source3/rpc_server/srv_pipe.c

   1 /*
   2  *  Unix SMB/CIFS implementation.
   3  *  RPC Pipe client / server routines
   4  *  Almost completely rewritten by (C) Jeremy Allison 2005.
   5  *
   6  *  This program is free software; you can redistribute it and/or modify
   7  *  it under the terms of the GNU General Public License as published by
   8  *  the Free Software Foundation; either version 3 of the License, or
   9  *  (at your option) any later version.
  10  *
  11  *  This program is distributed in the hope that it will be useful,
  12  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  *  GNU General Public License for more details.
  15  *
  16  *  You should have received a copy of the GNU General Public License
  17  *  along with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 /*  this module apparently provides an implementation of DCE/RPC over a
  21  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  22  *  documentation are available (in on-line form) from the X-Open group.
  23  *
  24  *  this module should provide a level of abstraction between SMB
  25  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  26  *  data copies, and network traffic.
  27  *
  28  */
  29
  30 #include "includes.h"
  31 #include "../librpc/gen_ndr/ndr_schannel.h"
  32 #include "../libcli/auth/schannel.h"
  33 #include "../libcli/auth/spnego.h"
  34 #include "ntlmssp.h"
  35
  36 extern struct current_user current_user;
  37
  38 #undef DBGC_CLASS
  39 #define DBGC_CLASS DBGC_RPC_SRV
  40
  41 static void free_pipe_ntlmssp_auth_data(struct pipe_auth_data *auth)
  42 {
  43         AUTH_NTLMSSP_STATE *a = auth->a_u.auth_ntlmssp_state;
  44
  45         if (a) {
  46                 auth_ntlmssp_end(&a);
  47         }
  48         auth->a_u.auth_ntlmssp_state = NULL;
  49 }
  50
  51 static DATA_BLOB generic_session_key(void)
  52 {
  53         return data_blob("SystemLibraryDTC", 16);
  54 }
  55
  56 /*******************************************************************
  57  Generate the next PDU to be returned from the data in p->rdata.
  58  Handle NTLMSSP.
  59  ********************************************************************/
  60
  61 static bool create_next_pdu_ntlmssp(pipes_struct *p)
  62 {
  63         RPC_HDR_RESP hdr_resp;
  64         uint32 ss_padding_len = 0;
  65         uint32 data_space_available;
  66         uint32 data_len_left;
  67         uint32 data_len;
  68         NTSTATUS status;
  69         DATA_BLOB auth_blob;
  70         RPC_HDR_AUTH auth_info;
  71         uint8 auth_type, auth_level;
  72         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
  73
  74         /*
  75          * If we're in the fault state, keep returning fault PDU's until
  76          * the pipe gets closed. JRA.
  77          */
  78
  79         if(p->fault_state) {
  80                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
  81                 return True;
  82         }
  83
  84         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
  85
  86         /* Change the incoming request header to a response. */
  87         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
  88
  89         /* Set up rpc header flags. */
  90         if (p->out_data.data_sent_length == 0) {
  91                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
  92         } else {
  93                 p->hdr.flags = 0;
  94         }
  95
  96         /*
  97          * Work out how much we can fit in a single PDU.
  98          */
  99
 100         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 101
 102         /*
 103          * Ensure there really is data left to send.
 104          */
 105
 106         if(!data_len_left) {
 107                 DEBUG(0,("create_next_pdu_ntlmssp: no data left to send !\n"));
 108                 return False;
 109         }
 110
 111         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 112                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN - NTLMSSP_SIG_SIZE;
 113
 114         /*
 115          * The amount we send is the minimum of the available
 116          * space and the amount left to send.
 117          */
 118
 119         data_len = MIN(data_len_left, data_space_available);
 120
 121         /*
 122          * Set up the alloc hint. This should be the data left to
 123          * send.
 124          */
 125
 126         hdr_resp.alloc_hint = data_len_left;
 127
 128         /*
 129          * Work out if this PDU will be the last.
 130          */
 131
 132         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 133                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 134                 if (data_len_left % 8) {
 135                         ss_padding_len = 8 - (data_len_left % 8);
 136                         DEBUG(10,("create_next_pdu_ntlmssp: adding sign/seal padding of %u\n",
 137                                 ss_padding_len ));
 138                 }
 139         }
 140
 141         /*
 142          * Set up the header lengths.
 143          */
 144
 145         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN +
 146                         data_len + ss_padding_len +
 147                         RPC_HDR_AUTH_LEN + NTLMSSP_SIG_SIZE;
 148         p->hdr.auth_len = NTLMSSP_SIG_SIZE;
 149
 150
 151         /*
 152          * Init the parse struct to point at the outgoing
 153          * data.
 154          */
 155
 156         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 157
 158         /* Store the header in the data stream. */
 159         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 160                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR.\n"));
 161                 prs_mem_free(&p->out_data.frag);
 162                 return False;
 163         }
 164
 165         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 166                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_RESP.\n"));
 167                 prs_mem_free(&p->out_data.frag);
 168                 return False;
 169         }
 170
 171         /* Copy the data into the PDU. */
 172
 173         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 174                                      p->out_data.data_sent_length, data_len)) {
 175                 DEBUG(0,("create_next_pdu_ntlmssp: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 176                 prs_mem_free(&p->out_data.frag);
 177                 return False;
 178         }
 179
 180         /* Copy the sign/seal padding data. */
 181         if (ss_padding_len) {
 182                 char pad[8];
 183
 184                 memset(pad, '\0', 8);
 185                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 186                                       ss_padding_len)) {
 187                         DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes of pad data.\n",
 188                                         (unsigned int)ss_padding_len));
 189                         prs_mem_free(&p->out_data.frag);
 190                         return False;
 191                 }
 192         }
 193
 194
 195         /* Now write out the auth header and null blob. */
 196         if (p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) {
 197                 auth_type = DCERPC_AUTH_TYPE_NTLMSSP;
 198         } else {
 199                 auth_type = DCERPC_AUTH_TYPE_SPNEGO;
 200         }
 201         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 202                 auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
 203         } else {
 204                 auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
 205         }
 206
 207         init_rpc_hdr_auth(&auth_info, auth_type, auth_level, ss_padding_len, 1 /* context id. */);
 208         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &p->out_data.frag,
 209                                 0)) {
 210                 DEBUG(0,("create_next_pdu_ntlmssp: failed to marshall RPC_HDR_AUTH.\n"));
 211                 prs_mem_free(&p->out_data.frag);
 212                 return False;
 213         }
 214
 215         /* Generate the sign blob. */
 216
 217         switch (p->auth.auth_level) {
 218                 case DCERPC_AUTH_LEVEL_PRIVACY:
 219                         /* Data portion is encrypted. */
 220                         status = ntlmssp_seal_packet(
 221                                 a->ntlmssp_state,
 222                                 (uint8_t *)prs_data_p(&p->out_data.frag)
 223                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 224                                 data_len + ss_padding_len,
 225                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 226                                 (size_t)prs_offset(&p->out_data.frag),
 227                                 &auth_blob);
 228                         if (!NT_STATUS_IS_OK(status)) {
 229                                 data_blob_free(&auth_blob);
 230                                 prs_mem_free(&p->out_data.frag);
 231                                 return False;
 232                         }
 233                         break;
 234                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 235                         /* Data is signed. */
 236                         status = ntlmssp_sign_packet(
 237                                 a->ntlmssp_state,
 238                                 (unsigned char *)prs_data_p(&p->out_data.frag)
 239                                 + RPC_HEADER_LEN + RPC_HDR_RESP_LEN,
 240                                 data_len + ss_padding_len,
 241                                 (unsigned char *)prs_data_p(&p->out_data.frag),
 242                                 (size_t)prs_offset(&p->out_data.frag),
 243                                 &auth_blob);
 244                         if (!NT_STATUS_IS_OK(status)) {
 245                                 data_blob_free(&auth_blob);
 246                                 prs_mem_free(&p->out_data.frag);
 247                                 return False;
 248                         }
 249                         break;
 250                 default:
 251                         prs_mem_free(&p->out_data.frag);
 252                         return False;
 253         }
 254
 255         /* Append the auth blob. */
 256         if (!prs_copy_data_in(&p->out_data.frag, (char *)auth_blob.data,
 257                               NTLMSSP_SIG_SIZE)) {
 258                 DEBUG(0,("create_next_pdu_ntlmssp: failed to add %u bytes auth blob.\n",
 259                                 (unsigned int)NTLMSSP_SIG_SIZE));
 260                 data_blob_free(&auth_blob);
 261                 prs_mem_free(&p->out_data.frag);
 262                 return False;
 263         }
 264
 265         data_blob_free(&auth_blob);
 266
 267         /*
 268          * Setup the counts for this PDU.
 269          */
 270
 271         p->out_data.data_sent_length += data_len;
 272         p->out_data.current_pdu_sent = 0;
 273
 274         return True;
 275 }
 276
 277 /*******************************************************************
 278  Generate the next PDU to be returned from the data in p->rdata.
 279  Return an schannel authenticated fragment.
 280  ********************************************************************/
 281
 282 static bool create_next_pdu_schannel(pipes_struct *p)
 283 {
 284         RPC_HDR_RESP hdr_resp;
 285         uint32 ss_padding_len = 0;
 286         uint32 data_len;
 287         uint32 data_space_available;
 288         uint32 data_len_left;
 289         uint32 data_pos;
 290         NTSTATUS status;
 291
 292         /*
 293          * If we're in the fault state, keep returning fault PDU's until
 294          * the pipe gets closed. JRA.
 295          */
 296
 297         if(p->fault_state) {
 298                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 299                 return True;
 300         }
 301
 302         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 303
 304         /* Change the incoming request header to a response. */
 305         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
 306
 307         /* Set up rpc header flags. */
 308         if (p->out_data.data_sent_length == 0) {
 309                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
 310         } else {
 311                 p->hdr.flags = 0;
 312         }
 313
 314         /*
 315          * Work out how much we can fit in a single PDU.
 316          */
 317
 318         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 319
 320         /*
 321          * Ensure there really is data left to send.
 322          */
 323
 324         if(!data_len_left) {
 325                 DEBUG(0,("create_next_pdu_schannel: no data left to send !\n"));
 326                 return False;
 327         }
 328
 329         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 330                 - RPC_HDR_RESP_LEN - RPC_HDR_AUTH_LEN
 331                 - RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 332
 333         /*
 334          * The amount we send is the minimum of the available
 335          * space and the amount left to send.
 336          */
 337
 338         data_len = MIN(data_len_left, data_space_available);
 339
 340         /*
 341          * Set up the alloc hint. This should be the data left to
 342          * send.
 343          */
 344
 345         hdr_resp.alloc_hint = data_len_left;
 346
 347         /*
 348          * Work out if this PDU will be the last.
 349          */
 350
 351         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 352                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 353                 if (data_len_left % 8) {
 354                         ss_padding_len = 8 - (data_len_left % 8);
 355                         DEBUG(10,("create_next_pdu_schannel: adding sign/seal padding of %u\n",
 356                                 ss_padding_len ));
 357                 }
 358         }
 359
 360         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len + ss_padding_len +
 361                                 RPC_HDR_AUTH_LEN + RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 362         p->hdr.auth_len = RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN;
 363
 364         /*
 365          * Init the parse struct to point at the outgoing
 366          * data.
 367          */
 368
 369         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 370
 371         /* Store the header in the data stream. */
 372         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 373                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR.\n"));
 374                 prs_mem_free(&p->out_data.frag);
 375                 return False;
 376         }
 377
 378         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 379                 DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_RESP.\n"));
 380                 prs_mem_free(&p->out_data.frag);
 381                 return False;
 382         }
 383
 384         /* Store the current offset. */
 385         data_pos = prs_offset(&p->out_data.frag);
 386
 387         /* Copy the data into the PDU. */
 388
 389         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 390                                      p->out_data.data_sent_length, data_len)) {
 391                 DEBUG(0,("create_next_pdu_schannel: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 392                 prs_mem_free(&p->out_data.frag);
 393                 return False;
 394         }
 395
 396         /* Copy the sign/seal padding data. */
 397         if (ss_padding_len) {
 398                 char pad[8];
 399                 memset(pad, '\0', 8);
 400                 if (!prs_copy_data_in(&p->out_data.frag, pad,
 401                                       ss_padding_len)) {
 402                         DEBUG(0,("create_next_pdu_schannel: failed to add %u bytes of pad data.\n", (unsigned int)ss_padding_len));
 403                         prs_mem_free(&p->out_data.frag);
 404                         return False;
 405                 }
 406         }
 407
 408         {
 409                 /*
 410                  * Schannel processing.
 411                  */
 412                 RPC_HDR_AUTH auth_info;
 413                 DATA_BLOB blob;
 414                 uint8_t *data;
 415
 416                 /* Check it's the type of reply we were expecting to decode */
 417
 418                 init_rpc_hdr_auth(&auth_info,
 419                                 DCERPC_AUTH_TYPE_SCHANNEL,
 420                                 p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY ?
 421                                         DCERPC_AUTH_LEVEL_PRIVACY : DCERPC_AUTH_LEVEL_INTEGRITY,
 422                                 ss_padding_len, 1);
 423
 424                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info,
 425                                         &p->out_data.frag, 0)) {
 426                         DEBUG(0,("create_next_pdu_schannel: failed to marshall RPC_HDR_AUTH.\n"));
 427                         prs_mem_free(&p->out_data.frag);
 428                         return False;
 429                 }
 430
 431                 data = (uint8_t *)prs_data_p(&p->out_data.frag) + data_pos;
 432
 433                 switch (p->auth.auth_level) {
 434                 case DCERPC_AUTH_LEVEL_PRIVACY:
 435                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 436                                                         talloc_tos(),
 437                                                         true,
 438                                                         data,
 439                                                         data_len + ss_padding_len,
 440                                                         &blob);
 441                         break;
 442                 case DCERPC_AUTH_LEVEL_INTEGRITY:
 443                         status = netsec_outgoing_packet(p->auth.a_u.schannel_auth,
 444                                                         talloc_tos(),
 445                                                         false,
 446                                                         data,
 447                                                         data_len + ss_padding_len,
 448                                                         &blob);
 449                         break;
 450                 default:
 451                         status = NT_STATUS_INTERNAL_ERROR;
 452                         break;
 453                 }
 454
 455                 if (!NT_STATUS_IS_OK(status)) {
 456                         DEBUG(0,("create_next_pdu_schannel: failed to process packet: %s\n",
 457                                 nt_errstr(status)));
 458                         prs_mem_free(&p->out_data.frag);
 459                         return false;
 460                 }
 461
 462                 /* Finally marshall the blob. */
 463
 464                 if (DEBUGLEVEL >= 10) {
 465                         dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
 466                 }
 467
 468                 if (!prs_copy_data_in(&p->out_data.frag, (const char *)blob.data, blob.length)) {
 469                         prs_mem_free(&p->out_data.frag);
 470                         return false;
 471                 }
 472         }
 473
 474         /*
 475          * Setup the counts for this PDU.
 476          */
 477
 478         p->out_data.data_sent_length += data_len;
 479         p->out_data.current_pdu_sent = 0;
 480
 481         return True;
 482 }
 483
 484 /*******************************************************************
 485  Generate the next PDU to be returned from the data in p->rdata.
 486  No authentication done.
 487 ********************************************************************/
 488
 489 static bool create_next_pdu_noauth(pipes_struct *p)
 490 {
 491         RPC_HDR_RESP hdr_resp;
 492         uint32 data_len;
 493         uint32 data_space_available;
 494         uint32 data_len_left;
 495
 496         /*
 497          * If we're in the fault state, keep returning fault PDU's until
 498          * the pipe gets closed. JRA.
 499          */
 500
 501         if(p->fault_state) {
 502                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
 503                 return True;
 504         }
 505
 506         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 507
 508         /* Change the incoming request header to a response. */
 509         p->hdr.pkt_type = DCERPC_PKT_RESPONSE;
 510
 511         /* Set up rpc header flags. */
 512         if (p->out_data.data_sent_length == 0) {
 513                 p->hdr.flags = DCERPC_PFC_FLAG_FIRST;
 514         } else {
 515                 p->hdr.flags = 0;
 516         }
 517
 518         /*
 519          * Work out how much we can fit in a single PDU.
 520          */
 521
 522         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 523
 524         /*
 525          * Ensure there really is data left to send.
 526          */
 527
 528         if(!data_len_left) {
 529                 DEBUG(0,("create_next_pdu_noath: no data left to send !\n"));
 530                 return False;
 531         }
 532
 533         data_space_available = RPC_MAX_PDU_FRAG_LEN - RPC_HEADER_LEN
 534                 - RPC_HDR_RESP_LEN;
 535
 536         /*
 537          * The amount we send is the minimum of the available
 538          * space and the amount left to send.
 539          */
 540
 541         data_len = MIN(data_len_left, data_space_available);
 542
 543         /*
 544          * Set up the alloc hint. This should be the data left to
 545          * send.
 546          */
 547
 548         hdr_resp.alloc_hint = data_len_left;
 549
 550         /*
 551          * Work out if this PDU will be the last.
 552          */
 553
 554         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata)) {
 555                 p->hdr.flags |= DCERPC_PFC_FLAG_LAST;
 556         }
 557
 558         /*
 559          * Set up the header lengths.
 560          */
 561
 562         p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 563         p->hdr.auth_len = 0;
 564
 565         /*
 566          * Init the parse struct to point at the outgoing
 567          * data.
 568          */
 569
 570         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 571
 572         /* Store the header in the data stream. */
 573         if(!smb_io_rpc_hdr("hdr", &p->hdr, &p->out_data.frag, 0)) {
 574                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR.\n"));
 575                 prs_mem_free(&p->out_data.frag);
 576                 return False;
 577         }
 578
 579         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 580                 DEBUG(0,("create_next_pdu_noath: failed to marshall RPC_HDR_RESP.\n"));
 581                 prs_mem_free(&p->out_data.frag);
 582                 return False;
 583         }
 584
 585         /* Copy the data into the PDU. */
 586
 587         if(!prs_append_some_prs_data(&p->out_data.frag, &p->out_data.rdata,
 588                                      p->out_data.data_sent_length, data_len)) {
 589                 DEBUG(0,("create_next_pdu_noauth: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 590                 prs_mem_free(&p->out_data.frag);
 591                 return False;
 592         }
 593
 594         /*
 595          * Setup the counts for this PDU.
 596          */
 597
 598         p->out_data.data_sent_length += data_len;
 599         p->out_data.current_pdu_sent = 0;
 600
 601         return True;
 602 }
 603
 604 /*******************************************************************
 605  Generate the next PDU to be returned from the data in p->rdata.
 606 ********************************************************************/
 607
 608 bool create_next_pdu(pipes_struct *p)
 609 {
 610         switch(p->auth.auth_level) {
 611                 case DCERPC_AUTH_LEVEL_NONE:
 612                 case DCERPC_AUTH_LEVEL_CONNECT:
 613                         /* This is incorrect for auth level connect. Fixme. JRA */
 614                         return create_next_pdu_noauth(p);
 615
 616                 default:
 617                         switch(p->auth.auth_type) {
 618                                 case PIPE_AUTH_TYPE_NTLMSSP:
 619                                 case PIPE_AUTH_TYPE_SPNEGO_NTLMSSP:
 620                                         return create_next_pdu_ntlmssp(p);
 621                                 case PIPE_AUTH_TYPE_SCHANNEL:
 622                                         return create_next_pdu_schannel(p);
 623                                 default:
 624                                         break;
 625                         }
 626         }
 627
 628         DEBUG(0,("create_next_pdu: invalid internal auth level %u / type %u",
 629                         (unsigned int)p->auth.auth_level,
 630                         (unsigned int)p->auth.auth_type));
 631         return False;
 632 }
 633
 634 /*******************************************************************
 635  Process an NTLMSSP authentication response.
 636  If this function succeeds, the user has been authenticated
 637  and their domain, name and calling workstation stored in
 638  the pipe struct.
 639 *******************************************************************/
 640
 641 static bool pipe_ntlmssp_verify_final(pipes_struct *p, DATA_BLOB *p_resp_blob)
 642 {
 643         DATA_BLOB session_key, reply;
 644         NTSTATUS status;
 645         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
 646         bool ret;
 647
 648         DEBUG(5,("pipe_ntlmssp_verify_final: pipe %s checking user details\n",
 649                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
 650
 651         ZERO_STRUCT(reply);
 652
 653         /* this has to be done as root in order to verify the password */
 654         become_root();
 655         status = auth_ntlmssp_update(a, *p_resp_blob, &reply);
 656         unbecome_root();
 657
 658         /* Don't generate a reply. */
 659         data_blob_free(&reply);
 660
 661         if (!NT_STATUS_IS_OK(status)) {
 662                 return False;
 663         }
 664
 665         /* Finally - if the pipe negotiated integrity (sign) or privacy (seal)
 666            ensure the underlying NTLMSSP flags are also set. If not we should
 667            refuse the bind. */
 668
 669         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_INTEGRITY) {
 670                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SIGN)) {
 671                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet integrity requested "
 672                                 "but client declined signing.\n",
 673                                  get_pipe_name_from_syntax(talloc_tos(),
 674                                                            &p->syntax)));
 675                         return False;
 676                 }
 677         }
 678         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_PRIVACY) {
 679                 if (!(a->ntlmssp_state->neg_flags & NTLMSSP_NEGOTIATE_SEAL)) {
 680                         DEBUG(0,("pipe_ntlmssp_verify_final: pipe %s : packet privacy requested "
 681                                 "but client declined sealing.\n",
 682                                  get_pipe_name_from_syntax(talloc_tos(),
 683                                                            &p->syntax)));
 684                         return False;
 685                 }
 686         }
 687
 688         DEBUG(5, ("pipe_ntlmssp_verify_final: OK: user: %s domain: %s "
 689                   "workstation: %s\n", a->ntlmssp_state->user,
 690                   a->ntlmssp_state->domain, a->ntlmssp_state->workstation));
 691
 692         if (a->server_info->ptok == NULL) {
 693                 DEBUG(1,("Error: Authmodule failed to provide nt_user_token\n"));
 694                 return False;
 695         }
 696
 697         TALLOC_FREE(p->server_info);
 698
 699         p->server_info = copy_serverinfo(p, a->server_info);
 700         if (p->server_info == NULL) {
 701                 DEBUG(0, ("copy_serverinfo failed\n"));
 702                 return false;
 703         }
 704
 705         /*
 706          * We're an authenticated bind over smb, so the session key needs to
 707          * be set to "SystemLibraryDTC". Weird, but this is what Windows
 708          * does. See the RPC-SAMBA3SESSIONKEY.
 709          */
 710
 711         session_key = generic_session_key();
 712         if (session_key.data == NULL) {
 713                 return False;
 714         }
 715
 716         ret = server_info_set_session_key(p->server_info, session_key);
 717
 718         data_blob_free(&session_key);
 719
 720         return True;
 721 }
 722
 723 /*******************************************************************
 724  The switch table for the pipe names and the functions to handle them.
 725 *******************************************************************/
 726
 727 struct rpc_table {
 728         struct {
 729                 const char *clnt;
 730                 const char *srv;
 731         } pipe;
 732         struct ndr_syntax_id rpc_interface;
 733         const struct api_struct *cmds;
 734         int n_cmds;
 735 };
 736
 737 static struct rpc_table *rpc_lookup;
 738 static int rpc_lookup_size;
 739
 740 /*******************************************************************
 741  This is the "stage3" NTLMSSP response after a bind request and reply.
 742 *******************************************************************/
 743
 744 bool api_pipe_bind_auth3(pipes_struct *p, prs_struct *rpc_in_p)
 745 {
 746         RPC_HDR_AUTH auth_info;
 747         uint32 pad = 0;
 748         DATA_BLOB blob;
 749
 750         ZERO_STRUCT(blob);
 751
 752         DEBUG(5,("api_pipe_bind_auth3: decode request. %d\n", __LINE__));
 753
 754         if (p->hdr.auth_len == 0) {
 755                 DEBUG(0,("api_pipe_bind_auth3: No auth field sent !\n"));
 756                 goto err;
 757         }
 758
 759         /* 4 bytes padding. */
 760         if (!prs_uint32("pad", rpc_in_p, 0, &pad)) {
 761                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of 4 byte pad failed.\n"));
 762                 goto err;
 763         }
 764
 765         /*
 766          * Decode the authentication verifier response.
 767          */
 768
 769         if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 770                 DEBUG(0,("api_pipe_bind_auth3: unmarshall of RPC_HDR_AUTH failed.\n"));
 771                 goto err;
 772         }
 773
 774         if (auth_info.auth_type != DCERPC_AUTH_TYPE_NTLMSSP) {
 775                 DEBUG(0,("api_pipe_bind_auth3: incorrect auth type (%u).\n",
 776                         (unsigned int)auth_info.auth_type ));
 777                 return False;
 778         }
 779
 780         blob = data_blob(NULL,p->hdr.auth_len);
 781
 782         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
 783                 DEBUG(0,("api_pipe_bind_auth3: Failed to pull %u bytes - the response blob.\n",
 784                         (unsigned int)p->hdr.auth_len ));
 785                 goto err;
 786         }
 787
 788         /*
 789          * The following call actually checks the challenge/response data.
 790          * for correctness against the given DOMAIN\user name.
 791          */
 792
 793         if (!pipe_ntlmssp_verify_final(p, &blob)) {
 794                 goto err;
 795         }
 796
 797         data_blob_free(&blob);
 798
 799         p->pipe_bound = True;
 800
 801         return True;
 802
 803  err:
 804
 805         data_blob_free(&blob);
 806         free_pipe_ntlmssp_auth_data(&p->auth);
 807         p->auth.a_u.auth_ntlmssp_state = NULL;
 808
 809         return False;
 810 }
 811
 812 /*******************************************************************
 813  Marshall a bind_nak pdu.
 814 *******************************************************************/
 815
 816 static bool setup_bind_nak(pipes_struct *p)
 817 {
 818         RPC_HDR nak_hdr;
 819         uint16 zero = 0;
 820
 821         /* Free any memory in the current return data buffer. */
 822         prs_mem_free(&p->out_data.rdata);
 823
 824         /*
 825          * Marshall directly into the outgoing PDU space. We
 826          * must do this as we need to set to the bind response
 827          * header and are never sending more than one PDU here.
 828          */
 829
 830         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 831
 832         /*
 833          * Initialize a bind_nak header.
 834          */
 835
 836         init_rpc_hdr(&nak_hdr, DCERPC_PKT_BIND_NAK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
 837                 p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 838
 839         /*
 840          * Marshall the header into the outgoing PDU.
 841          */
 842
 843         if(!smb_io_rpc_hdr("", &nak_hdr, &p->out_data.frag, 0)) {
 844                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 845                 prs_mem_free(&p->out_data.frag);
 846                 return False;
 847         }
 848
 849         /*
 850          * Now add the reject reason.
 851          */
 852
 853         if(!prs_uint16("reject code", &p->out_data.frag, 0, &zero)) {
 854                 prs_mem_free(&p->out_data.frag);
 855                 return False;
 856         }
 857
 858         p->out_data.data_sent_length = 0;
 859         p->out_data.current_pdu_sent = 0;
 860
 861         if (p->auth.auth_data_free_func) {
 862                 (*p->auth.auth_data_free_func)(&p->auth);
 863         }
 864         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
 865         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
 866         p->pipe_bound = False;
 867
 868         return True;
 869 }
 870
 871 /*******************************************************************
 872  Marshall a fault pdu.
 873 *******************************************************************/
 874
 875 bool setup_fault_pdu(pipes_struct *p, NTSTATUS status)
 876 {
 877         RPC_HDR fault_hdr;
 878         RPC_HDR_RESP hdr_resp;
 879         RPC_HDR_FAULT fault_resp;
 880
 881         /* Free any memory in the current return data buffer. */
 882         prs_mem_free(&p->out_data.rdata);
 883
 884         /*
 885          * Marshall directly into the outgoing PDU space. We
 886          * must do this as we need to set to the bind response
 887          * header and are never sending more than one PDU here.
 888          */
 889
 890         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
 891
 892         /*
 893          * Initialize a fault header.
 894          */
 895
 896         init_rpc_hdr(&fault_hdr, DCERPC_PKT_FAULT, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST | DCERPC_PFC_FLAG_DID_NOT_EXECUTE,
 897             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 898
 899         /*
 900          * Initialize the HDR_RESP and FAULT parts of the PDU.
 901          */
 902
 903         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 904
 905         fault_resp.status = status;
 906         fault_resp.reserved = 0;
 907
 908         /*
 909          * Marshall the header into the outgoing PDU.
 910          */
 911
 912         if(!smb_io_rpc_hdr("", &fault_hdr, &p->out_data.frag, 0)) {
 913                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 914                 prs_mem_free(&p->out_data.frag);
 915                 return False;
 916         }
 917
 918         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &p->out_data.frag, 0)) {
 919                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 920                 prs_mem_free(&p->out_data.frag);
 921                 return False;
 922         }
 923
 924         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &p->out_data.frag, 0)) {
 925                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 926                 prs_mem_free(&p->out_data.frag);
 927                 return False;
 928         }
 929
 930         p->out_data.data_sent_length = 0;
 931         p->out_data.current_pdu_sent = 0;
 932
 933         return True;
 934 }
 935
 936 #if 0
 937 /*******************************************************************
 938  Marshall a cancel_ack pdu.
 939  We should probably check the auth-verifier here.
 940 *******************************************************************/
 941
 942 bool setup_cancel_ack_reply(pipes_struct *p, prs_struct *rpc_in_p)
 943 {
 944         prs_struct outgoing_pdu;
 945         RPC_HDR ack_reply_hdr;
 946
 947         /* Free any memory in the current return data buffer. */
 948         prs_mem_free(&p->out_data.rdata);
 949
 950         /*
 951          * Marshall directly into the outgoing PDU space. We
 952          * must do this as we need to set to the bind response
 953          * header and are never sending more than one PDU here.
 954          */
 955
 956         prs_init_empty( &outgoing_pdu, p->mem_ctx, MARSHALL);
 957         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 958
 959         /*
 960          * Initialize a cancel_ack header.
 961          */
 962
 963         init_rpc_hdr(&ack_reply_hdr, DCERPC_PKT_CANCEL_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
 964                         p->hdr.call_id, RPC_HEADER_LEN, 0);
 965
 966         /*
 967          * Marshall the header into the outgoing PDU.
 968          */
 969
 970         if(!smb_io_rpc_hdr("", &ack_reply_hdr, &outgoing_pdu, 0)) {
 971                 DEBUG(0,("setup_cancel_ack_reply: marshalling of RPC_HDR failed.\n"));
 972                 prs_mem_free(&outgoing_pdu);
 973                 return False;
 974         }
 975
 976         p->out_data.data_sent_length = 0;
 977         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 978         p->out_data.current_pdu_sent = 0;
 979
 980         prs_mem_free(&outgoing_pdu);
 981         return True;
 982 }
 983 #endif
 984
 985 /*******************************************************************
 986  Ensure a bind request has the correct abstract & transfer interface.
 987  Used to reject unknown binds from Win2k.
 988 *******************************************************************/
 989
 990 static bool check_bind_req(struct pipes_struct *p,
 991                            struct ndr_syntax_id* abstract,
 992                            struct ndr_syntax_id* transfer,
 993                            uint32 context_id)
 994 {
 995         int i=0;
 996         struct pipe_rpc_fns *context_fns;
 997
 998         DEBUG(3,("check_bind_req for %s\n",
 999                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1000
1001         /* we have to check all now since win2k introduced a new UUID on the lsaprpc pipe */
1002
1003         for (i=0; i<rpc_lookup_size; i++) {
1004                 DEBUGADD(10, ("checking %s\n", rpc_lookup[i].pipe.clnt));
1005                 if (ndr_syntax_id_equal(
1006                             abstract, &rpc_lookup[i].rpc_interface)
1007                     && ndr_syntax_id_equal(
1008                             transfer, &ndr_transfer_syntax)) {
1009                         break;
1010                 }
1011         }
1012
1013         if (i == rpc_lookup_size) {
1014                 return false;
1015         }
1016
1017         context_fns = SMB_MALLOC_P(struct pipe_rpc_fns);
1018         if (context_fns == NULL) {
1019                 DEBUG(0,("check_bind_req: malloc() failed!\n"));
1020                 return False;
1021         }
1022
1023         context_fns->cmds = rpc_lookup[i].cmds;
1024         context_fns->n_cmds = rpc_lookup[i].n_cmds;
1025         context_fns->context_id = context_id;
1026
1027         /* add to the list of open contexts */
1028
1029         DLIST_ADD( p->contexts, context_fns );
1030
1031         return True;
1032 }
1033
1034 /*******************************************************************
1035  Register commands to an RPC pipe
1036 *******************************************************************/
1037
1038 NTSTATUS rpc_srv_register(int version, const char *clnt, const char *srv,
1039                           const struct ndr_interface_table *iface,
1040                           const struct api_struct *cmds, int size)
1041 {
1042         struct rpc_table *rpc_entry;
1043
1044         if (!clnt || !srv || !cmds) {
1045                 return NT_STATUS_INVALID_PARAMETER;
1046         }
1047
1048         if (version != SMB_RPC_INTERFACE_VERSION) {
1049                 DEBUG(0,("Can't register rpc commands!\n"
1050                          "You tried to register a rpc module with SMB_RPC_INTERFACE_VERSION %d"
1051                          ", while this version of samba uses version %d!\n",
1052                          version,SMB_RPC_INTERFACE_VERSION));
1053                 return NT_STATUS_OBJECT_TYPE_MISMATCH;
1054         }
1055
1056         /* TODO:
1057          *
1058          * we still need to make sure that don't register the same commands twice!!!
1059          *
1060          * --metze
1061          */
1062
1063         /* We use a temporary variable because this call can fail and
1064            rpc_lookup will still be valid afterwards.  It could then succeed if
1065            called again later */
1066         rpc_lookup_size++;
1067         rpc_entry = SMB_REALLOC_ARRAY_KEEP_OLD_ON_ERROR(rpc_lookup, struct rpc_table, rpc_lookup_size);
1068         if (NULL == rpc_entry) {
1069                 rpc_lookup_size--;
1070                 DEBUG(0, ("rpc_pipe_register_commands: memory allocation failed\n"));
1071                 return NT_STATUS_NO_MEMORY;
1072         } else {
1073                 rpc_lookup = rpc_entry;
1074         }
1075
1076         rpc_entry = rpc_lookup + (rpc_lookup_size - 1);
1077         ZERO_STRUCTP(rpc_entry);
1078         rpc_entry->pipe.clnt = SMB_STRDUP(clnt);
1079         rpc_entry->pipe.srv = SMB_STRDUP(srv);
1080         rpc_entry->rpc_interface = iface->syntax_id;
1081         rpc_entry->cmds = cmds;
1082         rpc_entry->n_cmds = size;
1083
1084         return NT_STATUS_OK;
1085 }
1086
1087 /**
1088  * Is a named pipe known?
1089  * @param[in] cli_filename      The pipe name requested by the client
1090  * @result                      Do we want to serve this?
1091  */
1092 bool is_known_pipename(const char *cli_filename, struct ndr_syntax_id *syntax)
1093 {
1094         const char *pipename = cli_filename;
1095         int i;
1096         NTSTATUS status;
1097
1098         if (strnequal(pipename, "\\PIPE\\", 6)) {
1099                 pipename += 5;
1100         }
1101
1102         if (*pipename == '\\') {
1103                 pipename += 1;
1104         }
1105
1106         if (lp_disable_spoolss() && strequal(pipename, "spoolss")) {
1107                 DEBUG(10, ("refusing spoolss access\n"));
1108                 return false;
1109         }
1110
1111         for (i=0; i<rpc_lookup_size; i++) {
1112                 if (strequal(pipename, rpc_lookup[i].pipe.clnt)) {
1113                         *syntax = rpc_lookup[i].rpc_interface;
1114                         return true;
1115                 }
1116         }
1117
1118         status = smb_probe_module("rpc", pipename);
1119         if (!NT_STATUS_IS_OK(status)) {
1120                 DEBUG(10, ("is_known_pipename: %s unknown\n", cli_filename));
1121                 return false;
1122         }
1123         DEBUG(10, ("is_known_pipename: %s loaded dynamically\n", pipename));
1124
1125         /*
1126          * Scan the list again for the interface id
1127          */
1128
1129         for (i=0; i<rpc_lookup_size; i++) {
1130                 if (strequal(pipename, rpc_lookup[i].pipe.clnt)) {
1131                         *syntax = rpc_lookup[i].rpc_interface;
1132                         return true;
1133                 }
1134         }
1135
1136         DEBUG(10, ("is_known_pipename: pipe %s did not register itself!\n",
1137                    pipename));
1138
1139         return false;
1140 }
1141
1142 /*******************************************************************
1143  Handle a SPNEGO krb5 bind auth.
1144 *******************************************************************/
1145
1146 static bool pipe_spnego_auth_bind_kerberos(pipes_struct *p, prs_struct *rpc_in_p, RPC_HDR_AUTH *pauth_info,
1147                 DATA_BLOB *psecblob, prs_struct *pout_auth)
1148 {
1149         return False;
1150 }
1151
1152 /*******************************************************************
1153  Handle the first part of a SPNEGO bind auth.
1154 *******************************************************************/
1155
1156 static bool pipe_spnego_auth_bind_negotiate(pipes_struct *p, prs_struct *rpc_in_p,
1157                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1158 {
1159         DATA_BLOB blob;
1160         DATA_BLOB secblob;
1161         DATA_BLOB response;
1162         DATA_BLOB chal;
1163         char *OIDs[ASN1_MAX_OIDS];
1164         int i;
1165         NTSTATUS status;
1166         bool got_kerberos_mechanism = false;
1167         AUTH_NTLMSSP_STATE *a = NULL;
1168         RPC_HDR_AUTH auth_info;
1169
1170         ZERO_STRUCT(secblob);
1171         ZERO_STRUCT(chal);
1172         ZERO_STRUCT(response);
1173
1174         /* Grab the SPNEGO blob. */
1175         blob = data_blob(NULL,p->hdr.auth_len);
1176
1177         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1178                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to pull %u bytes - the SPNEGO auth header.\n",
1179                         (unsigned int)p->hdr.auth_len ));
1180                 goto err;
1181         }
1182
1183         if (blob.data[0] != ASN1_APPLICATION(0)) {
1184                 goto err;
1185         }
1186
1187         /* parse out the OIDs and the first sec blob */
1188         if (!parse_negTokenTarg(blob, OIDs, &secblob)) {
1189                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: Failed to parse the security blob.\n"));
1190                 goto err;
1191         }
1192
1193         if (strcmp(OID_KERBEROS5, OIDs[0]) == 0 || strcmp(OID_KERBEROS5_OLD, OIDs[0]) == 0) {
1194                 got_kerberos_mechanism = true;
1195         }
1196
1197         for (i=0;OIDs[i];i++) {
1198                 DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got OID %s\n", OIDs[i]));
1199                 TALLOC_FREE(OIDs[i]);
1200         }
1201         DEBUG(3,("pipe_spnego_auth_bind_negotiate: Got secblob of size %lu\n", (unsigned long)secblob.length));
1202
1203         if ( got_kerberos_mechanism && ((lp_security()==SEC_ADS) || USE_KERBEROS_KEYTAB) ) {
1204                 bool ret = pipe_spnego_auth_bind_kerberos(p, rpc_in_p, pauth_info, &secblob, pout_auth);
1205                 data_blob_free(&secblob);
1206                 data_blob_free(&blob);
1207                 return ret;
1208         }
1209
1210         if (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP && p->auth.a_u.auth_ntlmssp_state) {
1211                 /* Free any previous auth type. */
1212                 free_pipe_ntlmssp_auth_data(&p->auth);
1213         }
1214
1215         if (!got_kerberos_mechanism) {
1216                 /* Initialize the NTLM engine. */
1217                 status = auth_ntlmssp_start(&a);
1218                 if (!NT_STATUS_IS_OK(status)) {
1219                         goto err;
1220                 }
1221
1222                 /*
1223                  * Pass the first security blob of data to it.
1224                  * This can return an error or NT_STATUS_MORE_PROCESSING_REQUIRED
1225                  * which means we need another packet to complete the bind.
1226                  */
1227
1228                 status = auth_ntlmssp_update(a, secblob, &chal);
1229
1230                 if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1231                         DEBUG(3,("pipe_spnego_auth_bind_negotiate: auth_ntlmssp_update failed.\n"));
1232                         goto err;
1233                 }
1234
1235                 /* Generate the response blob we need for step 2 of the bind. */
1236                 response = spnego_gen_auth_response(&chal, status, OID_NTLMSSP);
1237         } else {
1238                 /*
1239                  * SPNEGO negotiate down to NTLMSSP. The subsequent
1240                  * code to process follow-up packets is not complete
1241                  * yet. JRA.
1242                  */
1243                 response = spnego_gen_auth_response(NULL,
1244                                         NT_STATUS_MORE_PROCESSING_REQUIRED,
1245                                         OID_NTLMSSP);
1246         }
1247
1248         /* Copy the blob into the pout_auth parse struct */
1249         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1250         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1251                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of RPC_HDR_AUTH failed.\n"));
1252                 goto err;
1253         }
1254
1255         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1256                 DEBUG(0,("pipe_spnego_auth_bind_negotiate: marshalling of data blob failed.\n"));
1257                 goto err;
1258         }
1259
1260         p->auth.a_u.auth_ntlmssp_state = a;
1261         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1262         p->auth.auth_type = PIPE_AUTH_TYPE_SPNEGO_NTLMSSP;
1263
1264         data_blob_free(&blob);
1265         data_blob_free(&secblob);
1266         data_blob_free(&chal);
1267         data_blob_free(&response);
1268
1269         /* We can't set pipe_bound True yet - we need an RPC_ALTER_CONTEXT response packet... */
1270         return True;
1271
1272  err:
1273
1274         data_blob_free(&blob);
1275         data_blob_free(&secblob);
1276         data_blob_free(&chal);
1277         data_blob_free(&response);
1278
1279         p->auth.a_u.auth_ntlmssp_state = NULL;
1280
1281         return False;
1282 }
1283
1284 /*******************************************************************
1285  Handle the second part of a SPNEGO bind auth.
1286 *******************************************************************/
1287
1288 static bool pipe_spnego_auth_bind_continue(pipes_struct *p, prs_struct *rpc_in_p,
1289                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1290 {
1291         RPC_HDR_AUTH auth_info;
1292         DATA_BLOB spnego_blob;
1293         DATA_BLOB auth_blob;
1294         DATA_BLOB auth_reply;
1295         DATA_BLOB response;
1296         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
1297
1298         ZERO_STRUCT(spnego_blob);
1299         ZERO_STRUCT(auth_blob);
1300         ZERO_STRUCT(auth_reply);
1301         ZERO_STRUCT(response);
1302
1303         /*
1304          * NB. If we've negotiated down from krb5 to NTLMSSP we'll currently
1305          * fail here as 'a' == NULL.
1306          */
1307         if (p->auth.auth_type != PIPE_AUTH_TYPE_SPNEGO_NTLMSSP || !a) {
1308                 DEBUG(0,("pipe_spnego_auth_bind_continue: not in NTLMSSP auth state.\n"));
1309                 goto err;
1310         }
1311
1312         /* Grab the SPNEGO blob. */
1313         spnego_blob = data_blob(NULL,p->hdr.auth_len);
1314
1315         if (!prs_copy_data_out((char *)spnego_blob.data, rpc_in_p, p->hdr.auth_len)) {
1316                 DEBUG(0,("pipe_spnego_auth_bind_continue: Failed to pull %u bytes - the SPNEGO auth header.\n",
1317                         (unsigned int)p->hdr.auth_len ));
1318                 goto err;
1319         }
1320
1321         if (spnego_blob.data[0] != ASN1_CONTEXT(1)) {
1322                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob type.\n"));
1323                 goto err;
1324         }
1325
1326         if (!spnego_parse_auth(spnego_blob, &auth_blob)) {
1327                 DEBUG(0,("pipe_spnego_auth_bind_continue: invalid SPNEGO blob.\n"));
1328                 goto err;
1329         }
1330
1331         /*
1332          * The following call actually checks the challenge/response data.
1333          * for correctness against the given DOMAIN\user name.
1334          */
1335
1336         if (!pipe_ntlmssp_verify_final(p, &auth_blob)) {
1337                 goto err;
1338         }
1339
1340         data_blob_free(&spnego_blob);
1341         data_blob_free(&auth_blob);
1342
1343         /* Generate the spnego "accept completed" blob - no incoming data. */
1344         response = spnego_gen_auth_response(&auth_reply, NT_STATUS_OK, OID_NTLMSSP);
1345
1346         /* Copy the blob into the pout_auth parse struct */
1347         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SPNEGO, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1348         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1349                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of RPC_HDR_AUTH failed.\n"));
1350                 goto err;
1351         }
1352
1353         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1354                 DEBUG(0,("pipe_spnego_auth_bind_continue: marshalling of data blob failed.\n"));
1355                 goto err;
1356         }
1357
1358         data_blob_free(&auth_reply);
1359         data_blob_free(&response);
1360
1361         p->pipe_bound = True;
1362
1363         return True;
1364
1365  err:
1366
1367         data_blob_free(&spnego_blob);
1368         data_blob_free(&auth_blob);
1369         data_blob_free(&auth_reply);
1370         data_blob_free(&response);
1371
1372         free_pipe_ntlmssp_auth_data(&p->auth);
1373         p->auth.a_u.auth_ntlmssp_state = NULL;
1374
1375         return False;
1376 }
1377
1378 /*******************************************************************
1379  Handle an schannel bind auth.
1380 *******************************************************************/
1381
1382 static bool pipe_schannel_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1383                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1384 {
1385         RPC_HDR_AUTH auth_info;
1386         struct NL_AUTH_MESSAGE neg;
1387         struct NL_AUTH_MESSAGE reply;
1388         bool ret;
1389         NTSTATUS status;
1390         struct netlogon_creds_CredentialState *creds;
1391         DATA_BLOB session_key;
1392         enum ndr_err_code ndr_err;
1393         DATA_BLOB blob;
1394
1395         blob = data_blob_const(prs_data_p(rpc_in_p) + prs_offset(rpc_in_p),
1396                                prs_data_size(rpc_in_p));
1397
1398         ndr_err = ndr_pull_struct_blob(&blob, talloc_tos(), NULL, &neg,
1399                                (ndr_pull_flags_fn_t)ndr_pull_NL_AUTH_MESSAGE);
1400         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1401                 DEBUG(0,("pipe_schannel_auth_bind: Could not unmarshal SCHANNEL auth neg\n"));
1402                 return false;
1403         }
1404
1405         if (DEBUGLEVEL >= 10) {
1406                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &neg);
1407         }
1408
1409         if (!(neg.Flags & NL_FLAG_OEM_NETBIOS_COMPUTER_NAME)) {
1410                 DEBUG(0,("pipe_schannel_auth_bind: Did not receive netbios computer name\n"));
1411                 return false;
1412         }
1413
1414         /*
1415          * The neg.oem_netbios_computer.a key here must match the remote computer name
1416          * given in the DOM_CLNT_SRV.uni_comp_name used on all netlogon pipe
1417          * operations that use credentials.
1418          */
1419
1420         become_root();
1421         status = schannel_fetch_session_key(p,
1422                                             neg.oem_netbios_computer.a,
1423                                             &creds);
1424         unbecome_root();
1425
1426         if (!NT_STATUS_IS_OK(status)) {
1427                 DEBUG(0, ("pipe_schannel_auth_bind: Attempt to bind using schannel without successful serverauth2\n"));
1428                 return False;
1429         }
1430
1431         p->auth.a_u.schannel_auth = talloc(p, struct schannel_state);
1432         if (!p->auth.a_u.schannel_auth) {
1433                 TALLOC_FREE(creds);
1434                 return False;
1435         }
1436
1437         p->auth.a_u.schannel_auth->state = SCHANNEL_STATE_START;
1438         p->auth.a_u.schannel_auth->seq_num = 0;
1439         p->auth.a_u.schannel_auth->initiator = false;
1440         p->auth.a_u.schannel_auth->creds = creds;
1441
1442         /*
1443          * JRA. Should we also copy the schannel session key into the pipe session key p->session_key
1444          * here ? We do that for NTLMSSP, but the session key is already set up from the vuser
1445          * struct of the person who opened the pipe. I need to test this further. JRA.
1446          *
1447          * VL. As we are mapping this to guest set the generic key
1448          * "SystemLibraryDTC" key here. It's a bit difficult to test against
1449          * W2k3, as it does not allow schannel binds against SAMR and LSA
1450          * anymore.
1451          */
1452
1453         session_key = generic_session_key();
1454         if (session_key.data == NULL) {
1455                 DEBUG(0, ("pipe_schannel_auth_bind: Could not alloc session"
1456                           " key\n"));
1457                 return false;
1458         }
1459
1460         ret = server_info_set_session_key(p->server_info, session_key);
1461
1462         data_blob_free(&session_key);
1463
1464         if (!ret) {
1465                 DEBUG(0, ("server_info_set_session_key failed\n"));
1466                 return false;
1467         }
1468
1469         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_SCHANNEL, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1470         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1471                 DEBUG(0,("pipe_schannel_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1472                 return False;
1473         }
1474
1475         /*** SCHANNEL verifier ***/
1476
1477         reply.MessageType                       = NL_NEGOTIATE_RESPONSE;
1478         reply.Flags                             = 0;
1479         reply.Buffer.dummy                      = 5; /* ??? actually I don't think
1480                                                       * this has any meaning
1481                                                       * here - gd */
1482
1483         ndr_err = ndr_push_struct_blob(&blob, talloc_tos(), NULL, &reply,
1484                        (ndr_push_flags_fn_t)ndr_push_NL_AUTH_MESSAGE);
1485         if (!NDR_ERR_CODE_IS_SUCCESS(ndr_err)) {
1486                 DEBUG(0,("Failed to marshall NL_AUTH_MESSAGE.\n"));
1487                 return false;
1488         }
1489
1490         if (DEBUGLEVEL >= 10) {
1491                 NDR_PRINT_DEBUG(NL_AUTH_MESSAGE, &reply);
1492         }
1493
1494         if (!prs_copy_data_in(pout_auth, (const char *)blob.data, blob.length)) {
1495                 return false;
1496         }
1497
1498         DEBUG(10,("pipe_schannel_auth_bind: schannel auth: domain [%s] myname [%s]\n",
1499                 neg.oem_netbios_domain.a, neg.oem_netbios_computer.a));
1500
1501         /* We're finished with this bind - no more packets. */
1502         p->auth.auth_data_free_func = NULL;
1503         p->auth.auth_type = PIPE_AUTH_TYPE_SCHANNEL;
1504
1505         p->pipe_bound = True;
1506
1507         return True;
1508 }
1509
1510 /*******************************************************************
1511  Handle an NTLMSSP bind auth.
1512 *******************************************************************/
1513
1514 static bool pipe_ntlmssp_auth_bind(pipes_struct *p, prs_struct *rpc_in_p,
1515                                         RPC_HDR_AUTH *pauth_info, prs_struct *pout_auth)
1516 {
1517         RPC_HDR_AUTH auth_info;
1518         DATA_BLOB blob;
1519         DATA_BLOB response;
1520         NTSTATUS status;
1521         AUTH_NTLMSSP_STATE *a = NULL;
1522
1523         ZERO_STRUCT(blob);
1524         ZERO_STRUCT(response);
1525
1526         /* Grab the NTLMSSP blob. */
1527         blob = data_blob(NULL,p->hdr.auth_len);
1528
1529         if (!prs_copy_data_out((char *)blob.data, rpc_in_p, p->hdr.auth_len)) {
1530                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to pull %u bytes - the NTLM auth header.\n",
1531                         (unsigned int)p->hdr.auth_len ));
1532                 goto err;
1533         }
1534
1535         if (strncmp((char *)blob.data, "NTLMSSP", 7) != 0) {
1536                 DEBUG(0,("pipe_ntlmssp_auth_bind: Failed to read NTLMSSP in blob\n"));
1537                 goto err;
1538         }
1539
1540         /* We have an NTLMSSP blob. */
1541         status = auth_ntlmssp_start(&a);
1542         if (!NT_STATUS_IS_OK(status)) {
1543                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_start failed: %s\n",
1544                         nt_errstr(status) ));
1545                 goto err;
1546         }
1547
1548         status = auth_ntlmssp_update(a, blob, &response);
1549         if (!NT_STATUS_EQUAL(status, NT_STATUS_MORE_PROCESSING_REQUIRED)) {
1550                 DEBUG(0,("pipe_ntlmssp_auth_bind: auth_ntlmssp_update failed: %s\n",
1551                         nt_errstr(status) ));
1552                 goto err;
1553         }
1554
1555         data_blob_free(&blob);
1556
1557         /* Copy the blob into the pout_auth parse struct */
1558         init_rpc_hdr_auth(&auth_info, DCERPC_AUTH_TYPE_NTLMSSP, pauth_info->auth_level, RPC_HDR_AUTH_LEN, 1);
1559         if(!smb_io_rpc_hdr_auth("", &auth_info, pout_auth, 0)) {
1560                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of RPC_HDR_AUTH failed.\n"));
1561                 goto err;
1562         }
1563
1564         if (!prs_copy_data_in(pout_auth, (char *)response.data, response.length)) {
1565                 DEBUG(0,("pipe_ntlmssp_auth_bind: marshalling of data blob failed.\n"));
1566                 goto err;
1567         }
1568
1569         p->auth.a_u.auth_ntlmssp_state = a;
1570         p->auth.auth_data_free_func = &free_pipe_ntlmssp_auth_data;
1571         p->auth.auth_type = PIPE_AUTH_TYPE_NTLMSSP;
1572
1573         data_blob_free(&blob);
1574         data_blob_free(&response);
1575
1576         DEBUG(10,("pipe_ntlmssp_auth_bind: NTLMSSP auth started\n"));
1577
1578         /* We can't set pipe_bound True yet - we need an DCERPC_PKT_AUTH3 response packet... */
1579         return True;
1580
1581   err:
1582
1583         data_blob_free(&blob);
1584         data_blob_free(&response);
1585
1586         free_pipe_ntlmssp_auth_data(&p->auth);
1587         p->auth.a_u.auth_ntlmssp_state = NULL;
1588         return False;
1589 }
1590
1591 /*******************************************************************
1592  Respond to a pipe bind request.
1593 *******************************************************************/
1594
1595 bool api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
1596 {
1597         RPC_HDR_BA hdr_ba;
1598         RPC_HDR_RB hdr_rb;
1599         RPC_HDR_AUTH auth_info;
1600         uint16 assoc_gid;
1601         fstring ack_pipe_name;
1602         prs_struct out_hdr_ba;
1603         prs_struct out_auth;
1604         int i = 0;
1605         int auth_len = 0;
1606         unsigned int auth_type = DCERPC_AUTH_TYPE_NONE;
1607
1608         /* No rebinds on a bound pipe - use alter context. */
1609         if (p->pipe_bound) {
1610                 DEBUG(2,("api_pipe_bind_req: rejecting bind request on bound "
1611                          "pipe %s.\n",
1612                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
1613                 return setup_bind_nak(p);
1614         }
1615
1616         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1617
1618         /*
1619          * Marshall directly into the outgoing PDU space. We
1620          * must do this as we need to set to the bind response
1621          * header and are never sending more than one PDU here.
1622          */
1623
1624         /*
1625          * Setup the memory to marshall the ba header, and the
1626          * auth footers.
1627          */
1628
1629         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1630                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
1631                 prs_mem_free(&p->out_data.frag);
1632                 return False;
1633         }
1634
1635         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1636                 DEBUG(0,("api_pipe_bind_req: malloc out_auth failed.\n"));
1637                 prs_mem_free(&p->out_data.frag);
1638                 prs_mem_free(&out_hdr_ba);
1639                 return False;
1640         }
1641
1642         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
1643
1644         ZERO_STRUCT(hdr_rb);
1645
1646         /* decode the bind request */
1647
1648         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1649                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB "
1650                          "struct.\n"));
1651                 goto err_exit;
1652         }
1653
1654         if (hdr_rb.num_contexts == 0) {
1655                 DEBUG(0, ("api_pipe_bind_req: no rpc contexts around\n"));
1656                 goto err_exit;
1657         }
1658
1659         /*
1660          * Try and find the correct pipe name to ensure
1661          * that this is a pipe name we support.
1662          */
1663
1664         for (i = 0; i < rpc_lookup_size; i++) {
1665                 if (ndr_syntax_id_equal(&rpc_lookup[i].rpc_interface,
1666                                         &hdr_rb.rpc_context[0].abstract)) {
1667                         DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1668                                 rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1669                         break;
1670                 }
1671         }
1672
1673         if (i == rpc_lookup_size) {
1674                 NTSTATUS status;
1675
1676                 status = smb_probe_module(
1677                         "rpc", get_pipe_name_from_syntax(
1678                                 talloc_tos(),
1679                                 &hdr_rb.rpc_context[0].abstract));
1680
1681                 if (NT_STATUS_IS_ERR(status)) {
1682                        DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
1683                                 get_pipe_name_from_syntax(
1684                                         talloc_tos(),
1685                                         &hdr_rb.rpc_context[0].abstract)));
1686                         prs_mem_free(&p->out_data.frag);
1687                         prs_mem_free(&out_hdr_ba);
1688                         prs_mem_free(&out_auth);
1689
1690                         return setup_bind_nak(p);
1691                 }
1692
1693                 for (i = 0; i < rpc_lookup_size; i++) {
1694                        if (strequal(rpc_lookup[i].pipe.clnt,
1695                                     get_pipe_name_from_syntax(talloc_tos(),
1696                                                               &p->syntax))) {
1697                                DEBUG(3, ("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
1698                                          rpc_lookup[i].pipe.clnt, rpc_lookup[i].pipe.srv));
1699                                break;
1700                        }
1701                 }
1702
1703                 if (i == rpc_lookup_size) {
1704                         DEBUG(0, ("module %s doesn't provide functions for "
1705                                   "pipe %s!\n",
1706                                   get_pipe_name_from_syntax(talloc_tos(),
1707                                                             &p->syntax),
1708                                   get_pipe_name_from_syntax(talloc_tos(),
1709                                                             &p->syntax)));
1710                         goto err_exit;
1711                 }
1712         }
1713
1714         /* name has to be \PIPE\xxxxx */
1715         fstrcpy(ack_pipe_name, "\\PIPE\\");
1716         fstrcat(ack_pipe_name, rpc_lookup[i].pipe.srv);
1717
1718         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
1719
1720         /*
1721          * Check if this is an authenticated bind request.
1722          */
1723
1724         if (p->hdr.auth_len) {
1725                 /*
1726                  * Decode the authentication verifier.
1727                  */
1728
1729                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1730                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1731                         goto err_exit;
1732                 }
1733
1734                 auth_type = auth_info.auth_type;
1735
1736                 /* Work out if we have to sign or seal etc. */
1737                 switch (auth_info.auth_level) {
1738                         case DCERPC_AUTH_LEVEL_INTEGRITY:
1739                                 p->auth.auth_level = DCERPC_AUTH_LEVEL_INTEGRITY;
1740                                 break;
1741                         case DCERPC_AUTH_LEVEL_PRIVACY:
1742                                 p->auth.auth_level = DCERPC_AUTH_LEVEL_PRIVACY;
1743                                 break;
1744                         default:
1745                                 DEBUG(0,("api_pipe_bind_req: unexpected auth level (%u).\n",
1746                                         (unsigned int)auth_info.auth_level ));
1747                                 goto err_exit;
1748                 }
1749         } else {
1750                 ZERO_STRUCT(auth_info);
1751         }
1752
1753         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1754
1755         switch(auth_type) {
1756                 case DCERPC_AUTH_TYPE_NTLMSSP:
1757                         if (!pipe_ntlmssp_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1758                                 goto err_exit;
1759                         }
1760                         assoc_gid = 0x7a77;
1761                         break;
1762
1763                 case DCERPC_AUTH_TYPE_SCHANNEL:
1764                         if (!pipe_schannel_auth_bind(p, rpc_in_p, &auth_info, &out_auth)) {
1765                                 goto err_exit;
1766                         }
1767                         break;
1768
1769                 case DCERPC_AUTH_TYPE_SPNEGO:
1770                         if (!pipe_spnego_auth_bind_negotiate(p, rpc_in_p, &auth_info, &out_auth)) {
1771                                 goto err_exit;
1772                         }
1773                         break;
1774
1775                 case DCERPC_AUTH_TYPE_NONE:
1776                         /* Unauthenticated bind request. */
1777                         /* We're finished - no more packets. */
1778                         p->auth.auth_type = PIPE_AUTH_TYPE_NONE;
1779                         /* We must set the pipe auth_level here also. */
1780                         p->auth.auth_level = DCERPC_AUTH_LEVEL_NONE;
1781                         p->pipe_bound = True;
1782                         /* The session key was initialized from the SMB
1783                          * session in make_internal_rpc_pipe_p */
1784                         break;
1785
1786                 default:
1787                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n", auth_type ));
1788                         goto err_exit;
1789         }
1790
1791         /*
1792          * Create the bind response struct.
1793          */
1794
1795         /* If the requested abstract synt uuid doesn't match our client pipe,
1796                 reject the bind_ack & set the transfer interface synt to all 0's,
1797                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1798                 unknown to NT4)
1799                 Needed when adding entries to a DACL from NT5 - SK */
1800
1801         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1802                                 hdr_rb.rpc_context[0].context_id )) {
1803                 init_rpc_hdr_ba(&hdr_ba,
1804                         RPC_MAX_PDU_FRAG_LEN,
1805                         RPC_MAX_PDU_FRAG_LEN,
1806                         assoc_gid,
1807                         ack_pipe_name,
1808                         0x1, 0x0, 0x0,
1809                         &hdr_rb.rpc_context[0].transfer[0]);
1810         } else {
1811                 /* Rejection reason: abstract syntax not supported */
1812                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
1813                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
1814                                         ack_pipe_name, 0x1, 0x2, 0x1,
1815                                         &null_ndr_syntax_id);
1816                 p->pipe_bound = False;
1817         }
1818
1819         /*
1820          * and marshall it.
1821          */
1822
1823         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
1824                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
1825                 goto err_exit;
1826         }
1827
1828         /*
1829          * Create the header, now we know the length.
1830          */
1831
1832         if (prs_offset(&out_auth)) {
1833                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
1834         }
1835
1836         init_rpc_hdr(&p->hdr, DCERPC_PKT_BIND_ACK, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
1837                         p->hdr.call_id,
1838                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
1839                         auth_len);
1840
1841         /*
1842          * Marshall the header into the outgoing PDU.
1843          */
1844
1845         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
1846                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
1847                 goto err_exit;
1848         }
1849
1850         /*
1851          * Now add the RPC_HDR_BA and any auth needed.
1852          */
1853
1854         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
1855                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
1856                 goto err_exit;
1857         }
1858
1859         if (auth_len && !prs_append_prs_data( &p->out_data.frag, &out_auth)) {
1860                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
1861                 goto err_exit;
1862         }
1863
1864         /*
1865          * Setup the lengths for the initial reply.
1866          */
1867
1868         p->out_data.data_sent_length = 0;
1869         p->out_data.current_pdu_sent = 0;
1870
1871         prs_mem_free(&out_hdr_ba);
1872         prs_mem_free(&out_auth);
1873
1874         return True;
1875
1876   err_exit:
1877
1878         prs_mem_free(&p->out_data.frag);
1879         prs_mem_free(&out_hdr_ba);
1880         prs_mem_free(&out_auth);
1881         return setup_bind_nak(p);
1882 }
1883
1884 /****************************************************************************
1885  Deal with an alter context call. Can be third part of 3 leg auth request for
1886  SPNEGO calls.
1887 ****************************************************************************/
1888
1889 bool api_pipe_alter_context(pipes_struct *p, prs_struct *rpc_in_p)
1890 {
1891         RPC_HDR_BA hdr_ba;
1892         RPC_HDR_RB hdr_rb;
1893         RPC_HDR_AUTH auth_info;
1894         uint16 assoc_gid;
1895         fstring ack_pipe_name;
1896         prs_struct out_hdr_ba;
1897         prs_struct out_auth;
1898         int auth_len = 0;
1899
1900         prs_init_empty(&p->out_data.frag, p->mem_ctx, MARSHALL);
1901
1902         /*
1903          * Marshall directly into the outgoing PDU space. We
1904          * must do this as we need to set to the bind response
1905          * header and are never sending more than one PDU here.
1906          */
1907
1908         /*
1909          * Setup the memory to marshall the ba header, and the
1910          * auth footers.
1911          */
1912
1913         if(!prs_init(&out_hdr_ba, 1024, p->mem_ctx, MARSHALL)) {
1914                 DEBUG(0,("api_pipe_alter_context: malloc out_hdr_ba failed.\n"));
1915                 prs_mem_free(&p->out_data.frag);
1916                 return False;
1917         }
1918
1919         if(!prs_init(&out_auth, 1024, p->mem_ctx, MARSHALL)) {
1920                 DEBUG(0,("api_pipe_alter_context: malloc out_auth failed.\n"));
1921                 prs_mem_free(&p->out_data.frag);
1922                 prs_mem_free(&out_hdr_ba);
1923                 return False;
1924         }
1925
1926         ZERO_STRUCT(hdr_rb);
1927
1928         DEBUG(5,("api_pipe_alter_context: decode request. %d\n", __LINE__));
1929
1930         /* decode the alter context request */
1931         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
1932                 DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_RB struct.\n"));
1933                 goto err_exit;
1934         }
1935
1936         /* secondary address CAN be NULL
1937          * as the specs say it's ignored.
1938          * It MUST be NULL to have the spoolss working.
1939          */
1940         fstrcpy(ack_pipe_name,"");
1941
1942         DEBUG(5,("api_pipe_alter_context: make response. %d\n", __LINE__));
1943
1944         /*
1945          * Check if this is an authenticated alter context request.
1946          */
1947
1948         if (p->hdr.auth_len != 0) {
1949                 /*
1950                  * Decode the authentication verifier.
1951                  */
1952
1953                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
1954                         DEBUG(0,("api_pipe_alter_context: unable to unmarshall RPC_HDR_AUTH struct.\n"));
1955                         goto err_exit;
1956                 }
1957
1958                 /*
1959                  * Currently only the SPNEGO auth type uses the alter ctx
1960                  * response in place of the NTLMSSP auth3 type.
1961                  */
1962
1963                 if (auth_info.auth_type == DCERPC_AUTH_TYPE_SPNEGO) {
1964                         /* We can only finish if the pipe is unbound. */
1965                         if (!p->pipe_bound) {
1966                                 if (!pipe_spnego_auth_bind_continue(p, rpc_in_p, &auth_info, &out_auth)) {
1967                                         goto err_exit;
1968                                 }
1969                         } else {
1970                                 goto err_exit;
1971                         }
1972                 }
1973         } else {
1974                 ZERO_STRUCT(auth_info);
1975         }
1976
1977         assoc_gid = hdr_rb.bba.assoc_gid ? hdr_rb.bba.assoc_gid : 0x53f0;
1978
1979         /*
1980          * Create the bind response struct.
1981          */
1982
1983         /* If the requested abstract synt uuid doesn't match our client pipe,
1984                 reject the bind_ack & set the transfer interface synt to all 0's,
1985                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
1986                 unknown to NT4)
1987                 Needed when adding entries to a DACL from NT5 - SK */
1988
1989         if(check_bind_req(p, &hdr_rb.rpc_context[0].abstract, &hdr_rb.rpc_context[0].transfer[0],
1990                                 hdr_rb.rpc_context[0].context_id )) {
1991                 init_rpc_hdr_ba(&hdr_ba,
1992                         RPC_MAX_PDU_FRAG_LEN,
1993                         RPC_MAX_PDU_FRAG_LEN,
1994                         assoc_gid,
1995                         ack_pipe_name,
1996                         0x1, 0x0, 0x0,
1997                         &hdr_rb.rpc_context[0].transfer[0]);
1998         } else {
1999                 /* Rejection reason: abstract syntax not supported */
2000                 init_rpc_hdr_ba(&hdr_ba, RPC_MAX_PDU_FRAG_LEN,
2001                                         RPC_MAX_PDU_FRAG_LEN, assoc_gid,
2002                                         ack_pipe_name, 0x1, 0x2, 0x1,
2003                                         &null_ndr_syntax_id);
2004                 p->pipe_bound = False;
2005         }
2006
2007         /*
2008          * and marshall it.
2009          */
2010
2011         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
2012                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR_BA failed.\n"));
2013                 goto err_exit;
2014         }
2015
2016         /*
2017          * Create the header, now we know the length.
2018          */
2019
2020         if (prs_offset(&out_auth)) {
2021                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
2022         }
2023
2024         init_rpc_hdr(&p->hdr, DCERPC_PKT_ALTER_RESP, DCERPC_PFC_FLAG_FIRST | DCERPC_PFC_FLAG_LAST,
2025                         p->hdr.call_id,
2026                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
2027                         auth_len);
2028
2029         /*
2030          * Marshall the header into the outgoing PDU.
2031          */
2032
2033         if(!smb_io_rpc_hdr("", &p->hdr, &p->out_data.frag, 0)) {
2034                 DEBUG(0,("api_pipe_alter_context: marshalling of RPC_HDR failed.\n"));
2035                 goto err_exit;
2036         }
2037
2038         /*
2039          * Now add the RPC_HDR_BA and any auth needed.
2040          */
2041
2042         if(!prs_append_prs_data(&p->out_data.frag, &out_hdr_ba)) {
2043                 DEBUG(0,("api_pipe_alter_context: append of RPC_HDR_BA failed.\n"));
2044                 goto err_exit;
2045         }
2046
2047         if (auth_len && !prs_append_prs_data(&p->out_data.frag, &out_auth)) {
2048                 DEBUG(0,("api_pipe_alter_context: append of auth info failed.\n"));
2049                 goto err_exit;
2050         }
2051
2052         /*
2053          * Setup the lengths for the initial reply.
2054          */
2055
2056         p->out_data.data_sent_length = 0;
2057         p->out_data.current_pdu_sent = 0;
2058
2059         prs_mem_free(&out_hdr_ba);
2060         prs_mem_free(&out_auth);
2061
2062         return True;
2063
2064   err_exit:
2065
2066         prs_mem_free(&p->out_data.frag);
2067         prs_mem_free(&out_hdr_ba);
2068         prs_mem_free(&out_auth);
2069         return setup_bind_nak(p);
2070 }
2071
2072 /****************************************************************************
2073  Deal with NTLMSSP sign & seal processing on an RPC request.
2074 ****************************************************************************/
2075
2076 bool api_pipe_ntlmssp_auth_process(pipes_struct *p, prs_struct *rpc_in,
2077                                         uint32 *p_ss_padding_len, NTSTATUS *pstatus)
2078 {
2079         RPC_HDR_AUTH auth_info;
2080         uint32 auth_len = p->hdr.auth_len;
2081         uint32 save_offset = prs_offset(rpc_in);
2082         AUTH_NTLMSSP_STATE *a = p->auth.a_u.auth_ntlmssp_state;
2083         unsigned char *data = NULL;
2084         size_t data_len;
2085         unsigned char *full_packet_data = NULL;
2086         size_t full_packet_data_len;
2087         DATA_BLOB auth_blob;
2088
2089         *pstatus = NT_STATUS_OK;
2090
2091         if (p->auth.auth_level == DCERPC_AUTH_LEVEL_NONE || p->auth.auth_level == DCERPC_AUTH_LEVEL_CONNECT) {
2092                 return True;
2093         }
2094
2095         if (!a) {
2096                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2097                 return False;
2098         }
2099
2100         /* Ensure there's enough data for an authenticated request. */
2101         if ((auth_len > RPC_MAX_SIGN_SIZE) ||
2102                         (RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len > p->hdr.frag_len)) {
2103                 DEBUG(0,("api_pipe_ntlmssp_auth_process: auth_len %u is too large.\n",
2104                         (unsigned int)auth_len ));
2105                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2106                 return False;
2107         }
2108
2109         /*
2110          * We need the full packet data + length (minus auth stuff) as well as the packet data + length
2111          * after the RPC header.
2112          * We need to pass in the full packet (minus auth len) to the NTLMSSP sign and check seal
2113          * functions as NTLMv2 checks the rpc headers also.
2114          */
2115
2116         data = (unsigned char *)(prs_data_p(rpc_in) + RPC_HDR_REQ_LEN);
2117         data_len = (size_t)(p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN - RPC_HDR_AUTH_LEN - auth_len);
2118
2119         full_packet_data = p->in_data.current_in_pdu;
2120         full_packet_data_len = p->hdr.frag_len - auth_len;
2121
2122         /* Pull the auth header and the following data into a blob. */
2123         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2124                 DEBUG(0,("api_pipe_ntlmssp_auth_process: cannot move offset to %u.\n",
2125                         (unsigned int)RPC_HDR_REQ_LEN + (unsigned int)data_len ));
2126                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2127                 return False;
2128         }
2129
2130         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2131                 DEBUG(0,("api_pipe_ntlmssp_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
2132                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2133                 return False;
2134         }
2135
2136         auth_blob.data = (unsigned char *)prs_data_p(rpc_in) + prs_offset(rpc_in);
2137         auth_blob.length = auth_len;
2138
2139         switch (p->auth.auth_level) {
2140                 case DCERPC_AUTH_LEVEL_PRIVACY:
2141                         /* Data is encrypted. */
2142                         *pstatus = ntlmssp_unseal_packet(a->ntlmssp_state,
2143                                                         data, data_len,
2144                                                         full_packet_data,
2145                                                         full_packet_data_len,
2146                                                         &auth_blob);
2147                         if (!NT_STATUS_IS_OK(*pstatus)) {
2148                                 return False;
2149                         }
2150                         break;
2151                 case DCERPC_AUTH_LEVEL_INTEGRITY:
2152                         /* Data is signed. */
2153                         *pstatus = ntlmssp_check_packet(a->ntlmssp_state,
2154                                                         data, data_len,
2155                                                         full_packet_data,
2156                                                         full_packet_data_len,
2157                                                         &auth_blob);
2158                         if (!NT_STATUS_IS_OK(*pstatus)) {
2159                                 return False;
2160                         }
2161                         break;
2162                 default:
2163                         *pstatus = NT_STATUS_INVALID_PARAMETER;
2164                         return False;
2165         }
2166
2167         /*
2168          * Return the current pointer to the data offset.
2169          */
2170
2171         if(!prs_set_offset(rpc_in, save_offset)) {
2172                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
2173                         (unsigned int)save_offset ));
2174                 *pstatus = NT_STATUS_INVALID_PARAMETER;
2175                 return False;
2176         }
2177
2178         /*
2179          * Remember the padding length. We must remove it from the real data
2180          * stream once the sign/seal is done.
2181          */
2182
2183         *p_ss_padding_len = auth_info.auth_pad_len;
2184
2185         return True;
2186 }
2187
2188 /****************************************************************************
2189  Deal with schannel processing on an RPC request.
2190 ****************************************************************************/
2191
2192 bool api_pipe_schannel_process(pipes_struct *p, prs_struct *rpc_in, uint32 *p_ss_padding_len)
2193 {
2194         uint32 data_len;
2195         uint32 auth_len;
2196         uint32 save_offset = prs_offset(rpc_in);
2197         RPC_HDR_AUTH auth_info;
2198         DATA_BLOB blob;
2199         NTSTATUS status;
2200         uint8_t *data;
2201
2202         auth_len = p->hdr.auth_len;
2203
2204         if (auth_len < RPC_AUTH_SCHANNEL_SIGN_OR_SEAL_CHK_LEN ||
2205                         auth_len > RPC_HEADER_LEN +
2206                                         RPC_HDR_REQ_LEN +
2207                                         RPC_HDR_AUTH_LEN +
2208                                         auth_len) {
2209                 DEBUG(0,("Incorrect auth_len %u.\n", (unsigned int)auth_len ));
2210                 return False;
2211         }
2212
2213         /*
2214          * The following is that length of the data we must verify or unseal.
2215          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
2216          * preceeding the auth_data.
2217          */
2218
2219         if (p->hdr.frag_len < RPC_HEADER_LEN + RPC_HDR_REQ_LEN + RPC_HDR_AUTH_LEN + auth_len) {
2220                 DEBUG(0,("Incorrect frag %u, auth %u.\n",
2221                         (unsigned int)p->hdr.frag_len,
2222                         (unsigned int)auth_len ));
2223                 return False;
2224         }
2225
2226         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
2227                 RPC_HDR_AUTH_LEN - auth_len;
2228
2229         DEBUG(5,("data %d auth %d\n", data_len, auth_len));
2230
2231         if(!prs_set_offset(rpc_in, RPC_HDR_REQ_LEN + data_len)) {
2232                 DEBUG(0,("cannot move offset to %u.\n",
2233                          (unsigned int)RPC_HDR_REQ_LEN + data_len ));
2234                 return False;
2235         }
2236
2237         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
2238                 DEBUG(0,("failed to unmarshall RPC_HDR_AUTH.\n"));
2239                 return False;
2240         }
2241
2242         if (auth_info.auth_type != DCERPC_AUTH_TYPE_SCHANNEL) {
2243                 DEBUG(0,("Invalid auth info %d on schannel\n",
2244                          auth_info.auth_type));
2245                 return False;
2246         }
2247
2248         blob = data_blob_const(prs_data_p(rpc_in) + prs_offset(rpc_in), auth_len);
2249
2250         if (DEBUGLEVEL >= 10) {
2251                 dump_NL_AUTH_SIGNATURE(talloc_tos(), &blob);
2252         }
2253
2254         data = (uint8_t *)prs_data_p(rpc_in)+RPC_HDR_REQ_LEN;
2255
2256         switch (auth_info.auth_level) {
2257         case DCERPC_AUTH_LEVEL_PRIVACY:
2258                 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2259                                                 talloc_tos(),
2260                                                 true,
2261                                                 data,
2262                                                 data_len,
2263                                                 &blob);
2264                 break;
2265         case DCERPC_AUTH_LEVEL_INTEGRITY:
2266                 status = netsec_incoming_packet(p->auth.a_u.schannel_auth,
2267                                                 talloc_tos(),
2268                                                 false,
2269                                                 data,
2270                                                 data_len,
2271                                                 &blob);
2272                 break;
2273         default:
2274                 status = NT_STATUS_INTERNAL_ERROR;
2275                 break;
2276         }
2277
2278         if (!NT_STATUS_IS_OK(status)) {
2279                 DEBUG(0,("failed to unseal packet: %s\n", nt_errstr(status)));
2280                 return false;
2281         }
2282
2283         /*
2284          * Return the current pointer to the data offset.
2285          */
2286
2287         if(!prs_set_offset(rpc_in, save_offset)) {
2288                 DEBUG(0,("failed to set offset back to %u\n",
2289                          (unsigned int)save_offset ));
2290                 return False;
2291         }
2292
2293         /*
2294          * Remember the padding length. We must remove it from the real data
2295          * stream once the sign/seal is done.
2296          */
2297
2298         *p_ss_padding_len = auth_info.auth_pad_len;
2299
2300         return True;
2301 }
2302
2303 /****************************************************************************
2304  Find the set of RPC functions associated with this context_id
2305 ****************************************************************************/
2306
2307 static PIPE_RPC_FNS* find_pipe_fns_by_context( PIPE_RPC_FNS *list, uint32 context_id )
2308 {
2309         PIPE_RPC_FNS *fns = NULL;
2310
2311         if ( !list ) {
2312                 DEBUG(0,("find_pipe_fns_by_context: ERROR!  No context list for pipe!\n"));
2313                 return NULL;
2314         }
2315
2316         for (fns=list; fns; fns=fns->next ) {
2317                 if ( fns->context_id == context_id )
2318                         return fns;
2319         }
2320         return NULL;
2321 }
2322
2323 /****************************************************************************
2324  Memory cleanup.
2325 ****************************************************************************/
2326
2327 void free_pipe_rpc_context( PIPE_RPC_FNS *list )
2328 {
2329         PIPE_RPC_FNS *tmp = list;
2330         PIPE_RPC_FNS *tmp2;
2331
2332         while (tmp) {
2333                 tmp2 = tmp->next;
2334                 SAFE_FREE(tmp);
2335                 tmp = tmp2;
2336         }
2337
2338         return;
2339 }
2340
2341 static bool api_rpcTNP(pipes_struct *p,
2342                        const struct api_struct *api_rpc_cmds, int n_cmds);
2343
2344 /****************************************************************************
2345  Find the correct RPC function to call for this request.
2346  If the pipe is authenticated then become the correct UNIX user
2347  before doing the call.
2348 ****************************************************************************/
2349
2350 bool api_pipe_request(pipes_struct *p)
2351 {
2352         bool ret = False;
2353         bool changed_user = False;
2354         PIPE_RPC_FNS *pipe_fns;
2355
2356         if (p->pipe_bound &&
2357                         ((p->auth.auth_type == PIPE_AUTH_TYPE_NTLMSSP) ||
2358                          (p->auth.auth_type == PIPE_AUTH_TYPE_SPNEGO_NTLMSSP))) {
2359                 if(!become_authenticated_pipe_user(p)) {
2360                         prs_mem_free(&p->out_data.rdata);
2361                         return False;
2362                 }
2363                 changed_user = True;
2364         }
2365
2366         DEBUG(5, ("Requested \\PIPE\\%s\n",
2367                   get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2368
2369         /* get the set of RPC functions for this context */
2370
2371         pipe_fns = find_pipe_fns_by_context(p->contexts, p->hdr_req.context_id);
2372
2373         if ( pipe_fns ) {
2374                 TALLOC_CTX *frame = talloc_stackframe();
2375                 ret = api_rpcTNP(p, pipe_fns->cmds, pipe_fns->n_cmds);
2376                 TALLOC_FREE(frame);
2377         }
2378         else {
2379                 DEBUG(0,("api_pipe_request: No rpc function table associated with context [%d] on pipe [%s]\n",
2380                         p->hdr_req.context_id,
2381                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2382         }
2383
2384         if (changed_user) {
2385                 unbecome_authenticated_pipe_user();
2386         }
2387
2388         return ret;
2389 }
2390
2391 /*******************************************************************
2392  Calls the underlying RPC function for a named pipe.
2393  ********************************************************************/
2394
2395 static bool api_rpcTNP(pipes_struct *p,
2396                        const struct api_struct *api_rpc_cmds, int n_cmds)
2397 {
2398         int fn_num;
2399         uint32 offset1, offset2;
2400
2401         /* interpret the command */
2402         DEBUG(4,("api_rpcTNP: %s op 0x%x - ",
2403                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2404                  p->hdr_req.opnum));
2405
2406         if (DEBUGLEVEL >= 50) {
2407                 fstring name;
2408                 slprintf(name, sizeof(name)-1, "in_%s",
2409                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2410                 prs_dump(name, p->hdr_req.opnum, &p->in_data.data);
2411         }
2412
2413         for (fn_num = 0; fn_num < n_cmds; fn_num++) {
2414                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
2415                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
2416                         break;
2417                 }
2418         }
2419
2420         if (fn_num == n_cmds) {
2421                 /*
2422                  * For an unknown RPC just return a fault PDU but
2423                  * return True to allow RPC's on the pipe to continue
2424                  * and not put the pipe into fault state. JRA.
2425                  */
2426                 DEBUG(4, ("unknown\n"));
2427                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2428                 return True;
2429         }
2430
2431         offset1 = prs_offset(&p->out_data.rdata);
2432
2433         DEBUG(6, ("api_rpc_cmds[%d].fn == %p\n",
2434                 fn_num, api_rpc_cmds[fn_num].fn));
2435         /* do the actual command */
2436         if(!api_rpc_cmds[fn_num].fn(p)) {
2437                 DEBUG(0,("api_rpcTNP: %s: %s failed.\n",
2438                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax),
2439                          api_rpc_cmds[fn_num].name));
2440                 prs_mem_free(&p->out_data.rdata);
2441                 return False;
2442         }
2443
2444         if (p->bad_handle_fault_state) {
2445                 DEBUG(4,("api_rpcTNP: bad handle fault return.\n"));
2446                 p->bad_handle_fault_state = False;
2447                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_CONTEXT_MISMATCH));
2448                 return True;
2449         }
2450
2451         if (p->rng_fault_state) {
2452                 DEBUG(4, ("api_rpcTNP: rng fault return\n"));
2453                 p->rng_fault_state = False;
2454                 setup_fault_pdu(p, NT_STATUS(DCERPC_FAULT_OP_RNG_ERROR));
2455                 return True;
2456         }
2457
2458         offset2 = prs_offset(&p->out_data.rdata);
2459         prs_set_offset(&p->out_data.rdata, offset1);
2460         if (DEBUGLEVEL >= 50) {
2461                 fstring name;
2462                 slprintf(name, sizeof(name)-1, "out_%s",
2463                          get_pipe_name_from_syntax(talloc_tos(), &p->syntax));
2464                 prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
2465         }
2466         prs_set_offset(&p->out_data.rdata, offset2);
2467
2468         DEBUG(5,("api_rpcTNP: called %s successfully\n",
2469                  get_pipe_name_from_syntax(talloc_tos(), &p->syntax)));
2470
2471         /* Check for buffer underflow in rpc parsing */
2472
2473         if ((DEBUGLEVEL >= 10) &&
2474             (prs_offset(&p->in_data.data) != prs_data_size(&p->in_data.data))) {
2475                 size_t data_len = prs_data_size(&p->in_data.data) - prs_offset(&p->in_data.data);
2476                 char *data = (char *)SMB_MALLOC(data_len);
2477
2478                 DEBUG(10, ("api_rpcTNP: rpc input buffer underflow (parse error?)\n"));
2479                 if (data) {
2480                         prs_uint8s(False, "", &p->in_data.data, 0, (unsigned char *)data, (uint32)data_len);
2481                         SAFE_FREE(data);
2482                 }
2483
2484         }
2485
2486         return True;
2487 }