source3/rpc_client/cli_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1998,
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   6  *  Copyright (C) Paul Ashton                       1998.
   7  *  Copyright (C) Jeremy Allison                    1999.
   8  *
   9  *  This program is free software; you can redistribute it and/or modify
  10  *  it under the terms of the GNU General Public License as published by
  11  *  the Free Software Foundation; either version 2 of the License, or
  12  *  (at your option) any later version.
  13  *
  14  *  This program is distributed in the hope that it will be useful,
  15  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  *  GNU General Public License for more details.
  18  *
  19  *  You should have received a copy of the GNU General Public License
  20  *  along with this program; if not, write to the Free Software
  21  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  22  */
  23
  24 #include "includes.h"
  25
  26 #undef DBGC_CLASS
  27 #define DBGC_CLASS DBGC_RPC_CLI
  28
  29 extern struct pipe_id_info pipe_names[];
  30
  31 static void get_auth_type_level(int pipe_auth_flags, int *auth_type, int *auth_level)
  32 {
  33         *auth_type = 0;
  34         *auth_level = 0;
  35         if (pipe_auth_flags & AUTH_PIPE_SEAL) {
  36                 *auth_level = RPC_PIPE_AUTH_SEAL_LEVEL;
  37         } else if (pipe_auth_flags & AUTH_PIPE_SIGN) {
  38                 *auth_level = RPC_PIPE_AUTH_SIGN_LEVEL;
  39         }
  40
  41         if (pipe_auth_flags & AUTH_PIPE_NETSEC) {
  42                 *auth_type = NETSEC_AUTH_TYPE;
  43         } else if (pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
  44                 *auth_type = NTLMSSP_AUTH_TYPE;
  45         }
  46 }
  47
  48 /********************************************************************
  49  Rpc pipe call id.
  50  ********************************************************************/
  51
  52 static uint32 get_rpc_call_id(void)
  53 {
  54         static uint32 call_id = 0;
  55         return ++call_id;
  56 }
  57
  58 /*******************************************************************
  59  Use SMBreadX to get rest of one fragment's worth of rpc data.
  60  ********************************************************************/
  61
  62 static BOOL rpc_read(struct cli_state *cli, prs_struct *rdata, uint32 data_to_read, uint32 *rdata_offset)
  63 {
  64         size_t size = (size_t)cli->max_recv_frag;
  65         int stream_offset = 0;
  66         int num_read;
  67         char *pdata;
  68         int extra_data_size = ((int)*rdata_offset) + ((int)data_to_read) - (int)prs_data_size(rdata);
  69
  70         DEBUG(5,("rpc_read: data_to_read: %u rdata offset: %u extra_data_size: %d\n",
  71                 (int)data_to_read, (unsigned int)*rdata_offset, extra_data_size));
  72
  73         /*
  74          * Grow the buffer if needed to accommodate the data to be read.
  75          */
  76
  77         if (extra_data_size > 0) {
  78                 if(!prs_force_grow(rdata, (uint32)extra_data_size)) {
  79                         DEBUG(0,("rpc_read: Failed to grow parse struct by %d bytes.\n", extra_data_size ));
  80                         return False;
  81                 }
  82                 DEBUG(5,("rpc_read: grew buffer by %d bytes to %u\n", extra_data_size, prs_data_size(rdata) ));
  83         }
  84
  85         pdata = prs_data_p(rdata) + *rdata_offset;
  86
  87         do /* read data using SMBreadX */
  88         {
  89                 uint32 ecode;
  90                 uint8 eclass;
  91
  92                 if (size > (size_t)data_to_read)
  93                         size = (size_t)data_to_read;
  94
  95                 num_read = (int)cli_read(cli, cli->nt_pipe_fnum, pdata, (off_t)stream_offset, size);
  96
  97                 DEBUG(5,("rpc_read: num_read = %d, read offset: %d, to read: %d\n",
  98                           num_read, stream_offset, data_to_read));
  99
 100                 if (cli_is_dos_error(cli)) {
 101                         cli_dos_error(cli, &eclass, &ecode);
 102                         if (eclass != ERRDOS && ecode != ERRmoredata) {
 103                                 DEBUG(0,("rpc_read: Error %d/%u in cli_read\n",
 104                                          eclass, (unsigned int)ecode));
 105                                 return False;
 106                         }
 107                 }
 108
 109                 data_to_read -= num_read;
 110                 stream_offset += num_read;
 111                 pdata += num_read;
 112
 113         } while (num_read > 0 && data_to_read > 0);
 114         /* && err == (0x80000000 | STATUS_BUFFER_OVERFLOW)); */
 115
 116         /*
 117          * Update the current offset into rdata by the amount read.
 118          */
 119         *rdata_offset += stream_offset;
 120
 121         return True;
 122 }
 123
 124 /****************************************************************************
 125  Checks the header. This will set the endian bit in the rdata prs_struct. JRA.
 126  ****************************************************************************/
 127
 128 static BOOL rpc_check_hdr(prs_struct *rdata, RPC_HDR *rhdr,
 129                           BOOL *first, BOOL *last, uint32 *len)
 130 {
 131         DEBUG(5,("rpc_check_hdr: rdata->data_size = %u\n", (uint32)prs_data_size(rdata) ));
 132
 133         /* Next call sets endian bit. */
 134
 135         if(!smb_io_rpc_hdr("rpc_hdr   ", rhdr, rdata, 0)) {
 136                 DEBUG(0,("rpc_check_hdr: Failed to unmarshall RPC_HDR.\n"));
 137                 return False;
 138         }
 139
 140         if (prs_offset(rdata) != RPC_HEADER_LEN) {
 141                 DEBUG(0,("rpc_check_hdr: offset was %x, should be %x.\n", prs_offset(rdata), RPC_HEADER_LEN));
 142                 return False;
 143         }
 144
 145         (*first) = ((rhdr->flags & RPC_FLG_FIRST) != 0);
 146         (*last) = ((rhdr->flags & RPC_FLG_LAST ) != 0);
 147         (*len) = (uint32)rhdr->frag_len - prs_data_size(rdata);
 148
 149         return (rhdr->pkt_type != RPC_FAULT);
 150 }
 151
 152 /****************************************************************************
 153  Verify data on an rpc pipe.
 154  The VERIFY & SEAL code is only executed on packets that look like this :
 155
 156  Request/Response PDU's look like the following...
 157
 158  |<------------------PDU len----------------------------------------------->|
 159  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 160
 161  +------------+-----------------+-------------+---------------+-------------+
 162  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 163  +------------+-----------------+-------------+---------------+-------------+
 164
 165  Never on bind requests/responses.
 166  ****************************************************************************/
 167
 168 static BOOL rpc_auth_pipe(struct cli_state *cli, prs_struct *rdata,
 169                           uint32 fragment_start, int len, int auth_len, uint8 pkt_type,
 170                           int *pauth_padding_len)
 171 {
 172
 173         /*
 174          * The following is that length of the data we must sign or seal.
 175          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
 176          * preceeding the auth_data.
 177          */
 178
 179         int data_len = len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - auth_len;
 180
 181         /*
 182          * The start of the data to sign/seal is just after the RPC headers.
 183          */
 184         char *reply_data = prs_data_p(rdata) + fragment_start + RPC_HEADER_LEN + RPC_HDR_REQ_LEN;
 185
 186         RPC_HDR_AUTH rhdr_auth;
 187
 188         char *dp = prs_data_p(rdata) + fragment_start + len -
 189                 RPC_HDR_AUTH_LEN - auth_len;
 190         prs_struct auth_verf;
 191
 192         *pauth_padding_len = 0;
 193
 194         if (auth_len == 0) {
 195                 if (cli->pipe_auth_flags == 0) {
 196                         /* move along, nothing to see here */
 197                         return True;
 198                 }
 199
 200                 DEBUG(2, ("No authenticaton header recienved on reply, but this pipe is authenticated\n"));
 201                 return False;
 202         }
 203
 204         DEBUG(5,("rpc_auth_pipe: pkt_type: %d len: %d auth_len: %d NTLMSSP %s schannel %s sign %s seal %s \n",
 205                  pkt_type, len, auth_len,
 206                  BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP),
 207                  BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_NETSEC),
 208                  BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_SIGN),
 209                  BOOLSTR(cli->pipe_auth_flags & AUTH_PIPE_SEAL)));
 210
 211         if (dp - prs_data_p(rdata) > prs_data_size(rdata)) {
 212                 DEBUG(0,("rpc_auth_pipe: schannel auth data > data size !\n"));
 213                 return False;
 214         }
 215
 216         DEBUG(10,("rpc_auth_pipe: packet:\n"));
 217         dump_data(100, dp, auth_len);
 218
 219         prs_init(&auth_verf, 0, cli->mem_ctx, UNMARSHALL);
 220
 221         /* The endinness must be preserved. JRA. */
 222         prs_set_endian_data( &auth_verf, rdata->bigendian_data);
 223
 224         /* Point this new parse struct at the auth section of the main
 225            parse struct - rather than copying it.  Avoids needing to
 226            free it on every error
 227         */
 228         prs_give_memory(&auth_verf, dp, RPC_HDR_AUTH_LEN + auth_len, False /* not dynamic */);
 229         prs_set_offset(&auth_verf, 0);
 230
 231         {
 232                 int auth_type;
 233                 int auth_level;
 234                 if (!smb_io_rpc_hdr_auth("auth_hdr", &rhdr_auth, &auth_verf, 0)) {
 235                         DEBUG(0, ("rpc_auth_pipe: Could not parse auth header\n"));
 236                         return False;
 237                 }
 238
 239                 /* Let the caller know how much padding at the end of the data */
 240                 *pauth_padding_len = rhdr_auth.padding;
 241
 242                 /* Check it's the type of reply we were expecting to decode */
 243
 244                 get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level);
 245                 if (rhdr_auth.auth_type != auth_type) {
 246                         DEBUG(0, ("BAD auth type %d (should be %d)\n",
 247                                   rhdr_auth.auth_type, auth_type));
 248                         return False;
 249                 }
 250
 251                 if (rhdr_auth.auth_level != auth_level) {
 252                         DEBUG(0, ("BAD auth level %d (should be %d)\n",
 253                                   rhdr_auth.auth_level, auth_level));
 254                         return False;
 255                 }
 256         }
 257
 258         if (pkt_type == RPC_BINDACK) {
 259                 if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
 260                         /* copy the next auth_len bytes into a buffer for
 261                            later use */
 262
 263                         DATA_BLOB ntlmssp_verf = data_blob(NULL, auth_len);
 264
 265                         /* save the reply away, for use a little later */
 266                         prs_copy_data_out(ntlmssp_verf.data, &auth_verf, auth_len);
 267
 268
 269                         return (NT_STATUS_IS_OK(ntlmssp_client_store_response(cli->ntlmssp_pipe_state,
 270                                                                               ntlmssp_verf)));
 271                 }
 272                 else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
 273                         /* nothing to do here - we don't seem to be able to
 274                            validate the bindack based on VL's comments */
 275                         return True;
 276                 }
 277         }
 278
 279         if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
 280                 NTSTATUS nt_status;
 281                 DATA_BLOB sig;
 282                 if ((cli->pipe_auth_flags & AUTH_PIPE_SIGN) ||
 283                     (cli->pipe_auth_flags & AUTH_PIPE_SEAL)) {
 284                         if (auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) {
 285                                 DEBUG(0,("rpc_auth_pipe: wrong ntlmssp auth len %d\n", auth_len));
 286                                 return False;
 287                         }
 288                         sig = data_blob(NULL, auth_len);
 289                         prs_copy_data_out(sig.data, &auth_verf, auth_len);
 290                 }
 291
 292                 /*
 293                  * Unseal any sealed data in the PDU, not including the
 294                  * 8 byte auth_header or the auth_data.
 295                  */
 296
 297                 /*
 298                  * Now unseal and check the auth verifier in the auth_data at
 299                  * the end of the packet.
 300                  */
 301
 302                 if (cli->pipe_auth_flags & AUTH_PIPE_SEAL) {
 303                         if (data_len < 0) {
 304                                 DEBUG(1, ("Can't unseal - data_len < 0!!\n"));
 305                                 return False;
 306                         }
 307                         nt_status = ntlmssp_client_unseal_packet(cli->ntlmssp_pipe_state,
 308                                                                  reply_data, data_len,
 309                                                                  &sig);
 310                 }
 311                 else if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) {
 312                         nt_status = ntlmssp_client_check_packet(cli->ntlmssp_pipe_state,
 313                                                                 reply_data, data_len,
 314                                                                 &sig);
 315                 }
 316
 317                 data_blob_free(&sig);
 318
 319                 if (!NT_STATUS_IS_OK(nt_status)) {
 320                         DEBUG(0, ("rpc_auth_pipe: could not validate "
 321                                   "incoming NTLMSSP packet!\n"));
 322                         return False;
 323                 }
 324         }
 325
 326         if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
 327                 RPC_AUTH_NETSEC_CHK chk;
 328
 329                 if (auth_len != RPC_AUTH_NETSEC_CHK_LEN) {
 330                         DEBUG(0,("rpc_auth_pipe: wrong schannel auth len %d\n", auth_len));
 331                         return False;
 332                 }
 333
 334                 if (!smb_io_rpc_auth_netsec_chk("schannel_auth_sign",
 335                                                 &chk, &auth_verf, 0)) {
 336                         DEBUG(0, ("rpc_auth_pipe: schannel unmarshalling "
 337                                   "RPC_AUTH_NETSECK_CHK failed\n"));
 338                         return False;
 339                 }
 340
 341                 if (!netsec_decode(&cli->auth_info,
 342                                    cli->pipe_auth_flags,
 343                                    SENDER_IS_ACCEPTOR,
 344                                    &chk, reply_data, data_len)) {
 345                         DEBUG(0, ("rpc_auth_pipe: Could not decode schannel\n"));
 346                         return False;
 347                 }
 348
 349                 cli->auth_info.seq_num++;
 350
 351         }
 352         return True;
 353 }
 354
 355
 356 /****************************************************************************
 357  Send data on an rpc pipe via trans, which *must* be the last fragment.
 358  receive response data from an rpc pipe, which may be large...
 359
 360  Read the first fragment: unfortunately have to use SMBtrans for the first
 361  bit, then SMBreadX for subsequent bits.
 362
 363  If first fragment received also wasn't the last fragment, continue
 364  getting fragments until we _do_ receive the last fragment.
 365
 366  Request/Response PDU's look like the following...
 367
 368  |<------------------PDU len----------------------------------------------->|
 369  |<-HDR_LEN-->|<--REQ LEN------>|.............|<-AUTH_HDRLEN->|<-AUTH_LEN-->|
 370
 371  +------------+-----------------+-------------+---------------+-------------+
 372  | RPC HEADER | REQ/RESP HEADER | DATA ...... | AUTH_HDR      | AUTH DATA   |
 373  +------------+-----------------+-------------+---------------+-------------+
 374
 375  Where the presence of the AUTH_HDR and AUTH are dependent on the
 376  signing & sealing being negotiated.
 377
 378  ****************************************************************************/
 379
 380 static BOOL rpc_api_pipe(struct cli_state *cli, prs_struct *data, prs_struct *rdata,
 381                          uint8 expected_pkt_type)
 382 {
 383         uint32 len;
 384         char *rparam = NULL;
 385         uint32 rparam_len = 0;
 386         uint16 setup[2];
 387         BOOL first = True;
 388         BOOL last  = True;
 389         RPC_HDR rhdr;
 390         char *pdata = data ? prs_data_p(data) : NULL;
 391         uint32 data_len = data ? prs_offset(data) : 0;
 392         char *prdata = NULL;
 393         uint32 rdata_len = 0;
 394         uint32 current_offset = 0;
 395         uint32 fragment_start = 0;
 396         uint32 max_data = cli->max_xmit_frag ? cli->max_xmit_frag : 1024;
 397         int auth_padding_len = 0;
 398
 399         /* Create setup parameters - must be in native byte order. */
 400
 401         setup[0] = TRANSACT_DCERPCCMD;
 402         setup[1] = cli->nt_pipe_fnum; /* Pipe file handle. */
 403
 404         DEBUG(5,("rpc_api_pipe: fnum:%x\n", (int)cli->nt_pipe_fnum));
 405
 406         /* Send the RPC request and receive a response.  For short RPC
 407            calls (about 1024 bytes or so) the RPC request and response
 408            appears in a SMBtrans request and response.  Larger RPC
 409            responses are received further on. */
 410
 411         if (!cli_api_pipe(cli, "\\PIPE\\",
 412                   setup, 2, 0,                     /* Setup, length, max */
 413                   NULL, 0, 0,                      /* Params, length, max */
 414                   pdata, data_len, max_data,       /* data, length, max */
 415                   &rparam, &rparam_len,            /* return params, len */
 416                   &prdata, &rdata_len))            /* return data, len */
 417         {
 418                 DEBUG(0, ("cli_pipe: return critical error. Error was %s\n", cli_errstr(cli)));
 419                 return False;
 420         }
 421
 422         /* Throw away returned params - we know we won't use them. */
 423
 424         SAFE_FREE(rparam);
 425
 426         if (prdata == NULL) {
 427                 DEBUG(0,("rpc_api_pipe: pipe %x failed to return data.\n",
 428                         (int)cli->nt_pipe_fnum));
 429                 return False;
 430         }
 431
 432         /*
 433          * Give this memory as dynamically allocated to the return parse
 434          * struct.
 435          */
 436
 437         prs_give_memory(rdata, prdata, rdata_len, True);
 438         current_offset = rdata_len;
 439
 440         /* This next call sets the endian bit correctly in rdata. */
 441
 442         if (!rpc_check_hdr(rdata, &rhdr, &first, &last, &len)) {
 443                 prs_mem_free(rdata);
 444                 return False;
 445         }
 446
 447         if (rhdr.pkt_type == RPC_BINDACK) {
 448                 if (!last && !first) {
 449                         DEBUG(5,("rpc_api_pipe: bug in server (AS/U?), setting fragment first/last ON.\n"));
 450                         first = True;
 451                         last = True;
 452                 }
 453         }
 454
 455         if (rhdr.pkt_type == RPC_BINDNACK) {
 456                 DEBUG(3, ("Bind NACK received on pipe %x!\n", (int)cli->nt_pipe_fnum));
 457                 prs_mem_free(rdata);
 458                 return False;
 459         }
 460
 461         if (rhdr.pkt_type == RPC_RESPONSE) {
 462                 RPC_HDR_RESP rhdr_resp;
 463                 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, rdata, 0)) {
 464                         DEBUG(5,("rpc_api_pipe: failed to unmarshal RPC_HDR_RESP.\n"));
 465                         prs_mem_free(rdata);
 466                         return False;
 467                 }
 468         }
 469
 470         if (rhdr.pkt_type != expected_pkt_type) {
 471                 DEBUG(3, ("Connection to pipe %x got an unexpected RPC packet type - %d, not %d\n", (int)cli->nt_pipe_fnum, rhdr.pkt_type, expected_pkt_type));
 472                 prs_mem_free(rdata);
 473                 return False;
 474         }
 475
 476         DEBUG(5,("rpc_api_pipe: len left: %u smbtrans read: %u\n",
 477                   (unsigned int)len, (unsigned int)rdata_len ));
 478
 479         /* check if data to be sent back was too large for one SMBtrans */
 480         /* err status is only informational: the _real_ check is on the
 481            length */
 482
 483         if (len > 0) {
 484                 /* || err == (0x80000000 | STATUS_BUFFER_OVERFLOW)) */
 485
 486                 /* Read the remaining part of the first response fragment */
 487
 488                 if (!rpc_read(cli, rdata, len, &current_offset)) {
 489                         prs_mem_free(rdata);
 490                         return False;
 491                 }
 492         }
 493
 494         /*
 495          * Now we have a complete PDU, check the auth struct if any was sent.
 496          */
 497
 498         if(!rpc_auth_pipe(cli, rdata, fragment_start, rhdr.frag_len,
 499                           rhdr.auth_len, rhdr.pkt_type, &auth_padding_len)) {
 500                 prs_mem_free(rdata);
 501                 return False;
 502         }
 503
 504         if (rhdr.auth_len != 0) {
 505                 /*
 506                  * Drop the auth footers from the current offset.
 507                  * We need this if there are more fragments.
 508                  * The auth footers consist of the auth_data and the
 509                  * preceeding 8 byte auth_header.
 510                  */
 511                 current_offset -= (auth_padding_len + RPC_HDR_AUTH_LEN + rhdr.auth_len);
 512         }
 513
 514         /*
 515          * Only one rpc fragment, and it has been read.
 516          */
 517
 518         if (first && last) {
 519                 DEBUG(6,("rpc_api_pipe: fragment first and last both set\n"));
 520                 return True;
 521         }
 522
 523         /*
 524          * Read more fragments using SMBreadX until we get one with the
 525          * last bit set.
 526          */
 527
 528         while (!last) {
 529                 RPC_HDR_RESP rhdr_resp;
 530                 int num_read;
 531                 char hdr_data[RPC_HEADER_LEN+RPC_HDR_RESP_LEN];
 532                 prs_struct hps;
 533                 uint8 eclass;
 534                 uint32 ecode;
 535
 536                 /*
 537                  * First read the header of the next PDU.
 538                  */
 539
 540                 prs_init(&hps, 0, cli->mem_ctx, UNMARSHALL);
 541                 prs_give_memory(&hps, hdr_data, sizeof(hdr_data), False);
 542
 543                 num_read = cli_read(cli, cli->nt_pipe_fnum, hdr_data, 0, RPC_HEADER_LEN+RPC_HDR_RESP_LEN);
 544                 if (cli_is_dos_error(cli)) {
 545                         cli_dos_error(cli, &eclass, &ecode);
 546                         if (eclass != ERRDOS && ecode != ERRmoredata) {
 547                                 DEBUG(0,("rpc_api_pipe: cli_read error : %d/%d\n", eclass, ecode));
 548                                 return False;
 549                         }
 550                 }
 551
 552                 DEBUG(5,("rpc_api_pipe: read header (size:%d)\n", num_read));
 553
 554                 if (num_read != RPC_HEADER_LEN+RPC_HDR_RESP_LEN) {
 555                         DEBUG(0,("rpc_api_pipe: Error : requested %d bytes, got %d.\n",
 556                                 RPC_HEADER_LEN+RPC_HDR_RESP_LEN, num_read ));
 557                         return False;
 558                 }
 559
 560                 /* This call sets the endianness in hps. */
 561
 562                 if (!rpc_check_hdr(&hps, &rhdr, &first, &last, &len))
 563                         return False;
 564
 565                 /* Ensure the endianness in rdata is set correctly - must be same as hps. */
 566
 567                 if (hps.bigendian_data != rdata->bigendian_data) {
 568                         DEBUG(0,("rpc_api_pipe: Error : Endianness changed from %s to %s\n",
 569                                 rdata->bigendian_data ? "big" : "little",
 570                                 hps.bigendian_data ? "big" : "little" ));
 571                         return False;
 572                 }
 573
 574                 if(!smb_io_rpc_hdr_resp("rpc_hdr_resp", &rhdr_resp, &hps, 0)) {
 575                         DEBUG(0,("rpc_api_pipe: Error in unmarshalling RPC_HDR_RESP.\n"));
 576                         return False;
 577                 }
 578
 579                 if (first) {
 580                         DEBUG(0,("rpc_api_pipe: secondary PDU rpc header has 'first' set !\n"));
 581                         return False;
 582                 }
 583
 584                 /*
 585                  * Now read the rest of the PDU.
 586                  */
 587
 588                 if (!rpc_read(cli, rdata, len, &current_offset)) {
 589                         prs_mem_free(rdata);
 590                         return False;
 591                 }
 592
 593                 fragment_start = current_offset - len - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 594
 595                 /*
 596                  * Verify any authentication footer.
 597                  */
 598
 599
 600                 if(!rpc_auth_pipe(cli, rdata, fragment_start, rhdr.frag_len,
 601                                   rhdr.auth_len, rhdr.pkt_type, &auth_padding_len)) {
 602                         prs_mem_free(rdata);
 603                         return False;
 604                 }
 605
 606                 if (rhdr.auth_len != 0 ) {
 607
 608                         /*
 609                          * Drop the auth footers from the current offset.
 610                          * The auth footers consist of the auth_data and the
 611                          * preceeding 8 byte auth_header.
 612                          * We need this if there are more fragments.
 613                          */
 614                         current_offset -= (auth_padding_len + RPC_HDR_AUTH_LEN + rhdr.auth_len);
 615                 }
 616         }
 617
 618         return True;
 619 }
 620
 621 /*******************************************************************
 622  creates a DCE/RPC bind request
 623
 624  - initialises the parse structure.
 625  - dynamically allocates the header data structure
 626  - caller is expected to free the header data structure once used.
 627
 628  ********************************************************************/
 629
 630 static NTSTATUS create_rpc_bind_req(struct cli_state *cli, prs_struct *rpc_out,
 631                                     uint32 rpc_call_id,
 632                                     RPC_IFACE *abstract, RPC_IFACE *transfer,
 633                                     const char *my_name, const char *domain)
 634 {
 635         RPC_HDR hdr;
 636         RPC_HDR_RB hdr_rb;
 637         RPC_HDR_AUTH hdr_auth;
 638         int auth_len = 0;
 639         int auth_type, auth_level;
 640         size_t saved_hdr_offset;
 641
 642         prs_struct auth_info;
 643         prs_init(&auth_info, RPC_HDR_AUTH_LEN, /* we will need at least this much */
 644                 prs_get_mem_context(rpc_out), MARSHALL);
 645
 646         if (cli->pipe_auth_flags) {
 647                 get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level);
 648
 649                 /*
 650                  * Create the auth structs we will marshall.
 651                  */
 652
 653                 init_rpc_hdr_auth(&hdr_auth, auth_type, auth_level, 0x00, 1);
 654
 655                 /*
 656                  * Now marshall the data into the temporary parse_struct.
 657                  */
 658
 659                 if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth, &auth_info, 0)) {
 660                         DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR_AUTH.\n"));
 661                         prs_mem_free(&auth_info);
 662                         return NT_STATUS_NO_MEMORY;
 663                 }
 664                 saved_hdr_offset = prs_offset(&auth_info);
 665         }
 666
 667         if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
 668
 669                 NTSTATUS nt_status;
 670                 DATA_BLOB null_blob = data_blob(NULL, 0);
 671                 DATA_BLOB request;
 672
 673                 DEBUG(5, ("Processing NTLMSSP Negotiate\n"));
 674                 nt_status = ntlmssp_client_update(cli->ntlmssp_pipe_state,
 675                                                   null_blob,
 676                                                   &request);
 677
 678                 if (!NT_STATUS_EQUAL(nt_status,
 679                                      NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 680                         prs_mem_free(&auth_info);
 681                         return nt_status;
 682                 }
 683
 684                 /* Auth len in the rpc header doesn't include auth_header. */
 685                 auth_len = request.length;
 686                 prs_copy_data_in(&auth_info, request.data, request.length);
 687
 688                 DEBUG(5, ("NTLMSSP Negotiate:\n"));
 689                 dump_data(5, request.data, request.length);
 690
 691                 data_blob_free(&request);
 692
 693         }
 694         else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
 695                 RPC_AUTH_NETSEC_NEG netsec_neg;
 696
 697                 /* Use lp_workgroup() if domain not specified */
 698
 699                 if (!domain || !domain[0])
 700                         domain = lp_workgroup();
 701
 702                 init_rpc_auth_netsec_neg(&netsec_neg, domain, my_name);
 703
 704                 /*
 705                  * Now marshall the data into the temporary parse_struct.
 706                  */
 707
 708                 if(!smb_io_rpc_auth_netsec_neg("netsec_neg",
 709                                                &netsec_neg, &auth_info, 0)) {
 710                         DEBUG(0,("Failed to marshall RPC_AUTH_NETSEC_NEG.\n"));
 711                         prs_mem_free(&auth_info);
 712                         return NT_STATUS_NO_MEMORY;
 713                 }
 714
 715                 /* Auth len in the rpc header doesn't include auth_header. */
 716                 auth_len = prs_offset(&auth_info) - saved_hdr_offset;
 717         }
 718         /* create the request RPC_HDR */
 719         init_rpc_hdr(&hdr, RPC_BIND, 0x3, rpc_call_id,
 720                 RPC_HEADER_LEN + RPC_HDR_RB_LEN + prs_offset(&auth_info),
 721                 auth_len);
 722
 723         if(!smb_io_rpc_hdr("hdr"   , &hdr, rpc_out, 0)) {
 724                 DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR.\n"));
 725                 prs_mem_free(&auth_info);
 726                 return NT_STATUS_NO_MEMORY;
 727         }
 728
 729         /* create the bind request RPC_HDR_RB */
 730         init_rpc_hdr_rb(&hdr_rb, MAX_PDU_FRAG_LEN, MAX_PDU_FRAG_LEN, 0x0,
 731                         0x1, 0x0, 0x1, abstract, transfer);
 732
 733         /* Marshall the bind request data */
 734         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_out, 0)) {
 735                 DEBUG(0,("create_rpc_bind_req: failed to marshall RPC_HDR_RB.\n"));
 736                 prs_mem_free(&auth_info);
 737                 return NT_STATUS_NO_MEMORY;
 738         }
 739
 740         /*
 741          * Grow the outgoing buffer to store any auth info.
 742          */
 743
 744         if(auth_len != 0) {
 745                 if(!prs_append_prs_data( rpc_out, &auth_info)) {
 746                         DEBUG(0,("create_rpc_bind_req: failed to grow parse struct to add auth.\n"));
 747                         prs_mem_free(&auth_info);
 748                         return NT_STATUS_NO_MEMORY;
 749                 }
 750         }
 751         return NT_STATUS_OK;
 752 }
 753
 754 /*******************************************************************
 755  Creates a DCE/RPC bind authentication response.
 756  This is the packet that is sent back to the server once we
 757  have received a BIND-ACK, to finish the third leg of
 758  the authentication handshake.
 759  ********************************************************************/
 760
 761 static NTSTATUS create_rpc_bind_resp(struct cli_state *cli,
 762                                  uint32 rpc_call_id,
 763                                  prs_struct *rpc_out)
 764 {
 765         NTSTATUS nt_status;
 766         RPC_HDR hdr;
 767         RPC_HDR_AUTHA hdr_autha;
 768         DATA_BLOB ntlmssp_null_response = data_blob(NULL, 0);
 769         DATA_BLOB ntlmssp_reply;
 770         int auth_type, auth_level;
 771
 772         /* The response is picked up from the internal cache,
 773            where it was placed by the rpc_auth_pipe() code */
 774         nt_status = ntlmssp_client_update(cli->ntlmssp_pipe_state,
 775                                           ntlmssp_null_response,
 776                                           &ntlmssp_reply);
 777
 778         if (!NT_STATUS_EQUAL(nt_status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
 779                 return nt_status;
 780         }
 781
 782         /* Create the request RPC_HDR */
 783         init_rpc_hdr(&hdr, RPC_BINDRESP, 0x0, rpc_call_id,
 784                      RPC_HEADER_LEN + RPC_HDR_AUTHA_LEN + ntlmssp_reply.length,
 785                      ntlmssp_reply.length );
 786
 787         /* Marshall it. */
 788         if(!smb_io_rpc_hdr("hdr", &hdr, rpc_out, 0)) {
 789                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_HDR.\n"));
 790                 data_blob_free(&ntlmssp_reply);
 791                 return NT_STATUS_NO_MEMORY;
 792         }
 793
 794         get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level);
 795
 796         /* Create the request RPC_HDR_AUTHA */
 797         init_rpc_hdr_autha(&hdr_autha, MAX_PDU_FRAG_LEN, MAX_PDU_FRAG_LEN,
 798                            auth_type, auth_level, 0x00);
 799
 800         if(!smb_io_rpc_hdr_autha("hdr_autha", &hdr_autha, rpc_out, 0)) {
 801                 DEBUG(0,("create_rpc_bind_resp: failed to marshall RPC_HDR_AUTHA.\n"));
 802                 data_blob_free(&ntlmssp_reply);
 803                 return NT_STATUS_NO_MEMORY;
 804         }
 805
 806         /*
 807          * Append the auth data to the outgoing buffer.
 808          */
 809
 810         if(!prs_copy_data_in(rpc_out, ntlmssp_reply.data, ntlmssp_reply.length)) {
 811                 DEBUG(0,("create_rpc_bind_req: failed to grow parse struct to add auth.\n"));
 812                 data_blob_free(&ntlmssp_reply);
 813                 return NT_STATUS_NO_MEMORY;
 814         }
 815
 816         if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) {
 817                 nt_status = ntlmssp_client_sign_init(cli->ntlmssp_pipe_state);
 818
 819                 if (!NT_STATUS_IS_OK(nt_status)) {
 820                         return nt_status;
 821                 }
 822         }
 823
 824         data_blob_free(&ntlmssp_reply);
 825         return NT_STATUS_OK;
 826 }
 827
 828
 829 /*******************************************************************
 830  Creates a DCE/RPC request.
 831  ********************************************************************/
 832
 833 static uint32 create_rpc_request(prs_struct *rpc_out, uint8 op_num, int data_len, int auth_len, uint8 flags, uint32 oldid, uint32 data_left)
 834 {
 835         uint32 alloc_hint;
 836         RPC_HDR     hdr;
 837         RPC_HDR_REQ hdr_req;
 838         uint32 callid = oldid ? oldid : get_rpc_call_id();
 839
 840         DEBUG(5,("create_rpc_request: opnum: 0x%x data_len: 0x%x\n", op_num, data_len));
 841
 842         /* create the rpc header RPC_HDR */
 843         init_rpc_hdr(&hdr, RPC_REQUEST, flags,
 844                      callid, data_len, auth_len);
 845
 846         /*
 847          * The alloc hint should be the amount of data, not including
 848          * RPC headers & footers.
 849          */
 850
 851         if (auth_len != 0)
 852                 alloc_hint = data_len - RPC_HEADER_LEN - RPC_HDR_AUTH_LEN - auth_len;
 853         else
 854                 alloc_hint = data_len - RPC_HEADER_LEN;
 855
 856         DEBUG(10,("create_rpc_request: data_len: %x auth_len: %x alloc_hint: %x\n",
 857                    data_len, auth_len, alloc_hint));
 858
 859         /* Create the rpc request RPC_HDR_REQ */
 860         init_rpc_hdr_req(&hdr_req, alloc_hint, op_num);
 861
 862         /* stream-time... */
 863         if(!smb_io_rpc_hdr("hdr    ", &hdr, rpc_out, 0))
 864                 return 0;
 865
 866         if(!smb_io_rpc_hdr_req("hdr_req", &hdr_req, rpc_out, 0))
 867                 return 0;
 868
 869         if (prs_offset(rpc_out) != RPC_HEADER_LEN + RPC_HDR_REQ_LEN)
 870                 return 0;
 871
 872         return callid;
 873 }
 874
 875 /*******************************************************************
 876  Puts an auth header into an rpc request.
 877  ********************************************************************/
 878
 879 static BOOL create_auth_hdr(prs_struct *outgoing_packet,
 880                             int auth_type,
 881                             int auth_level, int padding)
 882 {
 883         RPC_HDR_AUTH hdr_auth;
 884
 885         init_rpc_hdr_auth(&hdr_auth, auth_type, auth_level,
 886                           padding, 1);
 887         if(!smb_io_rpc_hdr_auth("hdr_auth", &hdr_auth,
 888                                 outgoing_packet, 0)) {
 889                 DEBUG(0,("create_auth_hdr:Failed to marshal RPC_HDR_AUTH.\n"));
 890                 return False;
 891         }
 892         return True;
 893 }
 894
 895 /**
 896  * Send a request on an RPC pipe and get a response.
 897  *
 898  * @param data NDR contents of the request to be sent.
 899  * @param rdata Unparsed NDR response data.
 900 **/
 901
 902 BOOL rpc_api_pipe_req(struct cli_state *cli, uint8 op_num,
 903                       prs_struct *data, prs_struct *rdata)
 904 {
 905         uint32 auth_len, real_auth_len, auth_hdr_len, max_data, data_left, data_sent;
 906         NTSTATUS nt_status;
 907         BOOL ret = False;
 908         uint32 callid = 0;
 909         fstring dump_name;
 910
 911         auth_len = 0;
 912         real_auth_len = 0;
 913         auth_hdr_len = 0;
 914
 915         if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) {
 916                 if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
 917                         auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 918                 }
 919                 if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
 920                         auth_len = RPC_AUTH_NETSEC_CHK_LEN;
 921                 }
 922                 auth_hdr_len = RPC_HDR_AUTH_LEN;
 923         }
 924
 925         /*
 926          * calc how much actual data we can send in a PDU fragment
 927          */
 928         max_data = cli->max_xmit_frag - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
 929                 auth_hdr_len - auth_len - 8;
 930
 931         for (data_left = prs_offset(data), data_sent = 0; data_left > 0;) {
 932                 prs_struct outgoing_packet;
 933                 prs_struct sec_blob;
 934                 uint32 data_len, send_size;
 935                 uint8 flags = 0;
 936                 uint32 auth_padding = 0;
 937                 RPC_AUTH_NETSEC_CHK verf;
 938                 DATA_BLOB sign_blob;
 939
 940                 /*
 941                  * how much will we send this time
 942                  */
 943                 send_size = MIN(data_left, max_data);
 944
 945                 if (!prs_init(&sec_blob, send_size, /* will need at least this much */
 946                               cli->mem_ctx, MARSHALL)) {
 947                         DEBUG(0,("Could not malloc %u bytes",
 948                                  send_size+auth_padding));
 949                         return False;
 950                 }
 951
 952                 if(!prs_append_some_prs_data(&sec_blob, data,
 953                                              data_sent, send_size)) {
 954                         DEBUG(0,("Failed to append data to netsec blob\n"));
 955                         prs_mem_free(&sec_blob);
 956                         return False;
 957                 }
 958
 959                 /*
 960                  * NT expects the data that is sealed to be 8-byte
 961                  * aligned. The padding must be encrypted as well and
 962                  * taken into account when generating the
 963                  * authentication verifier. The amount of padding must
 964                  * be stored in the auth header.
 965                  */
 966
 967                 if (cli->pipe_auth_flags) {
 968                         size_t data_and_padding_size;
 969                         int auth_type;
 970                         int auth_level;
 971                         prs_align_uint64(&sec_blob);
 972
 973                         get_auth_type_level(cli->pipe_auth_flags, &auth_type, &auth_level);
 974
 975                         data_and_padding_size = prs_offset(&sec_blob);
 976                         auth_padding = data_and_padding_size - send_size;
 977
 978                         /* insert the auth header */
 979
 980                         if(!create_auth_hdr(&sec_blob, auth_type, auth_level, auth_padding)) {
 981                                 prs_mem_free(&sec_blob);
 982                                 return False;
 983                         }
 984
 985                         /* create an NTLMSSP signature */
 986                         if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
 987                                 /*
 988                                  * Seal the outgoing data if requested.
 989                                  */
 990                                 if (cli->pipe_auth_flags & AUTH_PIPE_SEAL) {
 991
 992                                         nt_status = ntlmssp_client_seal_packet(cli->ntlmssp_pipe_state,
 993                                                                                (unsigned char*)prs_data_p(&sec_blob),
 994                                                                                data_and_padding_size,
 995                                                                                &sign_blob);
 996                                         if (!NT_STATUS_IS_OK(nt_status)) {
 997                                                 prs_mem_free(&sec_blob);
 998                                                 return False;
 999                                         }
1000                                 }
1001                                 else if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) {
1002
1003                                         nt_status = ntlmssp_client_sign_packet(cli->ntlmssp_pipe_state,
1004                                                                                (unsigned char*)prs_data_p(&sec_blob),
1005                                                                                data_and_padding_size, &sign_blob);
1006                                         if (!NT_STATUS_IS_OK(nt_status)) {
1007                                                 prs_mem_free(&sec_blob);
1008                                                 return False;
1009                                         }
1010                                 }
1011
1012
1013                                 /* write auth footer onto the packet */
1014                                 real_auth_len = sign_blob.length;
1015
1016                                 prs_copy_data_in(&sec_blob, sign_blob.data, sign_blob.length);
1017                                 data_blob_free(&sign_blob);
1018
1019                         }
1020                         else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
1021                                 static const uchar netsec_sig[8] = NETSEC_SIGNATURE;
1022                                 static const uchar nullbytes[8] = { 0,0,0,0,0,0,0,0 };
1023                                 size_t parse_offset_marker;
1024                                 DEBUG(10,("SCHANNEL seq_num=%d\n", cli->auth_info.seq_num));
1025
1026                                 init_rpc_auth_netsec_chk(&verf, netsec_sig, nullbytes,
1027                                                          nullbytes, nullbytes);
1028
1029                                 netsec_encode(&cli->auth_info,
1030                                               cli->pipe_auth_flags,
1031                                               SENDER_IS_INITIATOR,
1032                                               &verf,
1033                                               prs_data_p(&sec_blob),
1034                                               data_and_padding_size);
1035
1036                                 cli->auth_info.seq_num++;
1037
1038                                 /* write auth footer onto the packet */
1039
1040                                 parse_offset_marker = prs_offset(&sec_blob);
1041                                 if (!smb_io_rpc_auth_netsec_chk("", &verf,
1042                                                                 &sec_blob, 0)) {
1043                                         prs_mem_free(&sec_blob);
1044                                         return False;
1045                                 }
1046                                 real_auth_len = prs_offset(&sec_blob) - parse_offset_marker;
1047                         }
1048                 }
1049
1050                 data_len = RPC_HEADER_LEN + RPC_HDR_REQ_LEN + prs_offset(&sec_blob);
1051
1052                 /*
1053                  * Malloc parse struct to hold it (and enough for alignments).
1054                  */
1055                 if(!prs_init(&outgoing_packet, data_len + 8,
1056                              cli->mem_ctx, MARSHALL)) {
1057                         DEBUG(0,("rpc_api_pipe_req: Failed to malloc %u bytes.\n", (unsigned int)data_len ));
1058                         return False;
1059                 }
1060
1061                 if (data_left == prs_offset(data))
1062                         flags |= RPC_FLG_FIRST;
1063
1064                 if (data_left <= max_data)
1065                         flags |= RPC_FLG_LAST;
1066                 /*
1067                  * Write out the RPC header and the request header.
1068                  */
1069                 if(!(callid = create_rpc_request(&outgoing_packet, op_num,
1070                                                  data_len, real_auth_len, flags,
1071                                                  callid, data_left))) {
1072                         DEBUG(0,("rpc_api_pipe_req: Failed to create RPC request.\n"));
1073                         prs_mem_free(&outgoing_packet);
1074                         prs_mem_free(&sec_blob);
1075                         return False;
1076                 }
1077
1078                 prs_append_prs_data(&outgoing_packet, &sec_blob);
1079                 prs_mem_free(&sec_blob);
1080
1081                 DEBUG(100,("data_len: %x data_calc_len: %x\n", data_len,
1082                            prs_offset(&outgoing_packet)));
1083
1084                 if (flags & RPC_FLG_LAST)
1085                         ret = rpc_api_pipe(cli, &outgoing_packet,
1086                                            rdata, RPC_RESPONSE);
1087                 else {
1088                         cli_write(cli, cli->nt_pipe_fnum, 0x0008,
1089                                    prs_data_p(&outgoing_packet),
1090                                    data_sent, data_len);
1091                 }
1092                 prs_mem_free(&outgoing_packet);
1093                 data_sent += send_size;
1094                 data_left -= send_size;
1095         }
1096         /* Also capture received data */
1097         slprintf(dump_name, sizeof(dump_name) - 1, "reply_%s",
1098                  cli_pipe_get_name(cli));
1099         prs_dump(dump_name, op_num, rdata);
1100
1101         return ret;
1102 }
1103
1104 /****************************************************************************
1105  Set the handle state.
1106 ****************************************************************************/
1107
1108 static BOOL rpc_pipe_set_hnd_state(struct cli_state *cli, const char *pipe_name, uint16 device_state)
1109 {
1110         BOOL state_set = False;
1111         char param[2];
1112         uint16 setup[2]; /* only need 2 uint16 setup parameters */
1113         char *rparam = NULL;
1114         char *rdata = NULL;
1115         uint32 rparam_len, rdata_len;
1116
1117         if (pipe_name == NULL)
1118                 return False;
1119
1120         DEBUG(5,("Set Handle state Pipe[%x]: %s - device state:%x\n",
1121         cli->nt_pipe_fnum, pipe_name, device_state));
1122
1123         /* create parameters: device state */
1124         SSVAL(param, 0, device_state);
1125
1126         /* create setup parameters. */
1127         setup[0] = 0x0001;
1128         setup[1] = cli->nt_pipe_fnum; /* pipe file handle.  got this from an SMBOpenX. */
1129
1130         /* send the data on \PIPE\ */
1131         if (cli_api_pipe(cli, "\\PIPE\\",
1132                     setup, 2, 0,                /* setup, length, max */
1133                     param, 2, 0,                /* param, length, max */
1134                     NULL, 0, 1024,              /* data, length, max */
1135                     &rparam, &rparam_len,        /* return param, length */
1136                     &rdata, &rdata_len))         /* return data, length */
1137         {
1138                 DEBUG(5, ("Set Handle state: return OK\n"));
1139                 state_set = True;
1140         }
1141
1142         SAFE_FREE(rparam);
1143         SAFE_FREE(rdata);
1144
1145         return state_set;
1146 }
1147
1148 /****************************************************************************
1149  check the rpc bind acknowledge response
1150 ****************************************************************************/
1151
1152 int get_pipe_index( const char *pipe_name )
1153 {
1154         int pipe_idx = 0;
1155
1156         while (pipe_names[pipe_idx].client_pipe != NULL) {
1157                 if (strequal(pipe_name, pipe_names[pipe_idx].client_pipe ))
1158                         return pipe_idx;
1159                 pipe_idx++;
1160         };
1161
1162         return -1;
1163 }
1164
1165
1166 /****************************************************************************
1167  check the rpc bind acknowledge response
1168 ****************************************************************************/
1169
1170 const char* get_pipe_name_from_index( const int pipe_index )
1171 {
1172
1173         if ( (pipe_index < 0) || (pipe_index >= PI_MAX_PIPES) )
1174                 return NULL;
1175
1176         return pipe_names[pipe_index].client_pipe;
1177 }
1178
1179 /****************************************************************************
1180  Check to see if this pipe index points to one of
1181  the pipes only supported by Win2k
1182  ****************************************************************************/
1183
1184 BOOL is_win2k_pipe( const int pipe_idx )
1185 {
1186         switch ( pipe_idx )
1187         {
1188                 case PI_LSARPC_DS:
1189                         return True;
1190         }
1191
1192         return False;
1193 }
1194
1195 /****************************************************************************
1196  check the rpc bind acknowledge response
1197 ****************************************************************************/
1198
1199 static BOOL valid_pipe_name(const int pipe_idx, RPC_IFACE *abstract, RPC_IFACE *transfer)
1200 {
1201         if ( pipe_idx >= PI_MAX_PIPES ) {
1202                 DEBUG(0,("valid_pipe_name: Programmer error!  Invalid pipe index [%d]\n",
1203                         pipe_idx));
1204                 return False;
1205         }
1206
1207         DEBUG(5,("Bind Abstract Syntax: "));
1208         dump_data(5, (char*)&(pipe_names[pipe_idx].abstr_syntax),
1209                   sizeof(pipe_names[pipe_idx].abstr_syntax));
1210         DEBUG(5,("Bind Transfer Syntax: "));
1211         dump_data(5, (char*)&(pipe_names[pipe_idx].trans_syntax),
1212                   sizeof(pipe_names[pipe_idx].trans_syntax));
1213
1214         /* copy the required syntaxes out so we can do the right bind */
1215
1216         *transfer = pipe_names[pipe_idx].trans_syntax;
1217         *abstract = pipe_names[pipe_idx].abstr_syntax;
1218
1219         return True;
1220 }
1221
1222 /****************************************************************************
1223  check the rpc bind acknowledge response
1224 ****************************************************************************/
1225
1226 static BOOL check_bind_response(RPC_HDR_BA *hdr_ba, const int pipe_idx, RPC_IFACE *transfer)
1227 {
1228         int i = 0;
1229
1230         if ( hdr_ba->addr.len <= 0)
1231                 return False;
1232
1233         if ( !strequal(hdr_ba->addr.str, pipe_names[pipe_idx].server_pipe ))
1234         {
1235                 DEBUG(4,("bind_rpc_pipe: pipe_name %s != expected pipe %s.  oh well!\n",
1236                          pipe_names[i].server_pipe ,hdr_ba->addr.str));
1237                 return False;
1238         }
1239
1240         DEBUG(5,("bind_rpc_pipe: server pipe_name found: %s\n", pipe_names[i].server_pipe ));
1241
1242         if (pipe_names[pipe_idx].server_pipe == NULL) {
1243                 DEBUG(2,("bind_rpc_pipe: pipe name %s unsupported\n", hdr_ba->addr.str));
1244                 return False;
1245         }
1246
1247         /* check the transfer syntax */
1248         if ((hdr_ba->transfer.version != transfer->version) ||
1249              (memcmp(&hdr_ba->transfer.uuid, &transfer->uuid, sizeof(transfer->uuid)) !=0)) {
1250                 DEBUG(2,("bind_rpc_pipe: transfer syntax differs\n"));
1251                 return False;
1252         }
1253
1254         /* lkclXXXX only accept one result: check the result(s) */
1255         if (hdr_ba->res.num_results != 0x1 || hdr_ba->res.result != 0) {
1256                 DEBUG(2,("bind_rpc_pipe: bind denied results: %d reason: %x\n",
1257                           hdr_ba->res.num_results, hdr_ba->res.reason));
1258         }
1259
1260         DEBUG(5,("bind_rpc_pipe: accepted!\n"));
1261         return True;
1262 }
1263
1264 /****************************************************************************
1265  Create and send the third packet in an RPC auth.
1266 ****************************************************************************/
1267
1268 static BOOL rpc_send_auth_reply(struct cli_state *cli, prs_struct *rdata, uint32 rpc_call_id)
1269 {
1270         prs_struct rpc_out;
1271         ssize_t ret;
1272
1273         prs_init(&rpc_out, RPC_HEADER_LEN + RPC_HDR_AUTHA_LEN, /* need at least this much */
1274                  cli->mem_ctx, MARSHALL);
1275
1276         create_rpc_bind_resp(cli, rpc_call_id,
1277                              &rpc_out);
1278
1279         if ((ret = cli_write(cli, cli->nt_pipe_fnum, 0x8, prs_data_p(&rpc_out),
1280                         0, (size_t)prs_offset(&rpc_out))) != (ssize_t)prs_offset(&rpc_out)) {
1281                 DEBUG(0,("rpc_send_auth_reply: cli_write failed. Return was %d\n", (int)ret));
1282                 prs_mem_free(&rpc_out);
1283                 return False;
1284         }
1285
1286         prs_mem_free(&rpc_out);
1287         return True;
1288 }
1289
1290 /****************************************************************************
1291  Do an rpc bind.
1292 ****************************************************************************/
1293
1294 static BOOL rpc_pipe_bind(struct cli_state *cli, int pipe_idx, const char *my_name)
1295 {
1296         RPC_IFACE abstract;
1297         RPC_IFACE transfer;
1298         prs_struct rpc_out;
1299         prs_struct rdata;
1300         uint32 rpc_call_id;
1301         char buffer[MAX_PDU_FRAG_LEN];
1302
1303         if ( (pipe_idx < 0) || (pipe_idx >= PI_MAX_PIPES) )
1304                 return False;
1305
1306         DEBUG(5,("Bind RPC Pipe[%x]: %s\n", cli->nt_pipe_fnum, pipe_names[pipe_idx].client_pipe));
1307
1308         if (!valid_pipe_name(pipe_idx, &abstract, &transfer))
1309                 return False;
1310
1311         prs_init(&rpc_out, 0, cli->mem_ctx, MARSHALL);
1312
1313         /*
1314          * Use the MAX_PDU_FRAG_LEN buffer to store the bind request.
1315          */
1316
1317         prs_give_memory( &rpc_out, buffer, sizeof(buffer), False);
1318
1319         rpc_call_id = get_rpc_call_id();
1320
1321         if (cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP) {
1322                 NTSTATUS nt_status;
1323                 fstring password;
1324
1325                 DEBUG(5, ("NTLMSSP authenticated pipe selected\n"));
1326
1327                 nt_status = ntlmssp_client_start(&cli->ntlmssp_pipe_state);
1328
1329                 if (!NT_STATUS_IS_OK(nt_status))
1330                         return False;
1331
1332                 nt_status = ntlmssp_set_username(cli->ntlmssp_pipe_state,
1333                                                  cli->user_name);
1334                 if (!NT_STATUS_IS_OK(nt_status))
1335                         return False;
1336
1337                 nt_status = ntlmssp_set_domain(cli->ntlmssp_pipe_state,
1338                                                cli->domain);
1339                 if (!NT_STATUS_IS_OK(nt_status))
1340                         return False;
1341
1342                 pwd_get_cleartext(&cli->pwd, password);
1343                 nt_status = ntlmssp_set_password(cli->ntlmssp_pipe_state,
1344                                                  password);
1345                 if (!NT_STATUS_IS_OK(nt_status))
1346                         return False;
1347
1348                 if (cli->pipe_auth_flags & AUTH_PIPE_SIGN) {
1349                         cli->ntlmssp_pipe_state->neg_flags |= NTLMSSP_NEGOTIATE_SIGN;
1350                 }
1351
1352                 if (cli->pipe_auth_flags & AUTH_PIPE_SEAL) {
1353                         cli->ntlmssp_pipe_state->neg_flags |= NTLMSSP_NEGOTIATE_SEAL;
1354                 }
1355         } else if (cli->pipe_auth_flags & AUTH_PIPE_NETSEC) {
1356                 cli->auth_info.seq_num = 0;
1357         }
1358
1359         /* Marshall the outgoing data. */
1360         create_rpc_bind_req(cli, &rpc_out, rpc_call_id,
1361                             &abstract, &transfer,
1362                             global_myname(), cli->domain);
1363
1364         /* Initialize the incoming data struct. */
1365         prs_init(&rdata, 0, cli->mem_ctx, UNMARSHALL);
1366
1367         /* send data on \PIPE\.  receive a response */
1368         if (rpc_api_pipe(cli, &rpc_out, &rdata, RPC_BINDACK)) {
1369                 RPC_HDR_BA   hdr_ba;
1370
1371                 DEBUG(5, ("rpc_pipe_bind: rpc_api_pipe returned OK.\n"));
1372
1373                 if(!smb_io_rpc_hdr_ba("", &hdr_ba, &rdata, 0)) {
1374                         DEBUG(0,("rpc_pipe_bind: Failed to unmarshall RPC_HDR_BA.\n"));
1375                         prs_mem_free(&rdata);
1376                         return False;
1377                 }
1378
1379                 if(!check_bind_response(&hdr_ba, pipe_idx, &transfer)) {
1380                         DEBUG(2,("rpc_pipe_bind: check_bind_response failed.\n"));
1381                         prs_mem_free(&rdata);
1382                         return False;
1383                 }
1384
1385                 cli->max_xmit_frag = hdr_ba.bba.max_tsize;
1386                 cli->max_recv_frag = hdr_ba.bba.max_rsize;
1387
1388                 /*
1389                  * If we're doing NTLMSSP auth we need to send a reply to
1390                  * the bind-ack to complete the 3-way challenge response
1391                  * handshake.
1392                  */
1393
1394                 if ((cli->pipe_auth_flags & AUTH_PIPE_NTLMSSP)
1395                     && !rpc_send_auth_reply(cli, &rdata, rpc_call_id)) {
1396                         DEBUG(0,("rpc_pipe_bind: rpc_send_auth_reply failed.\n"));
1397                         prs_mem_free(&rdata);
1398                         return False;
1399                 }
1400                 prs_mem_free(&rdata);
1401                 return True;
1402         }
1403
1404         return False;
1405 }
1406
1407 /****************************************************************************
1408  Open a session.
1409  ****************************************************************************/
1410
1411 BOOL cli_nt_session_open(struct cli_state *cli, const int pipe_idx)
1412 {
1413         int fnum;
1414
1415         /* At the moment we can't have more than one pipe open over
1416            a cli connection. )-: */
1417
1418         SMB_ASSERT(cli->nt_pipe_fnum == 0);
1419
1420         /* The pipe index must fall within our array */
1421
1422         SMB_ASSERT((pipe_idx >= 0) && (pipe_idx < PI_MAX_PIPES));
1423
1424         if (cli->capabilities & CAP_NT_SMBS) {
1425                 if ((fnum = cli_nt_create(cli, &pipe_names[pipe_idx].client_pipe[5], DESIRED_ACCESS_PIPE)) == -1) {
1426                         DEBUG(0,("cli_nt_session_open: cli_nt_create failed on pipe %s to machine %s.  Error was %s\n",
1427                                  &pipe_names[pipe_idx].client_pipe[5], cli->desthost, cli_errstr(cli)));
1428                         return False;
1429                 }
1430
1431                 cli->nt_pipe_fnum = (uint16)fnum;
1432         } else {
1433                 if ((fnum = cli_open(cli, pipe_names[pipe_idx].client_pipe, O_CREAT|O_RDWR, DENY_NONE)) == -1) {
1434                         DEBUG(0,("cli_nt_session_open: cli_open failed on pipe %s to machine %s.  Error was %s\n",
1435                                  pipe_names[pipe_idx].client_pipe, cli->desthost, cli_errstr(cli)));
1436                         return False;
1437                 }
1438
1439                 cli->nt_pipe_fnum = (uint16)fnum;
1440
1441                 /**************** Set Named Pipe State ***************/
1442                 if (!rpc_pipe_set_hnd_state(cli, pipe_names[pipe_idx].client_pipe, 0x4300)) {
1443                         DEBUG(0,("cli_nt_session_open: pipe hnd state failed.  Error was %s\n",
1444                                   cli_errstr(cli)));
1445                         cli_close(cli, cli->nt_pipe_fnum);
1446                         return False;
1447                 }
1448         }
1449
1450         /******************* bind request on pipe *****************/
1451
1452         if (!rpc_pipe_bind(cli, pipe_idx, global_myname())) {
1453                 DEBUG(2,("cli_nt_session_open: rpc bind to %s failed\n",
1454                          get_pipe_name_from_index(pipe_idx)));
1455                 cli_close(cli, cli->nt_pipe_fnum);
1456                 return False;
1457         }
1458
1459         /*
1460          * Setup the remote server name prefixed by \ and the machine account name.
1461          */
1462
1463         fstrcpy(cli->srv_name_slash, "\\\\");
1464         fstrcat(cli->srv_name_slash, cli->desthost);
1465         strupper_m(cli->srv_name_slash);
1466
1467         fstrcpy(cli->clnt_name_slash, "\\\\");
1468         fstrcat(cli->clnt_name_slash, global_myname());
1469         strupper_m(cli->clnt_name_slash);
1470
1471         fstrcpy(cli->mach_acct, global_myname());
1472         fstrcat(cli->mach_acct, "$");
1473         strupper_m(cli->mach_acct);
1474
1475         /* Remember which pipe we're talking to */
1476         fstrcpy(cli->pipe_name, pipe_names[pipe_idx].client_pipe);
1477
1478         return True;
1479 }
1480
1481
1482 /****************************************************************************
1483  Open a session to the NETLOGON pipe using schannel.
1484
1485  (Assumes that the netlogon pipe is already open)
1486  ****************************************************************************/
1487
1488 NTSTATUS cli_nt_establish_netlogon(struct cli_state *cli, int sec_chan,
1489                                    const uchar trust_password[16])
1490 {
1491         NTSTATUS result;
1492         uint32 neg_flags = 0x000001ff;
1493         int fnum;
1494
1495         cli_nt_netlogon_netsec_session_close(cli);
1496
1497         if (lp_client_schannel() != False)
1498                 neg_flags |= NETLOGON_NEG_SCHANNEL;
1499
1500         result = cli_nt_setup_creds(cli, sec_chan, trust_password,
1501                                     &neg_flags, 2);
1502
1503         if (!NT_STATUS_IS_OK(result)) {
1504                 cli_nt_session_close(cli);
1505                 return result;
1506         }
1507
1508         if ((lp_client_schannel() == True) &&
1509             ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
1510
1511                 DEBUG(3, ("Server did not offer schannel\n"));
1512                 cli_nt_session_close(cli);
1513                 return NT_STATUS_UNSUCCESSFUL;
1514         }
1515
1516         if ((lp_client_schannel() == False) ||
1517             ((neg_flags & NETLOGON_NEG_SCHANNEL) == 0)) {
1518                 return NT_STATUS_OK;
1519
1520                 /* keep the existing connection to NETLOGON open */
1521
1522         }
1523
1524         /* Server offered schannel, so try it. */
1525
1526         memcpy(cli->auth_info.sess_key, cli->sess_key,
1527                sizeof(cli->auth_info.sess_key));
1528
1529         cli->saved_netlogon_pipe_fnum = cli->nt_pipe_fnum;
1530
1531         cli->pipe_auth_flags = AUTH_PIPE_NETSEC;
1532         cli->pipe_auth_flags |= AUTH_PIPE_SIGN;
1533         cli->pipe_auth_flags |= AUTH_PIPE_SEAL;
1534
1535         if (cli->capabilities & CAP_NT_SMBS) {
1536
1537                 /* The secure channel connection must be opened on the same
1538                    session (TCP connection) as the one the challenge was
1539                    requested from. */
1540                 if ((fnum = cli_nt_create(cli, PIPE_NETLOGON_PLAIN,
1541                                           DESIRED_ACCESS_PIPE)) == -1) {
1542                         DEBUG(0,("cli_nt_create failed to %s machine %s. "
1543                                  "Error was %s\n",
1544                                  PIPE_NETLOGON, cli->desthost,
1545                                  cli_errstr(cli)));
1546                         return NT_STATUS_UNSUCCESSFUL;
1547                 }
1548
1549                 cli->nt_pipe_fnum = (uint16)fnum;
1550         } else {
1551                 if ((fnum = cli_open(cli, PIPE_NETLOGON,
1552                                      O_CREAT|O_RDWR, DENY_NONE)) == -1) {
1553                         DEBUG(0,("cli_open failed on pipe %s to machine %s. "
1554                                  "Error was %s\n",
1555                                  PIPE_NETLOGON, cli->desthost,
1556                                  cli_errstr(cli)));
1557                         return NT_STATUS_UNSUCCESSFUL;
1558                 }
1559
1560                 cli->nt_pipe_fnum = (uint16)fnum;
1561
1562                 /**************** Set Named Pipe State ***************/
1563                 if (!rpc_pipe_set_hnd_state(cli, PIPE_NETLOGON, 0x4300)) {
1564                         DEBUG(0,("Pipe hnd state failed.  Error was %s\n",
1565                                   cli_errstr(cli)));
1566                         cli_close(cli, cli->nt_pipe_fnum);
1567                         return NT_STATUS_UNSUCCESSFUL;
1568                 }
1569         }
1570
1571         /* doing schannel, not per-user auth */
1572         cli->pipe_auth_flags = AUTH_PIPE_NETSEC | AUTH_PIPE_SIGN | AUTH_PIPE_SEAL;
1573
1574         if (!rpc_pipe_bind(cli, PI_NETLOGON, global_myname())) {
1575                 DEBUG(2,("rpc bind to %s failed\n", PIPE_NETLOGON));
1576                 cli_close(cli, cli->nt_pipe_fnum);
1577                 return NT_STATUS_UNSUCCESSFUL;
1578         }
1579
1580         return NT_STATUS_OK;
1581 }
1582
1583
1584 const char *cli_pipe_get_name(struct cli_state *cli)
1585 {
1586         return cli->pipe_name;
1587 }
1588
1589