source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1998
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   6  *  Copyright (C) Paul Ashton                  1997-1998,
   7  *  Copyright (C) Jeremy Allison                    1999,
   8  *  Copyright (C) Anthony Liguori                   2003.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25 /*  this module apparently provides an implementation of DCE/RPC over a
  26  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  27  *  documentation are available (in on-line form) from the X-Open group.
  28  *
  29  *  this module should provide a level of abstraction between SMB
  30  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  31  *  data copies, and network traffic.
  32  *
  33  *  in this version, which takes a "let's learn what's going on and
  34  *  get something running" approach, there is additional network
  35  *  traffic generated, but the code should be easier to understand...
  36  *
  37  *  ... if you read the docs.  or stare at packets for weeks on end.
  38  *
  39  */
  40
  41 #include "includes.h"
  42
  43 #undef DBGC_CLASS
  44 #define DBGC_CLASS DBGC_RPC_SRV
  45
  46 static void NTLMSSPcalc_p( pipes_struct *p, unsigned char *data, int len)
  47 {
  48     unsigned char *hash = p->ntlmssp_hash;
  49     unsigned char index_i = hash[256];
  50     unsigned char index_j = hash[257];
  51     int ind;
  52
  53     for( ind = 0; ind < len; ind++) {
  54         unsigned char tc;
  55         unsigned char t;
  56
  57         index_i++;
  58         index_j += hash[index_i];
  59
  60         tc = hash[index_i];
  61         hash[index_i] = hash[index_j];
  62         hash[index_j] = tc;
  63
  64         t = hash[index_i] + hash[index_j];
  65         data[ind] = data[ind] ^ hash[t];
  66     }
  67
  68     hash[256] = index_i;
  69     hash[257] = index_j;
  70 }
  71
  72 /*******************************************************************
  73  Generate the next PDU to be returned from the data in p->rdata.
  74  We cheat here as this function doesn't handle the special auth
  75  footers of the authenticated bind response reply.
  76  ********************************************************************/
  77
  78 BOOL create_next_pdu(pipes_struct *p)
  79 {
  80         RPC_HDR_RESP hdr_resp;
  81         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
  82         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
  83         uint32 data_len;
  84         uint32 data_space_available;
  85         uint32 data_len_left;
  86         prs_struct outgoing_pdu;
  87         uint32 data_pos;
  88
  89         /*
  90          * If we're in the fault state, keep returning fault PDU's until
  91          * the pipe gets closed. JRA.
  92          */
  93
  94         if(p->fault_state) {
  95                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
  96                 return True;
  97         }
  98
  99         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 100
 101         /* Change the incoming request header to a response. */
 102         p->hdr.pkt_type = RPC_RESPONSE;
 103
 104         /* Set up rpc header flags. */
 105         if (p->out_data.data_sent_length == 0)
 106                 p->hdr.flags = RPC_FLG_FIRST;
 107         else
 108                 p->hdr.flags = 0;
 109
 110         /*
 111          * Work out how much we can fit in a single PDU.
 112          */
 113
 114         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 115         if(p->ntlmssp_auth_validated)
 116                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN);
 117
 118         /*
 119          * The amount we send is the minimum of the available
 120          * space and the amount left to send.
 121          */
 122
 123         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 124
 125         /*
 126          * Ensure there really is data left to send.
 127          */
 128
 129         if(!data_len_left) {
 130                 DEBUG(0,("create_next_pdu: no data left to send !\n"));
 131                 return False;
 132         }
 133
 134         data_len = MIN(data_len_left, data_space_available);
 135
 136         /*
 137          * Set up the alloc hint. This should be the data left to
 138          * send.
 139          */
 140
 141         hdr_resp.alloc_hint = data_len_left;
 142
 143         /*
 144          * Set up the header lengths.
 145          */
 146
 147         if (p->ntlmssp_auth_validated) {
 148                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
 149                                         RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN;
 150                 p->hdr.auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 151         } else {
 152                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 153                 p->hdr.auth_len = 0;
 154         }
 155
 156         /*
 157          * Work out if this PDU will be the last.
 158          */
 159
 160         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata))
 161                 p->hdr.flags |= RPC_FLG_LAST;
 162
 163         /*
 164          * Init the parse struct to point at the outgoing
 165          * data.
 166          */
 167
 168         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 169         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 170
 171         /* Store the header in the data stream. */
 172         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 173                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR.\n"));
 174                 prs_mem_free(&outgoing_pdu);
 175                 return False;
 176         }
 177
 178         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 179                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_RESP.\n"));
 180                 prs_mem_free(&outgoing_pdu);
 181                 return False;
 182         }
 183
 184         /* Store the current offset. */
 185         data_pos = prs_offset(&outgoing_pdu);
 186
 187         /* Copy the data into the PDU. */
 188
 189         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 190                 DEBUG(0,("create_next_pdu: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 191                 prs_mem_free(&outgoing_pdu);
 192                 return False;
 193         }
 194
 195         if (p->hdr.auth_len > 0) {
 196                 uint32 crc32 = 0;
 197                 char *data;
 198
 199                 DEBUG(5,("create_next_pdu: sign: %s seal: %s data %d auth %d\n",
 200                          BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, p->hdr.auth_len));
 201
 202                 /*
 203                  * Set data to point to where we copied the data into.
 204                  */
 205
 206                 data = prs_data_p(&outgoing_pdu) + data_pos;
 207
 208                 if (auth_seal) {
 209                         crc32 = crc32_calc_buffer(data, data_len);
 210                         NTLMSSPcalc_p(p, (uchar*)data, data_len);
 211                 }
 212
 213                 if (auth_seal || auth_verify) {
 214                         RPC_HDR_AUTH auth_info;
 215
 216                         init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL,
 217                                         (auth_verify ? RPC_HDR_AUTH_LEN : 0), (auth_verify ? 1 : 0));
 218                         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 219                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 220                                 prs_mem_free(&outgoing_pdu);
 221                                 return False;
 222                         }
 223                 }
 224
 225                 if (auth_verify) {
 226                         RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
 227                         char *auth_data = prs_data_p(&outgoing_pdu);
 228
 229                         p->ntlmssp_seq_num++;
 230                         init_rpc_auth_ntlmssp_chk(&ntlmssp_chk, NTLMSSP_SIGN_VERSION,
 231                                         crc32, p->ntlmssp_seq_num++);
 232                         auth_data = prs_data_p(&outgoing_pdu) + prs_offset(&outgoing_pdu) + 4;
 233                         if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, &outgoing_pdu, 0)) {
 234                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_AUTH_NTLMSSP_CHK.\n"));
 235                                 prs_mem_free(&outgoing_pdu);
 236                                 return False;
 237                         }
 238                         NTLMSSPcalc_p(p, (uchar*)auth_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 239                 }
 240         }
 241
 242         /*
 243          * Setup the counts for this PDU.
 244          */
 245
 246         p->out_data.data_sent_length += data_len;
 247         p->out_data.current_pdu_len = p->hdr.frag_len;
 248         p->out_data.current_pdu_sent = 0;
 249
 250         prs_mem_free(&outgoing_pdu);
 251         return True;
 252 }
 253
 254 /*******************************************************************
 255  Process an NTLMSSP authentication response.
 256  If this function succeeds, the user has been authenticated
 257  and their domain, name and calling workstation stored in
 258  the pipe struct.
 259  The initial challenge is stored in p->challenge.
 260  *******************************************************************/
 261
 262 static BOOL api_pipe_ntlmssp_verify(pipes_struct *p, RPC_AUTH_NTLMSSP_RESP *ntlmssp_resp)
 263 {
 264         uchar lm_owf[24];
 265         uchar nt_owf[128];
 266         int nt_pw_len;
 267         int lm_pw_len;
 268         fstring user_name;
 269         fstring domain;
 270         fstring wks;
 271
 272         NTSTATUS nt_status;
 273
 274         struct auth_context *auth_context = NULL;
 275         auth_usersupplied_info *user_info = NULL;
 276         auth_serversupplied_info *server_info = NULL;
 277
 278         DEBUG(5,("api_pipe_ntlmssp_verify: checking user details\n"));
 279
 280         memset(p->user_name, '\0', sizeof(p->user_name));
 281         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 282         memset(p->domain, '\0', sizeof(p->domain));
 283         memset(p->wks, '\0', sizeof(p->wks));
 284
 285         /* Set up for non-authenticated user. */
 286         delete_nt_token(&p->pipe_user.nt_user_token);
 287         p->pipe_user.ngroups = 0;
 288         SAFE_FREE( p->pipe_user.groups);
 289
 290         /*
 291          * Setup an empty password for a guest user.
 292          */
 293
 294         /*
 295          * We always negotiate UNICODE.
 296          */
 297
 298         if (p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_UNICODE) {
 299                 rpcstr_pull(user_name, ntlmssp_resp->user, sizeof(fstring), ntlmssp_resp->hdr_usr.str_str_len*2, 0 );
 300                 rpcstr_pull(domain, ntlmssp_resp->domain, sizeof(fstring), ntlmssp_resp->hdr_domain.str_str_len*2, 0);
 301                 rpcstr_pull(wks, ntlmssp_resp->wks, sizeof(fstring), ntlmssp_resp->hdr_wks.str_str_len*2, 0);
 302         } else {
 303                 pull_ascii_fstring(user_name, ntlmssp_resp->user);
 304                 pull_ascii_fstring(domain, ntlmssp_resp->domain);
 305                 pull_ascii_fstring(wks, ntlmssp_resp->wks);
 306         }
 307
 308         DEBUG(5,("user: %s domain: %s wks: %s\n", user_name, domain, wks));
 309
 310         nt_pw_len = MIN(sizeof(nt_owf), ntlmssp_resp->hdr_nt_resp.str_str_len);
 311         lm_pw_len = MIN(sizeof(lm_owf), ntlmssp_resp->hdr_lm_resp.str_str_len);
 312
 313         memcpy(lm_owf, ntlmssp_resp->lm_resp, sizeof(lm_owf));
 314         memcpy(nt_owf, ntlmssp_resp->nt_resp, nt_pw_len);
 315
 316 #ifdef DEBUG_PASSWORD
 317         DEBUG(100,("lm, nt owfs, chal\n"));
 318         dump_data(100, (char *)lm_owf, sizeof(lm_owf));
 319         dump_data(100, (char *)nt_owf, nt_pw_len);
 320         dump_data(100, (char *)p->challenge, 8);
 321 #endif
 322
 323         /*
 324          * Allow guest access. Patch from Shirish Kalele <kalele@veritas.com>.
 325          */
 326
 327         if (*user_name) {
 328
 329                 /*
 330                  * Do the length checking only if user is not NULL.
 331                  */
 332
 333                 if (ntlmssp_resp->hdr_lm_resp.str_str_len == 0)
 334                         return False;
 335                 if (ntlmssp_resp->hdr_nt_resp.str_str_len == 0)
 336                         return False;
 337                 if (ntlmssp_resp->hdr_usr.str_str_len == 0)
 338                         return False;
 339                 if (ntlmssp_resp->hdr_domain.str_str_len == 0)
 340                         return False;
 341                 if (ntlmssp_resp->hdr_wks.str_str_len == 0)
 342                         return False;
 343
 344         }
 345
 346         make_auth_context_fixed(&auth_context, (uchar*)p->challenge);
 347
 348         if (!make_user_info_netlogon_network(&user_info,
 349                                              user_name, domain, wks,
 350                                              lm_owf, lm_pw_len,
 351                                              nt_owf, nt_pw_len)) {
 352                 DEBUG(0,("make_user_info_netlogon_network failed!  Failing authenticaion.\n"));
 353                 return False;
 354         }
 355
 356         nt_status = auth_context->check_ntlm_password(auth_context, user_info, &server_info);
 357
 358         (auth_context->free)(&auth_context);
 359         free_user_info(&user_info);
 360
 361         p->ntlmssp_auth_validated = NT_STATUS_IS_OK(nt_status);
 362
 363         if (!p->ntlmssp_auth_validated) {
 364                 DEBUG(1,("api_pipe_ntlmssp_verify: User [%s]\\[%s] from machine %s \
 365 failed authentication on named pipe %s.\n", domain, user_name, wks, p->name ));
 366                 free_server_info(&server_info);
 367                 return False;
 368         }
 369
 370         /*
 371          * Set up the sign/seal data.
 372          */
 373
 374         {
 375                 uchar p24[24];
 376                 NTLMSSPOWFencrypt(server_info->first_8_lm_hash, lm_owf, p24);
 377                 {
 378                         unsigned char j = 0;
 379                         int ind;
 380
 381                         unsigned char k2[8];
 382
 383                         memcpy(k2, p24, 5);
 384                         k2[5] = 0xe5;
 385                         k2[6] = 0x38;
 386                         k2[7] = 0xb0;
 387
 388                         for (ind = 0; ind < 256; ind++)
 389                                 p->ntlmssp_hash[ind] = (unsigned char)ind;
 390
 391                         for( ind = 0; ind < 256; ind++) {
 392                                 unsigned char tc;
 393
 394                                 j += (p->ntlmssp_hash[ind] + k2[ind%8]);
 395
 396                                 tc = p->ntlmssp_hash[ind];
 397                                 p->ntlmssp_hash[ind] = p->ntlmssp_hash[j];
 398                                 p->ntlmssp_hash[j] = tc;
 399                         }
 400
 401                         p->ntlmssp_hash[256] = 0;
 402                         p->ntlmssp_hash[257] = 0;
 403                 }
 404 /*              NTLMSSPhash(p->ntlmssp_hash, p24); */
 405                 p->ntlmssp_seq_num = 0;
 406
 407         }
 408
 409         fstrcpy(p->user_name, user_name);
 410         fstrcpy(p->pipe_user_name, pdb_get_username(server_info->sam_account));
 411         fstrcpy(p->domain, domain);
 412         fstrcpy(p->wks, wks);
 413
 414         /*
 415          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 416          */
 417
 418         if (!IS_SAM_UNIX_USER(server_info->sam_account)) {
 419                 DEBUG(0,("Attempted authenticated pipe with invalid user.  No uid/gid in SAM_ACCOUNT\n"));
 420                 free_server_info(&server_info);
 421                 return False;
 422         }
 423
 424         memcpy(p->session_key, server_info->session_key, sizeof(p->session_key));
 425
 426         p->pipe_user.uid = pdb_get_uid(server_info->sam_account);
 427         p->pipe_user.gid = pdb_get_gid(server_info->sam_account);
 428
 429         p->pipe_user.ngroups = server_info->n_groups;
 430         if (p->pipe_user.ngroups) {
 431                 if (!(p->pipe_user.groups = memdup(server_info->groups, sizeof(gid_t) * p->pipe_user.ngroups))) {
 432                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 433                         free_server_info(&server_info);
 434                         return False;
 435                 }
 436         }
 437
 438         if (server_info->ptok)
 439                 p->pipe_user.nt_user_token = dup_nt_token(server_info->ptok);
 440         else {
 441                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 442                 p->pipe_user.nt_user_token = NULL;
 443                 free_server_info(&server_info);
 444                 return False;
 445         }
 446
 447         p->ntlmssp_auth_validated = True;
 448
 449         free_server_info(&server_info);
 450         return True;
 451 }
 452
 453 /*******************************************************************
 454  The switch table for the pipe names and the functions to handle them.
 455  *******************************************************************/
 456
 457 struct rpc_table
 458 {
 459   struct
 460   {
 461     const char *clnt;
 462     const char *srv;
 463   } pipe;
 464   struct api_struct *cmds;
 465   int n_cmds;
 466 };
 467
 468 static struct rpc_table *rpc_lookup;
 469 static int rpc_lookup_size;
 470
 471 /*******************************************************************
 472  This is the client reply to our challenge for an authenticated
 473  bind request. The challenge we sent is in p->challenge.
 474 *******************************************************************/
 475
 476 BOOL api_pipe_bind_auth_resp(pipes_struct *p, prs_struct *rpc_in_p)
 477 {
 478         RPC_HDR_AUTHA autha_info;
 479         RPC_AUTH_VERIFIER auth_verifier;
 480         RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 481
 482         DEBUG(5,("api_pipe_bind_auth_resp: decode request. %d\n", __LINE__));
 483
 484         if (p->hdr.auth_len == 0) {
 485                 DEBUG(0,("api_pipe_bind_auth_resp: No auth field sent !\n"));
 486                 return False;
 487         }
 488
 489         /*
 490          * Decode the authentication verifier response.
 491          */
 492
 493         if(!smb_io_rpc_hdr_autha("", &autha_info, rpc_in_p, 0)) {
 494                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_HDR_AUTHA failed.\n"));
 495                 return False;
 496         }
 497
 498         if (autha_info.auth_type != NTLMSSP_AUTH_TYPE || autha_info.auth_level != NTLMSSP_AUTH_LEVEL) {
 499                 DEBUG(0,("api_pipe_bind_auth_resp: incorrect auth type (%d) or level (%d).\n",
 500                         (int)autha_info.auth_type, (int)autha_info.auth_level ));
 501                 return False;
 502         }
 503
 504         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 505                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_AUTH_VERIFIER failed.\n"));
 506                 return False;
 507         }
 508
 509         /*
 510          * Ensure this is a NTLMSSP_AUTH packet type.
 511          */
 512
 513         if (!rpc_auth_verifier_chk(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH)) {
 514                 DEBUG(0,("api_pipe_bind_auth_resp: rpc_auth_verifier_chk failed.\n"));
 515                 return False;
 516         }
 517
 518         if(!smb_io_rpc_auth_ntlmssp_resp("", &ntlmssp_resp, rpc_in_p, 0)) {
 519                 DEBUG(0,("api_pipe_bind_auth_resp: Failed to unmarshall RPC_AUTH_NTLMSSP_RESP.\n"));
 520                 return False;
 521         }
 522
 523         /*
 524          * The following call actually checks the challenge/response data.
 525          * for correctness against the given DOMAIN\user name.
 526          */
 527
 528         if (!api_pipe_ntlmssp_verify(p, &ntlmssp_resp))
 529                 return False;
 530
 531         p->pipe_bound = True
 532 ;
 533         return True;
 534 }
 535
 536 /*******************************************************************
 537  Marshall a bind_nak pdu.
 538 *******************************************************************/
 539
 540 static BOOL setup_bind_nak(pipes_struct *p)
 541 {
 542         prs_struct outgoing_rpc;
 543         RPC_HDR nak_hdr;
 544         uint16 zero = 0;
 545
 546         /* Free any memory in the current return data buffer. */
 547         prs_mem_free(&p->out_data.rdata);
 548
 549         /*
 550          * Marshall directly into the outgoing PDU space. We
 551          * must do this as we need to set to the bind response
 552          * header and are never sending more than one PDU here.
 553          */
 554
 555         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 556         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 557
 558
 559         /*
 560          * Initialize a bind_nak header.
 561          */
 562
 563         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 564             p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 565
 566         /*
 567          * Marshall the header into the outgoing PDU.
 568          */
 569
 570         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 571                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 572                 prs_mem_free(&outgoing_rpc);
 573                 return False;
 574         }
 575
 576         /*
 577          * Now add the reject reason.
 578          */
 579
 580         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 581                 prs_mem_free(&outgoing_rpc);
 582         return False;
 583         }
 584
 585         p->out_data.data_sent_length = 0;
 586         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 587         p->out_data.current_pdu_sent = 0;
 588
 589         p->pipe_bound = False;
 590
 591         return True;
 592 }
 593
 594 /*******************************************************************
 595  Marshall a fault pdu.
 596 *******************************************************************/
 597
 598 BOOL setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 599 {
 600         prs_struct outgoing_pdu;
 601         RPC_HDR fault_hdr;
 602         RPC_HDR_RESP hdr_resp;
 603         RPC_HDR_FAULT fault_resp;
 604
 605         /* Free any memory in the current return data buffer. */
 606         prs_mem_free(&p->out_data.rdata);
 607
 608         /*
 609          * Marshall directly into the outgoing PDU space. We
 610          * must do this as we need to set to the bind response
 611          * header and are never sending more than one PDU here.
 612          */
 613
 614         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 615         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 616
 617         /*
 618          * Initialize a fault header.
 619          */
 620
 621         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 622             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 623
 624         /*
 625          * Initialize the HDR_RESP and FAULT parts of the PDU.
 626          */
 627
 628         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 629
 630         fault_resp.status = status;
 631         fault_resp.reserved = 0;
 632
 633         /*
 634          * Marshall the header into the outgoing PDU.
 635          */
 636
 637         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 638                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 639                 prs_mem_free(&outgoing_pdu);
 640                 return False;
 641         }
 642
 643         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 644                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 645                 prs_mem_free(&outgoing_pdu);
 646                 return False;
 647         }
 648
 649         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 650                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 651                 prs_mem_free(&outgoing_pdu);
 652                 return False;
 653         }
 654
 655         p->out_data.data_sent_length = 0;
 656         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 657         p->out_data.current_pdu_sent = 0;
 658
 659         prs_mem_free(&outgoing_pdu);
 660         return True;
 661 }
 662
 663 /*******************************************************************
 664  Ensure a bind request has the correct abstract & transfer interface.
 665  Used to reject unknown binds from Win2k.
 666 *******************************************************************/
 667
 668 BOOL check_bind_req(char* pipe_name, RPC_IFACE* abstract,
 669                                         RPC_IFACE* transfer)
 670 {
 671         extern struct pipe_id_info pipe_names[];
 672         int i=0;
 673         fstring pname;
 674         fstrcpy(pname,"\\PIPE\\");
 675         fstrcat(pname,pipe_name);
 676
 677         DEBUG(3,("check_bind_req for %s\n", pname));
 678
 679 #ifndef SUPPORT_NEW_LSARPC_UUID
 680
 681         /* check for the first pipe matching the name */
 682
 683         for ( i=0; pipe_names[i].client_pipe; i++ ) {
 684                 if ( strequal(pipe_names[i].client_pipe, pname) )
 685                         break;
 686         }
 687 #else
 688         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 689
 690         for ( i=0; pipe_names[i].client_pipe; i++ )
 691         {
 692                 if ( strequal(pipe_names[i].client_pipe, pname)
 693                         && (abstract->version == pipe_names[i].abstr_syntax.version)
 694                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(RPC_UUID)) == 0)
 695                         && (transfer->version == pipe_names[i].trans_syntax.version)
 696                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(RPC_UUID)) == 0) )
 697                 {
 698                         break;
 699                 }
 700         }
 701 #endif
 702
 703         if(pipe_names[i].client_pipe == NULL)
 704                 return False;
 705
 706 #ifndef SUPPORT_NEW_LSARPC_UUID
 707         /* check the abstract interface */
 708         if ( (abstract->version != pipe_names[i].abstr_syntax.version)
 709                 || (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(RPC_UUID)) != 0) )
 710         {
 711                 return False;
 712         }
 713
 714         /* check the transfer interface */
 715         if ( (transfer->version != pipe_names[i].trans_syntax.version)
 716                 || (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(RPC_UUID)) != 0) )
 717         {
 718                 return False;
 719         }
 720 #endif
 721         return True;
 722 }
 723
 724 /*******************************************************************
 725  Register commands to an RPC pipe
 726 *******************************************************************/
 727 int rpc_pipe_register_commands(const char *clnt, const char *srv, const struct api_struct *cmds, int size)
 728 {
 729         struct rpc_table *rpc_entry;
 730
 731
 732         /* We use a temporary variable because this call can fail and
 733            rpc_lookup will still be valid afterwards.  It could then succeed if
 734            called again later */
 735         rpc_entry = realloc(rpc_lookup,
 736                             ++rpc_lookup_size*sizeof(struct rpc_table));
 737         if (NULL == rpc_entry) {
 738                 rpc_lookup_size--;
 739                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
 740                 return 0;
 741         } else {
 742                 rpc_lookup = rpc_entry;
 743         }
 744
 745         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
 746         ZERO_STRUCTP(rpc_entry);
 747         rpc_entry->pipe.clnt = strdup(clnt);
 748         rpc_entry->pipe.srv = strdup(srv);
 749         rpc_entry->cmds = realloc(rpc_entry->cmds,
 750                                   (rpc_entry->n_cmds + size) *
 751                                   sizeof(struct api_struct));
 752         memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds,
 753                size * sizeof(struct api_struct));
 754         rpc_entry->n_cmds += size;
 755
 756         return size;
 757 }
 758
 759 /*******************************************************************
 760  Respond to a pipe bind request.
 761 *******************************************************************/
 762
 763 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
 764 {
 765         RPC_HDR_BA hdr_ba;
 766         RPC_HDR_RB hdr_rb;
 767         RPC_HDR_AUTH auth_info;
 768         uint16 assoc_gid;
 769         fstring ack_pipe_name;
 770         prs_struct out_hdr_ba;
 771         prs_struct out_auth;
 772         prs_struct outgoing_rpc;
 773         int i = 0;
 774         int auth_len = 0;
 775         enum RPC_PKT_TYPE reply_pkt_type;
 776
 777         p->ntlmssp_auth_requested = False;
 778
 779         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
 780
 781         /*
 782          * Try and find the correct pipe name to ensure
 783          * that this is a pipe name we support.
 784          */
 785
 786
 787         for (i = 0; i < rpc_lookup_size; i++) {
 788                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
 789                   DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 790                             rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
 791                   fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
 792                   break;
 793                 }
 794         }
 795
 796         if (i == rpc_lookup_size) {
 797                                 if (!smb_probe_module("rpc", p->name)) {
 798                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 799                                 p->name ));
 800                        if(!setup_bind_nak(p))
 801                                return False;
 802                        return True;
 803                 }
 804
 805                 for (i = 0; i < rpc_lookup_size; i++) {
 806                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
 807                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 808                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
 809                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
 810                                break;
 811                        }
 812                 }
 813
 814                                 if (i == rpc_lookup_size) {
 815                                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
 816                                         return False;
 817                                 }
 818         }
 819
 820         /* decode the bind request */
 821         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
 822                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
 823                 return False;
 824         }
 825
 826         /*
 827          * Check if this is an authenticated request.
 828          */
 829
 830         if (p->hdr.auth_len != 0) {
 831                 RPC_AUTH_VERIFIER auth_verifier;
 832                 RPC_AUTH_NTLMSSP_NEG ntlmssp_neg;
 833
 834                 /*
 835                  * Decode the authentication verifier.
 836                  */
 837
 838                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 839                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 840                         return False;
 841                 }
 842
 843                 /*
 844                  * We only support NTLMSSP_AUTH_TYPE requests.
 845                  */
 846
 847                 if(auth_info.auth_type != NTLMSSP_AUTH_TYPE) {
 848                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n",
 849                                 auth_info.auth_type ));
 850                         return False;
 851                 }
 852
 853                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 854                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 855                         return False;
 856                 }
 857
 858                 if(!strequal(auth_verifier.signature, "NTLMSSP")) {
 859                         DEBUG(0,("api_pipe_bind_req: auth_verifier.signature != NTLMSSP\n"));
 860                         return False;
 861                 }
 862
 863                 if(auth_verifier.msg_type != NTLMSSP_NEGOTIATE) {
 864                         DEBUG(0,("api_pipe_bind_req: auth_verifier.msg_type (%d) != NTLMSSP_NEGOTIATE\n",
 865                                 auth_verifier.msg_type));
 866                         return False;
 867                 }
 868
 869                 if(!smb_io_rpc_auth_ntlmssp_neg("", &ntlmssp_neg, rpc_in_p, 0)) {
 870                         DEBUG(0,("api_pipe_bind_req: Failed to unmarshall RPC_AUTH_NTLMSSP_NEG.\n"));
 871                         return False;
 872                 }
 873
 874                 p->ntlmssp_chal_flags = SMBD_NTLMSSP_NEG_FLAGS;
 875                 p->ntlmssp_auth_requested = True;
 876         }
 877
 878         switch(p->hdr.pkt_type) {
 879                 case RPC_BIND:
 880                         /* name has to be \PIPE\xxxxx */
 881                         fstrcpy(ack_pipe_name, "\\PIPE\\");
 882                         fstrcat(ack_pipe_name, p->pipe_srv_name);
 883                         reply_pkt_type = RPC_BINDACK;
 884                         break;
 885                 case RPC_ALTCONT:
 886                         /* secondary address CAN be NULL
 887                          * as the specs say it's ignored.
 888                          * It MUST NULL to have the spoolss working.
 889                          */
 890                         fstrcpy(ack_pipe_name,"");
 891                         reply_pkt_type = RPC_ALTCONTRESP;
 892                         break;
 893                 default:
 894                         return False;
 895         }
 896
 897         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 898
 899         /*
 900          * Marshall directly into the outgoing PDU space. We
 901          * must do this as we need to set to the bind response
 902          * header and are never sending more than one PDU here.
 903          */
 904
 905         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 906         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 907
 908         /*
 909          * Setup the memory to marshall the ba header, and the
 910          * auth footers.
 911          */
 912
 913         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
 914                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
 915                 prs_mem_free(&outgoing_rpc);
 916                 return False;
 917         }
 918
 919         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
 920                 DEBUG(0,("pi_pipe_bind_req: malloc out_auth failed.\n"));
 921                 prs_mem_free(&outgoing_rpc);
 922                 prs_mem_free(&out_hdr_ba);
 923                 return False;
 924         }
 925
 926         if (p->ntlmssp_auth_requested)
 927                 assoc_gid = 0x7a77;
 928         else
 929                 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
 930
 931         /*
 932          * Create the bind response struct.
 933          */
 934
 935         /* If the requested abstract synt uuid doesn't match our client pipe,
 936                 reject the bind_ack & set the transfer interface synt to all 0's,
 937                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 938                 unknown to NT4)
 939                 Needed when adding entries to a DACL from NT5 - SK */
 940
 941         if(check_bind_req(p->name, &hdr_rb.abstract, &hdr_rb.transfer)) {
 942                 init_rpc_hdr_ba(&hdr_ba,
 943                         MAX_PDU_FRAG_LEN,
 944                         MAX_PDU_FRAG_LEN,
 945                         assoc_gid,
 946                         ack_pipe_name,
 947                         0x1, 0x0, 0x0,
 948                         &hdr_rb.transfer);
 949         } else {
 950                 RPC_IFACE null_interface;
 951                 ZERO_STRUCT(null_interface);
 952                 /* Rejection reason: abstract syntax not supported */
 953                 init_rpc_hdr_ba(&hdr_ba, MAX_PDU_FRAG_LEN,
 954                                         MAX_PDU_FRAG_LEN, assoc_gid,
 955                                         ack_pipe_name, 0x1, 0x2, 0x1,
 956                                         &null_interface);
 957         }
 958
 959         /*
 960          * and marshall it.
 961          */
 962
 963         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
 964                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
 965                 goto err_exit;
 966         }
 967
 968         /*
 969          * Now the authentication.
 970          */
 971
 972         if (p->ntlmssp_auth_requested) {
 973                 RPC_AUTH_VERIFIER auth_verifier;
 974                 RPC_AUTH_NTLMSSP_CHAL ntlmssp_chal;
 975
 976                 generate_random_buffer(p->challenge, 8, False);
 977
 978                 /*** Authentication info ***/
 979
 980                 init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, RPC_HDR_AUTH_LEN, 1);
 981                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
 982                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
 983                         goto err_exit;
 984                 }
 985
 986                 /*** NTLMSSP verifier ***/
 987
 988                 init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_CHALLENGE);
 989                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, &out_auth, 0)) {
 990                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
 991                         goto err_exit;
 992                 }
 993
 994                 /* NTLMSSP challenge ***/
 995
 996                 init_rpc_auth_ntlmssp_chal(&ntlmssp_chal, p->ntlmssp_chal_flags, p->challenge);
 997                 if(!smb_io_rpc_auth_ntlmssp_chal("", &ntlmssp_chal, &out_auth, 0)) {
 998                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_NTLMSSP_CHAL failed.\n"));
 999                         goto err_exit;
1000                 }
1001
1002                 /* Auth len in the rpc header doesn't include auth_header. */
1003                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1004         }
1005
1006         /*
1007          * Create the header, now we know the length.
1008          */
1009
1010         init_rpc_hdr(&p->hdr, reply_pkt_type, RPC_FLG_FIRST | RPC_FLG_LAST,
1011                         p->hdr.call_id,
1012                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1013                         auth_len);
1014
1015         /*
1016          * Marshall the header into the outgoing PDU.
1017          */
1018
1019         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1020                 DEBUG(0,("pi_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1021                 goto err_exit;
1022         }
1023
1024         /*
1025          * Now add the RPC_HDR_BA and any auth needed.
1026          */
1027
1028         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1029                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1030                 goto err_exit;
1031         }
1032
1033         if(p->ntlmssp_auth_requested && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1034                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1035                 goto err_exit;
1036         }
1037
1038         if(!p->ntlmssp_auth_requested)
1039                 p->pipe_bound = True;
1040
1041         /*
1042          * Setup the lengths for the initial reply.
1043          */
1044
1045         p->out_data.data_sent_length = 0;
1046         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1047         p->out_data.current_pdu_sent = 0;
1048
1049         prs_mem_free(&out_hdr_ba);
1050         prs_mem_free(&out_auth);
1051
1052         return True;
1053
1054   err_exit:
1055
1056         prs_mem_free(&outgoing_rpc);
1057         prs_mem_free(&out_hdr_ba);
1058         prs_mem_free(&out_auth);
1059         return False;
1060 }
1061
1062 /****************************************************************************
1063  Deal with sign & seal processing on an RPC request.
1064 ****************************************************************************/
1065
1066 BOOL api_pipe_auth_process(pipes_struct *p, prs_struct *rpc_in)
1067 {
1068         /*
1069          * We always negotiate the following two bits....
1070          */
1071         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
1072         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
1073         int data_len;
1074         int auth_len;
1075         uint32 old_offset;
1076         uint32 crc32 = 0;
1077
1078         auth_len = p->hdr.auth_len;
1079
1080         if ((auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) && auth_verify) {
1081                 DEBUG(0,("api_pipe_auth_process: Incorrect auth_len %d.\n", auth_len ));
1082                 return False;
1083         }
1084
1085         /*
1086          * The following is that length of the data we must verify or unseal.
1087          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1088          * preceeding the auth_data.
1089          */
1090
1091         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1092                         (auth_verify ? RPC_HDR_AUTH_LEN : 0) - auth_len;
1093
1094         DEBUG(5,("api_pipe_auth_process: sign: %s seal: %s data %d auth %d\n",
1095                  BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, auth_len));
1096
1097         if (auth_seal) {
1098                 /*
1099                  * The data in rpc_in doesn't contain the RPC_HEADER as this
1100                  * has already been consumed.
1101                  */
1102                 char *data = prs_data_p(rpc_in) + RPC_HDR_REQ_LEN;
1103                 NTLMSSPcalc_p(p, (uchar*)data, data_len);
1104                 crc32 = crc32_calc_buffer(data, data_len);
1105         }
1106
1107         old_offset = prs_offset(rpc_in);
1108
1109         if (auth_seal || auth_verify) {
1110                 RPC_HDR_AUTH auth_info;
1111
1112                 if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1113                         DEBUG(0,("api_pipe_auth_process: cannot move offset to %u.\n",
1114                                 (unsigned int)old_offset + data_len ));
1115                         return False;
1116                 }
1117
1118                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1119                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1120                         return False;
1121                 }
1122         }
1123
1124         if (auth_verify) {
1125                 RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
1126                 char *req_data = prs_data_p(rpc_in) + prs_offset(rpc_in) + 4;
1127
1128                 DEBUG(5,("api_pipe_auth_process: auth %d\n", prs_offset(rpc_in) + 4));
1129
1130                 /*
1131                  * Ensure we have RPC_AUTH_NTLMSSP_CHK_LEN - 4 more bytes in the
1132                  * incoming buffer.
1133                  */
1134                 if(prs_mem_get(rpc_in, RPC_AUTH_NTLMSSP_CHK_LEN - 4) == NULL) {
1135                         DEBUG(0,("api_pipe_auth_process: missing %d bytes in buffer.\n",
1136                                 RPC_AUTH_NTLMSSP_CHK_LEN - 4 ));
1137                         return False;
1138                 }
1139
1140                 NTLMSSPcalc_p(p, (uchar*)req_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
1141                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, rpc_in, 0)) {
1142                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_AUTH_NTLMSSP_CHK.\n"));
1143                         return False;
1144                 }
1145
1146                 if (!rpc_auth_ntlmssp_chk(&ntlmssp_chk, crc32, p->ntlmssp_seq_num)) {
1147                         DEBUG(0,("api_pipe_auth_process: NTLMSSP check failed.\n"));
1148                         return False;
1149                 }
1150         }
1151
1152         /*
1153          * Return the current pointer to the data offset.
1154          */
1155
1156         if(!prs_set_offset(rpc_in, old_offset)) {
1157                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
1158                         (unsigned int)old_offset ));
1159                 return False;
1160         }
1161
1162         return True;
1163 }
1164
1165 /****************************************************************************
1166  Return a user struct for a pipe user.
1167 ****************************************************************************/
1168
1169 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
1170 {
1171         if (p->ntlmssp_auth_validated) {
1172                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
1173         } else {
1174                 extern struct current_user current_user;
1175                 memcpy(user, &current_user, sizeof(struct current_user));
1176         }
1177
1178         return user;
1179 }
1180
1181 /****************************************************************************
1182  Find the correct RPC function to call for this request.
1183  If the pipe is authenticated then become the correct UNIX user
1184  before doing the call.
1185 ****************************************************************************/
1186
1187 BOOL api_pipe_request(pipes_struct *p)
1188 {
1189         int i = 0;
1190         BOOL ret = False;
1191
1192         if (p->ntlmssp_auth_validated) {
1193
1194                 if(!become_authenticated_pipe_user(p)) {
1195                         prs_mem_free(&p->out_data.rdata);
1196                         return False;
1197                 }
1198         }
1199
1200         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
1201
1202         for (i = 0; i < rpc_lookup_size; i++) {
1203                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1204                         DEBUG(3,("Doing \\PIPE\\%s\n",
1205                                  rpc_lookup[i].pipe.clnt));
1206                         set_current_rpc_talloc(p->mem_ctx);
1207                         ret = api_rpcTNP(p, rpc_lookup[i].pipe.clnt,
1208                                          rpc_lookup[i].cmds,
1209                                          rpc_lookup[i].n_cmds);
1210                         set_current_rpc_talloc(NULL);
1211                         break;
1212                 }
1213         }
1214
1215
1216         if (i == rpc_lookup_size) {
1217                 smb_probe_module("rpc", p->name);
1218
1219                 for (i = 0; i < rpc_lookup_size; i++) {
1220                         if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1221                                 DEBUG(3,("Doing \\PIPE\\%s\n",
1222                                          rpc_lookup[i].pipe.clnt));
1223                                 set_current_rpc_talloc(p->mem_ctx);
1224                                 ret = api_rpcTNP(p, rpc_lookup[i].pipe.clnt,
1225                                                  rpc_lookup[i].cmds,
1226                                                  rpc_lookup[i].n_cmds);
1227                                 set_current_rpc_talloc(NULL);
1228                                 break;
1229                         }
1230                 }
1231         }
1232
1233         if(p->ntlmssp_auth_validated)
1234                 unbecome_authenticated_pipe_user();
1235
1236         return ret;
1237 }
1238
1239 /*******************************************************************
1240  Calls the underlying RPC function for a named pipe.
1241  ********************************************************************/
1242
1243 BOOL api_rpcTNP(pipes_struct *p, const char *rpc_name,
1244                 const struct api_struct *api_rpc_cmds, int n_cmds)
1245 {
1246         int fn_num;
1247         fstring name;
1248         uint32 offset1, offset2;
1249
1250         /* interpret the command */
1251         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
1252
1253         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
1254         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
1255
1256         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1257                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
1258                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
1259                         break;
1260                 }
1261         }
1262
1263         if (fn_num == n_cmds) {
1264                 /*
1265                  * For an unknown RPC just return a fault PDU but
1266                  * return True to allow RPC's on the pipe to continue
1267                  * and not put the pipe into fault state. JRA.
1268                  */
1269                 DEBUG(4, ("unknown\n"));
1270                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
1271                 return True;
1272         }
1273
1274         offset1 = prs_offset(&p->out_data.rdata);
1275
1276         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1277                 fn_num, api_rpc_cmds[fn_num].fn));
1278         /* do the actual command */
1279         if(!api_rpc_cmds[fn_num].fn(p)) {
1280                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
1281                 prs_mem_free(&p->out_data.rdata);
1282                 return False;
1283         }
1284
1285         if (p->bad_handle_fault_state) {
1286                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1287                 p->bad_handle_fault_state = False;
1288                 setup_fault_pdu(p, NT_STATUS(0x1C00001A));
1289                 return True;
1290         }
1291
1292         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
1293         offset2 = prs_offset(&p->out_data.rdata);
1294         prs_set_offset(&p->out_data.rdata, offset1);
1295         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
1296         prs_set_offset(&p->out_data.rdata, offset2);
1297
1298         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
1299
1300         /* Check for buffer underflow in rpc parsing */
1301
1302         if ((DEBUGLEVEL >= 10) &&
1303             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
1304                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
1305                 char *data;
1306
1307                 data = malloc(data_len);
1308
1309                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1310                 if (data) {
1311                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
1312                         SAFE_FREE(data);
1313                 }
1314
1315         }
1316
1317         return True;
1318 }