
 577          * Now add the reject reason.
 578          */
 579
 580         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 581                 prs_mem_free(&outgoing_rpc);
 582         return False;
 583         }
 584
 585         p->out_data.data_sent_length = 0;
 586         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 587         p->out_data.current_pdu_sent = 0;
 588
 589         p->pipe_bound = False;
 590
 591         return True;
 592 }
 593
 594 /*******************************************************************
 595  Marshall a fault pdu.
 596 *******************************************************************/
 597
 598 BOOL setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 599 {
 600         prs_struct outgoing_pdu;
 601         RPC_HDR fault_hdr;
 602         RPC_HDR_RESP hdr_resp;
 603         RPC_HDR_FAULT fault_resp;
 604
 605         /* Free any memory in the current return data buffer. */
 606         prs_mem_free(&p->out_data.rdata);
 607
 608         /*
 609          * Marshall directly into the outgoing PDU space. We
 610          * must do this as we need to set to the bind response
 611          * header and are never sending more than one PDU here.
 612          */
 613
 614         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 615         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 616
 617         /*
 618          * Initialize a fault header.
 619          */
 620
 621         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 622             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 623
 624         /*
 625          * Initialize the HDR_RESP and FAULT parts of the PDU.
 626          */
 627
 628         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 629
 630         fault_resp.status = status;
 631         fault_resp.reserved = 0;
 632
 633         /*
 634          * Marshall the header into the outgoing PDU.
 635          */
 636
 637         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 638                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 639                 prs_mem_free(&outgoing_pdu);
 640                 return False;
 641         }
 642
 643         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 644                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 645                 prs_mem_free(&outgoing_pdu);
 646                 return False;
 647         }
 648
 649         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 650                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 651                 prs_mem_free(&outgoing_pdu);
 652                 return False;
 653         }
 654
 655         p->out_data.data_sent_length = 0;
 656         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 657         p->out_data.current_pdu_sent = 0;
 658
 659         prs_mem_free(&outgoing_pdu);
 660         return True;
 661 }
 662
 663 /*******************************************************************
 664  Ensure a bind request has the correct abstract & transfer interface.
 665  Used to reject unknown binds from Win2k.
 666 *******************************************************************/
 667
 668 BOOL check_bind_req(char* pipe_name, RPC_IFACE* abstract,
 669                                         RPC_IFACE* transfer)
 670 {
 671         extern struct pipe_id_info pipe_names[];
 672         int i=0;
 673         fstring pname;
 674         fstrcpy(pname,"\\PIPE\\");
 675         fstrcat(pname,pipe_name);
 676
 677         DEBUG(3,("check_bind_req for %s\n", pname));
 678
 679 #ifndef SUPPORT_NEW_LSARPC_UUID
 680
 681         /* check for the first pipe matching the name */
 682
 683         for ( i=0; pipe_names[i].client_pipe; i++ ) {
 684                 if ( strequal(pipe_names[i].client_pipe, pname) )
 685                         break;
 686         }
 687 #else
 688         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 689
 690         for ( i=0; pipe_names[i].client_pipe; i++ )
 691         {
 692                 if ( strequal(pipe_names[i].client_pipe, pname)
 693                         && (abstract->version == pipe_names[i].abstr_syntax.version)
 694                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(RPC_UUID)) == 0)
 695                         && (transfer->version == pipe_names[i].trans_syntax.version)
 696                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(RPC_UUID)) == 0) )
 697                 {
 698                         break;
 699                 }
 700         }
 701 #endif
 702
 703         if(pipe_names[i].client_pipe == NULL)
 704                 return False;
 705
 706 #ifndef SUPPORT_NEW_LSARPC_UUID
 707         /* check the abstract interface */
 708         if ( (abstract->version != pipe_names[i].abstr_syntax.version)
 709                 || (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(RPC_UUID)) != 0) )
 710         {
 711                 return False;
 712         }
 713
 714         /* check the transfer interface */
 715         if ( (transfer->version != pipe_names[i].trans_syntax.version)
 716                 || (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(RPC_UUID)) != 0) )
 717         {
 718                 return False;
 719         }
 720 #endif
 721         return True;
 722 }
 723
 724 /*******************************************************************
 725  Register commands to an RPC pipe
 726 *******************************************************************/
 727 int rpc_pipe_register_commands(const char *clnt, const char *srv, const struct api_struct *cmds, int size)
 728 {
 729         struct rpc_table *rpc_entry;
 730
 731
 732         /* We use a temporary variable because this call can fail and
 733            rpc_lookup will still be valid afterwards.  It could then succeed if
 734            called again later */
 735         rpc_entry = realloc(rpc_lookup,
 736                             ++rpc_lookup_size*sizeof(struct rpc_table));
 737         if (NULL == rpc_entry) {
 738                 rpc_lookup_size--;
 739                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
 740                 return 0;
 741         } else {
 742                 rpc_lookup = rpc_entry;
 743         }
 744
 745         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
 746         ZERO_STRUCTP(rpc_entry);
 747         rpc_entry->pipe.clnt = strdup(clnt);
 748         rpc_entry->pipe.srv = strdup(srv);
 749         rpc_entry->cmds = realloc(rpc_entry->cmds,
 750                                   (rpc_entry->n_cmds + size) *
 751                                   sizeof(struct api_struct));
 752         memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds,
 753                size * sizeof(struct api_struct));
 754         rpc_entry->n_cmds += size;
 755
 756         return size;
 757 }
 758
 759 /*******************************************************************
 760  Respond to a pipe bind request.
 761 *******************************************************************/
 762
 763 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
 764 {
 765         RPC_HDR_BA hdr_ba;
 766         RPC_HDR_RB hdr_rb;
 767         RPC_HDR_AUTH auth_info;
 768         uint16 assoc_gid;
 769         fstring ack_pipe_name;
 770         prs_struct out_hdr_ba;
 771         prs_struct out_auth;
 772         prs_struct outgoing_rpc;
 773         int i = 0;
 774         int auth_len = 0;
 775         enum RPC_PKT_TYPE reply_pkt_type;
 776
 777         p->ntlmssp_auth_requested = False;
 778
 779         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
 780
 781         /*
 782          * Try and find the correct pipe name to ensure
 783          * that this is a pipe name we support.
 784          */
 785
 786
 787         for (i = 0; i < rpc_lookup_size; i++) {
 788                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
 789                   DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 790                             rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
 791                   fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
 792                   break;
 793                 }
 794         }
 795
 796         if (i == rpc_lookup_size) {
 797                                 if (!smb_probe_module("rpc", p->name)) {
 798                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 799                                 p->name ));
 800                        if(!setup_bind_nak(p))
 801                                return False;
 802                        return True;
 803                 }
 804
 805                 for (i = 0; i < rpc_lookup_size; i++) {
 806                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
 807                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 808                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
 809                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
 810                                break;
 811                        }
 812                 }
 813         }
 814
 815         /* decode the bind request */
 816         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
 817                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
 818                 return False;
 819         }
 820
 821         /*
 822          * Check if this is an authenticated request.
 823          */
 824
 825         if (p->hdr.auth_len != 0) {
 826                 RPC_AUTH_VERIFIER auth_verifier;
 827                 RPC_AUTH_NTLMSSP_NEG ntlmssp_neg;
 828
 829                 /*
 830                  * Decode the authentication verifier.
 831                  */
 832
 833                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 834                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 835                         return False;
 836                 }
 837
 838                 /*
 839                  * We only support NTLMSSP_AUTH_TYPE requests.
 840                  */
 841
 842                 if(auth_info.auth_type != NTLMSSP_AUTH_TYPE) {
 843                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n",
 844                                 auth_info.auth_type ));
 845                         return False;
 846                 }
 847
 848                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 849                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 850                         return False;
 851                 }
 852
 853                 if(!strequal(auth_verifier.signature, "NTLMSSP")) {
 854                         DEBUG(0,("api_pipe_bind_req: auth_verifier.signature != NTLMSSP\n"));
 855                         return False;
 856                 }
 857
 858                 if(auth_verifier.msg_type != NTLMSSP_NEGOTIATE) {
 859                         DEBUG(0,("api_pipe_bind_req: auth_verifier.msg_type (%d) != NTLMSSP_NEGOTIATE\n",
 860                                 auth_verifier.msg_type));
 861                         return False;
 862                 }
 863
 864                 if(!smb_io_rpc_auth_ntlmssp_neg("", &ntlmssp_neg, rpc_in_p, 0)) {
 865                         DEBUG(0,("api_pipe_bind_req: Failed to unmarshall RPC_AUTH_NTLMSSP_NEG.\n"));
 866                         return False;
 867                 }
 868
 869                 p->ntlmssp_chal_flags = SMBD_NTLMSSP_NEG_FLAGS;
 870                 p->ntlmssp_auth_requested = True;
 871         }
 872
 873         switch(p->hdr.pkt_type) {
 874                 case RPC_BIND:
 875                         /* name has to be \PIPE\xxxxx */
 876                         fstrcpy(ack_pipe_name, "\\PIPE\\");
 877                         fstrcat(ack_pipe_name, p->pipe_srv_name);
 878                         reply_pkt_type = RPC_BINDACK;
 879                         break;
 880                 case RPC_ALTCONT:
 881                         /* secondary address CAN be NULL
 882                          * as the specs say it's ignored.
 883                          * It MUST NULL to have the spoolss working.
 884                          */
 885                         fstrcpy(ack_pipe_name,"");
 886                         reply_pkt_type = RPC_ALTCONTRESP;
 887                         break;
 888                 default:
 889                         return False;
 890         }
 891
 892         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 893
 894         /*
 895          * Marshall directly into the outgoing PDU space. We
 896          * must do this as we need to set to the bind response
 897          * header and are never sending more than one PDU here.
 898          */
 899
 900         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 901         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 902
 903         /*
 904          * Setup the memory to marshall the ba header, and the
 905          * auth footers.
 906          */
 907
 908         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
 909                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
 910                 prs_mem_free(&outgoing_rpc);
 911                 return False;
 912         }
 913
 914         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
 915                 DEBUG(0,("pi_pipe_bind_req: malloc out_auth failed.\n"));
 916                 prs_mem_free(&outgoing_rpc);
 917                 prs_mem_free(&out_hdr_ba);
 918                 return False;
 919         }
 920
 921         if (p->ntlmssp_auth_requested)
 922                 assoc_gid = 0x7a77;
 923         else
 924                 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
 925
 926         /*
 927          * Create the bind response struct.
 928          */
 929
 930         /* If the requested abstract synt uuid doesn't match our client pipe,
 931                 reject the bind_ack & set the transfer interface synt to all 0's,
 932                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 933                 unknown to NT4)
 934                 Needed when adding entries to a DACL from NT5 - SK */
 935
 936         if(check_bind_req(p->name, &hdr_rb.abstract, &hdr_rb.transfer)) {
 937                 init_rpc_hdr_ba(&hdr_ba,
 938                         MAX_PDU_FRAG_LEN,
 939                         MAX_PDU_FRAG_LEN,
 940                         assoc_gid,
 941                         ack_pipe_name,
 942                         0x1, 0x0, 0x0,
 943                         &hdr_rb.transfer);
 944         } else {
 945                 RPC_IFACE null_interface;
 946                 ZERO_STRUCT(null_interface);
 947                 /* Rejection reason: abstract syntax not supported */
 948                 init_rpc_hdr_ba(&hdr_ba, MAX_PDU_FRAG_LEN,
 949                                         MAX_PDU_FRAG_LEN, assoc_gid,
 950                                         ack_pipe_name, 0x1, 0x2, 0x1,
 951                                         &null_interface);
 952         }
 953
 954         /*
 955          * and marshall it.
 956          */
 957
 958         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
 959                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
 960                 goto err_exit;
 961         }
 962
 963         /*
 964          * Now the authentication.
 965          */
 966
 967         if (p->ntlmssp_auth_requested) {
 968                 RPC_AUTH_VERIFIER auth_verifier;
 969                 RPC_AUTH_NTLMSSP_CHAL ntlmssp_chal;
 970
 971                 generate_random_buffer(p->challenge, 8, False);
 972
 973                 /*** Authentication info ***/
 974
 975                 init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, RPC_HDR_AUTH_LEN, 1);
 976                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
 977                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
 978                         goto err_exit;
 979                 }
 980
 981                 /*** NTLMSSP verifier ***/
 982
 983                 init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_CHALLENGE);
 984                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, &out_auth, 0)) {
 985                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
 986                         goto err_exit;
 987                 }
 988
 989                 /* NTLMSSP challenge ***/
 990
 991                 init_rpc_auth_ntlmssp_chal(&ntlmssp_chal, p->ntlmssp_chal_flags, p->challenge);
 992                 if(!smb_io_rpc_auth_ntlmssp_chal("", &ntlmssp_chal, &out_auth, 0)) {
 993                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_NTLMSSP_CHAL failed.\n"));
 994                         goto err_exit;
 995                 }
 996
 997                 /* Auth len in the rpc header doesn't include auth_header. */
 998                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
 999         }
1000
1001         /*
1002          * Create the header, now we know the length.
1003          */
1004
1005         init_rpc_hdr(&p->hdr, reply_pkt_type, RPC_FLG_FIRST | RPC_FLG_LAST,
1006                         p->hdr.call_id,
1007                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1008                         auth_len);
1009
1010         /*
1011          * Marshall the header into the outgoing PDU.
1012          */
1013
1014         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1015                 DEBUG(0,("pi_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1016                 goto err_exit;
1017         }
1018
1019         /*
1020          * Now add the RPC_HDR_BA and any auth needed.
1021          */
1022
1023         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1024                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1025                 goto err_exit;
1026         }
1027
1028         if(p->ntlmssp_auth_requested && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1029                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1030                 goto err_exit;
1031         }
1032
1033         if(!p->ntlmssp_auth_requested)
1034                 p->pipe_bound = True;
1035
1036         /*
1037          * Setup the lengths for the initial reply.
1038          */
1039
1040         p->out_data.data_sent_length = 0;
1041         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1042         p->out_data.current_pdu_sent = 0;
1043
1044         prs_mem_free(&out_hdr_ba);
1045         prs_mem_free(&out_auth);
1046
1047         return True;
1048
1049   err_exit:
1050
1051         prs_mem_free(&outgoing_rpc);
1052         prs_mem_free(&out_hdr_ba);
1053         prs_mem_free(&out_auth);
1054         return False;
1055 }
1056
1057 /****************************************************************************
1058  Deal with sign & seal processing on an RPC request.
1059 ****************************************************************************/
1060
1061 BOOL api_pipe_auth_process(pipes_struct *p, prs_struct *rpc_in)
1062 {
1063         /*
1064          * We always negotiate the following two bits....
1065          */
1066         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
1067         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
1068         int data_len;
1069         int auth_len;
1070         uint32 old_offset;
1071         uint32 crc32 = 0;
1072
1073         auth_len = p->hdr.auth_len;
1074
1075         if ((auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) && auth_verify) {
1076                 DEBUG(0,("api_pipe_auth_process: Incorrect auth_len %d.\n", auth_len ));
1077                 return False;
1078         }
1079
1080         /*
1081          * The following is that length of the data we must verify or unseal.
1082          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1083          * preceeding the auth_data.
1084          */
1085
1086         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1087                         (auth_verify ? RPC_HDR_AUTH_LEN : 0) - auth_len;
1088
1089         DEBUG(5,("api_pipe_auth_process: sign: %s seal: %s data %d auth %d\n",
1090                  BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, auth_len));
1091
1092         if (auth_seal) {
1093                 /*
1094                  * The data in rpc_in doesn't contain the RPC_HEADER as this
1095                  * has already been consumed.
1096                  */
1097                 char *data = prs_data_p(rpc_in) + RPC_HDR_REQ_LEN;
1098                 NTLMSSPcalc_p(p, (uchar*)data, data_len);
1099                 crc32 = crc32_calc_buffer(data, data_len);
1100         }
1101
1102         old_offset = prs_offset(rpc_in);
1103
1104         if (auth_seal || auth_verify) {
1105                 RPC_HDR_AUTH auth_info;
1106
1107                 if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1108                         DEBUG(0,("api_pipe_auth_process: cannot move offset to %u.\n",
1109                                 (unsigned int)old_offset + data_len ));
1110                         return False;
1111                 }
1112
1113                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1114                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1115                         return False;
1116                 }
1117         }
1118
1119         if (auth_verify) {
1120                 RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
1121                 char *req_data = prs_data_p(rpc_in) + prs_offset(rpc_in) + 4;
1122
1123                 DEBUG(5,("api_pipe_auth_process: auth %d\n", prs_offset(rpc_in) + 4));
1124
1125                 /*
1126                  * Ensure we have RPC_AUTH_NTLMSSP_CHK_LEN - 4 more bytes in the
1127                  * incoming buffer.
1128                  */
1129                 if(prs_mem_get(rpc_in, RPC_AUTH_NTLMSSP_CHK_LEN - 4) == NULL) {
1130                         DEBUG(0,("api_pipe_auth_process: missing %d bytes in buffer.\n",
1131                                 RPC_AUTH_NTLMSSP_CHK_LEN - 4 ));
1132                         return False;
1133                 }
1134
1135                 NTLMSSPcalc_p(p, (uchar*)req_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
1136                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, rpc_in, 0)) {
1137                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_AUTH_NTLMSSP_CHK.\n"));
1138                         return False;
1139                 }
1140
1141                 if (!rpc_auth_ntlmssp_chk(&ntlmssp_chk, crc32, p->ntlmssp_seq_num)) {
1142                         DEBUG(0,("api_pipe_auth_process: NTLMSSP check failed.\n"));
1143                         return False;
1144                 }
1145         }
1146
1147         /*
1148          * Return the current pointer to the data offset.
1149          */
1150
1151         if(!prs_set_offset(rpc_in, old_offset)) {
1152                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
1153                         (unsigned int)old_offset ));
1154                 return False;
1155         }
1156
1157         return True;
1158 }
1159
1160 /****************************************************************************
1161  Return a user struct for a pipe user.
1162 ****************************************************************************/
1163
1164 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
1165 {
1166         if (p->ntlmssp_auth_validated) {
1167                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
1168         } else {
1169                 extern struct current_user current_user;
1170                 memcpy(user, &current_user, sizeof(struct current_user));
1171         }
1172
1173         return user;
1174 }
1175
1176 /****************************************************************************
1177  Find the correct RPC function to call for this request.
1178  If the pipe is authenticated then become the correct UNIX user
1179  before doing the call.
1180 ****************************************************************************/
1181
1182 BOOL api_pipe_request(pipes_struct *p)
1183 {
1184         int i = 0;
1185         BOOL ret = False;
1186
1187         if (p->ntlmssp_auth_validated) {
1188
1189                 if(!become_authenticated_pipe_user(p)) {
1190                         prs_mem_free(&p->out_data.rdata);
1191                         return False;
1192                 }
1193         }
1194
1195         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
1196
1197         for (i = 0; i < rpc_lookup_size; i++) {
1198                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1199                         DEBUG(3,("Doing \\PIPE\\%s\n",
1200                                  rpc_lookup[i].pipe.clnt));
1201                         set_current_rpc_talloc(p->mem_ctx);
1202                         ret = api_rpcTNP(p, rpc_lookup[i].pipe.clnt,
1203                                          rpc_lookup[i].cmds,
1204                                          rpc_lookup[i].n_cmds);
1205                         set_current_rpc_talloc(NULL);
1206                         break;
1207                 }
1208         }
1209
1210
1211         if (i == rpc_lookup_size) {
1212                 smb_probe_module("rpc", p->name);
1213
1214                 for (i = 0; i < rpc_lookup_size; i++) {
1215                         if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1216                                 DEBUG(3,("Doing \\PIPE\\%s\n",
1217                                          rpc_lookup[i].pipe.clnt));
1218                                 set_current_rpc_talloc(p->mem_ctx);
1219                                 ret = api_rpcTNP(p, rpc_lookup[i].pipe.clnt,
1220                                                  rpc_lookup[i].cmds,
1221                                                  rpc_lookup[i].n_cmds);
1222                                 set_current_rpc_talloc(NULL);
1223                                 break;
1224                         }
1225                 }
1226         }
1227
1228         if(p->ntlmssp_auth_validated)
1229                 unbecome_authenticated_pipe_user();
1230
1231         return ret;
1232 }
1233
1234 /*******************************************************************
1235  Calls the underlying RPC function for a named pipe.
1236  ********************************************************************/
1237
1238 BOOL api_rpcTNP(pipes_struct *p, const char *rpc_name,
1239                 const struct api_struct *api_rpc_cmds, int n_cmds)
1240 {
1241         int fn_num;
1242         fstring name;
1243         uint32 offset1, offset2;
1244
1245         /* interpret the command */
1246         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
1247
1248         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
1249         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
1250
1251         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1252                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
1253                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
1254                         break;
1255                 }
1256         }
1257
1258         if (fn_num == n_cmds) {
1259                 /*
1260                  * For an unknown RPC just return a fault PDU but
1261                  * return True to allow RPC's on the pipe to continue
1262                  * and not put the pipe into fault state. JRA.
1263                  */
1264                 DEBUG(4, ("unknown\n"));
1265                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
1266                 return True;
1267         }
1268
1269         offset1 = prs_offset(&p->out_data.rdata);
1270
1271         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1272                 fn_num, api_rpc_cmds[fn_num].fn));
1273         /* do the actual command */
1274         if(!api_rpc_cmds[fn_num].fn(p)) {
1275                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
1276                 prs_mem_free(&p->out_data.rdata);
1277                 return False;
1278         }
1279
1280         if (p->bad_handle_fault_state) {
1281                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1282                 p->bad_handle_fault_state = False;
1283                 setup_fault_pdu(p, NT_STATUS(0x1C00001A));
1284                 return True;
1285         }
1286
1287         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
1288         offset2 = prs_offset(&p->out_data.rdata);
1289         prs_set_offset(&p->out_data.rdata, offset1);
1290         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
1291         prs_set_offset(&p->out_data.rdata, offset2);
1292
1293         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
1294
1295         /* Check for buffer underflow in rpc parsing */
1296
1297         if ((DEBUGLEVEL >= 10) &&
1298             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
1299                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
1300                 char *data;
1301
1302                 data = malloc(data_len);
1303
1304                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1305                 if (data) {
1306                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
1307                         SAFE_FREE(data);
1308                 }
1309
1310         }
1311
1312         return True;
1313 }