source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/Netbios implementation.
   3  *  Version 1.9.
   4  *  RPC Pipe client / server routines
   5  *  Copyright (C) Andrew Tridgell              1992-1998
   6  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   7  *  Copyright (C) Paul Ashton                  1997-1998.
   8  *  Copyright (C) Jeremy Allison                    1999.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25 /*  this module apparently provides an implementation of DCE/RPC over a
  26  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  27  *  documentation are available (in on-line form) from the X-Open group.
  28  *
  29  *  this module should provide a level of abstraction between SMB
  30  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  31  *  data copies, and network traffic.
  32  *
  33  *  in this version, which takes a "let's learn what's going on and
  34  *  get something running" approach, there is additional network
  35  *  traffic generated, but the code should be easier to understand...
  36  *
  37  *  ... if you read the docs.  or stare at packets for weeks on end.
  38  *
  39  */
  40
  41 #include "includes.h"
  42
  43 extern int DEBUGLEVEL;
  44
  45 static void NTLMSSPcalc_p( pipes_struct *p, unsigned char *data, int len)
  46 {
  47     unsigned char *hash = p->ntlmssp_hash;
  48     unsigned char index_i = hash[256];
  49     unsigned char index_j = hash[257];
  50     int ind;
  51
  52     for( ind = 0; ind < len; ind++) {
  53         unsigned char tc;
  54         unsigned char t;
  55
  56         index_i++;
  57         index_j += hash[index_i];
  58
  59         tc = hash[index_i];
  60         hash[index_i] = hash[index_j];
  61         hash[index_j] = tc;
  62
  63         t = hash[index_i] + hash[index_j];
  64         data[ind] = data[ind] ^ hash[t];
  65     }
  66
  67     hash[256] = index_i;
  68     hash[257] = index_j;
  69 }
  70
  71 /*******************************************************************
  72  Generate the next PDU to be returned from the data in p->rdata.
  73  We cheat here as this function doesn't handle the special auth
  74  footers of the authenticated bind response reply.
  75  ********************************************************************/
  76
  77 BOOL create_next_pdu(pipes_struct *p)
  78 {
  79         RPC_HDR_RESP hdr_resp;
  80         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
  81         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
  82         uint32 data_len;
  83         uint32 data_space_available;
  84         uint32 data_len_left;
  85         prs_struct outgoing_pdu;
  86         char *data;
  87         char *data_from;
  88         uint32 data_pos;
  89
  90         /*
  91          * If we're in the fault state, keep returning fault PDU's until
  92          * the pipe gets closed. JRA.
  93          */
  94
  95         if(p->fault_state) {
  96                 setup_fault_pdu(p, 0x1c010002);
  97                 return True;
  98         }
  99
 100         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 101
 102         /* Change the incoming request header to a response. */
 103         p->hdr.pkt_type = RPC_RESPONSE;
 104
 105         /* Set up rpc header flags. */
 106         if (p->out_data.data_sent_length == 0)
 107                 p->hdr.flags = RPC_FLG_FIRST;
 108         else
 109                 p->hdr.flags = 0;
 110
 111         /*
 112          * Work out how much we can fit in a single PDU.
 113          */
 114
 115         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 116         if(p->ntlmssp_auth_validated)
 117                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN);
 118
 119         /*
 120          * The amount we send is the minimum of the available
 121          * space and the amount left to send.
 122          */
 123
 124         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 125
 126         /*
 127          * Ensure there really is data left to send.
 128          */
 129
 130         if(!data_len_left) {
 131                 DEBUG(0,("create_next_pdu: no data left to send !\n"));
 132                 return False;
 133         }
 134
 135         data_len = MIN(data_len_left, data_space_available);
 136
 137         /*
 138          * Set up the alloc hint. This should be the data left to
 139          * send.
 140          */
 141
 142         hdr_resp.alloc_hint = data_len_left;
 143
 144         /*
 145          * Set up the header lengths.
 146          */
 147
 148         if (p->ntlmssp_auth_validated) {
 149                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
 150                                         RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN;
 151                 p->hdr.auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 152         } else {
 153                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 154                 p->hdr.auth_len = 0;
 155         }
 156
 157         /*
 158          * Work out if this PDU will be the last.
 159          */
 160
 161         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata))
 162                 p->hdr.flags |= RPC_FLG_LAST;
 163
 164         /*
 165          * Init the parse struct to point at the outgoing
 166          * data.
 167          */
 168
 169         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 170         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 171
 172         /* Store the header in the data stream. */
 173         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 174                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR.\n"));
 175                 prs_mem_free(&outgoing_pdu);
 176                 return False;
 177         }
 178
 179         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 180                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_RESP.\n"));
 181                 prs_mem_free(&outgoing_pdu);
 182                 return False;
 183         }
 184
 185         /* Store the current offset. */
 186         data_pos = prs_offset(&outgoing_pdu);
 187
 188         /* Copy the data into the PDU. */
 189         data_from = prs_data_p(&p->out_data.rdata) + p->out_data.data_sent_length;
 190
 191         if(!prs_append_data(&outgoing_pdu, data_from, data_len)) {
 192                 DEBUG(0,("create_next_pdu: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 193                 prs_mem_free(&outgoing_pdu);
 194                 return False;
 195         }
 196
 197         /*
 198          * Set data to point to where we copied the data into.
 199          */
 200
 201         data = prs_data_p(&outgoing_pdu) + data_pos;
 202
 203         if (p->hdr.auth_len > 0) {
 204                 uint32 crc32 = 0;
 205
 206                 DEBUG(5,("create_next_pdu: sign: %s seal: %s data %d auth %d\n",
 207                          BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, p->hdr.auth_len));
 208
 209                 if (auth_seal) {
 210                         crc32 = crc32_calc_buffer(data, data_len);
 211                         NTLMSSPcalc_p(p, (uchar*)data, data_len);
 212                 }
 213
 214                 if (auth_seal || auth_verify) {
 215                         RPC_HDR_AUTH auth_info;
 216
 217                         init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL,
 218                                         (auth_verify ? RPC_HDR_AUTH_LEN : 0), (auth_verify ? 1 : 0));
 219                         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 220                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 221                                 prs_mem_free(&outgoing_pdu);
 222                                 return False;
 223                         }
 224                 }
 225
 226                 if (auth_verify) {
 227                         RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
 228                         char *auth_data = prs_data_p(&outgoing_pdu);
 229
 230                         p->ntlmssp_seq_num++;
 231                         init_rpc_auth_ntlmssp_chk(&ntlmssp_chk, NTLMSSP_SIGN_VERSION,
 232                                         crc32, p->ntlmssp_seq_num++);
 233                         auth_data = prs_data_p(&outgoing_pdu) + prs_offset(&outgoing_pdu) + 4;
 234                         if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, &outgoing_pdu, 0)) {
 235                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_AUTH_NTLMSSP_CHK.\n"));
 236                                 prs_mem_free(&outgoing_pdu);
 237                                 return False;
 238                         }
 239                         NTLMSSPcalc_p(p, (uchar*)auth_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 240                 }
 241         }
 242
 243         /*
 244          * Setup the counts for this PDU.
 245          */
 246
 247         p->out_data.data_sent_length += data_len;
 248         p->out_data.current_pdu_len = p->hdr.frag_len;
 249         p->out_data.current_pdu_sent = 0;
 250
 251         prs_mem_free(&outgoing_pdu);
 252         return True;
 253 }
 254
 255 /*******************************************************************
 256  Process an NTLMSSP authentication response.
 257  If this function succeeds, the user has been authenticated
 258  and their domain, name and calling workstation stored in
 259  the pipe struct.
 260  The initial challenge is stored in p->challenge.
 261  *******************************************************************/
 262
 263 static BOOL api_pipe_ntlmssp_verify(pipes_struct *p, RPC_AUTH_NTLMSSP_RESP *ntlmssp_resp)
 264 {
 265         uchar lm_owf[24];
 266         uchar nt_owf[24];
 267         fstring user_name;
 268         fstring pipe_user_name;
 269         fstring domain;
 270         fstring wks;
 271         BOOL guest_user = False;
 272         SAM_ACCOUNT *sampass = NULL;
 273         uchar null_smb_passwd[16];
 274         uchar *smb_passwd_ptr = NULL;
 275
 276         DEBUG(5,("api_pipe_ntlmssp_verify: checking user details\n"));
 277
 278         memset(p->user_name, '\0', sizeof(p->user_name));
 279         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 280         memset(p->domain, '\0', sizeof(p->domain));
 281         memset(p->wks, '\0', sizeof(p->wks));
 282
 283         /* Set up for non-authenticated user. */
 284         delete_nt_token(&p->pipe_user.nt_user_token);
 285         p->pipe_user.ngroups = 0;
 286         safe_free( p->pipe_user.groups);
 287
 288         /*
 289          * Setup an empty password for a guest user.
 290          */
 291
 292         memset(null_smb_passwd,0,16);
 293
 294         /*
 295          * We always negotiate UNICODE.
 296          */
 297
 298         if (p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_UNICODE) {
 299                 fstrcpy(user_name, dos_unistrn2((uint16*)ntlmssp_resp->user, ntlmssp_resp->hdr_usr.str_str_len/2));
 300                 fstrcpy(domain, dos_unistrn2((uint16*)ntlmssp_resp->domain, ntlmssp_resp->hdr_domain.str_str_len/2));
 301                 fstrcpy(wks, dos_unistrn2((uint16*)ntlmssp_resp->wks, ntlmssp_resp->hdr_wks.str_str_len/2));
 302         } else {
 303                 fstrcpy(user_name, ntlmssp_resp->user);
 304                 fstrcpy(domain, ntlmssp_resp->domain);
 305                 fstrcpy(wks, ntlmssp_resp->wks);
 306         }
 307
 308         DEBUG(5,("user: %s domain: %s wks: %s\n", user_name, domain, wks));
 309
 310         memcpy(lm_owf, ntlmssp_resp->lm_resp, sizeof(lm_owf));
 311         memcpy(nt_owf, ntlmssp_resp->nt_resp, sizeof(nt_owf));
 312
 313 #ifdef DEBUG_PASSWORD
 314         DEBUG(100,("lm, nt owfs, chal\n"));
 315         dump_data(100, (char *)lm_owf, sizeof(lm_owf));
 316         dump_data(100, (char *)nt_owf, sizeof(nt_owf));
 317         dump_data(100, (char *)p->challenge, 8);
 318 #endif
 319
 320         /*
 321          * Allow guest access. Patch from Shirish Kalele <kalele@veritas.com>.
 322          */
 323
 324         if((strlen(user_name) == 0) &&
 325            (ntlmssp_resp->hdr_nt_resp.str_str_len==0))
 326           {
 327                 guest_user = True;
 328
 329         fstrcpy(pipe_user_name, lp_guestaccount(-1));
 330                 DEBUG(100,("Null user in NTLMSSP verification. Using guest = %s\n", pipe_user_name));
 331
 332                 smb_passwd_ptr = null_smb_passwd;
 333
 334         } else {
 335
 336                 /*
 337                  * Pass the user through the NT -> unix user mapping
 338                  * function.
 339                  */
 340
 341                 fstrcpy(pipe_user_name, user_name);
 342                 (void)map_username(pipe_user_name);
 343
 344                 /*
 345                  * Do the length checking only if user is not NULL.
 346                  */
 347
 348                 if (ntlmssp_resp->hdr_lm_resp.str_str_len == 0)
 349                         return False;
 350                 if (ntlmssp_resp->hdr_nt_resp.str_str_len == 0)
 351                         return False;
 352                 if (ntlmssp_resp->hdr_usr.str_str_len == 0)
 353                         return False;
 354                 if (ntlmssp_resp->hdr_domain.str_str_len == 0)
 355                         return False;
 356                 if (ntlmssp_resp->hdr_wks.str_str_len == 0)
 357                         return False;
 358
 359         }
 360
 361         if(!guest_user) {
 362
 363                 become_root();
 364
 365                 if(!(p->ntlmssp_auth_validated = pass_check_smb(pipe_user_name, domain,
 366                                       (uchar*)p->challenge, lm_owf, nt_owf, NULL))) {
 367                         DEBUG(1,("api_pipe_ntlmssp_verify: User %s\\%s from machine %s \
 368 failed authentication on named pipe %s.\n", domain, pipe_user_name, wks, p->name ));
 369                         unbecome_root();
 370                         return False;
 371                 }
 372
 373                 pdb_init_sam(&sampass);
 374
 375                 if(!pdb_getsampwnam(sampass, pipe_user_name)) {
 376                         DEBUG(1,("api_pipe_ntlmssp_verify: Cannot find user %s in smb passwd database.\n",
 377                                 pipe_user_name));
 378                         pdb_free_sam(sampass);
 379                         unbecome_root();
 380                         return False;
 381                 }
 382
 383                 unbecome_root();
 384
 385                 /* Quit if the account was disabled. */
 386                 if((pdb_get_acct_ctrl(sampass) & ACB_DISABLED) || !pdb_get_lanman_passwd(sampass)) {
 387                         DEBUG(1,("Account for user '%s' was disabled.\n", pipe_user_name));
 388                         pdb_free_sam(sampass);
 389                         return False;
 390                }
 391
 392                 if(!pdb_get_nt_passwd(sampass)) {
 393                         DEBUG(1,("Account for user '%s' has no NT password hash.\n", pipe_user_name));
 394                         pdb_free_sam(sampass);
 395                         return False;
 396                 }
 397
 398                 smb_passwd_ptr = pdb_get_lanman_passwd(sampass);
 399         }
 400
 401         /*
 402          * Set up the sign/seal data.
 403          */
 404
 405         {
 406                 uchar p24[24];
 407                 NTLMSSPOWFencrypt(smb_passwd_ptr, lm_owf, p24);
 408                 {
 409                         unsigned char j = 0;
 410                         int ind;
 411
 412                         unsigned char k2[8];
 413
 414                         memcpy(k2, p24, 5);
 415                         k2[5] = 0xe5;
 416                         k2[6] = 0x38;
 417                         k2[7] = 0xb0;
 418
 419                         for (ind = 0; ind < 256; ind++)
 420                                 p->ntlmssp_hash[ind] = (unsigned char)ind;
 421
 422                         for( ind = 0; ind < 256; ind++) {
 423                                 unsigned char tc;
 424
 425                                 j += (p->ntlmssp_hash[ind] + k2[ind%8]);
 426
 427                                 tc = p->ntlmssp_hash[ind];
 428                                 p->ntlmssp_hash[ind] = p->ntlmssp_hash[j];
 429                                 p->ntlmssp_hash[j] = tc;
 430                         }
 431
 432                         p->ntlmssp_hash[256] = 0;
 433                         p->ntlmssp_hash[257] = 0;
 434                 }
 435 /*              NTLMSSPhash(p->ntlmssp_hash, p24); */
 436                 p->ntlmssp_seq_num = 0;
 437
 438         }
 439
 440         fstrcpy(p->user_name, user_name);
 441         fstrcpy(p->pipe_user_name, pipe_user_name);
 442         fstrcpy(p->domain, domain);
 443         fstrcpy(p->wks, wks);
 444
 445         /*
 446          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 447          */
 448
 449         p->pipe_user.uid = pdb_get_uid(sampass);
 450         p->pipe_user.gid = pdb_get_uid(sampass);
 451
 452         /* Set up pipe user group membership. */
 453         initialise_groups(pipe_user_name, p->pipe_user.uid, p->pipe_user.gid);
 454         get_current_groups( &p->pipe_user.ngroups, &p->pipe_user.groups);
 455
 456         /* Create an NT_USER_TOKEN struct for this user. */
 457         p->pipe_user.nt_user_token = create_nt_token(p->pipe_user.uid,p->pipe_user.gid,
 458                                                 p->pipe_user.ngroups, p->pipe_user.groups,
 459                                                 guest_user);
 460
 461         p->ntlmssp_auth_validated = True;
 462
 463         pdb_free_sam(sampass);
 464         return True;
 465 }
 466
 467 /*******************************************************************
 468  The switch table for the pipe names and the functions to handle them.
 469  *******************************************************************/
 470
 471 struct api_cmd
 472 {
 473   char * pipe_clnt_name;
 474   char * pipe_srv_name;
 475   BOOL (*fn) (pipes_struct *);
 476 };
 477
 478 static struct api_cmd api_fd_commands[] =
 479 {
 480     { "lsarpc",   "lsass",   api_ntlsa_rpc },
 481     { "samr",     "lsass",   api_samr_rpc },
 482     { "srvsvc",   "ntsvcs",  api_srvsvc_rpc },
 483     { "wkssvc",   "ntsvcs",  api_wkssvc_rpc },
 484     { "NETLOGON", "lsass",   api_netlog_rpc },
 485     { "winreg",   "winreg",  api_reg_rpc },
 486     { "spoolss",  "spoolss", api_spoolss_rpc },
 487 #ifdef WITH_MSDFS
 488     { "netdfs",   "netdfs" , api_netdfs_rpc },
 489 #endif
 490     { NULL,       NULL,      NULL }
 491 };
 492
 493 /*******************************************************************
 494  This is the client reply to our challenge for an authenticated
 495  bind request. The challenge we sent is in p->challenge.
 496 *******************************************************************/
 497
 498 BOOL api_pipe_bind_auth_resp(pipes_struct *p, prs_struct *rpc_in_p)
 499 {
 500         RPC_HDR_AUTHA autha_info;
 501         RPC_AUTH_VERIFIER auth_verifier;
 502         RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 503
 504         DEBUG(5,("api_pipe_bind_auth_resp: decode request. %d\n", __LINE__));
 505
 506         if (p->hdr.auth_len == 0) {
 507                 DEBUG(0,("api_pipe_bind_auth_resp: No auth field sent !\n"));
 508                 return False;
 509         }
 510
 511         /*
 512          * Decode the authentication verifier response.
 513          */
 514
 515         if(!smb_io_rpc_hdr_autha("", &autha_info, rpc_in_p, 0)) {
 516                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_HDR_AUTHA failed.\n"));
 517                 return False;
 518         }
 519
 520         if (autha_info.auth_type != NTLMSSP_AUTH_TYPE || autha_info.auth_level != NTLMSSP_AUTH_LEVEL) {
 521                 DEBUG(0,("api_pipe_bind_auth_resp: incorrect auth type (%d) or level (%d).\n",
 522                         (int)autha_info.auth_type, (int)autha_info.auth_level ));
 523                 return False;
 524         }
 525
 526         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 527                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_AUTH_VERIFIER failed.\n"));
 528                 return False;
 529         }
 530
 531         /*
 532          * Ensure this is a NTLMSSP_AUTH packet type.
 533          */
 534
 535         if (!rpc_auth_verifier_chk(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH)) {
 536                 DEBUG(0,("api_pipe_bind_auth_resp: rpc_auth_verifier_chk failed.\n"));
 537                 return False;
 538         }
 539
 540         if(!smb_io_rpc_auth_ntlmssp_resp("", &ntlmssp_resp, rpc_in_p, 0)) {
 541                 DEBUG(0,("api_pipe_bind_auth_resp: Failed to unmarshall RPC_AUTH_NTLMSSP_RESP.\n"));
 542                 return False;
 543         }
 544
 545         /*
 546          * The following call actually checks the challenge/response data.
 547          * for correctness against the given DOMAIN\user name.
 548          */
 549
 550         if (!api_pipe_ntlmssp_verify(p, &ntlmssp_resp))
 551                 return False;
 552
 553         p->pipe_bound = True
 554 ;
 555         return True;
 556 }
 557
 558 /*******************************************************************
 559  Marshall a bind_nak pdu.
 560 *******************************************************************/
 561
 562 static BOOL setup_bind_nak(pipes_struct *p)
 563 {
 564         prs_struct outgoing_rpc;
 565         RPC_HDR nak_hdr;
 566         uint16 zero = 0;
 567
 568         /* Free any memory in the current return data buffer. */
 569         prs_mem_free(&p->out_data.rdata);
 570
 571         /*
 572          * Marshall directly into the outgoing PDU space. We
 573          * must do this as we need to set to the bind response
 574          * header and are never sending more than one PDU here.
 575          */
 576
 577         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 578         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 579
 580
 581         /*
 582          * Initialize a bind_nak header.
 583          */
 584
 585         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 586             p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 587
 588         /*
 589          * Marshall the header into the outgoing PDU.
 590          */
 591
 592         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 593                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 594                 prs_mem_free(&outgoing_rpc);
 595                 return False;
 596         }
 597
 598         /*
 599          * Now add the reject reason.
 600          */
 601
 602         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 603                 prs_mem_free(&outgoing_rpc);
 604         return False;
 605         }
 606
 607         p->out_data.data_sent_length = 0;
 608         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 609         p->out_data.current_pdu_sent = 0;
 610
 611         p->pipe_bound = False;
 612
 613         return True;
 614 }
 615
 616 /*******************************************************************
 617  Marshall a fault pdu.
 618 *******************************************************************/
 619
 620 BOOL setup_fault_pdu(pipes_struct *p, uint32 status)
 621 {
 622         prs_struct outgoing_pdu;
 623         RPC_HDR fault_hdr;
 624         RPC_HDR_RESP hdr_resp;
 625         RPC_HDR_FAULT fault_resp;
 626
 627         /* Free any memory in the current return data buffer. */
 628         prs_mem_free(&p->out_data.rdata);
 629
 630         /*
 631          * Marshall directly into the outgoing PDU space. We
 632          * must do this as we need to set to the bind response
 633          * header and are never sending more than one PDU here.
 634          */
 635
 636         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 637         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 638
 639         /*
 640          * Initialize a fault header.
 641          */
 642
 643         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 644             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 645
 646         /*
 647          * Initialize the HDR_RESP and FAULT parts of the PDU.
 648          */
 649
 650         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 651
 652         fault_resp.status = status;
 653         fault_resp.reserved = 0;
 654
 655         /*
 656          * Marshall the header into the outgoing PDU.
 657          */
 658
 659         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 660                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 661                 prs_mem_free(&outgoing_pdu);
 662                 return False;
 663         }
 664
 665         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 666                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 667                 prs_mem_free(&outgoing_pdu);
 668                 return False;
 669         }
 670
 671         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 672                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 673                 prs_mem_free(&outgoing_pdu);
 674                 return False;
 675         }
 676
 677         p->out_data.data_sent_length = 0;
 678         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 679         p->out_data.current_pdu_sent = 0;
 680
 681         prs_mem_free(&outgoing_pdu);
 682         return True;
 683 }
 684
 685 /*******************************************************************
 686  Ensure a bind request has the correct abstract & transfer interface.
 687  Used to reject unknown binds from Win2k.
 688 *******************************************************************/
 689
 690 BOOL check_bind_req(char* pipe_name, RPC_IFACE* abstract,
 691                                         RPC_IFACE* transfer)
 692 {
 693         extern struct pipe_id_info pipe_names[];
 694         int i=0;
 695         fstring pname;
 696         fstrcpy(pname,"\\PIPE\\");
 697         fstrcat(pname,pipe_name);
 698
 699         for(i=0;pipe_names[i].client_pipe; i++) {
 700                 if(strequal(pipe_names[i].client_pipe, pname))
 701                         break;
 702         }
 703
 704         if(pipe_names[i].client_pipe == NULL)
 705                 return False;
 706
 707         /* check the abstract interface */
 708         if((abstract->version != pipe_names[i].abstr_syntax.version) ||
 709                 (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid,
 710                         sizeof(RPC_UUID)) != 0))
 711                 return False;
 712
 713         /* check the transfer interface */
 714         if((transfer->version != pipe_names[i].trans_syntax.version) ||
 715                 (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid,
 716                         sizeof(RPC_UUID)) != 0))
 717                 return False;
 718
 719         return True;
 720 }
 721
 722 /*******************************************************************
 723  Respond to a pipe bind request.
 724 *******************************************************************/
 725
 726 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
 727 {
 728         RPC_HDR_BA hdr_ba;
 729         RPC_HDR_RB hdr_rb;
 730         RPC_HDR_AUTH auth_info;
 731         uint16 assoc_gid;
 732         fstring ack_pipe_name;
 733         prs_struct out_hdr_ba;
 734         prs_struct out_auth;
 735         prs_struct outgoing_rpc;
 736         int i = 0;
 737         int auth_len = 0;
 738         enum RPC_PKT_TYPE reply_pkt_type;
 739
 740         p->ntlmssp_auth_requested = False;
 741
 742         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
 743
 744         /*
 745          * Try and find the correct pipe name to ensure
 746          * that this is a pipe name we support.
 747          */
 748
 749         for (i = 0; api_fd_commands[i].pipe_clnt_name; i++) {
 750                 if (strequal(api_fd_commands[i].pipe_clnt_name, p->name) &&
 751                     api_fd_commands[i].fn != NULL) {
 752                         DEBUG(3,("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 753                                    api_fd_commands[i].pipe_clnt_name,
 754                                    api_fd_commands[i].pipe_srv_name));
 755                         fstrcpy(p->pipe_srv_name, api_fd_commands[i].pipe_srv_name);
 756                         break;
 757                 }
 758         }
 759
 760         if (api_fd_commands[i].fn == NULL) {
 761                 DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 762                         p->name ));
 763                 if(!setup_bind_nak(p))
 764                         return False;
 765                 return True;
 766         }
 767
 768         /* decode the bind request */
 769         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
 770                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
 771                 return False;
 772         }
 773
 774         /*
 775          * Check if this is an authenticated request.
 776          */
 777
 778         if (p->hdr.auth_len != 0) {
 779                 RPC_AUTH_VERIFIER auth_verifier;
 780                 RPC_AUTH_NTLMSSP_NEG ntlmssp_neg;
 781
 782                 /*
 783                  * Decode the authentication verifier.
 784                  */
 785
 786                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 787                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 788                         return False;
 789                 }
 790
 791                 /*
 792                  * We only support NTLMSSP_AUTH_TYPE requests.
 793                  */
 794
 795                 if(auth_info.auth_type != NTLMSSP_AUTH_TYPE) {
 796                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n",
 797                                 auth_info.auth_type ));
 798                         return False;
 799                 }
 800
 801                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 802                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 803                         return False;
 804                 }
 805
 806                 if(!strequal(auth_verifier.signature, "NTLMSSP")) {
 807                         DEBUG(0,("api_pipe_bind_req: auth_verifier.signature != NTLMSSP\n"));
 808                         return False;
 809                 }
 810
 811                 if(auth_verifier.msg_type != NTLMSSP_NEGOTIATE) {
 812                         DEBUG(0,("api_pipe_bind_req: auth_verifier.msg_type (%d) != NTLMSSP_NEGOTIATE\n",
 813                                 auth_verifier.msg_type));
 814                         return False;
 815                 }
 816
 817                 if(!smb_io_rpc_auth_ntlmssp_neg("", &ntlmssp_neg, rpc_in_p, 0)) {
 818                         DEBUG(0,("api_pipe_bind_req: Failed to unmarshall RPC_AUTH_NTLMSSP_NEG.\n"));
 819                         return False;
 820                 }
 821
 822                 p->ntlmssp_chal_flags = SMBD_NTLMSSP_NEG_FLAGS;
 823                 p->ntlmssp_auth_requested = True;
 824         }
 825
 826         switch(p->hdr.pkt_type) {
 827                 case RPC_BIND:
 828                         /* name has to be \PIPE\xxxxx */
 829                         fstrcpy(ack_pipe_name, "\\PIPE\\");
 830                         fstrcat(ack_pipe_name, p->pipe_srv_name);
 831                         reply_pkt_type = RPC_BINDACK;
 832                         break;
 833                 case RPC_ALTCONT:
 834                         /* secondary address CAN be NULL
 835                          * as the specs say it's ignored.
 836                          * It MUST NULL to have the spoolss working.
 837                          */
 838                         fstrcpy(ack_pipe_name,"");
 839                         reply_pkt_type = RPC_ALTCONTRESP;
 840                         break;
 841                 default:
 842                         return False;
 843         }
 844
 845         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 846
 847         /*
 848          * Marshall directly into the outgoing PDU space. We
 849          * must do this as we need to set to the bind response
 850          * header and are never sending more than one PDU here.
 851          */
 852
 853         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 854         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 855
 856         /*
 857          * Setup the memory to marshall the ba header, and the
 858          * auth footers.
 859          */
 860
 861         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
 862                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
 863                 prs_mem_free(&outgoing_rpc);
 864                 return False;
 865         }
 866
 867         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
 868                 DEBUG(0,("pi_pipe_bind_req: malloc out_auth failed.\n"));
 869                 prs_mem_free(&outgoing_rpc);
 870                 prs_mem_free(&out_hdr_ba);
 871                 return False;
 872         }
 873
 874         if (p->ntlmssp_auth_requested)
 875                 assoc_gid = 0x7a77;
 876         else
 877                 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
 878
 879         /*
 880          * Create the bind response struct.
 881          */
 882
 883         /* If the requested abstract synt uuid doesn't match our client pipe,
 884                 reject the bind_ack & set the transfer interface synt to all 0's,
 885                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 886                 unknown to NT4)
 887                 Needed when adding entries to a DACL from NT5 - SK */
 888
 889         if(check_bind_req(p->name, &hdr_rb.abstract, &hdr_rb.transfer)) {
 890                 init_rpc_hdr_ba(&hdr_ba,
 891                         MAX_PDU_FRAG_LEN,
 892                         MAX_PDU_FRAG_LEN,
 893                         assoc_gid,
 894                         ack_pipe_name,
 895                         0x1, 0x0, 0x0,
 896                         &hdr_rb.transfer);
 897         } else {
 898                 RPC_IFACE null_interface;
 899                 ZERO_STRUCT(null_interface);
 900                 /* Rejection reason: abstract syntax not supported */
 901                 init_rpc_hdr_ba(&hdr_ba, MAX_PDU_FRAG_LEN,
 902                                         MAX_PDU_FRAG_LEN, assoc_gid,
 903                                         ack_pipe_name, 0x1, 0x2, 0x1,
 904                                         &null_interface);
 905         }
 906
 907         /*
 908          * and marshall it.
 909          */
 910
 911         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
 912                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
 913                 goto err_exit;
 914         }
 915
 916         /*
 917          * Now the authentication.
 918          */
 919
 920         if (p->ntlmssp_auth_requested) {
 921                 RPC_AUTH_VERIFIER auth_verifier;
 922                 RPC_AUTH_NTLMSSP_CHAL ntlmssp_chal;
 923
 924                 generate_random_buffer(p->challenge, 8, False);
 925
 926                 /*** Authentication info ***/
 927
 928                 init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, RPC_HDR_AUTH_LEN, 1);
 929                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
 930                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
 931                         goto err_exit;
 932                 }
 933
 934                 /*** NTLMSSP verifier ***/
 935
 936                 init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_CHALLENGE);
 937                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, &out_auth, 0)) {
 938                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
 939                         goto err_exit;
 940                 }
 941
 942                 /* NTLMSSP challenge ***/
 943
 944                 init_rpc_auth_ntlmssp_chal(&ntlmssp_chal, p->ntlmssp_chal_flags, p->challenge);
 945                 if(!smb_io_rpc_auth_ntlmssp_chal("", &ntlmssp_chal, &out_auth, 0)) {
 946                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_NTLMSSP_CHAL failed.\n"));
 947                         goto err_exit;
 948                 }
 949
 950                 /* Auth len in the rpc header doesn't include auth_header. */
 951                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
 952         }
 953
 954         /*
 955          * Create the header, now we know the length.
 956          */
 957
 958         init_rpc_hdr(&p->hdr, reply_pkt_type, RPC_FLG_FIRST | RPC_FLG_LAST,
 959                         p->hdr.call_id,
 960                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
 961                         auth_len);
 962
 963         /*
 964          * Marshall the header into the outgoing PDU.
 965          */
 966
 967         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
 968                 DEBUG(0,("pi_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
 969                 goto err_exit;
 970         }
 971
 972         /*
 973          * Now add the RPC_HDR_BA and any auth needed.
 974          */
 975
 976         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
 977                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
 978                 goto err_exit;
 979         }
 980
 981         if(p->ntlmssp_auth_requested && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
 982                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
 983                 goto err_exit;
 984         }
 985
 986         if(!p->ntlmssp_auth_requested)
 987                 p->pipe_bound = True;
 988
 989         /*
 990          * Setup the lengths for the initial reply.
 991          */
 992
 993         p->out_data.data_sent_length = 0;
 994         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 995         p->out_data.current_pdu_sent = 0;
 996
 997         prs_mem_free(&out_hdr_ba);
 998         prs_mem_free(&out_auth);
 999
1000         return True;
1001
1002   err_exit:
1003
1004         prs_mem_free(&outgoing_rpc);
1005         prs_mem_free(&out_hdr_ba);
1006         prs_mem_free(&out_auth);
1007         return False;
1008 }
1009
1010 /****************************************************************************
1011  Deal with sign & seal processing on an RPC request.
1012 ****************************************************************************/
1013
1014 BOOL api_pipe_auth_process(pipes_struct *p, prs_struct *rpc_in)
1015 {
1016         /*
1017          * We always negotiate the following two bits....
1018          */
1019         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
1020         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
1021         int data_len;
1022         int auth_len;
1023         uint32 old_offset;
1024         uint32 crc32 = 0;
1025
1026         auth_len = p->hdr.auth_len;
1027
1028         if ((auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) && auth_verify) {
1029                 DEBUG(0,("api_pipe_auth_process: Incorrect auth_len %d.\n", auth_len ));
1030                 return False;
1031         }
1032
1033         /*
1034          * The following is that length of the data we must verify or unseal.
1035          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1036          * preceeding the auth_data.
1037          */
1038
1039         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1040                         (auth_verify ? RPC_HDR_AUTH_LEN : 0) - auth_len;
1041
1042         DEBUG(5,("api_pipe_auth_process: sign: %s seal: %s data %d auth %d\n",
1043                  BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, auth_len));
1044
1045         if (auth_seal) {
1046                 /*
1047                  * The data in rpc_in doesn't contain the RPC_HEADER as this
1048                  * has already been consumed.
1049                  */
1050                 char *data = prs_data_p(rpc_in) + RPC_HDR_REQ_LEN;
1051                 NTLMSSPcalc_p(p, (uchar*)data, data_len);
1052                 crc32 = crc32_calc_buffer(data, data_len);
1053         }
1054
1055         old_offset = prs_offset(rpc_in);
1056
1057         if (auth_seal || auth_verify) {
1058                 RPC_HDR_AUTH auth_info;
1059
1060                 if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1061                         DEBUG(0,("api_pipe_auth_process: cannot move offset to %u.\n",
1062                                 (unsigned int)old_offset + data_len ));
1063                         return False;
1064                 }
1065
1066                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1067                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1068                         return False;
1069                 }
1070         }
1071
1072         if (auth_verify) {
1073                 RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
1074                 char *req_data = prs_data_p(rpc_in) + prs_offset(rpc_in) + 4;
1075
1076                 DEBUG(5,("api_pipe_auth_process: auth %d\n", prs_offset(rpc_in) + 4));
1077
1078                 /*
1079                  * Ensure we have RPC_AUTH_NTLMSSP_CHK_LEN - 4 more bytes in the
1080                  * incoming buffer.
1081                  */
1082                 if(prs_mem_get(rpc_in, RPC_AUTH_NTLMSSP_CHK_LEN - 4) == NULL) {
1083                         DEBUG(0,("api_pipe_auth_process: missing %d bytes in buffer.\n",
1084                                 RPC_AUTH_NTLMSSP_CHK_LEN - 4 ));
1085                         return False;
1086                 }
1087
1088                 NTLMSSPcalc_p(p, (uchar*)req_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
1089                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, rpc_in, 0)) {
1090                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_AUTH_NTLMSSP_CHK.\n"));
1091                         return False;
1092                 }
1093
1094                 if (!rpc_auth_ntlmssp_chk(&ntlmssp_chk, crc32, p->ntlmssp_seq_num)) {
1095                         DEBUG(0,("api_pipe_auth_process: NTLMSSP check failed.\n"));
1096                         return False;
1097                 }
1098         }
1099
1100         /*
1101          * Return the current pointer to the data offset.
1102          */
1103
1104         if(!prs_set_offset(rpc_in, old_offset)) {
1105                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
1106                         (unsigned int)old_offset ));
1107                 return False;
1108         }
1109
1110         return True;
1111 }
1112
1113 /****************************************************************************
1114  Return a user struct for a pipe user.
1115 ****************************************************************************/
1116
1117 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
1118 {
1119         if (p->ntlmssp_auth_validated) {
1120                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
1121         } else {
1122                 extern struct current_user current_user;
1123                 memcpy(user, &current_user, sizeof(struct current_user));
1124         }
1125
1126         return user;
1127 }
1128
1129 /****************************************************************************
1130  Find the correct RPC function to call for this request.
1131  If the pipe is authenticated then become the correct UNIX user
1132  before doing the call.
1133 ****************************************************************************/
1134
1135 BOOL api_pipe_request(pipes_struct *p)
1136 {
1137         int i = 0;
1138         BOOL ret = False;
1139         BOOL changed_user_id = False;
1140
1141         if (p->ntlmssp_auth_validated) {
1142
1143                 if(!become_authenticated_pipe_user(p)) {
1144                         prs_mem_free(&p->out_data.rdata);
1145                         return False;
1146                 }
1147
1148                 changed_user_id = True;
1149         }
1150
1151         for (i = 0; api_fd_commands[i].pipe_clnt_name; i++) {
1152                 if (strequal(api_fd_commands[i].pipe_clnt_name, p->name) &&
1153                     api_fd_commands[i].fn != NULL) {
1154                         DEBUG(3,("Doing \\PIPE\\%s\n", api_fd_commands[i].pipe_clnt_name));
1155                         set_current_rpc_talloc(p->mem_ctx);
1156                         ret = api_fd_commands[i].fn(p);
1157                         set_current_rpc_talloc(NULL);
1158                 }
1159         }
1160
1161         if(changed_user_id)
1162                 unbecome_authenticated_pipe_user(p);
1163
1164         return ret;
1165 }
1166
1167 /*******************************************************************
1168  Calls the underlying RPC function for a named pipe.
1169  ********************************************************************/
1170
1171 BOOL api_rpcTNP(pipes_struct *p, char *rpc_name,
1172                 struct api_struct *api_rpc_cmds)
1173 {
1174         int fn_num;
1175         fstring name;
1176         uint32 offset1, offset2;
1177
1178         /* interpret the command */
1179         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
1180
1181         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
1182         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
1183
1184         for (fn_num = 0; api_rpc_cmds[fn_num].name; fn_num++) {
1185                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
1186                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
1187                         break;
1188                 }
1189         }
1190
1191         if (api_rpc_cmds[fn_num].name == NULL) {
1192                 /*
1193                  * For an unknown RPC just return a fault PDU but
1194                  * return True to allow RPC's on the pipe to continue
1195                  * and not put the pipe into fault state. JRA.
1196                  */
1197                 DEBUG(4, ("unknown\n"));
1198                 setup_fault_pdu(p, 0x1c010002);
1199                 return True;
1200         }
1201
1202         offset1 = prs_offset(&p->out_data.rdata);
1203
1204         /* do the actual command */
1205         if(!api_rpc_cmds[fn_num].fn(p)) {
1206                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
1207                 prs_mem_free(&p->out_data.rdata);
1208                 return False;
1209         }
1210
1211         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
1212         offset2 = prs_offset(&p->out_data.rdata);
1213         prs_set_offset(&p->out_data.rdata, offset1);
1214         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
1215         prs_set_offset(&p->out_data.rdata, offset2);
1216
1217         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
1218
1219         /* Check for buffer underflow in rpc parsing */
1220
1221         if ((DEBUGLEVEL >= 10) &&
1222             (p->in_data.data.data_offset != p->in_data.data.buffer_size)) {
1223                 int data_len = p->in_data.data.buffer_size -
1224                         p->in_data.data.data_offset;
1225                 char *data;
1226
1227                 data = malloc(data_len);
1228
1229                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1230                 if (data) {
1231                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data,
1232                                    data_len);
1233                         free(data);
1234                 }
1235
1236         }
1237
1238         return True;
1239 }