source3/rpc_server/srv_pipe.c

   1 #define OLD_NTDOMAIN 1
   2 /*
   3  *  Unix SMB/Netbios implementation.
   4  *  Version 1.9.
   5  *  RPC Pipe client / server routines
   6  *  Copyright (C) Andrew Tridgell              1992-1998
   7  *  Copyright (C) Luke Kenneth Casson Leighton 1996-1998,
   8  *  Copyright (C) Paul Ashton                  1997-1998.
   9  *  Copyright (C) Jeremy Allison                    1999.
  10  *
  11  *  This program is free software; you can redistribute it and/or modify
  12  *  it under the terms of the GNU General Public License as published by
  13  *  the Free Software Foundation; either version 2 of the License, or
  14  *  (at your option) any later version.
  15  *
  16  *  This program is distributed in the hope that it will be useful,
  17  *  but WITHOUT ANY WARRANTY; without even the implied warranty of
  18  *  MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  19  *  GNU General Public License for more details.
  20  *
  21  *  You should have received a copy of the GNU General Public License
  22  *  along with this program; if not, write to the Free Software
  23  *  Foundation, Inc., 675 Mass Ave, Cambridge, MA 02139, USA.
  24  */
  25
  26 /*  this module apparently provides an implementation of DCE/RPC over a
  27  *  named pipe (IPC$ connection using SMBtrans).  details of DCE/RPC
  28  *  documentation are available (in on-line form) from the X-Open group.
  29  *
  30  *  this module should provide a level of abstraction between SMB
  31  *  and DCE/RPC, while minimising the amount of mallocs, unnecessary
  32  *  data copies, and network traffic.
  33  *
  34  *  in this version, which takes a "let's learn what's going on and
  35  *  get something running" approach, there is additional network
  36  *  traffic generated, but the code should be easier to understand...
  37  *
  38  *  ... if you read the docs.  or stare at packets for weeks on end.
  39  *
  40  */
  41
  42 #include "includes.h"
  43
  44 extern int DEBUGLEVEL;
  45
  46 static void NTLMSSPcalc_p( pipes_struct *p, unsigned char *data, int len)
  47 {
  48     unsigned char *hash = p->ntlmssp_hash;
  49     unsigned char index_i = hash[256];
  50     unsigned char index_j = hash[257];
  51     int ind;
  52
  53     for( ind = 0; ind < len; ind++) {
  54         unsigned char tc;
  55         unsigned char t;
  56
  57         index_i++;
  58         index_j += hash[index_i];
  59
  60         tc = hash[index_i];
  61         hash[index_i] = hash[index_j];
  62         hash[index_j] = tc;
  63
  64         t = hash[index_i] + hash[index_j];
  65         data[ind] = data[ind] ^ hash[t];
  66     }
  67
  68     hash[256] = index_i;
  69     hash[257] = index_j;
  70 }
  71
  72 /*******************************************************************
  73  Generate the next PDU to be returned from the data in p->rdata.
  74  We cheat here as this function doesn't handle the special auth
  75  footers of the authenticated bind response reply.
  76  ********************************************************************/
  77
  78 BOOL create_next_pdu(pipes_struct *p)
  79 {
  80         RPC_HDR_RESP hdr_resp;
  81         BOOL auth_verify = IS_BITS_SET_ALL(p->ntlmssp_chal_flags, NTLMSSP_NEGOTIATE_SIGN);
  82         BOOL auth_seal   = IS_BITS_SET_ALL(p->ntlmssp_chal_flags, NTLMSSP_NEGOTIATE_SEAL);
  83         uint32 data_len;
  84         uint32 data_space_available;
  85         uint32 data_len_left;
  86         prs_struct outgoing_pdu;
  87         char *data;
  88         char *data_from;
  89         uint32 data_pos;
  90
  91         /*
  92          * If we're in the fault state, keep returning fault PDU's until
  93          * the pipe gets closed. JRA.
  94          */
  95
  96         if(p->fault_state) {
  97                 setup_fault_pdu(p);
  98                 return True;
  99         }
 100
 101         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 102
 103         /* Change the incoming request header to a response. */
 104         p->hdr.pkt_type = RPC_RESPONSE;
 105
 106         /* Set up rpc header flags. */
 107         if (p->out_data.data_sent_length == 0)
 108                 p->hdr.flags = RPC_FLG_FIRST;
 109         else
 110                 p->hdr.flags = 0;
 111
 112         /*
 113          * Work out how much we can fit in a single PDU.
 114          */
 115
 116         data_space_available = sizeof(p->out_data.current_pdu) - RPC_HEADER_LEN - RPC_HDR_RESP_LEN;
 117         if(p->ntlmssp_auth_validated)
 118                 data_space_available -= (RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN);
 119
 120         /*
 121          * The amount we send is the minimum of the available
 122          * space and the amount left to send.
 123          */
 124
 125         data_len_left = prs_offset(&p->out_data.rdata) - p->out_data.data_sent_length;
 126
 127         /*
 128          * Ensure there really is data left to send.
 129          */
 130
 131         if(!data_len_left) {
 132                 DEBUG(0,("create_next_pdu: no data left to send !\n"));
 133                 return False;
 134         }
 135
 136         data_len = MIN(data_len_left, data_space_available);
 137
 138         /*
 139          * Set up the alloc hint. This should be the data left to
 140          * send.
 141          */
 142
 143         hdr_resp.alloc_hint = data_len_left;
 144
 145         /*
 146          * Set up the header lengths.
 147          */
 148
 149         if (p->ntlmssp_auth_validated) {
 150                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len +
 151                                         RPC_HDR_AUTH_LEN + RPC_AUTH_NTLMSSP_CHK_LEN;
 152                 p->hdr.auth_len = RPC_AUTH_NTLMSSP_CHK_LEN;
 153         } else {
 154                 p->hdr.frag_len = RPC_HEADER_LEN + RPC_HDR_RESP_LEN + data_len;
 155                 p->hdr.auth_len = 0;
 156         }
 157
 158         /*
 159          * Work out if this PDU will be the last.
 160          */
 161
 162         if(p->out_data.data_sent_length + data_len >= prs_offset(&p->out_data.rdata))
 163                 p->hdr.flags |= RPC_FLG_LAST;
 164
 165         /*
 166          * Init the parse struct to point at the outgoing
 167          * data.
 168          */
 169
 170         prs_init( &outgoing_pdu, 0, 4, MARSHALL);
 171         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 172
 173         /* Store the header in the data stream. */
 174         if(!smb_io_rpc_hdr("hdr", &p->hdr, &outgoing_pdu, 0)) {
 175                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR.\n"));
 176                 return False;
 177         }
 178
 179         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 180                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_RESP.\n"));
 181                 return False;
 182         }
 183
 184         /* Store the current offset. */
 185         data_pos = prs_offset(&outgoing_pdu);
 186
 187         /* Copy the data into the PDU. */
 188         data_from = prs_data_p(&p->out_data.rdata) + p->out_data.data_sent_length;
 189
 190         if(!prs_append_data(&outgoing_pdu, data_from, data_len)) {
 191                 DEBUG(0,("create_next_pdu: failed to copy %u bytes of data.\n", (unsigned int)data_len));
 192                 return False;
 193         }
 194
 195         /*
 196          * Set data to point to where we copied the data into.
 197          */
 198
 199         data = prs_data_p(&outgoing_pdu) + data_pos;
 200
 201         if (p->hdr.auth_len > 0) {
 202                 uint32 crc32 = 0;
 203
 204                 DEBUG(5,("create_next_pdu: sign: %s seal: %s data %d auth %d\n",
 205                          BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, p->hdr.auth_len));
 206
 207                 if (auth_seal) {
 208                         crc32 = crc32_calc_buffer(data, data_len);
 209                         NTLMSSPcalc_p(p, (uchar*)data, data_len);
 210                 }
 211
 212                 if (auth_seal || auth_verify) {
 213                         RPC_HDR_AUTH auth_info;
 214
 215                         init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL,
 216                                         (auth_verify ? RPC_HDR_AUTH_LEN : 0), (auth_verify ? 1 : 0));
 217                         if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, &outgoing_pdu, 0)) {
 218                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_HDR_AUTH.\n"));
 219                                 return False;
 220                         }
 221                 }
 222
 223                 if (auth_verify) {
 224                         RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
 225                         char *auth_data = prs_data_p(&outgoing_pdu);
 226
 227                         p->ntlmssp_seq_num++;
 228                         init_rpc_auth_ntlmssp_chk(&ntlmssp_chk, NTLMSSP_SIGN_VERSION,
 229                                         crc32, p->ntlmssp_seq_num++);
 230                         auth_data = prs_data_p(&outgoing_pdu) + prs_offset(&outgoing_pdu) + 4;
 231                         if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, &outgoing_pdu, 0)) {
 232                                 DEBUG(0,("create_next_pdu: failed to marshall RPC_AUTH_NTLMSSP_CHK.\n"));
 233                                 return False;
 234                         }
 235                         NTLMSSPcalc_p(p, (uchar*)auth_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
 236                 }
 237         }
 238
 239         /*
 240          * Setup the counts for this PDU.
 241          */
 242
 243         p->out_data.data_sent_length += data_len;
 244         p->out_data.current_pdu_len = p->hdr.frag_len;
 245         p->out_data.current_pdu_sent = 0;
 246
 247         return True;
 248 }
 249
 250 /*******************************************************************
 251  Process an NTLMSSP authentication response.
 252  If this function succeeds, the user has been authenticated
 253  and their domain, name and calling workstation stored in
 254  the pipe struct.
 255  The initial challenge is stored in p->challenge.
 256  *******************************************************************/
 257
 258 static BOOL api_pipe_ntlmssp_verify(pipes_struct *p, RPC_AUTH_NTLMSSP_RESP *ntlmssp_resp)
 259 {
 260         uchar lm_owf[24];
 261         uchar nt_owf[24];
 262         fstring user_name;
 263         fstring unix_user_name;
 264         fstring domain;
 265         fstring wks;
 266         BOOL guest_user = False;
 267         struct smb_passwd *smb_pass = NULL;
 268         struct passwd *pass = NULL;
 269         uchar null_smb_passwd[16];
 270         uchar *smb_passwd_ptr = NULL;
 271
 272         DEBUG(5,("api_pipe_ntlmssp_verify: checking user details\n"));
 273
 274         memset(p->user_name, '\0', sizeof(p->user_name));
 275         memset(p->unix_user_name, '\0', sizeof(p->unix_user_name));
 276         memset(p->domain, '\0', sizeof(p->domain));
 277         memset(p->wks, '\0', sizeof(p->wks));
 278
 279         /*
 280          * Setup an empty password for a guest user.
 281          */
 282
 283         memset(null_smb_passwd,0,16);
 284
 285         /*
 286          * We always negotiate UNICODE.
 287          */
 288
 289         if (IS_BITS_SET_ALL(p->ntlmssp_chal_flags, NTLMSSP_NEGOTIATE_UNICODE)) {
 290                 fstrcpy(user_name, dos_unistrn2((uint16*)ntlmssp_resp->user, ntlmssp_resp->hdr_usr.str_str_len/2));
 291                 fstrcpy(domain, dos_unistrn2((uint16*)ntlmssp_resp->domain, ntlmssp_resp->hdr_domain.str_str_len/2));
 292                 fstrcpy(wks, dos_unistrn2((uint16*)ntlmssp_resp->wks, ntlmssp_resp->hdr_wks.str_str_len/2));
 293         } else {
 294                 fstrcpy(user_name, ntlmssp_resp->user);
 295                 fstrcpy(domain, ntlmssp_resp->domain);
 296                 fstrcpy(wks, ntlmssp_resp->wks);
 297         }
 298
 299         DEBUG(5,("user: %s domain: %s wks: %s\n", user_name, domain, wks));
 300
 301         memcpy(lm_owf, ntlmssp_resp->lm_resp, sizeof(lm_owf));
 302         memcpy(nt_owf, ntlmssp_resp->nt_resp, sizeof(nt_owf));
 303
 304 #ifdef DEBUG_PASSWORD
 305         DEBUG(100,("lm, nt owfs, chal\n"));
 306         dump_data(100, (char *)lm_owf, sizeof(lm_owf));
 307         dump_data(100, (char *)nt_owf, sizeof(nt_owf));
 308         dump_data(100, (char *)p->challenge, 8);
 309 #endif
 310
 311         /*
 312          * Allow guest access. Patch from Shirish Kalele <kalele@veritas.com>.
 313          */
 314
 315         if((strlen(user_name) == 0) &&
 316            (ntlmssp_resp->hdr_nt_resp.str_str_len==0))
 317           {
 318                 guest_user = True;
 319
 320         fstrcpy(unix_user_name, lp_guestaccount(-1));
 321                 DEBUG(100,("Null user in NTLMSSP verification. Using guest = %s\n", unix_user_name));
 322
 323                 smb_passwd_ptr = null_smb_passwd;
 324
 325         } else {
 326
 327                 /*
 328                  * Pass the user through the NT -> unix user mapping
 329                  * function.
 330                  */
 331
 332                 fstrcpy(unix_user_name, user_name);
 333                 (void)map_username(unix_user_name);
 334
 335                 /*
 336                  * Do the length checking only if user is not NULL.
 337                  */
 338
 339                 if (ntlmssp_resp->hdr_lm_resp.str_str_len == 0)
 340                         return False;
 341                 if (ntlmssp_resp->hdr_nt_resp.str_str_len == 0)
 342                         return False;
 343                 if (ntlmssp_resp->hdr_usr.str_str_len == 0)
 344                         return False;
 345                 if (ntlmssp_resp->hdr_domain.str_str_len == 0)
 346                         return False;
 347                 if (ntlmssp_resp->hdr_wks.str_str_len == 0)
 348                         return False;
 349
 350         }
 351
 352         /*
 353          * Find the user in the unix password db.
 354          */
 355
 356         if(!(pass = Get_Pwnam(unix_user_name,True))) {
 357                 DEBUG(1,("Couldn't find user '%s' in UNIX password database.\n",unix_user_name));
 358                 return(False);
 359         }
 360
 361         if(!guest_user) {
 362
 363                 become_root(True);
 364
 365                 if(!(p->ntlmssp_auth_validated = pass_check_smb(unix_user_name, domain,
 366                                       (uchar*)p->challenge, lm_owf, nt_owf, NULL))) {
 367                         DEBUG(1,("api_pipe_ntlmssp_verify: User %s\\%s from machine %s \
 368 failed authentication on named pipe %s.\n", domain, unix_user_name, wks, p->name ));
 369                         unbecome_root(True);
 370                         return False;
 371                 }
 372
 373                 if(!(smb_pass = getsmbpwnam(unix_user_name))) {
 374                         DEBUG(1,("api_pipe_ntlmssp_verify: Cannot find user %s in smb passwd database.\n",
 375                                 unix_user_name));
 376                         unbecome_root(True);
 377                         return False;
 378                 }
 379
 380                 unbecome_root(True);
 381
 382                 if (smb_pass == NULL) {
 383                         DEBUG(1,("api_pipe_ntlmssp_verify: Couldn't find user '%s' in smb_passwd file.\n",
 384                                 unix_user_name));
 385                         return(False);
 386                 }
 387
 388                 /* Quit if the account was disabled. */
 389                 if((smb_pass->acct_ctrl & ACB_DISABLED) || !smb_pass->smb_passwd) {
 390                         DEBUG(1,("Account for user '%s' was disabled.\n", unix_user_name));
 391                         return(False);
 392                 }
 393
 394                 if(!smb_pass->smb_nt_passwd) {
 395                         DEBUG(1,("Account for user '%s' has no NT password hash.\n", unix_user_name));
 396                         return(False);
 397                 }
 398
 399                 smb_passwd_ptr = smb_pass->smb_passwd;
 400         }
 401
 402         /*
 403          * Set up the sign/seal data.
 404          */
 405
 406         {
 407                 uchar p24[24];
 408                 NTLMSSPOWFencrypt(smb_passwd_ptr, lm_owf, p24);
 409                 {
 410                         unsigned char j = 0;
 411                         int ind;
 412
 413                         unsigned char k2[8];
 414
 415                         memcpy(k2, p24, 5);
 416                         k2[5] = 0xe5;
 417                         k2[6] = 0x38;
 418                         k2[7] = 0xb0;
 419
 420                         for (ind = 0; ind < 256; ind++)
 421                                 p->ntlmssp_hash[ind] = (unsigned char)ind;
 422
 423                         for( ind = 0; ind < 256; ind++) {
 424                                 unsigned char tc;
 425
 426                                 j += (p->ntlmssp_hash[ind] + k2[ind%8]);
 427
 428                                 tc = p->ntlmssp_hash[ind];
 429                                 p->ntlmssp_hash[ind] = p->ntlmssp_hash[j];
 430                                 p->ntlmssp_hash[j] = tc;
 431                         }
 432
 433                         p->ntlmssp_hash[256] = 0;
 434                         p->ntlmssp_hash[257] = 0;
 435                 }
 436 /*              NTLMSSPhash(p->ntlmssp_hash, p24); */
 437                 p->ntlmssp_seq_num = 0;
 438
 439         }
 440
 441         fstrcpy(p->user_name, user_name);
 442         fstrcpy(p->unix_user_name, unix_user_name);
 443         fstrcpy(p->domain, domain);
 444         fstrcpy(p->wks, wks);
 445
 446         /*
 447          * Store the UNIX credential data (uid/gid pair) in the pipe structure.
 448          */
 449
 450         p->uid = pass->pw_uid;
 451         p->gid = pass->pw_gid;
 452
 453         p->ntlmssp_auth_validated = True;
 454         return True;
 455 }
 456
 457 /*******************************************************************
 458  The switch table for the pipe names and the functions to handle them.
 459  *******************************************************************/
 460
 461 struct api_cmd
 462 {
 463   char * pipe_clnt_name;
 464   char * pipe_srv_name;
 465   BOOL (*fn) (pipes_struct *, prs_struct *);
 466 };
 467
 468 static struct api_cmd api_fd_commands[] =
 469 {
 470     { "lsarpc",   "lsass",   api_ntlsa_rpc },
 471     { "samr",     "lsass",   api_samr_rpc },
 472     { "srvsvc",   "ntsvcs",  api_srvsvc_rpc },
 473     { "wkssvc",   "ntsvcs",  api_wkssvc_rpc },
 474     { "NETLOGON", "lsass",   api_netlog_rpc },
 475     { "winreg",   "winreg",  api_reg_rpc },
 476     { "spoolss",  "spoolss", api_spoolss_rpc },
 477     { NULL,       NULL,      NULL }
 478 };
 479
 480 /*******************************************************************
 481  This is the client reply to our challenge for an authenticated
 482  bind request. The challenge we sent is in p->challenge.
 483 *******************************************************************/
 484
 485 BOOL api_pipe_bind_auth_resp(pipes_struct *p, prs_struct *rpc_in_p)
 486 {
 487         RPC_HDR_AUTHA autha_info;
 488         RPC_AUTH_VERIFIER auth_verifier;
 489         RPC_AUTH_NTLMSSP_RESP ntlmssp_resp;
 490
 491         DEBUG(5,("api_pipe_bind_auth_resp: decode request. %d\n", __LINE__));
 492
 493         if (p->hdr.auth_len == 0) {
 494                 DEBUG(0,("api_pipe_bind_auth_resp: No auth field sent !\n"));
 495                 return False;
 496         }
 497
 498         /*
 499          * Decode the authentication verifier response.
 500          */
 501
 502         if(!smb_io_rpc_hdr_autha("", &autha_info, rpc_in_p, 0)) {
 503                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_HDR_AUTHA failed.\n"));
 504                 return False;
 505         }
 506
 507         if (autha_info.auth_type != NTLMSSP_AUTH_TYPE || autha_info.auth_level != NTLMSSP_AUTH_LEVEL) {
 508                 DEBUG(0,("api_pipe_bind_auth_resp: incorrect auth type (%d) or level (%d).\n",
 509                         (int)autha_info.auth_type, (int)autha_info.auth_level ));
 510                 return False;
 511         }
 512
 513         if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 514                 DEBUG(0,("api_pipe_bind_auth_resp: unmarshall of RPC_AUTH_VERIFIER failed.\n"));
 515                 return False;
 516         }
 517
 518         /*
 519          * Ensure this is a NTLMSSP_AUTH packet type.
 520          */
 521
 522         if (!rpc_auth_verifier_chk(&auth_verifier, "NTLMSSP", NTLMSSP_AUTH)) {
 523                 DEBUG(0,("api_pipe_bind_auth_resp: rpc_auth_verifier_chk failed.\n"));
 524                 return False;
 525         }
 526
 527         if(!smb_io_rpc_auth_ntlmssp_resp("", &ntlmssp_resp, rpc_in_p, 0)) {
 528                 DEBUG(0,("api_pipe_bind_auth_resp: Failed to unmarshall RPC_AUTH_NTLMSSP_RESP.\n"));
 529                 return False;
 530         }
 531
 532         /*
 533          * The following call actually checks the challenge/response data.
 534          * for correctness against the given DOMAIN\user name.
 535          */
 536
 537         if (!api_pipe_ntlmssp_verify(p, &ntlmssp_resp))
 538                 return False;
 539
 540         p->pipe_bound = True
 541 ;
 542         return True;
 543 }
 544
 545 /*******************************************************************
 546  Marshall a bind_nak pdu.
 547 *******************************************************************/
 548
 549 static BOOL setup_bind_nak(pipes_struct *p)
 550 {
 551         prs_struct outgoing_rpc;
 552         RPC_HDR nak_hdr;
 553         uint16 zero = 0;
 554
 555         /* Free any memory in the current return data buffer. */
 556         prs_mem_free(&p->out_data.rdata);
 557
 558         /*
 559          * Marshall directly into the outgoing PDU space. We
 560          * must do this as we need to set to the bind response
 561          * header and are never sending more than one PDU here.
 562          */
 563
 564         prs_init( &outgoing_rpc, 0, 4, MARSHALL);
 565         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 566
 567
 568         /*
 569          * Initialize a bind_nak header.
 570          */
 571
 572         init_rpc_hdr(&nak_hdr, RPC_BINDNACK, RPC_FLG_FIRST | RPC_FLG_LAST,
 573             p->hdr.call_id, RPC_HEADER_LEN + sizeof(uint16), 0);
 574
 575         /*
 576          * Marshall the header into the outgoing PDU.
 577          */
 578
 579         if(!smb_io_rpc_hdr("", &nak_hdr, &outgoing_rpc, 0)) {
 580                 DEBUG(0,("setup_bind_nak: marshalling of RPC_HDR failed.\n"));
 581                 return False;
 582         }
 583
 584         /*
 585          * Now add the reject reason.
 586          */
 587
 588         if(!prs_uint16("reject code", &outgoing_rpc, 0, &zero))
 589         return False;
 590
 591         p->out_data.data_sent_length = 0;
 592         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 593         p->out_data.current_pdu_sent = 0;
 594
 595         p->pipe_bound = False;
 596
 597         return True;
 598 }
 599
 600 /*******************************************************************
 601  Marshall a fault pdu.
 602 *******************************************************************/
 603
 604 BOOL setup_fault_pdu(pipes_struct *p)
 605 {
 606         prs_struct outgoing_pdu;
 607         RPC_HDR fault_hdr;
 608         RPC_HDR_RESP hdr_resp;
 609         RPC_HDR_FAULT fault_resp;
 610
 611         /* Free any memory in the current return data buffer. */
 612         prs_mem_free(&p->out_data.rdata);
 613
 614         /*
 615          * Marshall directly into the outgoing PDU space. We
 616          * must do this as we need to set to the bind response
 617          * header and are never sending more than one PDU here.
 618          */
 619
 620         prs_init( &outgoing_pdu, 0, 4, MARSHALL);
 621         prs_give_memory( &outgoing_pdu, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 622
 623         /*
 624          * Initialize a fault header.
 625          */
 626
 627         init_rpc_hdr(&fault_hdr, RPC_FAULT, RPC_FLG_FIRST | RPC_FLG_LAST | RPC_FLG_NOCALL,
 628             p->hdr.call_id, RPC_HEADER_LEN + RPC_HDR_RESP_LEN + RPC_HDR_FAULT_LEN, 0);
 629
 630         /*
 631          * Initialize the HDR_RESP and FAULT parts of the PDU.
 632          */
 633
 634         memset((char *)&hdr_resp, '\0', sizeof(hdr_resp));
 635
 636         fault_resp.status = 0x1c010002;
 637         fault_resp.reserved = 0;
 638
 639         /*
 640          * Marshall the header into the outgoing PDU.
 641          */
 642
 643         if(!smb_io_rpc_hdr("", &fault_hdr, &outgoing_pdu, 0)) {
 644                 DEBUG(0,("setup_fault_pdu: marshalling of RPC_HDR failed.\n"));
 645                 return False;
 646         }
 647
 648         if(!smb_io_rpc_hdr_resp("resp", &hdr_resp, &outgoing_pdu, 0)) {
 649                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_RESP.\n"));
 650                 return False;
 651         }
 652
 653         if(!smb_io_rpc_hdr_fault("fault", &fault_resp, &outgoing_pdu, 0)) {
 654                 DEBUG(0,("setup_fault_pdu: failed to marshall RPC_HDR_FAULT.\n"));
 655                 return False;
 656         }
 657
 658         p->out_data.data_sent_length = 0;
 659         p->out_data.current_pdu_len = prs_offset(&outgoing_pdu);
 660         p->out_data.current_pdu_sent = 0;
 661
 662         return True;
 663 }
 664
 665 /*******************************************************************
 666  Ensure a bind request has the correct abstract & transfer interface.
 667  Used to reject unknown binds from Win2k.
 668 *******************************************************************/
 669
 670 BOOL check_bind_req(char* pipe_name, RPC_IFACE* abstract,
 671                                         RPC_IFACE* transfer)
 672 {
 673         extern struct pipe_id_info pipe_names[];
 674         int i=0;
 675         fstring pname;
 676         fstrcpy(pname,"\\PIPE\\");
 677         fstrcat(pname,pipe_name);
 678
 679         for(i=0;pipe_names[i].client_pipe; i++) {
 680                 if(strequal(pipe_names[i].client_pipe, pname))
 681                         break;
 682         }
 683
 684         if(pipe_names[i].client_pipe == NULL)
 685                 return False;
 686
 687         /* check the abstract interface */
 688         if((abstract->version != pipe_names[i].abstr_syntax.version) ||
 689                 (memcmp(&abstract->uuid, &pipe_names[i].abstr_syntax.uuid,
 690                         sizeof(RPC_UUID)) != 0))
 691                 return False;
 692
 693         /* check the transfer interface */
 694         if((transfer->version != pipe_names[i].trans_syntax.version) ||
 695                 (memcmp(&transfer->uuid, &pipe_names[i].trans_syntax.uuid,
 696                         sizeof(RPC_UUID)) != 0))
 697                 return False;
 698
 699         return True;
 700 }
 701
 702 /*******************************************************************
 703  Respond to a pipe bind request.
 704 *******************************************************************/
 705
 706 BOOL api_pipe_bind_req(pipes_struct *p, prs_struct *rpc_in_p)
 707 {
 708         RPC_HDR_BA hdr_ba;
 709         RPC_HDR_RB hdr_rb;
 710         RPC_HDR_AUTH auth_info;
 711         uint16 assoc_gid;
 712         fstring ack_pipe_name;
 713         prs_struct out_hdr_ba;
 714         prs_struct out_auth;
 715         prs_struct outgoing_rpc;
 716         int i = 0;
 717         int auth_len = 0;
 718         enum RPC_PKT_TYPE reply_pkt_type;
 719
 720         p->ntlmssp_auth_requested = False;
 721
 722         DEBUG(5,("api_pipe_bind_req: decode request. %d\n", __LINE__));
 723
 724         /*
 725          * Try and find the correct pipe name to ensure
 726          * that this is a pipe name we support.
 727          */
 728
 729         for (i = 0; api_fd_commands[i].pipe_clnt_name; i++) {
 730                 if (strequal(api_fd_commands[i].pipe_clnt_name, p->name) &&
 731                     api_fd_commands[i].fn != NULL) {
 732                         DEBUG(3,("api_pipe_bind_req: \\PIPE\\%s -> \\PIPE\\%s\n",
 733                                    api_fd_commands[i].pipe_clnt_name,
 734                                    api_fd_commands[i].pipe_srv_name));
 735                         fstrcpy(p->pipe_srv_name, api_fd_commands[i].pipe_srv_name);
 736                         break;
 737                 }
 738         }
 739
 740         if (api_fd_commands[i].fn == NULL) {
 741                 DEBUG(3,("api_pipe_bind_req: Unknown pipe name %s in bind request.\n",
 742                         p->name ));
 743                 if(!setup_bind_nak(p))
 744                         return False;
 745                 return True;
 746         }
 747
 748         /* decode the bind request */
 749         if(!smb_io_rpc_hdr_rb("", &hdr_rb, rpc_in_p, 0))  {
 750                 DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_RB struct.\n"));
 751                 return False;
 752         }
 753
 754         /*
 755          * Check if this is an authenticated request.
 756          */
 757
 758         if (p->hdr.auth_len != 0) {
 759                 RPC_AUTH_VERIFIER auth_verifier;
 760                 RPC_AUTH_NTLMSSP_NEG ntlmssp_neg;
 761
 762                 /*
 763                  * Decode the authentication verifier.
 764                  */
 765
 766                 if(!smb_io_rpc_hdr_auth("", &auth_info, rpc_in_p, 0)) {
 767                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 768                         return False;
 769                 }
 770
 771                 /*
 772                  * We only support NTLMSSP_AUTH_TYPE requests.
 773                  */
 774
 775                 if(auth_info.auth_type != NTLMSSP_AUTH_TYPE) {
 776                         DEBUG(0,("api_pipe_bind_req: unknown auth type %x requested.\n",
 777                                 auth_info.auth_type ));
 778                         return False;
 779                 }
 780
 781                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, rpc_in_p, 0)) {
 782                         DEBUG(0,("api_pipe_bind_req: unable to unmarshall RPC_HDR_AUTH struct.\n"));
 783                         return False;
 784                 }
 785
 786                 if(!strequal(auth_verifier.signature, "NTLMSSP")) {
 787                         DEBUG(0,("api_pipe_bind_req: auth_verifier.signature != NTLMSSP\n"));
 788                         return False;
 789                 }
 790
 791                 if(auth_verifier.msg_type != NTLMSSP_NEGOTIATE) {
 792                         DEBUG(0,("api_pipe_bind_req: auth_verifier.msg_type (%d) != NTLMSSP_NEGOTIATE\n",
 793                                 auth_verifier.msg_type));
 794                         return False;
 795                 }
 796
 797                 if(!smb_io_rpc_auth_ntlmssp_neg("", &ntlmssp_neg, rpc_in_p, 0)) {
 798                         DEBUG(0,("api_pipe_bind_req: Failed to unmarshall RPC_AUTH_NTLMSSP_NEG.\n"));
 799                         return False;
 800                 }
 801
 802                 p->ntlmssp_chal_flags = SMBD_NTLMSSP_NEG_FLAGS;
 803                 p->ntlmssp_auth_requested = True;
 804         }
 805
 806         switch(p->hdr.pkt_type) {
 807                 case RPC_BIND:
 808                         /* name has to be \PIPE\xxxxx */
 809                         fstrcpy(ack_pipe_name, "\\PIPE\\");
 810                         fstrcat(ack_pipe_name, p->pipe_srv_name);
 811                         reply_pkt_type = RPC_BINDACK;
 812                         break;
 813                 case RPC_ALTCONT:
 814                         /* secondary address CAN be NULL
 815                          * as the specs say it's ignored.
 816                          * It MUST NULL to have the spoolss working.
 817                          */
 818                         fstrcpy(ack_pipe_name,"");
 819                         reply_pkt_type = RPC_ALTCONTRESP;
 820                         break;
 821                 default:
 822                         return False;
 823         }
 824
 825         DEBUG(5,("api_pipe_bind_req: make response. %d\n", __LINE__));
 826
 827         /*
 828          * Marshall directly into the outgoing PDU space. We
 829          * must do this as we need to set to the bind response
 830          * header and are never sending more than one PDU here.
 831          */
 832
 833         prs_init( &outgoing_rpc, 0, 4, MARSHALL);
 834         prs_give_memory( &outgoing_rpc, (char *)p->out_data.current_pdu, sizeof(p->out_data.current_pdu), False);
 835
 836         /*
 837          * Setup the memory to marshall the ba header, and the
 838          * auth footers.
 839          */
 840
 841         if(!prs_init(&out_hdr_ba, 1024, 4, MARSHALL)) {
 842                 DEBUG(0,("api_pipe_bind_req: malloc out_hdr_ba failed.\n"));
 843                 return False;
 844         }
 845
 846         if(!prs_init(&out_auth, 1024, 4, MARSHALL)) {
 847                 DEBUG(0,("pi_pipe_bind_req: malloc out_auth failed.\n"));
 848                 prs_mem_free(&out_hdr_ba);
 849                 return False;
 850         }
 851
 852         if (p->ntlmssp_auth_requested)
 853                 assoc_gid = 0x7a77;
 854         else
 855                 assoc_gid = hdr_rb.bba.assoc_gid;
 856
 857         /*
 858          * Create the bind response struct.
 859          */
 860
 861         /* If the requested abstract synt uuid doesn't match our client pipe,
 862                 reject the bind_ack & set the transfer interface synt to all 0's,
 863                 ver 0 (observed when NT5 attempts to bind to abstract interfaces
 864                 unknown to NT4)
 865                 Needed when adding entries to a DACL from NT5 - SK */
 866
 867         if(check_bind_req(p->name, &hdr_rb.abstract, &hdr_rb.transfer)) {
 868                 init_rpc_hdr_ba(&hdr_ba,
 869                         MAX_PDU_FRAG_LEN,
 870                         MAX_PDU_FRAG_LEN,
 871                         assoc_gid,
 872                         ack_pipe_name,
 873                         0x1, 0x0, 0x0,
 874                         &hdr_rb.transfer);
 875         } else {
 876                 RPC_IFACE null_interface;
 877                 ZERO_STRUCT(null_interface);
 878                 /* Rejection reason: abstract syntax not supported */
 879                 init_rpc_hdr_ba(&hdr_ba, MAX_PDU_FRAG_LEN,
 880                                         MAX_PDU_FRAG_LEN, assoc_gid,
 881                                         ack_pipe_name, 0x1, 0x2, 0x1,
 882                                         &null_interface);
 883         }
 884
 885         /*
 886          * and marshall it.
 887          */
 888
 889         if(!smb_io_rpc_hdr_ba("", &hdr_ba, &out_hdr_ba, 0)) {
 890                 DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_BA failed.\n"));
 891                 goto err_exit;
 892         }
 893
 894         /*
 895          * Now the authentication.
 896          */
 897
 898         if (p->ntlmssp_auth_requested) {
 899                 RPC_AUTH_VERIFIER auth_verifier;
 900                 RPC_AUTH_NTLMSSP_CHAL ntlmssp_chal;
 901
 902                 generate_random_buffer(p->challenge, 8, False);
 903
 904                 /*** Authentication info ***/
 905
 906                 init_rpc_hdr_auth(&auth_info, NTLMSSP_AUTH_TYPE, NTLMSSP_AUTH_LEVEL, RPC_HDR_AUTH_LEN, 1);
 907                 if(!smb_io_rpc_hdr_auth("", &auth_info, &out_auth, 0)) {
 908                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_HDR_AUTH failed.\n"));
 909                         goto err_exit;
 910                 }
 911
 912                 /*** NTLMSSP verifier ***/
 913
 914                 init_rpc_auth_verifier(&auth_verifier, "NTLMSSP", NTLMSSP_CHALLENGE);
 915                 if(!smb_io_rpc_auth_verifier("", &auth_verifier, &out_auth, 0)) {
 916                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_VERIFIER failed.\n"));
 917                         goto err_exit;
 918                 }
 919
 920                 /* NTLMSSP challenge ***/
 921
 922                 init_rpc_auth_ntlmssp_chal(&ntlmssp_chal, p->ntlmssp_chal_flags, p->challenge);
 923                 if(!smb_io_rpc_auth_ntlmssp_chal("", &ntlmssp_chal, &out_auth, 0)) {
 924                         DEBUG(0,("api_pipe_bind_req: marshalling of RPC_AUTH_NTLMSSP_CHAL failed.\n"));
 925                         goto err_exit;
 926                 }
 927
 928                 /* Auth len in the rpc header doesn't include auth_header. */
 929                 auth_len = prs_offset(&out_auth) - RPC_HDR_AUTH_LEN;
 930         }
 931
 932         /*
 933          * Create the header, now we know the length.
 934          */
 935
 936         init_rpc_hdr(&p->hdr, reply_pkt_type, RPC_FLG_FIRST | RPC_FLG_LAST,
 937                         p->hdr.call_id,
 938                         RPC_HEADER_LEN + prs_offset(&out_hdr_ba) + prs_offset(&out_auth),
 939                         auth_len);
 940
 941         /*
 942          * Marshall the header into the outgoing PDU.
 943          */
 944
 945         if(!smb_io_rpc_hdr("", &p->hdr, &outgoing_rpc, 0)) {
 946                 DEBUG(0,("pi_pipe_bind_req: marshalling of RPC_HDR failed.\n"));
 947                 goto err_exit;
 948         }
 949
 950         /*
 951          * Now add the RPC_HDR_BA and any auth needed.
 952          */
 953
 954         if(!prs_append_prs_data( &outgoing_rpc, &out_hdr_ba)) {
 955                 DEBUG(0,("api_pipe_bind_req: append of RPC_HDR_BA failed.\n"));
 956                 goto err_exit;
 957         }
 958
 959         if(p->ntlmssp_auth_requested && !prs_append_prs_data( &outgoing_rpc, &out_auth)) {
 960                 DEBUG(0,("api_pipe_bind_req: append of auth info failed.\n"));
 961                 goto err_exit;
 962         }
 963
 964         if(!p->ntlmssp_auth_requested)
 965                 p->pipe_bound = True;
 966
 967         /*
 968          * Setup the lengths for the initial reply.
 969          */
 970
 971         p->out_data.data_sent_length = 0;
 972         p->out_data.current_pdu_len = prs_offset(&outgoing_rpc);
 973         p->out_data.current_pdu_sent = 0;
 974
 975         prs_mem_free(&out_hdr_ba);
 976         prs_mem_free(&out_auth);
 977
 978         return True;
 979
 980   err_exit:
 981
 982         prs_mem_free(&out_hdr_ba);
 983         prs_mem_free(&out_auth);
 984         return False;
 985 }
 986
 987 /****************************************************************************
 988  Deal with sign & seal processing on an RPC request.
 989 ****************************************************************************/
 990
 991 BOOL api_pipe_auth_process(pipes_struct *p, prs_struct *rpc_in)
 992 {
 993         /*
 994          * We always negotiate the following two bits....
 995          */
 996         BOOL auth_verify = IS_BITS_SET_ALL(p->ntlmssp_chal_flags, NTLMSSP_NEGOTIATE_SIGN);
 997         BOOL auth_seal   = IS_BITS_SET_ALL(p->ntlmssp_chal_flags, NTLMSSP_NEGOTIATE_SEAL);
 998         int data_len;
 999         int auth_len;
1000         uint32 old_offset;
1001         uint32 crc32 = 0;
1002
1003         auth_len = p->hdr.auth_len;
1004
1005         if ((auth_len != RPC_AUTH_NTLMSSP_CHK_LEN) && auth_verify) {
1006                 DEBUG(0,("api_pipe_auth_process: Incorrect auth_len %d.\n", auth_len ));
1007                 return False;
1008         }
1009
1010         /*
1011          * The following is that length of the data we must verify or unseal.
1012          * This doesn't include the RPC headers or the auth_len or the RPC_HDR_AUTH_LEN
1013          * preceeding the auth_data.
1014          */
1015
1016         data_len = p->hdr.frag_len - RPC_HEADER_LEN - RPC_HDR_REQ_LEN -
1017                         (auth_verify ? RPC_HDR_AUTH_LEN : 0) - auth_len;
1018
1019         DEBUG(5,("api_pipe_auth_process: sign: %s seal: %s data %d auth %d\n",
1020                  BOOLSTR(auth_verify), BOOLSTR(auth_seal), data_len, auth_len));
1021
1022         if (auth_seal) {
1023                 /*
1024                  * The data in rpc_in doesn't contain the RPC_HEADER as this
1025                  * has already been consumed.
1026                  */
1027                 char *data = prs_data_p(rpc_in) + RPC_HDR_REQ_LEN;
1028                 NTLMSSPcalc_p(p, (uchar*)data, data_len);
1029                 crc32 = crc32_calc_buffer(data, data_len);
1030         }
1031
1032         old_offset = prs_offset(rpc_in);
1033
1034         if (auth_seal || auth_verify) {
1035                 RPC_HDR_AUTH auth_info;
1036
1037                 if(!prs_set_offset(rpc_in, old_offset + data_len)) {
1038                         DEBUG(0,("api_pipe_auth_process: cannot move offset to %u.\n",
1039                                 (unsigned int)old_offset + data_len ));
1040                         return False;
1041                 }
1042
1043                 if(!smb_io_rpc_hdr_auth("hdr_auth", &auth_info, rpc_in, 0)) {
1044                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_HDR_AUTH.\n"));
1045                         return False;
1046                 }
1047         }
1048
1049         if (auth_verify) {
1050                 RPC_AUTH_NTLMSSP_CHK ntlmssp_chk;
1051                 char *req_data = prs_data_p(rpc_in) + prs_offset(rpc_in) + 4;
1052
1053                 DEBUG(5,("api_pipe_auth_process: auth %d\n", prs_offset(rpc_in) + 4));
1054
1055                 /*
1056                  * Ensure we have RPC_AUTH_NTLMSSP_CHK_LEN - 4 more bytes in the
1057                  * incoming buffer.
1058                  */
1059                 if(prs_mem_get(rpc_in, RPC_AUTH_NTLMSSP_CHK_LEN - 4) == NULL) {
1060                         DEBUG(0,("api_pipe_auth_process: missing %d bytes in buffer.\n",
1061                                 RPC_AUTH_NTLMSSP_CHK_LEN - 4 ));
1062                         return False;
1063                 }
1064
1065                 NTLMSSPcalc_p(p, (uchar*)req_data, RPC_AUTH_NTLMSSP_CHK_LEN - 4);
1066                 if(!smb_io_rpc_auth_ntlmssp_chk("auth_sign", &ntlmssp_chk, rpc_in, 0)) {
1067                         DEBUG(0,("api_pipe_auth_process: failed to unmarshall RPC_AUTH_NTLMSSP_CHK.\n"));
1068                         return False;
1069                 }
1070
1071                 if (!rpc_auth_ntlmssp_chk(&ntlmssp_chk, crc32, p->ntlmssp_seq_num)) {
1072                         DEBUG(0,("api_pipe_auth_process: NTLMSSP check failed.\n"));
1073                         return False;
1074                 }
1075         }
1076
1077         /*
1078          * Return the current pointer to the data offset.
1079          */
1080
1081         if(!prs_set_offset(rpc_in, old_offset)) {
1082                 DEBUG(0,("api_pipe_auth_process: failed to set offset back to %u\n",
1083                         (unsigned int)old_offset ));
1084                 return False;
1085         }
1086
1087         return True;
1088 }
1089
1090 /****************************************************************************
1091  Find the correct RPC function to call for this request.
1092  If the pipe is authenticated then become the correct UNIX user
1093  before doing the call.
1094 ****************************************************************************/
1095
1096 BOOL api_pipe_request(pipes_struct *p)
1097 {
1098         int i = 0;
1099         BOOL ret = False;
1100         BOOL changed_user_id = False;
1101
1102         if (p->ntlmssp_auth_validated) {
1103
1104                 if(!become_authenticated_pipe_user(p)) {
1105                         prs_mem_free(&p->out_data.rdata);
1106                         return False;
1107                 }
1108
1109                 changed_user_id = True;
1110         }
1111
1112         for (i = 0; api_fd_commands[i].pipe_clnt_name; i++) {
1113                 if (strequal(api_fd_commands[i].pipe_clnt_name, p->name) &&
1114                     api_fd_commands[i].fn != NULL) {
1115                         DEBUG(3,("Doing \\PIPE\\%s\n", api_fd_commands[i].pipe_clnt_name));
1116                         ret = api_fd_commands[i].fn(p, &p->in_data.data);
1117                 }
1118         }
1119
1120         if(changed_user_id)
1121                 unbecome_authenticated_pipe_user(p);
1122
1123         return ret;
1124 }
1125
1126 /*******************************************************************
1127  Calls the underlying RPC function for a named pipe.
1128  ********************************************************************/
1129
1130 BOOL api_rpcTNP(pipes_struct *p, char *rpc_name, struct api_struct *api_rpc_cmds,
1131                                 prs_struct *rpc_in)
1132 {
1133         int fn_num;
1134         fstring name;
1135         uint32 offset1, offset2;
1136
1137         /* interpret the command */
1138         DEBUG(4,("api_rpcTNP: %s op 0x%x - ", rpc_name, p->hdr_req.opnum));
1139
1140         slprintf(name, sizeof(name), "in_%s", rpc_name);
1141         prs_dump(name, p->hdr_req.opnum, rpc_in);
1142
1143         for (fn_num = 0; api_rpc_cmds[fn_num].name; fn_num++) {
1144                 if (api_rpc_cmds[fn_num].opnum == p->hdr_req.opnum && api_rpc_cmds[fn_num].fn != NULL) {
1145                         DEBUG(3,("api_rpcTNP: rpc command: %s\n", api_rpc_cmds[fn_num].name));
1146                         break;
1147                 }
1148         }
1149
1150         if (api_rpc_cmds[fn_num].name == NULL) {
1151                 /*
1152                  * For an unknown RPC just return a fault PDU but
1153                  * return True to allow RPC's on the pipe to continue
1154                  * and not put the pipe into fault state. JRA.
1155                  */
1156                 DEBUG(4, ("unknown\n"));
1157                 setup_fault_pdu(p);
1158                 return True;
1159         }
1160
1161         offset1 = prs_offset(&p->out_data.rdata);
1162
1163         /* do the actual command */
1164         if(!api_rpc_cmds[fn_num].fn(rpc_in, &p->out_data.rdata)) {
1165                 DEBUG(0,("api_rpcTNP: %s: failed.\n", rpc_name));
1166                 prs_mem_free(&p->out_data.rdata);
1167                 return False;
1168         }
1169
1170         slprintf(name, sizeof(name), "out_%s", rpc_name);
1171         offset2 = prs_offset(&p->out_data.rdata);
1172         prs_set_offset(&p->out_data.rdata, offset1);
1173         prs_dump(name, p->hdr_req.opnum, &p->out_data.rdata);
1174         prs_set_offset(&p->out_data.rdata, offset2);
1175
1176         DEBUG(5,("api_rpcTNP: called %s successfully\n", rpc_name));
1177
1178         return True;
1179 }
1180
1181 #undef OLD_NTDOMAIN