source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31
  32 extern struct pipe_id_info pipe_names[];
  33 extern struct current_user current_user;
  34
  35 #undef DBGC_CLASS
  36 #define DBGC_CLASS DBGC_RPC_SRV
  37
  38 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  39 {
  40         AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
  41
  42         if (a) {
  43                 auth_ntlmssp_end(&a);
  44         }
  45         auth->a_u.auth_ntlmssp_state = NULL;
  46 }
  47
  48 static DATA_BLOB generic_session_key(void)
  49 {
  50         return data_blob("SystemLibraryDTC", 16);
  51 }
  52
  53 /*******************************************************************
  54  Generate the next PDU to be returned from the data in p->rdata.
  55  Handle NTLMSSP.
  56  ********************************************************************/
  57
  58 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  59 {
  60         RPC_HDR_RESP hdr_resp;
  61         uint32 ss_padding_len = 0;
  62         uint32 data_space_available;
  63         uint32 data_len_left;
  64         uint32 data_len;
  65         prs_struct outgoing_pdu;
  66         NTSTATUS status;
  67         DATA_BLOB auth_blob;
  68         RPC_HDR_AUTH auth_info;
  69         uint8 auth_type, auth_level;
  70         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
  71
  72         /*
  73          * If we're in the fault state, keep returning fault PDU's until
  74          * the pipe gets closed. JRA.
  75          */
  76
  77         if(p->fault_state) {
  78                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  79                 return True;
  80         }
  81
  82         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  83
  84         /* Change the incoming request header to a response. */
  85         p->hdr.pkt_type = RPC_RESPONSE;
  86
  87         /* Set up rpc header flags. */
  88         if (p->out_data.data_sent_length == 0) {
  89                 p->hdr.flags = RPC_FLG_FIRST;
  90         } else {
  91                 p->hdr.flags = 0;
  92         }
  93
  94         /*
  95          * Work out how much we can fit in a single PDU.
  96          */
  97
  98         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
  99
 100         /*
 101          * Ensure there really is data left to send.
 102          */
 103
 104         if(!data_len_left) {
 105                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 106                 return False;
 107         }
 108
 109         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 110                                         RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 111
 112         /*
 113          * The amount we send is the minimum of the available
 114          * space and the amount left to send.
 115          */
 116
 117         data_len = MIN(data_len_left, data_space_available);
 118
 119         /*
 120          * Set up the alloc hint. This should be the data left to
 121          * send.
 122          */
 123
 124         hdr_resp.alloc_hint = data_len_left;
 125
 126         /*
 127          * Work out if this PDU will be the last.
 128          */
 129
 130         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 131                 p->hdr.flags |= RPC_FLG_LAST;
 132                 if (data_len_left % 8) {
 133                         ss_padding_len = 8 - (data_len_left % 8);
 134                         DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 135                                 ss_padding_len ));
 136                 }
 137         }
 138
 139         /*
 140          * Set up the header lengths.
 141          */
 142
 143         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 144                         data_len + ss_padding_len +
 145                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 146         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 147
 148
 149         /*
 150          * Init the parse struct to point at the outgoing
 151          * data.
 152          */
 153
 154         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 155         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 156
 157         /* Store the header in the data stream. */
 158         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 159                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 160                 prs_mem_free(&outgoing_pdu);
 161                 return False;
 162         }
 163
 164         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 165                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 166                 prs_mem_free(&outgoing_pdu);
 167                 return False;
 168         }
 169
 170         /* Copy the data into the PDU. */
 171
 172         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 173                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 174                 prs_mem_free(&outgoing_pdu);
 175                 return False;
 176         }
 177
 178         /* Copy the sign/seal padding data. */
 179         if (ss_padding_len) {
 180                 char pad[8];
 181
 182                 memset(pad, '\0', 8);
 183                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 184                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 185                                         (unsigned int)ss_padding_len));
 186                         prs_mem_free(&outgoing_pdu);
 187                         return False;
 188                 }
 189         }
 190
 191
 192         /* Now write out the auth header and null blob. */
 193         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 194                 auth_type = RPC_NTLMSSP_AUTH_TYPE;
 195         } else {
 196                 auth_type = RPC_SPNEGO_AUTH_TYPE;
 197         }
 198         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 199                 auth_level = RPC_AUTH_LEVEL_PRIVACY;
 200         } else {
 201                 auth_level = RPC_AUTH_LEVEL_INTEGRITY;
 202         }
 203
 204         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 205         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 206                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 207                 prs_mem_free(&outgoing_pdu);
 208                 return False;
 209         }
 210
 211         /* Generate the sign blob. */
 212
 213         switch (p->auth.auth_level) {
 214                 case PIPE_AUTH_LEVEL_PRIVACY:
 215                         /* Data portion is encrypted. */
 216                         status = ntlmssp_seal_packet(a->ntlmssp_state,
 217                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 218                                                         data_len + ss_padding_len,
 219                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 220                                                         (size_t)prs_offset(&outgoing_pdu),
 221                                                         &auth_blob);
 222                         if (!NT_STATUS_IS_OK(status)) {
 223                                 data_blob_free(&auth_blob);
 224                                 prs_mem_free(&outgoing_pdu);
 225                                 return False;
 226                         }
 227                         break;
 228                 case PIPE_AUTH_LEVEL_INTEGRITY:
 229                         /* Data is signed. */
 230                         status = ntlmssp_sign_packet(a->ntlmssp_state,
 231                                                         (unsigned char *)prs_data_p(&outgoing_pdu) + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 232                                                         data_len + ss_padding_len,
 233                                                         (unsigned char *)prs_data_p(&outgoing_pdu),
 234                                                         (size_t)prs_offset(&outgoing_pdu),
 235                                                         &auth_blob);
 236                         if (!NT_STATUS_IS_OK(status)) {
 237                                 data_blob_free(&auth_blob);
 238                                 prs_mem_free(&outgoing_pdu);
 239                                 return False;
 240                         }
 241                         break;
 242                 default:
 243                         prs_mem_free(&outgoing_pdu);
 244                         return False;
 245         }
 246
 247         /* Append the auth blob. */
 248         if (!prs_copy_data_in(&outgoing_pdu, (char *)auth_blob.data, NTLMSSP_SIG_SIZE)) {
 249                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 250                                 (unsigned int)NTLMSSP_SIG_SIZE));
 251                 data_blob_free(&auth_blob);
 252                 prs_mem_free(&outgoing_pdu);
 253                 return False;
 254         }
 255
 256         data_blob_free(&auth_blob);
 257
 258         /*
 259          * Setup the counts for this PDU.
 260          */
 261
 262         p->out_data.data_sent_length += data_len;
 263         p->out_data.current_pdu_len = p->hdr.frag_len;
 264         p->out_data.current_pdu_sent = 0;
 265
 266         prs_mem_free(&outgoing_pdu);
 267         return True;
 268 }
 269
 270 /*******************************************************************
 271  Generate the next PDU to be returned from the data in p->rdata.
 272  Return an schannel authenticated fragment.
 273  ********************************************************************/
 274
 275 static bool create_next_pdu_schannel(pipes_struct *p)
 276 {
 277         RPC_HDR_RESP hdr_resp;
 278         uint32 ss_padding_len = 0;
 279         uint32 data_len;
 280         uint32 data_space_available;
 281         uint32 data_len_left;
 282         prs_struct outgoing_pdu;
 283         uint32 data_pos;
 284
 285         /*
 286          * If we're in the fault state, keep returning fault PDU's until
 287          * the pipe gets closed. JRA.
 288          */
 289
 290         if(p->fault_state) {
 291                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 292                 return True;
 293         }
 294
 295         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 296
 297         /* Change the incoming request header to a response. */
 298         p->hdr.pkt_type = RPC_RESPONSE;
 299
 300         /* Set up rpc header flags. */
 301         if (p->out_data.data_sent_length == 0) {
 302                 p->hdr.flags = RPC_FLG_FIRST;
 303         } else {
 304                 p->hdr.flags = 0;
 305         }
 306
 307         /*
 308          * Work out how much we can fit in a single PDU.
 309          */
 310
 311         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 312
 313         /*
 314          * Ensure there really is data left to send.
 315          */
 316
 317         if(!data_len_left) {
 318                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 319                 return False;
 320         }
 321
 322         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN -
 323                                         RPC_HDR_AUTH_LEN - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 324
 325         /*
 326          * The amount we send is the minimum of the available
 327          * space and the amount left to send.
 328          */
 329
 330         data_len = MIN(data_len_left, data_space_available);
 331
 332         /*
 333          * Set up the alloc hint. This should be the data left to
 334          * send.
 335          */
 336
 337         hdr_resp.alloc_hint = data_len_left;
 338
 339         /*
 340          * Work out if this PDU will be the last.
 341          */
 342
 343         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 344                 p->hdr.flags |= RPC_FLG_LAST;
 345                 if (data_len_left % 8) {
 346                         ss_padding_len = 8 - (data_len_left % 8);
 347                         DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 348                                 ss_padding_len ));
 349                 }
 350         }
 351
 352         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 353                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 354         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 355
 356         /*
 357          * Init the parse struct to point at the outgoing
 358          * data.
 359          */
 360
 361         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 362         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 363
 364         /* Store the header in the data stream. */
 365         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 366                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 367                 prs_mem_free(&outgoing_pdu);
 368                 return False;
 369         }
 370
 371         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 372                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 373                 prs_mem_free(&outgoing_pdu);
 374                 return False;
 375         }
 376
 377         /* Store the current offset. */
 378         data_pos = prs_offset(&outgoing_pdu);
 379
 380         /* Copy the data into the PDU. */
 381
 382         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 383                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 384                 prs_mem_free(&outgoing_pdu);
 385                 return False;
 386         }
 387
 388         /* Copy the sign/seal padding data. */
 389         if (ss_padding_len) {
 390                 char pad[8];
 391                 memset(pad, '\0', 8);
 392                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 393                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 394                         prs_mem_free(&outgoing_pdu);
 395                         return False;
 396                 }
 397         }
 398
 399         {
 400                 /*
 401                  * Schannel processing.
 402                  */
 403                 char *data;
 404                 RPC_HDR_AUTH auth_info;
 405                 RPC_AUTH_SCHANNEL_CHK verf;
 406
 407                 data = prs_data_p(&outgoing_pdu) + data_pos;
 408                 /* Check it's the type of reply we were expecting to decode */
 409
 410                 init_rpc_hdr_auth(&auth_info,
 411                                 RPC_SCHANNEL_AUTH_TYPE,
 412                                 p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY ?
 413                                         RPC_AUTH_LEVEL_PRIVACY : RPC_AUTH_LEVEL_INTEGRITY,
 414                                 ss_padding_len, 1);
 415
 416                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 417                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 418                         prs_mem_free(&outgoing_pdu);
 419                         return False;
 420                 }
 421
 422                 schannel_encode(p->auth.a_u.schannel_auth,
 423                               p->auth.auth_level,
 424                               SENDER_IS_ACCEPTOR,
 425                               &verf, data, data_len + ss_padding_len);
 426
 427                 if (!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN,
 428                                 &verf, &outgoing_pdu, 0)) {
 429                         prs_mem_free(&outgoing_pdu);
 430                         return False;
 431                 }
 432
 433                 p->auth.a_u.schannel_auth->seq_num++;
 434         }
 435
 436         /*
 437          * Setup the counts for this PDU.
 438          */
 439
 440         p->out_data.data_sent_length += data_len;
 441         p->out_data.current_pdu_len = p->hdr.frag_len;
 442         p->out_data.current_pdu_sent = 0;
 443
 444         prs_mem_free(&outgoing_pdu);
 445         return True;
 446 }
 447
 448 /*******************************************************************
 449  Generate the next PDU to be returned from the data in p->rdata.
 450  No authentication done.
 451 ********************************************************************/
 452
 453 static bool create_next_pdu_noauth(pipes_struct *p)
 454 {
 455         RPC_HDR_RESP hdr_resp;
 456         uint32 data_len;
 457         uint32 data_space_available;
 458         uint32 data_len_left;
 459         prs_struct outgoing_pdu;
 460
 461         /*
 462          * If we're in the fault state, keep returning fault PDU's until
 463          * the pipe gets closed. JRA.
 464          */
 465
 466         if(p->fault_state) {
 467                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 468                 return True;
 469         }
 470
 471         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 472
 473         /* Change the incoming request header to a response. */
 474         p->hdr.pkt_type = RPC_RESPONSE;
 475
 476         /* Set up rpc header flags. */
 477         if (p->out_data.data_sent_length == 0) {
 478                 p->hdr.flags = RPC_FLG_FIRST;
 479         } else {
 480                 p->hdr.flags = 0;
 481         }
 482
 483         /*
 484          * Work out how much we can fit in a single PDU.
 485          */
 486
 487         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 488
 489         /*
 490          * Ensure there really is data left to send.
 491          */
 492
 493         if(!data_len_left) {
 494                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 495                 return False;
 496         }
 497
 498         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 499
 500         /*
 501          * The amount we send is the minimum of the available
 502          * space and the amount left to send.
 503          */
 504
 505         data_len = MIN(data_len_left, data_space_available);
 506
 507         /*
 508          * Set up the alloc hint. This should be the data left to
 509          * send.
 510          */
 511
 512         hdr_resp.alloc_hint = data_len_left;
 513
 514         /*
 515          * Work out if this PDU will be the last.
 516          */
 517
 518         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 519                 p->hdr.flags |= RPC_FLG_LAST;
 520         }
 521
 522         /*
 523          * Set up the header lengths.
 524          */
 525
 526         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 527         p->hdr.auth_len = 0;
 528
 529         /*
 530          * Init the parse struct to point at the outgoing
 531          * data.
 532          */
 533
 534         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 535         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 536
 537         /* Store the header in the data stream. */
 538         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 539                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 540                 prs_mem_free(&outgoing_pdu);
 541                 return False;
 542         }
 543
 544         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 545                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 546                 prs_mem_free(&outgoing_pdu);
 547                 return False;
 548         }
 549
 550         /* Copy the data into the PDU. */
 551
 552         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 553                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 554                 prs_mem_free(&outgoing_pdu);
 555                 return False;
 556         }
 557
 558         /*
 559          * Setup the counts for this PDU.
 560          */
 561
 562         p->out_data.data_sent_length += data_len;
 563         p->out_data.current_pdu_len = p->hdr.frag_len;
 564         p->out_data.current_pdu_sent = 0;
 565
 566         prs_mem_free(&outgoing_pdu);
 567         return True;
 568 }
 569
 570 /*******************************************************************
 571  Generate the next PDU to be returned from the data in p->rdata.
 572 ********************************************************************/
 573
 574 bool create_next_pdu(pipes_struct *p)
 575 {
 576         switch(p->auth.auth_level) {
 577                 case PIPE_AUTH_LEVEL_NONE:
 578                 case PIPE_AUTH_LEVEL_CONNECT:
 579                         /* This is incorrect for auth level connect. Fixme. JRA */
 580                         return create_next_pdu_noauth(p);
 581
 582                 default:
 583                         switch(p->auth.auth_type) {
 584                                 case PIPE_AUTH_TYPE_NTLMSSP:
 585                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 586                                         return create_next_pdu_ntlmssp(p);
 587                                 case PIPE_AUTH_TYPE_SCHANNEL:
 588                                         return create_next_pdu_schannel(p);
 589                                 default:
 590                                         break;
 591                         }
 592         }
 593
 594         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 595                         (unsigned int)p->auth.auth_level,
 596                         (unsigned int)p->auth.auth_type));
 597         return False;
 598 }
 599
 600 /*******************************************************************
 601  Process an NTLMSSP authentication response.
 602  If this function succeeds, the user has been authenticated
 603  and their domain, name and calling workstation stored in
 604  the pipe struct.
 605 *******************************************************************/
 606
 607 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 608 {
 609         DATA_BLOB reply;
 610         NTSTATUS status;
 611         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
 612
 613         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n", p->name));
 614
 615         ZERO_STRUCT(reply);
 616
 617         /* Set up for non-authenticated user. */
 618         TALLOC_FREE(p->pipe_user.nt_user_token);
 619         p->pipe_user.ut.ngroups = 0;
 620         SAFE_FREE( p->pipe_user.ut.groups);
 621
 622         /* this has to be done as root in order to verify the password */
 623         become_root();
 624         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 625         unbecome_root();
 626
 627         /* Don't generate a reply. */
 628         data_blob_free(&reply);
 629
 630         if (!NT_STATUS_IS_OK(status)) {
 631                 return False;
 632         }
 633
 634         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 635            ensure the underlying NTLMSSP flags are also set. If not we should
 636            refuse the bind. */
 637
 638         if (p->auth.auth_level == PIPE_AUTH_LEVEL_INTEGRITY) {
 639                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 640                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 641                                 "but client declined signing.\n",
 642                                         p->name ));
 643                         return False;
 644                 }
 645         }
 646         if (p->auth.auth_level == PIPE_AUTH_LEVEL_PRIVACY) {
 647                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
 648                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 649                                 "but client declined sealing.\n",
 650                                         p->name ));
 651                         return False;
 652                 }
 653         }
 654
 655         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 656                   "workstation: %s\n", a->ntlmssp_state->user,
 657                   a->ntlmssp_state->domain, a->ntlmssp_state->workstation));
 658
 659         /*
 660          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 661          */
 662
 663         p->pipe_user.ut.uid = a->server_info->utok.uid;
 664         p->pipe_user.ut.gid = a->server_info->utok.gid;
 665
 666         /*
 667          * We're an authenticated bind over smbd, so the session key needs to
 668          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 669          * does. See the RPC-SAMBA3SESSIONKEY.
 670          */
 671
 672         data_blob_free(&p->session_key);
 673         p->session_key = generic_session_key();
 674         if (!p->session_key.data) {
 675                 return False;
 676         }
 677
 678         p->pipe_user.ut.ngroups = a->server_info->utok.ngroups;
 679         if (p->pipe_user.ut.ngroups) {
 680                 if (!(p->pipe_user.ut.groups = (gid_t *)memdup(
 681                               a->server_info->utok.groups,
 682                               sizeof(gid_t) * p->pipe_user.ut.ngroups))) {
 683                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 684                         return False;
 685                 }
 686         }
 687
 688         if (a->server_info->ptok) {
 689                 p->pipe_user.nt_user_token =
 690                         dup_nt_token(NULL, a->server_info->ptok);
 691         } else {
 692                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 693                 p->pipe_user.nt_user_token = NULL;
 694                 return False;
 695         }
 696
 697         return True;
 698 }
 699
 700 /*******************************************************************
 701  The switch table for the pipe names and the functions to handle them.
 702 *******************************************************************/
 703
 704 struct rpc_table {
 705         struct {
 706                 const char *clnt;
 707                 const char *srv;
 708         } pipe;
 709         const struct api_struct *cmds;
 710         int n_cmds;
 711 };
 712
 713 static struct rpc_table *rpc_lookup;
 714 static int rpc_lookup_size;
 715
 716 /*******************************************************************
 717  This is the "stage3" NTLMSSP response after a bind request and reply.
 718 *******************************************************************/
 719
 720 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 721 {
 722         RPC_HDR_AUTH auth_info;
 723         uint32 pad;
 724         DATA_BLOB blob;
 725
 726         ZERO_STRUCT(blob);
 727
 728         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 729
 730         if (p->hdr.auth_len == 0) {
 731                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 732                 goto err;
 733         }
 734
 735         /* 4 bytes padding. */
 736         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 737                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 738                 goto err;
 739         }
 740
 741         /*
 742          * Decode the authentication verifier response.
 743          */
 744
 745         if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 746                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
 747                 goto err;
 748         }
 749
 750         if (auth_info.auth_type != RPC_NTLMSSP_AUTH_TYPE) {
 751                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 752                         (unsigned int)auth_info.auth_type ));
 753                 return False;
 754         }
 755
 756         blob = data_blob(NULL,p->hdr.auth_len);
 757
 758         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 759                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 760                         (unsigned int)p->hdr.auth_len ));
 761                 goto err;
 762         }
 763
 764         /*
 765          * The following call actually checks the challenge/response data.
 766          * for correctness against the given DOMAIN\user name.
 767          */
 768
 769         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 770                 goto err;
 771         }
 772
 773         data_blob_free(&blob);
 774
 775         p->pipe_bound = True;
 776
 777         return True;
 778
 779  err:
 780
 781         data_blob_free(&blob);
 782         free_pipe_ntlmssp_auth_data(&p->auth);
 783         p->auth.a_u.auth_ntlmssp_state = NULL;
 784
 785         return False;
 786 }
 787
 788 /*******************************************************************
 789  Marshall a bind_nak pdu.
 790 *******************************************************************/
 791
 792 static bool setup_bind_nak(pipes_struct *p)
 793 {
 794         prs_struct outgoing_rpc;
 795         RPC_HDR nak_hdr;
 796         uint16 zero = 0;
 797
 798         /* Free any memory in the current return data buffer. */
 799         prs_mem_free(&p->out_data.rdata);
 800
 801         /*
 802          * Marshall directly into the outgoing PDU space. We
 803          * must do this as we need to set to the bind response
 804          * header and are never sending more than one PDU here.
 805          */
 806
 807         prs_init_empty( &outgoing_rpc, p->mem_ctx, MARSHALL);
 808         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 809
 810         /*
 811          * Initialize a bind_nak header.
 812          */
 813
 814         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 815                 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 816
 817         /*
 818          * Marshall the header into the outgoing PDU.
 819          */
 820
 821         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 822                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 823                 prs_mem_free(&outgoing_rpc);
 824                 return False;
 825         }
 826
 827         /*
 828          * Now add the reject reason.
 829          */
 830
 831         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 832                 prs_mem_free(&outgoing_rpc);
 833                 return False;
 834         }
 835
 836         p->out_data.data_sent_length = 0;
 837         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 838         p->out_data.current_pdu_sent = 0;
 839
 840         if (p->auth.auth_data_free_func) {
 841                 (*p->auth.auth_data_free_func)(&p->auth);
 842         }
 843         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
 844         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 845         p->pipe_bound = False;
 846
 847         return True;
 848 }
 849
 850 /*******************************************************************
 851  Marshall a fault pdu.
 852 *******************************************************************/
 853
 854 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 855 {
 856         prs_struct outgoing_pdu;
 857         RPC_HDR fault_hdr;
 858         RPC_HDR_RESP hdr_resp;
 859         RPC_HDR_FAULT fault_resp;
 860
 861         /* Free any memory in the current return data buffer. */
 862         prs_mem_free(&p->out_data.rdata);
 863
 864         /*
 865          * Marshall directly into the outgoing PDU space. We
 866          * must do this as we need to set to the bind response
 867          * header and are never sending more than one PDU here.
 868          */
 869
 870         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 871         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 872
 873         /*
 874          * Initialize a fault header.
 875          */
 876
 877         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 878             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 879
 880         /*
 881          * Initialize the HDR_RESP and FAULT parts of the PDU.
 882          */
 883
 884         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 885
 886         fault_resp.status = status;
 887         fault_resp.reserved = 0;
 888
 889         /*
 890          * Marshall the header into the outgoing PDU.
 891          */
 892
 893         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 894                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 895                 prs_mem_free(&outgoing_pdu);
 896                 return False;
 897         }
 898
 899         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 900                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 901                 prs_mem_free(&outgoing_pdu);
 902                 return False;
 903         }
 904
 905         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 906                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 907                 prs_mem_free(&outgoing_pdu);
 908                 return False;
 909         }
 910
 911         p->out_data.data_sent_length = 0;
 912         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 913         p->out_data.current_pdu_sent = 0;
 914
 915         prs_mem_free(&outgoing_pdu);
 916         return True;
 917 }
 918
 919 #if 0
 920 /*******************************************************************
 921  Marshall a cancel_ack pdu.
 922  We should probably check the auth-verifier here.
 923 *******************************************************************/
 924
 925 bool setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
 926 {
 927         prs_struct outgoing_pdu;
 928         RPC_HDR ack_reply_hdr;
 929
 930         /* Free any memory in the current return data buffer. */
 931         prs_mem_free(&p->out_data.rdata);
 932
 933         /*
 934          * Marshall directly into the outgoing PDU space. We
 935          * must do this as we need to set to the bind response
 936          * header and are never sending more than one PDU here.
 937          */
 938
 939         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 940         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 941
 942         /*
 943          * Initialize a cancel_ack header.
 944          */
 945
 946         init_rpc_hdr(&ack_reply_hdr, RPC_CANCEL_ACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 947                         p->hdr.call_id, RPC_HEADER_LEN, 0);
 948
 949         /*
 950          * Marshall the header into the outgoing PDU.
 951          */
 952
 953         if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
 954                 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
 955                 prs_mem_free(&outgoing_pdu);
 956                 return False;
 957         }
 958
 959         p->out_data.data_sent_length = 0;
 960         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 961         p->out_data.current_pdu_sent = 0;
 962
 963         prs_mem_free(&outgoing_pdu);
 964         return True;
 965 }
 966 #endif
 967
 968 /*******************************************************************
 969  Ensure a bind request has the correct abstract & transfer interface.
 970  Used to reject unknown binds from Win2k.
 971 *******************************************************************/
 972
 973 bool check_bind_req(struct pipes_struct *p, RPC_IFACE* abstract,
 974                     RPC_IFACE* transfer, uint32 context_id)
 975 {
 976         char *pipe_name = p->name;
 977         int i=0;
 978         fstring pname;
 979
 980         fstrcpy(pname,"\\PIPE\\");
 981         fstrcat(pname,pipe_name);
 982
 983         DEBUG(3,("check_bind_req for %s\n", pname));
 984
 985         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 986
 987         for ( i=0; pipe_names[i].client_pipe; i++ ) {
 988                 DEBUGADD(10,("checking %s\n", pipe_names[i].client_pipe));
 989                 if ( strequal(pipe_names[i].client_pipe, pname)
 990                         && (abstract->if_version == pipe_names[i].abstr_syntax->if_version)
 991                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax->uuid, sizeof(struct GUID)) == 0)
 992                         && (transfer->if_version == pipe_names[i].trans_syntax->if_version)
 993                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax->uuid, sizeof(struct GUID)) == 0) ) {
 994                         struct api_struct       *fns = NULL;
 995                         int                     n_fns = 0;
 996                         PIPE_RPC_FNS            *context_fns;
 997
 998                         if ( !(context_fns = SMB_MALLOC_P(PIPE_RPC_FNS)) ) {
 999                                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
1000                                 return False;
1001                         }
1002
1003                         /* save the RPC function table associated with this bind */
1004
1005                         get_pipe_fns(i, &fns, &n_fns);
1006
1007                         context_fns->cmds = fns;
1008                         context_fns->n_cmds = n_fns;
1009                         context_fns->context_id = context_id;
1010
1011                         /* add to the list of open contexts */
1012
1013                         DLIST_ADD( p->contexts, context_fns );
1014
1015                         break;
1016                 }
1017         }
1018
1019         if(pipe_names[i].client_pipe == NULL) {
1020                 return False;
1021         }
1022
1023         return True;
1024 }
1025
1026 /*******************************************************************
1027  Register commands to an RPC pipe
1028 *******************************************************************/
1029
1030 NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *srv, const struct api_struct *cmds, int size)
1031 {
1032         struct rpc_table *rpc_entry;
1033
1034         if (!clnt || !srv || !cmds) {
1035                 return NT_STATUS_INVALID_PARAMETER;
1036         }
1037
1038         if (version != SMB_RPC_INTERFACE_VERSION) {
1039                 DEBUG(0,("Can't register rpc commands!\n"
1040                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1041                          ", while this version of samba uses version %d!\n",
1042                          version,SMB_RPC_INTERFACE_VERSION));
1043                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1044         }
1045
1046         /* TODO:
1047          *
1048          * we still need to make sure that don't register the same commands twice!!!
1049          *
1050          * --metze
1051          */
1052
1053         /* We use a temporary variable because this call can fail and
1054            rpc_lookup will still be valid afterwards.  It could then succeed if
1055            called again later */
1056         rpc_lookup_size++;
1057         rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1058         if (NULL == rpc_entry) {
1059                 rpc_lookup_size--;
1060                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1061                 return NT_STATUS_NO_MEMORY;
1062         } else {
1063                 rpc_lookup = rpc_entry;
1064         }
1065
1066         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1067         ZERO_STRUCTP(rpc_entry);
1068         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1069         rpc_entry->pipe.srv = SMB_STRDUP(srv);
1070         rpc_entry->cmds = cmds;
1071         rpc_entry->n_cmds = size;
1072
1073         return NT_STATUS_OK;
1074 }
1075
1076 /*******************************************************************
1077  Handle a SPNEGO krb5 bind auth.
1078 *******************************************************************/
1079
1080 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1081                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1082 {
1083         return False;
1084 }
1085
1086 /*******************************************************************
1087  Handle the first part of a SPNEGO bind auth.
1088 *******************************************************************/
1089
1090 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1091                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1092 {
1093         DATA_BLOB blob;
1094         DATA_BLOB secblob;
1095         DATA_BLOB response;
1096         DATA_BLOB chal;
1097         char *OIDs[ASN1_MAX_OIDS];
1098         int i;
1099         NTSTATUS status;
1100         bool got_kerberos_mechanism = false;
1101         AUTH_NTLMSSP_STATE *a = NULL;
1102         RPC_HDR_AUTH auth_info;
1103
1104         ZERO_STRUCT(secblob);
1105         ZERO_STRUCT(chal);
1106         ZERO_STRUCT(response);
1107
1108         /* Grab the SPNEGO blob. */
1109         blob = data_blob(NULL,p->hdr.auth_len);
1110
1111         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1112                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1113                         (unsigned int)p->hdr.auth_len ));
1114                 goto err;
1115         }
1116
1117         if (blob.data[0] != ASN1_APPLICATION(0)) {
1118                 goto err;
1119         }
1120
1121         /* parse out the OIDs and the first sec blob */
1122         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1123                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1124                 goto err;
1125         }
1126
1127         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1128                 got_kerberos_mechanism = true;
1129         }
1130
1131         for (i=0;OIDs[i];i++) {
1132                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1133                 SAFE_FREE(OIDs[i]);
1134         }
1135         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1136
1137         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || lp_use_kerberos_keytab()) ) {
1138                 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1139                 data_blob_free(&secblob);
1140                 data_blob_free(&blob);
1141                 return ret;
1142         }
1143
1144         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1145                 /* Free any previous auth type. */
1146                 free_pipe_ntlmssp_auth_data(&p->auth);
1147         }
1148
1149         if (!got_kerberos_mechanism) {
1150                 /* Initialize the NTLM engine. */
1151                 status = auth_ntlmssp_start(&a);
1152                 if (!NT_STATUS_IS_OK(status)) {
1153                         goto err;
1154                 }
1155
1156                 /*
1157                  * Pass the first security blob of data to it.
1158                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1159                  * which means we need another packet to complete the bind.
1160                  */
1161
1162                 status = auth_ntlmssp_update(a, secblob, &chal);
1163
1164                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1165                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1166                         goto err;
1167                 }
1168
1169                 /* Generate the response blob we need for step 2 of the bind. */
1170                 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1171         } else {
1172                 /*
1173                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1174                  * code to process follow-up packets is not complete
1175                  * yet. JRA.
1176                  */
1177                 response = spnego_gen_auth_response(NULL,
1178                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1179                                         OID_NTLMSSP);
1180         }
1181
1182         /* Copy the blob into the pout_auth parse struct */
1183         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1184         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1185                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1186                 goto err;
1187         }
1188
1189         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1190                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1191                 goto err;
1192         }
1193
1194         p->auth.a_u.auth_ntlmssp_state = a;
1195         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1196         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1197
1198         data_blob_free(&blob);
1199         data_blob_free(&secblob);
1200         data_blob_free(&chal);
1201         data_blob_free(&response);
1202
1203         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1204         return True;
1205
1206  err:
1207
1208         data_blob_free(&blob);
1209         data_blob_free(&secblob);
1210         data_blob_free(&chal);
1211         data_blob_free(&response);
1212
1213         p->auth.a_u.auth_ntlmssp_state = NULL;
1214
1215         return False;
1216 }
1217
1218 /*******************************************************************
1219  Handle the second part of a SPNEGO bind auth.
1220 *******************************************************************/
1221
1222 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1223                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1224 {
1225         RPC_HDR_AUTH auth_info;
1226         DATA_BLOB spnego_blob;
1227         DATA_BLOB auth_blob;
1228         DATA_BLOB auth_reply;
1229         DATA_BLOB response;
1230         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1231
1232         ZERO_STRUCT(spnego_blob);
1233         ZERO_STRUCT(auth_blob);
1234         ZERO_STRUCT(auth_reply);
1235         ZERO_STRUCT(response);
1236
1237         /*
1238          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1239          * fail here as 'a' == NULL.
1240          */
1241         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1242                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1243                 goto err;
1244         }
1245
1246         /* Grab the SPNEGO blob. */
1247         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1248
1249         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1250                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1251                         (unsigned int)p->hdr.auth_len ));
1252                 goto err;
1253         }
1254
1255         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1256                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1257                 goto err;
1258         }
1259
1260         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1261                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1262                 goto err;
1263         }
1264
1265         /*
1266          * The following call actually checks the challenge/response data.
1267          * for correctness against the given DOMAIN\user name.
1268          */
1269
1270         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1271                 goto err;
1272         }
1273
1274         data_blob_free(&spnego_blob);
1275         data_blob_free(&auth_blob);
1276
1277         /* Generate the spnego "accept completed" blob - no incoming data. */
1278         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1279
1280         /* Copy the blob into the pout_auth parse struct */
1281         init_rpc_hdr_auth(&auth_info, RPC_SPNEGO_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1282         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1283                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1284                 goto err;
1285         }
1286
1287         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1288                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1289                 goto err;
1290         }
1291
1292         data_blob_free(&auth_reply);
1293         data_blob_free(&response);
1294
1295         p->pipe_bound = True;
1296
1297         return True;
1298
1299  err:
1300
1301         data_blob_free(&spnego_blob);
1302         data_blob_free(&auth_blob);
1303         data_blob_free(&auth_reply);
1304         data_blob_free(&response);
1305
1306         free_pipe_ntlmssp_auth_data(&p->auth);
1307         p->auth.a_u.auth_ntlmssp_state = NULL;
1308
1309         return False;
1310 }
1311
1312 /*******************************************************************
1313  Handle an schannel bind auth.
1314 *******************************************************************/
1315
1316 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1317                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1318 {
1319         RPC_HDR_AUTH auth_info;
1320         RPC_AUTH_SCHANNEL_NEG neg;
1321         RPC_AUTH_VERIFIER auth_verifier;
1322         bool ret;
1323         struct dcinfo *pdcinfo;
1324         uint32 flags;
1325
1326         if (!smb_io_rpc_auth_schannel_neg("", &neg, rpc_in_p, 0)) {
1327                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1328                 return False;
1329         }
1330
1331         /*
1332          * The neg.myname key here must match the remote computer name
1333          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1334          * operations that use credentials.
1335          */
1336
1337         become_root();
1338         ret = secrets_restore_schannel_session_info(p->mem_ctx, neg.myname, &pdcinfo);
1339         unbecome_root();
1340
1341         if (!ret) {
1342                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1343                 return False;
1344         }
1345
1346         p->auth.a_u.schannel_auth = TALLOC_P(p->pipe_state_mem_ctx, struct schannel_auth_struct);
1347         if (!p->auth.a_u.schannel_auth) {
1348                 TALLOC_FREE(pdcinfo);
1349                 return False;
1350         }
1351
1352         memset(p->auth.a_u.schannel_auth->sess_key, 0, sizeof(p->auth.a_u.schannel_auth->sess_key));
1353         memcpy(p->auth.a_u.schannel_auth->sess_key, pdcinfo->sess_key,
1354                         sizeof(pdcinfo->sess_key));
1355
1356         TALLOC_FREE(pdcinfo);
1357
1358         p->auth.a_u.schannel_auth->seq_num = 0;
1359
1360         /*
1361          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1362          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1363          * struct of the person who opened the pipe. I need to test this further. JRA.
1364          *
1365          * VL. As we are mapping this to guest set the generic key
1366          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1367          * W2k3, as it does not allow schannel binds against SAMR and LSA
1368          * anymore.
1369          */
1370
1371         data_blob_free(&p->session_key);
1372         p->session_key = generic_session_key();
1373         if (p->session_key.data == NULL) {
1374                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1375                           " key\n"));
1376                 return False;
1377         }
1378
1379         init_rpc_hdr_auth(&auth_info, RPC_SCHANNEL_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1380         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1381                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1382                 return False;
1383         }
1384
1385         /*** SCHANNEL verifier ***/
1386
1387         init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1388         if(!smb_io_rpc_schannel_verifier("", &auth_verifier, pout_auth, 0)) {
1389                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1390                 return False;
1391         }
1392
1393         prs_align(pout_auth);
1394
1395         flags = 5;
1396         if(!prs_uint32("flags ", pout_auth, 0, &flags)) {
1397                 return False;
1398         }
1399
1400         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1401                 neg.domain, neg.myname));
1402
1403         /* We're finished with this bind - no more packets. */
1404         p->auth.auth_data_free_func = NULL;
1405         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1406
1407         p->pipe_bound = True;
1408
1409         return True;
1410 }
1411
1412 /*******************************************************************
1413  Handle an NTLMSSP bind auth.
1414 *******************************************************************/
1415
1416 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1417                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1418 {
1419         RPC_HDR_AUTH auth_info;
1420         DATA_BLOB blob;
1421         DATA_BLOB response;
1422         NTSTATUS status;
1423         AUTH_NTLMSSP_STATE *a = NULL;
1424
1425         ZERO_STRUCT(blob);
1426         ZERO_STRUCT(response);
1427
1428         /* Grab the NTLMSSP blob. */
1429         blob = data_blob(NULL,p->hdr.auth_len);
1430
1431         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1432                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1433                         (unsigned int)p->hdr.auth_len ));
1434                 goto err;
1435         }
1436
1437         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1438                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1439                 goto err;
1440         }
1441
1442         /* We have an NTLMSSP blob. */
1443         status = auth_ntlmssp_start(&a);
1444         if (!NT_STATUS_IS_OK(status)) {
1445                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1446                         nt_errstr(status) ));
1447                 goto err;
1448         }
1449
1450         status = auth_ntlmssp_update(a, blob, &response);
1451         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1452                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1453                         nt_errstr(status) ));
1454                 goto err;
1455         }
1456
1457         data_blob_free(&blob);
1458
1459         /* Copy the blob into the pout_auth parse struct */
1460         init_rpc_hdr_auth(&auth_info, RPC_NTLMSSP_AUTH_TYPE, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1461         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1462                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1463                 goto err;
1464         }
1465
1466         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1467                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1468                 goto err;
1469         }
1470
1471         p->auth.a_u.auth_ntlmssp_state = a;
1472         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1473         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1474
1475         data_blob_free(&blob);
1476         data_blob_free(&response);
1477
1478         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1479
1480         /* We can't set pipe_bound True yet - we need an RPC_AUTH3 response packet... */
1481         return True;
1482
1483   err:
1484
1485         data_blob_free(&blob);
1486         data_blob_free(&response);
1487
1488         free_pipe_ntlmssp_auth_data(&p->auth);
1489         p->auth.a_u.auth_ntlmssp_state = NULL;
1490         return False;
1491 }
1492
1493 /*******************************************************************
1494  Respond to a pipe bind request.
1495 *******************************************************************/
1496
1497 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1498 {
1499         RPC_HDR_BA hdr_ba;
1500         RPC_HDR_RB hdr_rb;
1501         RPC_HDR_AUTH auth_info;
1502         uint16 assoc_gid;
1503         fstring ack_pipe_name;
1504         prs_struct out_hdr_ba;
1505         prs_struct out_auth;
1506         prs_struct outgoing_rpc;
1507         int i = 0;
1508         int auth_len = 0;
1509         unsigned int auth_type = RPC_ANONYMOUS_AUTH_TYPE;
1510
1511         /* No rebinds on a bound pipe - use alter context. */
1512         if (p->pipe_bound) {
1513                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound pipe %s.\n", p->pipe_srv_name));
1514                 return setup_bind_nak(p);
1515         }
1516
1517         prs_init_empty( &outgoing_rpc, p->mem_ctx, MARSHALL);
1518
1519         /*
1520          * Marshall directly into the outgoing PDU space. We
1521          * must do this as we need to set to the bind response
1522          * header and are never sending more than one PDU here.
1523          */
1524
1525         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1526
1527         /*
1528          * Setup the memory to marshall the ba header, and the
1529          * auth footers.
1530          */
1531
1532         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1533                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1534                 prs_mem_free(&outgoing_rpc);
1535                 return False;
1536         }
1537
1538         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1539                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1540                 prs_mem_free(&outgoing_rpc);
1541                 prs_mem_free(&out_hdr_ba);
1542                 return False;
1543         }
1544
1545         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1546
1547         /*
1548          * Try and find the correct pipe name to ensure
1549          * that this is a pipe name we support.
1550          */
1551
1552
1553         for (i = 0; i < rpc_lookup_size; i++) {
1554                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1555                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1556                                 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1557                         fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1558                         break;
1559                 }
1560         }
1561
1562         if (i == rpc_lookup_size) {
1563                 if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) {
1564                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1565                                 p->name ));
1566                         prs_mem_free(&outgoing_rpc);
1567                         prs_mem_free(&out_hdr_ba);
1568                         prs_mem_free(&out_auth);
1569
1570                         return setup_bind_nak(p);
1571                 }
1572
1573                 for (i = 0; i < rpc_lookup_size; i++) {
1574                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1575                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1576                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1577                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
1578                                break;
1579                        }
1580                 }
1581
1582                 if (i == rpc_lookup_size) {
1583                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
1584                         goto err_exit;
1585                 }
1586         }
1587
1588         ZERO_STRUCT(hdr_rb);
1589
1590         /* decode the bind request */
1591         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1592                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
1593                 goto err_exit;
1594         }
1595
1596         /* name has to be \PIPE\xxxxx */
1597         fstrcpy(ack_pipe_name, "\\PIPE\\");
1598         fstrcat(ack_pipe_name, p->pipe_srv_name);
1599
1600         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1601
1602         /*
1603          * Check if this is an authenticated bind request.
1604          */
1605
1606         if (p->hdr.auth_len) {
1607                 /*
1608                  * Decode the authentication verifier.
1609                  */
1610
1611                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1612                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1613                         goto err_exit;
1614                 }
1615
1616                 auth_type = auth_info.auth_type;
1617
1618                 /* Work out if we have to sign or seal etc. */
1619                 switch (auth_info.auth_level) {
1620                         case RPC_AUTH_LEVEL_INTEGRITY:
1621                                 p->auth.auth_level = PIPE_AUTH_LEVEL_INTEGRITY;
1622                                 break;
1623                         case RPC_AUTH_LEVEL_PRIVACY:
1624                                 p->auth.auth_level = PIPE_AUTH_LEVEL_PRIVACY;
1625                                 break;
1626                         default:
1627                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1628                                         (unsigned int)auth_info.auth_level ));
1629                                 goto err_exit;
1630                 }
1631         } else {
1632                 ZERO_STRUCT(auth_info);
1633         }
1634
1635         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1636
1637         switch(auth_type) {
1638                 case RPC_NTLMSSP_AUTH_TYPE:
1639                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1640                                 goto err_exit;
1641                         }
1642                         assoc_gid = 0x7a77;
1643                         break;
1644
1645                 case RPC_SCHANNEL_AUTH_TYPE:
1646                         if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1647                                 goto err_exit;
1648                         }
1649                         break;
1650
1651                 case RPC_SPNEGO_AUTH_TYPE:
1652                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1653                                 goto err_exit;
1654                         }
1655                         break;
1656
1657                 case RPC_ANONYMOUS_AUTH_TYPE:
1658                         /* Unauthenticated bind request. */
1659                         /* Get the authenticated pipe user from current_user */
1660                         if (!copy_current_user(&p->pipe_user, &current_user)) {
1661                                 DEBUG(10, ("Could not copy current user\n"));
1662                                 goto err_exit;
1663                         }
1664                         /* We're finished - no more packets. */
1665                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1666                         /* We must set the pipe auth_level here also. */
1667                         p->auth.auth_level = PIPE_AUTH_LEVEL_NONE;
1668                         p->pipe_bound = True;
1669                         /* The session key was initialized from the SMB
1670                          * session in make_internal_rpc_pipe_p */
1671                         break;
1672
1673                 default:
1674                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1675                         goto err_exit;
1676         }
1677
1678         /*
1679          * Create the bind response struct.
1680          */
1681
1682         /* If the requested abstract synt uuid doesn't match our client pipe,
1683                 reject the bind_ack & set the transfer interface synt to all 0's,
1684                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1685                 unknown to NT4)
1686                 Needed when adding entries to a DACL from NT5 - SK */
1687
1688         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1689                                 hdr_rb.rpc_context[0].context_id )) {
1690                 init_rpc_hdr_ba(&hdr_ba,
1691                         RPC_MAX_PDU_FRAG_LEN,
1692                         RPC_MAX_PDU_FRAG_LEN,
1693                         assoc_gid,
1694                         ack_pipe_name,
1695                         0x1, 0x0, 0x0,
1696                         &hdr_rb.rpc_context[0].transfer[0]);
1697         } else {
1698                 RPC_IFACE null_interface;
1699                 ZERO_STRUCT(null_interface);
1700                 /* Rejection reason: abstract syntax not supported */
1701                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1702                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1703                                         ack_pipe_name, 0x1, 0x2, 0x1,
1704                                         &null_interface);
1705                 p->pipe_bound = False;
1706         }
1707
1708         /*
1709          * and marshall it.
1710          */
1711
1712         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1713                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1714                 goto err_exit;
1715         }
1716
1717         /*
1718          * Create the header, now we know the length.
1719          */
1720
1721         if (prs_offset(&out_auth)) {
1722                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1723         }
1724
1725         init_rpc_hdr(&p->hdr, RPC_BINDACK, RPC_FLG_FIRST | RPC_FLG_LAST,
1726                         p->hdr.call_id,
1727                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1728                         auth_len);
1729
1730         /*
1731          * Marshall the header into the outgoing PDU.
1732          */
1733
1734         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1735                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1736                 goto err_exit;
1737         }
1738
1739         /*
1740          * Now add the RPC_HDR_BA and any auth needed.
1741          */
1742
1743         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1744                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1745                 goto err_exit;
1746         }
1747
1748         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1749                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1750                 goto err_exit;
1751         }
1752
1753         /*
1754          * Setup the lengths for the initial reply.
1755          */
1756
1757         p->out_data.data_sent_length = 0;
1758         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1759         p->out_data.current_pdu_sent = 0;
1760
1761         prs_mem_free(&out_hdr_ba);
1762         prs_mem_free(&out_auth);
1763
1764         return True;
1765
1766   err_exit:
1767
1768         prs_mem_free(&outgoing_rpc);
1769         prs_mem_free(&out_hdr_ba);
1770         prs_mem_free(&out_auth);
1771         return setup_bind_nak(p);
1772 }
1773
1774 /****************************************************************************
1775  Deal with an alter context call. Can be third part of 3 leg auth request for
1776  SPNEGO calls.
1777 ****************************************************************************/
1778
1779 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1780 {
1781         RPC_HDR_BA hdr_ba;
1782         RPC_HDR_RB hdr_rb;
1783         RPC_HDR_AUTH auth_info;
1784         uint16 assoc_gid;
1785         fstring ack_pipe_name;
1786         prs_struct out_hdr_ba;
1787         prs_struct out_auth;
1788         prs_struct outgoing_rpc;
1789         int auth_len = 0;
1790
1791         prs_init_empty( &outgoing_rpc, p->mem_ctx, MARSHALL);
1792
1793         /*
1794          * Marshall directly into the outgoing PDU space. We
1795          * must do this as we need to set to the bind response
1796          * header and are never sending more than one PDU here.
1797          */
1798
1799         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1800
1801         /*
1802          * Setup the memory to marshall the ba header, and the
1803          * auth footers.
1804          */
1805
1806         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1807                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1808                 prs_mem_free(&outgoing_rpc);
1809                 return False;
1810         }
1811
1812         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1813                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1814                 prs_mem_free(&outgoing_rpc);
1815                 prs_mem_free(&out_hdr_ba);
1816                 return False;
1817         }
1818
1819         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1820
1821         /* decode the alter context request */
1822         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1823                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1824                 goto err_exit;
1825         }
1826
1827         /* secondary address CAN be NULL
1828          * as the specs say it's ignored.
1829          * It MUST be NULL to have the spoolss working.
1830          */
1831         fstrcpy(ack_pipe_name,"");
1832
1833         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1834
1835         /*
1836          * Check if this is an authenticated alter context request.
1837          */
1838
1839         if (p->hdr.auth_len != 0) {
1840                 /*
1841                  * Decode the authentication verifier.
1842                  */
1843
1844                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1845                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1846                         goto err_exit;
1847                 }
1848
1849                 /*
1850                  * Currently only the SPNEGO auth type uses the alter ctx
1851                  * response in place of the NTLMSSP auth3 type.
1852                  */
1853
1854                 if (auth_info.auth_type == RPC_SPNEGO_AUTH_TYPE) {
1855                         /* We can only finish if the pipe is unbound. */
1856                         if (!p->pipe_bound) {
1857                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1858                                         goto err_exit;
1859                                 }
1860                         } else {
1861                                 goto err_exit;
1862                         }
1863                 }
1864         } else {
1865                 ZERO_STRUCT(auth_info);
1866         }
1867
1868         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1869
1870         /*
1871          * Create the bind response struct.
1872          */
1873
1874         /* If the requested abstract synt uuid doesn't match our client pipe,
1875                 reject the bind_ack & set the transfer interface synt to all 0's,
1876                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1877                 unknown to NT4)
1878                 Needed when adding entries to a DACL from NT5 - SK */
1879
1880         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1881                                 hdr_rb.rpc_context[0].context_id )) {
1882                 init_rpc_hdr_ba(&hdr_ba,
1883                         RPC_MAX_PDU_FRAG_LEN,
1884                         RPC_MAX_PDU_FRAG_LEN,
1885                         assoc_gid,
1886                         ack_pipe_name,
1887                         0x1, 0x0, 0x0,
1888                         &hdr_rb.rpc_context[0].transfer[0]);
1889         } else {
1890                 RPC_IFACE null_interface;
1891                 ZERO_STRUCT(null_interface);
1892                 /* Rejection reason: abstract syntax not supported */
1893                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1894                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1895                                         ack_pipe_name, 0x1, 0x2, 0x1,
1896                                         &null_interface);
1897                 p->pipe_bound = False;
1898         }
1899
1900         /*
1901          * and marshall it.
1902          */
1903
1904         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1905                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1906                 goto err_exit;
1907         }
1908
1909         /*
1910          * Create the header, now we know the length.
1911          */
1912
1913         if (prs_offset(&out_auth)) {
1914                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1915         }
1916
1917         init_rpc_hdr(&p->hdr, RPC_ALTCONTRESP, RPC_FLG_FIRST | RPC_FLG_LAST,
1918                         p->hdr.call_id,
1919                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1920                         auth_len);
1921
1922         /*
1923          * Marshall the header into the outgoing PDU.
1924          */
1925
1926         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1927                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
1928                 goto err_exit;
1929         }
1930
1931         /*
1932          * Now add the RPC_HDR_BA and any auth needed.
1933          */
1934
1935         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1936                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
1937                 goto err_exit;
1938         }
1939
1940         if (auth_len && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1941                 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
1942                 goto err_exit;
1943         }
1944
1945         /*
1946          * Setup the lengths for the initial reply.
1947          */
1948
1949         p->out_data.data_sent_length = 0;
1950         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1951         p->out_data.current_pdu_sent = 0;
1952
1953         prs_mem_free(&out_hdr_ba);
1954         prs_mem_free(&out_auth);
1955
1956         return True;
1957
1958   err_exit:
1959
1960         prs_mem_free(&outgoing_rpc);
1961         prs_mem_free(&out_hdr_ba);
1962         prs_mem_free(&out_auth);
1963         return setup_bind_nak(p);
1964 }
1965
1966 /****************************************************************************
1967  Deal with NTLMSSP sign & seal processing on an RPC request.
1968 ****************************************************************************/
1969
1970 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
1971                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
1972 {
1973         RPC_HDR_AUTH auth_info;
1974         uint32 auth_len = p->hdr.auth_len;
1975         uint32 save_offset = prs_offset(rpc_in);
1976         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1977         unsigned char *data = NULL;
1978         size_t data_len;
1979         unsigned char *full_packet_data = NULL;
1980         size_t full_packet_data_len;
1981         DATA_BLOB auth_blob;
1982
1983         *pstatus = NT_STATUS_OK;
1984
1985         if (p->auth.auth_level == PIPE_AUTH_LEVEL_NONE || p->auth.auth_level == PIPE_AUTH_LEVEL_CONNECT) {
1986                 return True;
1987         }
1988
1989         if (!a) {
1990                 *pstatus = NT_STATUS_INVALID_PARAMETER;
1991                 return False;
1992         }
1993
1994         /* Ensure there's enough data for an authenticated request. */
1995         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
1996                         (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
1997                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
1998                         (unsigned int)auth_len ));
1999                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2000                 return False;
2001         }
2002
2003         /*
2004          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2005          * after the RPC header.
2006          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2007          * functions as NTLMv2 checks the rpc headers also.
2008          */
2009
2010         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2011         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2012
2013         full_packet_data = p->in_data.current_in_pdu;
2014         full_packet_data_len = p->hdr.frag_len - auth_len;
2015
2016         /* Pull the auth header and the following data into a blob. */
2017         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2018                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
2019                         (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
2020                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2021                 return False;
2022         }
2023
2024         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2025                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
2026                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2027                 return False;
2028         }
2029
2030         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2031         auth_blob.length = auth_len;
2032
2033         switch (p->auth.auth_level) {
2034                 case PIPE_AUTH_LEVEL_PRIVACY:
2035                         /* Data is encrypted. */
2036                         *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
2037                                                         data, data_len,
2038                                                         full_packet_data,
2039                                                         full_packet_data_len,
2040                                                         &auth_blob);
2041                         if (!NT_STATUS_IS_OK(*pstatus)) {
2042                                 return False;
2043                         }
2044                         break;
2045                 case PIPE_AUTH_LEVEL_INTEGRITY:
2046                         /* Data is signed. */
2047                         *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
2048                                                         data, data_len,
2049                                                         full_packet_data,
2050                                                         full_packet_data_len,
2051                                                         &auth_blob);
2052                         if (!NT_STATUS_IS_OK(*pstatus)) {
2053                                 return False;
2054                         }
2055                         break;
2056                 default:
2057                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2058                         return False;
2059         }
2060
2061         /*
2062          * Return the current pointer to the data offset.
2063          */
2064
2065         if(!prs_set_offset(rpc_in, save_offset)) {
2066                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2067                         (unsigned int)save_offset ));
2068                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2069                 return False;
2070         }
2071
2072         /*
2073          * Remember the padding length. We must remove it from the real data
2074          * stream once the sign/seal is done.
2075          */
2076
2077         *p_ss_padding_len = auth_info.auth_pad_len;
2078
2079         return True;
2080 }
2081
2082 /****************************************************************************
2083  Deal with schannel processing on an RPC request.
2084 ****************************************************************************/
2085
2086 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2087 {
2088         uint32 data_len;
2089         uint32 auth_len;
2090         uint32 save_offset = prs_offset(rpc_in);
2091         RPC_HDR_AUTH auth_info;
2092         RPC_AUTH_SCHANNEL_CHK schannel_chk;
2093
2094         auth_len = p->hdr.auth_len;
2095
2096         if (auth_len != RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN) {
2097                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2098                 return False;
2099         }
2100
2101         /*
2102          * The following is that length of the data we must verify or unseal.
2103          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2104          * preceeding the auth_data.
2105          */
2106
2107         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2108                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2109                         (unsigned int)p->hdr.frag_len,
2110                         (unsigned int)auth_len ));
2111                 return False;
2112         }
2113
2114         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2115                 RPC_HDR_AUTH_LEN - auth_len;
2116
2117         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2118
2119         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2120                 DEBUG(0,("cannot move offset to %u.\n",
2121                          (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2122                 return False;
2123         }
2124
2125         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2126                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2127                 return False;
2128         }
2129
2130         if (auth_info.auth_type != RPC_SCHANNEL_AUTH_TYPE) {
2131                 DEBUG(0,("Invalid auth info %d on schannel\n",
2132                          auth_info.auth_type));
2133                 return False;
2134         }
2135
2136         if(!smb_io_rpc_auth_schannel_chk("", RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN, &schannel_chk, rpc_in, 0)) {
2137                 DEBUG(0,("failed to unmarshal RPC_AUTH_SCHANNEL_CHK.\n"));
2138                 return False;
2139         }
2140
2141         if (!schannel_decode(p->auth.a_u.schannel_auth,
2142                            p->auth.auth_level,
2143                            SENDER_IS_INITIATOR,
2144                            &schannel_chk,
2145                            prs_data_p(rpc_in)+RPC_HDR_REQ_LEN, data_len)) {
2146                 DEBUG(3,("failed to decode PDU\n"));
2147                 return False;
2148         }
2149
2150         /*
2151          * Return the current pointer to the data offset.
2152          */
2153
2154         if(!prs_set_offset(rpc_in, save_offset)) {
2155                 DEBUG(0,("failed to set offset back to %u\n",
2156                          (unsigned int)save_offset ));
2157                 return False;
2158         }
2159
2160         /* The sequence number gets incremented on both send and receive. */
2161         p->auth.a_u.schannel_auth->seq_num++;
2162
2163         /*
2164          * Remember the padding length. We must remove it from the real data
2165          * stream once the sign/seal is done.
2166          */
2167
2168         *p_ss_padding_len = auth_info.auth_pad_len;
2169
2170         return True;
2171 }
2172
2173 /****************************************************************************
2174  Return a user struct for a pipe user.
2175 ****************************************************************************/
2176
2177 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
2178 {
2179         if (p->pipe_bound &&
2180                         (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP ||
2181                         (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2182                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
2183         } else {
2184                 memcpy(user, &current_user, sizeof(struct current_user));
2185         }
2186
2187         return user;
2188 }
2189
2190 /****************************************************************************
2191  Find the set of RPC functions associated with this context_id
2192 ****************************************************************************/
2193
2194 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2195 {
2196         PIPE_RPC_FNS *fns = NULL;
2197         PIPE_RPC_FNS *tmp = NULL;
2198
2199         if ( !list ) {
2200                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2201                 return NULL;
2202         }
2203
2204         for (tmp=list; tmp; tmp=tmp->next ) {
2205                 if ( tmp->context_id == context_id )
2206                         break;
2207         }
2208
2209         fns = tmp;
2210
2211         return fns;
2212 }
2213
2214 /****************************************************************************
2215  Memory cleanup.
2216 ****************************************************************************/
2217
2218 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2219 {
2220         PIPE_RPC_FNS *tmp = list;
2221         PIPE_RPC_FNS *tmp2;
2222
2223         while (tmp) {
2224                 tmp2 = tmp->next;
2225                 SAFE_FREE(tmp);
2226                 tmp = tmp2;
2227         }
2228
2229         return;
2230 }
2231
2232 /****************************************************************************
2233  Find the correct RPC function to call for this request.
2234  If the pipe is authenticated then become the correct UNIX user
2235  before doing the call.
2236 ****************************************************************************/
2237
2238 bool api_pipe_request(pipes_struct *p)
2239 {
2240         bool ret = False;
2241         bool changed_user = False;
2242         PIPE_RPC_FNS *pipe_fns;
2243
2244         if (p->pipe_bound &&
2245                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2246                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2247                 if(!become_authenticated_pipe_user(p)) {
2248                         prs_mem_free(&p->out_data.rdata);
2249                         return False;
2250                 }
2251                 changed_user = True;
2252         }
2253
2254         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
2255
2256         /* get the set of RPC functions for this context */
2257
2258         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2259
2260         if ( pipe_fns ) {
2261                 TALLOC_CTX *frame = talloc_stackframe();
2262                 ret = api_rpcTNP(p, p->name, pipe_fns->cmds, pipe_fns->n_cmds);
2263                 TALLOC_FREE(frame);
2264         }
2265         else {
2266                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2267                         p->hdr_req.context_id, p->name));
2268         }
2269
2270         if (changed_user) {
2271                 unbecome_authenticated_pipe_user();
2272         }
2273
2274         return ret;
2275 }
2276
2277 /*******************************************************************
2278  Calls the underlying RPC function for a named pipe.
2279  ********************************************************************/
2280
2281 bool api_rpcTNP(pipes_struct *p, const char *rpc_name,
2282                 const struct api_struct *api_rpc_cmds, int n_cmds)
2283 {
2284         int fn_num;
2285         fstring name;
2286         uint32 offset1, offset2;
2287
2288         /* interpret the command */
2289         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
2290
2291         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
2292         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2293
2294         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2295                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2296                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2297                         break;
2298                 }
2299         }
2300
2301         if (fn_num == n_cmds) {
2302                 /*
2303                  * For an unknown RPC just return a fault PDU but
2304                  * return True to allow RPC's on the pipe to continue
2305                  * and not put the pipe into fault state. JRA.
2306                  */
2307                 DEBUG(4, ("unknown\n"));
2308                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2309                 return True;
2310         }
2311
2312         offset1 = prs_offset(&p->out_data.rdata);
2313
2314         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2315                 fn_num, api_rpc_cmds[fn_num].fn));
2316         /* do the actual command */
2317         if(!api_rpc_cmds[fn_num].fn(p)) {
2318                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
2319                 prs_mem_free(&p->out_data.rdata);
2320                 return False;
2321         }
2322
2323         if (p->bad_handle_fault_state) {
2324                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2325                 p->bad_handle_fault_state = False;
2326                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2327                 return True;
2328         }
2329
2330         if (p->rng_fault_state) {
2331                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2332                 p->rng_fault_state = False;
2333                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2334                 return True;
2335         }
2336
2337         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
2338         offset2 = prs_offset(&p->out_data.rdata);
2339         prs_set_offset(&p->out_data.rdata, offset1);
2340         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2341         prs_set_offset(&p->out_data.rdata, offset2);
2342
2343         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
2344
2345         /* Check for buffer underflow in rpc parsing */
2346
2347         if ((DEBUGLEVEL >= 10) &&
2348             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2349                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2350                 char *data = (char *)SMB_MALLOC(data_len);
2351
2352                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2353                 if (data) {
2354                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2355                         SAFE_FREE(data);
2356                 }
2357
2358         }
2359
2360         return True;
2361 }
2362
2363 /*******************************************************************
2364 *******************************************************************/
2365
2366 void get_pipe_fns( int idx, struct api_struct **fns, int *n_fns )
2367 {
2368         struct api_struct *cmds = NULL;
2369         int               n_cmds = 0;
2370
2371         switch ( idx ) {
2372                 case PI_LSARPC:
2373                         lsarpc_get_pipe_fns( &cmds, &n_cmds );
2374                         break;
2375                 case PI_DSSETUP:
2376                         dssetup_get_pipe_fns( &cmds, &n_cmds );
2377                         break;
2378                 case PI_SAMR:
2379                         samr_get_pipe_fns( &cmds, &n_cmds );
2380                         break;
2381                 case PI_NETLOGON:
2382                         netlogon_get_pipe_fns( &cmds, &n_cmds );
2383                         break;
2384                 case PI_SRVSVC:
2385                         srvsvc_get_pipe_fns( &cmds, &n_cmds );
2386                         break;
2387                 case PI_WKSSVC:
2388                         wkssvc_get_pipe_fns( &cmds, &n_cmds );
2389                         break;
2390                 case PI_WINREG:
2391                         winreg_get_pipe_fns( &cmds, &n_cmds );
2392                         break;
2393                 case PI_SPOOLSS:
2394                         spoolss_get_pipe_fns( &cmds, &n_cmds );
2395                         break;
2396                 case PI_NETDFS:
2397                         netdfs_get_pipe_fns( &cmds, &n_cmds );
2398                         break;
2399                 case PI_SVCCTL:
2400                         svcctl2_get_pipe_fns( &cmds, &n_cmds );
2401                         break;
2402                 case PI_EVENTLOG:
2403                         eventlog2_get_pipe_fns( &cmds, &n_cmds );
2404                         break;
2405                 case PI_NTSVCS:
2406                         ntsvcs2_get_pipe_fns( &cmds, &n_cmds );
2407                         break;
2408 #ifdef DEVELOPER
2409                 case PI_RPCECHO:
2410                         rpcecho_get_pipe_fns( &cmds, &n_cmds );
2411                         break;
2412 #endif
2413                 default:
2414                         DEBUG(0,("get_pipe_fns: Unknown pipe index! [%d]\n", idx));
2415         }
2416
2417         *fns = cmds;
2418         *n_fns = n_cmds;
2419
2420         return;
2421 }