source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Copyright (C) Andrew Tridgell              1992-1998
   5  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   6  *  Copyright (C) Paul Ashton                  1997-1998,
   7  *  Copyright (C) Jeremy Allison                    1999,
   8  *  Copyright (C) Jim McDonough <jmcd@us.ibm.com>   2003.
   9  *
  10  *  This program is free software; you can redistribute it and/or modify
  11  *  it under the terms of the GNU General Public License as published by
  12  *  the Free Software Foundation; either version 2 of the License, or
  13  *  (at your option) any later version.
  14  *
  15  *  This program is distributed in the hope that it will be useful,
  16  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  17  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  18  *  GNU General Public License for more details.
  19  *
  20  *  You should have received a copy of the GNU General Public License
  21  *  along with this program; if not, write to the Free Software
  22  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  23  */
  24
  25 /*  this module apparently provides an implementation of DCE/RPC over a
  26  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  27  *  documentation are available (in on-line form) from the X-Open group.
  28  *
  29  *  this module should provide a level of abstraction between SMB
  30  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  31  *  data copies, and network traffic.
  32  *
  33  *  in this version, which takes a "let's learn what's going on and
  34  *  get something running" approach, there is additional network
  35  *  traffic generated, but the code should be easier to understand...
  36  *
  37  *  ... if you read the docs.  or stare at packets for weeks on end.
  38  *
  39  */
  40
  41 #include "includes.h"
  42
  43 #undef DBGC_CLASS
  44 #define DBGC_CLASS DBGC_RPC_SRV
  45
  46 /*************************************************************
  47  HACK Alert!
  48  We need to transfer the session key from one rpc bind to the
  49  next. This is the way the netlogon schannel works.
  50 **************************************************************/
  51 struct dcinfo last_dcinfo;
  52
  53 static void NTLMSSPcalc_p( pipes_struct *p, unsigned char *data, int len)
  54 {
  55         unsigned char *hash = p->ntlmssp_hash;
  56         unsigned char index_i = hash[256];
  57         unsigned char index_j = hash[257];
  58         int ind;
  59
  60         for( ind = 0; ind < len; ind++) {
  61                 unsigned char tc;
  62                 unsigned char t;
  63
  64                 index_i++;
  65                 index_j += hash[index_i];
  66
  67                 tc = hash[index_i];
  68                 hash[index_i] = hash[index_j];
  69                 hash[index_j] = tc;
  70
  71                 t = hash[index_i] + hash[index_j];
  72                 data[ind] = data[ind] ^ hash[t];
  73         }
  74
  75         hash[256] = index_i;
  76         hash[257] = index_j;
  77 }
  78
  79 /*******************************************************************
  80  Generate the next PDU to be returned from the data in p->rdata.
  81  We cheat here as this function doesn't handle the special auth
  82  footers of the authenticated bind response reply.
  83  ********************************************************************/
  84
  85 BOOL create_next_pdu(pipes_struct *p)
  86 {
  87         RPC_HDR_RESP hdr_resp;
  88         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
  89         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
  90         uint32 ss_padding_len = 0;
  91         uint32 data_len;
  92         uint32 data_space_available;
  93         uint32 data_len_left;
  94         prs_struct outgoing_pdu;
  95         uint32 data_pos;
  96
  97         /*
  98          * If we're in the fault state, keep returning fault PDU's until
  99          * the pipe gets closed. JRA.
 100          */
 101
 102         if(p->fault_state) {
 103                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
 104                 return True;
 105         }
 106
 107         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 108
 109         /* Change the incoming request header to a response. */
 110         p->hdr.pkt_type = RPC_RESPONSE;
 111
 112         /* Set up rpc header flags. */
 113         if (p->out_data.data_sent_length == 0) {
 114                 p->hdr.flags = RPC_FLG_FIRST;
 115         } else {
 116                 p->hdr.flags = 0;
 117         }
 118
 119         /*
 120          * Work out how much we can fit in a single PDU.
 121          */
 122
 123         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 124         if(p->ntlmssp_auth_validated) {
 125                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN);
 126         } else if(p->netsec_auth_validated) {
 127                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NETSEC_SIGN_OR_SEAL_CHK_LEN);
 128         }
 129
 130         /*
 131          * The amount we send is the minimum of the available
 132          * space and the amount left to send.
 133          */
 134
 135         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 136
 137         /*
 138          * Ensure there really is data left to send.
 139          */
 140
 141         if(!data_len_left) {
 142                 DEBUG(0,("create_next_pdu: no data left to send !\n"));
 143                 return False;
 144         }
 145
 146         data_len = MIN(data_len_left, data_space_available);
 147
 148         /*
 149          * Set up the alloc hint. This should be the data left to
 150          * send.
 151          */
 152
 153         hdr_resp.alloc_hint = data_len_left;
 154
 155         /*
 156          * Work out if this PDU will be the last.
 157          */
 158
 159         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 160                 p->hdr.flags |= RPC_FLG_LAST;
 161                 if ((auth_seal || auth_verify) && (data_len_left % 8)) {
 162                         ss_padding_len = 8 - (data_len_left % 8);
 163                         DEBUG(10,("create_next_pdu: adding sign/seal padding of %u\n",
 164                                 ss_padding_len ));
 165                 }
 166         }
 167
 168         /*
 169          * Set up the header lengths.
 170          */
 171
 172         if (p->ntlmssp_auth_validated) {
 173                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 174                         data_len + ss_padding_len +
 175                         RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN;
 176                 p->hdr.auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 177         } else if (p->netsec_auth_validated) {
 178                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 179                         data_len + ss_padding_len +
 180                         RPC_HDR_AUTH_LEN + RPC_AUTH_NETSEC_SIGN_OR_SEAL_CHK_LEN;
 181                 p->hdr.auth_len = RPC_AUTH_NETSEC_SIGN_OR_SEAL_CHK_LEN;
 182         } else {
 183                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 184                 p->hdr.auth_len = 0;
 185         }
 186
 187         /*
 188          * Init the parse struct to point at the outgoing
 189          * data.
 190          */
 191
 192         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 193         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 194
 195         /* Store the header in the data stream. */
 196         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 197                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR.\n"));
 198                 prs_mem_free(&outgoing_pdu);
 199                 return False;
 200         }
 201
 202         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 203                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_RESP.\n"));
 204                 prs_mem_free(&outgoing_pdu);
 205                 return False;
 206         }
 207
 208         /* Store the current offset. */
 209         data_pos = prs_offset(&outgoing_pdu);
 210
 211         /* Copy the data into the PDU. */
 212
 213         if(!prs_append_some_prs_data(&outgoing_pdu, &p->out_data.rdata, p->out_data.data_sent_length, data_len)) {
 214                 DEBUG(0,("create_next_pdu: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 215                 prs_mem_free(&outgoing_pdu);
 216                 return False;
 217         }
 218
 219         /* Copy the sign/seal padding data. */
 220         if (ss_padding_len) {
 221                 char pad[8];
 222                 memset(pad, '\0', 8);
 223                 if (!prs_copy_data_in(&outgoing_pdu, pad, ss_padding_len)) {
 224                         DEBUG(0,("create_next_pdu: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 225                         prs_mem_free(&outgoing_pdu);
 226                         return False;
 227                 }
 228         }
 229
 230         if (p->ntlmssp_auth_validated) {
 231                 /*
 232                  * NTLMSSP processing. Mutually exclusive with Schannel.
 233                  */
 234                 uint32 crc32 = 0;
 235                 char *data;
 236
 237                 DEBUG(5,("create_next_pdu: sign: %s seal: %s data %d auth %d\n",
 238                          BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len + ss_padding_len, p->hdr.auth_len));
 239
 240                 /*
 241                  * Set data to point to where we copied the data into.
 242                  */
 243
 244                 data = prs_data_p(&outgoing_pdu) + data_pos;
 245
 246                 if (auth_seal) {
 247                         crc32 = crc32_calc_buffer(data, data_len + ss_padding_len);
 248                         NTLMSSPcalc_p(p, (uchar*)data, data_len + ss_padding_len);
 249                 }
 250
 251                 if (auth_seal || auth_verify) {
 252                         RPC_HDR_AUTH auth_info;
 253
 254                         init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE,
 255                                         auth_seal ? RPC_PIPE_AUTH_SEAL_LEVEL : RPC_PIPE_AUTH_SIGN_LEVEL,
 256                                         (auth_verify ? ss_padding_len : 0), (auth_verify ? 1 : 0));
 257                         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 258                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 259                                 prs_mem_free(&outgoing_pdu);
 260                                 return False;
 261                         }
 262                 }
 263
 264                 if (auth_verify) {
 265                         RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
 266                         char *auth_data = prs_data_p(&outgoing_pdu);
 267
 268                         p->ntlmssp_seq_num++;
 269                         init_rpc_auth_ntlmssp_chk(&ntlmssp_chk, NTLMSSP_SIGN_VERSION,
 270                                         crc32, p->ntlmssp_seq_num++);
 271                         auth_data = prs_data_p(&outgoing_pdu) + prs_offset(&outgoing_pdu) + 4;
 272                         if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, &outgoing_pdu, 0)) {
 273                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_AUTH_NTLMSSP_CHK.\n"));
 274                                 prs_mem_free(&outgoing_pdu);
 275                                 return False;
 276                         }
 277                         NTLMSSPcalc_p(p, (uchar*)auth_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 278                 }
 279         } else if (p->netsec_auth_validated) {
 280                 /*
 281                  * Schannel processing. Mutually exclusive with NTLMSSP.
 282                  */
 283                 int auth_type, auth_level;
 284                 char *data;
 285                 RPC_HDR_AUTH auth_info;
 286
 287                 RPC_AUTH_NETSEC_CHK verf;
 288                 prs_struct rverf;
 289                 prs_struct rauth;
 290
 291                 data = prs_data_p(&outgoing_pdu) + data_pos;
 292                 /* Check it's the type of reply we were expecting to decode */
 293
 294                 get_auth_type_level(p->netsec_auth.auth_flags, &auth_type, &auth_level);
 295                 init_rpc_hdr_auth(&auth_info, auth_type, auth_level,
 296                                   ss_padding_len, 1);
 297
 298                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 299                         DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 300                         prs_mem_free(&outgoing_pdu);
 301                         return False;
 302                 }
 303
 304                 prs_init(&rverf, 0, p->mem_ctx, MARSHALL);
 305                 prs_init(&rauth, 0, p->mem_ctx, MARSHALL);
 306
 307                 netsec_encode(&p->netsec_auth,
 308                               p->netsec_auth.auth_flags,
 309                               SENDER_IS_ACCEPTOR,
 310                               &verf, data, data_len + ss_padding_len);
 311
 312                 smb_io_rpc_auth_netsec_chk("", RPC_AUTH_NETSEC_SIGN_OR_SEAL_CHK_LEN,
 313                         &verf, &outgoing_pdu, 0);
 314
 315                 p->netsec_auth.seq_num++;
 316         }
 317
 318         /*
 319          * Setup the counts for this PDU.
 320          */
 321
 322         p->out_data.data_sent_length += data_len;
 323         p->out_data.current_pdu_len = p->hdr.frag_len;
 324         p->out_data.current_pdu_sent = 0;
 325
 326         prs_mem_free(&outgoing_pdu);
 327         return True;
 328 }
 329
 330 /*******************************************************************
 331  Process an NTLMSSP authentication response.
 332  If this function succeeds, the user has been authenticated
 333  and their domain, name and calling workstation stored in
 334  the pipe struct.
 335  The initial challenge is stored in p->challenge.
 336  *******************************************************************/
 337
 338 static BOOL api_pipe_ntlmssp_verify(pipes_struct *p, RPC_AUTH_NTLMSSP_RESP *ntlmssp_resp)
 339 {
 340         uchar lm_owf[24];
 341         uchar nt_owf[128];
 342         int nt_pw_len;
 343         int lm_pw_len;
 344         fstring user_name;
 345         fstring domain;
 346         fstring wks;
 347
 348         NTSTATUS nt_status;
 349
 350         struct auth_context *auth_context = NULL;
 351         auth_usersupplied_info *user_info = NULL;
 352         auth_serversupplied_info *server_info = NULL;
 353
 354         DEBUG(5,("api_pipe_ntlmssp_verify: checking user details\n"));
 355
 356         memset(p->user_name, '\0', sizeof(p->user_name));
 357         memset(p->pipe_user_name, '\0', sizeof(p->pipe_user_name));
 358         memset(p->domain, '\0', sizeof(p->domain));
 359         memset(p->wks, '\0', sizeof(p->wks));
 360
 361         /* Set up for non-authenticated user. */
 362         delete_nt_token(&p->pipe_user.nt_user_token);
 363         p->pipe_user.ngroups = 0;
 364         SAFE_FREE( p->pipe_user.groups);
 365
 366         /*
 367          * Setup an empty password for a guest user.
 368          */
 369
 370         /*
 371          * We always negotiate UNICODE.
 372          */
 373
 374         if (p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_UNICODE) {
 375                 rpcstr_pull(user_name, ntlmssp_resp->user, sizeof(fstring), ntlmssp_resp->hdr_usr.str_str_len*2, 0 );
 376                 rpcstr_pull(domain, ntlmssp_resp->domain, sizeof(fstring), ntlmssp_resp->hdr_domain.str_str_len*2, 0);
 377                 rpcstr_pull(wks, ntlmssp_resp->wks, sizeof(fstring), ntlmssp_resp->hdr_wks.str_str_len*2, 0);
 378         } else {
 379                 pull_ascii_fstring(user_name, ntlmssp_resp->user);
 380                 pull_ascii_fstring(domain, ntlmssp_resp->domain);
 381                 pull_ascii_fstring(wks, ntlmssp_resp->wks);
 382         }
 383
 384         DEBUG(5,("user: %s domain: %s wks: %s\n", user_name, domain, wks));
 385
 386         nt_pw_len = MIN(sizeof(nt_owf), ntlmssp_resp->hdr_nt_resp.str_str_len);
 387         lm_pw_len = MIN(sizeof(lm_owf), ntlmssp_resp->hdr_lm_resp.str_str_len);
 388
 389         memcpy(lm_owf, ntlmssp_resp->lm_resp, sizeof(lm_owf));
 390         memcpy(nt_owf, ntlmssp_resp->nt_resp, nt_pw_len);
 391
 392 #ifdef DEBUG_PASSWORD
 393         DEBUG(100,("lm, nt owfs, chal\n"));
 394         dump_data(100, (char *)lm_owf, sizeof(lm_owf));
 395         dump_data(100, (char *)nt_owf, nt_pw_len);
 396         dump_data(100, (char *)p->challenge, 8);
 397 #endif
 398
 399         /*
 400          * Allow guest access. Patch from Shirish Kalele <kalele@veritas.com>.
 401          */
 402
 403         if (*user_name) {
 404
 405                 /*
 406                  * Do the length checking only if user is not NULL.
 407                  */
 408
 409                 if (ntlmssp_resp->hdr_lm_resp.str_str_len == 0)
 410                         return False;
 411                 if (ntlmssp_resp->hdr_nt_resp.str_str_len == 0)
 412                         return False;
 413                 if (ntlmssp_resp->hdr_usr.str_str_len == 0)
 414                         return False;
 415                 if (ntlmssp_resp->hdr_domain.str_str_len == 0)
 416                         return False;
 417                 if (ntlmssp_resp->hdr_wks.str_str_len == 0)
 418                         return False;
 419
 420         }
 421
 422         make_auth_context_fixed(&auth_context, (uchar*)p->challenge);
 423
 424         if (!make_user_info_netlogon_network(&user_info,
 425                                              user_name, domain, wks,
 426                                              lm_owf, lm_pw_len,
 427                                              nt_owf, nt_pw_len)) {
 428                 DEBUG(0,("make_user_info_netlogon_network failed!  Failing authenticaion.\n"));
 429                 return False;
 430         }
 431
 432         nt_status = auth_context->check_ntlm_password(auth_context, user_info, &server_info);
 433
 434         (auth_context->free)(&auth_context);
 435         free_user_info(&user_info);
 436
 437         p->ntlmssp_auth_validated = NT_STATUS_IS_OK(nt_status);
 438
 439         if (!p->ntlmssp_auth_validated) {
 440                 DEBUG(1,("api_pipe_ntlmssp_verify: User [%s]\\[%s] from machine %s \
 441 failed authentication on named pipe %s.\n", domain, user_name, wks, p->name ));
 442                 free_server_info(&server_info);
 443                 return False;
 444         }
 445
 446         /*
 447          * Set up the sign/seal data.
 448          */
 449
 450         if (server_info->lm_session_key.length != 16) {
 451                 DEBUG(1,("api_pipe_ntlmssp_verify: User [%s]\\[%s] from machine %s \
 452 succeeded authentication on named pipe %s, but session key was of incorrect length [%u].\n",
 453                          domain, user_name, wks, p->name, server_info->lm_session_key.length));
 454                 free_server_info(&server_info);
 455                 return False;
 456         } else {
 457                 uchar p24[24];
 458                 NTLMSSPOWFencrypt(server_info->lm_session_key.data, lm_owf, p24);
 459                 {
 460                         unsigned char j = 0;
 461                         int ind;
 462
 463                         unsigned char k2[8];
 464
 465                         memcpy(k2, p24, 5);
 466                         k2[5] = 0xe5;
 467                         k2[6] = 0x38;
 468                         k2[7] = 0xb0;
 469
 470                         for (ind = 0; ind < 256; ind++)
 471                                 p->ntlmssp_hash[ind] = (unsigned char)ind;
 472
 473                         for( ind = 0; ind < 256; ind++) {
 474                                 unsigned char tc;
 475
 476                                 j += (p->ntlmssp_hash[ind] + k2[ind%8]);
 477
 478                                 tc = p->ntlmssp_hash[ind];
 479                                 p->ntlmssp_hash[ind] = p->ntlmssp_hash[j];
 480                                 p->ntlmssp_hash[j] = tc;
 481                         }
 482
 483                         p->ntlmssp_hash[256] = 0;
 484                         p->ntlmssp_hash[257] = 0;
 485                 }
 486
 487                 dump_data_pw("NTLMSSP hash (v1)\n", p->ntlmssp_hash,
 488                              sizeof(p->ntlmssp_hash));
 489
 490 /*              NTLMSSPhash(p->ntlmssp_hash, p24); */
 491                 p->ntlmssp_seq_num = 0;
 492
 493         }
 494
 495         fstrcpy(p->user_name, user_name);
 496         fstrcpy(p->pipe_user_name, server_info->unix_name);
 497         fstrcpy(p->domain, domain);
 498         fstrcpy(p->wks, wks);
 499
 500         /*
 501          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 502          */
 503
 504         if (p->session_key.data) {
 505                 data_blob_free(&p->session_key);
 506         }
 507         p->session_key = data_blob(server_info->lm_session_key.data, server_info->lm_session_key.length);
 508
 509         p->pipe_user.uid = server_info->uid;
 510         p->pipe_user.gid = server_info->gid;
 511
 512         p->pipe_user.ngroups = server_info->n_groups;
 513         if (p->pipe_user.ngroups) {
 514                 if (!(p->pipe_user.groups = memdup(server_info->groups, sizeof(gid_t) * p->pipe_user.ngroups))) {
 515                         DEBUG(0,("failed to memdup group list to p->pipe_user.groups\n"));
 516                         free_server_info(&server_info);
 517                         return False;
 518                 }
 519         }
 520
 521         if (server_info->ptok)
 522                 p->pipe_user.nt_user_token = dup_nt_token(server_info->ptok);
 523         else {
 524                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 525                 p->pipe_user.nt_user_token = NULL;
 526                 free_server_info(&server_info);
 527                 return False;
 528         }
 529
 530         p->ntlmssp_auth_validated = True;
 531
 532         free_server_info(&server_info);
 533         return True;
 534 }
 535
 536 /*******************************************************************
 537  The switch table for the pipe names and the functions to handle them.
 538  *******************************************************************/
 539
 540 struct rpc_table
 541 {
 542   struct
 543   {
 544     const char *clnt;
 545     const char *srv;
 546   } pipe;
 547   struct api_struct *cmds;
 548   int n_cmds;
 549 };
 550
 551 static struct rpc_table *rpc_lookup;
 552 static int rpc_lookup_size;
 553
 554 /*******************************************************************
 555  This is the client reply to our challenge for an authenticated
 556  bind request. The challenge we sent is in p->challenge.
 557 *******************************************************************/
 558
 559 BOOL api_pipe_bind_auth_resp(pipes_struct *p, prs_struct *rpc_in_p)
 560 {
 561         RPC_HDR_AUTHA autha_info;
 562         RPC_AUTH_VERIFIER auth_verifier;
 563         RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 564
 565         DEBUG(5,("api_pipe_bind_auth_resp: decode request. %d\n", __LINE__));
 566
 567         if (p->hdr.auth_len == 0) {
 568                 DEBUG(0,("api_pipe_bind_auth_resp: No auth field sent !\n"));
 569                 return False;
 570         }
 571
 572         /*
 573          * Decode the authentication verifier response.
 574          */
 575
 576         if(!smb_io_rpc_hdr_autha("", &autha_info, rpc_in_p, 0)) {
 577                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_HDR_AUTHA failed.\n"));
 578                 return False;
 579         }
 580
 581         if (autha_info.auth_type != NTLMSSP_AUTH_TYPE || autha_info.auth_level != RPC_PIPE_AUTH_SEAL_LEVEL) {
 582                 DEBUG(0,("api_pipe_bind_auth_resp: incorrect auth type (%d) or level (%d).\n",
 583                         (int)autha_info.auth_type, (int)autha_info.auth_level ));
 584                 return False;
 585         }
 586
 587         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 588                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_AUTH_VERIFIER failed.\n"));
 589                 return False;
 590         }
 591
 592         /*
 593          * Ensure this is a NTLMSSP_AUTH packet type.
 594          */
 595
 596         if (!rpc_auth_verifier_chk(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH)) {
 597                 DEBUG(0,("api_pipe_bind_auth_resp: rpc_auth_verifier_chk failed.\n"));
 598                 return False;
 599         }
 600
 601         if(!smb_io_rpc_auth_ntlmssp_resp("", &ntlmssp_resp, rpc_in_p, 0)) {
 602                 DEBUG(0,("api_pipe_bind_auth_resp: Failed to unmarshall RPC_AUTH_NTLMSSP_RESP.\n"));
 603                 return False;
 604         }
 605
 606         /*
 607          * The following call actually checks the challenge/response data.
 608          * for correctness against the given DOMAIN\user name.
 609          */
 610
 611         if (!api_pipe_ntlmssp_verify(p, &ntlmssp_resp))
 612                 return False;
 613
 614         p->pipe_bound = True
 615 ;
 616         return True;
 617 }
 618
 619 /*******************************************************************
 620  Marshall a bind_nak pdu.
 621 *******************************************************************/
 622
 623 static BOOL setup_bind_nak(pipes_struct *p)
 624 {
 625         prs_struct outgoing_rpc;
 626         RPC_HDR nak_hdr;
 627         uint16 zero = 0;
 628
 629         /* Free any memory in the current return data buffer. */
 630         prs_mem_free(&p->out_data.rdata);
 631
 632         /*
 633          * Marshall directly into the outgoing PDU space. We
 634          * must do this as we need to set to the bind response
 635          * header and are never sending more than one PDU here.
 636          */
 637
 638         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
 639         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 640
 641
 642         /*
 643          * Initialize a bind_nak header.
 644          */
 645
 646         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 647             p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 648
 649         /*
 650          * Marshall the header into the outgoing PDU.
 651          */
 652
 653         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 654                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 655                 prs_mem_free(&outgoing_rpc);
 656                 return False;
 657         }
 658
 659         /*
 660          * Now add the reject reason.
 661          */
 662
 663         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero)) {
 664                 prs_mem_free(&outgoing_rpc);
 665         return False;
 666         }
 667
 668         p->out_data.data_sent_length = 0;
 669         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 670         p->out_data.current_pdu_sent = 0;
 671
 672         p->pipe_bound = False;
 673
 674         return True;
 675 }
 676
 677 /*******************************************************************
 678  Marshall a fault pdu.
 679 *******************************************************************/
 680
 681 BOOL setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 682 {
 683         prs_struct outgoing_pdu;
 684         RPC_HDR fault_hdr;
 685         RPC_HDR_RESP hdr_resp;
 686         RPC_HDR_FAULT fault_resp;
 687
 688         /* Free any memory in the current return data buffer. */
 689         prs_mem_free(&p->out_data.rdata);
 690
 691         /*
 692          * Marshall directly into the outgoing PDU space. We
 693          * must do this as we need to set to the bind response
 694          * header and are never sending more than one PDU here.
 695          */
 696
 697         prs_init( &outgoing_pdu, 0, p->mem_ctx, MARSHALL);
 698         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 699
 700         /*
 701          * Initialize a fault header.
 702          */
 703
 704         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 705             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 706
 707         /*
 708          * Initialize the HDR_RESP and FAULT parts of the PDU.
 709          */
 710
 711         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 712
 713         fault_resp.status = status;
 714         fault_resp.reserved = 0;
 715
 716         /*
 717          * Marshall the header into the outgoing PDU.
 718          */
 719
 720         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 721                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 722                 prs_mem_free(&outgoing_pdu);
 723                 return False;
 724         }
 725
 726         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 727                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 728                 prs_mem_free(&outgoing_pdu);
 729                 return False;
 730         }
 731
 732         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 733                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 734                 prs_mem_free(&outgoing_pdu);
 735                 return False;
 736         }
 737
 738         p->out_data.data_sent_length = 0;
 739         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 740         p->out_data.current_pdu_sent = 0;
 741
 742         prs_mem_free(&outgoing_pdu);
 743         return True;
 744 }
 745
 746 /*******************************************************************
 747  Ensure a bind request has the correct abstract & transfer interface.
 748  Used to reject unknown binds from Win2k.
 749 *******************************************************************/
 750
 751 BOOL check_bind_req(struct pipes_struct *p, RPC_IFACE* abstract,
 752                     RPC_IFACE* transfer, uint32 context_id)
 753 {
 754         extern struct pipe_id_info pipe_names[];
 755         char *pipe_name = p->name;
 756         int i=0;
 757         fstring pname;
 758
 759         fstrcpy(pname,"\\PIPE\\");
 760         fstrcat(pname,pipe_name);
 761
 762         DEBUG(3,("check_bind_req for %s\n", pname));
 763
 764         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
 765
 766         for ( i=0; pipe_names[i].client_pipe; i++ )
 767         {
 768                 DEBUG(10,("checking %s\n", pipe_names[i].client_pipe));
 769                 if ( strequal(pipe_names[i].client_pipe, pname)
 770                         && (abstract->version == pipe_names[i].abstr_syntax.version)
 771                         && (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid, sizeof(struct uuid)) == 0)
 772                         && (transfer->version == pipe_names[i].trans_syntax.version)
 773                         && (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid, sizeof(struct uuid)) == 0) )
 774                 {
 775                         struct api_struct       *fns = NULL;
 776                         int                     n_fns = 0;
 777                         PIPE_RPC_FNS            *context_fns;
 778
 779                         if ( !(context_fns = SMB_MALLOC_P(PIPE_RPC_FNS)) ) {
 780                                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
 781                                 return False;
 782                         }
 783
 784                         /* save the RPC function table associated with this bind */
 785
 786                         get_pipe_fns(i, &fns, &n_fns);
 787
 788                         context_fns->cmds = fns;
 789                         context_fns->n_cmds = n_fns;
 790                         context_fns->context_id = context_id;
 791
 792                         /* add to the list of open contexts */
 793
 794                         DLIST_ADD( p->contexts, context_fns );
 795
 796                         break;
 797                 }
 798         }
 799
 800         if(pipe_names[i].client_pipe == NULL)
 801                 return False;
 802
 803         return True;
 804 }
 805
 806 /*******************************************************************
 807  Register commands to an RPC pipe
 808 *******************************************************************/
 809 NTSTATUS rpc_pipe_register_commands(int version, const char *clnt, const char *srv, const struct api_struct *cmds, int size)
 810 {
 811         struct rpc_table *rpc_entry;
 812
 813         if (!clnt || !srv || !cmds) {
 814                 return NT_STATUS_INVALID_PARAMETER;
 815         }
 816
 817         if (version != SMB_RPC_INTERFACE_VERSION) {
 818                 DEBUG(0,("Can't register rpc commands!\n"
 819                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
 820                          ", while this version of samba uses version %d!\n",
 821                          version,SMB_RPC_INTERFACE_VERSION));
 822                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
 823         }
 824
 825         /* TODO:
 826          *
 827          * we still need to make sure that don't register the same commands twice!!!
 828          *
 829          * --metze
 830          */
 831
 832         /* We use a temporary variable because this call can fail and
 833            rpc_lookup will still be valid afterwards.  It could then succeed if
 834            called again later */
 835         rpc_lookup_size++;
 836         rpc_entry = SMB_REALLOC_ARRAY(rpc_lookup, struct rpc_table, rpc_lookup_size);
 837         if (NULL == rpc_entry) {
 838                 rpc_lookup_size--;
 839                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
 840                 return NT_STATUS_NO_MEMORY;
 841         } else {
 842                 rpc_lookup = rpc_entry;
 843         }
 844
 845         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
 846         ZERO_STRUCTP(rpc_entry);
 847         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
 848         rpc_entry->pipe.srv = SMB_STRDUP(srv);
 849         rpc_entry->cmds = SMB_REALLOC_ARRAY(rpc_entry->cmds, struct api_struct, rpc_entry->n_cmds + size);
 850         memcpy(rpc_entry->cmds + rpc_entry->n_cmds, cmds, size * sizeof(struct api_struct));
 851         rpc_entry->n_cmds += size;
 852
 853         return NT_STATUS_OK;
 854 }
 855
 856 /*******************************************************************
 857  Respond to a pipe bind request.
 858 *******************************************************************/
 859
 860 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
 861 {
 862         RPC_HDR_BA hdr_ba;
 863         RPC_HDR_RB hdr_rb;
 864         RPC_HDR_AUTH auth_info;
 865         uint16 assoc_gid;
 866         fstring ack_pipe_name;
 867         prs_struct out_hdr_ba;
 868         prs_struct out_auth;
 869         prs_struct outgoing_rpc;
 870         int i = 0;
 871         int auth_len = 0;
 872         enum RPC_PKT_TYPE reply_pkt_type;
 873
 874         p->ntlmssp_auth_requested = False;
 875         p->netsec_auth_validated = False;
 876
 877         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
 878
 879         /*
 880          * Try and find the correct pipe name to ensure
 881          * that this is a pipe name we support.
 882          */
 883
 884
 885         for (i = 0; i < rpc_lookup_size; i++) {
 886                 if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
 887                   DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 888                             rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
 889                   fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
 890                   break;
 891                 }
 892         }
 893
 894         if (i == rpc_lookup_size) {
 895                 if (NT_STATUS_IS_ERR(smb_probe_module("rpc", p->name))) {
 896                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 897                                 p->name ));
 898                        if(!setup_bind_nak(p))
 899                                return False;
 900                        return True;
 901                 }
 902
 903                 for (i = 0; i < rpc_lookup_size; i++) {
 904                        if (strequal(rpc_lookup[i].pipe.clnt, p->name)) {
 905                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 906                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
 907                                fstrcpy(p->pipe_srv_name, rpc_lookup[i].pipe.srv);
 908                                break;
 909                        }
 910                 }
 911
 912                 if (i == rpc_lookup_size) {
 913                         DEBUG(0, ("module %s doesn't provide functions for pipe %s!\n", p->name, p->name));
 914                         return False;
 915                 }
 916         }
 917
 918         /* decode the bind request */
 919         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
 920                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
 921                 return False;
 922         }
 923
 924         /*
 925          * Check if this is an authenticated request.
 926          */
 927
 928         if (p->hdr.auth_len != 0) {
 929                 RPC_AUTH_VERIFIER auth_verifier;
 930                 RPC_AUTH_NTLMSSP_NEG ntlmssp_neg;
 931
 932                 /*
 933                  * Decode the authentication verifier.
 934                  */
 935
 936                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 937                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 938                         return False;
 939                 }
 940
 941                 if(auth_info.auth_type == NTLMSSP_AUTH_TYPE) {
 942
 943                         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 944                                 DEBUG(0,("api_pipe_bind_req: unable to "
 945                                          "unmarshall RPC_HDR_AUTH struct.\n"));
 946                                 return False;
 947                         }
 948
 949                         if(!strequal(auth_verifier.signature, "NTLMSSP")) {
 950                                 DEBUG(0,("api_pipe_bind_req: "
 951                                          "auth_verifier.signature != NTLMSSP\n"));
 952                                 return False;
 953                         }
 954
 955                         if(auth_verifier.msg_type != NTLMSSP_NEGOTIATE) {
 956                                 DEBUG(0,("api_pipe_bind_req: "
 957                                          "auth_verifier.msg_type (%d) != NTLMSSP_NEGOTIATE\n",
 958                                          auth_verifier.msg_type));
 959                                 return False;
 960                         }
 961
 962                         if(!smb_io_rpc_auth_ntlmssp_neg("", &ntlmssp_neg, rpc_in_p, 0)) {
 963                                 DEBUG(0,("api_pipe_bind_req: "
 964                                          "Failed to unmarshall RPC_AUTH_NTLMSSP_NEG.\n"));
 965                                 return False;
 966                         }
 967
 968                         p->ntlmssp_chal_flags = SMBD_NTLMSSP_NEG_FLAGS;
 969                         p->ntlmssp_auth_requested = True;
 970
 971                 } else if (auth_info.auth_type == NETSEC_AUTH_TYPE) {
 972
 973                         RPC_AUTH_NETSEC_NEG neg;
 974                         struct netsec_auth_struct *a = &(p->netsec_auth);
 975
 976                         if (!smb_io_rpc_auth_netsec_neg("", &neg, rpc_in_p, 0)) {
 977                                 DEBUG(0,("api_pipe_bind_req: "
 978                                          "Could not unmarshal SCHANNEL auth neg\n"));
 979                                 return False;
 980                         }
 981
 982                         p->netsec_auth_validated = True;
 983
 984                         memset(a->sess_key, 0, sizeof(a->sess_key));
 985                         memcpy(a->sess_key, last_dcinfo.sess_key, sizeof(last_dcinfo.sess_key));
 986
 987                         a->seq_num = 0;
 988
 989                         DEBUG(10,("schannel auth: domain [%s] myname [%s]\n",
 990                                   neg.domain, neg.myname));
 991
 992                 } else {
 993                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n",
 994                                  auth_info.auth_type ));
 995                         return False;
 996                 }
 997         }
 998
 999         switch(p->hdr.pkt_type) {
1000                 case RPC_BIND:
1001                         /* name has to be \PIPE\xxxxx */
1002                         fstrcpy(ack_pipe_name, "\\PIPE\\");
1003                         fstrcat(ack_pipe_name, p->pipe_srv_name);
1004                         reply_pkt_type = RPC_BINDACK;
1005                         break;
1006                 case RPC_ALTCONT:
1007                         /* secondary address CAN be NULL
1008                          * as the specs say it's ignored.
1009                          * It MUST NULL to have the spoolss working.
1010                          */
1011                         fstrcpy(ack_pipe_name,"");
1012                         reply_pkt_type = RPC_ALTCONTRESP;
1013                         break;
1014                 default:
1015                         return False;
1016         }
1017
1018         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1019
1020         /*
1021          * Marshall directly into the outgoing PDU space. We
1022          * must do this as we need to set to the bind response
1023          * header and are never sending more than one PDU here.
1024          */
1025
1026         prs_init( &outgoing_rpc, 0, p->mem_ctx, MARSHALL);
1027         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
1028
1029         /*
1030          * Setup the memory to marshall the ba header, and the
1031          * auth footers.
1032          */
1033
1034         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1035                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1036                 prs_mem_free(&outgoing_rpc);
1037                 return False;
1038         }
1039
1040         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1041                 DEBUG(0,("pi_pipe_bind_req: malloc out_auth failed.\n"));
1042                 prs_mem_free(&outgoing_rpc);
1043                 prs_mem_free(&out_hdr_ba);
1044                 return False;
1045         }
1046
1047         if (p->ntlmssp_auth_requested)
1048                 assoc_gid = 0x7a77;
1049         else
1050                 assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1051
1052         /*
1053          * Create the bind response struct.
1054          */
1055
1056         /* If the requested abstract synt uuid doesn't match our client pipe,
1057                 reject the bind_ack & set the transfer interface synt to all 0's,
1058                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1059                 unknown to NT4)
1060                 Needed when adding entries to a DACL from NT5 - SK */
1061
1062         if(check_bind_req(p, &hdr_rb.abstract, &hdr_rb.transfer, hdr_rb.context_id ))
1063         {
1064                 init_rpc_hdr_ba(&hdr_ba,
1065                         MAX_PDU_FRAG_LEN,
1066                         MAX_PDU_FRAG_LEN,
1067                         assoc_gid,
1068                         ack_pipe_name,
1069                         0x1, 0x0, 0x0,
1070                         &hdr_rb.transfer);
1071         } else {
1072                 RPC_IFACE null_interface;
1073                 ZERO_STRUCT(null_interface);
1074                 /* Rejection reason: abstract syntax not supported */
1075                 init_rpc_hdr_ba(&hdr_ba, MAX_PDU_FRAG_LEN,
1076                                         MAX_PDU_FRAG_LEN, assoc_gid,
1077                                         ack_pipe_name, 0x1, 0x2, 0x1,
1078                                         &null_interface);
1079         }
1080
1081         /*
1082          * and marshall it.
1083          */
1084
1085         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1086                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1087                 goto err_exit;
1088         }
1089
1090         /*
1091          * Now the authentication.
1092          */
1093
1094         if (p->ntlmssp_auth_requested) {
1095                 RPC_AUTH_VERIFIER auth_verifier;
1096                 RPC_AUTH_NTLMSSP_CHAL ntlmssp_chal;
1097
1098                 generate_random_buffer(p->challenge, 8);
1099
1100                 /*** Authentication info ***/
1101
1102                 init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, RPC_PIPE_AUTH_SEAL_LEVEL, RPC_HDR_AUTH_LEN, 1);
1103                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
1104                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
1105                         goto err_exit;
1106                 }
1107
1108                 /*** NTLMSSP verifier ***/
1109
1110                 init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_CHALLENGE);
1111                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, &out_auth, 0)) {
1112                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1113                         goto err_exit;
1114                 }
1115
1116                 /* NTLMSSP challenge ***/
1117
1118                 init_rpc_auth_ntlmssp_chal(&ntlmssp_chal, p->ntlmssp_chal_flags, p->challenge);
1119                 if(!smb_io_rpc_auth_ntlmssp_chal("", &ntlmssp_chal, &out_auth, 0)) {
1120                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_NTLMSSP_CHAL failed.\n"));
1121                         goto err_exit;
1122                 }
1123
1124                 /* Auth len in the rpc header doesn't include auth_header. */
1125                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1126         }
1127
1128         if (p->netsec_auth_validated) {
1129                 RPC_AUTH_VERIFIER auth_verifier;
1130                 uint32 flags;
1131
1132                 /* The client opens a second RPC NETLOGON pipe without
1133                    doing a auth2. The credentials for the schannel are
1134                    re-used from the auth2 the client did before. */
1135                 p->dc = last_dcinfo;
1136
1137                 init_rpc_hdr_auth(&auth_info, NETSEC_AUTH_TYPE, auth_info.auth_level, RPC_HDR_AUTH_LEN, 1);
1138                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
1139                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
1140                         goto err_exit;
1141                 }
1142
1143                 /*** NETSEC verifier ***/
1144
1145                 init_rpc_auth_verifier(&auth_verifier, "\001", 0x0);
1146                 if(!smb_io_rpc_netsec_verifier("", &auth_verifier, &out_auth, 0)) {
1147                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
1148                         goto err_exit;
1149                 }
1150
1151                 prs_align(&out_auth);
1152
1153                 flags = 5;
1154                 if(!prs_uint32("flags ", &out_auth, 0, &flags))
1155                         goto err_exit;
1156
1157                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1158         }
1159
1160         /*
1161          * Create the header, now we know the length.
1162          */
1163
1164         init_rpc_hdr(&p->hdr, reply_pkt_type, RPC_FLG_FIRST | RPC_FLG_LAST,
1165                         p->hdr.call_id,
1166                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1167                         auth_len);
1168
1169         /*
1170          * Marshall the header into the outgoing PDU.
1171          */
1172
1173         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
1174                 DEBUG(0,("pi_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1175                 goto err_exit;
1176         }
1177
1178         /*
1179          * Now add the RPC_HDR_BA and any auth needed.
1180          */
1181
1182         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
1183                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1184                 goto err_exit;
1185         }
1186
1187         if((p->ntlmssp_auth_requested|p->netsec_auth_validated) &&
1188            !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
1189                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1190                 goto err_exit;
1191         }
1192
1193         if(!p->ntlmssp_auth_requested)
1194                 p->pipe_bound = True;
1195
1196         /*
1197          * Setup the lengths for the initial reply.
1198          */
1199
1200         p->out_data.data_sent_length = 0;
1201         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
1202         p->out_data.current_pdu_sent = 0;
1203
1204         prs_mem_free(&out_hdr_ba);
1205         prs_mem_free(&out_auth);
1206
1207         return True;
1208
1209   err_exit:
1210
1211         prs_mem_free(&outgoing_rpc);
1212         prs_mem_free(&out_hdr_ba);
1213         prs_mem_free(&out_auth);
1214         return False;
1215 }
1216
1217 /****************************************************************************
1218  Deal with sign & seal processing on an RPC request.
1219 ****************************************************************************/
1220
1221 BOOL api_pipe_auth_process(pipes_struct *p, prs_struct *rpc_in)
1222 {
1223         /*
1224          * We always negotiate the following two bits....
1225          */
1226         BOOL auth_verify = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SIGN) != 0);
1227         BOOL auth_seal   = ((p->ntlmssp_chal_flags & NTLMSSP_NEGOTIATE_SEAL) != 0);
1228         int data_len;
1229         int auth_len;
1230         uint32 old_offset;
1231         uint32 crc32 = 0;
1232
1233         auth_len = p->hdr.auth_len;
1234
1235         if ((auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) && auth_verify) {
1236                 DEBUG(0,("api_pipe_auth_process: Incorrect auth_len %d.\n", auth_len ));
1237                 return False;
1238         }
1239
1240         /*
1241          * The following is that length of the data we must verify or unseal.
1242          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1243          * preceeding the auth_data.
1244          */
1245
1246         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1247                         (auth_verify ? RPC_HDR_AUTH_LEN : 0) - auth_len;
1248
1249         DEBUG(5,("api_pipe_auth_process: sign: %s seal: %s data %d auth %d\n",
1250                  BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, auth_len));
1251
1252         if (auth_seal) {
1253                 /*
1254                  * The data in rpc_in doesn't contain the RPC_HEADER as this
1255                  * has already been consumed.
1256                  */
1257                 char *data = prs_data_p(rpc_in) + RPC_HDR_REQ_LEN;
1258                 dump_data_pw("NTLMSSP hash (v1)\n", p->ntlmssp_hash,
1259                              sizeof(p->ntlmssp_hash));
1260
1261                 dump_data_pw("Incoming RPC PDU (NTLMSSP sealed)\n",
1262                              (const unsigned char *)data, data_len);
1263                 NTLMSSPcalc_p(p, (uchar*)data, data_len);
1264                 dump_data_pw("Incoming RPC PDU (NTLMSSP unsealed)\n",
1265                              (const unsigned char *)data, data_len);
1266                 crc32 = crc32_calc_buffer(data, data_len);
1267         }
1268
1269         old_offset = prs_offset(rpc_in);
1270
1271         if (auth_seal || auth_verify) {
1272                 RPC_HDR_AUTH auth_info;
1273
1274                 if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1275                         DEBUG(0,("api_pipe_auth_process: cannot move offset to %u.\n",
1276                                 (unsigned int)old_offset + data_len ));
1277                         return False;
1278                 }
1279
1280                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1281                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1282                         return False;
1283                 }
1284         }
1285
1286         if (auth_verify) {
1287                 RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
1288                 char *req_data = prs_data_p(rpc_in) + prs_offset(rpc_in) + 4;
1289
1290                 DEBUG(5,("api_pipe_auth_process: auth %d\n", prs_offset(rpc_in) + 4));
1291
1292                 /*
1293                  * Ensure we have RPC_AUTH_NTLMSSP_CHK_LEN - 4 more bytes in the
1294                  * incoming buffer.
1295                  */
1296                 if(prs_mem_get(rpc_in, RPC_AUTH_NTLMSSP_CHK_LEN - 4) == NULL) {
1297                         DEBUG(0,("api_pipe_auth_process: missing %d bytes in buffer.\n",
1298                                 RPC_AUTH_NTLMSSP_CHK_LEN - 4 ));
1299                         return False;
1300                 }
1301
1302                 NTLMSSPcalc_p(p, (uchar*)req_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
1303                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, rpc_in, 0)) {
1304                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_AUTH_NTLMSSP_CHK.\n"));
1305                         return False;
1306                 }
1307
1308                 if (!rpc_auth_ntlmssp_chk(&ntlmssp_chk, crc32, p->ntlmssp_seq_num)) {
1309                         DEBUG(0,("api_pipe_auth_process: NTLMSSP check failed.\n"));
1310                         return False;
1311                 }
1312         }
1313
1314         /*
1315          * Return the current pointer to the data offset.
1316          */
1317
1318         if(!prs_set_offset(rpc_in, old_offset)) {
1319                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
1320                         (unsigned int)old_offset ));
1321                 return False;
1322         }
1323
1324         return True;
1325 }
1326
1327 /****************************************************************************
1328  Deal with schannel processing on an RPC request.
1329 ****************************************************************************/
1330 BOOL api_pipe_netsec_process(pipes_struct *p, prs_struct *rpc_in)
1331 {
1332         /*
1333          * We always negotiate the following two bits....
1334          */
1335         int data_len;
1336         int auth_len;
1337         uint32 old_offset;
1338         RPC_HDR_AUTH auth_info;
1339         RPC_AUTH_NETSEC_CHK netsec_chk;
1340
1341
1342         auth_len = p->hdr.auth_len;
1343
1344         if (auth_len != RPC_AUTH_NETSEC_SIGN_OR_SEAL_CHK_LEN) {
1345                 DEBUG(0,("Incorrect auth_len %d.\n", auth_len ));
1346                 return False;
1347         }
1348
1349         /*
1350          * The following is that length of the data we must verify or unseal.
1351          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1352          * preceeding the auth_data.
1353          */
1354
1355         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1356                 RPC_HDR_AUTH_LEN - auth_len;
1357
1358         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
1359
1360         old_offset = prs_offset(rpc_in);
1361
1362         if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1363                 DEBUG(0,("cannot move offset to %u.\n",
1364                          (unsigned int)old_offset + data_len ));
1365                 return False;
1366         }
1367
1368         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1369                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
1370                 return False;
1371         }
1372
1373         if (auth_info.auth_type != NETSEC_AUTH_TYPE) {
1374                 DEBUG(0,("Invalid auth info %d on schannel\n",
1375                          auth_info.auth_type));
1376                 return False;
1377         }
1378
1379         if (auth_info.auth_level == RPC_PIPE_AUTH_SEAL_LEVEL) {
1380                 p->netsec_auth.auth_flags = AUTH_PIPE_NETSEC|AUTH_PIPE_SIGN|AUTH_PIPE_SEAL;
1381         } else if (auth_info.auth_level == RPC_PIPE_AUTH_SIGN_LEVEL) {
1382                 p->netsec_auth.auth_flags = AUTH_PIPE_NETSEC|AUTH_PIPE_SIGN;
1383         } else {
1384                 DEBUG(0,("Invalid auth level %d on schannel\n",
1385                          auth_info.auth_level));
1386                 return False;
1387         }
1388
1389         if(!smb_io_rpc_auth_netsec_chk("", RPC_AUTH_NETSEC_SIGN_OR_SEAL_CHK_LEN,
1390                 &netsec_chk, rpc_in, 0))
1391         {
1392                 DEBUG(0,("failed to unmarshal RPC_AUTH_NETSEC_CHK.\n"));
1393                 return False;
1394         }
1395
1396         if (!netsec_decode(&p->netsec_auth,
1397                            p->netsec_auth.auth_flags,
1398                            SENDER_IS_INITIATOR,
1399                            &netsec_chk,
1400                            prs_data_p(rpc_in)+old_offset, data_len)) {
1401                 DEBUG(3,("failed to decode PDU\n"));
1402                 return False;
1403         }
1404
1405         /*
1406          * Return the current pointer to the data offset.
1407          */
1408
1409         if(!prs_set_offset(rpc_in, old_offset)) {
1410                 DEBUG(0,("failed to set offset back to %u\n",
1411                          (unsigned int)old_offset ));
1412                 return False;
1413         }
1414
1415         /* The sequence number gets incremented on both send and receive. */
1416         p->netsec_auth.seq_num++;
1417
1418         return True;
1419 }
1420
1421 /****************************************************************************
1422  Return a user struct for a pipe user.
1423 ****************************************************************************/
1424
1425 struct current_user *get_current_user(struct current_user *user, pipes_struct *p)
1426 {
1427         if (p->ntlmssp_auth_validated) {
1428                 memcpy(user, &p->pipe_user, sizeof(struct current_user));
1429         } else {
1430                 extern struct current_user current_user;
1431                 memcpy(user, &current_user, sizeof(struct current_user));
1432         }
1433
1434         return user;
1435 }
1436
1437 /****************************************************************************
1438  Find the set of RPC functions associated with this context_id
1439 ****************************************************************************/
1440
1441 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
1442 {
1443         PIPE_RPC_FNS *fns = NULL;
1444         PIPE_RPC_FNS *tmp = NULL;
1445
1446         if ( !list ) {
1447                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
1448                 return NULL;
1449         }
1450
1451         for (tmp=list; tmp; tmp=tmp->next ) {
1452                 if ( tmp->context_id == context_id )
1453                         break;
1454         }
1455
1456         fns = tmp;
1457
1458         return fns;
1459 }
1460
1461 /****************************************************************************
1462  memory cleanup
1463 ****************************************************************************/
1464
1465 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
1466 {
1467         PIPE_RPC_FNS *tmp = list;
1468         PIPE_RPC_FNS *tmp2;
1469
1470         while (tmp) {
1471                 tmp2 = tmp->next;
1472                 SAFE_FREE(tmp);
1473                 tmp = tmp2;
1474         }
1475
1476         return;
1477 }
1478
1479 /****************************************************************************
1480  Find the correct RPC function to call for this request.
1481  If the pipe is authenticated then become the correct UNIX user
1482  before doing the call.
1483 ****************************************************************************/
1484
1485 BOOL api_pipe_request(pipes_struct *p)
1486 {
1487         BOOL ret = False;
1488         PIPE_RPC_FNS *pipe_fns;
1489
1490         if (p->ntlmssp_auth_validated) {
1491
1492                 if(!become_authenticated_pipe_user(p)) {
1493                         prs_mem_free(&p->out_data.rdata);
1494                         return False;
1495                 }
1496         }
1497
1498         DEBUG(5, ("Requested \\PIPE\\%s\n", p->name));
1499
1500         /* get the set of RPC functions for this context */
1501
1502         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
1503
1504         if ( pipe_fns ) {
1505                 set_current_rpc_talloc(p->mem_ctx);
1506                 ret = api_rpcTNP(p, p->name, pipe_fns->cmds, pipe_fns->n_cmds);
1507                 set_current_rpc_talloc(NULL);
1508         }
1509         else {
1510                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
1511                         p->hdr_req.context_id, p->name));
1512         }
1513
1514         if(p->ntlmssp_auth_validated)
1515                 unbecome_authenticated_pipe_user();
1516
1517         return ret;
1518 }
1519
1520 /*******************************************************************
1521  Calls the underlying RPC function for a named pipe.
1522  ********************************************************************/
1523
1524 BOOL api_rpcTNP(pipes_struct *p, const char *rpc_name,
1525                 const struct api_struct *api_rpc_cmds, int n_cmds)
1526 {
1527         int fn_num;
1528         fstring name;
1529         uint32 offset1, offset2;
1530
1531         /* interpret the command */
1532         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
1533
1534         slprintf(name, sizeof(name)-1, "in_%s", rpc_name);
1535         prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
1536
1537         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
1538                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
1539                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
1540                         break;
1541                 }
1542         }
1543
1544         if (fn_num == n_cmds) {
1545                 /*
1546                  * For an unknown RPC just return a fault PDU but
1547                  * return True to allow RPC's on the pipe to continue
1548                  * and not put the pipe into fault state. JRA.
1549                  */
1550                 DEBUG(4, ("unknown\n"));
1551                 setup_fault_pdu(p, NT_STATUS(0x1c010002));
1552                 return True;
1553         }
1554
1555         offset1 = prs_offset(&p->out_data.rdata);
1556
1557         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
1558                 fn_num, api_rpc_cmds[fn_num].fn));
1559         /* do the actual command */
1560         if(!api_rpc_cmds[fn_num].fn(p)) {
1561                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n", rpc_name, api_rpc_cmds[fn_num].name));
1562                 prs_mem_free(&p->out_data.rdata);
1563                 return False;
1564         }
1565
1566         if (p->bad_handle_fault_state) {
1567                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
1568                 p->bad_handle_fault_state = False;
1569                 setup_fault_pdu(p, NT_STATUS(0x1C00001A));
1570                 return True;
1571         }
1572
1573         slprintf(name, sizeof(name)-1, "out_%s", rpc_name);
1574         offset2 = prs_offset(&p->out_data.rdata);
1575         prs_set_offset(&p->out_data.rdata, offset1);
1576         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
1577         prs_set_offset(&p->out_data.rdata, offset2);
1578
1579         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
1580
1581         /* Check for buffer underflow in rpc parsing */
1582
1583         if ((DEBUGLEVEL >= 10) &&
1584             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
1585                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
1586                 char *data = SMB_MALLOC(data_len);
1587
1588                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
1589                 if (data) {
1590                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
1591                         SAFE_FREE(data);
1592                 }
1593
1594         }
1595
1596         return True;
1597 }
1598
1599 /*******************************************************************
1600 *******************************************************************/
1601
1602 void get_pipe_fns( int idx, struct api_struct **fns, int *n_fns )
1603 {
1604         struct api_struct *cmds = NULL;
1605         int               n_cmds = 0;
1606
1607         switch ( idx ) {
1608                 case PI_LSARPC:
1609                         lsa_get_pipe_fns( &cmds, &n_cmds );
1610                         break;
1611                 case PI_LSARPC_DS:
1612                         lsa_ds_get_pipe_fns( &cmds, &n_cmds );
1613                         break;
1614                 case PI_SAMR:
1615                         samr_get_pipe_fns( &cmds, &n_cmds );
1616                         break;
1617                 case PI_NETLOGON:
1618                         netlog_get_pipe_fns( &cmds, &n_cmds );
1619                         break;
1620                 case PI_SRVSVC:
1621                         srvsvc_get_pipe_fns( &cmds, &n_cmds );
1622                         break;
1623                 case PI_WKSSVC:
1624                         wkssvc_get_pipe_fns( &cmds, &n_cmds );
1625                         break;
1626                 case PI_WINREG:
1627                         reg_get_pipe_fns( &cmds, &n_cmds );
1628                         break;
1629                 case PI_SPOOLSS:
1630                         spoolss_get_pipe_fns( &cmds, &n_cmds );
1631                         break;
1632                 case PI_NETDFS:
1633                         netdfs_get_pipe_fns( &cmds, &n_cmds );
1634                         break;
1635                 case PI_SVCCTL:
1636                         svcctl_get_pipe_fns( &cmds, &n_cmds );
1637                         break;
1638                 case PI_EVENTLOG:
1639                         eventlog_get_pipe_fns( &cmds, &n_cmds );
1640                         break;
1641 #ifdef DEVELOPER
1642                 case PI_ECHO:
1643                         echo_get_pipe_fns( &cmds, &n_cmds );
1644                         break;
1645 #endif
1646                 default:
1647                         DEBUG(0,("get_pipe_fns: Unknown pipe index! [%d]\n", idx));
1648         }
1649
1650         *fns = cmds;
1651         *n_fns = n_cmds;
1652
1653         return;
1654 }
1655
1656