source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "../libcli/auth/libcli_auth.h"
  32 #include "../librpc/gen_ndr/ndr_schannel.h"
  33 #include "../libcli/auth/schannel.h"
  34 #include "../libcli/auth/schannel_proto.h"
  35
  36 extern struct current_user current_user;
  37
  38 #undef DBGC_CLASS
  39 #define DBGC_CLASS DBGC_RPC_SRV
  40
  41 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  42 {
  43         AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
  44
  45         if (a) {
  46                 auth_ntlmssp_end(&a);
  47         }
  48         auth->a_u.auth_ntlmssp_state = NULL;
  49 }
  50
  51 static DATA_BLOB generic_session_key(void)
  52 {
  53         return data_blob("SystemLibraryDTC", 16);
  54 }
  55
  56 /*******************************************************************
  57  Generate the next PDU to be returned from the data in p->rdata.
  58  Handle NTLMSSP.
  59  ********************************************************************/
  60
  61 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  62 {
  63         RPC_HDR_RESP hdr_resp;
  64         uint32 ss_padding_len = 0;
  65         uint32 data_space_available;
  66         uint32 data_len_left;
  67         uint32 data_len;
  68         NTSTATUS status;
  69         DATA_BLOB auth_blob;
  70         RPC_HDR_AUTH auth_info;
  71         uint8 auth_type, auth_level;
  72         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
  73
  74         /*
  75          * If we're in the fault state, keep returning fault PDU's until
  76          * the pipe gets closed. JRA.
  77          */
  78
  79         if(p->fault_state) {
  80                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  81                 return True;
  82         }
  83
  84         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  85
  86         /* Change the incoming request header to a response. */
  87         p->hdr.pkt_type = RPC_RESPONSE;
  88
  89         /* Set up rpc header flags. */
  90         if (p->out_data.data_sent_length == 0) {
  91                 p->hdr.flags = RPC_FLG_FIRST;
  92         } else {
  93                 p->hdr.flags = 0;
  94         }
  95
  96         /*
  97          * Work out how much we can fit in a single PDU.
  98          */
  99
 100         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 101
 102         /*
 103          * Ensure there really is data left to send.
 104          */
 105
 106         if(!data_len_left) {
 107                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 108                 return False;
 109         }
 110
 111         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 112                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 113
 114         /*
 115          * The amount we send is the minimum of the available
 116          * space and the amount left to send.
 117          */
 118
 119         data_len = MIN(data_len_left, data_space_available);
 120
 121         /*
 122          * Set up the alloc hint. This should be the data left to
 123          * send.
 124          */
 125
 126         hdr_resp.alloc_hint = data_len_left;
 127
 128         /*
 129          * Work out if this PDU will be the last.
 130          */
 131
 132         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 133                 p->hdr.flags |= RPC_FLG_LAST;
 134                 if (data_len_left % 8) {
 135                         ss_padding_len = 8 - (data_len_left % 8);
 136                         DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 137                                 ss_padding_len ));
 138                 }
 139         }
 140
 141         /*
 142          * Set up the header lengths.
 143          */
 144
 145         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 146                         data_len + ss_padding_len +
 147                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 148         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 149
 150
 151         /*
 152          * Init the parse struct to point at the outgoing
 153          * data.
 154          */
 155
 156         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 157
 158         /* Store the header in the data stream. */
 159         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 160                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 161                 prs_mem_free(&p->out_data.frag);
 162                 return False;
 163         }
 164
 165         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 166                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 167                 prs_mem_free(&p->out_data.frag);
 168                 return False;
 169         }
 170
 171         /* Copy the data into the PDU. */
 172
 173         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 174                                      p->out_data.data_sent_length, data_len)) {
 175                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 176                 prs_mem_free(&p->out_data.frag);
 177                 return False;
 178         }
 179
 180         /* Copy the sign/seal padding data. */
 181         if (ss_padding_len) {
 182                 char pad[8];
 183
 184                 memset(pad, '\0', 8);
 185                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 186                                       ss_padding_len)) {
 187                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 188                                         (unsigned int)ss_padding_len));
 189                         prs_mem_free(&p->out_data.frag);
 190                         return False;
 191                 }
 192         }
 193
 194
 195         /* Now write out the auth header and null blob. */
 196         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 197                 auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 198         } else {
 199                 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 200         }
 201         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 202                 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 203         } else {
 204                 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 205         }
 206
 207         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 208         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &p->out_data.frag,
 209                                 0)) {
 210                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 211                 prs_mem_free(&p->out_data.frag);
 212                 return False;
 213         }
 214
 215         /* Generate the sign blob. */
 216
 217         switch (p->auth.auth_level) {
 218                 case DCERPC_AUTH_LEVEL_PRIVACY:
 219                         /* Data portion is encrypted. */
 220                         status = ntlmssp_seal_packet(
 221                                 a->ntlmssp_state,
 222                                 (uint8_t *)prs_data_p(&p->out_data.frag)
 223                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 224                                 data_len + ss_padding_len,
 225                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 226                                 (size_t)prs_offset(&p->out_data.frag),
 227                                 &auth_blob);
 228                         if (!NT_STATUS_IS_OK(status)) {
 229                                 data_blob_free(&auth_blob);
 230                                 prs_mem_free(&p->out_data.frag);
 231                                 return False;
 232                         }
 233                         break;
 234                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 235                         /* Data is signed. */
 236                         status = ntlmssp_sign_packet(
 237                                 a->ntlmssp_state,
 238                                 (unsigned char *)prs_data_p(&p->out_data.frag)
 239                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 240                                 data_len + ss_padding_len,
 241                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 242                                 (size_t)prs_offset(&p->out_data.frag),
 243                                 &auth_blob);
 244                         if (!NT_STATUS_IS_OK(status)) {
 245                                 data_blob_free(&auth_blob);
 246                                 prs_mem_free(&p->out_data.frag);
 247                                 return False;
 248                         }
 249                         break;
 250                 default:
 251                         prs_mem_free(&p->out_data.frag);
 252                         return False;
 253         }
 254
 255         /* Append the auth blob. */
 256         if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
 257                               NTLMSSP_SIG_SIZE)) {
 258                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 259                                 (unsigned int)NTLMSSP_SIG_SIZE));
 260                 data_blob_free(&auth_blob);
 261                 prs_mem_free(&p->out_data.frag);
 262                 return False;
 263         }
 264
 265         data_blob_free(&auth_blob);
 266
 267         /*
 268          * Setup the counts for this PDU.
 269          */
 270
 271         p->out_data.data_sent_length += data_len;
 272         p->out_data.current_pdu_sent = 0;
 273
 274         return True;
 275 }
 276
 277 /*******************************************************************
 278  Generate the next PDU to be returned from the data in p->rdata.
 279  Return an schannel authenticated fragment.
 280  ********************************************************************/
 281
 282 static bool create_next_pdu_schannel(pipes_struct *p)
 283 {
 284         RPC_HDR_RESP hdr_resp;
 285         uint32 ss_padding_len = 0;
 286         uint32 data_len;
 287         uint32 data_space_available;
 288         uint32 data_len_left;
 289         uint32 data_pos;
 290         NTSTATUS status;
 291
 292         /*
 293          * If we're in the fault state, keep returning fault PDU's until
 294          * the pipe gets closed. JRA.
 295          */
 296
 297         if(p->fault_state) {
 298                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 299                 return True;
 300         }
 301
 302         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 303
 304         /* Change the incoming request header to a response. */
 305         p->hdr.pkt_type = RPC_RESPONSE;
 306
 307         /* Set up rpc header flags. */
 308         if (p->out_data.data_sent_length == 0) {
 309                 p->hdr.flags = RPC_FLG_FIRST;
 310         } else {
 311                 p->hdr.flags = 0;
 312         }
 313
 314         /*
 315          * Work out how much we can fit in a single PDU.
 316          */
 317
 318         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 319
 320         /*
 321          * Ensure there really is data left to send.
 322          */
 323
 324         if(!data_len_left) {
 325                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 326                 return False;
 327         }
 328
 329         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 330                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
 331                 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 332
 333         /*
 334          * The amount we send is the minimum of the available
 335          * space and the amount left to send.
 336          */
 337
 338         data_len = MIN(data_len_left, data_space_available);
 339
 340         /*
 341          * Set up the alloc hint. This should be the data left to
 342          * send.
 343          */
 344
 345         hdr_resp.alloc_hint = data_len_left;
 346
 347         /*
 348          * Work out if this PDU will be the last.
 349          */
 350
 351         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 352                 p->hdr.flags |= RPC_FLG_LAST;
 353                 if (data_len_left % 8) {
 354                         ss_padding_len = 8 - (data_len_left % 8);
 355                         DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 356                                 ss_padding_len ));
 357                 }
 358         }
 359
 360         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 361                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 362         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 363
 364         /*
 365          * Init the parse struct to point at the outgoing
 366          * data.
 367          */
 368
 369         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 370
 371         /* Store the header in the data stream. */
 372         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 373                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 374                 prs_mem_free(&p->out_data.frag);
 375                 return False;
 376         }
 377
 378         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 379                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 380                 prs_mem_free(&p->out_data.frag);
 381                 return False;
 382         }
 383
 384         /* Store the current offset. */
 385         data_pos = prs_offset(&p->out_data.frag);
 386
 387         /* Copy the data into the PDU. */
 388
 389         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 390                                      p->out_data.data_sent_length, data_len)) {
 391                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 392                 prs_mem_free(&p->out_data.frag);
 393                 return False;
 394         }
 395
 396         /* Copy the sign/seal padding data. */
 397         if (ss_padding_len) {
 398                 char pad[8];
 399                 memset(pad, '\0', 8);
 400                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 401                                       ss_padding_len)) {
 402                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 403                         prs_mem_free(&p->out_data.frag);
 404                         return False;
 405                 }
 406         }
 407
 408         {
 409                 /*
 410                  * Schannel processing.
 411                  */
 412                 RPC_HDR_AUTH auth_info;
 413                 struct NL_AUTH_SIGNATURE verf;
 414                 DATA_BLOB blob;
 415                 enum ndr_err_code ndr_err;
 416
 417                 /* Check it's the type of reply we were expecting to decode */
 418
 419                 init_rpc_hdr_auth(&auth_info,
 420                                 DCERPC_AUTH_TYPE_SCHANNEL,
 421                                 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
 422                                         DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
 423                                 ss_padding_len, 1);
 424
 425                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 426                                         &p->out_data.frag, 0)) {
 427                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 428                         prs_mem_free(&p->out_data.frag);
 429                         return False;
 430                 }
 431
 432                 switch (p->auth.auth_level) {
 433                 case DCERPC_AUTH_LEVEL_PRIVACY:
 434                         status = schannel_seal_packet(p->auth.a_u.schannel_auth,
 435                                                       talloc_tos(),
 436                                                       (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos,
 437                                                       data_len + ss_padding_len,
 438                                                       &blob);
 439                         break;
 440                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 441                         status = schannel_sign_packet(p->auth.a_u.schannel_auth,
 442                                                       talloc_tos(),
 443                                                       (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos,
 444                                                       data_len + ss_padding_len,
 445                                                       &blob);
 446                         break;
 447                 default:
 448                         status = NT_STATUS_INTERNAL_ERROR;
 449                         break;
 450                 }
 451
 452                 if (!NT_STATUS_IS_OK(status)) {
 453                         DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
 454                                 nt_errstr(status)));
 455                         prs_mem_free(&p->out_data.frag);
 456                         return false;
 457                 }
 458
 459                 /* Finally marshall the blob. */
 460
 461 #if 0
 462                 ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), NULL, &verf,
 463                                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_SIGNATURE);
 464                 if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
 465                         prs_mem_free(&p->out_data.frag);
 466                         return false;
 467                 }
 468
 469                 if (DEBUGLEVEL >= 10) {
 470                         NDR_PRINT_DEBUG(NL_AUTH_SIGNATURE, &verf);
 471                 }
 472 #endif
 473                 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
 474                         prs_mem_free(&p->out_data.frag);
 475                         return false;
 476                 }
 477         }
 478
 479         /*
 480          * Setup the counts for this PDU.
 481          */
 482
 483         p->out_data.data_sent_length += data_len;
 484         p->out_data.current_pdu_sent = 0;
 485
 486         return True;
 487 }
 488
 489 /*******************************************************************
 490  Generate the next PDU to be returned from the data in p->rdata.
 491  No authentication done.
 492 ********************************************************************/
 493
 494 static bool create_next_pdu_noauth(pipes_struct *p)
 495 {
 496         RPC_HDR_RESP hdr_resp;
 497         uint32 data_len;
 498         uint32 data_space_available;
 499         uint32 data_len_left;
 500
 501         /*
 502          * If we're in the fault state, keep returning fault PDU's until
 503          * the pipe gets closed. JRA.
 504          */
 505
 506         if(p->fault_state) {
 507                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 508                 return True;
 509         }
 510
 511         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 512
 513         /* Change the incoming request header to a response. */
 514         p->hdr.pkt_type = RPC_RESPONSE;
 515
 516         /* Set up rpc header flags. */
 517         if (p->out_data.data_sent_length == 0) {
 518                 p->hdr.flags = RPC_FLG_FIRST;
 519         } else {
 520                 p->hdr.flags = 0;
 521         }
 522
 523         /*
 524          * Work out how much we can fit in a single PDU.
 525          */
 526
 527         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 528
 529         /*
 530          * Ensure there really is data left to send.
 531          */
 532
 533         if(!data_len_left) {
 534                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 535                 return False;
 536         }
 537
 538         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 539                 - RPC_HDR_RESP_LEN;
 540
 541         /*
 542          * The amount we send is the minimum of the available
 543          * space and the amount left to send.
 544          */
 545
 546         data_len = MIN(data_len_left, data_space_available);
 547
 548         /*
 549          * Set up the alloc hint. This should be the data left to
 550          * send.
 551          */
 552
 553         hdr_resp.alloc_hint = data_len_left;
 554
 555         /*
 556          * Work out if this PDU will be the last.
 557          */
 558
 559         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 560                 p->hdr.flags |= RPC_FLG_LAST;
 561         }
 562
 563         /*
 564          * Set up the header lengths.
 565          */
 566
 567         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 568         p->hdr.auth_len = 0;
 569
 570         /*
 571          * Init the parse struct to point at the outgoing
 572          * data.
 573          */
 574
 575         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 576
 577         /* Store the header in the data stream. */
 578         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 579                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 580                 prs_mem_free(&p->out_data.frag);
 581                 return False;
 582         }
 583
 584         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 585                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 586                 prs_mem_free(&p->out_data.frag);
 587                 return False;
 588         }
 589
 590         /* Copy the data into the PDU. */
 591
 592         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 593                                      p->out_data.data_sent_length, data_len)) {
 594                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 595                 prs_mem_free(&p->out_data.frag);
 596                 return False;
 597         }
 598
 599         /*
 600          * Setup the counts for this PDU.
 601          */
 602
 603         p->out_data.data_sent_length += data_len;
 604         p->out_data.current_pdu_sent = 0;
 605
 606         return True;
 607 }
 608
 609 /*******************************************************************
 610  Generate the next PDU to be returned from the data in p->rdata.
 611 ********************************************************************/
 612
 613 bool create_next_pdu(pipes_struct *p)
 614 {
 615         switch(p->auth.auth_level) {
 616                 case DCERPC_AUTH_LEVEL_NONE:
 617                 case DCERPC_AUTH_LEVEL_CONNECT:
 618                         /* This is incorrect for auth level connect. Fixme. JRA */
 619                         return create_next_pdu_noauth(p);
 620
 621                 default:
 622                         switch(p->auth.auth_type) {
 623                                 case PIPE_AUTH_TYPE_NTLMSSP:
 624                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 625                                         return create_next_pdu_ntlmssp(p);
 626                                 case PIPE_AUTH_TYPE_SCHANNEL:
 627                                         return create_next_pdu_schannel(p);
 628                                 default:
 629                                         break;
 630                         }
 631         }
 632
 633         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 634                         (unsigned int)p->auth.auth_level,
 635                         (unsigned int)p->auth.auth_type));
 636         return False;
 637 }
 638
 639 /*******************************************************************
 640  Process an NTLMSSP authentication response.
 641  If this function succeeds, the user has been authenticated
 642  and their domain, name and calling workstation stored in
 643  the pipe struct.
 644 *******************************************************************/
 645
 646 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 647 {
 648         DATA_BLOB session_key, reply;
 649         NTSTATUS status;
 650         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
 651         bool ret;
 652
 653         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
 654                  get_pipe_name_from_iface(&p->syntax)));
 655
 656         ZERO_STRUCT(reply);
 657
 658         /* this has to be done as root in order to verify the password */
 659         become_root();
 660         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 661         unbecome_root();
 662
 663         /* Don't generate a reply. */
 664         data_blob_free(&reply);
 665
 666         if (!NT_STATUS_IS_OK(status)) {
 667                 return False;
 668         }
 669
 670         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 671            ensure the underlying NTLMSSP flags are also set. If not we should
 672            refuse the bind. */
 673
 674         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
 675                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 676                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 677                                 "but client declined signing.\n",
 678                                 get_pipe_name_from_iface(&p->syntax)));
 679                         return False;
 680                 }
 681         }
 682         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 683                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
 684                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 685                                 "but client declined sealing.\n",
 686                                 get_pipe_name_from_iface(&p->syntax)));
 687                         return False;
 688                 }
 689         }
 690
 691         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 692                   "workstation: %s\n", a->ntlmssp_state->user,
 693                   a->ntlmssp_state->domain, a->ntlmssp_state->workstation));
 694
 695         if (a->server_info->ptok == NULL) {
 696                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 697                 return False;
 698         }
 699
 700         TALLOC_FREE(p->server_info);
 701
 702         p->server_info = copy_serverinfo(p, a->server_info);
 703         if (p->server_info == NULL) {
 704                 DEBUG(0, ("copy_serverinfo failed\n"));
 705                 return false;
 706         }
 707
 708         /*
 709          * We're an authenticated bind over smb, so the session key needs to
 710          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 711          * does. See the RPC-SAMBA3SESSIONKEY.
 712          */
 713
 714         session_key = generic_session_key();
 715         if (session_key.data == NULL) {
 716                 return False;
 717         }
 718
 719         ret = server_info_set_session_key(p->server_info, session_key);
 720
 721         data_blob_free(&session_key);
 722
 723         return True;
 724 }
 725
 726 /*******************************************************************
 727  The switch table for the pipe names and the functions to handle them.
 728 *******************************************************************/
 729
 730 struct rpc_table {
 731         struct {
 732                 const char *clnt;
 733                 const char *srv;
 734         } pipe;
 735         struct ndr_syntax_id rpc_interface;
 736         const struct api_struct *cmds;
 737         int n_cmds;
 738 };
 739
 740 static struct rpc_table *rpc_lookup;
 741 static int rpc_lookup_size;
 742
 743 /*******************************************************************
 744  This is the "stage3" NTLMSSP response after a bind request and reply.
 745 *******************************************************************/
 746
 747 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 748 {
 749         RPC_HDR_AUTH auth_info;
 750         uint32 pad = 0;
 751         DATA_BLOB blob;
 752
 753         ZERO_STRUCT(blob);
 754
 755         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 756
 757         if (p->hdr.auth_len == 0) {
 758                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 759                 goto err;
 760         }
 761
 762         /* 4 bytes padding. */
 763         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 764                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 765                 goto err;
 766         }
 767
 768         /*
 769          * Decode the authentication verifier response.
 770          */
 771
 772         if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 773                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
 774                 goto err;
 775         }
 776
 777         if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
 778                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 779                         (unsigned int)auth_info.auth_type ));
 780                 return False;
 781         }
 782
 783         blob = data_blob(NULL,p->hdr.auth_len);
 784
 785         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 786                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 787                         (unsigned int)p->hdr.auth_len ));
 788                 goto err;
 789         }
 790
 791         /*
 792          * The following call actually checks the challenge/response data.
 793          * for correctness against the given DOMAIN\user name.
 794          */
 795
 796         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 797                 goto err;
 798         }
 799
 800         data_blob_free(&blob);
 801
 802         p->pipe_bound = True;
 803
 804         return True;
 805
 806  err:
 807
 808         data_blob_free(&blob);
 809         free_pipe_ntlmssp_auth_data(&p->auth);
 810         p->auth.a_u.auth_ntlmssp_state = NULL;
 811
 812         return False;
 813 }
 814
 815 /*******************************************************************
 816  Marshall a bind_nak pdu.
 817 *******************************************************************/
 818
 819 static bool setup_bind_nak(pipes_struct *p)
 820 {
 821         RPC_HDR nak_hdr;
 822         uint16 zero = 0;
 823
 824         /* Free any memory in the current return data buffer. */
 825         prs_mem_free(&p->out_data.rdata);
 826
 827         /*
 828          * Marshall directly into the outgoing PDU space. We
 829          * must do this as we need to set to the bind response
 830          * header and are never sending more than one PDU here.
 831          */
 832
 833         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 834
 835         /*
 836          * Initialize a bind_nak header.
 837          */
 838
 839         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 840                 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 841
 842         /*
 843          * Marshall the header into the outgoing PDU.
 844          */
 845
 846         if(!smb_io_rpc_hdr("", &nak_hdr, &p->out_data.frag, 0)) {
 847                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 848                 prs_mem_free(&p->out_data.frag);
 849                 return False;
 850         }
 851
 852         /*
 853          * Now add the reject reason.
 854          */
 855
 856         if(!prs_uint16("reject code", &p->out_data.frag, 0, &zero)) {
 857                 prs_mem_free(&p->out_data.frag);
 858                 return False;
 859         }
 860
 861         p->out_data.data_sent_length = 0;
 862         p->out_data.current_pdu_sent = 0;
 863
 864         if (p->auth.auth_data_free_func) {
 865                 (*p->auth.auth_data_free_func)(&p->auth);
 866         }
 867         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 868         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 869         p->pipe_bound = False;
 870
 871         return True;
 872 }
 873
 874 /*******************************************************************
 875  Marshall a fault pdu.
 876 *******************************************************************/
 877
 878 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 879 {
 880         RPC_HDR fault_hdr;
 881         RPC_HDR_RESP hdr_resp;
 882         RPC_HDR_FAULT fault_resp;
 883
 884         /* Free any memory in the current return data buffer. */
 885         prs_mem_free(&p->out_data.rdata);
 886
 887         /*
 888          * Marshall directly into the outgoing PDU space. We
 889          * must do this as we need to set to the bind response
 890          * header and are never sending more than one PDU here.
 891          */
 892
 893         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 894
 895         /*
 896          * Initialize a fault header.
 897          */
 898
 899         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 900             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 901
 902         /*
 903          * Initialize the HDR_RESP and FAULT parts of the PDU.
 904          */
 905
 906         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 907
 908         fault_resp.status = status;
 909         fault_resp.reserved = 0;
 910
 911         /*
 912          * Marshall the header into the outgoing PDU.
 913          */
 914
 915         if(!smb_io_rpc_hdr("", &fault_hdr, &p->out_data.frag, 0)) {
 916                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 917                 prs_mem_free(&p->out_data.frag);
 918                 return False;
 919         }
 920
 921         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 922                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 923                 prs_mem_free(&p->out_data.frag);
 924                 return False;
 925         }
 926
 927         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &p->out_data.frag, 0)) {
 928                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 929                 prs_mem_free(&p->out_data.frag);
 930                 return False;
 931         }
 932
 933         p->out_data.data_sent_length = 0;
 934         p->out_data.current_pdu_sent = 0;
 935
 936         return True;
 937 }
 938
 939 #if 0
 940 /*******************************************************************
 941  Marshall a cancel_ack pdu.
 942  We should probably check the auth-verifier here.
 943 *******************************************************************/
 944
 945 bool setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
 946 {
 947         prs_struct outgoing_pdu;
 948         RPC_HDR ack_reply_hdr;
 949
 950         /* Free any memory in the current return data buffer. */
 951         prs_mem_free(&p->out_data.rdata);
 952
 953         /*
 954          * Marshall directly into the outgoing PDU space. We
 955          * must do this as we need to set to the bind response
 956          * header and are never sending more than one PDU here.
 957          */
 958
 959         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 960         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 961
 962         /*
 963          * Initialize a cancel_ack header.
 964          */
 965
 966         init_rpc_hdr(&ack_reply_hdr, RPC_CANCEL_ACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 967                         p->hdr.call_id, RPC_HEADER_LEN, 0);
 968
 969         /*
 970          * Marshall the header into the outgoing PDU.
 971          */
 972
 973         if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
 974                 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
 975                 prs_mem_free(&outgoing_pdu);
 976                 return False;
 977         }
 978
 979         p->out_data.data_sent_length = 0;
 980         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 981         p->out_data.current_pdu_sent = 0;
 982
 983         prs_mem_free(&outgoing_pdu);
 984         return True;
 985 }
 986 #endif
 987
 988 /*******************************************************************
 989  Ensure a bind request has the correct abstract & transfer interface.
 990  Used to reject unknown binds from Win2k.
 991 *******************************************************************/
 992
 993 static bool check_bind_req(struct pipes_struct *p,
 994                            struct ndr_syntax_id* abstract,
 995                            struct ndr_syntax_id* transfer,
 996                            uint32 context_id)
 997 {
 998         int i=0;
 999         struct pipe_rpc_fns *context_fns;
1000
1001         DEBUG(3,("check_bind_req for %s\n",
1002                  get_pipe_name_from_iface(&p->syntax)));
1003
1004         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
1005
1006         for (i=0; i<rpc_lookup_size; i++) {
1007                 DEBUGADD(10, ("checking %s\n", rpc_lookup[i].pipe.clnt));
1008                 if (ndr_syntax_id_equal(
1009                             abstract, &rpc_lookup[i].rpc_interface)
1010                     && ndr_syntax_id_equal(
1011                             transfer, &ndr_transfer_syntax)) {
1012                         break;
1013                 }
1014         }
1015
1016         if (i == rpc_lookup_size) {
1017                 return false;
1018         }
1019
1020         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
1021         if (context_fns == NULL) {
1022                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
1023                 return False;
1024         }
1025
1026         context_fns->cmds = rpc_lookup[i].cmds;
1027         context_fns->n_cmds = rpc_lookup[i].n_cmds;
1028         context_fns->context_id = context_id;
1029
1030         /* add to the list of open contexts */
1031
1032         DLIST_ADD( p->contexts, context_fns );
1033
1034         return True;
1035 }
1036
1037 /*******************************************************************
1038  Register commands to an RPC pipe
1039 *******************************************************************/
1040
1041 NTSTATUS rpc_srv_register(int version, const char *clnt, const char *srv,
1042                           const struct ndr_interface_table *iface,
1043                           const struct api_struct *cmds, int size)
1044 {
1045         struct rpc_table *rpc_entry;
1046
1047         if (!clnt || !srv || !cmds) {
1048                 return NT_STATUS_INVALID_PARAMETER;
1049         }
1050
1051         if (version != SMB_RPC_INTERFACE_VERSION) {
1052                 DEBUG(0,("Can't register rpc commands!\n"
1053                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1054                          ", while this version of samba uses version %d!\n",
1055                          version,SMB_RPC_INTERFACE_VERSION));
1056                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1057         }
1058
1059         /* TODO:
1060          *
1061          * we still need to make sure that don't register the same commands twice!!!
1062          *
1063          * --metze
1064          */
1065
1066         /* We use a temporary variable because this call can fail and
1067            rpc_lookup will still be valid afterwards.  It could then succeed if
1068            called again later */
1069         rpc_lookup_size++;
1070         rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1071         if (NULL == rpc_entry) {
1072                 rpc_lookup_size--;
1073                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1074                 return NT_STATUS_NO_MEMORY;
1075         } else {
1076                 rpc_lookup = rpc_entry;
1077         }
1078
1079         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1080         ZERO_STRUCTP(rpc_entry);
1081         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1082         rpc_entry->pipe.srv = SMB_STRDUP(srv);
1083         rpc_entry->rpc_interface = iface->syntax_id;
1084         rpc_entry->cmds = cmds;
1085         rpc_entry->n_cmds = size;
1086
1087         return NT_STATUS_OK;
1088 }
1089
1090 /**
1091  * Is a named pipe known?
1092  * @param[in] cli_filename      The pipe name requested by the client
1093  * @result                      Do we want to serve this?
1094  */
1095 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1096 {
1097         const char *pipename = cli_filename;
1098         int i;
1099
1100         if (strnequal(pipename, "\\PIPE\\", 6)) {
1101                 pipename += 5;
1102         }
1103
1104         if (*pipename == '\\') {
1105                 pipename += 1;
1106         }
1107
1108         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1109                 DEBUG(10, ("refusing spoolss access\n"));
1110                 return false;
1111         }
1112
1113         for (i=0; i<rpc_lookup_size; i++) {
1114                 if (strequal(pipename, rpc_lookup[i].pipe.clnt)) {
1115                         *syntax = rpc_lookup[i].rpc_interface;
1116                         return true;
1117                 }
1118         }
1119
1120         DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1121         return false;
1122 }
1123
1124 /*******************************************************************
1125  Handle a SPNEGO krb5 bind auth.
1126 *******************************************************************/
1127
1128 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1129                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1130 {
1131         return False;
1132 }
1133
1134 /*******************************************************************
1135  Handle the first part of a SPNEGO bind auth.
1136 *******************************************************************/
1137
1138 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1139                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1140 {
1141         DATA_BLOB blob;
1142         DATA_BLOB secblob;
1143         DATA_BLOB response;
1144         DATA_BLOB chal;
1145         char *OIDs[ASN1_MAX_OIDS];
1146         int i;
1147         NTSTATUS status;
1148         bool got_kerberos_mechanism = false;
1149         AUTH_NTLMSSP_STATE *a = NULL;
1150         RPC_HDR_AUTH auth_info;
1151
1152         ZERO_STRUCT(secblob);
1153         ZERO_STRUCT(chal);
1154         ZERO_STRUCT(response);
1155
1156         /* Grab the SPNEGO blob. */
1157         blob = data_blob(NULL,p->hdr.auth_len);
1158
1159         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1160                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1161                         (unsigned int)p->hdr.auth_len ));
1162                 goto err;
1163         }
1164
1165         if (blob.data[0] != ASN1_APPLICATION(0)) {
1166                 goto err;
1167         }
1168
1169         /* parse out the OIDs and the first sec blob */
1170         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1171                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1172                 goto err;
1173         }
1174
1175         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1176                 got_kerberos_mechanism = true;
1177         }
1178
1179         for (i=0;OIDs[i];i++) {
1180                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1181                 TALLOC_FREE(OIDs[i]);
1182         }
1183         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1184
1185         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1186                 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1187                 data_blob_free(&secblob);
1188                 data_blob_free(&blob);
1189                 return ret;
1190         }
1191
1192         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1193                 /* Free any previous auth type. */
1194                 free_pipe_ntlmssp_auth_data(&p->auth);
1195         }
1196
1197         if (!got_kerberos_mechanism) {
1198                 /* Initialize the NTLM engine. */
1199                 status = auth_ntlmssp_start(&a);
1200                 if (!NT_STATUS_IS_OK(status)) {
1201                         goto err;
1202                 }
1203
1204                 /*
1205                  * Pass the first security blob of data to it.
1206                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1207                  * which means we need another packet to complete the bind.
1208                  */
1209
1210                 status = auth_ntlmssp_update(a, secblob, &chal);
1211
1212                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1213                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1214                         goto err;
1215                 }
1216
1217                 /* Generate the response blob we need for step 2 of the bind. */
1218                 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1219         } else {
1220                 /*
1221                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1222                  * code to process follow-up packets is not complete
1223                  * yet. JRA.
1224                  */
1225                 response = spnego_gen_auth_response(NULL,
1226                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1227                                         OID_NTLMSSP);
1228         }
1229
1230         /* Copy the blob into the pout_auth parse struct */
1231         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1232         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1233                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1234                 goto err;
1235         }
1236
1237         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1238                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1239                 goto err;
1240         }
1241
1242         p->auth.a_u.auth_ntlmssp_state = a;
1243         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1244         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1245
1246         data_blob_free(&blob);
1247         data_blob_free(&secblob);
1248         data_blob_free(&chal);
1249         data_blob_free(&response);
1250
1251         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1252         return True;
1253
1254  err:
1255
1256         data_blob_free(&blob);
1257         data_blob_free(&secblob);
1258         data_blob_free(&chal);
1259         data_blob_free(&response);
1260
1261         p->auth.a_u.auth_ntlmssp_state = NULL;
1262
1263         return False;
1264 }
1265
1266 /*******************************************************************
1267  Handle the second part of a SPNEGO bind auth.
1268 *******************************************************************/
1269
1270 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1271                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1272 {
1273         RPC_HDR_AUTH auth_info;
1274         DATA_BLOB spnego_blob;
1275         DATA_BLOB auth_blob;
1276         DATA_BLOB auth_reply;
1277         DATA_BLOB response;
1278         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1279
1280         ZERO_STRUCT(spnego_blob);
1281         ZERO_STRUCT(auth_blob);
1282         ZERO_STRUCT(auth_reply);
1283         ZERO_STRUCT(response);
1284
1285         /*
1286          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1287          * fail here as 'a' == NULL.
1288          */
1289         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1290                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1291                 goto err;
1292         }
1293
1294         /* Grab the SPNEGO blob. */
1295         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1296
1297         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1298                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1299                         (unsigned int)p->hdr.auth_len ));
1300                 goto err;
1301         }
1302
1303         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1304                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1305                 goto err;
1306         }
1307
1308         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1309                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1310                 goto err;
1311         }
1312
1313         /*
1314          * The following call actually checks the challenge/response data.
1315          * for correctness against the given DOMAIN\user name.
1316          */
1317
1318         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1319                 goto err;
1320         }
1321
1322         data_blob_free(&spnego_blob);
1323         data_blob_free(&auth_blob);
1324
1325         /* Generate the spnego "accept completed" blob - no incoming data. */
1326         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1327
1328         /* Copy the blob into the pout_auth parse struct */
1329         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1330         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1331                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1332                 goto err;
1333         }
1334
1335         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1336                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1337                 goto err;
1338         }
1339
1340         data_blob_free(&auth_reply);
1341         data_blob_free(&response);
1342
1343         p->pipe_bound = True;
1344
1345         return True;
1346
1347  err:
1348
1349         data_blob_free(&spnego_blob);
1350         data_blob_free(&auth_blob);
1351         data_blob_free(&auth_reply);
1352         data_blob_free(&response);
1353
1354         free_pipe_ntlmssp_auth_data(&p->auth);
1355         p->auth.a_u.auth_ntlmssp_state = NULL;
1356
1357         return False;
1358 }
1359
1360 /*******************************************************************
1361  Handle an schannel bind auth.
1362 *******************************************************************/
1363
1364 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1365                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1366 {
1367         RPC_HDR_AUTH auth_info;
1368         struct NL_AUTH_MESSAGE neg;
1369         struct NL_AUTH_MESSAGE reply;
1370         bool ret;
1371         NTSTATUS status;
1372         struct netlogon_creds_CredentialState *creds;
1373         DATA_BLOB session_key;
1374         enum ndr_err_code ndr_err;
1375         DATA_BLOB blob;
1376
1377         blob = data_blob_const(prs_data_p(rpc_in_p) + prs_offset(rpc_in_p),
1378                                prs_data_size(rpc_in_p));
1379
1380         ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), NULL, &neg,
1381                                (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1382         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1383                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1384                 return false;
1385         }
1386
1387         if (DEBUGLEVEL >= 10) {
1388                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1389         }
1390
1391         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1392                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1393                 return false;
1394         }
1395
1396         /*
1397          * The neg.oem_netbios_computer.a key here must match the remote computer name
1398          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1399          * operations that use credentials.
1400          */
1401
1402         become_root();
1403         status = schannel_fetch_session_key(p,
1404                                             neg.oem_netbios_computer.a,
1405                                             &creds);
1406         unbecome_root();
1407
1408         if (!NT_STATUS_IS_OK(status)) {
1409                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1410                 return False;
1411         }
1412
1413         p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1414         if (!p->auth.a_u.schannel_auth) {
1415                 TALLOC_FREE(creds);
1416                 return False;
1417         }
1418
1419         p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1420         p->auth.a_u.schannel_auth->seq_num = 0;
1421         p->auth.a_u.schannel_auth->initiator = false;
1422         p->auth.a_u.schannel_auth->creds = creds;
1423
1424         /*
1425          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1426          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1427          * struct of the person who opened the pipe. I need to test this further. JRA.
1428          *
1429          * VL. As we are mapping this to guest set the generic key
1430          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1431          * W2k3, as it does not allow schannel binds against SAMR and LSA
1432          * anymore.
1433          */
1434
1435         session_key = generic_session_key();
1436         if (session_key.data == NULL) {
1437                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1438                           " key\n"));
1439                 return false;
1440         }
1441
1442         ret = server_info_set_session_key(p->server_info, session_key);
1443
1444         data_blob_free(&session_key);
1445
1446         if (!ret) {
1447                 DEBUG(0, ("server_info_set_session_key failed\n"));
1448                 return false;
1449         }
1450
1451         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SCHANNEL, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1452         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1453                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1454                 return False;
1455         }
1456
1457         /*** SCHANNEL verifier ***/
1458
1459         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
1460         reply.Flags                             = 0;
1461         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
1462                                                       * this has any meaning
1463                                                       * here - gd */
1464
1465         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), NULL, &reply,
1466                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1467         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1468                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1469                 return false;
1470         }
1471
1472         if (DEBUGLEVEL >= 10) {
1473                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1474         }
1475
1476         if (!prs_copy_data_in(pout_auth, (const char *)blob.data, blob.length)) {
1477                 return false;
1478         }
1479
1480         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1481                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1482
1483         /* We're finished with this bind - no more packets. */
1484         p->auth.auth_data_free_func = NULL;
1485         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1486
1487         p->pipe_bound = True;
1488
1489         return True;
1490 }
1491
1492 /*******************************************************************
1493  Handle an NTLMSSP bind auth.
1494 *******************************************************************/
1495
1496 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1497                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1498 {
1499         RPC_HDR_AUTH auth_info;
1500         DATA_BLOB blob;
1501         DATA_BLOB response;
1502         NTSTATUS status;
1503         AUTH_NTLMSSP_STATE *a = NULL;
1504
1505         ZERO_STRUCT(blob);
1506         ZERO_STRUCT(response);
1507
1508         /* Grab the NTLMSSP blob. */
1509         blob = data_blob(NULL,p->hdr.auth_len);
1510
1511         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1512                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1513                         (unsigned int)p->hdr.auth_len ));
1514                 goto err;
1515         }
1516
1517         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1518                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1519                 goto err;
1520         }
1521
1522         /* We have an NTLMSSP blob. */
1523         status = auth_ntlmssp_start(&a);
1524         if (!NT_STATUS_IS_OK(status)) {
1525                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1526                         nt_errstr(status) ));
1527                 goto err;
1528         }
1529
1530         status = auth_ntlmssp_update(a, blob, &response);
1531         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1532                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1533                         nt_errstr(status) ));
1534                 goto err;
1535         }
1536
1537         data_blob_free(&blob);
1538
1539         /* Copy the blob into the pout_auth parse struct */
1540         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_NTLMSSP, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1541         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1542                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1543                 goto err;
1544         }
1545
1546         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1547                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1548                 goto err;
1549         }
1550
1551         p->auth.a_u.auth_ntlmssp_state = a;
1552         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1553         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1554
1555         data_blob_free(&blob);
1556         data_blob_free(&response);
1557
1558         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1559
1560         /* We can't set pipe_bound True yet - we need an RPC_AUTH3 response packet... */
1561         return True;
1562
1563   err:
1564
1565         data_blob_free(&blob);
1566         data_blob_free(&response);
1567
1568         free_pipe_ntlmssp_auth_data(&p->auth);
1569         p->auth.a_u.auth_ntlmssp_state = NULL;
1570         return False;
1571 }
1572
1573 /*******************************************************************
1574  Respond to a pipe bind request.
1575 *******************************************************************/
1576
1577 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1578 {
1579         RPC_HDR_BA hdr_ba;
1580         RPC_HDR_RB hdr_rb;
1581         RPC_HDR_AUTH auth_info;
1582         uint16 assoc_gid;
1583         fstring ack_pipe_name;
1584         prs_struct out_hdr_ba;
1585         prs_struct out_auth;
1586         int i = 0;
1587         int auth_len = 0;
1588         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1589
1590         /* No rebinds on a bound pipe - use alter context. */
1591         if (p->pipe_bound) {
1592                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1593                          "pipe %s.\n", get_pipe_name_from_iface(&p->syntax)));
1594                 return setup_bind_nak(p);
1595         }
1596
1597         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1598
1599         /*
1600          * Marshall directly into the outgoing PDU space. We
1601          * must do this as we need to set to the bind response
1602          * header and are never sending more than one PDU here.
1603          */
1604
1605         /*
1606          * Setup the memory to marshall the ba header, and the
1607          * auth footers.
1608          */
1609
1610         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1611                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1612                 prs_mem_free(&p->out_data.frag);
1613                 return False;
1614         }
1615
1616         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1617                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1618                 prs_mem_free(&p->out_data.frag);
1619                 prs_mem_free(&out_hdr_ba);
1620                 return False;
1621         }
1622
1623         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1624
1625         ZERO_STRUCT(hdr_rb);
1626
1627         /* decode the bind request */
1628
1629         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1630                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB "
1631                          "struct.\n"));
1632                 goto err_exit;
1633         }
1634
1635         if (hdr_rb.num_contexts == 0) {
1636                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1637                 goto err_exit;
1638         }
1639
1640         /*
1641          * Try and find the correct pipe name to ensure
1642          * that this is a pipe name we support.
1643          */
1644
1645         for (i = 0; i < rpc_lookup_size; i++) {
1646                 if (ndr_syntax_id_equal(&rpc_lookup[i].rpc_interface,
1647                                         &hdr_rb.rpc_context[0].abstract)) {
1648                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1649                                 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1650                         break;
1651                 }
1652         }
1653
1654         if (i == rpc_lookup_size) {
1655                 NTSTATUS status;
1656
1657                 status = smb_probe_module(
1658                         "rpc", get_pipe_name_from_iface(
1659                                 &hdr_rb.rpc_context[0].abstract));
1660
1661                 if (NT_STATUS_IS_ERR(status)) {
1662                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1663                                 get_pipe_name_from_iface(&hdr_rb.rpc_context[0].abstract)));
1664                         prs_mem_free(&p->out_data.frag);
1665                         prs_mem_free(&out_hdr_ba);
1666                         prs_mem_free(&out_auth);
1667
1668                         return setup_bind_nak(p);
1669                 }
1670
1671                 for (i = 0; i < rpc_lookup_size; i++) {
1672                        if (strequal(rpc_lookup[i].pipe.clnt,
1673                                     get_pipe_name_from_iface(&p->syntax))) {
1674                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1675                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1676                                break;
1677                        }
1678                 }
1679
1680                 if (i == rpc_lookup_size) {
1681                         DEBUG(0, ("module %s doesn't provide functions for "
1682                                   "pipe %s!\n",
1683                                   get_pipe_name_from_iface(&p->syntax),
1684                                   get_pipe_name_from_iface(&p->syntax)));
1685                         goto err_exit;
1686                 }
1687         }
1688
1689         /* name has to be \PIPE\xxxxx */
1690         fstrcpy(ack_pipe_name, "\\PIPE\\");
1691         fstrcat(ack_pipe_name, rpc_lookup[i].pipe.srv);
1692
1693         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1694
1695         /*
1696          * Check if this is an authenticated bind request.
1697          */
1698
1699         if (p->hdr.auth_len) {
1700                 /*
1701                  * Decode the authentication verifier.
1702                  */
1703
1704                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1705                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1706                         goto err_exit;
1707                 }
1708
1709                 auth_type = auth_info.auth_type;
1710
1711                 /* Work out if we have to sign or seal etc. */
1712                 switch (auth_info.auth_level) {
1713                         case DCERPC_AUTH_LEVEL_INTEGRITY:
1714                                 p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1715                                 break;
1716                         case DCERPC_AUTH_LEVEL_PRIVACY:
1717                                 p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1718                                 break;
1719                         default:
1720                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1721                                         (unsigned int)auth_info.auth_level ));
1722                                 goto err_exit;
1723                 }
1724         } else {
1725                 ZERO_STRUCT(auth_info);
1726         }
1727
1728         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1729
1730         switch(auth_type) {
1731                 case DCERPC_AUTH_TYPE_NTLMSSP:
1732                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1733                                 goto err_exit;
1734                         }
1735                         assoc_gid = 0x7a77;
1736                         break;
1737
1738                 case DCERPC_AUTH_TYPE_SCHANNEL:
1739                         if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1740                                 goto err_exit;
1741                         }
1742                         break;
1743
1744                 case DCERPC_AUTH_TYPE_SPNEGO:
1745                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1746                                 goto err_exit;
1747                         }
1748                         break;
1749
1750                 case DCERPC_AUTH_TYPE_NONE:
1751                         /* Unauthenticated bind request. */
1752                         /* We're finished - no more packets. */
1753                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1754                         /* We must set the pipe auth_level here also. */
1755                         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1756                         p->pipe_bound = True;
1757                         /* The session key was initialized from the SMB
1758                          * session in make_internal_rpc_pipe_p */
1759                         break;
1760
1761                 default:
1762                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1763                         goto err_exit;
1764         }
1765
1766         /*
1767          * Create the bind response struct.
1768          */
1769
1770         /* If the requested abstract synt uuid doesn't match our client pipe,
1771                 reject the bind_ack & set the transfer interface synt to all 0's,
1772                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1773                 unknown to NT4)
1774                 Needed when adding entries to a DACL from NT5 - SK */
1775
1776         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1777                                 hdr_rb.rpc_context[0].context_id )) {
1778                 init_rpc_hdr_ba(&hdr_ba,
1779                         RPC_MAX_PDU_FRAG_LEN,
1780                         RPC_MAX_PDU_FRAG_LEN,
1781                         assoc_gid,
1782                         ack_pipe_name,
1783                         0x1, 0x0, 0x0,
1784                         &hdr_rb.rpc_context[0].transfer[0]);
1785         } else {
1786                 /* Rejection reason: abstract syntax not supported */
1787                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1788                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1789                                         ack_pipe_name, 0x1, 0x2, 0x1,
1790                                         &null_ndr_syntax_id);
1791                 p->pipe_bound = False;
1792         }
1793
1794         /*
1795          * and marshall it.
1796          */
1797
1798         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1799                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1800                 goto err_exit;
1801         }
1802
1803         /*
1804          * Create the header, now we know the length.
1805          */
1806
1807         if (prs_offset(&out_auth)) {
1808                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1809         }
1810
1811         init_rpc_hdr(&p->hdr, RPC_BINDACK, RPC_FLG_FIRST | RPC_FLG_LAST,
1812                         p->hdr.call_id,
1813                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1814                         auth_len);
1815
1816         /*
1817          * Marshall the header into the outgoing PDU.
1818          */
1819
1820         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1821                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1822                 goto err_exit;
1823         }
1824
1825         /*
1826          * Now add the RPC_HDR_BA and any auth needed.
1827          */
1828
1829         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1830                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1831                 goto err_exit;
1832         }
1833
1834         if (auth_len && !prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1835                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1836                 goto err_exit;
1837         }
1838
1839         /*
1840          * Setup the lengths for the initial reply.
1841          */
1842
1843         p->out_data.data_sent_length = 0;
1844         p->out_data.current_pdu_sent = 0;
1845
1846         prs_mem_free(&out_hdr_ba);
1847         prs_mem_free(&out_auth);
1848
1849         return True;
1850
1851   err_exit:
1852
1853         prs_mem_free(&p->out_data.frag);
1854         prs_mem_free(&out_hdr_ba);
1855         prs_mem_free(&out_auth);
1856         return setup_bind_nak(p);
1857 }
1858
1859 /****************************************************************************
1860  Deal with an alter context call. Can be third part of 3 leg auth request for
1861  SPNEGO calls.
1862 ****************************************************************************/
1863
1864 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1865 {
1866         RPC_HDR_BA hdr_ba;
1867         RPC_HDR_RB hdr_rb;
1868         RPC_HDR_AUTH auth_info;
1869         uint16 assoc_gid;
1870         fstring ack_pipe_name;
1871         prs_struct out_hdr_ba;
1872         prs_struct out_auth;
1873         int auth_len = 0;
1874
1875         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1876
1877         /*
1878          * Marshall directly into the outgoing PDU space. We
1879          * must do this as we need to set to the bind response
1880          * header and are never sending more than one PDU here.
1881          */
1882
1883         /*
1884          * Setup the memory to marshall the ba header, and the
1885          * auth footers.
1886          */
1887
1888         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1889                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1890                 prs_mem_free(&p->out_data.frag);
1891                 return False;
1892         }
1893
1894         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1895                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1896                 prs_mem_free(&p->out_data.frag);
1897                 prs_mem_free(&out_hdr_ba);
1898                 return False;
1899         }
1900
1901         ZERO_STRUCT(hdr_rb);
1902
1903         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1904
1905         /* decode the alter context request */
1906         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1907                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1908                 goto err_exit;
1909         }
1910
1911         /* secondary address CAN be NULL
1912          * as the specs say it's ignored.
1913          * It MUST be NULL to have the spoolss working.
1914          */
1915         fstrcpy(ack_pipe_name,"");
1916
1917         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1918
1919         /*
1920          * Check if this is an authenticated alter context request.
1921          */
1922
1923         if (p->hdr.auth_len != 0) {
1924                 /*
1925                  * Decode the authentication verifier.
1926                  */
1927
1928                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1929                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1930                         goto err_exit;
1931                 }
1932
1933                 /*
1934                  * Currently only the SPNEGO auth type uses the alter ctx
1935                  * response in place of the NTLMSSP auth3 type.
1936                  */
1937
1938                 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
1939                         /* We can only finish if the pipe is unbound. */
1940                         if (!p->pipe_bound) {
1941                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1942                                         goto err_exit;
1943                                 }
1944                         } else {
1945                                 goto err_exit;
1946                         }
1947                 }
1948         } else {
1949                 ZERO_STRUCT(auth_info);
1950         }
1951
1952         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1953
1954         /*
1955          * Create the bind response struct.
1956          */
1957
1958         /* If the requested abstract synt uuid doesn't match our client pipe,
1959                 reject the bind_ack & set the transfer interface synt to all 0's,
1960                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1961                 unknown to NT4)
1962                 Needed when adding entries to a DACL from NT5 - SK */
1963
1964         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1965                                 hdr_rb.rpc_context[0].context_id )) {
1966                 init_rpc_hdr_ba(&hdr_ba,
1967                         RPC_MAX_PDU_FRAG_LEN,
1968                         RPC_MAX_PDU_FRAG_LEN,
1969                         assoc_gid,
1970                         ack_pipe_name,
1971                         0x1, 0x0, 0x0,
1972                         &hdr_rb.rpc_context[0].transfer[0]);
1973         } else {
1974                 /* Rejection reason: abstract syntax not supported */
1975                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1976                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1977                                         ack_pipe_name, 0x1, 0x2, 0x1,
1978                                         &null_ndr_syntax_id);
1979                 p->pipe_bound = False;
1980         }
1981
1982         /*
1983          * and marshall it.
1984          */
1985
1986         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1987                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
1988                 goto err_exit;
1989         }
1990
1991         /*
1992          * Create the header, now we know the length.
1993          */
1994
1995         if (prs_offset(&out_auth)) {
1996                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1997         }
1998
1999         init_rpc_hdr(&p->hdr, RPC_ALTCONTRESP, RPC_FLG_FIRST | RPC_FLG_LAST,
2000                         p->hdr.call_id,
2001                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
2002                         auth_len);
2003
2004         /*
2005          * Marshall the header into the outgoing PDU.
2006          */
2007
2008         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
2009                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
2010                 goto err_exit;
2011         }
2012
2013         /*
2014          * Now add the RPC_HDR_BA and any auth needed.
2015          */
2016
2017         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
2018                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
2019                 goto err_exit;
2020         }
2021
2022         if (auth_len && !prs_append_prs_data(&p->out_data.frag, &out_auth)) {
2023                 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
2024                 goto err_exit;
2025         }
2026
2027         /*
2028          * Setup the lengths for the initial reply.
2029          */
2030
2031         p->out_data.data_sent_length = 0;
2032         p->out_data.current_pdu_sent = 0;
2033
2034         prs_mem_free(&out_hdr_ba);
2035         prs_mem_free(&out_auth);
2036
2037         return True;
2038
2039   err_exit:
2040
2041         prs_mem_free(&p->out_data.frag);
2042         prs_mem_free(&out_hdr_ba);
2043         prs_mem_free(&out_auth);
2044         return setup_bind_nak(p);
2045 }
2046
2047 /****************************************************************************
2048  Deal with NTLMSSP sign & seal processing on an RPC request.
2049 ****************************************************************************/
2050
2051 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
2052                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
2053 {
2054         RPC_HDR_AUTH auth_info;
2055         uint32 auth_len = p->hdr.auth_len;
2056         uint32 save_offset = prs_offset(rpc_in);
2057         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
2058         unsigned char *data = NULL;
2059         size_t data_len;
2060         unsigned char *full_packet_data = NULL;
2061         size_t full_packet_data_len;
2062         DATA_BLOB auth_blob;
2063
2064         *pstatus = NT_STATUS_OK;
2065
2066         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_NONE || p->auth.auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
2067                 return True;
2068         }
2069
2070         if (!a) {
2071                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2072                 return False;
2073         }
2074
2075         /* Ensure there's enough data for an authenticated request. */
2076         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
2077                         (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
2078                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2079                         (unsigned int)auth_len ));
2080                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2081                 return False;
2082         }
2083
2084         /*
2085          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2086          * after the RPC header.
2087          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2088          * functions as NTLMv2 checks the rpc headers also.
2089          */
2090
2091         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2092         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2093
2094         full_packet_data = p->in_data.current_in_pdu;
2095         full_packet_data_len = p->hdr.frag_len - auth_len;
2096
2097         /* Pull the auth header and the following data into a blob. */
2098         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2099                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
2100                         (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
2101                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2102                 return False;
2103         }
2104
2105         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2106                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
2107                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2108                 return False;
2109         }
2110
2111         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2112         auth_blob.length = auth_len;
2113
2114         switch (p->auth.auth_level) {
2115                 case DCERPC_AUTH_LEVEL_PRIVACY:
2116                         /* Data is encrypted. */
2117                         *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
2118                                                         data, data_len,
2119                                                         full_packet_data,
2120                                                         full_packet_data_len,
2121                                                         &auth_blob);
2122                         if (!NT_STATUS_IS_OK(*pstatus)) {
2123                                 return False;
2124                         }
2125                         break;
2126                 case DCERPC_AUTH_LEVEL_INTEGRITY:
2127                         /* Data is signed. */
2128                         *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
2129                                                         data, data_len,
2130                                                         full_packet_data,
2131                                                         full_packet_data_len,
2132                                                         &auth_blob);
2133                         if (!NT_STATUS_IS_OK(*pstatus)) {
2134                                 return False;
2135                         }
2136                         break;
2137                 default:
2138                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2139                         return False;
2140         }
2141
2142         /*
2143          * Return the current pointer to the data offset.
2144          */
2145
2146         if(!prs_set_offset(rpc_in, save_offset)) {
2147                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2148                         (unsigned int)save_offset ));
2149                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2150                 return False;
2151         }
2152
2153         /*
2154          * Remember the padding length. We must remove it from the real data
2155          * stream once the sign/seal is done.
2156          */
2157
2158         *p_ss_padding_len = auth_info.auth_pad_len;
2159
2160         return True;
2161 }
2162
2163 /****************************************************************************
2164  Deal with schannel processing on an RPC request.
2165 ****************************************************************************/
2166
2167 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2168 {
2169         uint32 data_len;
2170         uint32 auth_len;
2171         uint32 save_offset = prs_offset(rpc_in);
2172         RPC_HDR_AUTH auth_info;
2173         struct NL_AUTH_SIGNATURE schannel_chk;
2174         enum ndr_err_code ndr_err;
2175         DATA_BLOB blob;
2176         NTSTATUS status;
2177
2178         auth_len = p->hdr.auth_len;
2179
2180         if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN ||
2181                         auth_len > RPC_HEADER_LEN +
2182                                         RPC_HDR_REQ_LEN +
2183                                         RPC_HDR_AUTH_LEN +
2184                                         auth_len) {
2185                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2186                 return False;
2187         }
2188
2189         /*
2190          * The following is that length of the data we must verify or unseal.
2191          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2192          * preceeding the auth_data.
2193          */
2194
2195         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2196                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2197                         (unsigned int)p->hdr.frag_len,
2198                         (unsigned int)auth_len ));
2199                 return False;
2200         }
2201
2202         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2203                 RPC_HDR_AUTH_LEN - auth_len;
2204
2205         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2206
2207         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2208                 DEBUG(0,("cannot move offset to %u.\n",
2209                          (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2210                 return False;
2211         }
2212
2213         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2214                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2215                 return False;
2216         }
2217
2218         if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
2219                 DEBUG(0,("Invalid auth info %d on schannel\n",
2220                          auth_info.auth_type));
2221                 return False;
2222         }
2223
2224         blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), auth_len);
2225
2226         ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), NULL, &schannel_chk,
2227                                (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_SIGNATURE);
2228         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
2229                 DEBUG(0,("failed to pull NL_AUTH_SIGNATURE\n"));
2230                 dump_data(2, blob.data, blob.length);
2231                 return false;
2232         }
2233
2234         if (DEBUGLEVEL >= 10) {
2235                 NDR_PRINT_DEBUG(NL_AUTH_SIGNATURE, &schannel_chk);
2236         }
2237
2238         switch (auth_info.auth_level) {
2239         case DCERPC_AUTH_LEVEL_PRIVACY:
2240                 status = schannel_unseal_packet(p->auth.a_u.schannel_auth,
2241                                                 talloc_tos(),
2242                                                 (uint8_t *)prs_data_p(rpc_in)+RPC_HDR_REQ_LEN,
2243                                                 data_len,
2244                                                 &blob);
2245                 break;
2246         case DCERPC_AUTH_LEVEL_INTEGRITY:
2247                 status = schannel_check_packet(p->auth.a_u.schannel_auth,
2248                                                talloc_tos(),
2249                                                (uint8_t *)prs_data_p(rpc_in)+RPC_HDR_REQ_LEN,
2250                                                data_len,
2251                                                &blob);
2252                 break;
2253         default:
2254                 status = NT_STATUS_INTERNAL_ERROR;
2255                 break;
2256         }
2257
2258         if (!NT_STATUS_IS_OK(status)) {
2259                 DEBUG(0,("failed to unseal packet: %s\n", nt_errstr(status)));
2260                 return false;
2261         }
2262
2263         /*
2264          * Return the current pointer to the data offset.
2265          */
2266
2267         if(!prs_set_offset(rpc_in, save_offset)) {
2268                 DEBUG(0,("failed to set offset back to %u\n",
2269                          (unsigned int)save_offset ));
2270                 return False;
2271         }
2272
2273         /*
2274          * Remember the padding length. We must remove it from the real data
2275          * stream once the sign/seal is done.
2276          */
2277
2278         *p_ss_padding_len = auth_info.auth_pad_len;
2279
2280         return True;
2281 }
2282
2283 /****************************************************************************
2284  Find the set of RPC functions associated with this context_id
2285 ****************************************************************************/
2286
2287 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2288 {
2289         PIPE_RPC_FNS *fns = NULL;
2290
2291         if ( !list ) {
2292                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2293                 return NULL;
2294         }
2295
2296         for (fns=list; fns; fns=fns->next ) {
2297                 if ( fns->context_id == context_id )
2298                         return fns;
2299         }
2300         return NULL;
2301 }
2302
2303 /****************************************************************************
2304  Memory cleanup.
2305 ****************************************************************************/
2306
2307 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2308 {
2309         PIPE_RPC_FNS *tmp = list;
2310         PIPE_RPC_FNS *tmp2;
2311
2312         while (tmp) {
2313                 tmp2 = tmp->next;
2314                 SAFE_FREE(tmp);
2315                 tmp = tmp2;
2316         }
2317
2318         return;
2319 }
2320
2321 static bool api_rpcTNP(pipes_struct *p,
2322                        const struct api_struct *api_rpc_cmds, int n_cmds);
2323
2324 /****************************************************************************
2325  Find the correct RPC function to call for this request.
2326  If the pipe is authenticated then become the correct UNIX user
2327  before doing the call.
2328 ****************************************************************************/
2329
2330 bool api_pipe_request(pipes_struct *p)
2331 {
2332         bool ret = False;
2333         bool changed_user = False;
2334         PIPE_RPC_FNS *pipe_fns;
2335
2336         if (p->pipe_bound &&
2337                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2338                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2339                 if(!become_authenticated_pipe_user(p)) {
2340                         prs_mem_free(&p->out_data.rdata);
2341                         return False;
2342                 }
2343                 changed_user = True;
2344         }
2345
2346         DEBUG(5, ("Requested \\PIPE\\%s\n",
2347                   get_pipe_name_from_iface(&p->syntax)));
2348
2349         /* get the set of RPC functions for this context */
2350
2351         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2352
2353         if ( pipe_fns ) {
2354                 TALLOC_CTX *frame = talloc_stackframe();
2355                 ret = api_rpcTNP(p, pipe_fns->cmds, pipe_fns->n_cmds);
2356                 TALLOC_FREE(frame);
2357         }
2358         else {
2359                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2360                         p->hdr_req.context_id,
2361                         get_pipe_name_from_iface(&p->syntax)));
2362         }
2363
2364         if (changed_user) {
2365                 unbecome_authenticated_pipe_user();
2366         }
2367
2368         return ret;
2369 }
2370
2371 /*******************************************************************
2372  Calls the underlying RPC function for a named pipe.
2373  ********************************************************************/
2374
2375 static bool api_rpcTNP(pipes_struct *p,
2376                        const struct api_struct *api_rpc_cmds, int n_cmds)
2377 {
2378         int fn_num;
2379         uint32 offset1, offset2;
2380
2381         /* interpret the command */
2382         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2383                  get_pipe_name_from_iface(&p->syntax), p->hdr_req.opnum));
2384
2385         if (DEBUGLEVEL >= 50) {
2386                 fstring name;
2387                 slprintf(name, sizeof(name)-1, "in_%s",
2388                          get_pipe_name_from_iface(&p->syntax));
2389                 prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2390         }
2391
2392         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2393                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2394                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2395                         break;
2396                 }
2397         }
2398
2399         if (fn_num == n_cmds) {
2400                 /*
2401                  * For an unknown RPC just return a fault PDU but
2402                  * return True to allow RPC's on the pipe to continue
2403                  * and not put the pipe into fault state. JRA.
2404                  */
2405                 DEBUG(4, ("unknown\n"));
2406                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2407                 return True;
2408         }
2409
2410         offset1 = prs_offset(&p->out_data.rdata);
2411
2412         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2413                 fn_num, api_rpc_cmds[fn_num].fn));
2414         /* do the actual command */
2415         if(!api_rpc_cmds[fn_num].fn(p)) {
2416                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2417                          get_pipe_name_from_iface(&p->syntax),
2418                          api_rpc_cmds[fn_num].name));
2419                 prs_mem_free(&p->out_data.rdata);
2420                 return False;
2421         }
2422
2423         if (p->bad_handle_fault_state) {
2424                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2425                 p->bad_handle_fault_state = False;
2426                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2427                 return True;
2428         }
2429
2430         if (p->rng_fault_state) {
2431                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2432                 p->rng_fault_state = False;
2433                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2434                 return True;
2435         }
2436
2437         offset2 = prs_offset(&p->out_data.rdata);
2438         prs_set_offset(&p->out_data.rdata, offset1);
2439         if (DEBUGLEVEL >= 50) {
2440                 fstring name;
2441                 slprintf(name, sizeof(name)-1, "out_%s",
2442                          get_pipe_name_from_iface(&p->syntax));
2443                 prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2444         }
2445         prs_set_offset(&p->out_data.rdata, offset2);
2446
2447         DEBUG(5,("api_rpcTNP: called %s successfully\n",
2448                  get_pipe_name_from_iface(&p->syntax)));
2449
2450         /* Check for buffer underflow in rpc parsing */
2451
2452         if ((DEBUGLEVEL >= 10) &&
2453             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2454                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2455                 char *data = (char *)SMB_MALLOC(data_len);
2456
2457                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2458                 if (data) {
2459                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2460                         SAFE_FREE(data);
2461                 }
2462
2463         }
2464
2465         return True;
2466 }