source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/Netbios implementation.
   3  *  Version 1.9.
   4  *  RPC Pipe client / server routines
   5  *  Copyright (C) Andrew Tridgell              1992-1998
   6  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   7  *  Copyright (C) Paul Ashton                  1997-1998.
   8  *  Copyright (C) Jeremy Allison                    1999.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25 /*  this module apparently provides an implementation of DCE/RPC over a
  26  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  27  *  documentation are available (in on-line form) from the X-Open group.
  28  *
  29  *  this module should provide a level of abstraction between SMB
  30  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  31  *  data copies, and network traffic.
  32  *
  33  *  in this version, which takes a "let's learn what's going on and
  34  *  get something running" approach, there is additional network
  35  *  traffic generated, but the code should be easier to understand...
  36  *
  37  *  ... if you read the docs.  or stare at packets for weeks on end.
  38  *
  39  */
  40
  41 #include "includes.h"
  42
  43 extern int DEBUGLEVEL;
  44
  45 static void NTLMSSPcalc_p( pipes_struct *p, unsigned char *data, int len)
  46 {
  47     unsigned char *hash = p->ntlmssp_hash;
  48     unsigned char index_i = hash[256];
  49     unsigned char index_j = hash[257];
  50     int ind;
  51
  52     for( ind = 0; ind < len; ind++) {
  53         unsigned char tc;
  54         unsigned char t;
  55
  56         index_i++;
  57         index_j += hash[index_i];
  58
  59         tc = hash[index_i];
  60         hash[index_i] = hash[index_j];
  61         hash[index_j] = tc;
  62
  63         t = hash[index_i] + hash[index_j];
  64         data[ind] = data[ind] ^ hash[t];
  65     }
  66
  67     hash[256] = index_i;
  68     hash[257] = index_j;
  69 }
  70
  71 /*******************************************************************
  72  Generate the next PDU to be returned from the data in p->rdata.
  73  We cheat here as this function doesn't handle the special auth
  74  footers of the authenticated bind response reply.
  75  ********************************************************************/
  76
  77 BOOL create_next_pdu(pipes_struct *p)
  78 {
  79         RPC_HDR_RESP hdr_resp;
  80         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
  81         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
  82         uint32 data_len;
  83         uint32 data_space_available;
  84         uint32 data_len_left;
  85         prs_struct outgoing_pdu;
  86         char *data;
  87         char *data_from;
  88         uint32 data_pos;
  89
  90         /*
  91          * If we're in the fault state, keep returning fault PDU's until
  92          * the pipe gets closed. JRA.
  93          */
  94
  95         if(p->fault_state) {
  96                 setup_fault_pdu(p, 0x1c010002);
  97                 return True;
  98         }
  99
 100         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 101
 102         /* Change the incoming request header to a response. */
 103         p->hdr.pkt_type = RPC_RESPONSE;
 104
 105         /* Set up rpc header flags. */
 106         if (p->out_data.data_sent_length == 0)
 107                 p->hdr.flags = RPC_FLG_FIRST;
 108         else
 109                 p->hdr.flags = 0;
 110
 111         /*
 112          * Work out how much we can fit in a single PDU.
 113          */
 114
 115         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 116         if(p->ntlmssp_auth_validated)
 117                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN);
 118
 119         /*
 120          * The amount we send is the minimum of the available
 121          * space and the amount left to send.
 122          */
 123
 124         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 125
 126         /*
 127          * Ensure there really is data left to send.
 128          */
 129
 130         if(!data_len_left) {
 131                 DEBUG(0,("create_next_pdu: no data left to send !\n"));
 132                 return False;
 133         }
 134
 135         data_len = MIN(data_len_left, data_space_available);
 136
 137         /*
 138          * Set up the alloc hint. This should be the data left to
 139          * send.
 140          */
 141
 142         hdr_resp.alloc_hint = data_len_left;
 143
 144         /*
 145          * Set up the header lengths.
 146          */
 147
 148         if (p->ntlmssp_auth_validated) {
 149                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
 150                                         RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN;
 151                 p->hdr.auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 152         } else {
 153                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 154                 p->hdr.auth_len = 0;
 155         }
 156
 157         /*
 158          * Work out if this PDU will be the last.
 159          */
 160
 161         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata))
 162                 p->hdr.flags |= RPC_FLG_LAST;
 163
 164         /*
 165          * Init the parse struct to point at the outgoing
 166          * data.
 167          */
 168
 169         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 170         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 171
 172         /* Store the header in the data stream. */
 173         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 174                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR.\n"));
 175                 prs_mem_free(&outgoing_pdu);
 176                 return False;
 177         }
 178
 179         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 180                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_RESP.\n"));
 181                 prs_mem_free(&outgoing_pdu);
 182                 return False;
 183         }
 184
 185         /* Store the current offset. */
 186         data_pos = prs_offset(&outgoing_pdu);
 187
 188         /* Copy the data into the PDU. */
 189         data_from = prs_data_p(&p->out_data.rdata) + p->out_data.data_sent_length;
 190
 191         if(!prs_append_data(&outgoing_pdu, data_from, data_len)) {
 192                 DEBUG(0,("create_next_pdu: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 193                 prs_mem_free(&outgoing_pdu);
 194                 return False;
 195         }
 196
 197         /*
 198          * Set data to point to where we copied the data into.
 199          */
 200
 201         data = prs_data_p(&outgoing_pdu) + data_pos;
 202
 203         if (p->hdr.auth_len > 0) {
 204                 uint32 crc32 = 0;
 205
 206                 DEBUG(5,("create_next_pdu: sign: %s seal: %s data %d auth %d\n",
 207                          BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, p->hdr.auth_len));
 208
 209                 if (auth_seal) {
 210                         crc32 = crc32_calc_buffer(data, data_len);
 211                         NTLMSSPcalc_p(p, (uchar*)data, data_len);
 212                 }
 213
 214                 if (auth_seal || auth_verify) {
 215                         RPC_HDR_AUTH auth_info;
 216
 217                         init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL,
 218                                         (auth_verify ? RPC_HDR_AUTH_LEN : 0), (auth_verify ? 1 : 0));
 219                         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 220                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 221                                 prs_mem_free(&outgoing_pdu);
 222                                 return False;
 223                         }
 224                 }
 225
 226                 if (auth_verify) {
 227                         RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
 228                         char *auth_data = prs_data_p(&outgoing_pdu);
 229
 230                         p->ntlmssp_seq_num++;
 231                         init_rpc_auth_ntlmssp_chk(&ntlmssp_chk, NTLMSSP_SIGN_VERSION,
 232                                         crc32, p->ntlmssp_seq_num++);
 233                         auth_data = prs_data_p(&outgoing_pdu) + prs_offset(&outgoing_pdu) + 4;
 234                         if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, &outgoing_pdu, 0)) {
 235                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_AUTH_NTLMSSP_CHK.\n"));
 236                                 prs_mem_free(&outgoing_pdu);
 237                                 return False;
 238                         }
 239                         NTLMSSPcalc_p(p, (uchar*)auth_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 240                 }
 241         }
 242
 243         /*
 244          * Setup the counts for this PDU.
 245          */
 246
 247         p->out_data.data_sent_length += data_len;
 248         p->out_data.current_pdu_len = p->hdr.frag_len;
 249         p->out_data.current_pdu_sent = 0;
 250
 251         prs_mem_free(&outgoing_pdu);
 252         return True;
 253 }
 254
 255 /*******************************************************************
 256  Process an NTLMSSP authentication response.
 257  If this function succeeds, the user has been authenticated
 258  and their domain, name and calling workstation stored in
 259  the pipe struct.
 260  The initial challenge is stored in p->challenge.
 261  *******************************************************************/
 262
 263 static BOOL api_pipe_ntlmssp_verify(pipes_struct *p, RPC_AUTH_NTLMSSP_RESP *ntlmssp_resp)
 264 {
 265         uchar lm_owf[24];
 266         uchar nt_owf[128];
 267         int nt_pw_len;
 268         int lm_pw_len;
 269         fstring user_name;
 270         fstring pipe_user_name;
 271         fstring domain;
 272         fstring wks;
 273         BOOL guest_user = False;
 274         SAM_ACCOUNT *sampass = NULL;
 275         uchar null_smb_passwd[16];
 276         uchar *smb_passwd_ptr = NULL;
 277
 278         DEBUG(5,("api_pipe_ntlmssp_verify: checking user details\n"));
 279
 280         memset(p->user_name, '\0', sizeof(p->user_name));
 281         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 282         memset(p->domain, '\0', sizeof(p->domain));
 283         memset(p->wks, '\0', sizeof(p->wks));
 284
 285         /* Set up for non-authenticated user. */
 286         delete_nt_token(&p->pipe_user.nt_user_token);
 287         p->pipe_user.ngroups = 0;
 288         safe_free( p->pipe_user.groups);
 289
 290         /*
 291          * Setup an empty password for a guest user.
 292          */
 293
 294         memset(null_smb_passwd,0,16);
 295
 296         /*
 297          * We always negotiate UNICODE.
 298          */
 299
 300         if (p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_UNICODE) {
 301                 rpcstr_pull(user_name, ntlmssp_resp->user, sizeof(fstring), ntlmssp_resp->hdr_usr.str_str_len*2, 0 );
 302                 rpcstr_pull(domain, ntlmssp_resp->domain, sizeof(fstring), ntlmssp_resp->hdr_domain.str_str_len*2, 0);
 303                 rpcstr_pull(wks, ntlmssp_resp->wks, sizeof(fstring), ntlmssp_resp->hdr_wks.str_str_len*2, 0);
 304         } else {
 305                 fstrcpy(user_name, ntlmssp_resp->user);
 306                 fstrcpy(domain, ntlmssp_resp->domain);
 307                 fstrcpy(wks, ntlmssp_resp->wks);
 308         }
 309
 310         DEBUG(5,("user: %s domain: %s wks: %s\n", user_name, domain, wks));
 311
 312         nt_pw_len = MIN(sizeof(nt_owf), ntlmssp_resp->hdr_nt_resp.str_str_len);
 313         lm_pw_len = MIN(sizeof(lm_owf), ntlmssp_resp->hdr_lm_resp.str_str_len);
 314
 315         memcpy(lm_owf, ntlmssp_resp->lm_resp, sizeof(lm_owf));
 316         memcpy(nt_owf, ntlmssp_resp->nt_resp, nt_pw_len);
 317
 318 #ifdef DEBUG_PASSWORD
 319         DEBUG(100,("lm, nt owfs, chal\n"));
 320         dump_data(100, (char *)lm_owf, sizeof(lm_owf));
 321         dump_data(100, (char *)nt_owf, nt_pw_len);
 322         dump_data(100, (char *)p->challenge, 8);
 323 #endif
 324
 325         /*
 326          * Allow guest access. Patch from Shirish Kalele <kalele@veritas.com>.
 327          */
 328
 329         if((strlen(user_name) == 0) &&
 330            (ntlmssp_resp->hdr_nt_resp.str_str_len==0))
 331           {
 332                 guest_user = True;
 333
 334         fstrcpy(pipe_user_name, lp_guestaccount(-1));
 335                 DEBUG(100,("Null user in NTLMSSP verification. Using guest = %s\n", pipe_user_name));
 336
 337                 smb_passwd_ptr = null_smb_passwd;
 338
 339         } else {
 340
 341                 /*
 342                  * Pass the user through the NT -> unix user mapping
 343                  * function.
 344                  */
 345
 346                 fstrcpy(pipe_user_name, user_name);
 347                 (void)map_username(pipe_user_name);
 348
 349                 /*
 350                  * Do the length checking only if user is not NULL.
 351                  */
 352
 353                 if (ntlmssp_resp->hdr_lm_resp.str_str_len == 0)
 354                         return False;
 355                 if (ntlmssp_resp->hdr_nt_resp.str_str_len == 0)
 356                         return False;
 357                 if (ntlmssp_resp->hdr_usr.str_str_len == 0)
 358                         return False;
 359                 if (ntlmssp_resp->hdr_domain.str_str_len == 0)
 360                         return False;
 361                 if (ntlmssp_resp->hdr_wks.str_str_len == 0)
 362                         return False;
 363
 364         }
 365
 366         if(!guest_user) {
 367
 368                 become_root();
 369
 370                 if(!(p->ntlmssp_auth_validated =
 371                      pass_check_smb_with_chal(pipe_user_name, domain,
 372                                               (uchar*)p->challenge,
 373                                               lm_owf, lm_pw_len,
 374                                               nt_owf, nt_pw_len) == NT_STATUS_NOPROBLEMO)) {
 375                         DEBUG(1,("api_pipe_ntlmssp_verify: User %s\\%s from machine %s \
 376 failed authentication on named pipe %s.\n", domain, pipe_user_name, wks, p->name ));
 377                         unbecome_root();
 378                         return False;
 379                 }
 380
 381                 pdb_init_sam(&sampass);
 382
 383                 if(!pdb_getsampwnam(sampass, pipe_user_name)) {
 384                         DEBUG(1,("api_pipe_ntlmssp_verify: Cannot find user %s in smb passwd database.\n",
 385                                 pipe_user_name));
 386                         pdb_free_sam(sampass);
 387                         unbecome_root();
 388                         return False;
 389                 }
 390
 391                 unbecome_root();
 392
 393                 /* Quit if the account was disabled. */
 394                 if((pdb_get_acct_ctrl(sampass) & ACB_DISABLED) || !pdb_get_lanman_passwd(sampass)) {
 395                         DEBUG(1,("Account for user '%s' was disabled.\n", pipe_user_name));
 396                         pdb_free_sam(sampass);
 397                         return False;
 398                }
 399
 400                 if(!pdb_get_nt_passwd(sampass)) {
 401                         DEBUG(1,("Account for user '%s' has no NT password hash.\n", pipe_user_name));
 402                         pdb_free_sam(sampass);
 403                         return False;
 404                 }
 405
 406                 smb_passwd_ptr = pdb_get_lanman_passwd(sampass);
 407         }
 408
 409         /*
 410          * Set up the sign/seal data.
 411          */
 412
 413         {
 414                 uchar p24[24];
 415                 NTLMSSPOWFencrypt(smb_passwd_ptr, lm_owf, p24);
 416                 {
 417                         unsigned char j = 0;
 418                         int ind;
 419
 420                         unsigned char k2[8];
 421
 422                         memcpy(k2, p24, 5);
 423                         k2[5] = 0xe5;
 424                         k2[6] = 0x38;
 425                         k2[7] = 0xb0;
 426
 427                         for (ind = 0; ind < 256; ind++)
 428                                 p->ntlmssp_hash[ind] = (unsigned char)ind;
 429
 430                         for( ind = 0; ind < 256; ind++) {
 431                                 unsigned char tc;
 432
 433                                 j += (p->ntlmssp_hash[ind] + k2[ind%8]);
 434
 435                                 tc = p->ntlmssp_hash[ind];
 436                                 p->ntlmssp_hash[ind] = p->ntlmssp_hash[j];
 437                                 p->ntlmssp_hash[j] = tc;
 438                         }
 439
 440                         p->ntlmssp_hash[256] = 0;
 441                         p->ntlmssp_hash[257] = 0;
 442                 }
 443 /*              NTLMSSPhash(p->ntlmssp_hash, p24); */
 444                 p->ntlmssp_seq_num = 0;
 445
 446         }
 447
 448         fstrcpy(p->user_name, user_name);
 449         fstrcpy(p->pipe_user_name, pipe_user_name);
 450         fstrcpy(p->domain, domain);
 451         fstrcpy(p->wks, wks);
 452
 453         /*
 454          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 455          */
 456
 457         p->pipe_user.uid = pdb_get_uid(sampass);
 458         p->pipe_user.gid = pdb_get_uid(sampass);
 459
 460         /* Set up pipe user group membership. */
 461         initialise_groups(pipe_user_name, p->pipe_user.uid, p->pipe_user.gid);
 462         get_current_groups( &p->pipe_user.ngroups, &p->pipe_user.groups);
 463
 464         /* Create an NT_USER_TOKEN struct for this user. */
 465         p->pipe_user.nt_user_token = create_nt_token(p->pipe_user.uid,p->pipe_user.gid,
 466                                                 p->pipe_user.ngroups, p->pipe_user.groups,
 467                                                 guest_user);
 468
 469         p->ntlmssp_auth_validated = True;
 470
 471         pdb_free_sam(sampass);
 472         return True;
 473 }
 474
 475 /*******************************************************************
 476  The switch table for the pipe names and the functions to handle them.
 477  *******************************************************************/
 478
 479 struct api_cmd
 480 {
 481   char * pipe_clnt_name;
 482   char * pipe_srv_name;
 483   BOOL (*fn) (pipes_struct *);
 484 };
 485
 486 static struct api_cmd api_fd_commands[] =
 487 {
 488     { "lsarpc",   "lsass",   api_ntlsa_rpc },
 489     { "samr",     "lsass",   api_samr_rpc },
 490     { "srvsvc",   "ntsvcs",  api_srvsvc_rpc },
 491     { "wkssvc",   "ntsvcs",  api_wkssvc_rpc },
 492     { "NETLOGON", "lsass",   api_netlog_rpc },
 493     { "winreg",   "winreg",  api_reg_rpc },
 494     { "spoolss",  "spoolss", api_spoolss_rpc },
 495 #ifdef WITH_MSDFS
 496     { "netdfs",   "netdfs" , api_netdfs_rpc },
 497 #endif
 498     { NULL,       NULL,      NULL }
 499 };
 500
 501 /*******************************************************************
 502  This is the client reply to our challenge for an authenticated
 503  bind request. The challenge we sent is in p->challenge.
 504 *******************************************************************/
 505
 506 BOOL api_pipe_bind_auth_resp(pipes_struct *p, prs_struct *rpc_in_p)
 507 {
 508         RPC_HDR_AUTHA autha_info;
 509         RPC_AUTH_VERIFIER auth_verifier;
 510         RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 511
 512         DEBUG(5,("api_pipe_bind_auth_resp: decode request. %d\n", __LINE__));
 513
 514         if (p->hdr.auth_len == 0) {
 515                 DEBUG(0,("api_pipe_bind_auth_resp: No auth field sent !\n"));
 516                 return False;
 517         }
 518
 519         /*
 520          * Decode the authentication verifier response.
 521          */
 522
 523         if(!smb_io_rpc_hdr_autha("", &autha_info, rpc_in_p, 0)) {
 524                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_HDR_AUTHA failed.\n"));
 525                 return False;
 526         }
 527
 528         if (autha_info.auth_type != NTLMSSP_AUTH_TYPE || autha_info.auth_level != NTLMSSP_AUTH_LEVEL) {
 529                 DEBUG(0,("api_pipe_bind_auth_resp: incorrect auth type (%d) or level (%d).\n",
 530                         (int)autha_info.auth_type, (int)autha_info.auth_level ));
 531                 return False;
 532         }
 533
 534         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 535                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_AUTH_VERIFIER failed.\n"));
 536                 return False;
 537         }
 538
 539         /*
 540          * Ensure this is a NTLMSSP_AUTH packet type.
 541          */
 542
 543         if (!rpc_auth_verifier_chk(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH)) {
 544                 DEBUG(0,("api_pipe_bind_auth_resp: rpc_auth_verifier_chk failed.\n"));
 545                 return False;
 546         }
 547
 548         if(!smb_io_rpc_auth_ntlmssp_resp("", &ntlmssp_resp, rpc_in_p, 0)) {
 549                 DEBUG(0,("api_pipe_bind_auth_resp: Failed to unmarshall RPC_AUTH_NTLMSSP_RESP.\n"));
 550                 return False;
 551         }
 552
 553         /*
 554          * The following call actually checks the challenge/response data.
 555          * for correctness against the given DOMAIN\user name.
 556          */
 557
 558         if (!api_pipe_ntlmssp_verify(p, &ntlmssp_resp))
 559                 return False;
 560
 561         p->pipe_bound = True
 562 ;
 563         return True;
 564 }
 565
 566 /*******************************************************************
 567  Marshall a bind_nak pdu.
 568 *******************************************************************/
 569
 570 static BOOL setup_bind_nak(pipes_struct *p)
 571 {
 572         prs_struct outgoing_rpc;
 573         RPC_HDR nak_hdr;
 574         uint16 zero = 0;
 575
 576         /* Free any memory in the current return data buffer. */
 577         prs_mem_free(&p->out_data.rdata);
 578
 579         /*
 580          * Marshall directly into the outgoing PDU space. We
 581          * must do this as we need to set to the bind response
 582          * header and are never sending more than one PDU here.
 583          */
 584
 585         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 586         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 587
 588
 589         /*
 590          * Initialize a bind_nak header.
 591          */
 592
 593         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 594             p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 595
 596         /*
 597          * Marshall the header into the outgoing PDU.
 598          */
 599
 600         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 601                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 602                 prs_mem_free(&outgoing_rpc);
 603                 return False;
 604         }
 605
 606         /*
 607          * Now add the reject reason.
 608          */
 609
 610         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 611                 prs_mem_free(&outgoing_rpc);
 612         return False;
 613         }
 614
 615         p->out_data.data_sent_length = 0;
 616         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 617         p->out_data.current_pdu_sent = 0;
 618
 619         p->pipe_bound = False;
 620
 621         return True;
 622 }
 623
 624 /*******************************************************************
 625  Marshall a fault pdu.
 626 *******************************************************************/
 627
 628 BOOL setup_fault_pdu(pipes_struct *p, uint32 status)
 629 {
 630         prs_struct outgoing_pdu;
 631         RPC_HDR fault_hdr;
 632         RPC_HDR_RESP hdr_resp;
 633         RPC_HDR_FAULT fault_resp;
 634
 635         /* Free any memory in the current return data buffer. */
 636         prs_mem_free(&p->out_data.rdata);
 637
 638         /*
 639          * Marshall directly into the outgoing PDU space. We
 640          * must do this as we need to set to the bind response
 641          * header and are never sending more than one PDU here.
 642          */
 643
 644         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 645         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 646
 647         /*
 648          * Initialize a fault header.
 649          */
 650
 651         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 652             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 653
 654         /*
 655          * Initialize the HDR_RESP and FAULT parts of the PDU.
 656          */
 657
 658         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 659
 660         fault_resp.status = status;
 661         fault_resp.reserved = 0;
 662
 663         /*
 664          * Marshall the header into the outgoing PDU.
 665          */
 666
 667         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 668                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 669                 prs_mem_free(&outgoing_pdu);
 670                 return False;
 671         }
 672
 673         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 674                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 675                 prs_mem_free(&outgoing_pdu);
 676                 return False;
 677         }
 678
 679         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 680                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 681                 prs_mem_free(&outgoing_pdu);
 682                 return False;
 683         }
 684
 685         p->out_data.data_sent_length = 0;
 686         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 687         p->out_data.current_pdu_sent = 0;
 688
 689         prs_mem_free(&outgoing_pdu);
 690         return True;
 691 }
 692
 693 /*******************************************************************
 694  Ensure a bind request has the correct abstract & transfer interface.
 695  Used to reject unknown binds from Win2k.
 696 *******************************************************************/
 697
 698 BOOL check_bind_req(char* pipe_name, RPC_IFACE* abstract,
 699                                         RPC_IFACE* transfer)
 700 {
 701         extern struct pipe_id_info pipe_names[];
 702         int i=0;
 703         fstring pname;
 704         fstrcpy(pname,"\\PIPE\\");
 705         fstrcat(pname,pipe_name);
 706
 707         for(i=0;pipe_names[i].client_pipe; i++) {
 708                 if(strequal(pipe_names[i].client_pipe, pname))
 709                         break;
 710         }
 711
 712         if(pipe_names[i].client_pipe == NULL)
 713                 return False;
 714
 715         /* check the abstract interface */
 716         if((abstract->version != pipe_names[i].abstr_syntax.version) ||
 717                 (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid,
 718                         sizeof(RPC_UUID)) != 0))
 719                 return False;
 720
 721         /* check the transfer interface */
 722         if((transfer->version != pipe_names[i].trans_syntax.version) ||
 723                 (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid,
 724                         sizeof(RPC_UUID)) != 0))
 725                 return False;
 726
 727         return True;
 728 }
 729
 730 /*******************************************************************
 731  Respond to a pipe bind request.
 732 *******************************************************************/
 733
 734 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
 735 {
 736         RPC_HDR_BA hdr_ba;
 737         RPC_HDR_RB hdr_rb;
 738         RPC_HDR_AUTH auth_info;
 739         uint16 assoc_gid;
 740         fstring ack_pipe_name;
 741         prs_struct out_hdr_ba;
 742         prs_struct out_auth;
 743         prs_struct outgoing_rpc;
 744         int i = 0;
 745         int auth_len = 0;
 746         enum RPC_PKT_TYPE reply_pkt_type;
 747
 748         p->ntlmssp_auth_requested = False;
 749
 750         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
 751
 752         /*
 753          * Try and find the correct pipe name to ensure
 754          * that this is a pipe name we support.
 755          */
 756
 757         for (i = 0; api_fd_commands[i].pipe_clnt_name; i++) {
 758                 if (strequal(api_fd_commands[i].pipe_clnt_name, p->name) &&
 759                     api_fd_commands[i].fn != NULL) {
 760                         DEBUG(3,("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 761                                    api_fd_commands[i].pipe_clnt_name,
 762                                    api_fd_commands[i].pipe_srv_name));
 763                         fstrcpy(p->pipe_srv_name, api_fd_commands[i].pipe_srv_name);
 764                         break;
 765                 }
 766         }
 767
 768         if (api_fd_commands[i].fn == NULL) {
 769                 DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 770                         p->name ));
 771                 if(!setup_bind_nak(p))
 772                         return False;
 773                 return True;
 774         }
 775
 776         /* decode the bind request */
 777         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
 778                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
 779                 return False;
 780         }
 781
 782         /*
 783          * Check if this is an authenticated request.
 784          */
 785
 786         if (p->hdr.auth_len != 0) {
 787                 RPC_AUTH_VERIFIER auth_verifier;
 788                 RPC_AUTH_NTLMSSP_NEG ntlmssp_neg;
 789
 790                 /*
 791                  * Decode the authentication verifier.
 792                  */
 793
 794                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 795                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 796                         return False;
 797                 }
 798
 799                 /*
 800                  * We only support NTLMSSP_AUTH_TYPE requests.
 801                  */
 802
 803                 if(auth_info.auth_type != NTLMSSP_AUTH_TYPE) {
 804                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n",
 805                                 auth_info.auth_type ));
 806                         return False;
 807                 }
 808
 809                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 810                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 811                         return False;
 812                 }
 813
 814                 if(!strequal(auth_verifier.signature, "NTLMSSP")) {
 815                         DEBUG(0,("api_pipe_bind_req: auth_verifier.signature != NTLMSSP\n"));
 816                         return False;
 817                 }
 818
 819                 if(auth_verifier.msg_type != NTLMSSP_NEGOTIATE) {
 820                         DEBUG(0,("api_pipe_bind_req: auth_verifier.msg_type (%d) != NTLMSSP_NEGOTIATE\n",
 821                                 auth_verifier.msg_type));
 822                         return False;
 823                 }
 824
 825                 if(!smb_io_rpc_auth_ntlmssp_neg("", &ntlmssp_neg, rpc_in_p, 0)) {
 826                         DEBUG(0,("api_pipe_bind_req: Failed to unmarshall RPC_AUTH_NTLMSSP_NEG.\n"));
 827                         return False;
 828                 }
 829
 830                 p->ntlmssp_chal_flags = SMBD_NTLMSSP_NEG_FLAGS;
 831                 p->ntlmssp_auth_requested = True;
 832         }
 833
 834         switch(p->hdr.pkt_type) {
 835                 case RPC_BIND:
 836                         /* name has to be \PIPE\xxxxx */
 837                         fstrcpy(ack_pipe_name, "\\PIPE\\");
 838                         fstrcat(ack_pipe_name, p->pipe_srv_name);
 839                         reply_pkt_type = RPC_BINDACK;
 840                         break;
 841                 case RPC_ALTCONT:
 842                         /* secondary address CAN be NULL
 843                          * as the specs say it's ignored.
 844                          * It MUST NULL to have the spoolss working.
 845                          */
 846                         fstrcpy(ack_pipe_name,"");
 847                         reply_pkt_type = RPC_ALTCONTRESP;
 848                         break;
 849                 default:
 850                         return False;
 851         }
 852
 853         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 854
 855         /*
 856          * Marshall directly into the outgoing PDU space. We
 857          * must do this as we need to set to the bind response
 858          * header and are never sending more than one PDU here.
 859          */
 860
 861         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 862         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 863
 864         /*
 865          * Setup the memory to marshall the ba header, and the
 866          * auth footers.
 867          */
 868
 869         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
 870                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
 871                 prs_mem_free(&outgoing_rpc);
 872                 return False;
 873         }
 874
 875         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
 876                 DEBUG(0,("pi_pipe_bind_req: malloc out_auth failed.\n"));
 877                 prs_mem_free(&outgoing_rpc);
 878                 prs_mem_free(&out_hdr_ba);
 879                 return False;
 880         }
 881
 882         if (p->ntlmssp_auth_requested)
 883                 assoc_gid = 0x7a77;
 884         else
 885                 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
 886
 887         /*
 888          * Create the bind response struct.
 889          */
 890
 891         /* If the requested abstract synt uuid doesn't match our client pipe,
 892                 reject the bind_ack & set the transfer interface synt to all 0's,
 893                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 894                 unknown to NT4)
 895                 Needed when adding entries to a DACL from NT5 - SK */
 896
 897         if(check_bind_req(p->name, &hdr_rb.abstract, &hdr_rb.transfer)) {
 898                 init_rpc_hdr_ba(&hdr_ba,
 899                         MAX_PDU_FRAG_LEN,
 900                         MAX_PDU_FRAG_LEN,
 901                         assoc_gid,
 902                         ack_pipe_name,
 903                         0x1, 0x0, 0x0,
 904                         &hdr_rb.transfer);
 905         } else {
 906                 RPC_IFACE null_interface;
 907                 ZERO_STRUCT(null_interface);
 908                 /* Rejection reason: abstract syntax not supported */
 909                 init_rpc_hdr_ba(&hdr_ba, MAX_PDU_FRAG_LEN,
 910                                         MAX_PDU_FRAG_LEN, assoc_gid,
 911                                         ack_pipe_name, 0x1, 0x2, 0x1,
 912                                         &null_interface);
 913         }
 914
 915         /*
 916          * and marshall it.
 917          */
 918
 919         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
 920                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
 921                 goto err_exit;
 922         }
 923
 924         /*
 925          * Now the authentication.
 926          */
 927
 928         if (p->ntlmssp_auth_requested) {
 929                 RPC_AUTH_VERIFIER auth_verifier;
 930                 RPC_AUTH_NTLMSSP_CHAL ntlmssp_chal;
 931
 932                 generate_random_buffer(p->challenge, 8, False);
 933
 934                 /*** Authentication info ***/
 935
 936                 init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, RPC_HDR_AUTH_LEN, 1);
 937                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
 938                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
 939                         goto err_exit;
 940                 }
 941
 942                 /*** NTLMSSP verifier ***/
 943
 944                 init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_CHALLENGE);
 945                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, &out_auth, 0)) {
 946                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
 947                         goto err_exit;
 948                 }
 949
 950                 /* NTLMSSP challenge ***/
 951
 952                 init_rpc_auth_ntlmssp_chal(&ntlmssp_chal, p->ntlmssp_chal_flags, p->challenge);
 953                 if(!smb_io_rpc_auth_ntlmssp_chal("", &ntlmssp_chal, &out_auth, 0)) {
 954                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_NTLMSSP_CHAL failed.\n"));
 955                         goto err_exit;
 956                 }
 957
 958                 /* Auth len in the rpc header doesn't include auth_header. */
 959                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
 960         }
 961
 962         /*
 963          * Create the header, now we know the length.
 964          */
 965
 966         init_rpc_hdr(&p->hdr, reply_pkt_type, RPC_FLG_FIRST | RPC_FLG_LAST,
 967                         p->hdr.call_id,
 968                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
 969                         auth_len);
 970
 971         /*
 972          * Marshall the header into the outgoing PDU.
 973          */
 974
 975         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
 976                 DEBUG(0,("pi_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
 977                 goto err_exit;
 978         }
 979
 980         /*
 981          * Now add the RPC_HDR_BA and any auth needed.
 982          */
 983
 984         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
 985                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
 986                 goto err_exit;
 987         }
 988
 989         if(p->ntlmssp_auth_requested && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
 990                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
 991                 goto err_exit;
 992         }
 993
 994         if(!p->ntlmssp_auth_requested)
 995                 p->pipe_bound = True;
 996
 997         /*
 998          * Setup the lengths for the initial reply.
 999          */
1000
1001         p->out_data.data_sent_length = 0;
1002         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1003         p->out_data.current_pdu_sent = 0;
1004
1005         prs_mem_free(&out_hdr_ba);
1006         prs_mem_free(&out_auth);
1007
1008         return True;
1009
1010   err_exit:
1011
1012         prs_mem_free(&outgoing_rpc);
1013         prs_mem_free(&out_hdr_ba);
1014         prs_mem_free(&out_auth);
1015         return False;
1016 }
1017
1018 /****************************************************************************
1019  Deal with sign & seal processing on an RPC request.
1020 ****************************************************************************/
1021
1022 BOOL api_pipe_auth_process(pipes_struct *p, prs_struct *rpc_in)
1023 {
1024         /*
1025          * We always negotiate the following two bits....
1026          */
1027         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
1028         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
1029         int data_len;
1030         int auth_len;
1031         uint32 old_offset;
1032         uint32 crc32 = 0;
1033
1034         auth_len = p->hdr.auth_len;
1035
1036         if ((auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) && auth_verify) {
1037                 DEBUG(0,("api_pipe_auth_process: Incorrect auth_len %d.\n", auth_len ));
1038                 return False;
1039         }
1040
1041         /*
1042          * The following is that length of the data we must verify or unseal.
1043          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1044          * preceeding the auth_data.
1045          */
1046
1047         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1048                         (auth_verify ? RPC_HDR_AUTH_LEN : 0) - auth_len;
1049
1050         DEBUG(5,("api_pipe_auth_process: sign: %s seal: %s data %d auth %d\n",
1051                  BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, auth_len));
1052
1053         if (auth_seal) {
1054                 /*
1055                  * The data in rpc_in doesn't contain the RPC_HEADER as this
1056                  * has already been consumed.
1057                  */
1058                 char *data = prs_data_p(rpc_in) + RPC_HDR_REQ_LEN;
1059                 NTLMSSPcalc_p(p, (uchar*)data, data_len);
1060                 crc32 = crc32_calc_buffer(data, data_len);
1061         }
1062
1063         old_offset = prs_offset(rpc_in);
1064
1065         if (auth_seal || auth_verify) {
1066                 RPC_HDR_AUTH auth_info;
1067
1068                 if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1069                         DEBUG(0,("api_pipe_auth_process: cannot move offset to %u.\n",
1070                                 (unsigned int)old_offset + data_len ));
1071                         return False;
1072                 }
1073
1074                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1075                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1076                         return False;
1077                 }
1078         }
1079
1080         if (auth_verify) {
1081                 RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
1082                 char *req_data = prs_data_p(rpc_in) + prs_offset(rpc_in) + 4;
1083
1084                 DEBUG(5,("api_pipe_auth_process: auth %d\n", prs_offset(rpc_in) + 4));
1085
1086                 /*
1087                  * Ensure we have RPC_AUTH_NTLMSSP_CHK_LEN - 4 more bytes in the
1088                  * incoming buffer.
1089                  */
1090                 if(prs_mem_get(rpc_in, RPC_AUTH_NTLMSSP_CHK_LEN - 4) == NULL) {
1091                         DEBUG(0,("api_pipe_auth_process: missing %d bytes in buffer.\n",
1092                                 RPC_AUTH_NTLMSSP_CHK_LEN - 4 ));
1093                         return False;
1094                 }
1095
1096                 NTLMSSPcalc_p(p, (uchar*)req_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
1097                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, rpc_in, 0)) {
1098                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_AUTH_NTLMSSP_CHK.\n"));
1099                         return False;
1100                 }
1101
1102                 if (!rpc_auth_ntlmssp_chk(&ntlmssp_chk, crc32, p->ntlmssp_seq_num)) {
1103                         DEBUG(0,("api_pipe_auth_process: NTLMSSP check failed.\n"));
1104                         return False;
1105                 }
1106         }
1107
1108         /*
1109          * Return the current pointer to the data offset.
1110          */
1111
1112         if(!prs_set_offset(rpc_in, old_offset)) {
1113                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
1114                         (unsigned int)old_offset ));
1115                 return False;
1116         }
1117
1118         return True;
1119 }
1120
1121 /****************************************************************************
1122  Return a user struct for a pipe user.
1123 ****************************************************************************/
1124
1125 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
1126 {
1127         if (p->ntlmssp_auth_validated) {
1128                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
1129         } else {
1130                 extern struct current_user current_user;
1131                 memcpy(user, &current_user, sizeof(struct current_user));
1132         }
1133
1134         return user;
1135 }
1136
1137 /****************************************************************************
1138  Find the correct RPC function to call for this request.
1139  If the pipe is authenticated then become the correct UNIX user
1140  before doing the call.
1141 ****************************************************************************/
1142
1143 BOOL api_pipe_request(pipes_struct *p)
1144 {
1145         int i = 0;
1146         BOOL ret = False;
1147         BOOL changed_user_id = False;
1148
1149         if (p->ntlmssp_auth_validated) {
1150
1151                 if(!become_authenticated_pipe_user(p)) {
1152                         prs_mem_free(&p->out_data.rdata);
1153                         return False;
1154                 }
1155
1156                 changed_user_id = True;
1157         }
1158
1159         for (i = 0; api_fd_commands[i].pipe_clnt_name; i++) {
1160                 if (strequal(api_fd_commands[i].pipe_clnt_name, p->name) &&
1161                     api_fd_commands[i].fn != NULL) {
1162                         DEBUG(3,("Doing \\PIPE\\%s\n", api_fd_commands[i].pipe_clnt_name));
1163                         set_current_rpc_talloc(p->mem_ctx);
1164                         ret = api_fd_commands[i].fn(p);
1165                         set_current_rpc_talloc(NULL);
1166                 }
1167         }
1168
1169         if(changed_user_id)
1170                 unbecome_authenticated_pipe_user(p);
1171
1172         return ret;
1173 }
1174
1175 /*******************************************************************
1176  Calls the underlying RPC function for a named pipe.
1177  ********************************************************************/
1178
1179 BOOL api_rpcTNP(pipes_struct *p, char *rpc_name,
1180                 struct api_struct *api_rpc_cmds)
1181 {
1182         int fn_num;
1183         fstring name;
1184         uint32 offset1, offset2;
1185
1186         /* interpret the command */
1187         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
1188
1189         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
1190         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
1191
1192         for (fn_num = 0; api_rpc_cmds[fn_num].name; fn_num++) {
1193                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
1194                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
1195                         break;
1196                 }
1197         }
1198
1199         if (api_rpc_cmds[fn_num].name == NULL) {
1200                 /*
1201                  * For an unknown RPC just return a fault PDU but
1202                  * return True to allow RPC's on the pipe to continue
1203                  * and not put the pipe into fault state. JRA.
1204                  */
1205                 DEBUG(4, ("unknown\n"));
1206                 setup_fault_pdu(p, 0x1c010002);
1207                 return True;
1208         }
1209
1210         offset1 = prs_offset(&p->out_data.rdata);
1211
1212         /* do the actual command */
1213         if(!api_rpc_cmds[fn_num].fn(p)) {
1214                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
1215                 prs_mem_free(&p->out_data.rdata);
1216                 return False;
1217         }
1218
1219         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
1220         offset2 = prs_offset(&p->out_data.rdata);
1221         prs_set_offset(&p->out_data.rdata, offset1);
1222         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
1223         prs_set_offset(&p->out_data.rdata, offset2);
1224
1225         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
1226
1227         /* Check for buffer underflow in rpc parsing */
1228
1229         if ((DEBUGLEVEL >= 10) &&
1230             (p->in_data.data.data_offset != p->in_data.data.buffer_size)) {
1231                 int data_len = p->in_data.data.buffer_size -
1232                         p->in_data.data.data_offset;
1233                 char *data;
1234
1235                 data = malloc(data_len);
1236
1237                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1238                 if (data) {
1239                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data,
1240                                    data_len);
1241                         free(data);
1242                 }
1243
1244         }
1245
1246         return True;
1247 }