source/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1998
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   6  *  Copyright (C) Paul Ashton                  1997-1998,
   7  *  Copyright (C) Jeremy Allison                    1999,
   8  *  Copyright (C) Anthony Liguori                   2003.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25 /*  this module apparently provides an implementation of DCE/RPC over a
  26  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  27  *  documentation are available (in on-line form) from the X-Open group.
  28  *
  29  *  this module should provide a level of abstraction between SMB
  30  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  31  *  data copies, and network traffic.
  32  *
  33  *  in this version, which takes a "let's learn what's going on and
  34  *  get something running" approach, there is additional network
  35  *  traffic generated, but the code should be easier to understand...
  36  *
  37  *  ... if you read the docs.  or stare at packets for weeks on end.
  38  *
  39  */
  40
  41 #include "includes.h"
  42
  43 #undef DBGC_CLASS
  44 #define DBGC_CLASS DBGC_RPC_SRV
  45
  46 /*************************************************************
  47  HACK Alert!
  48  We need to transfer the session key from one rpc bind to the
  49  next. This is the way the netlogon schannel works.
  50 **************************************************************/
  51 struct dcinfo last_dcinfo;
  52
  53 static void NTLMSSPcalc_p( pipes_struct *p, unsigned char *data, int len)
  54 {
  55     unsigned char *hash = p->ntlmssp_hash;
  56     unsigned char index_i = hash[256];
  57     unsigned char index_j = hash[257];
  58     int ind;
  59
  60     for( ind = 0; ind < len; ind++) {
  61         unsigned char tc;
  62         unsigned char t;
  63
  64         index_i++;
  65         index_j += hash[index_i];
  66
  67         tc = hash[index_i];
  68         hash[index_i] = hash[index_j];
  69         hash[index_j] = tc;
  70
  71         t = hash[index_i] + hash[index_j];
  72         data[ind] = data[ind] ^ hash[t];
  73     }
  74
  75     hash[256] = index_i;
  76     hash[257] = index_j;
  77 }
  78
  79 /*******************************************************************
  80  Generate the next PDU to be returned from the data in p->rdata.
  81  We cheat here as this function doesn't handle the special auth
  82  footers of the authenticated bind response reply.
  83  ********************************************************************/
  84
  85 BOOL create_next_pdu(pipes_struct *p)
  86 {
  87         RPC_HDR_RESP hdr_resp;
  88         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
  89         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
  90         uint32 data_len;
  91         uint32 data_space_available;
  92         uint32 data_len_left;
  93         prs_struct outgoing_pdu;
  94         uint32 data_pos;
  95
  96         /*
  97          * If we're in the fault state, keep returning fault PDU's until
  98          * the pipe gets closed. JRA.
  99          */
 100
 101         if(p->fault_state) {
 102                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 103                 return True;
 104         }
 105
 106         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 107
 108         /* Change the incoming request header to a response. */
 109         p->hdr.pkt_type = RPC_RESPONSE;
 110
 111         /* Set up rpc header flags. */
 112         if (p->out_data.data_sent_length == 0)
 113                 p->hdr.flags = RPC_FLG_FIRST;
 114         else
 115                 p->hdr.flags = 0;
 116
 117         /*
 118          * Work out how much we can fit in a single PDU.
 119          */
 120
 121         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 122         if(p->ntlmssp_auth_validated)
 123                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN);
 124
 125         if(p->netsec_auth_validated)
 126                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NETSEC_CHK_LEN);
 127
 128         /*
 129          * The amount we send is the minimum of the available
 130          * space and the amount left to send.
 131          */
 132
 133         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 134
 135         /*
 136          * Ensure there really is data left to send.
 137          */
 138
 139         if(!data_len_left) {
 140                 DEBUG(0,("create_next_pdu: no data left to send !\n"));
 141                 return False;
 142         }
 143
 144         data_len = MIN(data_len_left, data_space_available);
 145
 146         /*
 147          * Set up the alloc hint. This should be the data left to
 148          * send.
 149          */
 150
 151         hdr_resp.alloc_hint = data_len_left;
 152
 153         /*
 154          * Set up the header lengths.
 155          */
 156
 157         if (p->ntlmssp_auth_validated) {
 158                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
 159                                         RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN;
 160                 p->hdr.auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 161         } else if (p->netsec_auth_validated) {
 162                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
 163                         RPC_HDR_AUTH_LEN + RPC_AUTH_NETSEC_CHK_LEN;
 164                 p->hdr.auth_len = RPC_AUTH_NETSEC_CHK_LEN;
 165         } else {
 166                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 167                 p->hdr.auth_len = 0;
 168         }
 169
 170         /*
 171          * Work out if this PDU will be the last.
 172          */
 173
 174         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata))
 175                 p->hdr.flags |= RPC_FLG_LAST;
 176
 177         /*
 178          * Init the parse struct to point at the outgoing
 179          * data.
 180          */
 181
 182         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 183         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 184
 185         /* Store the header in the data stream. */
 186         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 187                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR.\n"));
 188                 prs_mem_free(&outgoing_pdu);
 189                 return False;
 190         }
 191
 192         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 193                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_RESP.\n"));
 194                 prs_mem_free(&outgoing_pdu);
 195                 return False;
 196         }
 197
 198         /* Store the current offset. */
 199         data_pos = prs_offset(&outgoing_pdu);
 200
 201         /* Copy the data into the PDU. */
 202
 203         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 204                 DEBUG(0,("create_next_pdu: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 205                 prs_mem_free(&outgoing_pdu);
 206                 return False;
 207         }
 208
 209         if (p->ntlmssp_auth_validated) {
 210                 uint32 crc32 = 0;
 211                 char *data;
 212
 213                 DEBUG(5,("create_next_pdu: sign: %s seal: %s data %d auth %d\n",
 214                          BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, p->hdr.auth_len));
 215
 216                 /*
 217                  * Set data to point to where we copied the data into.
 218                  */
 219
 220                 data = prs_data_p(&outgoing_pdu) + data_pos;
 221
 222                 if (auth_seal) {
 223                         crc32 = crc32_calc_buffer(data, data_len);
 224                         NTLMSSPcalc_p(p, (uchar*)data, data_len);
 225                 }
 226
 227                 if (auth_seal || auth_verify) {
 228                         RPC_HDR_AUTH auth_info;
 229
 230                         init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, RPC_PIPE_AUTH_SEAL_LEVEL,
 231                                         (auth_verify ? RPC_HDR_AUTH_LEN : 0), (auth_verify ? 1 : 0));
 232                         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 233                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 234                                 prs_mem_free(&outgoing_pdu);
 235                                 return False;
 236                         }
 237                 }
 238
 239                 if (auth_verify) {
 240                         RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
 241                         char *auth_data = prs_data_p(&outgoing_pdu);
 242
 243                         p->ntlmssp_seq_num++;
 244                         init_rpc_auth_ntlmssp_chk(&ntlmssp_chk, NTLMSSP_SIGN_VERSION,
 245                                         crc32, p->ntlmssp_seq_num++);
 246                         auth_data = prs_data_p(&outgoing_pdu) + prs_offset(&outgoing_pdu) + 4;
 247                         if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, &outgoing_pdu, 0)) {
 248                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_AUTH_NTLMSSP_CHK.\n"));
 249                                 prs_mem_free(&outgoing_pdu);
 250                                 return False;
 251                         }
 252                         NTLMSSPcalc_p(p, (uchar*)auth_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 253                 }
 254         }
 255
 256         if (p->netsec_auth_validated) {
 257                 char *data;
 258                 RPC_HDR_AUTH auth_info;
 259                 static const uchar netsec_sig[8] = NETSEC_SIGNATURE;
 260                 static const uchar nullbytes[8] = { 0,0,0,0,0,0,0,0 };
 261
 262                 RPC_AUTH_NETSEC_CHK verf;
 263                 prs_struct rverf;
 264                 prs_struct rauth;
 265
 266                 data = prs_data_p(&outgoing_pdu) + data_pos;
 267
 268                 init_rpc_hdr_auth(&auth_info, NETSEC_AUTH_TYPE, RPC_PIPE_AUTH_SEAL_LEVEL,
 269                                   RPC_HDR_AUTH_LEN, 1);
 270
 271                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 272                         DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 273                         prs_mem_free(&outgoing_pdu);
 274                         return False;
 275                 }
 276
 277                 prs_init(&rverf, 0, p->mem_ctx, MARSHALL);
 278                 prs_init(&rauth, 0, p->mem_ctx, MARSHALL);
 279
 280                 if ((p->netsec_auth.seq_num & 1) == 0) {
 281                         DEBUG(0,("SCHANNEL ERROR: seq_num must be odd in server! (seq_num=%d)\n",
 282                                         p->netsec_auth.seq_num));
 283                 }
 284
 285                 init_rpc_auth_netsec_chk(&verf, netsec_sig, nullbytes, nullbytes, nullbytes);
 286
 287                 netsec_encode(&p->netsec_auth,
 288                               AUTH_PIPE_NETSEC|AUTH_PIPE_SIGN|AUTH_PIPE_SEAL,
 289                               SENDER_IS_ACCEPTOR,
 290                               &verf, data, data_len);
 291
 292                 smb_io_rpc_auth_netsec_chk("", &verf, &outgoing_pdu, 0);
 293
 294                 p->netsec_auth.seq_num++;
 295         }
 296
 297         /*
 298          * Setup the counts for this PDU.
 299          */
 300
 301         p->out_data.data_sent_length += data_len;
 302         p->out_data.current_pdu_len = p->hdr.frag_len;
 303         p->out_data.current_pdu_sent = 0;
 304
 305         prs_mem_free(&outgoing_pdu);
 306         return True;
 307 }
 308
 309 /*******************************************************************
 310  Process an NTLMSSP authentication response.
 311  If this function succeeds, the user has been authenticated
 312  and their domain, name and calling workstation stored in
 313  the pipe struct.
 314  The initial challenge is stored in p->challenge.
 315  *******************************************************************/
 316
 317 static BOOL api_pipe_ntlmssp_verify(pipes_struct *p, RPC_AUTH_NTLMSSP_RESP *ntlmssp_resp)
 318 {
 319         uchar lm_owf[24];
 320         uchar nt_owf[128];
 321         int nt_pw_len;
 322         int lm_pw_len;
 323         fstring user_name;
 324         fstring domain;
 325         fstring wks;
 326
 327         NTSTATUS nt_status;
 328
 329         struct auth_context *auth_context = NULL;
 330         auth_usersupplied_info *user_info = NULL;
 331         auth_serversupplied_info *server_info = NULL;
 332
 333         DEBUG(5,("api_pipe_ntlmssp_verify: checking user details\n"));
 334
 335         memset(p->user_name, '\0', sizeof(p->user_name));
 336         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 337         memset(p->domain, '\0', sizeof(p->domain));
 338         memset(p->wks, '\0', sizeof(p->wks));
 339
 340         /* Set up for non-authenticated user. */
 341         delete_nt_token(&p->pipe_user.nt_user_token);
 342         p->pipe_user.ngroups = 0;
 343         SAFE_FREE( p->pipe_user.groups);
 344
 345         /*
 346          * Setup an empty password for a guest user.
 347          */
 348
 349         /*
 350          * We always negotiate UNICODE.
 351          */
 352
 353         if (p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_UNICODE) {
 354                 rpcstr_pull(user_name, ntlmssp_resp->user, sizeof(fstring), ntlmssp_resp->hdr_usr.str_str_len*2, 0 );
 355                 rpcstr_pull(domain, ntlmssp_resp->domain, sizeof(fstring), ntlmssp_resp->hdr_domain.str_str_len*2, 0);
 356                 rpcstr_pull(wks, ntlmssp_resp->wks, sizeof(fstring), ntlmssp_resp->hdr_wks.str_str_len*2, 0);
 357         } else {
 358                 pull_ascii_fstring(user_name, ntlmssp_resp->user);
 359                 pull_ascii_fstring(domain, ntlmssp_resp->domain);
 360                 pull_ascii_fstring(wks, ntlmssp_resp->wks);
 361         }
 362
 363         DEBUG(5,("user: %s domain: %s wks: %s\n", user_name, domain, wks));
 364
 365         nt_pw_len = MIN(sizeof(nt_owf), ntlmssp_resp->hdr_nt_resp.str_str_len);
 366         lm_pw_len = MIN(sizeof(lm_owf), ntlmssp_resp->hdr_lm_resp.str_str_len);
 367
 368         memcpy(lm_owf, ntlmssp_resp->lm_resp, sizeof(lm_owf));
 369         memcpy(nt_owf, ntlmssp_resp->nt_resp, nt_pw_len);
 370
 371 #ifdef DEBUG_PASSWORD
 372         DEBUG(100,("lm, nt owfs, chal\n"));
 373         dump_data(100, (char *)lm_owf, sizeof(lm_owf));
 374         dump_data(100, (char *)nt_owf, nt_pw_len);
 375         dump_data(100, (char *)p->challenge, 8);
 376 #endif
 377
 378         /*
 379          * Allow guest access. Patch from Shirish Kalele <kalele@veritas.com>.
 380          */
 381
 382         if (*user_name) {
 383
 384                 /*
 385                  * Do the length checking only if user is not NULL.
 386                  */
 387
 388                 if (ntlmssp_resp->hdr_lm_resp.str_str_len == 0)
 389                         return False;
 390                 if (ntlmssp_resp->hdr_nt_resp.str_str_len == 0)
 391                         return False;
 392                 if (ntlmssp_resp->hdr_usr.str_str_len == 0)
 393                         return False;
 394                 if (ntlmssp_resp->hdr_domain.str_str_len == 0)
 395                         return False;
 396                 if (ntlmssp_resp->hdr_wks.str_str_len == 0)
 397                         return False;
 398
 399         }
 400
 401         make_auth_context_fixed(&auth_context, (uchar*)p->challenge);
 402
 403         if (!make_user_info_netlogon_network(&user_info,
 404                                              user_name, domain, wks,
 405                                              lm_owf, lm_pw_len,
 406                                              nt_owf, nt_pw_len)) {
 407                 DEBUG(0,("make_user_info_netlogon_network failed!  Failing authenticaion.\n"));
 408                 return False;
 409         }
 410
 411         nt_status = auth_context->check_ntlm_password(auth_context, user_info, &server_info);
 412
 413         (auth_context->free)(&auth_context);
 414         free_user_info(&user_info);
 415
 416         p->ntlmssp_auth_validated = NT_STATUS_IS_OK(nt_status);
 417
 418         if (!p->ntlmssp_auth_validated) {
 419                 DEBUG(1,("api_pipe_ntlmssp_verify: User [%s]\\[%s] from machine %s \
 420 failed authentication on named pipe %s.\n", domain, user_name, wks, p->name ));
 421                 free_server_info(&server_info);
 422                 return False;
 423         }
 424
 425         /*
 426          * Set up the sign/seal data.
 427          */
 428
 429         {
 430                 uchar p24[24];
 431                 NTLMSSPOWFencrypt(server_info->first_8_lm_hash, lm_owf, p24);
 432                 {
 433                         unsigned char j = 0;
 434                         int ind;
 435
 436                         unsigned char k2[8];
 437
 438                         memcpy(k2, p24, 5);
 439                         k2[5] = 0xe5;
 440                         k2[6] = 0x38;
 441                         k2[7] = 0xb0;
 442
 443                         for (ind = 0; ind < 256; ind++)
 444                                 p->ntlmssp_hash[ind] = (unsigned char)ind;
 445
 446                         for( ind = 0; ind < 256; ind++) {
 447                                 unsigned char tc;
 448
 449                                 j += (p->ntlmssp_hash[ind] + k2[ind%8]);
 450
 451                                 tc = p->ntlmssp_hash[ind];
 452                                 p->ntlmssp_hash[ind] = p->ntlmssp_hash[j];
 453                                 p->ntlmssp_hash[j] = tc;
 454                         }
 455
 456                         p->ntlmssp_hash[256] = 0;
 457                         p->ntlmssp_hash[257] = 0;
 458                 }
 459
 460                 dump_data_pw("NTLMSSP hash (v1)\n", p->ntlmssp_hash,
 461                              sizeof(p->ntlmssp_hash));
 462
 463 /*              NTLMSSPhash(p->ntlmssp_hash, p24); */
 464                 p->ntlmssp_seq_num = 0;
 465
 466         }
 467
 468         fstrcpy(p->user_name, user_name);
 469         fstrcpy(p->pipe_user_name, server_info->unix_name);
 470         fstrcpy(p->domain, domain);
 471         fstrcpy(p->wks, wks);
 472
 473         /*
 474          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 475          */
 476
 477         memcpy(p->session_key, server_info->session_key, sizeof(p->session_key));
 478
 479         p->pipe_user.uid = server_info->uid;
 480         p->pipe_user.gid = server_info->gid;
 481
 482         p->pipe_user.ngroups = server_info->n_groups;
 483         if (p->pipe_user.ngroups) {
 484                 if (!(p->pipe_user.groups = memdup(server_info->groups, sizeof(gid_t) * p->pipe_user.ngroups))) {
 485                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 486                         free_server_info(&server_info);
 487                         return False;
 488                 }
 489         }
 490
 491         if (server_info->ptok)
 492                 p->pipe_user.nt_user_token = dup_nt_token(server_info->ptok);
 493         else {
 494                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 495                 p->pipe_user.nt_user_token = NULL;
 496                 free_server_info(&server_info);
 497                 return False;
 498         }
 499
 500         p->ntlmssp_auth_validated = True;
 501
 502         free_server_info(&server_info);
 503         return True;
 504 }
 505
 506 /*******************************************************************
 507  The switch table for the pipe names and the functions to handle them.
 508  *******************************************************************/
 509
 510 struct rpc_table
 511 {
 512   struct
 513   {
 514     const char *clnt;
 515     const char *srv;
 516   } pipe;
 517   struct api_struct *cmds;
 518   int n_cmds;
 519 };
 520
 521 static struct rpc_table *rpc_lookup;
 522 static int rpc_lookup_size;
 523
 524 /*******************************************************************
 525  This is the client reply to our challenge for an authenticated
 526  bind request. The challenge we sent is in p->challenge.
 527 *******************************************************************/
 528
 529 BOOL api_pipe_bind_auth_resp(pipes_struct *p, prs_struct *rpc_in_p)
 530 {
 531         RPC_HDR_AUTHA autha_info;
 532         RPC_AUTH_VERIFIER auth_verifier;
 533         RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 534
 535         DEBUG(5,("api_pipe_bind_auth_resp: decode request. %d\n", __LINE__));
 536
 537         if (p->hdr.auth_len == 0) {
 538                 DEBUG(0,("api_pipe_bind_auth_resp: No auth field sent !\n"));
 539                 return False;
 540         }
 541
 542         /*
 543          * Decode the authentication verifier response.
 544          */
 545
 546         if(!smb_io_rpc_hdr_autha("", &autha_info, rpc_in_p, 0)) {
 547                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_HDR_AUTHA failed.\n"));
 548                 return False;
 549         }
 550
 551         if (autha_info.auth_type != NTLMSSP_AUTH_TYPE || autha_info.auth_level != RPC_PIPE_AUTH_SEAL_LEVEL) {
 552                 DEBUG(0,("api_pipe_bind_auth_resp: incorrect auth type (%d) or level (%d).\n",
 553                         (int)autha_info.auth_type, (int)autha_info.auth_level ));
 554                 return False;
 555         }
 556
 557         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 558                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_AUTH_VERIFIER failed.\n"));
 559                 return False;
 560         }
 561
 562         /*
 563          * Ensure this is a NTLMSSP_AUTH packet type.
 564          */
 565
 566         if (!rpc_auth_verifier_chk(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH)) {
 567                 DEBUG(0,("api_pipe_bind_auth_resp: rpc_auth_verifier_chk failed.\n"));
 568                 return False;
 569         }
 570
 571         if(!smb_io_rpc_auth_ntlmssp_resp("", &ntlmssp_resp, rpc_in_p, 0)) {
 572                 DEBUG(0,("api_pipe_bind_auth_resp: Failed to unmarshall RPC_AUTH_NTLMSSP_RESP.\n"));
 573                 return False;
 574         }
 575
 576         /*
 577          * The following call actually checks the challenge/response data.
 578          * for correctness against the given DOMAIN\user name.
 579          */
 580
 581         if (!api_pipe_ntlmssp_verify(p, &ntlmssp_resp))
 582                 return False;
 583
 584         p->pipe_bound = True
 585 ;
 586         return True;
 587 }
 588
 589 /*******************************************************************
 590  Marshall a bind_nak pdu.
 591 *******************************************************************/
 592
 593 static BOOL setup_bind_nak(pipes_struct *p)
 594 {
 595         prs_struct outgoing_rpc;
 596         RPC_HDR nak_hdr;
 597         uint16 zero = 0;
 598
 599         /* Free any memory in the current return data buffer. */
 600         prs_mem_free(&p->out_data.rdata);
 601
 602         /*
 603          * Marshall directly into the outgoing PDU space. We
 604          * must do this as we need to set to the bind response
 605          * header and are never sending more than one PDU here.
 606          */
 607
 608         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 609         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 610
 611
 612         /*
 613          * Initialize a bind_nak header.
 614          */
 615
 616         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 617             p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 618
 619         /*
 620          * Marshall the header into the outgoing PDU.
 621          */
 622
 623         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 624                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 625                 prs_mem_free(&outgoing_rpc);
 626                 return False;
 627         }
 628
 629         /*
 630          * Now add the reject reason.
 631          */
 632
 633         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 634                 prs_mem_free(&outgoing_rpc);
 635         return False;
 636         }
 637
 638         p->out_data.data_sent_length = 0;
 639         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 640         p->out_data.current_pdu_sent = 0;
 641
 642         p->pipe_bound = False;
 643
 644         return True;
 645 }
 646
 647 /*******************************************************************
 648  Marshall a fault pdu.
 649 *******************************************************************/
 650
 651 BOOL setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 652 {
 653         prs_struct outgoing_pdu;
 654         RPC_HDR fault_hdr;
 655         RPC_HDR_RESP hdr_resp;
 656         RPC_HDR_FAULT fault_resp;
 657
 658         /* Free any memory in the current return data buffer. */
 659         prs_mem_free(&p->out_data.rdata);
 660
 661         /*
 662          * Marshall directly into the outgoing PDU space. We
 663          * must do this as we need to set to the bind response
 664          * header and are never sending more than one PDU here.
 665          */
 666
 667         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 668         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 669
 670         /*
 671          * Initialize a fault header.
 672          */
 673
 674         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 675             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 676
 677         /*
 678          * Initialize the HDR_RESP and FAULT parts of the PDU.
 679          */
 680
 681         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 682
 683         fault_resp.status = status;
 684         fault_resp.reserved = 0;
 685
 686         /*
 687          * Marshall the header into the outgoing PDU.
 688          */
 689
 690         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 691                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 692                 prs_mem_free(&outgoing_pdu);
 693                 return False;
 694         }
 695
 696         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 697                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 698                 prs_mem_free(&outgoing_pdu);
 699                 return False;
 700         }
 701
 702         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 703                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 704                 prs_mem_free(&outgoing_pdu);
 705                 return False;
 706         }
 707
 708         p->out_data.data_sent_length = 0;
 709         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 710         p->out_data.current_pdu_sent = 0;
 711
 712         prs_mem_free(&outgoing_pdu);
 713         return True;
 714 }
 715
 716 /*******************************************************************
 717  Ensure a bind request has the correct abstract & transfer interface.
 718  Used to reject unknown binds from Win2k.
 719 *******************************************************************/
 720
 721 BOOL check_bind_req(char* pipe_name, RPC_IFACE* abstract,
 722                                         RPC_IFACE* transfer)
 723 {
 724         extern struct pipe_id_info pipe_names[];
 725         int i=0;
 726         fstring pname;
 727         fstrcpy(pname,"\\PIPE\\");
 728         fstrcat(pname,pipe_name);
 729
 730         DEBUG(3,("check_bind_req for %s\n", pname));
 731
 732 #ifndef SUPPORT_NEW_LSARPC_UUID
 733
 734         /* check for the first pipe matching the name */
 735
 736         for ( i=0; pipe_names[i].client_pipe; i++ ) {
 737                 if ( strequal(pipe_names[i].client_pipe, pname) )
 738                         break;
 739         }
 740 #else
 741         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 742
 743         for ( i=0; pipe_names[i].client_pipe; i++ )
 744         {
 745                 if ( strequal(pipe_names[i].client_pipe, pname)
 746                         && (abstract->version == pipe_names[i].abstr_syntax.version)
 747                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(RPC_UUID)) == 0)
 748                         && (transfer->version == pipe_names[i].trans_syntax.version)
 749                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(RPC_UUID)) == 0) )
 750                 {
 751                         break;
 752                 }
 753         }
 754 #endif
 755
 756         if(pipe_names[i].client_pipe == NULL)
 757                 return False;
 758
 759 #ifndef SUPPORT_NEW_LSARPC_UUID
 760         /* check the abstract interface */
 761         if ( (abstract->version != pipe_names[i].abstr_syntax.version)
 762                 || (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(RPC_UUID)) != 0) )
 763         {
 764                 return False;
 765         }
 766
 767         /* check the transfer interface */
 768         if ( (transfer->version != pipe_names[i].trans_syntax.version)
 769                 || (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(RPC_UUID)) != 0) )
 770         {
 771                 return False;
 772         }
 773 #endif
 774         return True;
 775 }
 776
 777 /*******************************************************************
 778  Register commands to an RPC pipe
 779 *******************************************************************/
 780 NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *srv, const struct api_struct *cmds, int size)
 781 {
 782         struct rpc_table *rpc_entry;
 783
 784         if (!clnt || !srv || !cmds) {
 785                 return NT_STATUS_INVALID_PARAMETER;
 786         }
 787
 788         if (version != SMB_RPC_INTERFACE_VERSION) {
 789                 DEBUG(0,("Can't register rpc commands!\n"
 790                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
 791                          ", while this version of samba uses version %d!\n",
 792                          version,SMB_RPC_INTERFACE_VERSION));
 793                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
 794         }
 795
 796         /* TODO:
 797          *
 798          * we still need to make sure that don't register the same commands twice!!!
 799          *
 800          * --metze
 801          */
 802
 803         /* We use a temporary variable because this call can fail and
 804            rpc_lookup will still be valid afterwards.  It could then succeed if
 805            called again later */
 806         rpc_entry = realloc(rpc_lookup,
 807                             ++rpc_lookup_size*sizeof(struct rpc_table));
 808         if (NULL == rpc_entry) {
 809                 rpc_lookup_size--;
 810                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
 811                 return NT_STATUS_NO_MEMORY;
 812         } else {
 813                 rpc_lookup = rpc_entry;
 814         }
 815
 816         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
 817         ZERO_STRUCTP(rpc_entry);
 818         rpc_entry->pipe.clnt = strdup(clnt);
 819         rpc_entry->pipe.srv = strdup(srv);
 820         rpc_entry->cmds = realloc(rpc_entry->cmds,
 821                                   (rpc_entry->n_cmds + size) *
 822                                   sizeof(struct api_struct));
 823         memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds,
 824                size * sizeof(struct api_struct));
 825         rpc_entry->n_cmds += size;
 826
 827         return NT_STATUS_OK;
 828 }
 829
 830 /*******************************************************************
 831  Respond to a pipe bind request.
 832 *******************************************************************/
 833
 834 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
 835 {
 836         RPC_HDR_BA hdr_ba;
 837         RPC_HDR_RB hdr_rb;
 838         RPC_HDR_AUTH auth_info;
 839         uint16 assoc_gid;
 840         fstring ack_pipe_name;
 841         prs_struct out_hdr_ba;
 842         prs_struct out_auth;
 843         prs_struct outgoing_rpc;
 844         int i = 0;
 845         int auth_len = 0;
 846         enum RPC_PKT_TYPE reply_pkt_type;
 847
 848         p->ntlmssp_auth_requested = False;
 849         p->netsec_auth_validated = False;
 850
 851         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
 852
 853         /*
 854          * Try and find the correct pipe name to ensure
 855          * that this is a pipe name we support.
 856          */
 857
 858
 859         for (i = 0; i < rpc_lookup_size; i++) {
 860                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
 861                   DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 862                             rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
 863                   fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
 864                   break;
 865                 }
 866         }
 867
 868         if (i == rpc_lookup_size) {
 869                                 if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) {
 870                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 871                                 p->name ));
 872                        if(!setup_bind_nak(p))
 873                                return False;
 874                        return True;
 875                 }
 876
 877                 for (i = 0; i < rpc_lookup_size; i++) {
 878                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
 879                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 880                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
 881                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
 882                                break;
 883                        }
 884                 }
 885
 886                                 if (i == rpc_lookup_size) {
 887                                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
 888                                         return False;
 889                                 }
 890         }
 891
 892         /* decode the bind request */
 893         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
 894                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
 895                 return False;
 896         }
 897
 898         /*
 899          * Check if this is an authenticated request.
 900          */
 901
 902         if (p->hdr.auth_len != 0) {
 903                 RPC_AUTH_VERIFIER auth_verifier;
 904                 RPC_AUTH_NTLMSSP_NEG ntlmssp_neg;
 905
 906                 /*
 907                  * Decode the authentication verifier.
 908                  */
 909
 910                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 911                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 912                         return False;
 913                 }
 914
 915                 if(auth_info.auth_type == NTLMSSP_AUTH_TYPE) {
 916
 917                         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 918                                 DEBUG(0,("api_pipe_bind_req: unable to "
 919                                          "unmarshall RPC_HDR_AUTH struct.\n"));
 920                                 return False;
 921                         }
 922
 923                         if(!strequal(auth_verifier.signature, "NTLMSSP")) {
 924                                 DEBUG(0,("api_pipe_bind_req: "
 925                                          "auth_verifier.signature != NTLMSSP\n"));
 926                                 return False;
 927                         }
 928
 929                         if(auth_verifier.msg_type != NTLMSSP_NEGOTIATE) {
 930                                 DEBUG(0,("api_pipe_bind_req: "
 931                                          "auth_verifier.msg_type (%d) != NTLMSSP_NEGOTIATE\n",
 932                                          auth_verifier.msg_type));
 933                                 return False;
 934                         }
 935
 936                         if(!smb_io_rpc_auth_ntlmssp_neg("", &ntlmssp_neg, rpc_in_p, 0)) {
 937                                 DEBUG(0,("api_pipe_bind_req: "
 938                                          "Failed to unmarshall RPC_AUTH_NTLMSSP_NEG.\n"));
 939                                 return False;
 940                         }
 941
 942                         p->ntlmssp_chal_flags = SMBD_NTLMSSP_NEG_FLAGS;
 943                         p->ntlmssp_auth_requested = True;
 944
 945                 } else if (auth_info.auth_type == NETSEC_AUTH_TYPE) {
 946
 947                         RPC_AUTH_NETSEC_NEG neg;
 948                         struct netsec_auth_struct *a = &(p->netsec_auth);
 949
 950                         if (!smb_io_rpc_auth_netsec_neg("", &neg, rpc_in_p, 0)) {
 951                                 DEBUG(0,("api_pipe_bind_req: "
 952                                          "Could not unmarshal SCHANNEL auth neg\n"));
 953                                 return False;
 954                         }
 955
 956                         p->netsec_auth_validated = True;
 957
 958                         memset(a->sess_key, 0, sizeof(a->sess_key));
 959                         memcpy(a->sess_key, last_dcinfo.sess_key, sizeof(last_dcinfo.sess_key));
 960
 961                         a->seq_num = 0;
 962
 963                         DEBUG(10,("schannel auth: domain [%s] myname [%s]\n",
 964                                   neg.domain, neg.myname));
 965
 966                 } else {
 967                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n",
 968                                  auth_info.auth_type ));
 969                         return False;
 970                 }
 971         }
 972
 973         switch(p->hdr.pkt_type) {
 974                 case RPC_BIND:
 975                         /* name has to be \PIPE\xxxxx */
 976                         fstrcpy(ack_pipe_name, "\\PIPE\\");
 977                         fstrcat(ack_pipe_name, p->pipe_srv_name);
 978                         reply_pkt_type = RPC_BINDACK;
 979                         break;
 980                 case RPC_ALTCONT:
 981                         /* secondary address CAN be NULL
 982                          * as the specs say it's ignored.
 983                          * It MUST NULL to have the spoolss working.
 984                          */
 985                         fstrcpy(ack_pipe_name,"");
 986                         reply_pkt_type = RPC_ALTCONTRESP;
 987                         break;
 988                 default:
 989                         return False;
 990         }
 991
 992         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 993
 994         /*
 995          * Marshall directly into the outgoing PDU space. We
 996          * must do this as we need to set to the bind response
 997          * header and are never sending more than one PDU here.
 998          */
 999
1000         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
1001         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1002
1003         /*
1004          * Setup the memory to marshall the ba header, and the
1005          * auth footers.
1006          */
1007
1008         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1009                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1010                 prs_mem_free(&outgoing_rpc);
1011                 return False;
1012         }
1013
1014         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1015                 DEBUG(0,("pi_pipe_bind_req: malloc out_auth failed.\n"));
1016                 prs_mem_free(&outgoing_rpc);
1017                 prs_mem_free(&out_hdr_ba);
1018                 return False;
1019         }
1020
1021         if (p->ntlmssp_auth_requested)
1022                 assoc_gid = 0x7a77;
1023         else
1024                 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1025
1026         /*
1027          * Create the bind response struct.
1028          */
1029
1030         /* If the requested abstract synt uuid doesn't match our client pipe,
1031                 reject the bind_ack & set the transfer interface synt to all 0's,
1032                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1033                 unknown to NT4)
1034                 Needed when adding entries to a DACL from NT5 - SK */
1035
1036         if(check_bind_req(p->name, &hdr_rb.abstract, &hdr_rb.transfer)) {
1037                 init_rpc_hdr_ba(&hdr_ba,
1038                         MAX_PDU_FRAG_LEN,
1039                         MAX_PDU_FRAG_LEN,
1040                         assoc_gid,
1041                         ack_pipe_name,
1042                         0x1, 0x0, 0x0,
1043                         &hdr_rb.transfer);
1044         } else {
1045                 RPC_IFACE null_interface;
1046                 ZERO_STRUCT(null_interface);
1047                 /* Rejection reason: abstract syntax not supported */
1048                 init_rpc_hdr_ba(&hdr_ba, MAX_PDU_FRAG_LEN,
1049                                         MAX_PDU_FRAG_LEN, assoc_gid,
1050                                         ack_pipe_name, 0x1, 0x2, 0x1,
1051                                         &null_interface);
1052         }
1053
1054         /*
1055          * and marshall it.
1056          */
1057
1058         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1059                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1060                 goto err_exit;
1061         }
1062
1063         /*
1064          * Now the authentication.
1065          */
1066
1067         if (p->ntlmssp_auth_requested) {
1068                 RPC_AUTH_VERIFIER auth_verifier;
1069                 RPC_AUTH_NTLMSSP_CHAL ntlmssp_chal;
1070
1071                 generate_random_buffer(p->challenge, 8, False);
1072
1073                 /*** Authentication info ***/
1074
1075                 init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, RPC_PIPE_AUTH_SEAL_LEVEL, RPC_HDR_AUTH_LEN, 1);
1076                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
1077                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
1078                         goto err_exit;
1079                 }
1080
1081                 /*** NTLMSSP verifier ***/
1082
1083                 init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_CHALLENGE);
1084                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, &out_auth, 0)) {
1085                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1086                         goto err_exit;
1087                 }
1088
1089                 /* NTLMSSP challenge ***/
1090
1091                 init_rpc_auth_ntlmssp_chal(&ntlmssp_chal, p->ntlmssp_chal_flags, p->challenge);
1092                 if(!smb_io_rpc_auth_ntlmssp_chal("", &ntlmssp_chal, &out_auth, 0)) {
1093                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_NTLMSSP_CHAL failed.\n"));
1094                         goto err_exit;
1095                 }
1096
1097                 /* Auth len in the rpc header doesn't include auth_header. */
1098                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1099         }
1100
1101         if (p->netsec_auth_validated) {
1102                 RPC_AUTH_VERIFIER auth_verifier;
1103                 uint32 flags;
1104
1105                 /* The client opens a second RPC NETLOGON pipe without
1106                    doing a auth2. The credentials for the schannel are
1107                    re-used from the auth2 the client did before. */
1108                 p->dc = last_dcinfo;
1109
1110                 init_rpc_hdr_auth(&auth_info, NETSEC_AUTH_TYPE, RPC_PIPE_AUTH_SEAL_LEVEL, RPC_HDR_AUTH_LEN, 1);
1111                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
1112                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
1113                         goto err_exit;
1114                 }
1115
1116                 /*** NETSEC verifier ***/
1117
1118                 init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1119                 if(!smb_io_rpc_netsec_verifier("", &auth_verifier, &out_auth, 0)) {
1120                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1121                         goto err_exit;
1122                 }
1123
1124                 prs_align(&out_auth);
1125
1126                 flags = 5;
1127                 if(!prs_uint32("flags ", &out_auth, 0, &flags))
1128                         goto err_exit;
1129
1130                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1131         }
1132
1133         /*
1134          * Create the header, now we know the length.
1135          */
1136
1137         init_rpc_hdr(&p->hdr, reply_pkt_type, RPC_FLG_FIRST | RPC_FLG_LAST,
1138                         p->hdr.call_id,
1139                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1140                         auth_len);
1141
1142         /*
1143          * Marshall the header into the outgoing PDU.
1144          */
1145
1146         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1147                 DEBUG(0,("pi_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1148                 goto err_exit;
1149         }
1150
1151         /*
1152          * Now add the RPC_HDR_BA and any auth needed.
1153          */
1154
1155         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1156                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1157                 goto err_exit;
1158         }
1159
1160         if((p->ntlmssp_auth_requested|p->netsec_auth_validated) &&
1161            !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1162                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1163                 goto err_exit;
1164         }
1165
1166         if(!p->ntlmssp_auth_requested)
1167                 p->pipe_bound = True;
1168
1169         /*
1170          * Setup the lengths for the initial reply.
1171          */
1172
1173         p->out_data.data_sent_length = 0;
1174         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1175         p->out_data.current_pdu_sent = 0;
1176
1177         prs_mem_free(&out_hdr_ba);
1178         prs_mem_free(&out_auth);
1179
1180         return True;
1181
1182   err_exit:
1183
1184         prs_mem_free(&outgoing_rpc);
1185         prs_mem_free(&out_hdr_ba);
1186         prs_mem_free(&out_auth);
1187         return False;
1188 }
1189
1190 /****************************************************************************
1191  Deal with sign & seal processing on an RPC request.
1192 ****************************************************************************/
1193
1194 BOOL api_pipe_auth_process(pipes_struct *p, prs_struct *rpc_in)
1195 {
1196         /*
1197          * We always negotiate the following two bits....
1198          */
1199         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
1200         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
1201         int data_len;
1202         int auth_len;
1203         uint32 old_offset;
1204         uint32 crc32 = 0;
1205
1206         auth_len = p->hdr.auth_len;
1207
1208         if ((auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) && auth_verify) {
1209                 DEBUG(0,("api_pipe_auth_process: Incorrect auth_len %d.\n", auth_len ));
1210                 return False;
1211         }
1212
1213         /*
1214          * The following is that length of the data we must verify or unseal.
1215          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1216          * preceeding the auth_data.
1217          */
1218
1219         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1220                         (auth_verify ? RPC_HDR_AUTH_LEN : 0) - auth_len;
1221
1222         DEBUG(5,("api_pipe_auth_process: sign: %s seal: %s data %d auth %d\n",
1223                  BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, auth_len));
1224
1225         if (auth_seal) {
1226                 /*
1227                  * The data in rpc_in doesn't contain the RPC_HEADER as this
1228                  * has already been consumed.
1229                  */
1230                 char *data = prs_data_p(rpc_in) + RPC_HDR_REQ_LEN;
1231                 dump_data_pw("NTLMSSP hash (v1)\n", p->ntlmssp_hash,
1232                              sizeof(p->ntlmssp_hash));
1233
1234                 dump_data_pw("Incoming RPC PDU (NTLMSSP sealed)\n",
1235                              data, data_len);
1236                 NTLMSSPcalc_p(p, (uchar*)data, data_len);
1237                 dump_data_pw("Incoming RPC PDU (NTLMSSP unsealed)\n",
1238                              data, data_len);
1239                 crc32 = crc32_calc_buffer(data, data_len);
1240         }
1241
1242         old_offset = prs_offset(rpc_in);
1243
1244         if (auth_seal || auth_verify) {
1245                 RPC_HDR_AUTH auth_info;
1246
1247                 if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1248                         DEBUG(0,("api_pipe_auth_process: cannot move offset to %u.\n",
1249                                 (unsigned int)old_offset + data_len ));
1250                         return False;
1251                 }
1252
1253                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1254                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1255                         return False;
1256                 }
1257         }
1258
1259         if (auth_verify) {
1260                 RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
1261                 char *req_data = prs_data_p(rpc_in) + prs_offset(rpc_in) + 4;
1262
1263                 DEBUG(5,("api_pipe_auth_process: auth %d\n", prs_offset(rpc_in) + 4));
1264
1265                 /*
1266                  * Ensure we have RPC_AUTH_NTLMSSP_CHK_LEN - 4 more bytes in the
1267                  * incoming buffer.
1268                  */
1269                 if(prs_mem_get(rpc_in, RPC_AUTH_NTLMSSP_CHK_LEN - 4) == NULL) {
1270                         DEBUG(0,("api_pipe_auth_process: missing %d bytes in buffer.\n",
1271                                 RPC_AUTH_NTLMSSP_CHK_LEN - 4 ));
1272                         return False;
1273                 }
1274
1275                 NTLMSSPcalc_p(p, (uchar*)req_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
1276                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, rpc_in, 0)) {
1277                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_AUTH_NTLMSSP_CHK.\n"));
1278                         return False;
1279                 }
1280
1281                 if (!rpc_auth_ntlmssp_chk(&ntlmssp_chk, crc32, p->ntlmssp_seq_num)) {
1282                         DEBUG(0,("api_pipe_auth_process: NTLMSSP check failed.\n"));
1283                         return False;
1284                 }
1285         }
1286
1287         /*
1288          * Return the current pointer to the data offset.
1289          */
1290
1291         if(!prs_set_offset(rpc_in, old_offset)) {
1292                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
1293                         (unsigned int)old_offset ));
1294                 return False;
1295         }
1296
1297         return True;
1298 }
1299
1300 /****************************************************************************
1301  Deal with schannel processing on an RPC request.
1302 ****************************************************************************/
1303 BOOL api_pipe_netsec_process(pipes_struct *p, prs_struct *rpc_in)
1304 {
1305         /*
1306          * We always negotiate the following two bits....
1307          */
1308         int data_len;
1309         int auth_len;
1310         uint32 old_offset;
1311         RPC_HDR_AUTH auth_info;
1312         RPC_AUTH_NETSEC_CHK netsec_chk;
1313
1314
1315         auth_len = p->hdr.auth_len;
1316
1317         if (auth_len != RPC_AUTH_NETSEC_CHK_LEN) {
1318                 DEBUG(0,("Incorrect auth_len %d.\n", auth_len ));
1319                 return False;
1320         }
1321
1322         /*
1323          * The following is that length of the data we must verify or unseal.
1324          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1325          * preceeding the auth_data.
1326          */
1327
1328         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1329                 RPC_HDR_AUTH_LEN - auth_len;
1330
1331         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
1332
1333         old_offset = prs_offset(rpc_in);
1334
1335         if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1336                 DEBUG(0,("cannot move offset to %u.\n",
1337                          (unsigned int)old_offset + data_len ));
1338                 return False;
1339         }
1340
1341         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1342                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
1343                 return False;
1344         }
1345
1346         if ((auth_info.auth_type != NETSEC_AUTH_TYPE) ||
1347             (auth_info.auth_level != RPC_PIPE_AUTH_SEAL_LEVEL)) {
1348                 DEBUG(0,("Invalid auth info %d or level %d on schannel\n",
1349                          auth_info.auth_type, auth_info.auth_level));
1350                 return False;
1351         }
1352
1353         if(!smb_io_rpc_auth_netsec_chk("", &netsec_chk, rpc_in, 0)) {
1354                 DEBUG(0,("failed to unmarshal RPC_AUTH_NETSEC_CHK.\n"));
1355                 return False;
1356         }
1357
1358         if (!netsec_decode(&p->netsec_auth,
1359                            AUTH_PIPE_NETSEC|AUTH_PIPE_SIGN|AUTH_PIPE_SEAL,
1360                            SENDER_IS_INITIATOR,
1361                            &netsec_chk,
1362                            prs_data_p(rpc_in)+old_offset, data_len)) {
1363                 DEBUG(0,("failed to decode PDU\n"));
1364                 return False;
1365         }
1366
1367         /*
1368          * Return the current pointer to the data offset.
1369          */
1370
1371         if(!prs_set_offset(rpc_in, old_offset)) {
1372                 DEBUG(0,("failed to set offset back to %u\n",
1373                          (unsigned int)old_offset ));
1374                 return False;
1375         }
1376
1377         /* The sequence number gets incremented on both send and receive. */
1378         p->netsec_auth.seq_num++;
1379
1380         return True;
1381 }
1382
1383 /****************************************************************************
1384  Return a user struct for a pipe user.
1385 ****************************************************************************/
1386
1387 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
1388 {
1389         if (p->ntlmssp_auth_validated) {
1390                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
1391         } else {
1392                 extern struct current_user current_user;
1393                 memcpy(user, &current_user, sizeof(struct current_user));
1394         }
1395
1396         return user;
1397 }
1398
1399 /****************************************************************************
1400  Find the correct RPC function to call for this request.
1401  If the pipe is authenticated then become the correct UNIX user
1402  before doing the call.
1403 ****************************************************************************/
1404
1405 BOOL api_pipe_request(pipes_struct *p)
1406 {
1407         int i = 0;
1408         BOOL ret = False;
1409
1410         if (p->ntlmssp_auth_validated) {
1411
1412                 if(!become_authenticated_pipe_user(p)) {
1413                         prs_mem_free(&p->out_data.rdata);
1414                         return False;
1415                 }
1416         }
1417
1418         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
1419
1420         for (i = 0; i < rpc_lookup_size; i++) {
1421                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1422                         DEBUG(3,("Doing \\PIPE\\%s\n",
1423                                  rpc_lookup[i].pipe.clnt));
1424                         set_current_rpc_talloc(p->mem_ctx);
1425                         ret = api_rpcTNP(p, rpc_lookup[i].pipe.clnt,
1426                                          rpc_lookup[i].cmds,
1427                                          rpc_lookup[i].n_cmds);
1428                         set_current_rpc_talloc(NULL);
1429                         break;
1430                 }
1431         }
1432
1433
1434         if (i == rpc_lookup_size) {
1435                 smb_probe_module("rpc", p->name);
1436
1437                 for (i = 0; i < rpc_lookup_size; i++) {
1438                         if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
1439                                 DEBUG(3,("Doing \\PIPE\\%s\n",
1440                                          rpc_lookup[i].pipe.clnt));
1441                                 set_current_rpc_talloc(p->mem_ctx);
1442                                 ret = api_rpcTNP(p, rpc_lookup[i].pipe.clnt,
1443                                                  rpc_lookup[i].cmds,
1444                                                  rpc_lookup[i].n_cmds);
1445                                 set_current_rpc_talloc(NULL);
1446                                 break;
1447                         }
1448                 }
1449         }
1450
1451         if(p->ntlmssp_auth_validated)
1452                 unbecome_authenticated_pipe_user();
1453
1454         return ret;
1455 }
1456
1457 /*******************************************************************
1458  Calls the underlying RPC function for a named pipe.
1459  ********************************************************************/
1460
1461 BOOL api_rpcTNP(pipes_struct *p, const char *rpc_name,
1462                 const struct api_struct *api_rpc_cmds, int n_cmds)
1463 {
1464         int fn_num;
1465         fstring name;
1466         uint32 offset1, offset2;
1467
1468         /* interpret the command */
1469         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
1470
1471         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
1472         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
1473
1474         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1475                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
1476                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
1477                         break;
1478                 }
1479         }
1480
1481         if (fn_num == n_cmds) {
1482                 /*
1483                  * For an unknown RPC just return a fault PDU but
1484                  * return True to allow RPC's on the pipe to continue
1485                  * and not put the pipe into fault state. JRA.
1486                  */
1487                 DEBUG(4, ("unknown\n"));
1488                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
1489                 return True;
1490         }
1491
1492         offset1 = prs_offset(&p->out_data.rdata);
1493
1494         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1495                 fn_num, api_rpc_cmds[fn_num].fn));
1496         /* do the actual command */
1497         if(!api_rpc_cmds[fn_num].fn(p)) {
1498                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
1499                 prs_mem_free(&p->out_data.rdata);
1500                 return False;
1501         }
1502
1503         if (p->bad_handle_fault_state) {
1504                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1505                 p->bad_handle_fault_state = False;
1506                 setup_fault_pdu(p, NT_STATUS(0x1C00001A));
1507                 return True;
1508         }
1509
1510         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
1511         offset2 = prs_offset(&p->out_data.rdata);
1512         prs_set_offset(&p->out_data.rdata, offset1);
1513         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
1514         prs_set_offset(&p->out_data.rdata, offset2);
1515
1516         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
1517
1518         /* Check for buffer underflow in rpc parsing */
1519
1520         if ((DEBUGLEVEL >= 10) &&
1521             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
1522                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
1523                 char *data;
1524
1525                 data = malloc(data_len);
1526
1527                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1528                 if (data) {
1529                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
1530                         SAFE_FREE(data);
1531                 }
1532
1533         }
1534
1535         return True;
1536 }