source/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1998
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   6  *  Copyright (C) Paul Ashton                  1997-1998,
   7  *  Copyright (C) Jeremy Allison                    1999,
   8  *  Copyright (C) Anthony Liguori                   2003.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25 /*  this module apparently provides an implementation of DCE/RPC over a
  26  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  27  *  documentation are available (in on-line form) from the X-Open group.
  28  *
  29  *  this module should provide a level of abstraction between SMB
  30  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  31  *  data copies, and network traffic.
  32  *
  33  *  in this version, which takes a "let's learn what's going on and
  34  *  get something running" approach, there is additional network
  35  *  traffic generated, but the code should be easier to understand...
  36  *
  37  *  ... if you read the docs.  or stare at packets for weeks on end.
  38  *
  39  */
  40
  41 #include "includes.h"
  42
  43 #undef DBGC_CLASS
  44 #define DBGC_CLASS DBGC_RPC_SRV
  45
  46 /*************************************************************
  47  HACK Alert!
  48  We need to transfer the session key from one rpc bind to the
  49  next. This is the way the netlogon schannel works.
  50 **************************************************************/
  51 struct dcinfo last_dcinfo;
  52
  53 static void NTLMSSPcalc_p( pipes_struct *p, unsigned char *data, int len)
  54 {
  55     unsigned char *hash = p->ntlmssp_hash;
  56     unsigned char index_i = hash[256];
  57     unsigned char index_j = hash[257];
  58     int ind;
  59
  60     for( ind = 0; ind < len; ind++) {
  61         unsigned char tc;
  62         unsigned char t;
  63
  64         index_i++;
  65         index_j += hash[index_i];
  66
  67         tc = hash[index_i];
  68         hash[index_i] = hash[index_j];
  69         hash[index_j] = tc;
  70
  71         t = hash[index_i] + hash[index_j];
  72         data[ind] = data[ind] ^ hash[t];
  73     }
  74
  75     hash[256] = index_i;
  76     hash[257] = index_j;
  77 }
  78
  79 /*******************************************************************
  80  Generate the next PDU to be returned from the data in p->rdata.
  81  We cheat here as this function doesn't handle the special auth
  82  footers of the authenticated bind response reply.
  83  ********************************************************************/
  84
  85 BOOL create_next_pdu(pipes_struct *p)
  86 {
  87         RPC_HDR_RESP hdr_resp;
  88         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
  89         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
  90         uint32 data_len;
  91         uint32 data_space_available;
  92         uint32 data_len_left;
  93         prs_struct outgoing_pdu;
  94         uint32 data_pos;
  95
  96         /*
  97          * If we're in the fault state, keep returning fault PDU's until
  98          * the pipe gets closed. JRA.
  99          */
 100
 101         if(p->fault_state) {
 102                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 103                 return True;
 104         }
 105
 106         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 107
 108         /* Change the incoming request header to a response. */
 109         p->hdr.pkt_type = RPC_RESPONSE;
 110
 111         /* Set up rpc header flags. */
 112         if (p->out_data.data_sent_length == 0)
 113                 p->hdr.flags = RPC_FLG_FIRST;
 114         else
 115                 p->hdr.flags = 0;
 116
 117         /*
 118          * Work out how much we can fit in a single PDU.
 119          */
 120
 121         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 122         if(p->ntlmssp_auth_validated)
 123                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN);
 124
 125         if(p->netsec_auth_validated)
 126                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NETSEC_CHK_LEN);
 127
 128         /*
 129          * The amount we send is the minimum of the available
 130          * space and the amount left to send.
 131          */
 132
 133         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 134
 135         /*
 136          * Ensure there really is data left to send.
 137          */
 138
 139         if(!data_len_left) {
 140                 DEBUG(0,("create_next_pdu: no data left to send !\n"));
 141                 return False;
 142         }
 143
 144         data_len = MIN(data_len_left, data_space_available);
 145
 146         /*
 147          * Set up the alloc hint. This should be the data left to
 148          * send.
 149          */
 150
 151         hdr_resp.alloc_hint = data_len_left;
 152
 153         /*
 154          * Set up the header lengths.
 155          */
 156
 157         if (p->ntlmssp_auth_validated) {
 158                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
 159                                         RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN;
 160                 p->hdr.auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 161         } else if (p->netsec_auth_validated) {
 162                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
 163                         RPC_HDR_AUTH_LEN + RPC_AUTH_NETSEC_CHK_LEN;
 164                 p->hdr.auth_len = RPC_AUTH_NETSEC_CHK_LEN;
 165         } else {
 166                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 167                 p->hdr.auth_len = 0;
 168         }
 169
 170         /*
 171          * Work out if this PDU will be the last.
 172          */
 173
 174         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata))
 175                 p->hdr.flags |= RPC_FLG_LAST;
 176
 177         /*
 178          * Init the parse struct to point at the outgoing
 179          * data.
 180          */
 181
 182         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 183         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 184
 185         /* Store the header in the data stream. */
 186         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 187                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR.\n"));
 188                 prs_mem_free(&outgoing_pdu);
 189                 return False;
 190         }
 191
 192         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 193                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_RESP.\n"));
 194                 prs_mem_free(&outgoing_pdu);
 195                 return False;
 196         }
 197
 198         /* Store the current offset. */
 199         data_pos = prs_offset(&outgoing_pdu);
 200
 201         /* Copy the data into the PDU. */
 202
 203         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 204                 DEBUG(0,("create_next_pdu: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 205                 prs_mem_free(&outgoing_pdu);
 206                 return False;
 207         }
 208
 209         if (p->ntlmssp_auth_validated) {
 210                 uint32 crc32 = 0;
 211                 char *data;
 212
 213                 DEBUG(5,("create_next_pdu: sign: %s seal: %s data %d auth %d\n",
 214                          BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, p->hdr.auth_len));
 215
 216                 /*
 217                  * Set data to point to where we copied the data into.
 218                  */
 219
 220                 data = prs_data_p(&outgoing_pdu) + data_pos;
 221
 222                 if (auth_seal) {
 223                         crc32 = crc32_calc_buffer(data, data_len);
 224                         NTLMSSPcalc_p(p, (uchar*)data, data_len);
 225                 }
 226
 227                 if (auth_seal || auth_verify) {
 228                         RPC_HDR_AUTH auth_info;
 229
 230                         init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL,
 231                                         (auth_verify ? RPC_HDR_AUTH_LEN : 0), (auth_verify ? 1 : 0));
 232                         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 233                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 234                                 prs_mem_free(&outgoing_pdu);
 235                                 return False;
 236                         }
 237                 }
 238
 239                 if (auth_verify) {
 240                         RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
 241                         char *auth_data = prs_data_p(&outgoing_pdu);
 242
 243                         p->ntlmssp_seq_num++;
 244                         init_rpc_auth_ntlmssp_chk(&ntlmssp_chk, NTLMSSP_SIGN_VERSION,
 245                                         crc32, p->ntlmssp_seq_num++);
 246                         auth_data = prs_data_p(&outgoing_pdu) + prs_offset(&outgoing_pdu) + 4;
 247                         if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, &outgoing_pdu, 0)) {
 248                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_AUTH_NTLMSSP_CHK.\n"));
 249                                 prs_mem_free(&outgoing_pdu);
 250                                 return False;
 251                         }
 252                         NTLMSSPcalc_p(p, (uchar*)auth_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 253                 }
 254         }
 255
 256         if (p->netsec_auth_validated) {
 257                 char *data;
 258                 RPC_HDR_AUTH auth_info;
 259                 static const uchar netsec_sig[8] = NETSEC_SIGNATURE;
 260                 static const uchar nullbytes[8] = { 0,0,0,0,0,0,0,0 };
 261
 262                 RPC_AUTH_NETSEC_CHK verf;
 263                 prs_struct rverf;
 264                 prs_struct rauth;
 265
 266                 uchar sign[8];
 267
 268                 data = prs_data_p(&outgoing_pdu) + data_pos;
 269
 270                 init_rpc_hdr_auth(&auth_info, NETSEC_AUTH_TYPE, NETSEC_AUTH_LEVEL,
 271                                   RPC_HDR_AUTH_LEN, 1);
 272
 273                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 274                         DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 275                         prs_mem_free(&outgoing_pdu);
 276                         return False;
 277                 }
 278
 279                 prs_init(&rverf, 0, p->mem_ctx, MARSHALL);
 280                 prs_init(&rauth, 0, p->mem_ctx, MARSHALL);
 281
 282                 if ((p->netsec_auth.seq_num & 1) == 0) {
 283                         DEBUG(0,("SCHANNEL ERROR: seq_num must be odd in server! (seq_num=%d)\n",
 284                                         p->netsec_auth.seq_num));
 285                 }
 286
 287                 RSIVAL(sign, 0, p->netsec_auth.seq_num);
 288                 SIVAL(sign, 4, 0);
 289
 290                 init_rpc_auth_netsec_chk(&verf, netsec_sig, nullbytes, sign, nullbytes);
 291
 292                 netsec_encode(&p->netsec_auth, &verf, data, data_len);
 293
 294                 smb_io_rpc_auth_netsec_chk("", &verf, &outgoing_pdu, 0);
 295
 296                 p->netsec_auth.seq_num++;
 297         }
 298
 299         /*
 300          * Setup the counts for this PDU.
 301          */
 302
 303         p->out_data.data_sent_length += data_len;
 304         p->out_data.current_pdu_len = p->hdr.frag_len;
 305         p->out_data.current_pdu_sent = 0;
 306
 307         prs_mem_free(&outgoing_pdu);
 308         return True;
 309 }
 310
 311 /*******************************************************************
 312  Process an NTLMSSP authentication response.
 313  If this function succeeds, the user has been authenticated
 314  and their domain, name and calling workstation stored in
 315  the pipe struct.
 316  The initial challenge is stored in p->challenge.
 317  *******************************************************************/
 318
 319 static BOOL api_pipe_ntlmssp_verify(pipes_struct *p, RPC_AUTH_NTLMSSP_RESP *ntlmssp_resp)
 320 {
 321         uchar lm_owf[24];
 322         uchar nt_owf[128];
 323         int nt_pw_len;
 324         int lm_pw_len;
 325         fstring user_name;
 326         fstring domain;
 327         fstring wks;
 328
 329         NTSTATUS nt_status;
 330
 331         struct auth_context *auth_context = NULL;
 332         auth_usersupplied_info *user_info = NULL;
 333         auth_serversupplied_info *server_info = NULL;
 334
 335         DEBUG(5,("api_pipe_ntlmssp_verify: checking user details\n"));
 336
 337         memset(p->user_name, '\0', sizeof(p->user_name));
 338         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 339         memset(p->domain, '\0', sizeof(p->domain));
 340         memset(p->wks, '\0', sizeof(p->wks));
 341
 342         /* Set up for non-authenticated user. */
 343         delete_nt_token(&p->pipe_user.nt_user_token);
 344         p->pipe_user.ngroups = 0;
 345         SAFE_FREE( p->pipe_user.groups);
 346
 347         /*
 348          * Setup an empty password for a guest user.
 349          */
 350
 351         /*
 352          * We always negotiate UNICODE.
 353          */
 354
 355         if (p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_UNICODE) {
 356                 rpcstr_pull(user_name, ntlmssp_resp->user, sizeof(fstring), ntlmssp_resp->hdr_usr.str_str_len*2, 0 );
 357                 rpcstr_pull(domain, ntlmssp_resp->domain, sizeof(fstring), ntlmssp_resp->hdr_domain.str_str_len*2, 0);
 358                 rpcstr_pull(wks, ntlmssp_resp->wks, sizeof(fstring), ntlmssp_resp->hdr_wks.str_str_len*2, 0);
 359         } else {
 360                 pull_ascii_fstring(user_name, ntlmssp_resp->user);
 361                 pull_ascii_fstring(domain, ntlmssp_resp->domain);
 362                 pull_ascii_fstring(wks, ntlmssp_resp->wks);
 363         }
 364
 365         DEBUG(5,("user: %s domain: %s wks: %s\n", user_name, domain, wks));
 366
 367         nt_pw_len = MIN(sizeof(nt_owf), ntlmssp_resp->hdr_nt_resp.str_str_len);
 368         lm_pw_len = MIN(sizeof(lm_owf), ntlmssp_resp->hdr_lm_resp.str_str_len);
 369
 370         memcpy(lm_owf, ntlmssp_resp->lm_resp, sizeof(lm_owf));
 371         memcpy(nt_owf, ntlmssp_resp->nt_resp, nt_pw_len);
 372
 373 #ifdef DEBUG_PASSWORD
 374         DEBUG(100,("lm, nt owfs, chal\n"));
 375         dump_data(100, (char *)lm_owf, sizeof(lm_owf));
 376         dump_data(100, (char *)nt_owf, nt_pw_len);
 377         dump_data(100, (char *)p->challenge, 8);
 378 #endif
 379
 380         /*
 381          * Allow guest access. Patch from Shirish Kalele <kalele@veritas.com>.
 382          */
 383
 384         if (*user_name) {
 385
 386                 /*
 387                  * Do the length checking only if user is not NULL.
 388                  */
 389
 390                 if (ntlmssp_resp->hdr_lm_resp.str_str_len == 0)
 391                         return False;
 392                 if (ntlmssp_resp->hdr_nt_resp.str_str_len == 0)
 393                         return False;
 394                 if (ntlmssp_resp->hdr_usr.str_str_len == 0)
 395                         return False;
 396                 if (ntlmssp_resp->hdr_domain.str_str_len == 0)
 397                         return False;
 398                 if (ntlmssp_resp->hdr_wks.str_str_len == 0)
 399                         return False;
 400
 401         }
 402
 403         make_auth_context_fixed(&auth_context, (uchar*)p->challenge);
 404
 405         if (!make_user_info_netlogon_network(&user_info,
 406                                              user_name, domain, wks,
 407                                              lm_owf, lm_pw_len,
 408                                              nt_owf, nt_pw_len)) {
 409                 DEBUG(0,("make_user_info_netlogon_network failed!  Failing authenticaion.\n"));
 410                 return False;
 411         }
 412
 413         nt_status = auth_context->check_ntlm_password(auth_context, user_info, &server_info);
 414
 415         (auth_context->free)(&auth_context);
 416         free_user_info(&user_info);
 417
 418         p->ntlmssp_auth_validated = NT_STATUS_IS_OK(nt_status);
 419
 420         if (!p->ntlmssp_auth_validated) {
 421                 DEBUG(1,("api_pipe_ntlmssp_verify: User [%s]\\[%s] from machine %s \
 422 failed authentication on named pipe %s.\n", domain, user_name, wks, p->name ));
 423                 free_server_info(&server_info);
 424                 return False;
 425         }
 426
 427         /*
 428          * Set up the sign/seal data.
 429          */
 430
 431         {
 432                 uchar p24[24];
 433                 NTLMSSPOWFencrypt(server_info->first_8_lm_hash, lm_owf, p24);
 434                 {
 435                         unsigned char j = 0;
 436                         int ind;
 437
 438                         unsigned char k2[8];
 439
 440                         memcpy(k2, p24, 5);
 441                         k2[5] = 0xe5;
 442                         k2[6] = 0x38;
 443                         k2[7] = 0xb0;
 444
 445                         for (ind = 0; ind < 256; ind++)
 446                                 p->ntlmssp_hash[ind] = (unsigned char)ind;
 447
 448                         for( ind = 0; ind < 256; ind++) {
 449                                 unsigned char tc;
 450
 451                                 j += (p->ntlmssp_hash[ind] + k2[ind%8]);
 452
 453                                 tc = p->ntlmssp_hash[ind];
 454                                 p->ntlmssp_hash[ind] = p->ntlmssp_hash[j];
 455                                 p->ntlmssp_hash[j] = tc;
 456                         }
 457
 458                         p->ntlmssp_hash[256] = 0;
 459                         p->ntlmssp_hash[257] = 0;
 460                 }
 461 /*              NTLMSSPhash(p->ntlmssp_hash, p24); */
 462                 p->ntlmssp_seq_num = 0;
 463
 464         }
 465
 466         fstrcpy(p->user_name, user_name);
 467         fstrcpy(p->pipe_user_name, pdb_get_username(server_info->sam_account));
 468         fstrcpy(p->domain, domain);
 469         fstrcpy(p->wks, wks);
 470
 471         /*
 472          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 473          */
 474
 475         if (!IS_SAM_UNIX_USER(server_info->sam_account)) {
 476                 DEBUG(0,("Attempted authenticated pipe with invalid user.  No uid/gid in SAM_ACCOUNT\n"));
 477                 free_server_info(&server_info);
 478                 return False;
 479         }
 480
 481         memcpy(p->session_key, server_info->session_key, sizeof(p->session_key));
 482
 483         p->pipe_user.uid = pdb_get_uid(server_info->sam_account);
 484         p->pipe_user.gid = pdb_get_gid(server_info->sam_account);
 485
 486         p->pipe_user.ngroups = server_info->n_groups;
 487         if (p->pipe_user.ngroups) {
 488                 if (!(p->pipe_user.groups = memdup(server_info->groups, sizeof(gid_t) * p->pipe_user.ngroups))) {
 489                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 490                         free_server_info(&server_info);
 491                         return False;
 492                 }
 493         }
 494
 495         if (server_info->ptok)
 496                 p->pipe_user.nt_user_token = dup_nt_token(server_info->ptok);
 497         else {
 498                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 499                 p->pipe_user.nt_user_token = NULL;
 500                 free_server_info(&server_info);
 501                 return False;
 502         }
 503
 504         p->ntlmssp_auth_validated = True;
 505
 506         free_server_info(&server_info);
 507         return True;
 508 }
 509
 510 /*******************************************************************
 511  The switch table for the pipe names and the functions to handle them.
 512  *******************************************************************/
 513
 514 struct rpc_table
 515 {
 516   struct
 517   {
 518     const char *clnt;
 519     const char *srv;
 520   } pipe;
 521   struct api_struct *cmds;
 522   int n_cmds;
 523 };
 524
 525 static struct rpc_table *rpc_lookup;
 526 static int rpc_lookup_size;
 527
 528 /*******************************************************************
 529  This is the client reply to our challenge for an authenticated
 530  bind request. The challenge we sent is in p->challenge.
 531 *******************************************************************/
 532
 533 BOOL api_pipe_bind_auth_resp(pipes_struct *p, prs_struct *rpc_in_p)
 534 {
 535         RPC_HDR_AUTHA autha_info;
 536         RPC_AUTH_VERIFIER auth_verifier;
 537         RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 538
 539         DEBUG(5,("api_pipe_bind_auth_resp: decode request. %d\n", __LINE__));
 540
 541         if (p->hdr.auth_len == 0) {
 542                 DEBUG(0,("api_pipe_bind_auth_resp: No auth field sent !\n"));
 543                 return False;
 544         }
 545
 546         /*
 547          * Decode the authentication verifier response.
 548          */
 549
 550         if(!smb_io_rpc_hdr_autha("", &autha_info, rpc_in_p, 0)) {
 551                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_HDR_AUTHA failed.\n"));
 552                 return False;
 553         }
 554
 555         if (autha_info.auth_type != NTLMSSP_AUTH_TYPE || autha_info.auth_level != NTLMSSP_AUTH_LEVEL) {
 556                 DEBUG(0,("api_pipe_bind_auth_resp: incorrect auth type (%d) or level (%d).\n",
 557                         (int)autha_info.auth_type, (int)autha_info.auth_level ));
 558                 return False;
 559         }
 560
 561         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 562                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_AUTH_VERIFIER failed.\n"));
 563                 return False;
 564         }
 565
 566         /*
 567          * Ensure this is a NTLMSSP_AUTH packet type.
 568          */
 569
 570         if (!rpc_auth_verifier_chk(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH)) {
 571                 DEBUG(0,("api_pipe_bind_auth_resp: rpc_auth_verifier_chk failed.\n"));
 572                 return False;
 573         }
 574
 575         if(!smb_io_rpc_auth_ntlmssp_resp("", &ntlmssp_resp, rpc_in_p, 0)) {
 576                 DEBUG(0,("api_pipe_bind_auth_resp: Failed to unmarshall RPC_AUTH_NTLMSSP_RESP.\n"));
 577                 return False;
 578         }
 579
 580         /*
 581          * The following call actually checks the challenge/response data.
 582          * for correctness against the given DOMAIN\user name.
 583          */
 584
 585         if (!api_pipe_ntlmssp_verify(p, &ntlmssp_resp))
 586                 return False;
 587
 588         p->pipe_bound = True
 589 ;
 590         return True;
 591 }
 592
 593 /*******************************************************************
 594  Marshall a bind_nak pdu.
 595 *******************************************************************/
 596
 597 static BOOL setup_bind_nak(pipes_struct *p)
 598 {
 599         prs_struct outgoing_rpc;
 600         RPC_HDR nak_hdr;
 601         uint16 zero = 0;
 602
 603         /* Free any memory in the current return data buffer. */
 604         prs_mem_free(&p->out_data.rdata);
 605
 606         /*
 607          * Marshall directly into the outgoing PDU space. We
 608          * must do this as we need to set to the bind response
 609          * header and are never sending more than one PDU here.
 610          */
 611
 612         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 613         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 614
 615
 616         /*
 617          * Initialize a bind_nak header.
 618          */
 619
 620         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 621             p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 622
 623         /*
 624          * Marshall the header into the outgoing PDU.
 625          */
 626
 627         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 628                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 629                 prs_mem_free(&outgoing_rpc);
 630                 return False;
 631         }
 632
 633         /*
 634          * Now add the reject reason.
 635          */
 636
 637         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 638                 prs_mem_free(&outgoing_rpc);
 639         return False;
 640         }
 641
 642         p->out_data.data_sent_length = 0;
 643         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 644         p->out_data.current_pdu_sent = 0;
 645
 646         p->pipe_bound = False;
 647
 648         return True;
 649 }
 650
 651 /*******************************************************************
 652  Marshall a fault pdu.
 653 *******************************************************************/
 654
 655 BOOL setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 656 {
 657         prs_struct outgoing_pdu;
 658         RPC_HDR fault_hdr;
 659         RPC_HDR_RESP hdr_resp;
 660         RPC_HDR_FAULT fault_resp;
 661
 662         /* Free any memory in the current return data buffer. */
 663         prs_mem_free(&p->out_data.rdata);
 664
 665         /*
 666          * Marshall directly into the outgoing PDU space. We
 667          * must do this as we need to set to the bind response
 668          * header and are never sending more than one PDU here.
 669          */
 670
 671         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 672         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 673
 674         /*
 675          * Initialize a fault header.
 676          */
 677
 678         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 679             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 680
 681         /*
 682          * Initialize the HDR_RESP and FAULT parts of the PDU.
 683          */
 684
 685         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 686
 687         fault_resp.status = status;
 688         fault_resp.reserved = 0;
 689
 690         /*
 691          * Marshall the header into the outgoing PDU.
 692          */
 693
 694         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 695                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 696                 prs_mem_free(&outgoing_pdu);
 697                 return False;
 698         }
 699
 700         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 701                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 702                 prs_mem_free(&outgoing_pdu);
 703                 return False;
 704         }
 705
 706         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 707                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 708                 prs_mem_free(&outgoing_pdu);
 709                 return False;
 710         }
 711
 712         p->out_data.data_sent_length = 0;
 713         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 714         p->out_data.current_pdu_sent = 0;
 715
 716         prs_mem_free(&outgoing_pdu);
 717         return True;
 718 }
 719
 720 /*******************************************************************
 721  Ensure a bind request has the correct abstract & transfer interface.
 722  Used to reject unknown binds from Win2k.
 723 *******************************************************************/
 724
 725 BOOL check_bind_req(char* pipe_name, RPC_IFACE* abstract,
 726                                         RPC_IFACE* transfer)
 727 {
 728         extern struct pipe_id_info pipe_names[];
 729         int i=0;
 730         fstring pname;
 731         fstrcpy(pname,"\\PIPE\\");
 732         fstrcat(pname,pipe_name);
 733
 734         DEBUG(3,("check_bind_req for %s\n", pname));
 735
 736 #ifndef SUPPORT_NEW_LSARPC_UUID
 737
 738         /* check for the first pipe matching the name */
 739
 740         for ( i=0; pipe_names[i].client_pipe; i++ ) {
 741                 if ( strequal(pipe_names[i].client_pipe, pname) )
 742                         break;
 743         }
 744 #else
 745         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 746
 747         for ( i=0; pipe_names[i].client_pipe; i++ )
 748         {
 749                 if ( strequal(pipe_names[i].client_pipe, pname)
 750                         && (abstract->version == pipe_names[i].abstr_syntax.version)
 751                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(RPC_UUID)) == 0)
 752                         && (transfer->version == pipe_names[i].trans_syntax.version)
 753                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(RPC_UUID)) == 0) )
 754                 {
 755                         break;
 756                 }
 757         }
 758 #endif
 759
 760         if(pipe_names[i].client_pipe == NULL)
 761                 return False;
 762
 763 #ifndef SUPPORT_NEW_LSARPC_UUID
 764         /* check the abstract interface */
 765         if ( (abstract->version != pipe_names[i].abstr_syntax.version)
 766                 || (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(RPC_UUID)) != 0) )
 767         {
 768                 return False;
 769         }
 770
 771         /* check the transfer interface */
 772         if ( (transfer->version != pipe_names[i].trans_syntax.version)
 773                 || (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(RPC_UUID)) != 0) )
 774         {
 775                 return False;
 776         }
 777 #endif
 778         return True;
 779 }
 780
 781 /*******************************************************************
 782  Register commands to an RPC pipe
 783 *******************************************************************/
 784 int rpc_pipe_register_commands(const char *clnt, const char *srv, const struct api_struct *cmds, int size)
 785 {
 786         struct rpc_table *rpc_entry;
 787
 788
 789         /* We use a temporary variable because this call can fail and
 790            rpc_lookup will still be valid afterwards.  It could then succeed if
 791            called again later */
 792         rpc_entry = realloc(rpc_lookup,
 793                             ++rpc_lookup_size*sizeof(struct rpc_table));
 794         if (NULL == rpc_entry) {
 795                 rpc_lookup_size--;
 796                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
 797                 return 0;
 798         } else {
 799                 rpc_lookup = rpc_entry;
 800         }
 801
 802         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
 803         ZERO_STRUCTP(rpc_entry);
 804         rpc_entry->pipe.clnt = strdup(clnt);
 805         rpc_entry->pipe.srv = strdup(srv);
 806         rpc_entry->cmds = realloc(rpc_entry->cmds,
 807                                   (rpc_entry->n_cmds + size) *
 808                                   sizeof(struct api_struct));
 809         memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds,
 810                size * sizeof(struct api_struct));
 811         rpc_entry->n_cmds += size;
 812
 813         return size;
 814 }
 815
 816 /*******************************************************************
 817  Respond to a pipe bind request.
 818 *******************************************************************/
 819
 820 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
 821 {
 822         RPC_HDR_BA hdr_ba;
 823         RPC_HDR_RB hdr_rb;
 824         RPC_HDR_AUTH auth_info;
 825         uint16 assoc_gid;
 826         fstring ack_pipe_name;
 827         prs_struct out_hdr_ba;
 828         prs_struct out_auth;
 829         prs_struct outgoing_rpc;
 830         int i = 0;
 831         int auth_len = 0;
 832         enum RPC_PKT_TYPE reply_pkt_type;
 833
 834         p->ntlmssp_auth_requested = False;
 835         p->netsec_auth_validated = False;
 836
 837         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
 838
 839         /*
 840          * Try and find the correct pipe name to ensure
 841          * that this is a pipe name we support.
 842          */
 843
 844
 845         for (i = 0; i < rpc_lookup_size; i++) {
 846                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
 847                   DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 848                             rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
 849                   fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
 850                   break;
 851                 }
 852         }
 853
 854         if (i == rpc_lookup_size) {
 855                                 if (!smb_probe_module("rpc", p->name)) {
 856                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 857                                 p->name ));
 858                        if(!setup_bind_nak(p))
 859                                return False;
 860                        return True;
 861                 }
 862
 863                 for (i = 0; i < rpc_lookup_size; i++) {
 864                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
 865                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 866                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
 867                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
 868                                break;
 869                        }
 870                 }
 871
 872                                 if (i == rpc_lookup_size) {
 873                                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
 874                                         return False;
 875                                 }
 876         }
 877
 878         /* decode the bind request */
 879         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
 880                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
 881                 return False;
 882         }
 883
 884         /*
 885          * Check if this is an authenticated request.
 886          */
 887
 888         if (p->hdr.auth_len != 0) {
 889                 RPC_AUTH_VERIFIER auth_verifier;
 890                 RPC_AUTH_NTLMSSP_NEG ntlmssp_neg;
 891
 892                 /*
 893                  * Decode the authentication verifier.
 894                  */
 895
 896                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 897                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 898                         return False;
 899                 }
 900
 901                 if(auth_info.auth_type == NTLMSSP_AUTH_TYPE) {
 902
 903                         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 904                                 DEBUG(0,("api_pipe_bind_req: unable to "
 905                                          "unmarshall RPC_HDR_AUTH struct.\n"));
 906                                 return False;
 907                         }
 908
 909                         if(!strequal(auth_verifier.signature, "NTLMSSP")) {
 910                                 DEBUG(0,("api_pipe_bind_req: "
 911                                          "auth_verifier.signature != NTLMSSP\n"));
 912                                 return False;
 913                         }
 914
 915                         if(auth_verifier.msg_type != NTLMSSP_NEGOTIATE) {
 916                                 DEBUG(0,("api_pipe_bind_req: "
 917                                          "auth_verifier.msg_type (%d) != NTLMSSP_NEGOTIATE\n",
 918                                          auth_verifier.msg_type));
 919                                 return False;
 920                         }
 921
 922                         if(!smb_io_rpc_auth_ntlmssp_neg("", &ntlmssp_neg, rpc_in_p, 0)) {
 923                                 DEBUG(0,("api_pipe_bind_req: "
 924                                          "Failed to unmarshall RPC_AUTH_NTLMSSP_NEG.\n"));
 925                                 return False;
 926                         }
 927
 928                         p->ntlmssp_chal_flags = SMBD_NTLMSSP_NEG_FLAGS;
 929                         p->ntlmssp_auth_requested = True;
 930
 931                 } else if (auth_info.auth_type == NETSEC_AUTH_TYPE) {
 932
 933                         RPC_AUTH_NETSEC_NEG neg;
 934                         struct netsec_auth_struct *a = &(p->netsec_auth);
 935
 936                         if (!smb_io_rpc_auth_netsec_neg("", &neg, rpc_in_p, 0)) {
 937                                 DEBUG(0,("api_pipe_bind_req: "
 938                                          "Could not unmarshal SCHANNEL auth neg\n"));
 939                                 return False;
 940                         }
 941
 942                         p->netsec_auth_validated = True;
 943
 944                         memset(a->sess_key, 0, sizeof(a->sess_key));
 945                         memcpy(a->sess_key, last_dcinfo.sess_key, sizeof(last_dcinfo.sess_key));
 946
 947                         a->seq_num = 0;
 948
 949                         DEBUG(10,("schannel auth: domain [%s] myname [%s]\n",
 950                                   neg.domain, neg.myname));
 951
 952                 } else {
 953                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n",
 954                                  auth_info.auth_type ));
 955                         return False;
 956                 }
 957         }
 958
 959         switch(p->hdr.pkt_type) {
 960                 case RPC_BIND:
 961                         /* name has to be \PIPE\xxxxx */
 962                         fstrcpy(ack_pipe_name, "\\PIPE\\");
 963                         fstrcat(ack_pipe_name, p->pipe_srv_name);
 964                         reply_pkt_type = RPC_BINDACK;
 965                         break;
 966                 case RPC_ALTCONT:
 967                         /* secondary address CAN be NULL
 968                          * as the specs say it's ignored.
 969                          * It MUST NULL to have the spoolss working.
 970                          */
 971                         fstrcpy(ack_pipe_name,"");
 972                         reply_pkt_type = RPC_ALTCONTRESP;
 973                         break;
 974                 default:
 975                         return False;
 976         }
 977
 978         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 979
 980         /*
 981          * Marshall directly into the outgoing PDU space. We
 982          * must do this as we need to set to the bind response
 983          * header and are never sending more than one PDU here.
 984          */
 985
 986         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 987         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 988
 989         /*
 990          * Setup the memory to marshall the ba header, and the
 991          * auth footers.
 992          */
 993
 994         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
 995                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
 996                 prs_mem_free(&outgoing_rpc);
 997                 return False;
 998         }
 999
1000         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1001                 DEBUG(0,("pi_pipe_bind_req: malloc out_auth failed.\n"));
1002                 prs_mem_free(&outgoing_rpc);
1003                 prs_mem_free(&out_hdr_ba);
1004                 return False;
1005         }
1006
1007         if (p->ntlmssp_auth_requested)
1008                 assoc_gid = 0x7a77;
1009         else
1010                 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1011
1012         /*
1013          * Create the bind response struct.
1014          */
1015
1016         /* If the requested abstract synt uuid doesn't match our client pipe,
1017                 reject the bind_ack & set the transfer interface synt to all 0's,
1018                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1019                 unknown to NT4)
1020                 Needed when adding entries to a DACL from NT5 - SK */
1021
1022         if(check_bind_req(p->name, &hdr_rb.abstract, &hdr_rb.transfer)) {
1023                 init_rpc_hdr_ba(&hdr_ba,
1024                         MAX_PDU_FRAG_LEN,
1025                         MAX_PDU_FRAG_LEN,
1026                         assoc_gid,
1027                         ack_pipe_name,
1028                         0x1, 0x0, 0x0,
1029                         &hdr_rb.transfer);
1030         } else {
1031                 RPC_IFACE null_interface;
1032                 ZERO_STRUCT(null_interface);
1033                 /* Rejection reason: abstract syntax not supported */
1034                 init_rpc_hdr_ba(&hdr_ba, MAX_PDU_FRAG_LEN,
1035                                         MAX_PDU_FRAG_LEN, assoc_gid,
1036                                         ack_pipe_name, 0x1, 0x2, 0x1,
1037                                         &null_interface);
1038         }
1039
1040         /*
1041          * and marshall it.
1042          */
1043
1044         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1045                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1046                 goto err_exit;
1047         }
1048
1049         /*
1050          * Now the authentication.
1051          */
1052
1053         if (p->ntlmssp_auth_requested) {
1054                 RPC_AUTH_VERIFIER auth_verifier;
1055                 RPC_AUTH_NTLMSSP_CHAL ntlmssp_chal;
1056
1057                 generate_random_buffer(p->challenge, 8, False);
1058
1059                 /*** Authentication info ***/
1060
1061                 init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, RPC_HDR_AUTH_LEN, 1);
1062                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
1063                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
1064                         goto err_exit;
1065                 }
1066
1067                 /*** NTLMSSP verifier ***/
1068
1069                 init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_CHALLENGE);
1070                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, &out_auth, 0)) {
1071                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1072                         goto err_exit;
1073                 }
1074
1075                 /* NTLMSSP challenge ***/
1076
1077                 init_rpc_auth_ntlmssp_chal(&ntlmssp_chal, p->ntlmssp_chal_flags, p->challenge);
1078                 if(!smb_io_rpc_auth_ntlmssp_chal("", &ntlmssp_chal, &out_auth, 0)) {
1079                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_NTLMSSP_CHAL failed.\n"));
1080                         goto err_exit;
1081                 }
1082
1083                 /* Auth len in the rpc header doesn't include auth_header. */
1084                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1085         }
1086
1087         if (p->netsec_auth_validated) {
1088                 RPC_AUTH_VERIFIER auth_verifier;
1089                 uint32 flags;
1090
1091                 init_rpc_hdr_auth(&auth_info, NETSEC_AUTH_TYPE, NETSEC_AUTH_LEVEL, RPC_HDR_AUTH_LEN, 1);
1092                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
1093                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
1094                         goto err_exit;
1095                 }
1096
1097                 /*** NETSEC verifier ***/
1098
1099                 init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1100                 if(!smb_io_rpc_netsec_verifier("", &auth_verifier, &out_auth, 0)) {
1101                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1102                         goto err_exit;
1103                 }
1104
1105                 prs_align(&out_auth);
1106
1107                 flags = 5;
1108                 if(!prs_uint32("flags ", &out_auth, 0, &flags))
1109                         goto err_exit;
1110
1111                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1112         }
1113
1114         /*
1115          * Create the header, now we know the length.
1116          */
1117
1118         init_rpc_hdr(&p->hdr, reply_pkt_type, RPC_FLG_FIRST | RPC_FLG_LAST,
1119                         p->hdr.call_id,
1120                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1121                         auth_len);
1122
1123         /*
1124          * Marshall the header into the outgoing PDU.
1125          */
1126
1127         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1128                 DEBUG(0,("pi_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1129                 goto err_exit;
1130         }
1131
1132         /*
1133          * Now add the RPC_HDR_BA and any auth needed.
1134          */
1135
1136         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1137                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1138                 goto err_exit;
1139         }
1140
1141         if((p->ntlmssp_auth_requested|p->netsec_auth_validated) &&
1142            !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1143                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1144                 goto err_exit;
1145         }
1146
1147         if(!p->ntlmssp_auth_requested)
1148                 p->pipe_bound = True;
1149
1150         /*
1151          * Setup the lengths for the initial reply.
1152          */
1153
1154         p->out_data.data_sent_length = 0;
1155         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1156         p->out_data.current_pdu_sent = 0;
1157
1158         prs_mem_free(&out_hdr_ba);
1159         prs_mem_free(&out_auth);
1160
1161         return True;
1162
1163   err_exit:
1164
1165         prs_mem_free(&outgoing_rpc);
1166         prs_mem_free(&out_hdr_ba);
1167         prs_mem_free(&out_auth);
1168         return False;
1169 }
1170
1171 /****************************************************************************
1172  Deal with sign & seal processing on an RPC request.
1173 ****************************************************************************/
1174
1175 BOOL api_pipe_auth_process(pipes_struct *p, prs_struct *rpc_in)
1176 {
1177         /*
1178          * We always negotiate the following two bits....
1179          */
1180         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
1181         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
1182         int data_len;
1183         int auth_len;
1184         uint32 old_offset;
1185         uint32 crc32 = 0;
1186
1187         auth_len = p->hdr.auth_len;
1188
1189         if ((auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) && auth_verify) {
1190                 DEBUG(0,("api_pipe_auth_process: Incorrect auth_len %d.\n", auth_len ));
1191                 return False;
1192         }
1193
1194         /*
1195          * The following is that length of the data we must verify or unseal.
1196          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1197          * preceeding the auth_data.
1198          */
1199
1200         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1201                         (auth_verify ? RPC_HDR_AUTH_LEN : 0) - auth_len;
1202
1203         DEBUG(5,("api_pipe_auth_process: sign: %s seal: %s data %d auth %d\n",
1204                  BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, auth_len));
1205
1206         if (auth_seal) {
1207                 /*
1208                  * The data in rpc_in doesn't contain the RPC_HEADER as this
1209                  * has already been consumed.
1210                  */
1211                 char *data = prs_data_p(rpc_in) + RPC_HDR_REQ_LEN;
1212                 NTLMSSPcalc_p(p, (uchar*)data, data_len);
1213                 crc32 = crc32_calc_buffer(data, data_len);
1214         }
1215
1216         old_offset = prs_offset(rpc_in);
1217
1218         if (auth_seal || auth_verify) {
1219                 RPC_HDR_AUTH auth_info;
1220
1221                 if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1222                         DEBUG(0,("api_pipe_auth_process: cannot move offset to %u.\n",
1223                                 (unsigned int)old_offset + data_len ));
1224                         return False;
1225                 }
1226
1227                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1228                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1229                         return False;
1230                 }
1231         }
1232
1233         if (auth_verify) {
1234                 RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
1235                 char *req_data = prs_data_p(rpc_in) + prs_offset(rpc_in) + 4;
1236
1237                 DEBUG(5,("api_pipe_auth_process: auth %d\n", prs_offset(rpc_in) + 4));
1238
1239                 /*
1240                  * Ensure we have RPC_AUTH_NTLMSSP_CHK_LEN - 4 more bytes in the
1241                  * incoming buffer.
1242                  */
1243                 if(prs_mem_get(rpc_in, RPC_AUTH_NTLMSSP_CHK_LEN - 4) == NULL) {
1244                         DEBUG(0,("api_pipe_auth_process: missing %d bytes in buffer.\n",
1245                                 RPC_AUTH_NTLMSSP_CHK_LEN - 4 ));
1246                         return False;
1247                 }
1248
1249                 NTLMSSPcalc_p(p, (uchar*)req_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
1250                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, rpc_in, 0)) {
1251                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_AUTH_NTLMSSP_CHK.\n"));
1252                         return False;
1253                 }
1254
1255                 if (!rpc_auth_ntlmssp_chk(&ntlmssp_chk, crc32, p->ntlmssp_seq_num)) {
1256                         DEBUG(0,("api_pipe_auth_process: NTLMSSP check failed.\n"));
1257                         return False;
1258                 }
1259         }
1260
1261         /*
1262          * Return the current pointer to the data offset.
1263          */
1264
1265         if(!prs_set_offset(rpc_in, old_offset)) {
1266                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
1267                         (unsigned int)old_offset ));
1268                 return False;
1269         }
1270
1271         return True;
1272 }
1273
1274 /****************************************************************************
1275  Deal with schannel processing on an RPC request.
1276 ****************************************************************************/
1277 BOOL api_pipe_netsec_process(pipes_struct *p, prs_struct *rpc_in)
1278 {
1279         /*
1280          * We always negotiate the following two bits....
1281          */
1282         int data_len;
1283         int auth_len;
1284         uint32 old_offset;
1285         RPC_HDR_AUTH auth_info;
1286         RPC_AUTH_NETSEC_CHK netsec_chk;
1287
1288
1289         auth_len = p->hdr.auth_len;
1290
1291         if (auth_len != RPC_AUTH_NETSEC_CHK_LEN) {
1292                 DEBUG(0,("Incorrect auth_len %d.\n", auth_len ));
1293                 return False;
1294         }
1295
1296         /*
1297          * The following is that length of the data we must verify or unseal.
1298          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1299          * preceeding the auth_data.
1300          */
1301
1302         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1303                 RPC_HDR_AUTH_LEN - auth_len;
1304
1305         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
1306
1307         old_offset = prs_offset(rpc_in);
1308
1309         if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1310                 DEBUG(0,("cannot move offset to %u.\n",
1311                          (unsigned int)old_offset + data_len ));
1312                 return False;
1313         }
1314
1315         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1316                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
1317                 return False;
1318         }
1319
1320         if ((auth_info.auth_type != NETSEC_AUTH_TYPE) ||
1321             (auth_info.auth_level != NETSEC_AUTH_LEVEL)) {
1322                 DEBUG(0,("Invalid auth info %d or level %d on schannel\n",
1323                          auth_info.auth_type, auth_info.auth_level));
1324                 return False;
1325         }
1326
1327         if(!smb_io_rpc_auth_netsec_chk("", &netsec_chk, rpc_in, 0)) {
1328                 DEBUG(0,("failed to unmarshal RPC_AUTH_NETSEC_CHK.\n"));
1329                 return False;
1330         }
1331
1332         if (!netsec_decode(&p->netsec_auth, &netsec_chk,
1333                            prs_data_p(rpc_in)+old_offset, data_len)) {
1334                 DEBUG(0,("failed to decode PDU\n"));
1335                 return False;
1336         }
1337
1338         /*
1339          * Return the current pointer to the data offset.
1340          */
1341
1342         if(!prs_set_offset(rpc_in, old_offset)) {
1343                 DEBUG(0,("failed to set offset back to %u\n",
1344                          (unsigned int)old_offset ));
1345                 return False;
1346         }
1347
1348         /* The sequence number gets incremented on both send and receive. */
1349         p->netsec_auth.seq_num++;
1350
1351         return True;
1352 }
1353
1354 /****************************************************************************
1355  Return a user struct for a pipe user.
1356 ****************************************************************************/
1357
1358 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
1359 {
1360         if (p->ntlmssp_auth_validated) {
1361                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
1362         } else {
1363                 extern struct current_user current_user;
1364                 memcpy(user, &current_user, sizeof(struct current_user));
1365         }
1366
1367         return user;
1368 }
1369
1370 /****************************************************************************
1371  Find the correct RPC function to call for this request.
1372  If the pipe is authenticated then become the correct UNIX user
1373  before doing the call.
1374 ****************************************************************************/
1375
1376 BOOL api_pipe_request(pipes_struct *p)
1377 {
1378         int i = 0;
1379         BOOL ret = False;
1380
1381         if (p->ntlmssp_auth_validated) {
1382
1383                 if(!become_authenticated_pipe_user(p)) {
1384                         prs_mem_free(&p->out_data.rdata);
1385                         return False;
1386                 }
1387         }
1388
1389         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
1390
1391         for (i = 0; i < rpc_lookup_size; i++) {
1392                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1393                         DEBUG(3,("Doing \\PIPE\\%s\n",
1394                                  rpc_lookup[i].pipe.clnt));
1395                         set_current_rpc_talloc(p->mem_ctx);
1396                         ret = api_rpcTNP(p, rpc_lookup[i].pipe.clnt,
1397                                          rpc_lookup[i].cmds,
1398                                          rpc_lookup[i].n_cmds);
1399                         set_current_rpc_talloc(NULL);
1400                         break;
1401                 }
1402         }
1403
1404
1405         if (i == rpc_lookup_size) {
1406                 smb_probe_module("rpc", p->name);
1407
1408                 for (i = 0; i < rpc_lookup_size; i++) {
1409                         if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1410                                 DEBUG(3,("Doing \\PIPE\\%s\n",
1411                                          rpc_lookup[i].pipe.clnt));
1412                                 set_current_rpc_talloc(p->mem_ctx);
1413                                 ret = api_rpcTNP(p, rpc_lookup[i].pipe.clnt,
1414                                                  rpc_lookup[i].cmds,
1415                                                  rpc_lookup[i].n_cmds);
1416                                 set_current_rpc_talloc(NULL);
1417                                 break;
1418                         }
1419                 }
1420         }
1421
1422         if(p->ntlmssp_auth_validated)
1423                 unbecome_authenticated_pipe_user();
1424
1425         return ret;
1426 }
1427
1428 /*******************************************************************
1429  Calls the underlying RPC function for a named pipe.
1430  ********************************************************************/
1431
1432 BOOL api_rpcTNP(pipes_struct *p, const char *rpc_name,
1433                 const struct api_struct *api_rpc_cmds, int n_cmds)
1434 {
1435         int fn_num;
1436         fstring name;
1437         uint32 offset1, offset2;
1438
1439         /* interpret the command */
1440         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
1441
1442         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
1443         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
1444
1445         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1446                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
1447                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
1448                         break;
1449                 }
1450         }
1451
1452         if (fn_num == n_cmds) {
1453                 /*
1454                  * For an unknown RPC just return a fault PDU but
1455                  * return True to allow RPC's on the pipe to continue
1456                  * and not put the pipe into fault state. JRA.
1457                  */
1458                 DEBUG(4, ("unknown\n"));
1459                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
1460                 return True;
1461         }
1462
1463         offset1 = prs_offset(&p->out_data.rdata);
1464
1465         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1466                 fn_num, api_rpc_cmds[fn_num].fn));
1467         /* do the actual command */
1468         if(!api_rpc_cmds[fn_num].fn(p)) {
1469                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
1470                 prs_mem_free(&p->out_data.rdata);
1471                 return False;
1472         }
1473
1474         if (p->bad_handle_fault_state) {
1475                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1476                 p->bad_handle_fault_state = False;
1477                 setup_fault_pdu(p, NT_STATUS(0x1C00001A));
1478                 return True;
1479         }
1480
1481         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
1482         offset2 = prs_offset(&p->out_data.rdata);
1483         prs_set_offset(&p->out_data.rdata, offset1);
1484         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
1485         prs_set_offset(&p->out_data.rdata, offset2);
1486
1487         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
1488
1489         /* Check for buffer underflow in rpc parsing */
1490
1491         if ((DEBUGLEVEL >= 10) &&
1492             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
1493                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
1494                 char *data;
1495
1496                 data = malloc(data_len);
1497
1498                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1499                 if (data) {
1500                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
1501                         SAFE_FREE(data);
1502                 }
1503
1504         }
1505
1506         return True;
1507 }