source3/rpc_server/srv_pipe.c

   1 #define OLD_NTDOMAIN 1
   2 /*
   3  *  Unix SMB/Netbios implementation.
   4  *  Version 1.9.
   5  *  RPC Pipe client / server routines
   6  *  Copyright (C) Andrew Tridgell              1992-1998
   7  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   8  *  Copyright (C) Paul Ashton                  1997-1998.
   9  *  Copyright (C) Jeremy Allison                    1999.
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 2 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License
  22  *  along with this program; if not, write to the Free Software
  23  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  24  */
  25
  26 /*  this module apparently provides an implementation of DCE/RPC over a
  27  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  28  *  documentation are available (in on-line form) from the X-Open group.
  29  *
  30  *  this module should provide a level of abstraction between SMB
  31  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  32  *  data copies, and network traffic.
  33  *
  34  *  in this version, which takes a "let's learn what's going on and
  35  *  get something running" approach, there is additional network
  36  *  traffic generated, but the code should be easier to understand...
  37  *
  38  *  ... if you read the docs.  or stare at packets for weeks on end.
  39  *
  40  */
  41
  42 #include "includes.h"
  43
  44 extern int DEBUGLEVEL;
  45
  46 static void NTLMSSPcalc_p( pipes_struct *p, unsigned char *data, int len)
  47 {
  48     unsigned char *hash = p->ntlmssp_hash;
  49     unsigned char index_i = hash[256];
  50     unsigned char index_j = hash[257];
  51     int ind;
  52
  53     for( ind = 0; ind < len; ind++) {
  54         unsigned char tc;
  55         unsigned char t;
  56
  57         index_i++;
  58         index_j += hash[index_i];
  59
  60         tc = hash[index_i];
  61         hash[index_i] = hash[index_j];
  62         hash[index_j] = tc;
  63
  64         t = hash[index_i] + hash[index_j];
  65         data[ind] = data[ind] ^ hash[t];
  66     }
  67
  68     hash[256] = index_i;
  69     hash[257] = index_j;
  70 }
  71
  72 /*******************************************************************
  73  Generate the next PDU to be returned from the data in p->rdata.
  74  We cheat here as this function doesn't handle the special auth
  75  footers of the authenticated bind response reply.
  76  ********************************************************************/
  77
  78 BOOL create_next_pdu(pipes_struct *p)
  79 {
  80         RPC_HDR_RESP hdr_resp;
  81         BOOL auth_verify = IS_BITS_SET_ALL(p->ntlmssp_chal_flags, NTLMSSP_NEGOTIATE_SIGN);
  82         BOOL auth_seal   = IS_BITS_SET_ALL(p->ntlmssp_chal_flags, NTLMSSP_NEGOTIATE_SEAL);
  83         uint32 data_len;
  84         uint32 data_space_available;
  85         uint32 data_len_left;
  86         prs_struct outgoing_pdu;
  87         char *data;
  88         char *data_from;
  89         uint32 data_pos;
  90
  91         /*
  92          * If we're in the fault state, keep returning fault PDU's until
  93          * the pipe gets closed. JRA.
  94          */
  95
  96         if(p->fault_state) {
  97                 setup_fault_pdu(p);
  98                 return True;
  99         }
 100
 101         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 102
 103         /* Change the incoming request header to a response. */
 104         p->hdr.pkt_type = RPC_RESPONSE;
 105
 106         /* Set up rpc header flags. */
 107         if (p->out_data.data_sent_length == 0)
 108                 p->hdr.flags = RPC_FLG_FIRST;
 109         else
 110                 p->hdr.flags = 0;
 111
 112         /*
 113          * Work out how much we can fit in a single PDU.
 114          */
 115
 116         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 117         if(p->ntlmssp_auth_validated)
 118                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN);
 119
 120         /*
 121          * The amount we send is the minimum of the available
 122          * space and the amount left to send.
 123          */
 124
 125         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 126
 127         /*
 128          * Ensure there really is data left to send.
 129          */
 130
 131         if(!data_len_left) {
 132                 DEBUG(0,("create_next_pdu: no data left to send !\n"));
 133                 return False;
 134         }
 135
 136         data_len = MIN(data_len_left, data_space_available);
 137
 138         /*
 139          * Set up the alloc hint. This should be the data left to
 140          * send.
 141          */
 142
 143         hdr_resp.alloc_hint = data_len_left;
 144
 145         /*
 146          * Set up the header lengths.
 147          */
 148
 149         if (p->ntlmssp_auth_validated) {
 150                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
 151                                         RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN;
 152                 p->hdr.auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 153         } else {
 154                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 155                 p->hdr.auth_len = 0;
 156         }
 157
 158         /*
 159          * Work out if this PDU will be the last.
 160          */
 161
 162         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata))
 163                 p->hdr.flags |= RPC_FLG_LAST;
 164
 165         /*
 166          * Init the parse struct to point at the outgoing
 167          * data.
 168          */
 169
 170         prs_init( &outgoing_pdu, 0, 4, p->mem_ctx, MARSHALL);
 171         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 172
 173         /* Store the header in the data stream. */
 174         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 175                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR.\n"));
 176                 prs_mem_free(&outgoing_pdu);
 177                 return False;
 178         }
 179
 180         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 181                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_RESP.\n"));
 182                 prs_mem_free(&outgoing_pdu);
 183                 return False;
 184         }
 185
 186         /* Store the current offset. */
 187         data_pos = prs_offset(&outgoing_pdu);
 188
 189         /* Copy the data into the PDU. */
 190         data_from = prs_data_p(&p->out_data.rdata) + p->out_data.data_sent_length;
 191
 192         if(!prs_append_data(&outgoing_pdu, data_from, data_len)) {
 193                 DEBUG(0,("create_next_pdu: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 194                 prs_mem_free(&outgoing_pdu);
 195                 return False;
 196         }
 197
 198         /*
 199          * Set data to point to where we copied the data into.
 200          */
 201
 202         data = prs_data_p(&outgoing_pdu) + data_pos;
 203
 204         if (p->hdr.auth_len > 0) {
 205                 uint32 crc32 = 0;
 206
 207                 DEBUG(5,("create_next_pdu: sign: %s seal: %s data %d auth %d\n",
 208                          BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, p->hdr.auth_len));
 209
 210                 if (auth_seal) {
 211                         crc32 = crc32_calc_buffer(data, data_len);
 212                         NTLMSSPcalc_p(p, (uchar*)data, data_len);
 213                 }
 214
 215                 if (auth_seal || auth_verify) {
 216                         RPC_HDR_AUTH auth_info;
 217
 218                         init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL,
 219                                         (auth_verify ? RPC_HDR_AUTH_LEN : 0), (auth_verify ? 1 : 0));
 220                         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 221                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 222                                 prs_mem_free(&outgoing_pdu);
 223                                 return False;
 224                         }
 225                 }
 226
 227                 if (auth_verify) {
 228                         RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
 229                         char *auth_data = prs_data_p(&outgoing_pdu);
 230
 231                         p->ntlmssp_seq_num++;
 232                         init_rpc_auth_ntlmssp_chk(&ntlmssp_chk, NTLMSSP_SIGN_VERSION,
 233                                         crc32, p->ntlmssp_seq_num++);
 234                         auth_data = prs_data_p(&outgoing_pdu) + prs_offset(&outgoing_pdu) + 4;
 235                         if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, &outgoing_pdu, 0)) {
 236                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_AUTH_NTLMSSP_CHK.\n"));
 237                                 prs_mem_free(&outgoing_pdu);
 238                                 return False;
 239                         }
 240                         NTLMSSPcalc_p(p, (uchar*)auth_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 241                 }
 242         }
 243
 244         /*
 245          * Setup the counts for this PDU.
 246          */
 247
 248         p->out_data.data_sent_length += data_len;
 249         p->out_data.current_pdu_len = p->hdr.frag_len;
 250         p->out_data.current_pdu_sent = 0;
 251
 252         prs_mem_free(&outgoing_pdu);
 253         return True;
 254 }
 255
 256 /*******************************************************************
 257  Process an NTLMSSP authentication response.
 258  If this function succeeds, the user has been authenticated
 259  and their domain, name and calling workstation stored in
 260  the pipe struct.
 261  The initial challenge is stored in p->challenge.
 262  *******************************************************************/
 263
 264 static BOOL api_pipe_ntlmssp_verify(pipes_struct *p, RPC_AUTH_NTLMSSP_RESP *ntlmssp_resp)
 265 {
 266         uchar lm_owf[24];
 267         uchar nt_owf[24];
 268         fstring user_name;
 269         fstring pipe_user_name;
 270         fstring domain;
 271         fstring wks;
 272         BOOL guest_user = False;
 273         struct smb_passwd *smb_pass = NULL;
 274         struct passwd *pass = NULL;
 275         uchar null_smb_passwd[16];
 276         uchar *smb_passwd_ptr = NULL;
 277
 278         DEBUG(5,("api_pipe_ntlmssp_verify: checking user details\n"));
 279
 280         memset(p->user_name, '\0', sizeof(p->user_name));
 281         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 282         memset(p->domain, '\0', sizeof(p->domain));
 283         memset(p->wks, '\0', sizeof(p->wks));
 284
 285         /*
 286          * Setup an empty password for a guest user.
 287          */
 288
 289         memset(null_smb_passwd,0,16);
 290
 291         /*
 292          * We always negotiate UNICODE.
 293          */
 294
 295         if (IS_BITS_SET_ALL(p->ntlmssp_chal_flags, NTLMSSP_NEGOTIATE_UNICODE)) {
 296                 fstrcpy(user_name, dos_unistrn2((uint16*)ntlmssp_resp->user, ntlmssp_resp->hdr_usr.str_str_len/2));
 297                 fstrcpy(domain, dos_unistrn2((uint16*)ntlmssp_resp->domain, ntlmssp_resp->hdr_domain.str_str_len/2));
 298                 fstrcpy(wks, dos_unistrn2((uint16*)ntlmssp_resp->wks, ntlmssp_resp->hdr_wks.str_str_len/2));
 299         } else {
 300                 fstrcpy(user_name, ntlmssp_resp->user);
 301                 fstrcpy(domain, ntlmssp_resp->domain);
 302                 fstrcpy(wks, ntlmssp_resp->wks);
 303         }
 304
 305         DEBUG(5,("user: %s domain: %s wks: %s\n", user_name, domain, wks));
 306
 307         memcpy(lm_owf, ntlmssp_resp->lm_resp, sizeof(lm_owf));
 308         memcpy(nt_owf, ntlmssp_resp->nt_resp, sizeof(nt_owf));
 309
 310 #ifdef DEBUG_PASSWORD
 311         DEBUG(100,("lm, nt owfs, chal\n"));
 312         dump_data(100, (char *)lm_owf, sizeof(lm_owf));
 313         dump_data(100, (char *)nt_owf, sizeof(nt_owf));
 314         dump_data(100, (char *)p->challenge, 8);
 315 #endif
 316
 317         /*
 318          * Allow guest access. Patch from Shirish Kalele <kalele@veritas.com>.
 319          */
 320
 321         if((strlen(user_name) == 0) &&
 322            (ntlmssp_resp->hdr_nt_resp.str_str_len==0))
 323           {
 324                 guest_user = True;
 325
 326         fstrcpy(pipe_user_name, lp_guestaccount(-1));
 327                 DEBUG(100,("Null user in NTLMSSP verification. Using guest = %s\n", pipe_user_name));
 328
 329                 smb_passwd_ptr = null_smb_passwd;
 330
 331         } else {
 332
 333                 /*
 334                  * Pass the user through the NT -> unix user mapping
 335                  * function.
 336                  */
 337
 338                 fstrcpy(pipe_user_name, user_name);
 339                 (void)map_username(pipe_user_name);
 340
 341                 /*
 342                  * Do the length checking only if user is not NULL.
 343                  */
 344
 345                 if (ntlmssp_resp->hdr_lm_resp.str_str_len == 0)
 346                         return False;
 347                 if (ntlmssp_resp->hdr_nt_resp.str_str_len == 0)
 348                         return False;
 349                 if (ntlmssp_resp->hdr_usr.str_str_len == 0)
 350                         return False;
 351                 if (ntlmssp_resp->hdr_domain.str_str_len == 0)
 352                         return False;
 353                 if (ntlmssp_resp->hdr_wks.str_str_len == 0)
 354                         return False;
 355
 356         }
 357
 358         /*
 359          * Find the user in the unix password db.
 360          */
 361
 362         if(!(pass = Get_Pwnam(pipe_user_name,True))) {
 363                 DEBUG(1,("Couldn't find user '%s' in UNIX password database.\n",pipe_user_name));
 364                 return(False);
 365         }
 366
 367         if(!guest_user) {
 368
 369                 become_root();
 370
 371                 if(!(p->ntlmssp_auth_validated = pass_check_smb(pipe_user_name, domain,
 372                                       (uchar*)p->challenge, lm_owf, nt_owf, NULL))) {
 373                         DEBUG(1,("api_pipe_ntlmssp_verify: User %s\\%s from machine %s \
 374 failed authentication on named pipe %s.\n", domain, pipe_user_name, wks, p->name ));
 375                         unbecome_root();
 376                         return False;
 377                 }
 378
 379                 if(!(smb_pass = getsmbpwnam(pipe_user_name))) {
 380                         DEBUG(1,("api_pipe_ntlmssp_verify: Cannot find user %s in smb passwd database.\n",
 381                                 pipe_user_name));
 382                         unbecome_root();
 383                         return False;
 384                 }
 385
 386                 unbecome_root();
 387
 388                 if (smb_pass == NULL) {
 389                         DEBUG(1,("api_pipe_ntlmssp_verify: Couldn't find user '%s' in smb_passwd file.\n",
 390                                 pipe_user_name));
 391                         return(False);
 392                 }
 393
 394                 /* Quit if the account was disabled. */
 395                 if((smb_pass->acct_ctrl & ACB_DISABLED) || !smb_pass->smb_passwd) {
 396                         DEBUG(1,("Account for user '%s' was disabled.\n", pipe_user_name));
 397                         return(False);
 398                 }
 399
 400                 if(!smb_pass->smb_nt_passwd) {
 401                         DEBUG(1,("Account for user '%s' has no NT password hash.\n", pipe_user_name));
 402                         return(False);
 403                 }
 404
 405                 smb_passwd_ptr = smb_pass->smb_passwd;
 406         }
 407
 408         /*
 409          * Set up the sign/seal data.
 410          */
 411
 412         {
 413                 uchar p24[24];
 414                 NTLMSSPOWFencrypt(smb_passwd_ptr, lm_owf, p24);
 415                 {
 416                         unsigned char j = 0;
 417                         int ind;
 418
 419                         unsigned char k2[8];
 420
 421                         memcpy(k2, p24, 5);
 422                         k2[5] = 0xe5;
 423                         k2[6] = 0x38;
 424                         k2[7] = 0xb0;
 425
 426                         for (ind = 0; ind < 256; ind++)
 427                                 p->ntlmssp_hash[ind] = (unsigned char)ind;
 428
 429                         for( ind = 0; ind < 256; ind++) {
 430                                 unsigned char tc;
 431
 432                                 j += (p->ntlmssp_hash[ind] + k2[ind%8]);
 433
 434                                 tc = p->ntlmssp_hash[ind];
 435                                 p->ntlmssp_hash[ind] = p->ntlmssp_hash[j];
 436                                 p->ntlmssp_hash[j] = tc;
 437                         }
 438
 439                         p->ntlmssp_hash[256] = 0;
 440                         p->ntlmssp_hash[257] = 0;
 441                 }
 442 /*              NTLMSSPhash(p->ntlmssp_hash, p24); */
 443                 p->ntlmssp_seq_num = 0;
 444
 445         }
 446
 447         fstrcpy(p->user_name, user_name);
 448         fstrcpy(p->pipe_user_name, pipe_user_name);
 449         fstrcpy(p->domain, domain);
 450         fstrcpy(p->wks, wks);
 451
 452         /*
 453          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 454          */
 455
 456         p->pipe_user.uid = pass->pw_uid;
 457         p->pipe_user.gid = pass->pw_gid;
 458
 459         /* XXX also set up pipe user group membership */
 460
 461         p->ntlmssp_auth_validated = True;
 462         return True;
 463 }
 464
 465 /*******************************************************************
 466  The switch table for the pipe names and the functions to handle them.
 467  *******************************************************************/
 468
 469 struct api_cmd
 470 {
 471   char * pipe_clnt_name;
 472   char * pipe_srv_name;
 473   BOOL (*fn) (pipes_struct *);
 474 };
 475
 476 static struct api_cmd api_fd_commands[] =
 477 {
 478     { "lsarpc",   "lsass",   api_ntlsa_rpc },
 479     { "samr",     "lsass",   api_samr_rpc },
 480     { "srvsvc",   "ntsvcs",  api_srvsvc_rpc },
 481     { "wkssvc",   "ntsvcs",  api_wkssvc_rpc },
 482     { "NETLOGON", "lsass",   api_netlog_rpc },
 483     { "winreg",   "winreg",  api_reg_rpc },
 484     { "spoolss",  "spoolss", api_spoolss_rpc },
 485 #ifdef WITH_MSDFS
 486     { "netdfs",   "netdfs" , api_netdfs_rpc },
 487 #endif
 488     { NULL,       NULL,      NULL }
 489 };
 490
 491 /*******************************************************************
 492  This is the client reply to our challenge for an authenticated
 493  bind request. The challenge we sent is in p->challenge.
 494 *******************************************************************/
 495
 496 BOOL api_pipe_bind_auth_resp(pipes_struct *p, prs_struct *rpc_in_p)
 497 {
 498         RPC_HDR_AUTHA autha_info;
 499         RPC_AUTH_VERIFIER auth_verifier;
 500         RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 501
 502         DEBUG(5,("api_pipe_bind_auth_resp: decode request. %d\n", __LINE__));
 503
 504         if (p->hdr.auth_len == 0) {
 505                 DEBUG(0,("api_pipe_bind_auth_resp: No auth field sent !\n"));
 506                 return False;
 507         }
 508
 509         /*
 510          * Decode the authentication verifier response.
 511          */
 512
 513         if(!smb_io_rpc_hdr_autha("", &autha_info, rpc_in_p, 0)) {
 514                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_HDR_AUTHA failed.\n"));
 515                 return False;
 516         }
 517
 518         if (autha_info.auth_type != NTLMSSP_AUTH_TYPE || autha_info.auth_level != NTLMSSP_AUTH_LEVEL) {
 519                 DEBUG(0,("api_pipe_bind_auth_resp: incorrect auth type (%d) or level (%d).\n",
 520                         (int)autha_info.auth_type, (int)autha_info.auth_level ));
 521                 return False;
 522         }
 523
 524         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 525                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_AUTH_VERIFIER failed.\n"));
 526                 return False;
 527         }
 528
 529         /*
 530          * Ensure this is a NTLMSSP_AUTH packet type.
 531          */
 532
 533         if (!rpc_auth_verifier_chk(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH)) {
 534                 DEBUG(0,("api_pipe_bind_auth_resp: rpc_auth_verifier_chk failed.\n"));
 535                 return False;
 536         }
 537
 538         if(!smb_io_rpc_auth_ntlmssp_resp("", &ntlmssp_resp, rpc_in_p, 0)) {
 539                 DEBUG(0,("api_pipe_bind_auth_resp: Failed to unmarshall RPC_AUTH_NTLMSSP_RESP.\n"));
 540                 return False;
 541         }
 542
 543         /*
 544          * The following call actually checks the challenge/response data.
 545          * for correctness against the given DOMAIN\user name.
 546          */
 547
 548         if (!api_pipe_ntlmssp_verify(p, &ntlmssp_resp))
 549                 return False;
 550
 551         p->pipe_bound = True
 552 ;
 553         return True;
 554 }
 555
 556 /*******************************************************************
 557  Marshall a bind_nak pdu.
 558 *******************************************************************/
 559
 560 static BOOL setup_bind_nak(pipes_struct *p)
 561 {
 562         prs_struct outgoing_rpc;
 563         RPC_HDR nak_hdr;
 564         uint16 zero = 0;
 565
 566         /* Free any memory in the current return data buffer. */
 567         prs_mem_free(&p->out_data.rdata);
 568
 569         /*
 570          * Marshall directly into the outgoing PDU space. We
 571          * must do this as we need to set to the bind response
 572          * header and are never sending more than one PDU here.
 573          */
 574
 575         prs_init( &outgoing_rpc, 0, 4, p->mem_ctx, MARSHALL);
 576         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 577
 578
 579         /*
 580          * Initialize a bind_nak header.
 581          */
 582
 583         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 584             p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 585
 586         /*
 587          * Marshall the header into the outgoing PDU.
 588          */
 589
 590         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 591                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 592                 prs_mem_free(&outgoing_rpc);
 593                 return False;
 594         }
 595
 596         /*
 597          * Now add the reject reason.
 598          */
 599
 600         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 601                 prs_mem_free(&outgoing_rpc);
 602         return False;
 603         }
 604
 605         p->out_data.data_sent_length = 0;
 606         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 607         p->out_data.current_pdu_sent = 0;
 608
 609         p->pipe_bound = False;
 610
 611         return True;
 612 }
 613
 614 /*******************************************************************
 615  Marshall a fault pdu.
 616 *******************************************************************/
 617
 618 BOOL setup_fault_pdu(pipes_struct *p)
 619 {
 620         prs_struct outgoing_pdu;
 621         RPC_HDR fault_hdr;
 622         RPC_HDR_RESP hdr_resp;
 623         RPC_HDR_FAULT fault_resp;
 624
 625         /* Free any memory in the current return data buffer. */
 626         prs_mem_free(&p->out_data.rdata);
 627
 628         /*
 629          * Marshall directly into the outgoing PDU space. We
 630          * must do this as we need to set to the bind response
 631          * header and are never sending more than one PDU here.
 632          */
 633
 634         prs_init( &outgoing_pdu, 0, 4, p->mem_ctx, MARSHALL);
 635         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 636
 637         /*
 638          * Initialize a fault header.
 639          */
 640
 641         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 642             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 643
 644         /*
 645          * Initialize the HDR_RESP and FAULT parts of the PDU.
 646          */
 647
 648         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 649
 650         fault_resp.status = 0x1c010002;
 651         fault_resp.reserved = 0;
 652
 653         /*
 654          * Marshall the header into the outgoing PDU.
 655          */
 656
 657         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 658                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 659                 prs_mem_free(&outgoing_pdu);
 660                 return False;
 661         }
 662
 663         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 664                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 665                 prs_mem_free(&outgoing_pdu);
 666                 return False;
 667         }
 668
 669         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 670                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 671                 prs_mem_free(&outgoing_pdu);
 672                 return False;
 673         }
 674
 675         p->out_data.data_sent_length = 0;
 676         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 677         p->out_data.current_pdu_sent = 0;
 678
 679         prs_mem_free(&outgoing_pdu);
 680         return True;
 681 }
 682
 683 /*******************************************************************
 684  Ensure a bind request has the correct abstract & transfer interface.
 685  Used to reject unknown binds from Win2k.
 686 *******************************************************************/
 687
 688 BOOL check_bind_req(char* pipe_name, RPC_IFACE* abstract,
 689                                         RPC_IFACE* transfer)
 690 {
 691         extern struct pipe_id_info pipe_names[];
 692         int i=0;
 693         fstring pname;
 694         fstrcpy(pname,"\\PIPE\\");
 695         fstrcat(pname,pipe_name);
 696
 697         for(i=0;pipe_names[i].client_pipe; i++) {
 698                 if(strequal(pipe_names[i].client_pipe, pname))
 699                         break;
 700         }
 701
 702         if(pipe_names[i].client_pipe == NULL)
 703                 return False;
 704
 705         /* check the abstract interface */
 706         if((abstract->version != pipe_names[i].abstr_syntax.version) ||
 707                 (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid,
 708                         sizeof(RPC_UUID)) != 0))
 709                 return False;
 710
 711         /* check the transfer interface */
 712         if((transfer->version != pipe_names[i].trans_syntax.version) ||
 713                 (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid,
 714                         sizeof(RPC_UUID)) != 0))
 715                 return False;
 716
 717         return True;
 718 }
 719
 720 /*******************************************************************
 721  Respond to a pipe bind request.
 722 *******************************************************************/
 723
 724 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
 725 {
 726         RPC_HDR_BA hdr_ba;
 727         RPC_HDR_RB hdr_rb;
 728         RPC_HDR_AUTH auth_info;
 729         uint16 assoc_gid;
 730         fstring ack_pipe_name;
 731         prs_struct out_hdr_ba;
 732         prs_struct out_auth;
 733         prs_struct outgoing_rpc;
 734         int i = 0;
 735         int auth_len = 0;
 736         enum RPC_PKT_TYPE reply_pkt_type;
 737
 738         p->ntlmssp_auth_requested = False;
 739
 740         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
 741
 742         /*
 743          * Try and find the correct pipe name to ensure
 744          * that this is a pipe name we support.
 745          */
 746
 747         for (i = 0; api_fd_commands[i].pipe_clnt_name; i++) {
 748                 if (strequal(api_fd_commands[i].pipe_clnt_name, p->name) &&
 749                     api_fd_commands[i].fn != NULL) {
 750                         DEBUG(3,("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 751                                    api_fd_commands[i].pipe_clnt_name,
 752                                    api_fd_commands[i].pipe_srv_name));
 753                         fstrcpy(p->pipe_srv_name, api_fd_commands[i].pipe_srv_name);
 754                         break;
 755                 }
 756         }
 757
 758         if (api_fd_commands[i].fn == NULL) {
 759                 DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 760                         p->name ));
 761                 if(!setup_bind_nak(p))
 762                         return False;
 763                 return True;
 764         }
 765
 766         /* decode the bind request */
 767         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
 768                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
 769                 return False;
 770         }
 771
 772         /*
 773          * Check if this is an authenticated request.
 774          */
 775
 776         if (p->hdr.auth_len != 0) {
 777                 RPC_AUTH_VERIFIER auth_verifier;
 778                 RPC_AUTH_NTLMSSP_NEG ntlmssp_neg;
 779
 780                 /*
 781                  * Decode the authentication verifier.
 782                  */
 783
 784                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 785                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 786                         return False;
 787                 }
 788
 789                 /*
 790                  * We only support NTLMSSP_AUTH_TYPE requests.
 791                  */
 792
 793                 if(auth_info.auth_type != NTLMSSP_AUTH_TYPE) {
 794                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n",
 795                                 auth_info.auth_type ));
 796                         return False;
 797                 }
 798
 799                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 800                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 801                         return False;
 802                 }
 803
 804                 if(!strequal(auth_verifier.signature, "NTLMSSP")) {
 805                         DEBUG(0,("api_pipe_bind_req: auth_verifier.signature != NTLMSSP\n"));
 806                         return False;
 807                 }
 808
 809                 if(auth_verifier.msg_type != NTLMSSP_NEGOTIATE) {
 810                         DEBUG(0,("api_pipe_bind_req: auth_verifier.msg_type (%d) != NTLMSSP_NEGOTIATE\n",
 811                                 auth_verifier.msg_type));
 812                         return False;
 813                 }
 814
 815                 if(!smb_io_rpc_auth_ntlmssp_neg("", &ntlmssp_neg, rpc_in_p, 0)) {
 816                         DEBUG(0,("api_pipe_bind_req: Failed to unmarshall RPC_AUTH_NTLMSSP_NEG.\n"));
 817                         return False;
 818                 }
 819
 820                 p->ntlmssp_chal_flags = SMBD_NTLMSSP_NEG_FLAGS;
 821                 p->ntlmssp_auth_requested = True;
 822         }
 823
 824         switch(p->hdr.pkt_type) {
 825                 case RPC_BIND:
 826                         /* name has to be \PIPE\xxxxx */
 827                         fstrcpy(ack_pipe_name, "\\PIPE\\");
 828                         fstrcat(ack_pipe_name, p->pipe_srv_name);
 829                         reply_pkt_type = RPC_BINDACK;
 830                         break;
 831                 case RPC_ALTCONT:
 832                         /* secondary address CAN be NULL
 833                          * as the specs say it's ignored.
 834                          * It MUST NULL to have the spoolss working.
 835                          */
 836                         fstrcpy(ack_pipe_name,"");
 837                         reply_pkt_type = RPC_ALTCONTRESP;
 838                         break;
 839                 default:
 840                         return False;
 841         }
 842
 843         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 844
 845         /*
 846          * Marshall directly into the outgoing PDU space. We
 847          * must do this as we need to set to the bind response
 848          * header and are never sending more than one PDU here.
 849          */
 850
 851         prs_init( &outgoing_rpc, 0, 4, p->mem_ctx, MARSHALL);
 852         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 853
 854         /*
 855          * Setup the memory to marshall the ba header, and the
 856          * auth footers.
 857          */
 858
 859         if(!prs_init(&out_hdr_ba, 1024, 4, p->mem_ctx, MARSHALL)) {
 860                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
 861                 prs_mem_free(&outgoing_rpc);
 862                 return False;
 863         }
 864
 865         if(!prs_init(&out_auth, 1024, 4, p->mem_ctx, MARSHALL)) {
 866                 DEBUG(0,("pi_pipe_bind_req: malloc out_auth failed.\n"));
 867                 prs_mem_free(&outgoing_rpc);
 868                 prs_mem_free(&out_hdr_ba);
 869                 return False;
 870         }
 871
 872         if (p->ntlmssp_auth_requested)
 873                 assoc_gid = 0x7a77;
 874         else
 875                 assoc_gid = hdr_rb.bba.assoc_gid;
 876
 877         /*
 878          * Create the bind response struct.
 879          */
 880
 881         /* If the requested abstract synt uuid doesn't match our client pipe,
 882                 reject the bind_ack & set the transfer interface synt to all 0's,
 883                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 884                 unknown to NT4)
 885                 Needed when adding entries to a DACL from NT5 - SK */
 886
 887         if(check_bind_req(p->name, &hdr_rb.abstract, &hdr_rb.transfer)) {
 888                 init_rpc_hdr_ba(&hdr_ba,
 889                         MAX_PDU_FRAG_LEN,
 890                         MAX_PDU_FRAG_LEN,
 891                         assoc_gid,
 892                         ack_pipe_name,
 893                         0x1, 0x0, 0x0,
 894                         &hdr_rb.transfer);
 895         } else {
 896                 RPC_IFACE null_interface;
 897                 ZERO_STRUCT(null_interface);
 898                 /* Rejection reason: abstract syntax not supported */
 899                 init_rpc_hdr_ba(&hdr_ba, MAX_PDU_FRAG_LEN,
 900                                         MAX_PDU_FRAG_LEN, assoc_gid,
 901                                         ack_pipe_name, 0x1, 0x2, 0x1,
 902                                         &null_interface);
 903         }
 904
 905         /*
 906          * and marshall it.
 907          */
 908
 909         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
 910                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
 911                 goto err_exit;
 912         }
 913
 914         /*
 915          * Now the authentication.
 916          */
 917
 918         if (p->ntlmssp_auth_requested) {
 919                 RPC_AUTH_VERIFIER auth_verifier;
 920                 RPC_AUTH_NTLMSSP_CHAL ntlmssp_chal;
 921
 922                 generate_random_buffer(p->challenge, 8, False);
 923
 924                 /*** Authentication info ***/
 925
 926                 init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, RPC_HDR_AUTH_LEN, 1);
 927                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
 928                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
 929                         goto err_exit;
 930                 }
 931
 932                 /*** NTLMSSP verifier ***/
 933
 934                 init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_CHALLENGE);
 935                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, &out_auth, 0)) {
 936                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
 937                         goto err_exit;
 938                 }
 939
 940                 /* NTLMSSP challenge ***/
 941
 942                 init_rpc_auth_ntlmssp_chal(&ntlmssp_chal, p->ntlmssp_chal_flags, p->challenge);
 943                 if(!smb_io_rpc_auth_ntlmssp_chal("", &ntlmssp_chal, &out_auth, 0)) {
 944                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_NTLMSSP_CHAL failed.\n"));
 945                         goto err_exit;
 946                 }
 947
 948                 /* Auth len in the rpc header doesn't include auth_header. */
 949                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
 950         }
 951
 952         /*
 953          * Create the header, now we know the length.
 954          */
 955
 956         init_rpc_hdr(&p->hdr, reply_pkt_type, RPC_FLG_FIRST | RPC_FLG_LAST,
 957                         p->hdr.call_id,
 958                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
 959                         auth_len);
 960
 961         /*
 962          * Marshall the header into the outgoing PDU.
 963          */
 964
 965         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
 966                 DEBUG(0,("pi_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
 967                 goto err_exit;
 968         }
 969
 970         /*
 971          * Now add the RPC_HDR_BA and any auth needed.
 972          */
 973
 974         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
 975                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
 976                 goto err_exit;
 977         }
 978
 979         if(p->ntlmssp_auth_requested && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
 980                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
 981                 goto err_exit;
 982         }
 983
 984         if(!p->ntlmssp_auth_requested)
 985                 p->pipe_bound = True;
 986
 987         /*
 988          * Setup the lengths for the initial reply.
 989          */
 990
 991         p->out_data.data_sent_length = 0;
 992         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 993         p->out_data.current_pdu_sent = 0;
 994
 995         prs_mem_free(&out_hdr_ba);
 996         prs_mem_free(&out_auth);
 997
 998         return True;
 999
1000   err_exit:
1001
1002         prs_mem_free(&outgoing_rpc);
1003         prs_mem_free(&out_hdr_ba);
1004         prs_mem_free(&out_auth);
1005         return False;
1006 }
1007
1008 /****************************************************************************
1009  Deal with sign & seal processing on an RPC request.
1010 ****************************************************************************/
1011
1012 BOOL api_pipe_auth_process(pipes_struct *p, prs_struct *rpc_in)
1013 {
1014         /*
1015          * We always negotiate the following two bits....
1016          */
1017         BOOL auth_verify = IS_BITS_SET_ALL(p->ntlmssp_chal_flags, NTLMSSP_NEGOTIATE_SIGN);
1018         BOOL auth_seal   = IS_BITS_SET_ALL(p->ntlmssp_chal_flags, NTLMSSP_NEGOTIATE_SEAL);
1019         int data_len;
1020         int auth_len;
1021         uint32 old_offset;
1022         uint32 crc32 = 0;
1023
1024         auth_len = p->hdr.auth_len;
1025
1026         if ((auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) && auth_verify) {
1027                 DEBUG(0,("api_pipe_auth_process: Incorrect auth_len %d.\n", auth_len ));
1028                 return False;
1029         }
1030
1031         /*
1032          * The following is that length of the data we must verify or unseal.
1033          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1034          * preceeding the auth_data.
1035          */
1036
1037         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1038                         (auth_verify ? RPC_HDR_AUTH_LEN : 0) - auth_len;
1039
1040         DEBUG(5,("api_pipe_auth_process: sign: %s seal: %s data %d auth %d\n",
1041                  BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, auth_len));
1042
1043         if (auth_seal) {
1044                 /*
1045                  * The data in rpc_in doesn't contain the RPC_HEADER as this
1046                  * has already been consumed.
1047                  */
1048                 char *data = prs_data_p(rpc_in) + RPC_HDR_REQ_LEN;
1049                 NTLMSSPcalc_p(p, (uchar*)data, data_len);
1050                 crc32 = crc32_calc_buffer(data, data_len);
1051         }
1052
1053         old_offset = prs_offset(rpc_in);
1054
1055         if (auth_seal || auth_verify) {
1056                 RPC_HDR_AUTH auth_info;
1057
1058                 if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1059                         DEBUG(0,("api_pipe_auth_process: cannot move offset to %u.\n",
1060                                 (unsigned int)old_offset + data_len ));
1061                         return False;
1062                 }
1063
1064                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1065                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1066                         return False;
1067                 }
1068         }
1069
1070         if (auth_verify) {
1071                 RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
1072                 char *req_data = prs_data_p(rpc_in) + prs_offset(rpc_in) + 4;
1073
1074                 DEBUG(5,("api_pipe_auth_process: auth %d\n", prs_offset(rpc_in) + 4));
1075
1076                 /*
1077                  * Ensure we have RPC_AUTH_NTLMSSP_CHK_LEN - 4 more bytes in the
1078                  * incoming buffer.
1079                  */
1080                 if(prs_mem_get(rpc_in, RPC_AUTH_NTLMSSP_CHK_LEN - 4) == NULL) {
1081                         DEBUG(0,("api_pipe_auth_process: missing %d bytes in buffer.\n",
1082                                 RPC_AUTH_NTLMSSP_CHK_LEN - 4 ));
1083                         return False;
1084                 }
1085
1086                 NTLMSSPcalc_p(p, (uchar*)req_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
1087                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, rpc_in, 0)) {
1088                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_AUTH_NTLMSSP_CHK.\n"));
1089                         return False;
1090                 }
1091
1092                 if (!rpc_auth_ntlmssp_chk(&ntlmssp_chk, crc32, p->ntlmssp_seq_num)) {
1093                         DEBUG(0,("api_pipe_auth_process: NTLMSSP check failed.\n"));
1094                         return False;
1095                 }
1096         }
1097
1098         /*
1099          * Return the current pointer to the data offset.
1100          */
1101
1102         if(!prs_set_offset(rpc_in, old_offset)) {
1103                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
1104                         (unsigned int)old_offset ));
1105                 return False;
1106         }
1107
1108         return True;
1109 }
1110
1111 /****************************************************************************
1112  Find the correct RPC function to call for this request.
1113  If the pipe is authenticated then become the correct UNIX user
1114  before doing the call.
1115 ****************************************************************************/
1116
1117 BOOL api_pipe_request(pipes_struct *p)
1118 {
1119         int i = 0;
1120         BOOL ret = False;
1121         BOOL changed_user_id = False;
1122
1123         if (p->ntlmssp_auth_validated) {
1124
1125                 if(!become_authenticated_pipe_user(p)) {
1126                         prs_mem_free(&p->out_data.rdata);
1127                         return False;
1128                 }
1129
1130                 changed_user_id = True;
1131         }
1132
1133         for (i = 0; api_fd_commands[i].pipe_clnt_name; i++) {
1134                 if (strequal(api_fd_commands[i].pipe_clnt_name, p->name) &&
1135                     api_fd_commands[i].fn != NULL) {
1136                         DEBUG(3,("Doing \\PIPE\\%s\n", api_fd_commands[i].pipe_clnt_name));
1137                         ret = api_fd_commands[i].fn(p);
1138                 }
1139         }
1140
1141         if(changed_user_id)
1142                 unbecome_authenticated_pipe_user(p);
1143
1144         return ret;
1145 }
1146
1147 /*******************************************************************
1148  Calls the underlying RPC function for a named pipe.
1149  ********************************************************************/
1150
1151 BOOL api_rpcTNP(pipes_struct *p, char *rpc_name,
1152                 struct api_struct *api_rpc_cmds)
1153 {
1154         int fn_num;
1155         fstring name;
1156         uint32 offset1, offset2;
1157
1158         /* interpret the command */
1159         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
1160
1161         slprintf(name, sizeof(name), "in_%s", rpc_name);
1162         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
1163
1164         for (fn_num = 0; api_rpc_cmds[fn_num].name; fn_num++) {
1165                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
1166                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
1167                         break;
1168                 }
1169         }
1170
1171         if (api_rpc_cmds[fn_num].name == NULL) {
1172                 /*
1173                  * For an unknown RPC just return a fault PDU but
1174                  * return True to allow RPC's on the pipe to continue
1175                  * and not put the pipe into fault state. JRA.
1176                  */
1177                 DEBUG(4, ("unknown\n"));
1178                 setup_fault_pdu(p);
1179                 return True;
1180         }
1181
1182         offset1 = prs_offset(&p->out_data.rdata);
1183
1184         /* do the actual command */
1185         if(!api_rpc_cmds[fn_num].fn(p)) {
1186                 DEBUG(0,("api_rpcTNP: %s: failed.\n", rpc_name));
1187                 prs_mem_free(&p->out_data.rdata);
1188                 return False;
1189         }
1190
1191         slprintf(name, sizeof(name), "out_%s", rpc_name);
1192         offset2 = prs_offset(&p->out_data.rdata);
1193         prs_set_offset(&p->out_data.rdata, offset1);
1194         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
1195         prs_set_offset(&p->out_data.rdata, offset2);
1196
1197         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
1198
1199         return True;
1200 }
1201
1202 #undef OLD_NTDOMAIN