source3/rpc_client/cli_pipe.c

   1 /*
   2  *  Unix SMB/Netbios implementation.
   3  *  Version 1.9.
   4  *  RPC Pipe client / server routines
   5  *  Copyright (C) Andrew Tridgell              1992-1998,
   6  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   7  *  Copyright (C) Paul Ashton                       1998.
   8  *  Copyright (C) Jeremy Allison                    1999.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25 #include "includes.h"
  26
  27 extern struct pipe_id_info pipe_names[];
  28 extern fstring global_myworkgroup;
  29 extern pstring global_myname;
  30
  31 /********************************************************************
  32  Rpc pipe call id.
  33  ********************************************************************/
  34
  35 static uint32 get_rpc_call_id(void)
  36 {
  37         static uint32 call_id = 0;
  38         return ++call_id;
  39 }
  40
  41 /*******************************************************************
  42  Use SMBreadX to get rest of one fragment's worth of rpc data.
  43  ********************************************************************/
  44
  45 static BOOL rpc_read(struct cli_state *cli, prs_struct *rdata, uint32 data_to_read, uint32 *rdata_offset)
  46 {
  47         size_t size = (size_t)cli->max_recv_frag;
  48         int stream_offset = 0;
  49         int num_read;
  50         char *pdata;
  51         int extra_data_size = ((int)*rdata_offset) + ((int)data_to_read) - (int)prs_data_size(rdata);
  52
  53         DEBUG(5,("rpc_read: data_to_read: %u rdata offset: %u extra_data_size: %d\n",
  54                 (int)data_to_read, (unsigned int)*rdata_offset, extra_data_size));
  55
  56         /*
  57          * Grow the buffer if needed to accommodate the data to be read.
  58          */
  59
  60         if (extra_data_size > 0) {
  61                 if(!prs_force_grow(rdata, (uint32)extra_data_size)) {
  62                         DEBUG(0,("rpc_read: Failed to grow parse struct by %d bytes.\n", extra_data_size ));
  63                         return False;
  64                 }
  65                 DEBUG(5,("rpc_read: grew buffer by %d bytes to %u\n", extra_data_size, prs_data_size(rdata) ));
  66         }
  67
  68         pdata = prs_data_p(rdata) + *rdata_offset;
  69
  70         do /* read data using SMBreadX */
  71         {
  72                 uint32 ecode;
  73                 uint8 eclass;
  74
  75                 if (size > (size_t)data_to_read)
  76                         size = (size_t)data_to_read;
  77
  78                 num_read = (int)cli_read(cli, cli->nt_pipe_fnum, pdata, (off_t)stream_offset, size);
  79
  80                 DEBUG(5,("rpc_read: num_read = %d, read offset: %d, to read: %d\n",
  81                           num_read, stream_offset, data_to_read));
  82
  83                 if (cli_is_dos_error(cli)) {
  84                         cli_dos_error(cli, &eclass, &ecode);
  85                         if (eclass != ERRDOS && ecode != ERRmoredata) {
  86                                 DEBUG(0,("rpc_read: Error %d/%u in cli_read\n",
  87                                          eclass, (unsigned int)ecode));
  88                                 return False;
  89                         }
  90                 }
  91
  92                 data_to_read -= num_read;
  93                 stream_offset += num_read;
  94                 pdata += num_read;
  95
  96         } while (num_read > 0 && data_to_read > 0);
  97         /* && err == (0x80000000 | STATUS_BUFFER_OVERFLOW)); */
  98
  99         /*
 100          * Update the current offset into rdata by the amount read.
 101          */
 102         *rdata_offset += stream_offset;
 103
 104         return True;
 105 }
 106
 107 /****************************************************************************
 108  Checks the header. This will set the endian bit in the rdata prs_struct. JRA.
 109  ****************************************************************************/
 110
 111 static BOOL rpc_check_hdr(prs_struct *rdata, RPC_HDR *rhdr,
 112                           BOOL *first, BOOL *last, uint32 *len)
 113 {
 114         DEBUG(5,("rpc_check_hdr: rdata->data_size = %u\n", (uint32)prs_data_size(rdata) ));
 115
 116         /* Next call sets endian bit. */
 117
 118         if(!smb_io_rpc_hdr("rpc_hdr   ", rhdr, rdata, 0)) {
 119                 DEBUG(0,("rpc_check_hdr: Failed to unmarshall RPC_HDR.\n"));
 120                 return False;
 121         }
 122
 123         if (prs_offset(rdata) != RPC_HEADER_LEN) {
 124                 DEBUG(0,("rpc_check_hdr: offset was %x, should be %x.\n", prs_offset(rdata), RPC_HEADER_LEN));
 125                 return False;
 126         }
 127
 128         (*first) = ((rhdr->flags & RPC_FLG_FIRST) != 0);
 129         (*last) = ((rhdr->flags & RPC_FLG_LAST ) != 0);
 130         (*len) = (uint32)rhdr->frag_len - prs_data_size(rdata);
 131
 132         return (rhdr->pkt_type != RPC_FAULT);
 133 }
 134
 135 static void NTLMSSPcalc_ap( struct cli_state *cli, unsigned char *data, uint32 len)
 136 {
 137         unsigned char *hash = cli->ntlmssp_hash;
 138         unsigned char index_i = hash[256];
 139         unsigned char index_j = hash[257];
 140         int ind;
 141
 142         for( ind = 0; ind < len; ind++) {
 143                 unsigned char tc;
 144                 unsigned char t;
 145
 146                 index_i++;
 147                 index_j += hash[index_i];
 148
 149                 tc = hash[index_i];
 150                 hash[index_i] = hash[index_j];
 151                 hash[index_j] = tc;
 152
 153                 t = hash[index_i] + hash[index_j];
 154                 data[ind] = data[ind] ^ hash[t];
 155         }
 156
 157         hash[256] = index_i;
 158         hash[257] = index_j;
 159 }
 160
 161 /****************************************************************************
 162  Verify data on an rpc pipe.
 163  The VERIFY & SEAL code is only executed on packets that look like this :
 164
 165  Request/Response PDU's look like the following...
 166
 167  |<------------------PDU len----------------------------------------------->|
 168  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 169
 170  +------------+-----------------+-------------+---------------+-------------+
 171  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 172  +------------+-----------------+-------------+---------------+-------------+
 173
 174  Never on bind requests/responses.
 175  ****************************************************************************/
 176
 177 static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata, int len, int auth_len)
 178 {
 179         /*
 180          * The following is that length of the data we must sign or seal.
 181          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
 182          * preceeding the auth_data.
 183          */
 184
 185         int data_len = len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len;
 186
 187         /*
 188          * The start of the data to sign/seal is just after the RPC headers.
 189          */
 190         char *reply_data = prs_data_p(rdata) + RPC_HEADER_LEN + RPC_HDR_REQ_LEN;
 191
 192         BOOL auth_verify = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SIGN) != 0);
 193         BOOL auth_seal = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SEAL) != 0);
 194
 195         DEBUG(5,("rpc_auth_pipe: len: %d auth_len: %d verify %s seal %s\n",
 196                   len, auth_len, BOOLSTR(auth_verify), BOOLSTR(auth_seal)));
 197
 198         /*
 199          * Unseal any sealed data in the PDU, not including the
 200          * 8 byte auth_header or the auth_data.
 201          */
 202
 203         if (auth_seal) {
 204                 DEBUG(10,("rpc_auth_pipe: unseal\n"));
 205                 dump_data(100, reply_data, data_len);
 206                 NTLMSSPcalc_ap(cli, (uchar*)reply_data, data_len);
 207                 dump_data(100, reply_data, data_len);
 208         }
 209
 210         if (auth_verify || auth_seal) {
 211                 RPC_HDR_AUTH rhdr_auth;
 212                 prs_struct auth_req;
 213                 char data[RPC_HDR_AUTH_LEN];
 214                 /*
 215                  * We set dp to be the end of the packet, minus the auth_len
 216                  * and the length of the header that preceeds the auth_data.
 217                  */
 218                 char *dp = prs_data_p(rdata) + len - auth_len - RPC_HDR_AUTH_LEN;
 219
 220                 if(dp - prs_data_p(rdata) > prs_data_size(rdata)) {
 221                         DEBUG(0,("rpc_auth_pipe: auth data > data size !\n"));
 222                         return False;
 223                 }
 224
 225                 memcpy(data, dp, sizeof(data));
 226
 227                 prs_init(&auth_req , 0, cli->mem_ctx, UNMARSHALL);
 228
 229                 /* The endianness must be preserved... JRA. */
 230
 231                 prs_set_endian_data(&auth_req, rdata->bigendian_data);
 232
 233                 prs_give_memory(&auth_req, data, RPC_HDR_AUTH_LEN, False);
 234
 235                 /*
 236                  * Unmarshall the 8 byte auth_header that comes before the
 237                  * auth data.
 238                  */
 239
 240                 if(!smb_io_rpc_hdr_auth("hdr_auth", &rhdr_auth, &auth_req, 0)) {
 241                         DEBUG(0,("rpc_auth_pipe: unmarshalling RPC_HDR_AUTH failed.\n"));
 242                         return False;
 243                 }
 244
 245                 if (!rpc_hdr_auth_chk(&rhdr_auth)) {
 246                         DEBUG(0,("rpc_auth_pipe: rpc_hdr_auth_chk failed.\n"));
 247                         return False;
 248                 }
 249         }
 250
 251         /*
 252          * Now unseal and check the auth verifier in the auth_data at
 253          * then end of the packet. The 4 bytes skipped in the unseal
 254          * seem to be a buffer pointer preceeding the sealed data.
 255          */
 256
 257         if (auth_verify) {
 258                 RPC_AUTH_NTLMSSP_CHK chk;
 259                 uint32 crc32;
 260                 prs_struct auth_verf;
 261                 char data[RPC_AUTH_NTLMSSP_CHK_LEN];
 262                 char *dp = prs_data_p(rdata) + len - auth_len;
 263
 264                 if(dp - prs_data_p(rdata) > prs_data_size(rdata)) {
 265                         DEBUG(0,("rpc_auth_pipe: auth data > data size !\n"));
 266                         return False;
 267                 }
 268
 269                 DEBUG(10,("rpc_auth_pipe: verify\n"));
 270                 dump_data(100, dp, auth_len);
 271                 NTLMSSPcalc_ap(cli, (uchar*)(dp+4), auth_len - 4);
 272
 273                 memcpy(data, dp, RPC_AUTH_NTLMSSP_CHK_LEN);
 274                 dump_data(100, data, auth_len);
 275
 276                 prs_init(&auth_verf, 0, cli->mem_ctx, UNMARSHALL);
 277
 278                 /* The endinness must be preserved. JRA. */
 279                 prs_set_endian_data( &auth_verf, rdata->bigendian_data);
 280
 281                 prs_give_memory(&auth_verf, data, RPC_AUTH_NTLMSSP_CHK_LEN, False);
 282
 283                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &chk, &auth_verf, 0)) {
 284                         DEBUG(0,("rpc_auth_pipe: unmarshalling RPC_AUTH_NTLMSSP_CHK failed.\n"));
 285                         return False;
 286                 }
 287
 288                 crc32 = crc32_calc_buffer(reply_data, data_len);
 289
 290                 if (!rpc_auth_ntlmssp_chk(&chk, crc32 , cli->ntlmssp_seq_num)) {
 291                         DEBUG(0,("rpc_auth_pipe: rpc_auth_ntlmssp_chk failed.\n"));
 292                         return False;
 293                 }
 294                 cli->ntlmssp_seq_num++;
 295         }
 296         return True;
 297 }
 298
 299
 300 /****************************************************************************
 301  Send data on an rpc pipe, which *must* be in one fragment.
 302  receive response data from an rpc pipe, which may be large...
 303
 304  Read the first fragment: unfortunately have to use SMBtrans for the first
 305  bit, then SMBreadX for subsequent bits.
 306
 307  If first fragment received also wasn't the last fragment, continue
 308  getting fragments until we _do_ receive the last fragment.
 309
 310  Request/Response PDU's look like the following...
 311
 312  |<------------------PDU len----------------------------------------------->|
 313  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 314
 315  +------------+-----------------+-------------+---------------+-------------+
 316  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 317  +------------+-----------------+-------------+---------------+-------------+
 318
 319  Where the presence of the AUTH_HDR and AUTH are dependent on the
 320  signing & sealing being neogitated.
 321
 322  ****************************************************************************/
 323
 324 static BOOL rpc_api_pipe(struct cli_state *cli, uint16 cmd, prs_struct *data, prs_struct *rdata)
 325 {
 326         uint32 len;
 327         char *rparam = NULL;
 328         uint32 rparam_len = 0;
 329         uint16 setup[2];
 330         BOOL first = True;
 331         BOOL last  = True;
 332         RPC_HDR rhdr;
 333         char *pdata = data ? prs_data_p(data) : NULL;
 334         uint32 data_len = data ? prs_offset(data) : 0;
 335         char *prdata = NULL;
 336         uint32 rdata_len = 0;
 337         uint32 current_offset = 0;
 338
 339         /* Create setup parameters - must be in native byte order. */
 340
 341         setup[0] = cmd;
 342         setup[1] = cli->nt_pipe_fnum; /* Pipe file handle. */
 343
 344         DEBUG(5,("rpc_api_pipe: cmd:%x fnum:%x\n", (int)cmd,
 345                  (int)cli->nt_pipe_fnum));
 346
 347         /* Send the RPC request and receive a response.  For short RPC
 348            calls (about 1024 bytes or so) the RPC request and response
 349            appears in a SMBtrans request and response.  Larger RPC
 350            responses are received further on. */
 351
 352         if (!cli_api_pipe(cli, "\\PIPE\\",
 353                   setup, 2, 0,                     /* Setup, length, max */
 354                   NULL, 0, 0,                      /* Params, length, max */
 355                   pdata, data_len, data_len,       /* data, length, max */
 356                   &rparam, &rparam_len,            /* return params, len */
 357                   &prdata, &rdata_len))            /* return data, len */
 358         {
 359                 DEBUG(0, ("cli_pipe: return critical error. Error was %s\n", cli_errstr(cli)));
 360                 return False;
 361         }
 362
 363         /* Throw away returned params - we know we won't use them. */
 364
 365         SAFE_FREE(rparam);
 366
 367         if (prdata == NULL) {
 368                 DEBUG(0,("rpc_api_pipe: cmd %x on pipe %x failed to return data.\n",
 369                         (int)cmd, (int)cli->nt_pipe_fnum));
 370                 return False;
 371         }
 372
 373         /*
 374          * Give this memory as dynamically allocated to the return parse
 375          * struct.
 376          */
 377
 378         prs_give_memory(rdata, prdata, rdata_len, True);
 379         current_offset = rdata_len;
 380
 381         /* This next call sets the endian bit correctly in rdata. */
 382
 383         if (!rpc_check_hdr(rdata, &rhdr, &first, &last, &len)) {
 384                 prs_mem_free(rdata);
 385                 return False;
 386         }
 387
 388         if (rhdr.pkt_type == RPC_BINDACK) {
 389                 if (!last && !first) {
 390                         DEBUG(5,("rpc_api_pipe: bug in server (AS/U?), setting fragment first/last ON.\n"));
 391                         first = True;
 392                         last = True;
 393                 }
 394         }
 395
 396         if (rhdr.pkt_type == RPC_RESPONSE) {
 397                 RPC_HDR_RESP rhdr_resp;
 398                 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, rdata, 0)) {
 399                         DEBUG(5,("rpc_api_pipe: failed to unmarshal RPC_HDR_RESP.\n"));
 400                         prs_mem_free(rdata);
 401                         return False;
 402                 }
 403         }
 404
 405         DEBUG(5,("rpc_api_pipe: len left: %u smbtrans read: %u\n",
 406                   (unsigned int)len, (unsigned int)rdata_len ));
 407
 408         /* check if data to be sent back was too large for one SMBtrans */
 409         /* err status is only informational: the _real_ check is on the
 410            length */
 411
 412         if (len > 0) {
 413                 /* || err == (0x80000000 | STATUS_BUFFER_OVERFLOW)) */
 414
 415                 /* Read the remaining part of the first response fragment */
 416
 417                 if (!rpc_read(cli, rdata, len, &current_offset)) {
 418                         prs_mem_free(rdata);
 419                         return False;
 420                 }
 421         }
 422
 423         /*
 424          * Now we have a complete PDU, check the auth struct if any was sent.
 425          */
 426
 427         if (rhdr.auth_len != 0) {
 428                 if(!rpc_auth_pipe(cli, rdata, rhdr.frag_len, rhdr.auth_len))
 429                         return False;
 430                 /*
 431                  * Drop the auth footers from the current offset.
 432                  * We need this if there are more fragments.
 433                  * The auth footers consist of the auth_data and the
 434                  * preceeding 8 byte auth_header.
 435                  */
 436                 current_offset -= (rhdr.auth_len + RPC_HDR_AUTH_LEN);
 437         }
 438
 439         /*
 440          * Only one rpc fragment, and it has been read.
 441          */
 442
 443         if (first && last) {
 444                 DEBUG(6,("rpc_api_pipe: fragment first and last both set\n"));
 445                 return True;
 446         }
 447
 448         /*
 449          * Read more fragments using SMBreadX until we get one with the
 450          * last bit set.
 451          */
 452
 453         while (!last) {
 454                 RPC_HDR_RESP rhdr_resp;
 455                 int num_read;
 456                 char hdr_data[RPC_HEADER_LEN+RPC_HDR_RESP_LEN];
 457                 prs_struct hps;
 458                 uint8 eclass;
 459                 uint32 ecode;
 460
 461                 /*
 462                  * First read the header of the next PDU.
 463                  */
 464
 465                 prs_init(&hps, 0, cli->mem_ctx, UNMARSHALL);
 466                 prs_give_memory(&hps, hdr_data, sizeof(hdr_data), False);
 467
 468                 num_read = cli_read(cli, cli->nt_pipe_fnum, hdr_data, 0, RPC_HEADER_LEN+RPC_HDR_RESP_LEN);
 469                 if (cli_is_dos_error(cli)) {
 470                         cli_dos_error(cli, &eclass, &ecode);
 471                         if (eclass != ERRDOS && ecode != ERRmoredata) {
 472                                 DEBUG(0,("rpc_api_pipe: cli_read error : %d/%d\n", eclass, ecode));
 473                                 return False;
 474                         }
 475                 }
 476
 477                 DEBUG(5,("rpc_api_pipe: read header (size:%d)\n", num_read));
 478
 479                 if (num_read != RPC_HEADER_LEN+RPC_HDR_RESP_LEN) {
 480                         DEBUG(0,("rpc_api_pipe: Error : requested %d bytes, got %d.\n",
 481                                 RPC_HEADER_LEN+RPC_HDR_RESP_LEN, num_read ));
 482                         return False;
 483                 }
 484
 485                 /* This call sets the endianness in hps. */
 486
 487                 if (!rpc_check_hdr(&hps, &rhdr, &first, &last, &len))
 488                         return False;
 489
 490                 /* Ensure the endianness in rdata is set correctly - must be same as hps. */
 491
 492                 if (hps.bigendian_data != rdata->bigendian_data) {
 493                         DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to %s\n",
 494                                 rdata->bigendian_data ? "big" : "little",
 495                                 hps.bigendian_data ? "big" : "little" ));
 496                         return False;
 497                 }
 498
 499                 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, &hps, 0)) {
 500                         DEBUG(0,("rpc_api_pipe: Error in unmarshalling RPC_HDR_RESP.\n"));
 501                         return False;
 502                 }
 503
 504                 if (first) {
 505                         DEBUG(0,("rpc_api_pipe: secondary PDU rpc header has 'first' set !\n"));
 506                         return False;
 507                 }
 508
 509                 /*
 510                  * Now read the rest of the PDU.
 511                  */
 512
 513                 if (!rpc_read(cli, rdata, len, &current_offset))
 514                         return False;
 515
 516                 /*
 517                  * Verify any authentication footer.
 518                  */
 519
 520                 if (rhdr.auth_len != 0 ) {
 521                         if(!rpc_auth_pipe(cli, rdata, rhdr.frag_len, rhdr.auth_len))
 522                                 return False;
 523                         /*
 524                          * Drop the auth footers from the current offset.
 525                          * The auth footers consist of the auth_data and the
 526                          * preceeding 8 byte auth_header.
 527                          * We need this if there are more fragments.
 528                          */
 529                         current_offset -= (rhdr.auth_len + RPC_HDR_AUTH_LEN);
 530                 }
 531         }
 532
 533         return True;
 534 }
 535
 536 /*******************************************************************
 537  creates a DCE/RPC bind request
 538
 539  - initialises the parse structure.
 540  - dynamically allocates the header data structure
 541  - caller is expected to free the header data structure once used.
 542
 543  ********************************************************************/
 544
 545 static BOOL create_rpc_bind_req(prs_struct *rpc_out, BOOL do_auth, uint32 rpc_call_id,
 546                                 RPC_IFACE *abstract, RPC_IFACE *transfer,
 547                                 char *my_name, char *domain, uint32 neg_flags)
 548 {
 549         RPC_HDR hdr;
 550         RPC_HDR_RB hdr_rb;
 551         char buffer[4096];
 552         prs_struct auth_info;
 553         int auth_len = 0;
 554
 555         prs_init(&auth_info, 0, prs_get_mem_context(rpc_out), MARSHALL);
 556
 557         if (do_auth) {
 558                 RPC_HDR_AUTH hdr_auth;
 559                 RPC_AUTH_VERIFIER auth_verifier;
 560                 RPC_AUTH_NTLMSSP_NEG ntlmssp_neg;
 561
 562                 /*
 563                  * Create the auth structs we will marshall.
 564                  */
 565
 566                 init_rpc_hdr_auth(&hdr_auth, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, 0x00, 1);
 567                 init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_NEGOTIATE);
 568                 init_rpc_auth_ntlmssp_neg(&ntlmssp_neg, neg_flags, my_name, domain);
 569
 570                 /*
 571                  * Use the 4k buffer to store the auth info.
 572                  */
 573
 574                 prs_give_memory( &auth_info, buffer, sizeof(buffer), False);
 575
 576                 /*
 577                  * Now marshall the data into the temporary parse_struct.
 578                  */
 579
 580                 if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &auth_info, 0)) {
 581                         DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR_AUTH.\n"));
 582                         return False;
 583                 }
 584
 585                 if(!smb_io_rpc_auth_verifier("auth_verifier", &auth_verifier, &auth_info, 0)) {
 586                         DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_AUTH_VERIFIER.\n"));
 587                         return False;
 588                 }
 589
 590                 if(!smb_io_rpc_auth_ntlmssp_neg("ntlmssp_neg", &ntlmssp_neg, &auth_info, 0)) {
 591                         DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_AUTH_NTLMSSP_NEG.\n"));
 592                         return False;
 593                 }
 594
 595                 /* Auth len in the rpc header doesn't include auth_header. */
 596                 auth_len = prs_offset(&auth_info) - RPC_HDR_AUTH_LEN;
 597         }
 598
 599         /* create the request RPC_HDR */
 600         init_rpc_hdr(&hdr, RPC_BIND, 0x0, rpc_call_id,
 601                 RPC_HEADER_LEN + RPC_HDR_RB_LEN + prs_offset(&auth_info),
 602                 auth_len);
 603
 604         if(!smb_io_rpc_hdr("hdr"   , &hdr, rpc_out, 0)) {
 605                 DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR.\n"));
 606                 return False;
 607         }
 608
 609         /* create the bind request RPC_HDR_RB */
 610         init_rpc_hdr_rb(&hdr_rb, MAX_PDU_FRAG_LEN, MAX_PDU_FRAG_LEN, 0x0,
 611                         0x1, 0x0, 0x1, abstract, transfer);
 612
 613         /* Marshall the bind request data */
 614         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_out, 0)) {
 615                 DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR_RB.\n"));
 616                 return False;
 617         }
 618
 619         /*
 620          * Grow the outgoing buffer to store any auth info.
 621          */
 622
 623         if(hdr.auth_len != 0) {
 624                 if(!prs_append_prs_data( rpc_out, &auth_info)) {
 625                         DEBUG(0,("create_rpc_bind_req: failed to grow parse struct to add auth.\n"));
 626                         return False;
 627                 }
 628         }
 629
 630         return True;
 631 }
 632
 633 /*******************************************************************
 634  Creates a DCE/RPC bind authentication response.
 635  This is the packet that is sent back to the server once we
 636  have received a BIND-ACK, to finish the third leg of
 637  the authentication handshake.
 638  ********************************************************************/
 639
 640 static BOOL create_rpc_bind_resp(struct pwd_info *pwd,
 641                                 char *domain, char *user_name, char *my_name,
 642                                 uint32 ntlmssp_cli_flgs,
 643                                 uint32 rpc_call_id,
 644                                 prs_struct *rpc_out)
 645 {
 646         unsigned char lm_owf[24];
 647         unsigned char nt_owf[24];
 648         RPC_HDR hdr;
 649         RPC_HDR_AUTHA hdr_autha;
 650         RPC_AUTH_VERIFIER auth_verifier;
 651         RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 652         char buffer[4096];
 653         prs_struct auth_info;
 654
 655         /*
 656          * Marshall the variable length data into a temporary parse
 657          * struct, pointing into a 4k local buffer.
 658          */
 659         prs_init(&auth_info, 0, prs_get_mem_context(rpc_out), MARSHALL);
 660
 661         /*
 662          * Use the 4k buffer to store the auth info.
 663          */
 664
 665         prs_give_memory( &auth_info, buffer, sizeof(buffer), False);
 666
 667         /*
 668          * Create the variable length auth_data.
 669          */
 670
 671         init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH);
 672
 673         pwd_get_lm_nt_owf(pwd, lm_owf, nt_owf);
 674
 675         init_rpc_auth_ntlmssp_resp(&ntlmssp_resp,
 676                                  lm_owf, nt_owf,
 677                                  domain, user_name, my_name,
 678                                  ntlmssp_cli_flgs);
 679
 680         /*
 681          * Marshall the variable length auth_data into a temp parse_struct.
 682          */
 683
 684         if(!smb_io_rpc_auth_verifier("auth_verifier", &auth_verifier, &auth_info, 0)) {
 685                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_AUTH_VERIFIER.\n"));
 686                 return False;
 687         }
 688
 689         if(!smb_io_rpc_auth_ntlmssp_resp("ntlmssp_resp", &ntlmssp_resp, &auth_info, 0)) {
 690                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_AUTH_NTLMSSP_RESP.\n"));
 691                 return False;
 692         }
 693
 694         /* Create the request RPC_HDR */
 695         init_rpc_hdr(&hdr, RPC_BINDRESP, 0x0, rpc_call_id,
 696                         RPC_HEADER_LEN + RPC_HDR_AUTHA_LEN + prs_offset(&auth_info),
 697                         prs_offset(&auth_info) );
 698
 699         /* Marshall it. */
 700         if(!smb_io_rpc_hdr("hdr", &hdr, rpc_out, 0)) {
 701                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_HDR.\n"));
 702                 return False;
 703         }
 704
 705         /* Create the request RPC_HDR_AUTHA */
 706         init_rpc_hdr_autha(&hdr_autha, MAX_PDU_FRAG_LEN, MAX_PDU_FRAG_LEN,
 707                         NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, 0x00);
 708
 709         if(!smb_io_rpc_hdr_autha("hdr_autha", &hdr_autha, rpc_out, 0)) {
 710                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_HDR_AUTHA.\n"));
 711                 return False;
 712         }
 713
 714         /*
 715          * Append the auth data to the outgoing buffer.
 716          */
 717
 718         if(!prs_append_prs_data(rpc_out, &auth_info)) {
 719                 DEBUG(0,("create_rpc_bind_req: failed to grow parse struct to add auth.\n"));
 720                 return False;
 721         }
 722
 723         return True;
 724 }
 725
 726
 727 /*******************************************************************
 728  Creates a DCE/RPC request.
 729  ********************************************************************/
 730
 731 static BOOL create_rpc_request(prs_struct *rpc_out, uint8 op_num, int data_len, int auth_len)
 732 {
 733         uint32 alloc_hint;
 734         RPC_HDR     hdr;
 735         RPC_HDR_REQ hdr_req;
 736
 737         DEBUG(5,("create_rpc_request: opnum: 0x%x data_len: 0x%x\n", op_num, data_len));
 738
 739         /* create the rpc header RPC_HDR */
 740         init_rpc_hdr(&hdr, RPC_REQUEST, RPC_FLG_FIRST | RPC_FLG_LAST,
 741                      get_rpc_call_id(), data_len, auth_len);
 742
 743         /*
 744          * The alloc hint should be the amount of data, not including
 745          * RPC headers & footers.
 746          */
 747
 748         if (auth_len != 0)
 749                 alloc_hint = data_len - RPC_HEADER_LEN - RPC_HDR_AUTH_LEN - auth_len;
 750         else
 751                 alloc_hint = data_len - RPC_HEADER_LEN;
 752
 753         DEBUG(10,("create_rpc_request: data_len: %x auth_len: %x alloc_hint: %x\n",
 754                    data_len, auth_len, alloc_hint));
 755
 756         /* Create the rpc request RPC_HDR_REQ */
 757         init_rpc_hdr_req(&hdr_req, alloc_hint, op_num);
 758
 759         /* stream-time... */
 760         if(!smb_io_rpc_hdr("hdr    ", &hdr, rpc_out, 0))
 761                 return False;
 762
 763         if(!smb_io_rpc_hdr_req("hdr_req", &hdr_req, rpc_out, 0))
 764                 return False;
 765
 766         if (prs_offset(rpc_out) != RPC_HEADER_LEN + RPC_HDR_REQ_LEN)
 767                 return False;
 768
 769         return True;
 770 }
 771
 772
 773 /****************************************************************************
 774  Send a request on an rpc pipe.
 775  ****************************************************************************/
 776
 777 BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num,
 778                       prs_struct *data, prs_struct *rdata)
 779 {
 780         prs_struct outgoing_packet;
 781         uint32 data_len;
 782         uint32 auth_len;
 783         BOOL ret;
 784         BOOL auth_verify;
 785         BOOL auth_seal;
 786         uint32 crc32 = 0;
 787         char *pdata_out = NULL;
 788
 789         auth_verify = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SIGN) != 0);
 790         auth_seal   = ((cli->ntlmssp_srv_flgs & NTLMSSP_NEGOTIATE_SEAL) != 0);
 791
 792         /*
 793          * The auth_len doesn't include the RPC_HDR_AUTH_LEN.
 794          */
 795
 796         auth_len = (auth_verify ? RPC_AUTH_NTLMSSP_CHK_LEN : 0);
 797
 798         /*
 799          * PDU len is header, plus request header, plus data, plus
 800          * auth_header_len (if present), plus auth_len (if present).
 801          * NB. The auth stuff should be aligned on an 8 byte boundary
 802          * to be totally DCE/RPC spec complient. For now we cheat and
 803          * hope that the data structs defined are a multiple of 8 bytes.
 804          */
 805
 806         if((prs_offset(data) % 8) != 0) {
 807                 DEBUG(5,("rpc_api_pipe_req: Outgoing data not a multiple of 8 bytes....\n"));
 808         }
 809
 810         data_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + prs_offset(data) +
 811                         (auth_verify ? RPC_HDR_AUTH_LEN : 0) + auth_len;
 812
 813         /*
 814          * Malloc a parse struct to hold it (and enough for alignments).
 815          */
 816
 817         if(!prs_init(&outgoing_packet, data_len + 8, cli->mem_ctx, MARSHALL)) {
 818                 DEBUG(0,("rpc_api_pipe_req: Failed to malloc %u bytes.\n", (unsigned int)data_len ));
 819                 return False;
 820         }
 821
 822         pdata_out = prs_data_p(&outgoing_packet);
 823
 824         /*
 825          * Write out the RPC header and the request header.
 826          */
 827
 828         if(!create_rpc_request(&outgoing_packet, op_num, data_len, auth_len)) {
 829                 DEBUG(0,("rpc_api_pipe_req: Failed to create RPC request.\n"));
 830                 prs_mem_free(&outgoing_packet);
 831                 return False;
 832         }
 833
 834         /*
 835          * Seal the outgoing data if requested.
 836          */
 837
 838         if (auth_seal) {
 839                 crc32 = crc32_calc_buffer(prs_data_p(data), prs_offset(data));
 840                 NTLMSSPcalc_ap(cli, (unsigned char*)prs_data_p(data), prs_offset(data));
 841         }
 842
 843         /*
 844          * Now copy the data into the outgoing packet.
 845          */
 846
 847         if(!prs_append_prs_data( &outgoing_packet, data)) {
 848                 DEBUG(0,("rpc_api_pipe_req: Failed to append data to outgoing packet.\n"));
 849                 prs_mem_free(&outgoing_packet);
 850                 return False;
 851         }
 852
 853         /*
 854          * Add a trailing auth_verifier if needed.
 855          */
 856
 857         if (auth_seal || auth_verify) {
 858                 RPC_HDR_AUTH hdr_auth;
 859
 860                 init_rpc_hdr_auth(&hdr_auth, NTLMSSP_AUTH_TYPE,
 861                         NTLMSSP_AUTH_LEVEL, 0x08, (auth_verify ? 1 : 0));
 862                 if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &outgoing_packet, 0)) {
 863                         DEBUG(0,("rpc_api_pipe_req: Failed to marshal RPC_HDR_AUTH.\n"));
 864                         prs_mem_free(&outgoing_packet);
 865                         return False;
 866                 }
 867         }
 868
 869         /*
 870          * Finally the auth data itself.
 871          */
 872
 873         if (auth_verify) {
 874                 RPC_AUTH_NTLMSSP_CHK chk;
 875                 uint32 current_offset = prs_offset(&outgoing_packet);
 876
 877                 init_rpc_auth_ntlmssp_chk(&chk, NTLMSSP_SIGN_VERSION, crc32, cli->ntlmssp_seq_num++);
 878                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &chk, &outgoing_packet, 0)) {
 879                         DEBUG(0,("rpc_api_pipe_req: Failed to marshal RPC_AUTH_NTLMSSP_CHK.\n"));
 880                         prs_mem_free(&outgoing_packet);
 881                         return False;
 882                 }
 883                 NTLMSSPcalc_ap(cli, (unsigned char*)&pdata_out[current_offset+4], RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 884         }
 885
 886         DEBUG(100,("data_len: %x data_calc_len: %x\n", data_len, prs_offset(&outgoing_packet)));
 887
 888         ret = rpc_api_pipe(cli, 0x0026, &outgoing_packet, rdata);
 889
 890         prs_mem_free(&outgoing_packet);
 891
 892         return ret;
 893 }
 894
 895 /****************************************************************************
 896  Set the handle state.
 897 ****************************************************************************/
 898
 899 static BOOL rpc_pipe_set_hnd_state(struct cli_state *cli, char *pipe_name, uint16 device_state)
 900 {
 901         BOOL state_set = False;
 902         char param[2];
 903         uint16 setup[2]; /* only need 2 uint16 setup parameters */
 904         char *rparam = NULL;
 905         char *rdata = NULL;
 906         uint32 rparam_len, rdata_len;
 907
 908         if (pipe_name == NULL)
 909                 return False;
 910
 911         DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
 912         cli->nt_pipe_fnum, pipe_name, device_state));
 913
 914         /* create parameters: device state */
 915         SSVAL(param, 0, device_state);
 916
 917         /* create setup parameters. */
 918         setup[0] = 0x0001;
 919         setup[1] = cli->nt_pipe_fnum; /* pipe file handle.  got this from an SMBOpenX. */
 920
 921         /* send the data on \PIPE\ */
 922         if (cli_api_pipe(cli, "\\PIPE\\",
 923                     setup, 2, 0,                /* setup, length, max */
 924                     param, 2, 0,                /* param, length, max */
 925                     NULL, 0, 1024,              /* data, length, max */
 926                     &rparam, &rparam_len,        /* return param, length */
 927                     &rdata, &rdata_len))         /* return data, length */
 928         {
 929                 DEBUG(5, ("Set Handle state: return OK\n"));
 930                 state_set = True;
 931         }
 932
 933         SAFE_FREE(rparam);
 934         SAFE_FREE(rdata);
 935
 936         return state_set;
 937 }
 938
 939 /****************************************************************************
 940  check the rpc bind acknowledge response
 941 ****************************************************************************/
 942
 943 static BOOL valid_pipe_name(char *pipe_name, RPC_IFACE *abstract, RPC_IFACE *transfer)
 944 {
 945         int pipe_idx = 0;
 946
 947         while (pipe_names[pipe_idx].client_pipe != NULL) {
 948                 if (strequal(pipe_name, pipe_names[pipe_idx].client_pipe )) {
 949                         DEBUG(5,("Bind Abstract Syntax: "));
 950                         dump_data(5, (char*)&(pipe_names[pipe_idx].abstr_syntax),
 951                                   sizeof(pipe_names[pipe_idx].abstr_syntax));
 952                         DEBUG(5,("Bind Transfer Syntax: "));
 953                         dump_data(5, (char*)&(pipe_names[pipe_idx].trans_syntax),
 954                                   sizeof(pipe_names[pipe_idx].trans_syntax));
 955
 956                         /* copy the required syntaxes out so we can do the right bind */
 957                         *transfer = pipe_names[pipe_idx].trans_syntax;
 958                         *abstract = pipe_names[pipe_idx].abstr_syntax;
 959
 960                         return True;
 961                 }
 962                 pipe_idx++;
 963         };
 964
 965         DEBUG(5,("Bind RPC Pipe[%s] unsupported\n", pipe_name));
 966         return False;
 967 }
 968
 969 /****************************************************************************
 970  check the rpc bind acknowledge response
 971 ****************************************************************************/
 972
 973 static BOOL check_bind_response(RPC_HDR_BA *hdr_ba, char *pipe_name, RPC_IFACE *transfer)
 974 {
 975         int i = 0;
 976
 977         while ((pipe_names[i].client_pipe != NULL) && hdr_ba->addr.len > 0) {
 978                 if ((strequal(pipe_name, pipe_names[i].client_pipe ))) {
 979                         if (strequal(hdr_ba->addr.str, pipe_names[i].server_pipe )) {
 980                                 DEBUG(5,("bind_rpc_pipe: server pipe_name found: %s\n",
 981                                          pipe_names[i].server_pipe ));
 982                                 break;
 983                         } else {
 984                                 DEBUG(4,("bind_rpc_pipe: pipe_name %s != expected pipe %s.  oh well!\n",
 985                                          pipe_names[i].server_pipe ,
 986                                          hdr_ba->addr.str));
 987                                 break;
 988                         }
 989                 } else {
 990                         i++;
 991                 }
 992         }
 993
 994         if (pipe_names[i].server_pipe == NULL) {
 995                 DEBUG(2,("bind_rpc_pipe: pipe name %s unsupported\n", hdr_ba->addr.str));
 996                 return False;
 997         }
 998
 999         /* check the transfer syntax */
1000         if ((hdr_ba->transfer.version != transfer->version) ||
1001              (memcmp(&hdr_ba->transfer.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1002                 DEBUG(0,("bind_rpc_pipe: transfer syntax differs\n"));
1003                 return False;
1004         }
1005
1006         /* lkclXXXX only accept one result: check the result(s) */
1007         if (hdr_ba->res.num_results != 0x1 || hdr_ba->res.result != 0) {
1008                 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1009                           hdr_ba->res.num_results, hdr_ba->res.reason));
1010         }
1011
1012         DEBUG(5,("bind_rpc_pipe: accepted!\n"));
1013         return True;
1014 }
1015
1016 /****************************************************************************
1017  Create and send the third packet in an RPC auth.
1018 ****************************************************************************/
1019
1020 static BOOL rpc_send_auth_reply(struct cli_state *cli, prs_struct *rdata, uint32 rpc_call_id)
1021 {
1022         RPC_HDR_AUTH rhdr_auth;
1023         RPC_AUTH_VERIFIER rhdr_verf;
1024         RPC_AUTH_NTLMSSP_CHAL rhdr_chal;
1025         char buffer[MAX_PDU_FRAG_LEN];
1026         prs_struct rpc_out;
1027         ssize_t ret;
1028
1029         unsigned char p24[24];
1030         unsigned char lm_owf[24];
1031         unsigned char lm_hash[16];
1032
1033         if(!smb_io_rpc_hdr_auth("", &rhdr_auth, rdata, 0)) {
1034                 DEBUG(0,("rpc_send_auth_reply: Failed to unmarshall RPC_HDR_AUTH.\n"));
1035                 return False;
1036         }
1037         if(!smb_io_rpc_auth_verifier("", &rhdr_verf, rdata, 0)) {
1038                 DEBUG(0,("rpc_send_auth_reply: Failed to unmarshall RPC_AUTH_VERIFIER.\n"));
1039                 return False;
1040         }
1041         if(!smb_io_rpc_auth_ntlmssp_chal("", &rhdr_chal, rdata, 0)) {
1042                 DEBUG(0,("rpc_send_auth_reply: Failed to unmarshall RPC_AUTH_NTLMSSP_CHAL.\n"));
1043                 return False;
1044         }
1045
1046         cli->ntlmssp_cli_flgs = rhdr_chal.neg_flags;
1047
1048         pwd_make_lm_nt_owf(&cli->pwd, rhdr_chal.challenge);
1049
1050         prs_init(&rpc_out, 0, cli->mem_ctx, MARSHALL);
1051
1052         prs_give_memory( &rpc_out, buffer, sizeof(buffer), False);
1053
1054         create_rpc_bind_resp(&cli->pwd, cli->domain,
1055                              cli->user_name, global_myname,
1056                              cli->ntlmssp_cli_flgs, rpc_call_id,
1057                              &rpc_out);
1058
1059         pwd_get_lm_nt_owf(&cli->pwd, lm_owf, NULL);
1060         pwd_get_lm_nt_16(&cli->pwd, lm_hash, NULL);
1061
1062         NTLMSSPOWFencrypt(lm_hash, lm_owf, p24);
1063
1064         {
1065                 unsigned char j = 0;
1066                 int ind;
1067                 unsigned char k2[8];
1068
1069                 memcpy(k2, p24, 5);
1070                 k2[5] = 0xe5;
1071                 k2[6] = 0x38;
1072                 k2[7] = 0xb0;
1073
1074                 for (ind = 0; ind < 256; ind++)
1075                         cli->ntlmssp_hash[ind] = (unsigned char)ind;
1076
1077                 for( ind = 0; ind < 256; ind++) {
1078                         unsigned char tc;
1079
1080                         j += (cli->ntlmssp_hash[ind] + k2[ind%8]);
1081
1082                         tc = cli->ntlmssp_hash[ind];
1083                         cli->ntlmssp_hash[ind] = cli->ntlmssp_hash[j];
1084                         cli->ntlmssp_hash[j] = tc;
1085                 }
1086
1087                 cli->ntlmssp_hash[256] = 0;
1088                 cli->ntlmssp_hash[257] = 0;
1089         }
1090
1091         memset((char *)lm_hash, '\0', sizeof(lm_hash));
1092
1093         if ((ret = cli_write(cli, cli->nt_pipe_fnum, 0x8, prs_data_p(&rpc_out),
1094                         0, (size_t)prs_offset(&rpc_out))) != (ssize_t)prs_offset(&rpc_out)) {
1095                 DEBUG(0,("rpc_send_auth_reply: cli_write failed. Return was %d\n", (int)ret));
1096                 return False;
1097         }
1098
1099         cli->ntlmssp_srv_flgs = rhdr_chal.neg_flags;
1100         return True;
1101 }
1102
1103 /****************************************************************************
1104  Do an rpc bind.
1105 ****************************************************************************/
1106
1107 BOOL rpc_pipe_bind(struct cli_state *cli, char *pipe_name, char *my_name)
1108 {
1109         RPC_IFACE abstract;
1110         RPC_IFACE transfer;
1111         prs_struct rpc_out;
1112         prs_struct rdata;
1113         BOOL do_auth = (cli->ntlmssp_cli_flgs != 0);
1114         uint32 rpc_call_id;
1115         char buffer[MAX_PDU_FRAG_LEN];
1116
1117         DEBUG(5,("Bind RPC Pipe[%x]: %s\n", cli->nt_pipe_fnum, pipe_name));
1118
1119         if (!valid_pipe_name(pipe_name, &abstract, &transfer))
1120                 return False;
1121
1122         prs_init(&rpc_out, 0, cli->mem_ctx, MARSHALL);
1123
1124         /*
1125          * Use the MAX_PDU_FRAG_LEN buffer to store the bind request.
1126          */
1127
1128         prs_give_memory( &rpc_out, buffer, sizeof(buffer), False);
1129
1130         rpc_call_id = get_rpc_call_id();
1131
1132         /* Marshall the outgoing data. */
1133         create_rpc_bind_req(&rpc_out, do_auth, rpc_call_id,
1134                             &abstract, &transfer,
1135                             global_myname, cli->domain, cli->ntlmssp_cli_flgs);
1136
1137         /* Initialize the incoming data struct. */
1138         prs_init(&rdata, 0, cli->mem_ctx, UNMARSHALL);
1139
1140         /* send data on \PIPE\.  receive a response */
1141         if (rpc_api_pipe(cli, 0x0026, &rpc_out, &rdata)) {
1142                 RPC_HDR_BA   hdr_ba;
1143
1144                 DEBUG(5, ("rpc_pipe_bind: rpc_api_pipe returned OK.\n"));
1145
1146                 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &rdata, 0)) {
1147                         DEBUG(0,("rpc_pipe_bind: Failed to unmarshall RPC_HDR_BA.\n"));
1148                         prs_mem_free(&rdata);
1149                         return False;
1150                 }
1151
1152                 if(!check_bind_response(&hdr_ba, pipe_name, &transfer)) {
1153                         DEBUG(0,("rpc_pipe_bind: check_bind_response failed.\n"));
1154                         prs_mem_free(&rdata);
1155                         return False;
1156                 }
1157
1158                 cli->max_xmit_frag = hdr_ba.bba.max_tsize;
1159                 cli->max_recv_frag = hdr_ba.bba.max_rsize;
1160
1161                 /*
1162                  * If we're doing NTLMSSP auth we need to send a reply to
1163                  * the bind-ack to complete the 3-way challenge response
1164                  * handshake.
1165                  */
1166
1167                 if (do_auth && !rpc_send_auth_reply(cli, &rdata, rpc_call_id)) {
1168                         DEBUG(0,("rpc_pipe_bind: rpc_send_auth_reply failed.\n"));
1169                         prs_mem_free(&rdata);
1170                         return False;
1171                 }
1172         }
1173
1174         prs_mem_free(&rdata);
1175         return True;
1176 }
1177
1178 /****************************************************************************
1179  Set ntlmssp negotiation flags.
1180  ****************************************************************************/
1181
1182 void cli_nt_set_ntlmssp_flgs(struct cli_state *cli, uint32 ntlmssp_flgs)
1183 {
1184         cli->ntlmssp_cli_flgs = ntlmssp_flgs;
1185 }
1186
1187
1188 /****************************************************************************
1189  Open a session.
1190  ****************************************************************************/
1191
1192 BOOL cli_nt_session_open(struct cli_state *cli, char *pipe_name)
1193 {
1194         int fnum;
1195
1196         SMB_ASSERT(cli->nt_pipe_fnum == 0);
1197
1198         if (cli->capabilities & CAP_NT_SMBS) {
1199                 if ((fnum = cli_nt_create(cli, &(pipe_name[5]), DESIRED_ACCESS_PIPE)) == -1) {
1200                         DEBUG(0,("cli_nt_session_open: cli_nt_create failed on pipe %s to machine %s.  Error was %s\n",
1201                                  &(pipe_name[5]), cli->desthost, cli_errstr(cli)));
1202                         return False;
1203                 }
1204
1205                 cli->nt_pipe_fnum = (uint16)fnum;
1206         } else {
1207                 if ((fnum = cli_open(cli, pipe_name, O_CREAT|O_RDWR, DENY_NONE)) == -1) {
1208                         DEBUG(0,("cli_nt_session_open: cli_open failed on pipe %s to machine %s.  Error was %s\n",
1209                                  pipe_name, cli->desthost, cli_errstr(cli)));
1210                         return False;
1211                 }
1212
1213                 cli->nt_pipe_fnum = (uint16)fnum;
1214
1215                 /**************** Set Named Pipe State ***************/
1216                 if (!rpc_pipe_set_hnd_state(cli, pipe_name, 0x4300)) {
1217                         DEBUG(0,("cli_nt_session_open: pipe hnd state failed.  Error was %s\n",
1218                                   cli_errstr(cli)));
1219                         cli_close(cli, cli->nt_pipe_fnum);
1220                         return False;
1221                 }
1222         }
1223
1224         /******************* bind request on pipe *****************/
1225
1226         if (!rpc_pipe_bind(cli, pipe_name, global_myname)) {
1227                 DEBUG(0,("cli_nt_session_open: rpc bind failed. Error was %s\n",
1228                           cli_errstr(cli)));
1229                 cli_close(cli, cli->nt_pipe_fnum);
1230                 return False;
1231         }
1232
1233         /*
1234          * Setup the remote server name prefixed by \ and the machine account name.
1235          */
1236
1237         fstrcpy(cli->srv_name_slash, "\\\\");
1238         fstrcat(cli->srv_name_slash, cli->desthost);
1239         strupper(cli->srv_name_slash);
1240
1241         fstrcpy(cli->clnt_name_slash, "\\\\");
1242         fstrcat(cli->clnt_name_slash, global_myname);
1243         strupper(cli->clnt_name_slash);
1244
1245         fstrcpy(cli->mach_acct, global_myname);
1246         fstrcat(cli->mach_acct, "$");
1247         strupper(cli->mach_acct);
1248
1249         return True;
1250 }
1251
1252 /****************************************************************************
1253 close the session
1254 ****************************************************************************/
1255
1256 void cli_nt_session_close(struct cli_state *cli)
1257 {
1258         cli_close(cli, cli->nt_pipe_fnum);
1259         cli->nt_pipe_fnum = 0;
1260 }